@giveitsmaller/contracts 0.68.0 → 0.69.0

package/dist/openapi/models/WorkflowSummaryJob.d.ts

@@ -2,7 +2,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/models/WorkflowSummaryJob.js

@@ -4,7 +4,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/models/WorkflowWarning.d.ts

@@ -2,7 +2,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/models/WorkflowWarning.js

@@ -4,7 +4,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/models/WorkflowWarningSeverity.d.ts

@@ -2,7 +2,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/models/WorkflowWarningSeverity.js

@@ -4,7 +4,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/runtime.d.ts

@@ -2,7 +2,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/runtime.js

@@ -4,7 +4,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.198.0
+ * The version of the OpenAPI document: 2.199.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/openapi/api.yaml

@@ -89,7 +89,7 @@ info:
     of truth instead of hardcoding magic numbers. A runtime
     `GET /api/uploads/limits` endpoint for dynamic discovery
     (per-tier / per-environment overrides) is a deferred follow-up.
-  version: 2.198.0
+  version: 2.199.0
   contact:
     name: API Support
 
@@ -454,10 +454,26 @@ paths:
                     feature_tier_restricted: '#/components/schemas/FeatureTierRestrictedResponse'
         '413':
           description: |
-            File exceeds the absolute maximum upload size (across all
-            tiers). For tier-specific size caps below this absolute
-            limit, the server returns 403 with
-            `error_type: tier_restriction, restriction_kind: file_size`.
+            Two rejection cases, discriminated by the `ErrorEnvelope.error`
+            code — the same pair as `POST /api/uploads`.
+
+            - **Byte size** — the file exceeds the absolute maximum upload size
+              (across all tiers). For tier-specific size caps below this
+              absolute limit, the server returns 403 with
+              `error_type: tier_restriction, restriction_kind: file_size`.
+            - **Pixel dimensions** (`error: IMAGE_DIMENSIONS_TOO_LARGE`) — as
+              declared on `POST /api/uploads`: a decodable raster image whose
+              `width x height` exceeds the configured pixel ceiling
+              (`UPLOAD_MAX_IMAGE_PIXELS`, default 16 MP), read from the file
+              **header** and rejected **before** decoding.
+
+            🔴 **THIS CASE WAS UNDECLARED HERE UNTIL 2026-08-28, AND THIS IS
+            THE PATH IT MATTERS MOST ON.** Multipart exists for LARGE uploads,
+            so a high-pixel image is *more* likely to arrive here than on the
+            single-shot endpoint where the ceiling was documented. A ceiling
+            declared on the small-file path and omitted from the large-file
+            path is worse than one declared nowhere: a consumer who reads the
+            contract concludes the rule does not apply here.
           content:
             application/json:
               schema:
@@ -1244,20 +1260,29 @@ paths:
         - name: archived
           in: query
           required: false
-          x-availability: planned
-          description: |
-            🔴 **NOT IMPLEMENTED — see the `planned` note below. A server
-            that does not support this parameter SILENTLY IGNORES IT and
-            returns the DEFAULT (non-archived) list.** That is the dangerous
-            half of this feature and the reason it is called out here rather
-            than only on the endpoints: `POST .../archive` would 404, which is
-            loud and teaches the caller immediately, whereas
-            **`archived=true` returns a 200 carrying the wrong rows.** A
-            consumer asking for their archive receives their NON-archived
-            workflows and is told nothing. **Silent wrong data beats a 404
-            every time for damage.**
-            Until the server implements it, a client MUST NOT present an
-            "archived" view built on this parameter.
+          x-availability: stable
+          description: |
+            ⚠️ **A SERVER THAT DOES NOT SUPPORT THIS PARAMETER SILENTLY
+            IGNORES IT and returns the DEFAULT (non-archived) list** — it
+            does not error. That asymmetry is why this is called out on the
+            parameter and not only on the endpoints: `POST .../archive`
+            would 404, which is loud and teaches the caller immediately,
+            whereas **`archived=true` returns a 200 carrying the wrong
+            rows** — a consumer asking for their archive receives their
+            NON-archived workflows and is told nothing. **Silent wrong data
+            beats a 404 every time for damage.**
+
+            ✅ **IMPLEMENTED. This was `planned` and carried a "clients MUST
+            NOT present an archived view" prohibition; both are struck.**
+            Verified on `compression_api` `origin/main` before the flip
+            rather than on report: the `ArchiveWorkflow` and
+            `RestoreWorkflow` command handlers exist, and
+            `WorkflowListReadPort` takes the `bool $archived` filter.
+            ⚠️ **What that establishes is that the code is MERGED, not that
+            a given environment is running it** — availability in this
+            contract has no environment axis, so read this as the shape
+            being committed, and confirm deployment from the environment
+            rather than from here.
 
             Archived-row filter (ticket
             [`j2s6T2qf`](https://trello.com/c/j2s6T2qf)). **Default `false`**:
@@ -5827,7 +5852,29 @@ paths:
       summary: Get current credit balance
       description: |
         Returns a snapshot of the caller's credit position at request
-        time. Per ticket [I23 `DffjC3zm`](https://trello.com/c/DffjC3zm)
+        time.
+
+        🔴 **EVENTUALLY CONSISTENT WITH A COMPLETED CHECKOUT, AND THIS
+        RESPONSE CARRIES NO FRESHNESS SIGNAL.** A credit-pack purchase is
+        granted on an asynchronous server-to-server callback, so a
+        snapshot taken just after the Stripe redirect **may legitimately
+        predate the grant**. There is **no timestamp, no version, no
+        pending state and no session correlation** here — the fields
+        below are the whole of it — so **this endpoint cannot
+        distinguish "the grant has not landed yet" from "the payment did
+        not credit you".**
+
+        ⇒ **Do not treat an unchanged balance after checkout as a
+        failure.** Those two states need opposite handling — *wait*
+        versus *contact support* — and the way to tell them apart is
+        `GET /api/v2/credits/usage`, correlating on the checkout
+        `session_id`, not this endpoint. See
+        `POST /api/billing/checkout` for the full model, **including
+        that nothing detects a callback which never arrives.**
+
+        ⛔ **No interval is stated anywhere in this contract**, because
+        none has been measured end to end. Any client timeout is the
+        client's own choice and is not sanctioned here. Per ticket [I23 `DffjC3zm`](https://trello.com/c/DffjC3zm)
         + plan v5 §F9 round-13 narrowing — this endpoint is the
         canonical user-visible billing-state surface.
 
@@ -6232,6 +6279,43 @@ paths:
         frontend can hide/disable the upgrade affordance without
         hard-coding the rollout state.
 
+        🔴 **THE CREDIT GRANT IS ASYNCHRONOUS. THE BALANCE WILL NOT
+        REFLECT IT WHEN STRIPE REDIRECTS THE USER BACK.** Credits are
+        granted on the server-to-server callback, which arrives
+        independently of the browser redirect. A client reading
+        `GET /api/v2/credits/balance` immediately on return **may
+        legitimately see the pre-purchase value, and that is not an
+        error.**
+
+        **How to observe the grant:** poll `GET /api/v2/credits/usage`
+        for a transaction whose `reference_id` equals the `session_id`
+        returned here. That is the only client-observable correlation
+        between a checkout and its credits. ⚠️ See
+        `CreditTransaction.reference_id` — **the pack-purchase path does
+        not populate it yet**, so today there is nothing to match on.
+
+        ⛔ **NO TIMING IS STATED, DELIBERATELY.** The interval is
+        dominated by the provider's callback delivery latency, which
+        **this system does not measure**. Production has processed
+        **zero** such events; staging exactly one, a synthetic rehearsal
+        purchase — n=1, idle box, caller not a browser. **No bound is
+        derivable from that**, and a client MUST NOT build a timeout
+        from any figure in this contract, because there is none.
+
+        ⇒ **Show a pending state rather than a failure.** Absence of
+        credits after checkout is **indeterminate, not negative**.
+
+        🔴 **AND THE BRANCH A CLIENT MUST NOT BE PROMISED AWAY FROM:
+        NOTHING DETECTS A CALLBACK THAT NEVER ARRIVES.** Recovery relies
+        on the provider's own retries. There is **no server-side
+        reconciliation** comparing completed checkouts against granted
+        credits, and an event already marked terminal **cannot be
+        reopened**. **No customer-visible recovery route exists and no
+        automated one** — the manual path is an operator action. ⇒ A
+        client that has waited past any interval it considers reasonable
+        should **direct the user to support with the `session_id`**,
+        which is the only handle both sides share.
+
         The Stripe **webhook** (`POST /api/webhooks/stripe`) is a
         server-to-server, signature-authenticated callback and is
         deliberately **not** part of this client contract.
@@ -6945,6 +7029,10 @@ components:
         customer path carries the same signal as the SSE/message
         surface. Cross-spec enum parity is verified by
         `tests/test_asyncapi_named_schemas.py`.
+      # OPEN. Purely diagnostic — it reports which path `auto` took so a caller can
+      # see why. An unrecognised path does not change any decision a consumer makes,
+      # so a new one is safely ignorable and additive.
+      x-enum-openness: open
       enum:
         - stream_copy
         - re_encode
@@ -6971,6 +7059,12 @@ components:
         See `schemas/FORMAT.md` §Availability Taxonomy and
         `docs/decisions/0001-contract-first-availability.md` for the full
         rules, vocabulary rationale, and parser obligations.
+      # CLOSED. A consumer uses this to decide whether to EXPOSE a feature, so an
+      # unrecognised level cannot be handled safely in either direction — hiding a
+      # live capability or surfacing one that is not. ADR-0001 §1.3 defines exactly
+      # these five; a sixth is a contract event that consumers must be updated for,
+      # and failing loudly is the correct way to require that.
+      x-enum-openness: closed
       enum:
         - stable
         - beta
@@ -7873,8 +7967,23 @@ components:
         overridden:
           type: boolean
           description: |
-            True iff a per-account override is active (i.e. `effective`
-            comes from an override rather than the tier default).
+            Whether `effective` came from a per-account override rather than
+            the tier default.
+
+            🔴 **RESERVED, AND STRUCTURALLY `false` TODAY — DO NOT BRANCH ON
+            IT.** No per-account override store exists, and the API's resolver
+            is called with no override for either limit, so **every response
+            carries `false`, and will until an override store ships.**
+            Measured by `compression_api` on 2026-08-28.
+
+            ⚠️ It is declared **required**, so a consumer must handle a field
+            that currently takes exactly one value. It is kept rather than
+            removed because this is the shape an environment-overridable limit
+            needs, and removing it would be a breaking change to re-make later.
+
+            📌 **A test asserting `overridden === false` would be a decoration
+            — no input makes it fail.** When an override store exists, assert
+            against that, not against this field now.
 
     CreditTransaction:
       type: object
@@ -8001,10 +8110,31 @@ components:
           type: string
           description: |
             Identifier of the referenced entity. Typically a UUID v7
-            for `workflow` references, but other reference types
-            (`top_up` carrying a Stripe payment intent ID,
-            `cycle_grant` carrying a cycle date, etc.) may use
-            non-UUID identifiers. NOT constrained to `UuidV7`.
+            for `workflow` references; other reference types may use
+            non-UUID identifiers and this is NOT constrained to
+            `UuidV7`.
+
+            🔴 **FOR A `top_up` FROM CHECKOUT THIS IS THE CHECKOUT
+            SESSION ID (`cs_...`) — THE IDENTIFIER THE CLIENT ACTUALLY
+            HOLDS.** It is returned as
+            `BillingCheckoutSession.session_id` when the session is
+            created, and it is the handle that makes the asynchronous
+            credit grant observable. See `POST /api/billing/checkout`.
+
+            ⚠️ **This description previously named a Stripe PAYMENT
+            INTENT id.** A client never receives one — checkout returns
+            `checkout_url` and `session_id` and nothing else — so the
+            only correlator this contract named was one the caller
+            could not obtain.
+
+            🔴 **NOT YET POPULATED ON THE PACK-PURCHASE PATH.**
+            `compression_api` measured 2026-08-28: the pack grant writes
+            a free-text description naming the SKU and leaves
+            `reference_type` / `reference_id` empty, so **two purchases
+            of the same pack are indistinguishable**. Reservations do
+            populate them. Until the session id is wired through, a
+            `top_up` row carries no correlator and the polling strategy
+            described on checkout has nothing to match on.
         created_at:
           type: string
           format: date-time
@@ -8528,6 +8658,9 @@ components:
           rule when product/Lambda confirms detection logic.)
 
         Per ticket [I25 `i5yCuSZc`](https://trello.com/c/i5yCuSZc).
+      # `WarningType` carries the NORMATIVE statement of the additive convention
+      # ("SDKs MUST treat the enum as additive"), so it is open by its own declaration.
+      x-enum-openness: open
       enum:
         - redundant_pre_encode_before_reencode_merge
 
@@ -8839,6 +8972,14 @@ components:
         429 response). **The per-tier numbers are deliberately not restated
         here** — read them from the source above.
 
+      # CLOSED, AND DELIBERATELY SO. The values are an ORDERED ladder driving upgrade
+      # prompts and tier comparisons — an unknown tier cannot be RANKED, so a consumer
+      # that silently accepted one would place it arbitrarily in that ordering.
+      # Failing on an unknown tier is the correct behaviour.
+      # SURVEY TRAP: this schema's description mentions "typed-open", but that
+      # sentence is about `AccountLimits.limits`, NOT about this enum. A keyword
+      # sweep reads it as open. It is not.
+      x-enum-openness: closed
       enum:
         - basic
         - free
@@ -9459,6 +9600,9 @@ components:
           server. Equivalent to `cancelled` for downstream
           accounting; distinct status so dashboards can surface the
           natural-expiry vs caller-initiated distinction.
+      # Declared "additive widening; V1 clients ignoring unknown enum values
+      # continue to function".
+      x-enum-openness: open
       enum:
         - pending
         - in_progress
@@ -9486,6 +9630,8 @@ components:
         - `in_progress`: At least one operation is running.
         - `completed`: All operations completed successfully.
         - `failed`: Job failed (at least one operation failed).
+      # Declared "additive widening".
+      x-enum-openness: open
       enum:
         - pending
         - waiting
@@ -9559,6 +9705,13 @@ components:
         V1 `watermark` operation removed at V2 cutover (I4-CONS) —
         replaced by `image_watermark` + `text_watermark` per ADR-0004
         §"Greenfield V2.0 cutover".
+      # CLOSED on BOTH sides, and the two sides declare DIFFERENT VALUE SETS on
+      # purpose — see schemas/cross-document-enums.yaml. openapi types the CREATE
+      # SURFACE; asyncapi types the PAYLOAD FIELD, which stays coarse because the
+      # thumbnail sub-types travel on the SNS message ATTRIBUTE, not in the payload.
+      # Closed because an unrecognised operation type cannot be dispatched or
+      # rendered; guessing is never right.
+      x-enum-openness: closed
       enum:
         - compress
         - thumbnail
@@ -9668,10 +9821,31 @@ components:
             use the multipart flow
             (`POST /api/uploads/multipart/initiate` → chunk PUTs →
             `POST /api/uploads/multipart/complete`). 10 MB /
-            10,000,000 bytes — chosen to match the ALB-fronted
-            single-request body cap. Raising this requires
-            infrastructure work (ALB swap or rearchitect; out of
-            scope for this ticket).
+            10,000,000 bytes — matching the **API Gateway HTTP API
+            payload quota** that fronts `api.<domain>`.
+
+            🔴 **THIS CANNOT BE INCREASED.** AWS documents the HTTP API
+            payload limit as 10 MB, "Can be increased: No". It is a
+            platform quota, not a tunable setting, so there is no
+            configuration change or support request that raises it —
+            only a different ingress would.
+
+            ⚠️ **This line previously said the cap matched an
+            "ALB-fronted single-request body cap" and that raising it
+            required an "ALB swap".** There is no ALB in front of
+            `/api/uploads`; the ALB module is instantiated only for
+            `stream.<domain>`. `compression_api` measured this on
+            2026-08-28.
+
+            ⇒ **The NUMBER was right and the RECORDED REASON was wrong,
+            which is the more dangerous way round**: a correct value
+            never triggers a review, and the rationale is what the next
+            person acts on. **And the error pointed the permissive
+            way** — it named a load-balancer setting somebody could
+            raise, where the real constraint is a non-adjustable quota.
+            Anyone revisiting this would have gone looking for a load
+            balancer that is not there, concluded the cap was tunable,
+            and planned work that cannot succeed.
         multipart_chunk_size:
           type: integer
           format: int64
@@ -11332,6 +11506,10 @@ components:
         value is that sentence. Emit it in preference to a
         measurement-asserting value whenever the metrics were absent,
         even if the class ultimately chosen happens to be correct.
+      # OPEN BY CITED CONVENTION, AND IT SAID SO NOWHERE. `WarningType` names it in
+      # the precedent set and this declaration was silent — so a generator reading
+      # only this schema could not learn it. That is the gap this marker closes.
+      x-enum-openness: open
       enum:
         - within_short_form_limits
         - input_size_exceeds_short_form
@@ -11757,6 +11935,11 @@ components:
           could not extract enough metadata to make a routing
           decision. Caller may proceed at their own risk; the
           workflow-create routing fallback applies.
+      # OPEN. `ok` is the only proceed value and everything else is a reason not to,
+      # so a consumer branches on `ok` rather than enumerating failures. A new
+      # failure reason is additive and an old consumer treats it correctly as
+      # not-ok.
+      x-enum-openness: open
       enum:
         - ok
         - corrupt
@@ -11773,6 +11956,11 @@ components:
         the file (e.g. free-tier caller probing a long-form clip,
         or any caller probing a `corrupt` / `unsupported_codec`
         file).
+      # CLOSED. It GATES AN AFFORDANCE: `blocked` is a hard stop and the others
+      # predict routing. An unrecognised class cannot be safely treated as routable —
+      # a consumer guessing would offer an upload the server will refuse. A new
+      # class must reach consumers deliberately.
+      x-enum-openness: closed
       enum:
         - short_form
         - long_form
@@ -14191,17 +14379,49 @@ components:
             once no consumer reads it.
 
             🔴 **KNOWN READER OF `environment`, RECORDED SO THE REMOVAL
-            CONDITION IS CHECKABLE RATHER THAN ASSUMED:**
-            `compression_api` reads it — `CapabilitiesSidecar::fromArray`
-            does `$raw['environment'] ?? null` and `OperationSchemaController`
-            emits it conditionally (reported by that session, 2026-08-25).
-
-            ⚠️ **THEIR ONLY TRIPWIRE IS A TEST THAT REMOVAL TURNS RED AND
-            DEPRECATION DOES NOT** — it asserts `environment === 'baseline'`
-            against the real vendored sidecar. So the null-coalesce means a
-            removal drops the field from `/api/operations/schema` **with no
-            error anywhere**, and the deprecation window generates no signal
-            they can act on.
+            CONDITION IS CHECKABLE RATHER THAN ASSUMED:** `compression_api`
+            reads it.
+
+            **AS MERGED ON THEIR `main` — api #662, merge commit `25801c8d`,
+            verified by ref 2026-08-28, not taken on report:**
+
+            - the read is **successor-preferred**: `capabilities_profile`
+              when provided, `environment` only as a fallback for a sidecar
+              predating the rename. `null` and `''` count as *not provided*
+              and fall back; a **present-but-wrong-type successor does NOT
+              fall back**, so a corrupt successor is never masked by the
+              predecessor's value.
+            - `DeprecatedEnvironmentKeyRemovalTriggerTest` fires on **four**
+              conditions — this contract **stops declaring** `environment`,
+              **loses `deprecated: true`**, **stops naming its successor**
+              via `x-superseded-by`, or **`availability.json` stops carrying
+              `environment`**. ⇒ **api goes red on the removal by itself**,
+              whichever artefact moves first.
+
+            🔴 **THE SIDECAR IS STILL A LEVER — ON THEIR BUILD, NOT ON THEIR
+            WIRE, AND THE TWO NOW POINT OPPOSITE WAYS.** api emits
+            `environment` as a **MIRROR of the resolved profile** rather than
+            as an independent read of the sidecar, so dropping it from
+            `availability.json` **no longer changes their wire output** — it
+            used to. It does now turn their **CI test suite** red, via
+            `testTheSidecarStillCarriesTheDeprecatedKeyItIsMirroredFrom`,
+            proved by mutation rather than by reading.
+            ⛔ **That is a PHPUnit alarm, NOT a build or deploy gate.** Their
+            production image installs without dev dependencies and neither
+            `ci-deploy.yml` nor `deploy-prod.yml` runs PHPUnit — `phpunit`
+            appears in `ci.yml` alone (verified against their `origin/main`).
+            ⇒ **An affected revision can BUILD AND DEPLOY, with the alarm
+            arriving separately.** The control gives detection, not
+            prevention, and the two must not be read as one.
+            ⚠️ **Under expand → migrate → contract the sidecar half fires
+            FIRST**, because the normal ordering drops the key there before
+            retiring the declaration here. ⇒ **Retiring the key quietly via
+            the sidecar ahead of this schema no longer half-works silently;
+            it fails loudly**, which is the outcome to want.
+            ⚠️ **That decoupling is the deliberate price of mirroring**, which
+            is what stops the successor drifting from the field it
+            supersedes; the four-condition control is what pays for it.
+            Recorded here rather than discovered later.
 
             ⇒ **REMOVAL IS A CO-LAND, NOT A CUT.** Tell every reader listed
             here BEFORE the removal ships, and remove a name from this list

package/operation-capabilities/operation-capabilities.json

@@ -732,5 +732,5 @@
       "isAnimated": "maybe"
     }
   },
-  "schema_version": "2.198.0"
+  "schema_version": "2.199.0"
 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@giveitsmaller/contracts",
-  "version": "0.68.0",
-  "description": "Generated contract types for GISL (Give It Smaller). Generated from compression_contracts spec v2.198.0.",
-  "gislContractsSpec": "v2.198.0",
+  "version": "0.69.0",
+  "description": "Generated contract types for GISL (Give It Smaller). Generated from compression_contracts spec v2.199.0.",
+  "gislContractsSpec": "v2.199.0",
   "license": "Apache-2.0",
   "homepage": "https://docs.giveitsmaller.com",
   "bugs": {