@fayegram-ai/decision-bridge 0.1.1 → 0.1.3

package/src/live/index.mjs

@@ -0,0 +1,170 @@
+import { DecisionError, requireCondition as check, publicError } from '../errors.mjs';
+import { optionsObject } from '../options.mjs';
+import { deadline, validateSignal, withSignal } from '../async.mjs';
+import { freezeJson } from '../validation.mjs';
+import { serializeRequestBody } from '../transport.mjs';
+import { validateLiveCommand, validateLiveConfiguration, validateLiveEvent } from './validation.mjs';
+import { createLiveState } from './state.mjs';
+
+export { validateLiveCommand, validateLiveConfiguration, validateLiveEvent } from './validation.mjs';
+
+/** Own Decisions commands and correlation, while the application owns its connection. */
+export function createLiveDecisions(options) {
+    const { transport, configuration, timeoutMs = 30000, maxPending = 128, maxHistory = 4096,
+        maxRequestBytes = 8 * 1024 * 1024, maxResponseBytes = 8 * 1024 * 1024 } = optionsObject(options,
+        ['transport', 'configuration', 'timeoutMs', 'maxPending', 'maxHistory', 'maxRequestBytes', 'maxResponseBytes'], 'Live controller options');
+    check(transport && typeof transport.send === 'function' && typeof transport.subscribe === 'function',
+        'Live requires a supplied connection adapter.', 'CONFIGURATION_ERROR');
+    for (const value of [maxPending, maxHistory]) check(Number.isSafeInteger(value) && value > 0,
+        'Live history and pending budgets must be positive integers.', 'CONFIGURATION_ERROR');
+    for (const value of [maxRequestBytes, maxResponseBytes]) check(Number.isSafeInteger(value) && value > 0 && value <= 64 * 1024 * 1024,
+        'Live byte budgets must be within 1 to 64 MiB.', 'CONFIGURATION_ERROR');
+    check(Number.isSafeInteger(timeoutMs) && timeoutMs > 0 && timeoutMs <= 2147483647, 'Invalid Live timeout.', 'CONFIGURATION_ERROR');
+    const state = createLiveState({ configuration, maxHistory });
+    const observers = new Set();
+    const pending = new Map();
+    const prefix = globalThis.crypto.randomUUID();
+    let sequence = 0;
+    let closed = false;
+    let closeError;
+    const lifetime = new AbortController();
+    let unsubscribe;
+    const failure = (code, message) => new DecisionError(message, { code, source: 'client' });
+
+    function notify(event) {
+        const immutable = freezeJson(event);
+        // Subscription changes affect later deliveries, never revisit a recipient.
+        for (const observer of [...observers]) {
+            if (!observers.has(observer)) continue;
+            const failed = () => {
+                if (event.type !== 'observer_error' && !closed) notify({ type: 'observer_error',
+                    error: { code: 'OBSERVER_ERROR', message: 'A Live observer failed.' } });
+            };
+            try { Promise.resolve(observer(immutable)).catch(failed); } catch { failed(); }
+        }
+    }
+    function detach() {
+        const cleanup = unsubscribe;
+        unsubscribe = undefined;
+        try { cleanup?.(); } catch { /* Application cleanup cannot retain pending work. */ }
+    }
+    function close(code, message, report = true) {
+        if (closed) return;
+        closed = true;
+        closeError = failure(code, message);
+        lifetime.abort();
+        for (const wait of pending.values()) wait.reject(failure(code, message));
+        pending.clear();
+        detach();
+        state.clear();
+        if (report) notify({ type: 'closed', error: { code, message } });
+        observers.clear();
+    }
+    function receive(notification) {
+        if (closed) return;
+        if (notification?.kind === 'close' || notification?.kind === 'error') {
+            close(notification.kind === 'close' ? 'CONNECTION_CLOSED' : 'NETWORK_ERROR', 'The supplied Live connection ended.');
+            return;
+        }
+        try {
+            check(notification?.kind === 'event', 'Invalid connection notification.', 'INVALID_RESPONSE');
+            const event = validateLiveEvent(notification.event);
+            try { serializeRequestBody(event, maxResponseBytes); }
+            catch (error) {
+                if (error.code === 'REQUEST_TOO_LARGE') throw failure('RESPONSE_TOO_LARGE', 'Live event exceeds the client byte budget.');
+                throw error;
+            }
+            const normalized = state.accept(event);
+            const clientId = event.error?.client_event_id ?? event.client_event_id;
+            const wait = clientId ? pending.get(clientId) : undefined;
+            if (normalized?.type !== 'duplicate' && wait) {
+                if (event.type === 'error') wait.reject(new DecisionError(normalized.error.message, normalized.error));
+                else if (event.type === wait.expected) {
+                    const mismatched = event.type === 'decision.item.deleted' && event.item_id !== wait.command.item_id ||
+                        event.type === 'decision.item.created' && wait.command.item.id && event.item.id !== wait.command.item.id;
+                    if (mismatched) {
+                        const error = failure('INVALID_RESPONSE', 'Item acknowledgement does not match the command.');
+                        wait.reject(error);
+                        throw error;
+                    }
+                    wait.resolve(normalized);
+                }
+            }
+            if (normalized) notify(normalized);
+            if (event.type === 'session.closed') close('CONNECTION_CLOSED', 'The Live session closed.', false);
+        } catch (error) { notify({ type: 'error', error: publicError(error) }); }
+    }
+    try { unsubscribe = transport.subscribe(receive); }
+    catch { throw failure('NETWORK_ERROR', 'Cannot subscribe to the supplied Live connection.'); }
+    check(typeof unsubscribe === 'function', 'Live transport subscribe must return an unsubscribe function.', 'CONFIGURATION_ERROR');
+    if (closed) detach();
+
+    async function send(type, body, expected, options = {}) {
+        const { signal, timeoutMs: callTimeoutMs = timeoutMs } = optionsObject(options, ['signal', 'timeoutMs'], 'Live call options');
+        check(!closed, 'Live controller is closed.', 'CONNECTION_CLOSED');
+        check(pending.size < maxPending, 'Live pending operations exceed the client resource budget.', 'RESOURCE_LIMIT');
+        validateSignal(signal);
+        const budget = deadline(callTimeoutMs, signal ? AbortSignal.any([signal, lifetime.signal]) : lifetime.signal);
+        let command;
+        try {
+            budget.throwIfAborted();
+            command = validateLiveCommand({ ...body, type, event_id: `${prefix}_${++sequence}` });
+            budget.throwIfAborted();
+        } catch (error) {
+            budget.close();
+            if (budget.timedOut) throw failure('TIMEOUT', 'Live command deadline exceeded.');
+            throw error;
+        }
+        let observed = false;
+        let resolve;
+        let reject;
+        const acknowledged = expected ? new Promise((yes, no) => { resolve = yes; reject = no; }) : undefined;
+        acknowledged?.catch(() => {});
+        // Submission-only calls are tracked too, so disposal interrupts a stalled send.
+        const stopped = new Promise((_yes, no) => {
+            pending.set(command.event_id, { resolve, reject: no, expected, command });
+        });
+        stopped.catch(() => {});
+        if (expected) pending.get(command.event_id).reject = error => { reject(error); };
+        try {
+            budget.throwIfAborted();
+            serializeRequestBody(command, maxRequestBytes);
+            const dispatched = Promise.resolve().then(() => {
+                budget.throwIfAborted();
+                // Unsent updates cannot change the accepted configuration. Observe
+                // just before send so synchronous acknowledgements still correlate.
+                state.observeClient(command);
+                observed = true;
+                return transport.send(command);
+            });
+            // Acknowledgement can arrive synchronously from a supplied transport.
+            await withSignal(Promise.race([dispatched, expected ? acknowledged.then(() => undefined) : stopped]), budget.signal);
+            if (expected) return await withSignal(acknowledged, budget.signal);
+            budget.throwIfAborted();
+            return freezeJson({ eventId: command.event_id, type, status: 'submitted' });
+        } catch (error) {
+            if (observed) state.abandon(command);
+            if (budget.timedOut) throw failure('TIMEOUT', 'Live command deadline exceeded.');
+            if (signal?.aborted) throw failure('ABORTED', 'Live command cancelled.');
+            if (closed) throw closeError;
+            if (error instanceof DecisionError) throw error;
+            throw failure('NETWORK_ERROR', 'Live command submission failed.');
+        } finally { pending.delete(command.event_id); budget.close(); }
+    }
+    return Object.freeze({
+        configure(config, call) { return send('session.update', { session: config }, 'session.updated', call); },
+        createItem(item, call) { return send('decision.item.create', { item }, 'decision.item.created', call); },
+        deleteItem(itemId, call) { return send('decision.item.delete', { item_id: itemId }, 'decision.item.deleted', call); },
+        requestDecision(call) { return send('decision.create', {}, undefined, call); },
+        appendCommentary(content, options = {}) {
+            const { delegationId = null, ...call } = optionsObject(options, ['delegationId', 'signal', 'timeoutMs'], 'Commentary options');
+            return send('session.commentary.append', { content, delegation_id: delegationId }, undefined, call);
+        },
+        subscribe(observer) {
+            check(!closed && typeof observer === 'function', 'Live subscription requires an open controller and function.', 'CONFIGURATION_ERROR');
+            observers.add(observer);
+            return () => observers.delete(observer);
+        },
+        dispose() { close('DISPOSED', 'Live controller disposed.'); },
+    });
+}

package/src/live/state.mjs

@@ -0,0 +1,125 @@
+import { freezeJson } from '../validation.mjs';
+import { requireCondition as check } from '../errors.mjs';
+import { validateDecisionResponse } from '../providers/decisions-validation.mjs';
+import { TRANSCRIPTS, configurationFromSession, validateLiveConfiguration } from './validation.mjs';
+import { openaiError } from '../providers/openai-errors.mjs';
+
+/** Bounded correlation history. Evicted sources become unmatched, never guessed. */
+export function createLiveState({ configuration, maxHistory = 4096 } = {}) {
+    let config = configuration === undefined ? undefined : validateLiveConfiguration(configuration);
+    let generation = 0;
+    let sequence = 0;
+    let lostConfigurationHistory = false;
+    let closed = false;
+    const sources = new Map();
+    const delegations = new Map();
+    const seen = new Map();
+    const pendingConfigurations = new Map();
+    const latest = new Map();
+    function remember(map, key, value) {
+        map.set(key, value);
+        if (map.size > maxHistory) map.delete(map.keys().next().value);
+    }
+    function questionsFor(type) {
+        if (!config || pendingConfigurations.size || lostConfigurationHistory) return undefined;
+        if (type === 'delegation') return config.delegation?.decisions.questions;
+        const matches = config.triggers?.filter(trigger => trigger.event_type === type) ?? [];
+        return matches.length === 1 ? matches[0].decisions.questions : undefined;
+    }
+    function clear() {
+        closed = true;
+        config = undefined;
+        lostConfigurationHistory = false;
+        for (const map of [sources, delegations, seen, pendingConfigurations, latest]) map.clear();
+    }
+    return {
+        clear,
+        observeClient(command) {
+            check(!closed, 'Live session is closed.', 'CONNECTION_CLOSED');
+            if (command.type === 'session.update') {
+                // Offline logs may omit optional IDs. Without one no acknowledgement
+                // can prove which update completed; do not guess a source snapshot.
+                if (!command.event_id) { lostConfigurationHistory = true; return; }
+                // An evicted unresolved update can still take effect upstream. Retain
+                // uncertainty even after all remaining IDs have been acknowledged.
+                if (!pendingConfigurations.has(command.event_id) && pendingConfigurations.size >= maxHistory) lostConfigurationHistory = true;
+                remember(pendingConfigurations, command.event_id, true);
+            }
+        },
+        abandon(command) {
+            // Do not assume a timed-out update failed server-side. Its effect is unknown
+            // until a resolved snapshot arrives, so source correlation stays conservative.
+            // A correlated acknowledgement/rejection already removed this marker;
+            // known rejection leaves the previous accepted configuration intact.
+            if (command.type === 'session.update' && pendingConfigurations.has(command.event_id)) config = undefined;
+        },
+        accept(event) {
+            check(!closed, 'Live session is closed.', 'CONNECTION_CLOSED');
+            if (seen.has(event.event_id)) return freezeJson({ type: 'duplicate', eventId: event.event_id, eventType: event.type });
+            remember(seen, event.event_id, true);
+            const base = { eventId: event.event_id, eventType: event.type };
+            if (['session.created', 'session.updated'].includes(event.type)) {
+                config = configurationFromSession(event.session);
+                generation++;
+                if (event.client_event_id) pendingConfigurations.delete(event.client_event_id);
+                return freezeJson({ type: 'configuration', ...base, configuration: config, generation });
+            }
+            if (TRANSCRIPTS.includes(event.type)) {
+                const snapshot = { type: event.type, sequence: ++sequence, generation,
+                    questions: questionsFor(event.type) };
+                remember(sources, event.event_id, snapshot);
+                return freezeJson({ type: 'transcript', ...base, direction: event.type === TRANSCRIPTS[0] ? 'input' : 'output',
+                    delta: event.delta, sequence: snapshot.sequence });
+            }
+            if (event.type === 'session.delegation.created' && event.delegation.target === 'decisions') {
+                remember(delegations, event.delegation.id, { generation, questions: questionsFor('delegation') });
+                return freezeJson({ type: 'delegation', ...base, delegationId: event.delegation.id });
+            }
+            if (event.type === 'decision.event') {
+                // Mixed origins are observable but cannot establish one trustworthy snapshot.
+                const triggerOrigin = event.delegation_id === null && event.trigger_id !== null &&
+                    event.source_event_id !== null && event.source_event_type !== null;
+                const delegationOrigin = event.delegation_id !== null && event.trigger_id === null &&
+                    event.source_event_id === null && event.source_event_type === null;
+                const observedSource = triggerOrigin ? sources.get(event.source_event_id) : undefined;
+                const source = observedSource?.type === event.source_event_type ? observedSource : undefined;
+                const snapshot = source ?? (delegationOrigin ? delegations.get(event.delegation_id) : undefined);
+                let matched = !!snapshot?.questions;
+                let reason = 'source_or_configuration_unavailable';
+                const decision = validateDecisionResponse(event.event.decision, undefined, { allowRefusals: true });
+                if (matched) {
+                    try { validateDecisionResponse(decision, { questions: snapshot.questions }, { allowRefusals: true }); }
+                    catch { matched = false; reason = 'configuration_mismatch'; }
+                }
+                let stale = false;
+                // Transcript order is known even when the question snapshot is not.
+                // Only an observed ID with the same direction can advance that order.
+                if (source) {
+                    stale = source.sequence <= (latest.get(source.type) ?? -1);
+                    if (!stale) latest.set(source.type, source.sequence);
+                }
+                if (delegationOrigin) delegations.delete(event.delegation_id);
+                return freezeJson({ type: 'decision', ...base, decision,
+                    correlation: { matched, stale, sourceEventId: event.source_event_id, sourceEventType: event.source_event_type,
+                        delegationId: event.delegation_id, triggerId: event.trigger_id,
+                        ...(matched ? { generation: snapshot.generation } : { reason }) } });
+            }
+            if (event.type === 'error') {
+                const hint = event.error.type === 'rate_limit_error' ? 429 : 400;
+                // Live supplies protocol errors, not an HTTP response/status.
+                const { status: _status, ...error } = openaiError({ error: event.error }, hint).toJSON();
+                const clientEventId = event.error.client_event_id ?? event.client_event_id;
+                if (clientEventId) pendingConfigurations.delete(clientEventId);
+                return freezeJson({ type: 'error', ...base, error, ...(clientEventId ? { clientEventId } : {}) });
+            }
+            if (event.type === 'session.closed') {
+                clear();
+                return freezeJson({ type: 'closed', ...base });
+            }
+            if (['decision.item.created', 'decision.item.deleted'].includes(event.type)) {
+                return freezeJson({ type: 'item', ...base, ...(event.item ? { item: event.item } : { itemId: event.item_id }) });
+            }
+            return undefined;
+        },
+    };
+}

package/src/live/validation.mjs

@@ -0,0 +1,122 @@
+import { DecisionError, requireCondition as check } from '../errors.mjs';
+import { cloneJson, freezeJson, isRecord } from '../validation.mjs';
+import { fields, validateDecisionQuestions } from '../providers/decisions-input.mjs';
+import { validateDecisionResponse } from '../providers/decisions-validation.mjs';
+import { validateImage } from '../input.mjs';
+
+export const TRANSCRIPTS = ['session.input_transcript.delta', 'session.output_transcript.delta'];
+const text = value => typeof value === 'string' && value.length > 0;
+const nullableId = value => value === null || text(value);
+
+export function validateLiveConfiguration(input) {
+    const config = cloneJson(input, 'Live Decisions configuration');
+    fields(config, ['delegation', 'triggers'], [], 'Live configuration');
+    if (config.delegation !== undefined) {
+        fields(config.delegation, ['type', 'decisions'], ['type', 'decisions'], 'delegation');
+        check(config.delegation.type === 'decisions', 'This controller configures Decisions delegation.');
+        fields(config.delegation.decisions, ['model', 'questions'], [], 'delegation decisions');
+        const decisions = config.delegation.decisions;
+        check(decisions.model === undefined || decisions.model === 'gpt-6-luna', 'Unsupported Live Decisions model.');
+        if (decisions.questions !== undefined) validateDecisionQuestions(decisions.questions);
+    }
+    if (config.triggers !== undefined) {
+        check(Array.isArray(config.triggers), 'triggers must be an array.');
+        for (const trigger of config.triggers) {
+            fields(trigger, ['type', 'event_type', 'decisions'], ['type', 'event_type', 'decisions'], 'trigger');
+            check(trigger.type === 'decisions' && TRANSCRIPTS.includes(trigger.event_type), 'Invalid Decisions trigger.');
+            fields(trigger.decisions, ['questions'], ['questions'], 'trigger decisions');
+            validateDecisionQuestions(trigger.decisions.questions);
+        }
+    }
+    return freezeJson(config);
+}
+
+function item(input, created = false) {
+    fields(input, ['id', 'type', 'role', 'content'], ['role', 'content', ...(created ? ['id'] : [])], 'Decision input item');
+    check(input.role === 'user' && (input.type === undefined || input.type === 'message'), 'Live Decision items are user messages.');
+    check(created ? text(input.id) : input.id === undefined || input.id === null || text(input.id), 'Invalid item ID.');
+    if (typeof input.content !== 'string') {
+        check(Array.isArray(input.content) && input.content.length > 0, 'Live item requires content.');
+        for (const part of input.content) {
+            if (part?.type === 'input_text') {
+                fields(part, ['type', 'text'], ['type', 'text'], 'Live text part');
+                check(typeof part.text === 'string', 'Live text must be a string.');
+            } else {
+                fields(part, ['type', 'image_url', 'detail'], ['type', 'image_url'], 'Live image part');
+                check(part.type === 'input_image', 'Unsupported Live input part.');
+                validateImage(part.image_url, part.detail);
+            }
+        }
+    }
+}
+
+export function validateLiveCommand(input) {
+    const command = cloneJson(input, 'Live command');
+    check(isRecord(command) && typeof command.type === 'string', 'Live command requires a type.');
+    check(command.event_id === undefined || command.event_id === null || text(command.event_id), 'Invalid client event ID.');
+    const base = ['type', 'event_id'];
+    if (command.type === 'session.update') {
+        fields(command, [...base, 'session'], ['type', 'session'], 'session update');
+        validateLiveConfiguration(command.session);
+    } else if (command.type === 'decision.item.create') {
+        fields(command, [...base, 'item'], ['type', 'item'], 'item create');
+        item(command.item);
+    } else if (command.type === 'decision.item.delete') {
+        fields(command, [...base, 'item_id'], ['type', 'item_id'], 'item delete');
+        check(text(command.item_id), 'Item delete requires an ID.');
+    } else if (command.type === 'decision.create') {
+        fields(command, base, base, 'decision create');
+        check(text(command.event_id), 'Manual evaluation requires an event ID.');
+    } else {
+        fields(command, [...base, 'delegation_id', 'content'], ['type', 'delegation_id', 'content'], 'commentary');
+        check(command.type === 'session.commentary.append' && nullableId(command.delegation_id) &&
+            typeof command.content === 'string', 'Invalid commentary command.');
+    }
+    return freezeJson(command);
+}
+
+/** Only inspect the Decisions subset of full Live session snapshots. */
+export function configurationFromSession(session) {
+    const result = {};
+    if (session.delegation?.type === 'decisions') result.delegation = session.delegation;
+    if (Array.isArray(session.triggers)) result.triggers = session.triggers.filter(trigger => trigger.type === 'decisions');
+    return validateLiveConfiguration(result);
+}
+
+export function validateLiveEvent(input) {
+    // Nested request validators are reused below, but server content must leave
+    // this boundary as a response error. Unknown exceptions never expose text.
+    try { return validateServerEvent(input); }
+    catch (error) {
+        if (error instanceof DecisionError) {
+            if (error.code === 'INVALID_RESPONSE') throw error;
+            throw new DecisionError(error.message, { ...error.toJSON(), code: 'INVALID_RESPONSE' });
+        }
+        throw new DecisionError('Invalid Live server event.', { code: 'INVALID_RESPONSE' });
+    }
+}
+
+function validateServerEvent(input) {
+    const event = cloneJson(input, 'Live event', 'INVALID_RESPONSE');
+    const invalid = (condition, message) => check(condition, message, 'INVALID_RESPONSE');
+    invalid(isRecord(event) && text(event.type) && text(event.event_id), 'Live server events require type and event_id.');
+    invalid(event.client_event_id === undefined || text(event.client_event_id), 'Invalid acknowledgement correlation ID.');
+    if (event.type === 'decision.event') {
+        invalid(nullableId(event.delegation_id) && nullableId(event.trigger_id) && nullableId(event.source_event_id) &&
+            (event.source_event_type === null || TRANSCRIPTS.includes(event.source_event_type)) &&
+            event.event?.type === 'decision.completed', 'Invalid Decision event envelope.');
+        validateDecisionResponse(event.event.decision, undefined, { allowRefusals: true });
+    } else if (TRANSCRIPTS.includes(event.type)) {
+        invalid(typeof event.delta === 'string' && Number.isFinite(event.start_ms) && Number.isFinite(event.end_ms) &&
+            event.start_ms >= 0 && event.end_ms >= event.start_ms, 'Invalid transcript delta.');
+    } else if (['session.created', 'session.updated', 'session.closed'].includes(event.type)) {
+        invalid(isRecord(event.session), 'Missing Live session snapshot.');
+        configurationFromSession(event.session);
+    } else if (event.type === 'decision.item.created') item(event.item, true);
+    else if (event.type === 'decision.item.deleted') invalid(text(event.item_id), 'Missing deleted item ID.');
+    else if (event.type === 'session.delegation.created') invalid(isRecord(event.delegation) && text(event.delegation.id) &&
+        ['client', 'responses', 'decisions'].includes(event.delegation.target), 'Invalid delegation metadata.');
+    else if (event.type === 'error') invalid(isRecord(event.error) && text(event.error.code) && text(event.error.type) &&
+        (event.error.client_event_id === undefined || text(event.error.client_event_id)), 'Invalid Live error.');
+    return freezeJson(event);
+}

package/src/probabilities.mjs

@@ -6,14 +6,17 @@ export function validateResultOptions(options) {
         [Object.prototype, null].includes(Object.getPrototypeOf(options)) &&
         Object.getOwnPropertySymbols(options).length === 0 &&
         Object.entries(Object.getOwnPropertyDescriptors(options)).every(([key, descriptor]) =>
-            ['native', 'probabilityDecimalPlaces'].includes(key) && descriptor.enumerable && 'value' in descriptor),
+            ['native', 'nullableUsage', 'probabilityDecimalPlaces'].includes(key) && descriptor.enumerable && 'value' in descriptor),
     'Result-validation options contain an unknown field or accessor.', 'CONFIGURATION_ERROR');
-    const { native = false, probabilityDecimalPlaces } = options;
+    // Only own data fields select policy; inherited values and getters are not settings.
+    const { native = false, nullableUsage = false, probabilityDecimalPlaces } = Object.assign(Object.create(null), options);
     check(typeof native === 'boolean', 'native must be boolean.', 'CONFIGURATION_ERROR');
+    check(typeof nullableUsage === 'boolean', 'nullableUsage must be boolean.', 'CONFIGURATION_ERROR');
     check(probabilityDecimalPlaces === undefined || (Number.isSafeInteger(probabilityDecimalPlaces) &&
         probabilityDecimalPlaces >= 1 && probabilityDecimalPlaces <= 15),
     'probabilityDecimalPlaces must be an integer from 1 to 15.', 'CONFIGURATION_ERROR');
-    return { native, ...(probabilityDecimalPlaces === undefined ? {} : { probabilityDecimalPlaces }) };
+    // Keep even an omitted precision as an own value when callers read this policy again.
+    return { native, nullableUsage, probabilityDecimalPlaces };
 }
 
 /** Preserve native numbers. Only grid-aligned values receive the rounding budget. */

package/src/providers/cloudflare-images.mjs

@@ -1,69 +1,12 @@
 import { requireCondition as check } from '../errors.mjs';
 import { validateImage } from '../input.mjs';
 import { isRecord } from '../validation.mjs';
+import { imageDimensions } from './image-header.mjs';
 
 const FORMATS = ['image/png', 'image/jpeg', 'image/webp'];
-const checkImage = condition => check(condition, 'Invalid embedded image header or dimensions.', 'VALIDATION_ERROR');
-const ascii = (bytes, start, length) => String.fromCharCode(...bytes.subarray(start, start + length));
-
-function dimensions(bytes, format) {
-    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-    if (format === 'image/png') {
-        checkImage(bytes.length >= 33 && [137, 80, 78, 71, 13, 10, 26, 10].every((value, i) => bytes[i] === value) &&
-            view.getUint32(8) === 13 && ascii(bytes, 12, 4) === 'IHDR');
-        return [view.getUint32(16), view.getUint32(20)];
-    }
-    if (format === 'image/jpeg') {
-        checkImage(bytes.length >= 4 && bytes[0] === 255 && bytes[1] === 216);
-        let offset = 2;
-        while (offset < bytes.length) {
-            checkImage(bytes[offset++] === 255);
-            while (offset < bytes.length && bytes[offset] === 255) offset++;
-            checkImage(offset < bytes.length);
-            const marker = bytes[offset++];
-            if (marker === 217 || marker === 218) break;
-            if (marker === 1 || (marker >= 208 && marker <= 215)) continue;
-            checkImage(offset + 2 <= bytes.length);
-            const length = view.getUint16(offset);
-            checkImage(length >= 2 && offset + length <= bytes.length);
-            if ([192, 193, 194, 195, 197, 198, 199, 201, 202, 203, 205, 206, 207].includes(marker)) {
-                checkImage(length >= 8 && bytes[offset + 7] > 0 && length >= 8 + 3 * bytes[offset + 7]);
-                return [view.getUint16(offset + 5), view.getUint16(offset + 3)];
-            }
-            offset += length;
-        }
-        checkImage(false);
-    }
-    checkImage(bytes.length >= 20 && ascii(bytes, 0, 4) === 'RIFF' && ascii(bytes, 8, 4) === 'WEBP' &&
-        view.getUint32(4, true) + 8 === bytes.length);
-    const little24 = offset => bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16;
-    for (let offset = 12; offset + 8 <= bytes.length;) {
-        const kind = ascii(bytes, offset, 4);
-        const length = view.getUint32(offset + 4, true);
-        const start = offset + 8;
-        checkImage(start + length <= bytes.length);
-        if (kind === 'VP8X') {
-            checkImage(length === 10);
-            return [little24(start + 4) + 1, little24(start + 7) + 1];
-        }
-        if (kind === 'VP8L') {
-            checkImage(length >= 5 && bytes[start] === 47 && (bytes[start + 4] >> 5) === 0);
-            return [1 + (bytes[start + 1] | (bytes[start + 2] & 63) << 8),
-                1 + (bytes[start + 2] >> 6 | bytes[start + 3] << 2 | (bytes[start + 4] & 15) << 10)];
-        }
-        if (kind === 'VP8 ') {
-            checkImage(length >= 10 && ascii(bytes, start + 3, 3) === '\x9d\x01\x2a');
-            return [view.getUint16(start + 6, true) & 16383, view.getUint16(start + 8, true) & 16383];
-        }
-        offset = start + length + length % 2;
-    }
-    checkImage(false);
-}
-
 /** Inspect bounded embedded bytes; this is header validation, not full image decoding. */
 export function validateCloudflareImages(images) {
-    check(Array.isArray(images) && images.length <= 4, 'Cloudflare accepts at most four images.');
-    let total = 0;
+    check(Array.isArray(images), 'Cloudflare images must be an array.');
     for (const image of images) {
         let format, payload;
         if (typeof image === 'string') {
@@ -80,16 +23,11 @@ export function validateCloudflareImages(images) {
             payload = image.base64;
         }
         validateImage('data:' + format + ';base64,' + payload);
-        const padding = payload.endsWith('==') ? 2 : payload.endsWith('=') ? 1 : 0;
-        const size = payload.length / 4 * 3 - padding;
-        check(size <= 4 * 1024 * 1024, 'Cloudflare images must be within 4 MiB each.', 'REQUEST_TOO_LARGE');
-        total += size;
-        check(total <= 8 * 1024 * 1024, 'Cloudflare images exceed 8 MiB total.', 'REQUEST_TOO_LARGE');
         const decoded = atob(payload);
         const bytes = new Uint8Array(decoded.length);
         for (let i = 0; i < decoded.length; i++) bytes[i] = decoded.charCodeAt(i);
-        const [width, height] = dimensions(bytes, format);
-        check(width > 0 && height > 0 && width * height <= 16000000,
-            'Cloudflare images must have positive dimensions within 16 million pixels.');
+        const [width, height] = imageDimensions(bytes, format);
+        check(width > 0 && height > 0,
+            'Cloudflare images must have positive dimensions.');
     }
 }

package/src/providers/cloudflare-media.mjs

@@ -1,21 +1,19 @@
 import { requireCondition as check } from '../errors.mjs';
 import { embeddedDataUrl, base64ByteLength } from '../embedded.mjs';
 import { isRecord } from '../validation.mjs';
-import { mediaBytes, checkMediaDuration } from './media-binary.mjs';
+import { mediaBytes } from './media-binary.mjs';
 import { inspectWav, inspectMp3 } from './cloudflare-audio.mjs';
 import { inspectMp4, inspectWebm } from './cloudflare-video.mjs';
 
 const INSPECTORS = { 'audio/wav': inspectWav, 'audio/x-wav': inspectWav, 'audio/mpeg': inspectMp3,
     'audio/mp3': inspectMp3, 'video/mp4': inspectMp4, 'video/webm': inspectWebm };
-const MIB = 1024 * 1024;
 
-/** Counts/decoded sizes are checked before container inspection; no runtime codec dependency. */
+/** Inspect supported containers; admission counts, sizes and duration are server-owned. */
 export function validateCloudflareMedia(request) {
-    let total = 0;
-    for (const [field, kind, count, bytes, seconds] of [['audio', 'audio', 4, 8 * MIB, 300], ['videos', 'video', 2, 16 * MIB, 60]]) {
+    for (const [field, kind] of [['audio', 'audio'], ['videos', 'video']]) {
         if (!Object.hasOwn(request, field)) continue;
         const items = request[field];
-        check(Array.isArray(items) && items.length <= count, 'Cloudflare media count exceeds its limit.');
+        check(Array.isArray(items), 'Cloudflare media must be an array.');
         for (const item of items) {
             let media;
             if (typeof item === 'string') media = embeddedDataUrl(item, kind);
@@ -27,10 +25,7 @@ export function validateCloudflareMedia(request) {
             }
             check(media.format.startsWith(kind + '/') && Object.hasOwn(INSPECTORS, media.format),
                 'Cloudflare audio/video format is unsupported.', 'UNSUPPORTED_CAPABILITY');
-            check(media.size <= bytes, 'Cloudflare media exceeds its decoded byte limit.', 'REQUEST_TOO_LARGE');
-            total += media.size;
-            check(total <= 16 * MIB, 'Cloudflare audio/video exceeds 16 MiB combined.', 'REQUEST_TOO_LARGE');
-            checkMediaDuration(INSPECTORS[media.format](mediaBytes(media.payload, media.size)), seconds);
+            INSPECTORS[media.format](mediaBytes(media.payload, media.size));
         }
     }
 }

package/src/providers/cloudflare-preflight.mjs

@@ -20,7 +20,9 @@ function settingsFor(options) {
 
 export function cloudflareBindingBody(request, gateway) {
     const { options, ...inputs } = request;
-    return { inputs, options: { returnRawResponse: true, rejectIfBusy: options?.rejectIfBusy ?? false,
+    const { rejectIfBusy = false, ...inference } = options ?? {};
+    return { inputs: { ...inputs, ...(Object.keys(inference).length ? { options: inference } : {}) },
+        options: { returnRawResponse: true, rejectIfBusy,
         ...(gateway ? { gateway } : {}) } };
 }
 
@@ -35,9 +37,8 @@ export function preflightCloudflareDecision(input, options = {}) {
     check(model === 'clef-omni' || !['audio', 'videos'].some(key => Object.hasOwn(request, key)),
         'Audio and video require clef-omni.', 'UNSUPPORTED_CAPABILITY');
     const common = validateRequest({ model, state: request.state, questions: request.questions }, model);
-    check(Object.keys(common.questions).length <= 64, 'Cloudflare accepts at most 64 questions.');
     for (const [id, question] of Object.entries(common.questions)) {
-        check(/^[A-Za-z0-9_.-]{1,100}$/.test(id), 'Cloudflare question IDs must use letters, digits, _, ., or - within 100 characters.');
+        check(/^[A-Za-z0-9_.-]+$/.test(id), 'Cloudflare question IDs must use letters, digits, _, ., or -.');
         check(!Object.hasOwn(question, 'options') && !Object.hasOwn(question, 'levels'),
             'Cloudflare native questions use criteria; typed choices and levels belong to the common API.');
         if (question.type === 'choice') check(Object.keys(question.criteria).length >= 2,