@giveitsmaller/contracts 0.36.0 → 0.38.0

package/operations/schemas/compress.yaml

@@ -17,22 +17,39 @@ operation:
     #   image_png  -> + optimization_level (PNG-only)
     #   image_avif -> + avif_speed    (AVIF-only)
     #   image      -> webp/gif/svg/tiff (quality + output_format only)
-    # The worker reads quality/progressive/optimization_level/avif_speed (+ a
-    # `lossless` bool the API never emits). It HARDCODES metadata-strip, so
-    # `metadata` is a single fixed `all`. `mode` (lossy/lossless/auto) and
-    # `icc_profile` were REMOVED — the worker never read them and the API passed
-    # them verbatim; image compress is LOSSY-ONLY today (product decision
-    # 2026-06-20, lossless parked). width/height/fit/auto_orient stay removed
-    # (EsD1hs5u — worker recompresses only; resize -> thumbnail, format -> convert).
+    # The worker reads quality/progressive/optimization_level/avif_speed/lossless
+    # (the API now emits lossless) + metadata (strip/keep). The old `mode`
+    # (lossy/lossless/auto) was REMOVED (the worker never read it). HISTORY: this
+    # header once said width/height/fit/auto_orient "stay removed" and metadata is a
+    # fixed `all` — BOTH now superseded by the image-options work: RESIZE
+    # (width/height/fit) is back STABLE (v2.97.0, the route-aware Output model);
+    # `metadata` is strip/keep (canonical `strip`, deprecated `all`); `auto_orient`
+    # is re-added PLANNED (wave-2, below); and the old `icc_profile` is superseded by
+    # the decoupled `color_profile` control (wave-2, planned — ICC handling is its
+    # own axis, NOT folded into metadata-strip; that fold-in was the silent-colour-
+    # shift bug). See the per-option blocks for the live shape.
     #
-    # output_format (replicated identically per group): only the LIVE targets
-    # are advertised — `original` (no-op, default) and `webp` (the one proven
+    # output_format (replicated identically per group): the LIVE concrete
+    # targets are `original` (no-op, default) and `webp` (the one proven
     # compress+format pass: a single API-canonicalized convert-with-size-cap;
-    # the compress worker itself never reads output_format). The planned
-    # facade targets (auto/smallest/jpeg/png/avif) were PRUNED 2026-06-21 —
-    # dangling coming-soon values are dishonest at source; every other format
-    # change is the convert operation's job (all stable). Re-add a target here
-    # only when its compress+format canonicalization actually ships.
+    # the compress worker itself never reads output_format). The concrete
+    # facade targets jpeg/png/avif stay PRUNED (pruned 2026-06-21) — a dangling
+    # coming-soon DUPLICATE of a concrete format is dishonest at source when
+    # every such format change is already the convert operation's job (all
+    # stable). Re-add a concrete target here only when its compress+format
+    # canonicalization actually ships.
+    #
+    # `auto` / `smallest` are the EXCEPTION (re-added 2026-06-23, planned, the
+    # auto-format differentiator): they are SELECTION STRATEGIES, not concrete
+    # formats — the server encodes to several candidate formats and returns the
+    # best (`auto` = the most suitable; `smallest` = the absolute fewest bytes),
+    # reporting the chosen format via the result `mime_type`. `convert` cannot
+    # express "pick the smallest" (it needs an explicit target), so these
+    # genuinely belong on this compress Output facade, not on convert — that is
+    # why they are NOT dangling duplicates. Both stay `per_value_availability:
+    # planned` until the API try-all-return-smallest logic + worker proof land
+    # (coordinated with api + frontend). They are EXCLUDED from the projection's
+    # facade_managed_outputs (not single-target canonicalizations).
     #
     # ---- ROUTE-AWARE "OUTPUT" model (image-options Phase 0, tewB37Jg) ----
     # The user-facing "Output" operation IS this compress op + output_format:
@@ -89,50 +106,97 @@ operation:
           type: enum
           values: [quality, target_size]
           default: quality
-          per_value_availability:
-            target_size: { availability: planned }
           honored_on: [same_format]
           description: >-
             Compression mode (mirrors compress.video). `quality` = the `quality`
-            slider drives the encode (default, live). `target_size` = `planned` —
-            hit a byte budget via the worker's encode-measure-binary-search loop
-            (lambdas building; jpeg/webp/avif only). Optimiser (same_format) route.
+            slider drives the encode (default). `target_size` = hit a byte budget via
+            the worker's encode-measure-binary-search loop — STABLE (worker-proven on
+            staging, lambdas git-870a7c2: re-encode under target + best-effort below
+            floor + original-wins, all proven). Optimiser (same_format) route.
         target_size_bytes:
           type: integer
           min: 1024
-          availability: planned
           depends_on: { encoding_mode: target_size }
           honored_on: [same_format]
           description: >-
-            Target output size in bytes (min 1024 = 1 KiB). `planned` — the image
-            encode-measure loop binary-searches quality to land at or under the
-            target; best-effort if the target is unreachable at min quality (the
-            result reports the chosen quality + whether the target was met).
-            Optimiser (same_format) route.
+            Target output size in bytes (min 1024 = 1 KiB). The image encode-measure
+            loop binary-searches quality to land at or under the target; best-effort
+            if the target is unreachable at min quality (the result reports the chosen
+            quality + whether the target was met). STABLE (worker-proven, lambdas
+            git-870a7c2). Optimiser (same_format) route.
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         progressive:
           type: boolean
           default: true
           honored_on: [same_format]
           description: "Enable progressive JPEG rendering (a low-quality preview renders first, then refines). JPEG only — the optimiser (same_format) route."
+        chroma_subsampling:
+          type: enum
+          values: ["420", "422", "444"]
+          honored_on: [same_format]
+          description: >-
+            JPEG chroma subsampling — the colour-resolution/size trade-off.
+            `420` (4:2:0) = smallest, chroma at quarter resolution (default-ish for
+            web photos); `422` (4:2:2) = half-horizontal; `444` (4:4:4) = full chroma
+            (largest, best for sharp colour edges / text). JPEG ONLY (declared on
+            image_jpeg only — ravif hardcodes 4:4:4, libwebp lossy locks 4:2:0).
+            String values (the worker strict-matches strings). STABLE — worker-proven
+            on staging (lambdas PR #264, deployed git-f2bef85: output JPEG SOF luma
+            sampling bytes verified 0x22/0x21/0x11 for 420/422/444). INCOMPATIBLE with
+            `lossless` (any chroma value): lossless JPEG is a DCT-coefficient copy and
+            cannot resample chroma — see the chroma_subsampling.lossless_conflict
+            constraint.
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         lossless:
           type: boolean
           default: false
@@ -177,6 +241,33 @@ operation:
             worker has no such key). `crop`/`scale` = exact dimensions (`scale`
             deliberately enlarges past source). Applies only when width or height is
             set, on whichever Output route runs.
+        color_profile:
+          type: enum
+          values: [keep, srgb, strip]
+          default: keep
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            ICC colour-profile handling — its OWN control, DECOUPLED from `metadata`
+            (stripping metadata must NOT silently shift colours; that coupling is the
+            correctness bug this fixes). `keep` (default) = preserve the embedded
+            profile; `srgb` = convert to sRGB (also handles CMYK→sRGB); `strip` = drop
+            the profile (smallest — only when the consumer manages colour itself).
+            `planned` — the worker does not yet honour it (today the default strips ICC
+            during metadata-strip; the fix preserves it). Applies on BOTH Output routes
+            (optimiser preserves; transcoder preserves/converts). Worker-proven flip.
+        auto_orient:
+          type: boolean
+          default: true
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            Bake EXIF orientation into the pixels (honour the camera/device rotation
+            tag) so the output displays upright everywhere, then drop the now-redundant
+            orientation tag. `planned` — a restored control (was removed): the worker
+            must apply the EXIF-orientation transform before encode on both Output
+            routes. Default `true` (a behaviour change, proven planned-first). No-op for
+            inputs without an orientation tag.
 
     image_png:
       mimes:
@@ -192,14 +283,39 @@ operation:
           description: "Compression quality (1 = smallest file, 100 = best quality)."
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         optimization_level:
           type: integer
           min: 0
@@ -209,13 +325,21 @@ operation:
           description: "PNG optimization effort (0-6, oxipng). Higher = smaller file, slower encode. Default 3. Optimiser (same_format) route."
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         lossy:
           type: boolean
           default: false
@@ -258,6 +382,33 @@ operation:
             worker has no such key). `crop`/`scale` = exact dimensions (`scale`
             deliberately enlarges past source). Applies only when width or height is
             set, on whichever Output route runs.
+        color_profile:
+          type: enum
+          values: [keep, srgb, strip]
+          default: keep
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            ICC colour-profile handling — its OWN control, DECOUPLED from `metadata`
+            (stripping metadata must NOT silently shift colours; that coupling is the
+            correctness bug this fixes). `keep` (default) = preserve the embedded
+            profile; `srgb` = convert to sRGB (also handles CMYK→sRGB); `strip` = drop
+            the profile (smallest — only when the consumer manages colour itself).
+            `planned` — the worker does not yet honour it (today the default strips ICC
+            during metadata-strip; the fix preserves it). Applies on BOTH Output routes
+            (optimiser preserves; transcoder preserves/converts). Worker-proven flip.
+        auto_orient:
+          type: boolean
+          default: true
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            Bake EXIF orientation into the pixels (honour the camera/device rotation
+            tag) so the output displays upright everywhere, then drop the now-redundant
+            orientation tag. `planned` — a restored control (was removed): the worker
+            must apply the EXIF-orientation transform before encode on both Output
+            routes. Default `true` (a behaviour change, proven planned-first). No-op for
+            inputs without an orientation tag.
 
     image_avif:
       availability: beta
@@ -289,37 +440,38 @@ operation:
           type: enum
           values: [quality, target_size]
           default: quality
-          per_value_availability:
-            target_size: { availability: planned }
           honored_on: [same_format]
           description: >-
             Compression mode (mirrors compress.video). `quality` = the `quality`
-            slider drives the encode (default, live). `target_size` = `planned` —
-            hit a byte budget via the worker's encode-measure-binary-search loop
-            (lambdas building; jpeg/webp/avif only). AVIF encodes are slow, so the
-            loop caps iterations. Optimiser (same_format) route.
+            slider drives the encode (default). `target_size` = hit a byte budget via
+            the worker's encode-measure-binary-search loop — STABLE (worker-proven on
+            staging, lambdas git-870a7c2: re-encode under target + best-effort +
+            original-wins). AVIF encodes are slow, so the loop caps iterations (a
+            6-iteration cap, ~18s worst case). Optimiser (same_format) route.
         target_size_bytes:
           type: integer
           min: 1024
-          availability: planned
           depends_on: { encoding_mode: target_size }
           honored_on: [same_format]
           description: >-
-            Target output size in bytes (min 1024 = 1 KiB). `planned` — the image
-            encode-measure loop binary-searches quality to land at or under the
-            target; best-effort if the target is unreachable at min quality (the
-            result reports the chosen quality + whether the target was met).
-            Optimiser (same_format) route.
+            Target output size in bytes (min 1024 = 1 KiB). The image encode-measure
+            loop binary-searches quality to land at or under the target; best-effort
+            if the target is unreachable at min quality (the result reports the chosen
+            quality + whether the target was met). STABLE (worker-proven, lambdas
+            git-870a7c2). Optimiser (same_format) route.
         metadata:
           type: enum
-          values: [all]
-          default: all
+          values: [strip, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling. `all` = strip all EXIF/IPTC/XMP (the only supported
-            value). `keep` is NOT offered for AVIF — ravif re-encodes from pixels
-            and cannot preserve metadata (the worker rejects `keep` as
-            invalid_options).
+            Metadata handling. `strip` = remove all EXIF/IPTC/XMP (default, the only
+            supported behaviour). `all` is a DEPRECATED alias of `strip` (migrate to
+            `strip`; the API lowers it at the worker boundary). `keep` is NOT offered
+            for AVIF — ravif re-encodes from pixels and cannot preserve metadata (the
+            worker rejects `keep` as invalid_options).
         avif_speed:
           type: integer
           min: 1
@@ -329,13 +481,21 @@ operation:
           description: "AVIF encode speed (1-10, ravif). Lower = smaller file, slower encode; higher = faster, larger. Default 4. Optimiser (same_format) route."
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         width:
           type: integer
           min: 1
@@ -367,6 +527,33 @@ operation:
             worker has no such key). `crop`/`scale` = exact dimensions (`scale`
             deliberately enlarges past source). Applies only when width or height is
             set, on whichever Output route runs.
+        color_profile:
+          type: enum
+          values: [keep, srgb, strip]
+          default: keep
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            ICC colour-profile handling — its OWN control, DECOUPLED from `metadata`
+            (stripping metadata must NOT silently shift colours; that coupling is the
+            correctness bug this fixes). `keep` (default) = preserve the embedded
+            profile; `srgb` = convert to sRGB (also handles CMYK→sRGB); `strip` = drop
+            the profile (smallest — only when the consumer manages colour itself).
+            `planned` — the worker does not yet honour it (today the default strips ICC
+            during metadata-strip; the fix preserves it). Applies on BOTH Output routes
+            (optimiser preserves; transcoder preserves/converts). Worker-proven flip.
+        auto_orient:
+          type: boolean
+          default: true
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            Bake EXIF orientation into the pixels (honour the camera/device rotation
+            tag) so the output displays upright everywhere, then drop the now-redundant
+            orientation tag. `planned` — a restored control (was removed): the worker
+            must apply the EXIF-orientation transform before encode on both Output
+            routes. Default `true` (a behaviour change, proven planned-first). No-op for
+            inputs without an orientation tag.
 
     # webp split out of the former bundled image group: it is the one input that
     # carries BOTH Resize (raster, proven in thumbnail-images) AND the optimiser
@@ -392,45 +579,76 @@ operation:
           type: enum
           values: [quality, target_size]
           default: quality
-          per_value_availability:
-            target_size: { availability: planned }
           honored_on: [same_format]
           description: >-
             Compression mode (mirrors compress.video). `quality` = the `quality`
-            slider drives the encode (default, live). `target_size` = `planned` —
-            hit a byte budget via the worker's encode-measure-binary-search loop
-            (lambdas building; jpeg/webp/avif only). Optimiser (same_format) route.
+            slider drives the encode (default). `target_size` = hit a byte budget via
+            the worker's encode-measure-binary-search loop — STABLE (worker-proven on
+            staging, lambdas git-870a7c2: re-encode under target + best-effort below
+            floor + original-wins, all proven). Optimiser (same_format) route.
         target_size_bytes:
           type: integer
           min: 1024
-          availability: planned
           depends_on: { encoding_mode: target_size }
           honored_on: [same_format]
           description: >-
-            Target output size in bytes (min 1024 = 1 KiB). `planned` — the image
-            encode-measure loop binary-searches quality to land at or under the
-            target; best-effort if the target is unreachable at min quality (the
-            result reports the chosen quality + whether the target was met).
-            Optimiser (same_format) route.
+            Target output size in bytes (min 1024 = 1 KiB). The image encode-measure
+            loop binary-searches quality to land at or under the target; best-effort
+            if the target is unreachable at min quality (the result reports the chosen
+            quality + whether the target was met). STABLE (worker-proven, lambdas
+            git-870a7c2). Optimiser (same_format) route.
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         lossless:
           type: boolean
           default: false
@@ -474,6 +692,33 @@ operation:
             worker has no such key). `crop`/`scale` = exact dimensions (`scale`
             deliberately enlarges past source). Applies only when width or height is
             set, on whichever Output route runs.
+        color_profile:
+          type: enum
+          values: [keep, srgb, strip]
+          default: keep
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            ICC colour-profile handling — its OWN control, DECOUPLED from `metadata`
+            (stripping metadata must NOT silently shift colours; that coupling is the
+            correctness bug this fixes). `keep` (default) = preserve the embedded
+            profile; `srgb` = convert to sRGB (also handles CMYK→sRGB); `strip` = drop
+            the profile (smallest — only when the consumer manages colour itself).
+            `planned` — the worker does not yet honour it (today the default strips ICC
+            during metadata-strip; the fix preserves it). Applies on BOTH Output routes
+            (optimiser preserves; transcoder preserves/converts). Worker-proven flip.
+        auto_orient:
+          type: boolean
+          default: true
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            Bake EXIF orientation into the pixels (honour the camera/device rotation
+            tag) so the output displays upright everywhere, then drop the now-redundant
+            orientation tag. `planned` — a restored control (was removed): the worker
+            must apply the EXIF-orientation transform before encode on both Output
+            routes. Default `true` (a behaviour change, proven planned-first). No-op for
+            inputs without an orientation tag.
 
     # svg is VECTOR: no raster resize (thumbnail-images does not list svg), and the
     # optimiser `lossless` knob does not apply. SVG compression is SVGO; only
@@ -491,20 +736,31 @@ operation:
           description: "Compression quality (1 = smallest file, 100 = best quality)."
         metadata:
           type: enum
-          values: [all]
-          default: all
+          values: [strip, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling. `all` = strip all metadata (the only supported value).
-            `keep` is NOT offered for SVG — SVGO optimises the markup and cannot
-            preserve a metadata block (the worker rejects `keep` as invalid_options).
+            Metadata handling. `strip` = remove all metadata (default, the only
+            supported behaviour). `all` is a DEPRECATED alias of `strip` (migrate to
+            `strip`; the API lowers it at the worker boundary). `keep` is NOT offered
+            for SVG — SVGO optimises the markup and cannot preserve a metadata block
+            (the worker rejects `keep` as invalid_options).
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP. Other format changes are the convert operation's job. See FORMAT.md.
+            WebP. Concrete format changes are the convert operation's job. `auto` /
+            `smallest` are PLANNED auto-format directives (server picks the best/smallest
+            candidate format, reported via the result `mime_type`) — selection strategies,
+            not concrete targets, planned until the API logic + worker proof land. See
+            FORMAT.md.
 
     # gif/tiff: raster Resize is engine-proven (both are in thumbnail-images), but
     # the optimiser `lossless` knob is WebP-only — not advertised here.
@@ -525,23 +781,56 @@ operation:
             GIF the worker honours this but real-world size reduction is typically small.
         metadata:
           type: enum
-          values: [all, keep]
-          default: all
+          values: [strip, keep, all]
+          default: strip
+          per_value_availability:
+            all: { availability: deprecated }
           honored_on: [same_format]
           description: >-
-            Metadata handling (optimiser/same_format route). `all` = strip all
+            Metadata handling (optimiser/same_format route). `strip` = remove all
             EXIF/IPTC/XMP (default). `keep` = preserve EXIF/ICC/XMP — STABLE
-            (worker-proven, libcaesium; lambdas PR #260, staging round-trip +
-            unit test). Any other value is rejected as invalid_options.
+            (worker-proven, libcaesium; lambdas PR #260, staging round-trip + unit
+            test). `all` is a DEPRECATED alias of `strip` (the pre-2026-06-23 token;
+            `all` reading as "strip all" was counterintuitive) — still accepted,
+            emits Deprecation/Sunset, migrate to `strip`. The API lowers `strip`→`all`
+            at the worker boundary. Any other value is rejected as invalid_options.
+        keep_metadata:
+          type: array
+          items:
+            # items.type is `string` (not `enum`) deliberately: the valid categories
+            # are listed below + enforced by the API at the stable-flip. SDK operation-
+            # schema codegen does not yet support typed array-of-enum (restore `enum` +
+            # values:[copyright,gps,date] when that lands — likely at this option's
+            # stable-flip). Wire-identical either way (a JSON array of strings).
+            type: string
+          uniqueItems: true
+          availability: planned
+          depends_on: { metadata: strip }
+          honored_on: [same_format]
+          description: >-
+            Selective per-category metadata keep (optimiser/same_format route):
+            preserve ONLY these categories and strip the rest — refines the strip
+            path (`metadata: strip`). Valid categories: `copyright`, `gps` (location),
+            `date` (capture time); combinable. `planned` — the worker does not yet
+            do selective keep (use `metadata: keep` to preserve everything), so the
+            API returns feature_not_available until lambdas proves it.
         output_format:
           type: enum
-          values: [original, webp]
+          values: [original, webp, auto, smallest]
           default: original
+          per_value_availability:
+            auto:     { availability: planned }
+            smallest: { availability: planned }
           description: >-
             Output format. original = keep input format (default); webp = recompress to
-            WebP — the one live compress+format target (proven on staging). Other format
+            WebP — the one live compress+format target (proven on staging). Concrete format
             changes (jpeg/png/avif/gif/tiff) are the convert operation's job, not compress.
-            See FORMAT.md.
+            `auto` / `smallest` are PLANNED auto-format directives — the server encodes to
+            several candidate formats and returns the best (`auto` = the most suitable;
+            `smallest` = the absolute fewest bytes), reporting the chosen format via the
+            result `mime_type`. They are SELECTION STRATEGIES, not concrete targets (convert
+            cannot express "pick the smallest"), so they live here and stay `planned` until
+            the API try-all-return-smallest logic + worker proof land. See FORMAT.md.
         width:
           type: integer
           min: 1
@@ -573,6 +862,33 @@ operation:
             worker has no such key). `crop`/`scale` = exact dimensions (`scale`
             deliberately enlarges past source). Applies only when width or height is
             set, on whichever Output route runs.
+        color_profile:
+          type: enum
+          values: [keep, srgb, strip]
+          default: keep
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            ICC colour-profile handling — its OWN control, DECOUPLED from `metadata`
+            (stripping metadata must NOT silently shift colours; that coupling is the
+            correctness bug this fixes). `keep` (default) = preserve the embedded
+            profile; `srgb` = convert to sRGB (also handles CMYK→sRGB); `strip` = drop
+            the profile (smallest — only when the consumer manages colour itself).
+            `planned` — the worker does not yet honour it (today the default strips ICC
+            during metadata-strip; the fix preserves it). Applies on BOTH Output routes
+            (optimiser preserves; transcoder preserves/converts). Worker-proven flip.
+        auto_orient:
+          type: boolean
+          default: true
+          availability: planned
+          honored_on: [same_format, format_change]
+          description: >-
+            Bake EXIF orientation into the pixels (honour the camera/device rotation
+            tag) so the output displays upright everywhere, then drop the now-redundant
+            orientation tag. `planned` — a restored control (was removed): the worker
+            must apply the EXIF-orientation transform before encode on both Output
+            routes. Default `true` (a behaviour change, proven planned-first). No-op for
+            inputs without an orientation tag.
 
     audio:
       mimes: