@civitai/app-sdk 0.56.1 → 0.58.0

package/dist/blocks/types.js

@@ -114,4 +114,30 @@ export function isPageSlotContext(ctx) {
 export function isSignedIn(viewer) {
     return viewer !== null && viewer !== undefined;
 }
+// ============================================================
+// App Blocks TRAINING kind (`kind: 'training'`)
+// ============================================================
+//
+// 🔴 MIRRORED FROM THE HOST, NOT DESIGNED HERE. Every type in this section copies
+// civitai/civitai's zod at `a32f506516` (main, after civitai/civitai#5434):
+// `blockTrainingBodySchema` in `src/server/schema/blocks/workflow.schema.ts`, and
+// `aiToolkitTrainingParamsSchema` in `src/server/schema/orchestrator/training.schema.ts`
+// for `params`. The host's zod is the definition; this is the copy. A field the
+// host adds is invisible here until this file is updated, and the host rejects a
+// body that does not parse — so a mismatch shows up as a refused estimate, never
+// as a silently different run.
+/** Ceiling on what ONE confirmed `kind: 'training'` run may cost, in Buzz. Host constant `BLOCK_TRAINING_MAX_BUZZ_PER_RUN`. */
+export const BLOCK_TRAINING_MAX_BUZZ_PER_RUN = 5000;
+/** Max images in one prepared training dataset. Host constant `BLOCK_TRAINING_DATASET_MAX_ITEMS`. */
+export const BLOCK_TRAINING_DATASET_MAX_ITEMS = 50;
+/** Max characters of one dataset caption. Host constant `BLOCK_TRAINING_CAPTION_MAX_CHARS`. */
+export const BLOCK_TRAINING_CAPTION_MAX_CHARS = 1000;
+/** Max sample prompts on a training body. Host constant `BLOCK_TRAINING_SAMPLE_PROMPTS_MAX`. */
+export const BLOCK_TRAINING_SAMPLE_PROMPTS_MAX = 6;
+/** Max characters of one sample prompt. Host constant `BLOCK_TRAINING_SAMPLE_PROMPT_MAX_CHARS`. */
+export const BLOCK_TRAINING_SAMPLE_PROMPT_MAX_CHARS = 1000;
+/** Max characters of the trigger word. Host constant `BLOCK_TRAINING_TRIGGER_WORD_MAX_CHARS`. */
+export const BLOCK_TRAINING_TRIGGER_WORD_MAX_CHARS = 64;
+/** Max characters of the base-model key. Host constant `BLOCK_TRAINING_MODEL_KEY_MAX_CHARS`. */
+export const BLOCK_TRAINING_MODEL_KEY_MAX_CHARS = 64;
 //# sourceMappingURL=types.js.map

package/dist/index.d.ts

@@ -25,10 +25,16 @@
  *
  *  - **`./blocks`** — importing it RUNS `./safe-storage` for its side effect
  *    (repairing `localStorage`/`sessionStorage` at an opaque origin). Folding
- *    119 symbols and that side effect into the root would make every OAuth app
+ *    154 symbols and that side effect into the root would make every OAuth app
  *    that writes `import { exchangeCode } from '@civitai/app-sdk'` pay for the
  *    Civitai-Apps contract it does not use. Blocks and OAuth apps are disjoint
  *    audiences; see this package's README.
+ *    🔴 That 154 is ASSERTED, not merely quoted — by
+ *    `packages/civitai-app-sdk/test/export-surface.test.ts`, which pins
+ *    `surface.get('./blocks').size`. It said 119 here against a real 125 until
+ *    2026-10-04, because the existing checks pin the root as an exact union and
+ *    each subpath's set relations, none of which can see a subpath GROW. Update
+ *    both this line and the ledger `reason` in that file together.
  *  - **`./safe-storage`** — the same side effect, and its whole point is being
  *    imported FOR it (`import '@civitai/app-sdk/safe-storage'`). A side effect
  *    on the root barrel is not something a consumer can opt out of.

package/dist/index.js

@@ -25,10 +25,16 @@
  *
  *  - **`./blocks`** — importing it RUNS `./safe-storage` for its side effect
  *    (repairing `localStorage`/`sessionStorage` at an opaque origin). Folding
- *    119 symbols and that side effect into the root would make every OAuth app
+ *    154 symbols and that side effect into the root would make every OAuth app
  *    that writes `import { exchangeCode } from '@civitai/app-sdk'` pay for the
  *    Civitai-Apps contract it does not use. Blocks and OAuth apps are disjoint
  *    audiences; see this package's README.
+ *    🔴 That 154 is ASSERTED, not merely quoted — by
+ *    `packages/civitai-app-sdk/test/export-surface.test.ts`, which pins
+ *    `surface.get('./blocks').size`. It said 119 here against a real 125 until
+ *    2026-10-04, because the existing checks pin the root as an exact union and
+ *    each subpath's set relations, none of which can see a subpath GROW. Update
+ *    both this line and the ledger `reason` in that file together.
  *  - **`./safe-storage`** — the same side effect, and its whole point is being
  *    imported FOR it (`import '@civitai/app-sdk/safe-storage'`). A side effect
  *    on the root barrel is not something a consumer can opt out of.

package/dist/orchestrator/index.d.ts

@@ -75,7 +75,12 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly imageBackgroundRemoval: "Image background removal (BiRefNet)";
     /** Vectorize a raster image with a local StarVector / OmniSVG model. */
     readonly imageToSvg: "Raster image → SVG vectorization";
-    /** LoRA / DoRA / embedding training. Long-running. */
+    /**
+     * LoRA / DoRA / embedding training. Long-running. Allowed on an App Block's
+     * pass-through arm, where `maxBuzz` (1–250) is its timeout in seconds only
+     * when the orchestrator returns no quote — see `WorkflowBodyPassThroughStep`
+     * in `@civitai/app-sdk/blocks`.
+     */
     readonly imageResourceTraining: "Train a LoRA / DoRA / embedding from a dataset";
     /** Pre-process an image (resize, ControlNet preprocessor, etc.). */
     readonly preprocessImage: "Image preprocessing (resize, ControlNet preprocessors, …)";
@@ -152,7 +157,8 @@ export declare const WORKFLOW_STEP_TYPES: {
     /**
      * Generic training step. Engines: `ai-toolkit`, `comfy`. Distinct from
      * {@link WORKFLOW_STEP_TYPES.imageResourceTraining}, which is the older
-     * kohya/musubi/flux-dev-fast LoRA path.
+     * kohya/musubi/flux-dev-fast LoRA path. Allowed on an App Block's
+     * pass-through arm on the same terms as `imageResourceTraining`.
      */
     readonly training: "Model training (ai-toolkit / comfy engines)";
     /** Hash an image / video / model for dedup or lookup. */
@@ -213,6 +219,8 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly comfyNodepackSnapshot: "Snapshot a worker’s installed ComfyUI node packs (internal)";
     /** Qwen image benchmarking harness. */
     readonly qwenImageBench: "Qwen image benchmarking (internal)";
+    readonly liveTranscription: "Live speech-to-text from audio streamed while the user talks";
+    readonly merge: "Merge — combine fields from earlier steps' outputs into one result";
 };
 export type WorkflowStepType = keyof typeof WORKFLOW_STEP_TYPES;
 /**

package/dist/orchestrator/index.js

@@ -77,7 +77,12 @@ export const WORKFLOW_STEP_TYPES = {
     imageBackgroundRemoval: 'Image background removal (BiRefNet)',
     /** Vectorize a raster image with a local StarVector / OmniSVG model. */
     imageToSvg: 'Raster image → SVG vectorization',
-    /** LoRA / DoRA / embedding training. Long-running. */
+    /**
+     * LoRA / DoRA / embedding training. Long-running. Allowed on an App Block's
+     * pass-through arm, where `maxBuzz` (1–250) is its timeout in seconds only
+     * when the orchestrator returns no quote — see `WorkflowBodyPassThroughStep`
+     * in `@civitai/app-sdk/blocks`.
+     */
     imageResourceTraining: 'Train a LoRA / DoRA / embedding from a dataset',
     /** Pre-process an image (resize, ControlNet preprocessor, etc.). */
     preprocessImage: 'Image preprocessing (resize, ControlNet preprocessors, …)',
@@ -159,7 +164,8 @@ export const WORKFLOW_STEP_TYPES = {
     /**
      * Generic training step. Engines: `ai-toolkit`, `comfy`. Distinct from
      * {@link WORKFLOW_STEP_TYPES.imageResourceTraining}, which is the older
-     * kohya/musubi/flux-dev-fast LoRA path.
+     * kohya/musubi/flux-dev-fast LoRA path. Allowed on an App Block's
+     * pass-through arm on the same terms as `imageResourceTraining`.
      */
     training: 'Model training (ai-toolkit / comfy engines)',
     // ----- Classification / tagging / moderation ----------------------------
@@ -228,6 +234,15 @@ export const WORKFLOW_STEP_TYPES = {
     comfyNodepackSnapshot: 'Snapshot a worker’s installed ComfyUI node packs (internal)',
     /** Qwen image benchmarking harness. */
     qwenImageBench: 'Qwen image benchmarking (internal)',
+    // ----- Auto-added 2026-10-06 from the orchestrator spec ----------------------
+    // Added by scripts/sync-orchestrator-catalogs.mjs: the live spec accepts
+    // these and this catalog did not list them. MOVE each entry into the right
+    // section above, and replace any TODO(catalog) line with a real one-line
+    // description — `pnpm check:catalogs` names every placeholder that is left.
+    // (That check is advisory, so it will not stop this merging. It is a
+    // reminder, not a gate.)
+    liveTranscription: 'Live speech-to-text from audio streamed while the user talks',
+    merge: "Merge — combine fields from earlier steps' outputs into one result",
 };
 /**
  * Engines that the `imageGen` step accepts. Each one has its own input shape;

package/dist/orchestrator/steps.d.ts

@@ -3,7 +3,7 @@
  * own generated client (`@civitai/client`).
  *
  * The sibling `@civitai/app-sdk/orchestrator` module gives you the *catalog*
- * (`WORKFLOW_STEP_TYPES` — 51 `$type` names and what each one does) and the
+ * (`WORKFLOW_STEP_TYPES` — 53 `$type` names and what each one does) and the
  * fetch helpers (`submitWorkflow`, `estimateWorkflow`, …), but its body
  * builders take `input: unknown`. This module is the missing half: the actual
  * per-step input shapes, tracked against the orchestrator's OpenAPI spec by
@@ -65,12 +65,20 @@
  *
  * The practical consequence: a number of the 47 step types below exist to serve
  * Civitai's own pipelines rather than third-party apps — `modelPickleScan`,
- * `xGuardModeration`, `training`, `comfyNodepackSnapshot`, `qwenImageBench`,
+ * `xGuardModeration`, `comfyNodepackSnapshot`, `qwenImageBench`,
  * the `model*` / `media*` hashing and classification steps. They are in the
  * consumer spec, so they are typed here. They are not an invitation.
  *
+ * `training` and `imageResourceTraining` are the exception: an App Block's host
+ * explicitly ALLOWS both on the pass-through arm (`WorkflowBodyPassThroughStep`
+ * in `blocks/types.ts`), with the same spend rules as any other `$type` there
+ * (see `WorkflowBodyPassThroughStep.maxBuzz`). The trained checkpoint is not
+ * part of the block contract; publishing goes through Civitai's model wizard
+ * (`BlockWorkflowSnapshot.trainedEpochs`). For a standalone app the
+ * orchestrator's own authorization still decides.
+ *
  * ⚠️ `WORKFLOW_STEP_TYPES` does NOT mark most of them. Counted at this commit:
- * of its 51 entries, exactly TWO sit under its "Platform internals" heading —
+ * of its 53 entries, exactly TWO sit under its "Platform internals" heading —
  * `comfyNodepackSnapshot` and `qwenImageBench`. `training`, `webScrape`,
  * `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
  * ordinary documented entries under ordinary headings, and `webScrape` carries
@@ -89,10 +97,10 @@
  * (#315) without anything going red. The measured state, derived rather than
  * typed:
  *
- * `WORKFLOW_STEP_TYPES` documents 51 `$type`s; this map covers 47. The 4 with
+ * `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with
  * no generated template in the pinned `@civitai/client` are `imageScanning`,
- * `preprocessVideo`, `soniloAudioGen`, `yuE2`, and `WorkflowStepTemplateFor<…>` is a compile
- * error for each of them.
+ * `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and
+ * `WorkflowStepTemplateFor<…>` is a compile error for each of them.
  *
  * That gap is EXPECTED and is not a defect in either surface. The catalog
  * tracks the LIVE orchestrator spec (`pnpm check:catalogs` and the daily
@@ -300,7 +308,7 @@ interface StepTemplateMap {
     xGuardModeration: XGuardModerationStepTemplate;
 }
 /**
- * `$type` → its step-template type, for 47 of the catalog's 51 step types.
+ * `$type` → its step-template type, for 47 of the catalog's 53 step types.
  *
  * Keyed by the WIRE name rather than the generated type name, because the wire
  * name is what you actually have in hand and the generator does not always

package/dist/orchestrator/steps.js

@@ -3,7 +3,7 @@
  * own generated client (`@civitai/client`).
  *
  * The sibling `@civitai/app-sdk/orchestrator` module gives you the *catalog*
- * (`WORKFLOW_STEP_TYPES` — 51 `$type` names and what each one does) and the
+ * (`WORKFLOW_STEP_TYPES` — 53 `$type` names and what each one does) and the
  * fetch helpers (`submitWorkflow`, `estimateWorkflow`, …), but its body
  * builders take `input: unknown`. This module is the missing half: the actual
  * per-step input shapes, tracked against the orchestrator's OpenAPI spec by
@@ -65,12 +65,20 @@
  *
  * The practical consequence: a number of the 47 step types below exist to serve
  * Civitai's own pipelines rather than third-party apps — `modelPickleScan`,
- * `xGuardModeration`, `training`, `comfyNodepackSnapshot`, `qwenImageBench`,
+ * `xGuardModeration`, `comfyNodepackSnapshot`, `qwenImageBench`,
  * the `model*` / `media*` hashing and classification steps. They are in the
  * consumer spec, so they are typed here. They are not an invitation.
  *
+ * `training` and `imageResourceTraining` are the exception: an App Block's host
+ * explicitly ALLOWS both on the pass-through arm (`WorkflowBodyPassThroughStep`
+ * in `blocks/types.ts`), with the same spend rules as any other `$type` there
+ * (see `WorkflowBodyPassThroughStep.maxBuzz`). The trained checkpoint is not
+ * part of the block contract; publishing goes through Civitai's model wizard
+ * (`BlockWorkflowSnapshot.trainedEpochs`). For a standalone app the
+ * orchestrator's own authorization still decides.
+ *
  * ⚠️ `WORKFLOW_STEP_TYPES` does NOT mark most of them. Counted at this commit:
- * of its 51 entries, exactly TWO sit under its "Platform internals" heading —
+ * of its 53 entries, exactly TWO sit under its "Platform internals" heading —
  * `comfyNodepackSnapshot` and `qwenImageBench`. `training`, `webScrape`,
  * `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
  * ordinary documented entries under ordinary headings, and `webScrape` carries
@@ -89,10 +97,10 @@
  * (#315) without anything going red. The measured state, derived rather than
  * typed:
  *
- * `WORKFLOW_STEP_TYPES` documents 51 `$type`s; this map covers 47. The 4 with
+ * `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with
  * no generated template in the pinned `@civitai/client` are `imageScanning`,
- * `preprocessVideo`, `soniloAudioGen`, `yuE2`, and `WorkflowStepTemplateFor<…>` is a compile
- * error for each of them.
+ * `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and
+ * `WorkflowStepTemplateFor<…>` is a compile error for each of them.
  *
  * That gap is EXPECTED and is not a defect in either surface. The catalog
  * tracks the LIVE orchestrator spec (`pnpm check:catalogs` and the daily

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.56.1",
+  "version": "0.58.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",