@giveitsmaller/contracts 0.36.0 → 0.37.0

package/operations/schemas/compress.yaml

@@ -25,14 +25,27 @@ operation:
     # 2026-06-20, lossless parked). width/height/fit/auto_orient stay removed
     # (EsD1hs5u — worker recompresses only; resize -> thumbnail, format -> convert).
     #
-    # output_format (replicated identically per group): only the LIVE targets
-    # are advertised — `original` (no-op, default) and `webp` (the one proven
+    # output_format (replicated identically per group): the LIVE concrete
+    # targets are `original` (no-op, default) and `webp` (the one proven
     # compress+format pass: a single API-canonicalized convert-with-size-cap;
-    # the compress worker itself never reads output_format). The planned
-    # facade targets (auto/smallest/jpeg/png/avif) were PRUNED 2026-06-21 —
-    # dangling coming-soon values are dishonest at source; every other format
-    # change is the convert operation's job (all stable). Re-add a target here
-    # only when its compress+format canonicalization actually ships.
+    # the compress worker itself never reads output_format). The concrete
+    # facade targets jpeg/png/avif stay PRUNED (pruned 2026-06-21) — a dangling
+    # coming-soon DUPLICATE of a concrete format is dishonest at source when
+    # every such format change is already the convert operation's job (all
+    # stable). Re-add a concrete target here only when its compress+format
+    # canonicalization actually ships.
+    #
+    # `auto` / `smallest` are the EXCEPTION (re-added 2026-06-23, planned, the
+    # auto-format differentiator): they are SELECTION STRATEGIES, not concrete
+    # formats — the server encodes to several candidate formats and returns the
+    # best (`auto` = the most suitable; `smallest` = the absolute fewest bytes),
+    # reporting the chosen format via the result `mime_type`. `convert` cannot
+    # express "pick the smallest" (it needs an explicit target), so these
+    # genuinely belong on this compress Output facade, not on convert — that is
+    # why they are NOT dangling duplicates. Both stay `per_value_availability:
+    # planned` until the API try-all-return-smallest logic + worker proof land
+    # (coordinated with api + frontend). They are EXCLUDED from the projection's
+    # facade_managed_outputs (not single-target canonicalizations).
     #
     # ---- ROUTE-AWARE "OUTPUT" model (image-options Phase 0, tewB37Jg) ----
     # The user-facing "Output" operation IS this compress op + output_format:
@@ -89,50 +102,97 @@ operation:
           type: enum
           values: [quality, target_size]
           default: quality
-          per_value_availability:
-            target_size: { availability: planned }
           honored_on: [same_format]
           description: >-
             Compression mode (mirrors compress.video). `quality` = the `quality`
-            slider drives the encode (default, live). `target_size` = `planned` —
-            hit a byte budget via the worker's encode-measure-binary-search loop
-            (lambdas building; jpeg/webp/avif only). Optimiser (same_format) route.
+            slider drives the encode (default). `target_size` = hit a byte budget via
+            the worker's encode-measure-binary-search loop — STABLE (worker-proven on
+            staging, lambdas git-870a7c2: re-encode under target + best-effort below
+            floor + original-wins, all proven). Optimiser (same_format) route.
         target_size_bytes:
           type: integer
           min: 1024
-          availability: planned
           depends_on: { encoding_mode: target_size }
           honored_on: [same_format]
           description: >-
-            Target output size in bytes (min 1024 = 1 KiB). `planned` — the image
-            encode-measure loop binary-searches quality to land at or under the
-            target; best-effort if the target is unreachable at min quality (the
-            result reports the chosen quality + whether the target was met).
-            Optimiser (same_format) route.
+            Target output size in bytes (min 1024 = 1 KiB). The image encode-measure
+            loop binary-searches quality to land at or under the target; best-effort
+            if the target is unreachable at min quality (the result reports the chosen
+            quality + whether the target was met). STABLE (worker-proven, lambdas
+            git-870a7c2). Optimiser (same_format) route.
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         progressive:
           type: boolean
           default: true
           honored_on: [same_format]
           description: "Enable progressive JPEG rendering (a low-quality preview renders first, then refines). JPEG only — the optimiser (same_format) route."
+        chroma_subsampling:
+          type: enum
+          values: ["420", "422", "444"]
+          honored_on: [same_format]
+          description: >-
+            JPEG chroma subsampling — the colour-resolution/size trade-off.
+            `420` (4:2:0) = smallest, chroma at quarter resolution (default-ish for
+            web photos); `422` (4:2:2) = half-horizontal; `444` (4:4:4) = full chroma
+            (largest, best for sharp colour edges / text). JPEG ONLY (declared on
+            image_jpeg only — ravif hardcodes 4:4:4, libwebp lossy locks 4:2:0).
+            String values (the worker strict-matches strings). STABLE — worker-proven
+            on staging (lambdas PR #264, deployed git-f2bef85: output JPEG SOF luma
+            sampling bytes verified 0x22/0x21/0x11 for 420/422/444). INCOMPATIBLE with
+            `lossless` (any chroma value): lossless JPEG is a DCT-coefficient copy and
+            cannot resample chroma — see the chroma_subsampling.lossless_conflict
+            constraint.
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         lossless:
           type: boolean
           default: false
@@ -192,14 +252,39 @@ operation:
           description: "Compression quality (1 = smallest file, 100 = best quality)."
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         optimization_level:
           type: integer
           min: 0
@@ -209,13 +294,21 @@ operation:
           description: "PNG optimization effort (0-6, oxipng). Higher = smaller file, slower encode. Default 3. Optimiser (same_format) route."
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         lossy:
           type: boolean
           default: false
@@ -289,37 +382,38 @@ operation:
           type: enum
           values: [quality, target_size]
           default: quality
-          per_value_availability:
-            target_size: { availability: planned }
           honored_on: [same_format]
           description: >-
             Compression mode (mirrors compress.video). `quality` = the `quality`
-            slider drives the encode (default, live). `target_size` = `planned` —
-            hit a byte budget via the worker's encode-measure-binary-search loop
-            (lambdas building; jpeg/webp/avif only). AVIF encodes are slow, so the
-            loop caps iterations. Optimiser (same_format) route.
+            slider drives the encode (default). `target_size` = hit a byte budget via
+            the worker's encode-measure-binary-search loop — STABLE (worker-proven on
+            staging, lambdas git-870a7c2: re-encode under target + best-effort +
+            original-wins). AVIF encodes are slow, so the loop caps iterations (a
+            6-iteration cap, ~18s worst case). Optimiser (same_format) route.
         target_size_bytes:
           type: integer
           min: 1024
-          availability: planned
           depends_on: { encoding_mode: target_size }
           honored_on: [same_format]
           description: >-
-            Target output size in bytes (min 1024 = 1 KiB). `planned` — the image
-            encode-measure loop binary-searches quality to land at or under the
-            target; best-effort if the target is unreachable at min quality (the
-            result reports the chosen quality + whether the target was met).
-            Optimiser (same_format) route.
+            Target output size in bytes (min 1024 = 1 KiB). The image encode-measure
+            loop binary-searches quality to land at or under the target; best-effort
+            if the target is unreachable at min quality (the result reports the chosen
+            quality + whether the target was met). STABLE (worker-proven, lambdas
+            git-870a7c2). Optimiser (same_format) route.
         metadata:
           type: enum
-          values: [all]
-          default: all
+          values: [strip, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling. `all` = strip all EXIF/IPTC/XMP (the only supported
-            value). `keep` is NOT offered for AVIF — ravif re-encodes from pixels
-            and cannot preserve metadata (the worker rejects `keep` as
-            invalid_options).
+            Metadata handling. `strip` = remove all EXIF/IPTC/XMP (default, the only
+            supported behaviour). `all` is a DEPRECATED alias of `strip` (migrate to
+            `strip`; the API lowers it at the worker boundary). `keep` is NOT offered
+            for AVIF — ravif re-encodes from pixels and cannot preserve metadata (the
+            worker rejects `keep` as invalid_options).
         avif_speed:
           type: integer
           min: 1
@@ -329,13 +423,21 @@ operation:
           description: "AVIF encode speed (1-10, ravif). Lower = smaller file, slower encode; higher = faster, larger. Default 4. Optimiser (same_format) route."
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         width:
           type: integer
           min: 1
@@ -392,45 +494,76 @@ operation:
           type: enum
           values: [quality, target_size]
           default: quality
-          per_value_availability:
-            target_size: { availability: planned }
           honored_on: [same_format]
           description: >-
             Compression mode (mirrors compress.video). `quality` = the `quality`
-            slider drives the encode (default, live). `target_size` = `planned` —
-            hit a byte budget via the worker's encode-measure-binary-search loop
-            (lambdas building; jpeg/webp/avif only). Optimiser (same_format) route.
+            slider drives the encode (default). `target_size` = hit a byte budget via
+            the worker's encode-measure-binary-search loop — STABLE (worker-proven on
+            staging, lambdas git-870a7c2: re-encode under target + best-effort below
+            floor + original-wins, all proven). Optimiser (same_format) route.
         target_size_bytes:
           type: integer
           min: 1024
-          availability: planned
           depends_on: { encoding_mode: target_size }
           honored_on: [same_format]
           description: >-
-            Target output size in bytes (min 1024 = 1 KiB). `planned` — the image
-            encode-measure loop binary-searches quality to land at or under the
-            target; best-effort if the target is unreachable at min quality (the
-            result reports the chosen quality + whether the target was met).
-            Optimiser (same_format) route.
+            Target output size in bytes (min 1024 = 1 KiB). The image encode-measure
+            loop binary-searches quality to land at or under the target; best-effort
+            if the target is unreachable at min quality (the result reports the chosen
+            quality + whether the target was met). STABLE (worker-proven, lambdas
+            git-870a7c2). Optimiser (same_format) route.
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         lossless:
           type: boolean
           default: false
@@ -491,20 +624,31 @@ operation:
           description: "Compression quality (1 = smallest file, 100 = best quality)."
         metadata:
           type: enum
-          values: [all]
-          default: all
+          values: [strip, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling. `all` = strip all metadata (the only supported value).
-            `keep` is NOT offered for SVG — SVGO optimises the markup and cannot
-            preserve a metadata block (the worker rejects `keep` as invalid_options).
+            Metadata handling. `strip` = remove all metadata (default, the only
+            supported behaviour). `all` is a DEPRECATED alias of `strip` (migrate to
+            `strip`; the API lowers it at the worker boundary). `keep` is NOT offered
+            for SVG — SVGO optimises the markup and cannot preserve a metadata block
+            (the worker rejects `keep` as invalid_options).
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP. Other format changes are the convert operation's job. See FORMAT.md.
+            WebP. Concrete format changes are the convert operation's job. `auto` /
+            `smallest` are PLANNED auto-format directives (server picks the best/smallest
+            candidate format, reported via the result `mime_type`) — selection strategies,
+            not concrete targets, planned until the API logic + worker proof land. See
+            FORMAT.md.
 
     # gif/tiff: raster Resize is engine-proven (both are in thumbnail-images), but
     # the optimiser `lossless` knob is WebP-only — not advertised here.
@@ -525,23 +669,56 @@ operation:
             GIF the worker honours this but real-world size reduction is typically small.
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         width:
           type: integer
           min: 1

package/operations/schemas/convert.yaml

@@ -8,15 +8,16 @@ operation:
 
   mime_groups:
     image:
-      # svg is split into convert.image_svg (below): it rasterises to raster
-      # formats but CANNOT be raster-resized (worker rejects svg resize), so it
-      # must NOT sit in a group that declares width/height/fit — else the raw
-      # schema / availability / accepted-options advertise svg resize. Mirrors
-      # compress.image_svg.
+      # svg is split into convert.image_svg + gif into convert.image_gif (below).
+      # svg rasterises but CANNOT be raster-resized (worker rejects svg resize), so
+      # it must NOT sit in a group that declares width/height/fit. gif is split out
+      # because it ALSO targets VIDEO (mp4/webm — the GIF→video transcode, card
+      # oEjNe9gT), which a jpeg/png input must not advertise. This `image` group is
+      # the still-raster inputs whose only targets are still-image formats. Mirrors
+      # compress.image_svg / compress.image* per-format split.
       mimes:
         - image/jpeg
         - image/png
-        - image/gif
         - image/webp
         - image/tiff
         - image/bmp
@@ -78,6 +79,23 @@ operation:
             (e.g. `magenta`) to the white default, so the `pattern` rejects a
             non-hex value as `invalid_options` rather than advertising an inert
             free-form string (e2e staging-verified 2026-06-22).
+        metadata:
+          type: enum
+          values: [strip, keep]
+          default: strip
+          availability: planned
+          honored_on: [format_change]
+          description: >-
+            Metadata handling on the format-change (convert/transcoder) route.
+            `strip` = remove all EXIF/IPTC/XMP (default), `keep` = preserve. `planned`
+            — the convert worker re-encodes from pixels and does not yet preserve
+            metadata across a format change, so the API returns feature_not_available
+            (rather than "Unknown option" on a format-change request — e2e/api flagged
+            2026-06-23). This is a new (planned) surface, so it carries no deprecated
+            `all` alias — unlike compress.image.metadata, which keeps `all` for its
+            existing callers. Stable-flip gated on lambdas proving convert-route
+            metadata preservation; the honoured target subset may narrow (avif/heic
+            targets re-encode and cannot keep).
         width:
           type: integer
           min: 1
@@ -140,6 +158,97 @@ operation:
             rasterised to JPEG (alpha-flatten). HEX ONLY — non-hex is rejected as
             `invalid_options` (see convert.image.background).
 
+    # gif is animated raster: it converts to a STILL image (first frame / rasterise —
+    # the existing image targets, stable) AND — NEW, planned — to VIDEO (mp4/webm):
+    # the GIF→video transcode (animated GIF → muted, play-once video; ~85-95% smaller
+    # than the GIF; card oEjNe9gT). Split out of convert.image so ONLY gif advertises
+    # the mp4/webm video targets (a jpeg/png input must not show them). The output
+    # crosses the media boundary image→video; per codex convergence this stays
+    # operation_type=convert (the convert worker's video_convert path owns the ffmpeg
+    # mp4/webm encode — NOT a new op, NOT the compression-video worker). mp4/webm are
+    # per_value_availability:planned and flip INDEPENDENTLY (like target_size's
+    # per-format flip) on lambdas worker-proof + API representability + the API's
+    # output-aware billing override (convert.image_gif→video is video-class encode
+    # work, NOT a cheap image transcode — the API must not price it as convert.image;
+    # API owns that, ticket 0Z4zunCr). Planned-first anti-regression (image-options §2.5).
+    image_gif:
+      mimes:
+        - image/gif
+      max_output_pixels: 16000000
+      options:
+        output_format:
+          type: enum
+          values: [jpeg, png, webp, avif, gif, tiff, mp4, webm]
+          required: true
+          per_value_availability:
+            mp4:  { availability: planned }
+            webm: { availability: planned }
+          description: >-
+            Target format. The still-image targets (jpeg/png/webp/avif/gif/tiff) take
+            the first frame / rasterise (stable, today's gif-convert behaviour). `mp4`
+            / `webm` are the NEW (planned) GIF→VIDEO transcode targets — the animated
+            GIF becomes a muted, play-once video (`mp4` = H.264 / yuv420p / +faststart,
+            plays everywhere; `webm` = VP9, smaller). GIFs are silent (no audio
+            stream); the GIF infinite-loop becomes a playback attribute (`<video loop>`)
+            the player sets, NOT baked into the file. mp4 and webm flip planned→stable
+            independently on worker proof.
+        quality:
+          type: integer
+          min: 1
+          max: 100
+          default: 85
+          depends_on: { output_format: [jpeg, webp, avif] }
+          honored_on: [format_change]
+          description: >-
+            Output quality for the lossy STILL-IMAGE targets (jpeg/webp/avif). The
+            video targets (mp4/webm) use a sensible default encode quality in v1 —
+            there is no exposed CRF knob yet (planned-first; may be added later).
+        background:
+          type: string
+          pattern: "^#[0-9a-fA-F]{6}$"
+          depends_on: { output_format: jpeg }
+          honored_on: [format_change]
+          description: >-
+            Background colour as a 6-digit hex (`#RRGGBB`) for a transparent GIF
+            flattened to JPEG (alpha-flatten). HEX ONLY — non-hex is rejected as
+            `invalid_options` (see convert.image.background).
+        metadata:
+          type: enum
+          values: [strip, keep]
+          default: strip
+          availability: planned
+          honored_on: [format_change]
+          description: >-
+            Metadata handling on the format-change route (still-image targets).
+            `planned` — mirrors convert.image.metadata (the convert worker does not
+            yet preserve metadata across a format change). The video targets carry no
+            EXIF/IPTC/XMP.
+        width:
+          type: integer
+          min: 1
+          max: 16384
+          honored_on: [format_change]
+          description: >-
+            Resize-inside-Output: target width in pixels (1-16384; width*height <=
+            max_output_pixels). Applies to the still-image targets; for the planned
+            mp4/webm video targets, resize applicability is settled at the worker flip.
+        height:
+          type: integer
+          min: 1
+          max: 16384
+          honored_on: [format_change]
+          description: "Resize-inside-Output: target height in pixels (1-16384; width*height <= max_output_pixels). See `width`."
+        fit:
+          type: enum
+          values: [max, crop, scale]
+          default: max
+          depends_on: { width: set, height: set, logic: or }
+          honored_on: [format_change]
+          description: >-
+            Resize mode. `max` (default) = fit within bounds, preserving aspect ratio
+            and never upscaling; `crop`/`scale` = exact dimensions. Applies only when
+            width or height is set.
+
     video:
       mimes:
         - video/mp4