@giveitsmaller/contracts 0.81.0 → 0.83.0

package/dist/openapi/runtime.d.ts

@@ -2,7 +2,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Free-text string fields: `x-string-vocabulary` (ticket [`Q79yjcFF`](https://trello.com/c/Q79yjcFF)).** A `type: string` field with no `enum` that names example values says, as data, what a client may do with them (the same marker is used in the AsyncAPI document): - `open` — a vocabulary that grows. Each published value keeps its   meaning, the SET is not closed: switch on the values you know and   handle an unknown one as the generic case (e.g. `ErrorEnvelope.error`). - `advisory` — explanatory text. Display or log it; **never switch on   it** (e.g. `SseWorkflowTerminalData.reason`). - `none` — not a vocabulary at all (an expression or an identifier,   e.g. `OptionSchema.pattern`). A field whose description hedges with \"common values\" or \"free-form\" must carry the marker; a test enforces it.  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.216.0
+ * The version of the OpenAPI document: 2.218.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/openapi/runtime.js

@@ -4,7 +4,7 @@
  * GISL Compression API
  * REST API for the GISL (Give It Smaller) file compression and processing service.  **Architecture:** - Upload files to get a `file_id` - Create workflows referencing uploaded files with operations (compress, thumbnail, image_watermark, text_watermark, merge, archive, convert, custom_luma, audio_overlay, audio_watermark) - Poll status, stream SSE events, or receive webhook callbacks - Download results per operation output  **Response envelope:** All mutation and query endpoints return `{ success: true, data: {...} }` on success and `{ success: false, error: \"...\", details: [...] }` on failure. Exceptions: `GET /api/operations/schema` returns raw JSON (per-tier private caching with ETag revalidation per ADR-0002 + I3), health probes return flat objects, and `POST /api/contact` returns 204 with no body.  **Availability metadata.** This spec uses the `x-availability` vendor extension as **decorative documentation only**. Per [ADR-0001](../docs/decisions/0001-contract-first-availability.md) §1.5, the runtime endpoint `GET /api/operations/schema` (ticket I3) is the authoritative source; the sidecar `availability.json` (ticket I3b) is the authoritative companion (generated, never hand-edited; CI cross-checks runtime ⇄ sidecar). SDKs MUST NOT depend on `x-availability` reaching generated code — code-generators that surface vendor extensions may emit it as documentation, but consumers read availability from the runtime endpoint, not from the generated bindings.  The 5-value vocabulary (`stable | beta | experimental | planned | deprecated`) is defined in the `AvailabilityValue` schema. See `schemas/FORMAT.md` §Availability Taxonomy for the operational rules (parser obligation: absent = stable; per-enum-value granularity is the `per_value_availability` primitive landed via ticket I17).  **Free-text string fields: `x-string-vocabulary` (ticket [`Q79yjcFF`](https://trello.com/c/Q79yjcFF)).** A `type: string` field with no `enum` that names example values says, as data, what a client may do with them (the same marker is used in the AsyncAPI document): - `open` — a vocabulary that grows. Each published value keeps its   meaning, the SET is not closed: switch on the values you know and   handle an unknown one as the generic case (e.g. `ErrorEnvelope.error`). - `advisory` — explanatory text. Display or log it; **never switch on   it** (e.g. `SseWorkflowTerminalData.reason`). - `none` — not a vocabulary at all (an expression or an identifier,   e.g. `OptionSchema.pattern`). A field whose description hedges with \"common values\" or \"free-form\" must carry the marker; a test enforces it.  **Localisation (per ticket [I26](https://trello.com/c/rcnqwgI4)).**  Error responses + paused/blocked workflow statuses carry a localised human-readable `message` alongside a stable, never-localised `message_key`. Machine-readable fields (`error`, enum values, status codes) stay canonical English.  - **Currently committed locales:** `en-GB` only (per ticket   [`4GKyuYo6`](https://trello.com/c/4GKyuYo6)). The I26 carrier   shape (`Accept-Language` + `Content-Language` + `Vary` headers +   `locale` envelope field + `message_key` + `message_params`) is   stable and exercised; the **catalog** of translated `message`   strings is en-GB-only at runtime today. Additional locales (e.g.   `pt-PT`) will be advertised by name when their catalogs ship —   the request/response carrier shape does NOT change when a new   locale lands. Treat unrequested locales as \"machine-code +   `message_key` path is committed; localised `message` prose is   not\" until this prose enumerates them by name. - **Request:** `Accept-Language` header per RFC 9110 §12.5.4 (q-value   negotiation supported). The server selects the best-match locale   from its supported list; falls back to `en-GB` when no match —   which, until additional catalogs land, is every non-`en-GB`   `Accept-Language`. - **Response:** `Content-Language: <locale>` echo on every localised   response; `Vary: Accept-Language` on every response (CDN/cache   correctness — different `Accept-Language` requests produce   different responses). `Vary` is emitted unconditionally so the   header contract does not flip when a second locale ships. - **Fallback locale:** `en-GB` (also the canonical locale for   `message_key` translations and English `message` prose). - **SDK guidance:** switch on `error` (machine code) for typed   error branches; surface `message_key` to client-side i18n   catalogs (SDK companion work tracked at X19, cross-repo);   display `message` for end-user UI; **never parse `message` for   control flow** — it changes per locale.  Carrier shape lives on `ErrorEnvelope` (envelope-level optional `message_key` + `message` + `locale` + `message_params`) and `ValidationErrorEnvelope` (also per-`details[]` entry). Existing 402 / 403 / 422 envelopes (`BalanceExhaustedResponse`, `FeatureNotAvailableResponse`, `FeatureTierRestrictedResponse`, `WorkflowPausedDetail`) inherit the convention.  **Upload thresholds (per tickets [u0ar7Yye](https://trello.com/c/u0ar7Yye) + [58nBQLWQ](https://trello.com/c/58nBQLWQ)).** Canonical upload constants (single-shot cap, multipart chunk size, multipart concurrency default, multipart first-chunk size) live on the `UploadThresholds` schema with `const:`-pinned values. SDK generators emit these as typed binding constants so frontend / API / SDKs reference one source of truth instead of hardcoding magic numbers. A runtime `GET /api/uploads/limits` endpoint for dynamic discovery (per-tier / per-environment overrides) is a deferred follow-up.
  *
- * The version of the OpenAPI document: 2.216.0
+ * The version of the OpenAPI document: 2.218.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/openapi/README.md

@@ -10,7 +10,7 @@
 - **Generator:** [openapi-generator-cli](https://openapi-generator.tech/) v7.21.0
   (Docker image: `openapitools/openapi-generator-cli:v7.21.0`)
 - **Generator preset:** `typescript-fetch`, models only
-- **Files:** 269
+- **Files:** 270
 
 ## Contents
 

package/openapi/api.yaml

@@ -103,7 +103,7 @@ info:
     of truth instead of hardcoding magic numbers. A runtime
     `GET /api/uploads/limits` endpoint for dynamic discovery
     (per-tier / per-environment overrides) is a deferred follow-up.
-  version: 2.216.0
+  version: 2.218.0
   contact:
     name: API Support
 
@@ -255,13 +255,34 @@ paths:
                     required_tier: "enterprise"
         '413':
           description: |
-            The upload is too large. Two rejection cases, discriminated by the
-            `ErrorEnvelope.error` code:
-
-            - **Byte size** — the file exceeds the absolute maximum upload size
-              (across all tiers). For tier-specific size caps below this
-              absolute limit, the server returns 403 with `error_type:
-              tier_restriction, restriction_kind: file_size` instead.
+            The upload is too large. Two rejection cases from the API,
+            discriminated by the `ErrorEnvelope.error` code, plus one from the
+            edge:
+
+            - **Edge (no envelope)** — a request whose whole `multipart/form-data`
+              BODY exceeds the API gateway's payload limit is refused by the
+              gateway before the API runs, as a 413 with no `ErrorEnvelope`.
+              Near the single-shot maximum the form encoding can push the body
+              past that limit, so a client MUST treat ANY 413 on this endpoint
+              as "too large", with or without an envelope. An authenticated
+              client SHOULD send files near `single_shot_max_bytes` through
+              multipart; a guest cannot (multipart requires an account, see
+              `schemas/anonymous-policy.yaml`) and is limited to the single-shot
+              maximum. Only the two API-generated cases below carry an
+              `ErrorEnvelope`.
+
+            - **Byte size** (`error: FILE_TOO_LARGE`, `error_type:
+              file_too_large`, `message_params.max_bytes` = the limit that was
+              exceeded) — the file exceeds this endpoint's maximum byte size
+              (the single-shot maximum; larger files use the multipart
+              endpoints). For tier-specific size caps below it, the server
+              returns 403 with `error_type: tier_restriction,
+              restriction_kind: file_size` instead. ⚠️ The API currently
+              answers this case with `400 BAD_REQUEST`, which also covers a
+              missing file or an invalid filename (api card `E8xFECmG` moves
+              the size case here). Until that ships, only a client that
+              already knows its file exceeds `single_shot_max_bytes` should
+              read that 400 as "too large".
             - **Pixel dimensions** (`error: IMAGE_DIMENSIONS_TOO_LARGE`) — a
               decodable raster image whose `width × height` exceeds the
               SINGLE-SHOT pixel ceiling (`UPLOAD_MAX_IMAGE_PIXELS`, default
@@ -285,10 +306,14 @@ paths:
                 $ref: '#/components/schemas/ErrorEnvelope'
               examples:
                 file_too_large:
-                  summary: File exceeds the absolute maximum byte size
+                  summary: File exceeds this endpoint's maximum byte size
                   value:
                     success: false
-                    error: "File size exceeds maximum allowed (100 GiB)"
+                    error: "FILE_TOO_LARGE"
+                    error_type: "file_too_large"
+                    message: "The file is larger than the maximum for this upload method."
+                    message_params:
+                      max_bytes: 10000000
                 image_dimensions_too_large:
                   summary: Decodable raster exceeds the pixel-dimension ceiling
                   value:
@@ -418,7 +443,7 @@ paths:
 
         After all parts are uploaded to S3, call the complete endpoint to finalise.
       operationId: multipartInitiate
-      security: [{}, {bearerAuth: []}, {sessionAuth: []}]  # optional (anon-tolerant; manifest.userId pinned to caller if authed)
+      security: [{bearerAuth: []}, {sessionAuth: []}]  # REQUIRED: api security.yaml puts multipart behind IS_AUTHENTICATED_FULLY and initiate() 401s a guest (measured 2026-09-26; anonymous-policy.yaml multipart_allowed: false)
       tags:
         - Upload
       requestBody:
@@ -497,9 +522,11 @@ paths:
               and multipart carries ordinary camera photos — **a 24 MP photo
               must pass**. API setting `UPLOAD_MAX_MULTIPART_IMAGE_PIXELS`,
               enforced at multipart initiate. Default 50 MP (hub ruling 2026-09-24, on lambdas'
-              recommendation: the image workers declare a 100 MP source cap,
-              but none has run a job that large, so it stays at half that
-              until a staging proof). It is an API setting, so authenticated
+              recommendation, then made with the workers' per-format decode
+              ceilings unmeasured). Those ceilings are now declared per group
+              as `max_input_pixels` (2026-09-26: PNG 100 MP, JPEG 90 MP,
+              WebP 75 MP), all above this default; see that field for which
+              ceiling binds when. It is an API setting, so authenticated
               clients read the effective value from
               `limits.max_multipart_upload_image_pixels`
               (`GET /api/v2/account/limits`) once the API emits it.
@@ -582,7 +609,7 @@ paths:
         rule and additionally refuse anonymous-initiated sessions
         outright (returning 403 `MULTIPART_SESSION_AUTH_REQUIRED`).
       operationId: multipartComplete
-      security: [{}, {bearerAuth: []}, {sessionAuth: []}]  # optional (anon-tolerant; ownership-scoped per HxUmVr3Y when manifest.userId set)
+      security: [{bearerAuth: []}, {sessionAuth: []}]  # REQUIRED in practice: a session can only be initiated authenticated (see initiate), and completion is ownership-scoped (HxUmVr3Y)
       x-identity-scoped: true  # session/ownership-scoped per ADR-0016 D3
       tags:
         - Upload
@@ -1786,13 +1813,31 @@ paths:
               credential) requested an operation outside the anonymous
               allow-list. `operation` names the first such operation.
               A register-wall: signing in is the remedy, not upgrading.
-            - `anonymous_quota_exhausted`: an anonymous caller has used
-              its per-IP workflow allowance for the rolling 24 hours.
-              Also a register-wall.
-
-            Both anonymous walls are checked BEFORE the workflow is
-            built, and neither consumes the caller's anonymous
-            allowance. An authenticated caller never receives either.
+            - `anonymous_quota_exhausted`: this create would cost more
+              credits than the caller's per-IP allowance has left in the
+              rolling 24 hours (`schemas/anonymous-policy.yaml`
+              `allowance`). Also a register-wall. Carries `allowance`,
+              `remaining` and `cost`, and `Retry-After` unless the request
+              costs more than the whole allowance.
+            - `anonymous_limit_exceeded`: an anonymous caller's input
+              exceeds a guest-only limit (today: video duration). Also a
+              register-wall.
+
+            The anonymous walls are checked BEFORE the workflow is
+            built, and none consumes the caller's anonymous
+            allowance. An authenticated caller never receives any.
+          headers:
+            Retry-After:
+              required: false
+              description: |
+                Present only on `anonymous_quota_exhausted`, and only when
+                the request's `cost` fits the `allowance` at all: seconds
+                until enough of the caller's rolling 24 h credit window
+                frees up for it. Delta-seconds (RFC 9110). Signing in
+                remains the immediate remedy.
+              schema:
+                type: integer
+                minimum: 0
           content:
             application/json:
               schema:
@@ -1801,6 +1846,7 @@ paths:
                   - $ref: '#/components/schemas/FeatureTierRestrictedResponse'
                   - $ref: '#/components/schemas/AnonymousOperationNotAllowedResponse'
                   - $ref: '#/components/schemas/AnonymousQuotaExhaustedResponse'
+                  - $ref: '#/components/schemas/AnonymousLimitExceededResponse'
                 discriminator:
                   propertyName: error_type
                   mapping:
@@ -1808,6 +1854,7 @@ paths:
                     feature_tier_restricted: '#/components/schemas/FeatureTierRestrictedResponse'
                     anonymous_operation_not_allowed: '#/components/schemas/AnonymousOperationNotAllowedResponse'
                     anonymous_quota_exhausted: '#/components/schemas/AnonymousQuotaExhaustedResponse'
+                    anonymous_limit_exceeded: '#/components/schemas/AnonymousLimitExceededResponse'
               examples:
                 feature_tier_restricted:
                   summary: Free tier referencing a Pro-tier operation
@@ -1839,6 +1886,21 @@ paths:
                     message: "Sign up to keep compressing."
                     message_key: "error.anonymous_quota_exhausted"
                     locale: "en-GB"
+                    allowance: 30
+                    remaining: 2
+                    cost: 5
+                anonymous_limit_exceeded:
+                  summary: Anonymous caller's video is longer than the guest cap
+                  value:
+                    success: false
+                    error: "ANONYMOUS_LIMIT_EXCEEDED"
+                    error_type: "anonymous_limit_exceeded"
+                    message: "Sign up to process videos longer than a minute."
+                    message_key: "error.anonymous_limit_exceeded"
+                    locale: "en-GB"
+                    limit: "video_duration_seconds"
+                    actual: 95
+                    maximum: 60
         '402':
           description: |
             Credit reservation failed (per ticket
@@ -3934,7 +3996,7 @@ paths:
         The original failed operation is marked as `retried` and a new operation with
         a new ID is created in `pending` state.
       operationId: retryOperation
-      security: [{}, {bearerAuth: []}, {sessionAuth: []}]  # optional (anon-OK; identity-scoped to operation owner)
+      security: [{bearerAuth: []}, {sessionAuth: []}]  # REQUIRED: api security.yaml:103 requires IS_AUTHENTICATED_FULLY for retry (sdks, measured 2026-09-26)
       x-identity-scoped: true  # operation-ownership-scoped per ADR-0016 D3
       tags:
         - Operations
@@ -8452,9 +8514,10 @@ components:
               # ceiling (width x height from the header) — the 413
               # IMAGE_DIMENSIONS_TOO_LARGE threshold on the multipart path. A
               # SEPARATE, HIGHER API setting than max_upload_image_pixels:
-              # default 50 MP (hub, 2026-09-24), about half the workers'
-              # declared 100 MP source cap, which is unproven end to end; it
-              # rises only after a 100 MP staging proof. It MUST admit a 24 MP
+              # default 50 MP (hub, 2026-09-24). The workers' decode ceilings
+              # were measured 2026-09-26 and are declared per group as
+              # `max_input_pixels` (PNG 100 MP, JPEG 90 MP, WebP 75 MP), all
+              # above this default. It MUST admit a 24 MP
               # photo. The server serves the number. Not tier-varying today.
               $ref: '#/components/schemas/AccountLimitEntry'
 
@@ -9708,7 +9771,9 @@ components:
       description: |
         403 from `POST /api/workflows` when an ANONYMOUS caller (no
         credential) requests an operation outside the anonymous
-        allow-list. A register-wall: the frontend renders a sign-up
+        allow-list, declared in `schemas/anonymous-policy.yaml`
+        (`operations_allowed`; the file also declares the guest upload and
+        quota limits). A register-wall: the frontend renders a sign-up
         prompt, since no tier upgrade applies to a caller without an
         account.
 
@@ -9716,10 +9781,10 @@ components:
         (`JobsErrorCode::AnonymousOperationNotAllowed`), which checks
         every operation in the body and names the FIRST disallowed one.
 
-        ⚠️ **The allow-list itself is NOT yet declared in this contract**
-        (ticket [`UQ7zROTr`](https://trello.com/c/UQ7zROTr)), so a client
-        can parse this refusal but cannot yet predict it. Do not hard-code
-        the list from this description: it deliberately names none.
+        **Predict it from `schemas/anonymous-policy.yaml`**
+        (`operations_allowed`; ticket [`UQ7zROTr`](https://trello.com/c/UQ7zROTr)),
+        the one declaration of the allow-list. Do not hard-code the list
+        from this description: it deliberately names none.
       allOf:
         - $ref: '#/components/schemas/ErrorEnvelope'
         - type: object
@@ -9743,19 +9808,36 @@ components:
     AnonymousQuotaExhaustedResponse:
       description: |
         403 from `POST /api/workflows` when an ANONYMOUS caller (no
-        credential) has used its per-IP workflow allowance for the
-        rolling 24 hours. A register-wall, distinct from the generic
-        `429`: the remedy is signing in, not waiting.
+        credential) asks for a workflow that would cost more CREDITS than
+        its per-IP allowance has left in the rolling 24 hours
+        (`schemas/anonymous-policy.yaml` `allowance`, priced with the same
+        operation weights as a signed-in caller). The request is refused
+        whole; nothing runs. A register-wall, distinct from the generic
+        `429`: the remedy is signing in.
+
+        The recovery figures are REQUIRED fields of this envelope, not
+        localisation parameters (`ErrorEnvelope.message_params` excludes
+        cost numbers): `allowance`, `remaining` and `cost`, in credits.
+
+        Two cases, told apart by `cost` against `allowance`:
+        - `cost <= allowance`: waiting helps. The response carries
+          `Retry-After`, the seconds until enough of the window frees up.
+        - `cost > allowance`: the request can NEVER fit a guest window
+          (the body is not bounded to the allowance). No `Retry-After`;
+          only signing in, or a smaller request, helps.
 
         Mirrors `compression_api`'s `WorkflowController` register-wall
-        (`JobsErrorCode::AnonymousQuotaExhausted`). The allowance is only
-        consumed by a workflow that is actually created, so a refused
-        request does not use it up.
+        (`JobsErrorCode::AnonymousQuotaExhausted`). Credits are charged
+        only by a workflow that is actually created, and released on
+        failure, so a refused request does not use any up.
       allOf:
         - $ref: '#/components/schemas/ErrorEnvelope'
         - type: object
           required:
             - error_type
+            - allowance
+            - remaining
+            - cost
           properties:
             error:
               enum:
@@ -9765,6 +9847,64 @@ components:
               type: string
               enum:
                 - anonymous_quota_exhausted
+            allowance:
+              type: integer
+              minimum: 0
+              description: Credits per rolling 24 h for this IP (the policy value).
+            remaining:
+              type: integer
+              minimum: 0
+              description: Credits left in the window when the request was refused.
+            cost:
+              type: integer
+              minimum: 1
+              description: |
+                What this request would have charged. When it exceeds
+                `allowance`, the request can never fit and `Retry-After`
+                is absent.
+    AnonymousLimitExceededResponse:
+      description: |
+        403 from `POST /api/workflows` when an ANONYMOUS caller's input
+        exceeds a guest-only limit declared in
+        `schemas/anonymous-policy.yaml`. Today the one such limit is the
+        video duration cap (`video.max_duration_seconds`), measured on the
+        upload probe's duration; the create waits for the probe first. A
+        register-wall: signing in lifts the guest limit (the signed-in
+        caller's ordinary class ceilings then apply). Not a
+        processing-class refusal: no class or tier ceiling is involved.
+      allOf:
+        - $ref: '#/components/schemas/ErrorEnvelope'
+        - type: object
+          required:
+            - error_type
+            - limit
+            - actual
+            - maximum
+          properties:
+            error:
+              enum:
+                - ANONYMOUS_LIMIT_EXCEEDED
+            error_type:
+              description: Discriminator for the 403 oneOf. Always `anonymous_limit_exceeded` for this envelope.
+              type: string
+              enum:
+                - anonymous_limit_exceeded
+            limit:
+              description: |
+                Which guest limit was exceeded. OPEN: a consumer that does
+                not know a value shows the envelope's localised message.
+              type: string
+              x-enum-openness: open
+              enum:
+                - video_duration_seconds
+            actual:
+              type: integer
+              minimum: 0
+              description: The input's value, in the unit `limit` names (seconds, rounded up).
+            maximum:
+              type: integer
+              minimum: 0
+              description: The guest limit, from `schemas/anonymous-policy.yaml`.
     FeatureViolation:
       type: object
       description: |
@@ -16148,6 +16288,42 @@ components:
             §`per_mime_availability`.
         ceiling_basis:
           $ref: '#/components/schemas/CeilingBasis'
+        max_input_pixels:
+          type: integer
+          format: int64
+          minimum: 1
+          description: |
+            The largest INPUT image, in decoded pixels (width x height), that
+            this group's worker is declared to process (owner decision
+            607(d), 2026-09-26: decode memory, not bytes, binds for raster
+            images). Present only where it was measured.
+
+            WHICH PIXEL CEILING BINDS WHEN. There are three, at three stages:
+            1. UPLOAD, single-shot: `limits.max_upload_image_pixels`
+               (default 16 MP; API setting `UPLOAD_MAX_IMAGE_PIXELS`), 413
+               `IMAGE_DIMENSIONS_TOO_LARGE`.
+            2. UPLOAD, multipart: `limits.max_multipart_upload_image_pixels`
+               (default 50 MP; admits a 24 MP phone photo), same 413.
+            3. OPERATION: this field, the worker's declared decode ceiling. The
+               worker refuses above it (`input_too_large`, header-only, before
+               decoding); the API is to check it at workflow create too (api
+               card, co-land), after which it refuses before any job runs.
+            An uploaded image passes its upload gate first, so it meets
+            `min(upload ceiling, this field)`. Every value declared here is at
+            least 75 MP, above both upload defaults, so today the UPLOAD
+            ceiling binds for uploads, and this field binds for inputs that
+            did not come through an upload gate (another job's output, an
+            import), or if an upload ceiling is raised past it. A 24 MP photo
+            passes all three.
+
+            THE VALUE IS AN UPPER BOUND, NOT A GUARANTEE FOR EVERY IMAGE. Where
+            the worker's real limit is a decode-memory budget, images with more
+            bytes per pixel (alpha, 16-bit channels) hit it at fewer pixels,
+            and the worker refuses them with `input_too_large` (typed, not
+            retryable, before any billed work) below this field. PNG is the
+            measured case: 100 MP is the 8-bit RGBA value; 16-bit RGB reaches
+            the budget near 67 MP and 16-bit RGBA near 50 MP. A pre-flight
+            check against this field therefore cannot promise acceptance.
         max_input_size_bytes:
           type: integer
           format: int64

package/operation-capabilities/operation-capabilities.json

@@ -860,5 +860,5 @@
       "isAnimated": "maybe"
     }
   },
-  "schema_version": "2.216.0"
+  "schema_version": "2.218.0"
 }

package/operations/schemas/compress.yaml

@@ -97,9 +97,15 @@ operation:
       # Resize-inside-Output shares the convert resize engine's 16MP output-area
       # wall — the per-axis 16384 cap can't express it (FORMAT.md §max_output_pixels).
       max_output_pixels: 16000000
+      # 607(d) image-decode corner run (lambdas, staging compression-image v144, git-2166848,
+      # 2026-09-26; vm_shared 10_Now/lambdas-corner-img-results-2026-09-26.md).
+      # Largest passing 370 MB / 90 MP. 493 MB / 120 MP failed: the input plus its
+      # intermediate exceed the worker's 512 MB /tmp.
       ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
-        max_input_size_bytes: unproven
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
+        max_input_size_bytes: proven
+        max_input_pixels: proven
+      max_input_size_bytes: 370000000   # was 500 MiB
+      max_input_pixels: 90000000
       options:
         quality:
           type: integer
@@ -279,9 +285,20 @@ operation:
       mimes:
         - image/png
       max_output_pixels: 16000000
+      # 607(d) image-decode corner run (lambdas, staging compression-image v144, git-2166848,
+      # 2026-09-26; vm_shared 10_Now/lambdas-corner-img-results-2026-09-26.md).
+      # The binding limit is DECODED PIXELS: the shared decoder's 400 MB allocation
+      # budget, so the pixel ceiling depends on colour type (~133 MP RGB8, 100 MP
+      # RGBA8, ~67 MP RGB16, 50 MP RGBA16). 100 MP is the RGBA8 value; RGB8 passed
+      # at 120 MP / 360 MB, and RGBA8 at 100 MP is not yet run, so it stays
+      # unproven. Beyond the budget the worker refuses with input_too_large: a
+      # 16-bit RGBA PNG reaches it at ~50 MP, below this value, and is refused
+      # there (typed, before billing work), not served.
       ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
-        max_input_size_bytes: unproven
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
+        max_input_size_bytes: proven
+        max_input_pixels: unproven
+      max_input_size_bytes: 360000000   # largest passing (120 MP RGB8); was 500 MiB, unreachable within the decode budget
+      max_input_pixels: 100000000
       options:
         # PROVENANCE (author-side, NOT user-facing — kept out of the description per
         # 7KkNSvdv / FE BhVwdlhQ: no implementation detail or licence copy in user text):
@@ -436,8 +453,9 @@ operation:
       mimes:
         - image/avif
       max_output_pixels: 16000000
+      # 607(d): PROVEN, 19.57 MiB passed (staging v144); above 20 MB the worker refuses.
       ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
-        max_input_size_bytes: unproven
+        max_input_size_bytes: proven
       max_input_size_bytes: 20971520   # 20 MiB compress input ceiling (uKsFzORi; AVIF decode OOM guard, worker AVIF_MAX_MB)
       options:
         quality:
@@ -606,9 +624,16 @@ operation:
       mimes:
         - image/webp
       max_output_pixels: 16000000
+      # 607(d) image-decode corner run (lambdas, staging compression-image v144, git-2166848,
+      # 2026-09-26; vm_shared 10_Now/lambdas-corner-img-results-2026-09-26.md).
+      # Passed at 270 MB / 90 MP but at 98% of the function's memory; 120 MP was
+      # OOM-killed (no terminal result). lambdas' header pre-flight (AmYqFGaI)
+      # refuses above 75 MP before any decode, so 75 MP is the declared value.
       ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
-        max_input_size_bytes: unproven
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
+        max_input_size_bytes: proven
+        max_input_pixels: proven
+      max_input_size_bytes: 270000000   # was 500 MiB
+      max_input_pixels: 75000000
       options:
         quality:
           type: integer
@@ -814,27 +839,25 @@ operation:
       # claiming it.)
       mimes:
         - image/svg+xml
-      # KNOWN OVER-ADVERTISEMENT, DELIBERATELY LEFT AS-IS — do NOT lower this
-      # unilaterally. compress_svg holds the markup in memory and caps SVGO
-      # output at 100 MiB (image_compressor.rs:1243), so the 500 MiB image/*
-      # default over-states what the SVG route can actually serve: a valid input
-      # inside the advertised limit can fail on the worker cap. Codex flagged it
-      # on the flip PR and it is a real gap.
-      #
-      # It stays 500 MiB here because this value is an API-ENFORCED constant, not
-      # documentation — tests/test_group_input_caps.py pins these to the api
-      # enforcer, so changing the contract alone would create contract-vs-enforcer
-      # DRIFT rather than fix anything. Lowering it needs an api co-land, and a
-      # figure lambdas has actually measured (the only SVG datapoint today is a
-      # 43 KB fixture). Ticket filed; lambdas already flagged a per-format cap as
-      # their follow-up.
-      #
-      # PRE-EXISTING, not introduced by the 2026-07-21 restore: the same 500 MiB
-      # applied while this route was stable before 2026-07-17. Recorded rather
-      # than silently carried.
+      # RESOLVED 2026-09-26 (607(d)): this group used to carry the 500 MiB image/*
+      # default, a known over-advertisement left in place until lambdas measured a
+      # figure (see the note below). The api enforcer reads this value from the
+      # vendored schema, so lowering it here lowers enforcement at api's next
+      # vendoring.
+      # 607(d) corner run (lambdas, staging v144, 2026-09-26): WHY ~1 MB. compress SVG runs
+      # the external SVGO binary under a FIXED 30 s tool timeout
+      # (image_compressor.rs svg_compression_timeout). No rasterising and memory is not
+      # the limit: 1 MB (9.6k elements) passed in 4.4 s; 4 MB, 20 MB and 100 MB all
+      # failed at ~30.2 s (processing_limit_exceeded). Cost scales with ELEMENT COUNT,
+      # not bytes, so bytes are a proxy. The 30 s is a code constant (a TODO sits at its
+      # call site), not the Lambda budget: raising it is a lambdas choice, after which
+      # this ceiling can be re-measured upward.
+      # UNPROVEN as a guarantee: bytes are only a PROXY for element count. The 1 MB
+      # run had 9.6k rects; a denser SVG under 1 MB can still hit the 30 s cap
+      # (codex #622). Proven only once lambdas bounds element count or the cap moves.
       ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
         max_input_size_bytes: unproven
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi; image/* default)
+      max_input_size_bytes: 1000000   # was 500 MiB
       options:
         # No `quality`: compress SVG is SVG->SVG via SVGO (VISUALLY PRESERVING
         # vector optimise — not lossless; see the group note above on convertPathData);
@@ -895,6 +918,11 @@ operation:
         - image/gif
         - image/tiff
       max_output_pixels: 16000000
+      # 607(d): ONE ceiling for TWO formats that measured differently. GIF passed at
+      # 515 MB (30 x 12.5 MP frames; the worker caps a frame at 12.5 MP); TIFF passed
+      # only to 150 MB / 50 MP (100 MP refused by libcaesium). A single group value
+      # cannot state both, so it stays unproven until the group splits into
+      # image_gif + image_tiff (IJofpQLI's pending split).
       ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
         max_input_size_bytes: unproven
       max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)

package/operations/schemas/merge.yaml

@@ -318,6 +318,22 @@ operation:
           description: "Crossfade duration in seconds"
         normalize_audio:
           type: boolean
+          # KNOWN LIMITATION (hub ruling 2026-09-26, lambdas 7sbbABVG). CORRECTED
+          # 2026-09-26 17:32 by lambdas' measurement (local, static FFmpeg 7.1.1,
+          # instrument validated against 0 ms and +100 ms controls): the default
+          # stream-copy concat does NOT accumulate. Each join is offset by a
+          # constant, about +7.5 ms after a clip whose audio is longer than its
+          # video and about -37 ms (audio early) after one whose audio is shorter,
+          # because the concat demuxer drops each later file's AAC priming skip.
+          # The first draft said the offset ACCUMULATED; that was an inference, not
+          # a measurement, and is withdrawn. The normalize_audio=true route did
+          # accumulate (+362 ms by the 8th join); lambdas fixed that in cTk1wbib,
+          # which is NOT yet deployed. The deployed `true` route was measured at
+          # one join only (-44 ms), so the description does not claim
+          # "not cumulative" for `true` (codex #620). Whether to re-encode the default route's audio to
+          # remove the constant is an OWNER decision. Hub ruling 17:33: keep the
+          # description sentence until a REAL source measured on staging shows a
+          # per-join offset above 45 ms (then widen it), or the owner rules.
           # DEFAULT FALSE since 2026-09-26 (owner decision, 607(d)): with it on,
           # every video merge re-encodes, and the re-encode does not fit the
           # short_form ceiling. THE API APPLIES THIS DEFAULT: when a request omits
@@ -343,7 +359,12 @@ operation:
             long_form_re_encode: { availability: planned }
           description: >-
             Normalize audio levels across all clips. Off by default (the server
-            applies the default when the option is omitted). Turning it
+            applies the default when the option is omitted). Known issue:
+            at each join of video clips, audio may lead video by up to about
+            40 ms with the default (`false`); the offset is per join and does
+            not add up across joins. With `true`, an offset of about 45 ms
+            was measured at a single join; merges with more joins are not
+            yet measured on that setting. Turning it
             on re-encodes every clip, which lowers the limit: about 120 seconds
             of combined 720p video was measured to fit, instead of 5 minutes.
             NOT available on the long-form path, which forces loudness

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@giveitsmaller/contracts",
-  "version": "0.81.0",
-  "description": "Generated contract types for GISL (Give It Smaller). Generated from compression_contracts spec v2.216.0.",
-  "gislContractsSpec": "v2.216.0",
+  "version": "0.83.0",
+  "description": "Generated contract types for GISL (Give It Smaller). Generated from compression_contracts spec v2.218.0.",
+  "gislContractsSpec": "v2.218.0",
   "license": "Apache-2.0",
   "homepage": "https://docs.giveitsmaller.com",
   "bugs": {
@@ -31,6 +31,7 @@
     "./openapi/api.yaml": "./openapi/api.yaml",
     "./asyncapi/events.yaml": "./asyncapi/events.yaml",
     "./resolution-bands.yaml": "./resolution-bands.yaml",
+    "./anonymous-policy.yaml": "./anonymous-policy.yaml",
     "./availability/availability.json": "./availability/availability.json",
     "./accepted-options/accepted-options.json": "./accepted-options/accepted-options.json",
     "./accepted-options/image-output-routes.json": "./accepted-options/image-output-routes.json",
@@ -65,7 +66,8 @@
     "accepted-options/image-output-routes.json",
     "operation-capabilities/operation-capabilities.json",
     "code-builder/code-builder-metadata.json",
-    "resolution-bands.yaml"
+    "resolution-bands.yaml",
+    "anonymous-policy.yaml"
   ],
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist', {recursive: true, force: true})\"",