@giveitsmaller/contracts 0.18.0 → 0.21.0

package/dist/operations/compress.metadata.js

@@ -26,7 +26,23 @@ export const compressMetadata = {
                     per_value_availability: {},
                 },
                 output_format: {
-                    per_value_availability: {},
+                    per_value_availability: {
+                        auto: {
+                            availability: 'planned',
+                        },
+                        smallest: {
+                            availability: 'planned',
+                        },
+                        jpeg: {
+                            availability: 'planned',
+                        },
+                        png: {
+                            availability: 'planned',
+                        },
+                        avif: {
+                            availability: 'planned',
+                        },
+                    },
                 },
             },
             per_input_options: {},
@@ -35,6 +51,9 @@ export const compressMetadata = {
             processing_class: {},
             per_mime_availability: {},
             options: {
+                output_format: {
+                    per_value_availability: {},
+                },
                 bitrate: {
                     per_value_availability: {},
                 },
@@ -80,16 +99,34 @@ export const compressMetadata = {
             },
             per_mime_availability: {},
             options: {
+                output_format: {
+                    per_value_availability: {
+                        mp4: {
+                            availability: 'planned',
+                        },
+                        webm: {
+                            availability: 'planned',
+                        },
+                        ogg: {
+                            availability: 'planned',
+                        },
+                    },
+                },
                 codec: {
                     per_value_availability: {},
                 },
                 encoding_mode: {
-                    per_value_availability: {},
+                    per_value_availability: {
+                        target_size: {
+                            availability: 'planned',
+                        },
+                    },
                 },
                 crf: {
                     per_value_availability: {},
                 },
                 target_size_bytes: {
+                    availability: 'planned',
                     per_value_availability: {},
                 },
                 preset: {

package/openapi/api.yaml

@@ -89,7 +89,7 @@ info:
     of truth instead of hardcoding magic numbers. A runtime
     `GET /api/uploads/limits` endpoint for dynamic discovery
     (per-tier / per-environment overrides) is a deferred follow-up.
-  version: 2.68.0
+  version: 2.78.0
   contact:
     name: API Support
 
@@ -168,7 +168,7 @@ paths:
                   mime_type: "image/jpeg"
                   size_bytes: 2457600
                   constraints_applied:
-                    max_size_bytes: 104857600
+                    max_size_bytes: 10485760
                     max_duration_seconds: null
                     processing_class_pre_assignment: short_form
         '400':
@@ -232,7 +232,7 @@ paths:
                 $ref: '#/components/schemas/ErrorEnvelope'
               example:
                 success: false
-                error: "File size exceeds maximum allowed (500MB)"
+                error: "File size exceeds maximum allowed (100 GiB)"
         '415':
           description: |
             Unsupported file type at the contract level (no tier permits
@@ -280,13 +280,13 @@ paths:
                     upload_duration_exceeds_tier: '#/components/schemas/UploadDurationExceedsTierResponse'
               examples:
                 size_exceeds_tier:
-                  summary: Free-tier caller uploads a 200MB file (cap is 100MB)
+                  summary: Free-tier caller uploads a 200MB file (cap is 10 MiB)
                   value:
                     success: false
-                    error: "Upload exceeds size cap for free tier (max 100MB; pro permits up to 5GB)."
+                    error: "Upload exceeds size cap for free tier (max 10 MiB; pro permits up to 5 GiB)."
                     error_type: "upload_size_exceeds_tier"
                     current_tier: "free"
-                    max_size_bytes: 104857600
+                    max_size_bytes: 10485760
                     required_tier: "pro"
                 duration_exceeds_tier:
                   summary: Pro-tier caller uploads a 30-minute video (cap is 5min on short_form)
@@ -1932,6 +1932,18 @@ paths:
           description: Workflow ID (UUID v7)
           schema:
             $ref: '#/components/schemas/UuidV7'
+        - name: X-Workflow-Capability
+          in: header
+          required: false
+          schema:
+            type: string
+          description: |
+            Capability token (the `cap` from the anonymous workflow-create
+            response) authorizing this read for a **null-owner** workflow.
+            Optional — an authenticated owner does not need it. A wrong or
+            missing cap on a null-owner workflow returns 404 `WorkflowNotFound`
+            (no existence oracle — not 401/403). Per ticket
+            [`YQt88cq2`](https://trello.com/c/YQt88cq2).
       responses:
         '200':
           description: Workflow status retrieved
@@ -2015,6 +2027,18 @@ paths:
           description: Workflow ID (UUID v7)
           schema:
             $ref: '#/components/schemas/UuidV7'
+        - name: X-Workflow-Capability
+          in: header
+          required: false
+          schema:
+            type: string
+          description: |
+            Capability token (the `cap` from the anonymous workflow-create
+            response) authorizing this read for a **null-owner** workflow.
+            Optional — an authenticated owner does not need it. A wrong or
+            missing cap on a null-owner workflow returns 404 `WorkflowNotFound`
+            (no existence oracle — not 401/403). Per ticket
+            [`YQt88cq2`](https://trello.com/c/YQt88cq2).
       responses:
         '200':
           description: Download URLs retrieved
@@ -2119,6 +2143,26 @@ paths:
           description: Workflow ID (UUID v7)
           schema:
             $ref: '#/components/schemas/UuidV7'
+        - name: X-Workflow-Capability
+          in: header
+          required: false
+          schema:
+            type: string
+          description: |
+            Capability token (the `cap` from the anonymous workflow-create
+            response) authorizing this read for a **null-owner** workflow.
+            Optional — an authenticated owner does not need it. A wrong or
+            missing cap on a null-owner workflow returns 404 `WorkflowNotFound`
+            (no existence oracle — not 401/403). Per ticket
+            [`YQt88cq2`](https://trello.com/c/YQt88cq2).
+
+            **SSE transport note:** native browser `EventSource` cannot set
+            request headers (its constructor accepts only `url` + `withCredentials`
+            per the WHATWG SSE spec), so an anonymous caller must reach this
+            endpoint with a header-capable SSE client (a `fetch`-based
+            `EventSource` implementation). The cap is deliberately NOT accepted as
+            a query parameter — that would leak the bearer into URLs / logs /
+            referrers.
       responses:
         '200':
           description: SSE event stream
@@ -4465,6 +4509,100 @@ paths:
               schema:
                 $ref: '#/components/schemas/ErrorEnvelope'
 
+  # ============================================
+  # ACCOUNT LIMITS ENDPOINT
+  # ============================================
+
+  /api/v2/account/limits:
+    get:
+      summary: Get the caller's effective account limits
+      description: |
+        Returns the authed caller's **effective** (override-aware) account
+        limits. `effective = per-account override ?? tier_default`. Until a
+        per-account override is set, every limit's `effective` equals its
+        `tier_default` and `overridden` is `false`.
+
+        These are **request-level tier-quota** limits — the per-file upload
+        cap (`UserTier.maxFileSizeBytes`) and the merge combined-size band.
+        They are **distinct** from the per-operation **processing-class**
+        band caps in each operation schema's `processing_class.constraints`
+        (which `GET /api/operations/schema` advertises account-agnostically
+        as tier DEFAULTS). This endpoint is the account-scoped,
+        override-aware **effective** view — the pre-upload cap surface
+        previously missing (tickets
+        [`zcRRQHVC`](https://trello.com/c/zcRRQHVC) +
+        [`uKsFzORi`](https://trello.com/c/uKsFzORi)).
+
+        v1 keys: `max_upload_size_bytes` (per-file upload cap) and
+        `max_total_input_size_bytes` (merge combined-size band). SDKs/FE
+        gate the upload affordance on
+        `limits.max_upload_size_bytes.effective`, surface
+        `tier_default` for upgrade-prompt copy, and show an
+        "extended limit" affordance when `overridden` is `true`.
+
+        Per ticket [`ViRVI2MP`](https://trello.com/c/ViRVI2MP).
+      operationId: getAccountLimits
+      security: [{bearerAuth: []}, {sessionAuth: []}]  # required (identity-scoped to caller's account)
+      x-identity-scoped: true  # caller's account limits — per ADR-0016 §D4 sample
+      tags:
+        - Billing
+      responses:
+        '200':
+          description: Effective account-limits snapshot
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AccountLimitsSuccessEnvelope'
+              examples:
+                free_tier_defaults:
+                  summary: Free tier, no overrides (effective == tier_default)
+                  value:
+                    success: true
+                    data:
+                      tier: free
+                      limits:
+                        max_upload_size_bytes:
+                          effective: 10485760
+                          tier_default: 10485760
+                          overridden: false
+                        max_total_input_size_bytes:
+                          effective: 1073741824
+                          tier_default: 1073741824
+                          overridden: false
+                enterprise_with_upload_override:
+                  summary: Enterprise tier with a raised per-account upload override
+                  value:
+                    success: true
+                    data:
+                      tier: enterprise
+                      limits:
+                        max_upload_size_bytes:
+                          effective: 128849018880
+                          tier_default: 107374182400
+                          overridden: true
+                        max_total_input_size_bytes:
+                          effective: 120000000000
+                          tier_default: 120000000000
+                          overridden: false
+        '401':
+          description: Authentication required.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorEnvelope'
+        '429':
+          description: Rate limit exceeded
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorEnvelope'
+        '500':
+          description: Internal server error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorEnvelope'
+
   # ============================================
   # CONTACT ENDPOINT
   # ============================================
@@ -5645,6 +5783,98 @@ components:
         data:
           $ref: '#/components/schemas/CreditsBalanceResponse'
 
+    AccountLimitsSuccessEnvelope:
+      type: object
+      additionalProperties: false
+      required:
+        - success
+        - data
+      properties:
+        success:
+          type: boolean
+          enum: [true]
+        data:
+          $ref: '#/components/schemas/AccountLimits'
+
+    AccountLimits:
+      type: object
+      # Open payload (response data target stays open for additive evolution —
+      # the success-envelope tightening convention; new top-level fields may
+      # be added without a breaking change).
+      description: |
+        The caller's effective (override-aware) account limits
+        (`GET /api/v2/account/limits`, ticket
+        [`ViRVI2MP`](https://trello.com/c/ViRVI2MP)). `tier` is the caller's
+        subscription tier; `limits` maps a fixed v1 key set to each limit's
+        effective / tier-default / override state.
+
+        **v1 limit keys** (both REQUIRED):
+        - `max_upload_size_bytes`: the per-FILE upload cap
+          (`UserTier.maxFileSizeBytes` — the request-level tier quota the
+          upload endpoints enforce). **Distinct** from the per-operation
+          processing ceiling `max_input_size_bytes` in operation schemas
+          (different axis AND number). Tier defaults: free 10 MiB, pro 5 GiB,
+          enterprise 100 GiB.
+        - `max_total_input_size_bytes`: the effective merge combined-input
+          size cap (the summed-inputs ceiling). Same key as the
+          operation-schema merge band; the band is processing-class +
+          tier dependent (`short_form_concat` baseline 1 GiB; the
+          `long_form_re_encode` band where the tier permits it — Pro 5 GB,
+          Enterprise 120 GB). The server resolves the effective value for
+          the caller.
+      required:
+        - tier
+        - limits
+      properties:
+        tier:
+          $ref: '#/components/schemas/UserTier'
+        limits:
+          type: object
+          # Typed-open: the v1 keys below are REQUIRED + frozen, but future
+          # limit keys may be added additively (each an AccountLimitEntry) —
+          # forward-compatible per the open-payload convention.
+          additionalProperties:
+            $ref: '#/components/schemas/AccountLimitEntry'
+          required:
+            - max_upload_size_bytes
+            - max_total_input_size_bytes
+          properties:
+            max_upload_size_bytes:
+              $ref: '#/components/schemas/AccountLimitEntry'
+            max_total_input_size_bytes:
+              $ref: '#/components/schemas/AccountLimitEntry'
+
+    AccountLimitEntry:
+      type: object
+      additionalProperties: false
+      description: |
+        One account limit: the effective value (override ?? tier default),
+        the tier default, and whether a per-account override is active. The
+        override mechanism / store is NOT exposed — only the resolved
+        numbers plus the `overridden` flag.
+      required:
+        - effective
+        - tier_default
+        - overridden
+      properties:
+        effective:
+          type: integer
+          minimum: 1
+          description: |
+            The cap in force for this account, in bytes
+            (`override ?? tier_default`).
+        tier_default:
+          type: integer
+          minimum: 1
+          description: |
+            The tier's default cap for this limit, in bytes (already public
+            via the tier model).
+        overridden:
+          type: boolean
+          description: |
+            True iff a per-account override is active (i.e. `effective`
+            comes from an override rather than the tier default).
+
     CreditTransaction:
       type: object
       description: |
@@ -5777,6 +6007,49 @@ components:
         created_at:
           type: string
           format: date-time
+        # Activity-display fields (ticket B9ppslt2 / odct4sPB) — additive, all
+        # nullable + optional. Populate ONLY on `type: reservation` rows going
+        # forward; legacy reservation rows (pre-migration) and all non-reservation
+        # ledger types emit `null`. The frontend composes the human "Recent
+        # activity" label from these STRUCTURED fields (operation_summary +
+        # operation_count + primary_filename + type/state) instead of the opaque
+        # `description` legacy fallback. No separate `label` field — FE composes
+        # it (en/pt). Part A (state/state_changed_at) is live on API main (#426);
+        # Part B (operation_summary/operation_count/primary_filename) lands
+        # additively from the API ahead of this contract.
+        state:
+          type: [string, "null"]
+          description: |
+            Reservation lifecycle state — free-form string (kept opaque like
+            `type`/`reference_type` for churn-resistance; SDKs duck-type).
+            Current values: `active` (held), `settled` (charged), `released` /
+            `cancelled_released` (refunded / cancelled), `expired`. `null` for
+            non-reservation ledger types. Lets the consumer distinguish an
+            internal HOLD from a final charge rather than showing raw
+            reservations as spends.
+        state_changed_at:
+          type: [string, "null"]
+          format: date-time
+          description: |
+            RFC3339 / ISO-8601 timestamp of the last `state` transition.
+            `null` for non-reservation types.
+        operation_summary:
+          type: [string, "null"]
+          description: |
+            Distinct canonical operation type(s) for the referenced workflow,
+            comma-joined (e.g. `"compress"` or `"convert, compress"`). `null`
+            for legacy rows + non-reservation types. Human-label input.
+        operation_count:
+          type: [integer, "null"]
+          minimum: 0
+          description: |
+            Count of operations in the referenced workflow. `null` for legacy /
+            non-reservation rows. Human-label input (e.g. "Compressed 3 images").
+        primary_filename:
+          type: [string, "null"]
+          description: |
+            Original filename of the primary (first) input of the referenced
+            workflow. `null` for legacy / non-reservation rows. Human-label input.
 
     CreditsUsageResponse:
       type: object
@@ -6263,13 +6536,20 @@ components:
 
         Tier capability summary (informational; canonical limits are
         enforced server-side per `UserTier.php`):
-        - `free`: 10 MB max upload; image MIMEs only; 50 monthly credits;
+        - `free`: 10 MiB max upload; image MIMEs only; 50 monthly credits;
           0 overdraft; 1× rate-limit baseline.
-        - `pro`: 500 MB max upload; image + video + document MIMEs; 1000
+        - `pro`: 5 GiB max upload; image + video + document MIMEs; 1000
           monthly credits; 200 overdraft; 5× rate-limit.
-        - `enterprise`: 2 GB max upload; image + video + document + audio
+        - `enterprise`: 100 GiB max upload; image + video + document + audio
           MIMEs; 10000 monthly credits; 5000 overdraft; 20× rate-limit.
 
+        The "max upload" figures are the per-file upload cap
+        (`UserTier.maxFileSizeBytes`) — the request-level tier quota,
+        surfaced override-aware via `GET /api/v2/account/limits`
+        (`max_upload_size_bytes`). They are DISTINCT from the per-operation
+        processing-class band caps (`processing_class.constraints` in the
+        operation schemas; e.g. the 120 GB Enterprise merge combined band).
+
         Used by `TierRestrictionResponse.current_tier` /
         `TierRestrictionResponse.required_tier` and by
         `FeatureViolation.required_tier`.
@@ -6920,7 +7200,7 @@ components:
         - audio_to_video: Produce a video from an audio input plus an OPTIONAL still image overlay. Multi-input role-based with the first OPTIONAL role on the contract (`role: base` audio required, `role: overlay` image 0..1 — see `per_role_cardinality`). When overlay is omitted, the video uses a solid background colour. `availability: beta` (Wave A — Lambda backend live; opt-in, MUST NOT return `feature_not_available`; may change with notice). Per ticket [`SlluxMBN`](https://trello.com/c/SlluxMBN) + ADR-0015 (introduces `per_role_cardinality` vocab).
         - video_watermark: Apply an image overlay onto a base video via FFmpeg's `overlay` filter. Multi-input role-based (`role: base` video + `role: overlay` image, exactly one of each per `per_role_cardinality`). Re-encode required; audio stream-copy passthrough. Distinct from `image_watermark` (pure-Rust/image-only). `availability: beta` (Wave A — Lambda backend live; opt-in, MUST NOT 422; `short_form` is beta, `long_form` stays `planned` — no live Fargate worker; `multi_overlay_stack` stays `planned`). Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
         - video_text_watermark: Render a text overlay onto a base video via FFmpeg's `drawtext` filter. Single-input — text and styling in options. Same `watermark_mode` (single/tiled), anchor + margin vocab as `text_watermark`. Re-encode required; audio stream-copy passthrough. `availability: planned`; dispatch returns `feature_not_available` (422) until Lambda ships. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
-        - split: Fan one input file into N outputs across GIF / PDF / audio / video MIME families. Single-input per-mime-group catalog (mirrors merge/convert): GIF uses `frame_range` (REQUIRED) + `output_format`; PDF uses `page_range` OR `page_groups` (mutually exclusive); audio + video use a `mode` discriminator (interval/count/cut_points) + numeric-seconds wire format + `precision` flag (fast/exact). 200-output hard cap per ADR-0009 §D5 with per-mode preflight math; output naming `output-001..output-200`. Long-form video routes to a separate `split-video-fargate` worker via `processing_class`. `availability: beta` for the `audio` and `video` mime_groups (workers live on staging — shape-stable + opt-in, MUST NOT 422); video activates BOTH classes (`video.processing_class.short_form: beta` AND `long_form: beta` — `split-video-fargate` proven on staging per [`rcwvUKhI`](https://trello.com/c/rcwvUKhI)). The `image_gif` and `document_pdf` mime_groups stay `availability: planned` and dispatch returns `feature_not_available` (422) until their workers ship. Per ticket [`vKI0CFDu`](https://trello.com/c/vKI0CFDu) + ADR-0014.
+        - split: Fan one input file into N outputs across GIF / PDF / audio / video MIME families. Single-input per-mime-group catalog (mirrors merge/convert): GIF uses `frame_range` (REQUIRED) + `output_format`; PDF uses `page_range` OR `page_groups` (mutually exclusive); audio + video use a `mode` discriminator (interval/count/cut_points) + numeric-seconds wire format + `precision` flag (fast/exact). 200-output hard cap per ADR-0009 §D5 with per-mode preflight math; output naming `output-001..output-200`. Long-form video routes to a separate `split-video-fargate` worker via `processing_class`. `availability: beta` for the `audio` and `video` mime_groups (workers live on staging — shape-stable + opt-in, MUST NOT 422); video activates BOTH classes (`video.processing_class.short_form: beta` AND `long_form: beta` — `split-video-fargate` deployed + wired on staging but NOT yet proven end-to-end per [`rcwvUKhI`](https://trello.com/c/rcwvUKhI); the first customer-path soak has not completed, the 4GB+ speed-up is unmeasured, and the long-form fan-out is flag-gated dark). The `image_gif` and `document_pdf` mime_groups stay `availability: planned` and dispatch returns `feature_not_available` (422) until their workers ship. Per ticket [`vKI0CFDu`](https://trello.com/c/vKI0CFDu) + ADR-0014.
         - passthrough: Inert lossless source operation. A single-input source job whose SOLE operation is `passthrough` emits its source bytes UNCHANGED — no compression, no Lambda. The API self-completes the job at publish (terminal output = the upload `{bucket, key}` unchanged). Its purpose is to feed an uploaded file into a multi-input operation LOSSLESSLY: because `JobInputV2.source` is narrowed to exclude upload-direct, an upload that must enter a `merge` / `archive` / `image_watermark` op enters via a `passthrough` source job referenced downstream by `{type: job_output, from: <id>}` — preserving billing / DAG / lineage. Distinct from `operations: []` (which keeps its implicit-compress meaning on a single-input upload job); `passthrough` is the EXPLICIT lossless path via the "non-empty `operations[]` without `compress` = compression opt-out" rule. Media-agnostic; no options. `availability: beta` — activated (the inputs[]-narrowing + passthrough self-complete mechanism is deployed API-side); workflow-create accepts `passthrough` source jobs and MUST NOT return `feature_not_available`. **Never published to SNS** — deliberately absent from the AsyncAPI routing enums (API self-completes; no `ops-passthrough` queue). Per ticket [`4som89Uh`](https://trello.com/c/4som89Uh) + ADR-0004 (planned→beta flip).
 
         Both the legacy `thumbnail` value and the four sub-type values
@@ -9343,6 +9623,25 @@ components:
             Use this key to verify the `X-GIS-Signature` header on incoming webhook
             requests: `sha256=<hex(hmac-sha256(webhook_secret, raw_body))>`.
           example: "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
+        cap:
+          type:
+            - string
+            - "null"
+          readOnly: true
+          description: |
+            Per-workflow capability token (plaintext). Present ONLY for an
+            **anonymous (null-owner)** workflow create — it is the bearer that
+            authorizes reads of this workflow without a session. ABSENT for
+            authenticated creates (the session authorizes those). Like
+            `webhook_secret`, this is the only time it is exposed; it does not
+            appear in status queries.
+
+            Pass it as the `X-Workflow-Capability` request header on
+            `GET /api/workflows/{id}/status` / `/downloads` / `/events`. A wrong
+            or missing cap on a null-owner workflow returns **404**
+            (`WorkflowNotFound`) — deliberately no existence oracle (not 401/403).
+            Per ticket [`YQt88cq2`](https://trello.com/c/YQt88cq2).
+          example: "wcap_3f8a1c9e2b7d4f60a5c1e8b2d9f6a0c3"
 
     WorkflowCreateSuccessEnvelope:
       type: object
@@ -10885,12 +11184,24 @@ components:
             when `type: enum`. Keys MUST be a subset of `values[]`;
             each entry value is a `depends_on`-shaped condition mapping
             that the named enum value REQUIRES. Distinct from
-            option-level `depends_on` (which gates applicability with
-            silent-ignore semantics); `per_value_depends_on` rejects
-            the request with `invalid_options` when the named value is
-            chosen and the condition is not met. Verified by
+            option-level `depends_on`, which gates the WHOLE option's
+            applicability and IS enforced by the API at workflow-create
+            (`OperationOptionsValidator`: a submitted option whose gate is
+            unmet is rejected as `invalid_options`; an absent one is
+            inactive). `per_value_depends_on` instead constrains a single
+            VALUE of an otherwise-active option. ENFORCEMENT NOTE: the API's
+            create-time validator does NOT yet evaluate `per_value_depends_on`
+            (only option-level `depends_on`); it is shape-checked metadata
+            that SDK/FE consume to gate the value, with the worker as the
+            reject backstop (a future API version may add create-time
+            enforcement, contract-first). When unmet it logically requires
+            the request be rejected as `invalid_options` (intent; per the
+            enforcement note above this is not yet API-create-enforced), the
+            option itself staying active. The KEY/SHAPE (keys are a subset of
+            `values[]`; condition cross-refs resolve) is verified by
             `make check-per-value-depends-on` (CI guard, ticket
-            [`bsV3FWM5`](https://trello.com/c/bsV3FWM5)). Runtime
+            [`bsV3FWM5`](https://trello.com/c/bsV3FWM5)) — shape only, NOT
+            runtime/worker enforcement. Runtime
             emission ships verbatim alongside other availability
             metadata. See `schemas/FORMAT.md` §per_value_depends_on.
           additionalProperties: true