Module attachments 

Offline preflight for canonical user attachments and rich tool results.

This is a model and transport gate, not a model-name heuristic. Nothing here fetches a catalog, reads an attachment path, or contacts a provider. Call again on every outgoing history (including resume/model switches). Errors are static: neither payloads, titles, MIME strings nor model IDs from untrusted messages are interpolated into diagnostics.

Constants

MAX_ATTACHMENTS_PER_MESSAGE

Shared with attachment loaders; nested tool media counts toward this limit.

MAX_BROKER_PROXY_BYTES

Keep the broker’s existing bound authoritative; never raise it for media.

MAX_HISTORY_ENCODED_BYTES

Encoded attachment blocks across the complete outgoing history.

MAX_IMAGE_BYTES

3.5 MiB, matching the read tool’s raw image bound.

MAX_PDF_BYTES

MAX_TEXT_DOCUMENT_BYTES

UTF-8 bytes, not Unicode scalar values.

Functions

validate_messages

Validate canonical top-level user image/document blocks and media inside user tool_result.content arrays. Non-media tool inputs are not traversed: a JSON object supplied as tool arguments is data, not a content block.

validate_tool_blocks

Validate one tool’s rich output before committing it to a tool_result. Callers can replace Err with a plain-text tool error; no offending bytes need enter history. The outgoing full-history check remains mandatory, since sibling tool results share one message count/broker/history budget.