Bound JSON-compatible value copying

types.go

@@ -82,7 +82,8 @@ const (
 // Prepare, PrepareExecution, and Run copy the request's maps, pointers, and
 // nested JSON-compatible values before using them. The caller may mutate the
 // request after any method returns. A successful PrepareExecution retains its
-// own private execution snapshot for RunPrepared.
+// own private execution snapshot for RunPrepared. Excessively deep or large
+// JSON-shaped values are rejected for safety.
 type RunRequest struct {
 	// PromptID is the required non-empty prompt identifier.
 	PromptID string
@@ -428,7 +429,8 @@ type ExecutionTargetOverride struct {
 	APIKeyEnv string
 	// ExtraParams, when non-empty, replaces the complete profile or backend map.
 	// Values must be JSON-compatible: nil, booleans, finite numbers, strings,
-	// arrays or slices, and maps with non-empty string keys. Cycles are invalid.
+	// arrays or slices, and maps with non-empty string keys. Cycles and
+	// excessively deep or large values are invalid.
 	ExtraParams map[string]any
 }
 
@@ -479,7 +481,8 @@ type Profile struct {
 	APIKeyRequired bool
 	// ExtraParams contains provider-specific JSON-compatible values. An empty
 	// map inherits backend request defaults, when any. WithProfiles validates
-	// and deeply copies it during NewEngine.
+	// and deeply copies it during NewEngine. Excessively deep or large values
+	// are rejected for safety.
 	ExtraParams map[string]any
 }