@civitai/app-sdk 0.59.0 → 0.61.0

package/README.md

@@ -528,7 +528,7 @@ The starters in `civitai/civitai-app-starters` wire this into framework-specific
 
 ## Choosing a workflow step type
 
-The orchestrator is a workflow API: each request submits a list of typed steps. `WORKFLOW_STEP_TYPES` is the in-code catalog of every step `$type` it accepts, with a one-line description for each — `textToImage`, `imageGen`, `videoGen`, `comfy`, `customComfy`, `textToSpeech`, `aceStepAudio`, `transcription`, `imageUpscaler` among them (53 in total).
+The orchestrator is a workflow API: each request submits a list of typed steps. `WORKFLOW_STEP_TYPES` is the in-code catalog of every step `$type` it accepts, with a one-line description for each — `textToImage`, `imageGen`, `videoGen`, `comfy`, `customComfy`, `textToSpeech`, `aceStepAudio`, `transcription`, `imageUpscaler` among them (55 in total).
 
 The catalog is pinned to the orchestrator's published OpenAPI spec two ways — an offline unit test against a transcribed copy of the spec's `WorkflowStepTemplate` discriminator mapping, and a CI job (`pnpm check:catalogs`) that re-fetches the live spec and diffs it. If a `$type` is listed here, the orchestrator accepts it.
 
@@ -603,15 +603,15 @@ What it exports:
 
 | Export | What |
 |---|---|
-| `WorkflowStepTemplates` | `$type` → template type, for 47 of the catalog's 53 step types. Keyed by the WIRE name, which the generated type names don't always match (`model3DPreview` → `Model3dPreviewStepTemplate`). |
+| `WorkflowStepTemplates` | `$type` → template type, for 47 of the catalog's 55 step types. Keyed by the WIRE name, which the generated type names don't always match (`model3DPreview` → `Model3dPreviewStepTemplate`). |
 | `WorkflowStepTemplateFor<'videoGen'>` | One step's template. |
 | `WorkflowStepInputFor<'videoGen'>` | One step's `input` shape, without needing the generated `*Input` name. |
 | `AnyWorkflowStepTemplate` | Discriminated union of all 47 mapped templates — `Extract<…, { $type: 'comfy' }>` and exhaustive `switch` work. `@civitai/client`'s base `WorkflowStepTemplate` has `$type` as a bare `string`, so it narrows nothing. |
 | `TypedWorkflowTemplate` | The submit envelope with `steps` narrowed to that union. Pass it straight to `submitWorkflow` / `estimateWorkflow`. |
 
-> 🔴 **The map is not total over the catalog, and that is the expected state.** `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with no generated template in the pinned `@civitai/client` are `imageScanning`, `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and `WorkflowStepTemplateFor<…>` is a compile error for each of them.
+> 🔴 **The map is not total over the catalog, and that is the expected state.** `WORKFLOW_STEP_TYPES` documents 55 `$type`s; this map covers 47. The 8 with no generated template in the pinned `@civitai/client` are `imageScanning`, `liveTextToSpeech`, `liveTranscription`, `merge`, `preprocessVideo`, `promptModeration`, `soniloAudioGen`, `yuE2`, and `WorkflowStepTemplateFor<…>` is a compile error for each of them.
 >
-> The two surfaces move independently on purpose: the catalog tracks the **live** orchestrator spec (a daily job syncs it), while these types track whatever `@civitai/client` was last published from. So the catalog runs ahead and the client catches up. The gap is never silent — `test/orchestrator/step-templates.test-d.ts` carries it as a `never` ledger plus one `@ts-expect-error` per gap `$type`, and `test/orchestrator/step-count-prose.test.ts` derives all four numbers (53, 47, 6, and the names) from `WORKFLOW_STEP_TYPES` and the map's own AST, then fails if this paragraph or its twin in `src/orchestrator/steps.ts` disagrees by one character.
+> The two surfaces move independently on purpose: the catalog tracks the **live** orchestrator spec (a daily job syncs it), while these types track whatever `@civitai/client` was last published from. So the catalog runs ahead and the client catches up. The gap is never silent — `test/orchestrator/step-templates.test-d.ts` carries it as a `never` ledger plus one `@ts-expect-error` per gap `$type`, and `test/orchestrator/step-count-prose.test.ts` derives all four numbers (55, 47, 8, and the names) from `WORKFLOW_STEP_TYPES` and the map's own AST, then fails if this paragraph or its twin in `src/orchestrator/steps.ts` disagrees by one character.
 
 The generated `*StepTemplate` and `*Input` types are **not** re-exported individually. Using this subpath already requires `@civitai/client` installed, so if you want one by name, import it straight from there — `import type { TextToImageStepTemplate } from '@civitai/client'`.
 
@@ -650,7 +650,7 @@ Several of the 47 exist to serve Civitai's own pipelines rather than third-party
 
 `training` and `imageResourceTraining` are the exception: an App Block's host explicitly **allows** them on the pass-through arm (see `WorkflowBodyPassThroughStep` under Primitives above for the `maxBuzz` bound, and how a trained epoch is published). For a standalone app, the orchestrator's own authorization still decides.
 
-Note that `WORKFLOW_STEP_TYPES` does **not** mark most of them: of its 53 entries exactly two — `comfyNodepackSnapshot` and `qwenImageBench` — sit under its "Platform internals" heading, and the rest are ordinary documented entries (`webScrape` even carries usage notes). The reason the platform steps are typed anyway is not that the catalog flags them as internal; it's that the catalog *documents* them, so skipping them would make `WorkflowStepTemplateFor<'training'>` a compile error for a step type the SDK documents — which is exactly what is live today for the 3 `$type`s the pinned client cannot type, and is why that gap is spelled out above rather than left to be discovered.
+Note that `WORKFLOW_STEP_TYPES` does **not** mark most of them: of its 55 entries exactly three — `comfyNodepackSnapshot`, `qwenImageBench` and `promptModeration` — sit under its "Platform internals" heading, and the rest are ordinary documented entries (`webScrape` even carries usage notes). The reason the platform steps are typed anyway is not that the catalog flags them as internal; it's that the catalog *documents* them, so skipping them would make `WorkflowStepTemplateFor<'training'>` a compile error for a step type the SDK documents — which is exactly what is live today for each `$type` the pinned client cannot type, and is why that gap is spelled out above rather than left to be discovered.
 
 ## Public vs. confidential clients
 

package/dist/blocks/messages.d.ts

@@ -966,11 +966,20 @@ export type BlockToParentMessage = {
     type: 'SAVE_IMAGE';
     payload: {
         requestId: string;
-        /** Own-output URL — origin-allowlisted host-side. Mutually exclusive with `imageId`. */
+        /** Own-output URL — origin-allowlisted host-side. Mutually exclusive with `imageId` / `bytes`. */
         url?: string;
-        /** Cross-user image id — routed through the gated per-viewer read. Mutually exclusive with `url`. */
+        /** Cross-user image id — routed through the gated per-viewer read. Mutually exclusive with `url` / `bytes`. */
         imageId?: number;
-        /** Optional download filename (host-sanitized). */
+        /**
+         * In-tab file bytes — classified by CONTENT host-side, size-capped host-side.
+         * Page apps only. Mutually exclusive with `url` / `imageId`.
+         */
+        bytes?: ArrayBuffer;
+        /**
+         * Optional download filename (host-sanitized). For `bytes`, a `.json`
+         * name selects JSON for text that parses as JSON, and the extension is
+         * forced from the classified type.
+         */
         filename?: string;
     };
 } | {

package/dist/orchestrator/index.d.ts

@@ -113,6 +113,15 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly transcode: "Audio/video transcoding";
     /** Text-to-speech (multi-voice, multi-language). */
     readonly textToSpeech: "Text-to-speech synthesis";
+    /**
+     * Streaming text-to-speech. Inputs mirror `textToSpeech`, restricted to voices
+     * that stream with low first-audio latency. The output hands back an
+     * `inputUrl` you POST UTF-8 text chunks to (`?seq=0,1,…`, `final=true` on the
+     * last) and one continuous `audioUrl` stream (`pcm` s16le 24 kHz mono, or
+     * `ogg` Opus). The session ends at `maxCharacters` or after
+     * `idleTimeoutSeconds` without input, and is billed on characters spoken.
+     */
+    readonly liveTextToSpeech: "Streaming text-to-speech — post text in chunks, read back one continuous audio stream";
     /** Music generation via ACE Step 1.5 (lyrics + style → song). */
     readonly aceStepAudio: "Music generation (ACE Step 1.5)";
     /**
@@ -139,6 +148,8 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly soniloAudioGen: "Music or a sound effect from a text prompt (Sonilo)";
     /** Speech-to-text transcription. */
     readonly transcription: "Speech-to-text transcription";
+    /** Speech-to-text over audio streamed in while the user is still talking. */
+    readonly liveTranscription: "Live speech-to-text from audio streamed while the user talks";
     /** Generate captions from audio. */
     readonly audioCaptioning: "Caption generation from audio";
     /**
@@ -215,12 +226,14 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly echo: "Echo step — round-trip the input for testing";
     /** Package multiple blobs into a zip archive. */
     readonly blobArchive: "Zip multiple blobs into an archive";
+    /** Combine fields from earlier steps' outputs into a single result. */
+    readonly merge: "Merge — combine fields from earlier steps' outputs into one result";
     /** Snapshot the installed ComfyUI custom-node packs on a worker. */
     readonly comfyNodepackSnapshot: "Snapshot a worker’s installed ComfyUI node packs (internal)";
     /** Qwen image benchmarking harness. */
     readonly qwenImageBench: "Qwen image benchmarking (internal)";
-    readonly liveTranscription: "Live speech-to-text from audio streamed while the user talks";
-    readonly merge: "Merge — combine fields from earlier steps' outputs into one result";
+    /** Per-label scores and flags for a positive / negative prompt pair, under a versioned policy. */
+    readonly promptModeration: "Prompt moderation — per-label scores and flags for a prompt pair (internal)";
 };
 export type WorkflowStepType = keyof typeof WORKFLOW_STEP_TYPES;
 /**

package/dist/orchestrator/index.js

@@ -117,6 +117,15 @@ export const WORKFLOW_STEP_TYPES = {
     // ----- Audio -------------------------------------------------------------
     /** Text-to-speech (multi-voice, multi-language). */
     textToSpeech: 'Text-to-speech synthesis',
+    /**
+     * Streaming text-to-speech. Inputs mirror `textToSpeech`, restricted to voices
+     * that stream with low first-audio latency. The output hands back an
+     * `inputUrl` you POST UTF-8 text chunks to (`?seq=0,1,…`, `final=true` on the
+     * last) and one continuous `audioUrl` stream (`pcm` s16le 24 kHz mono, or
+     * `ogg` Opus). The session ends at `maxCharacters` or after
+     * `idleTimeoutSeconds` without input, and is billed on characters spoken.
+     */
+    liveTextToSpeech: 'Streaming text-to-speech — post text in chunks, read back one continuous audio stream',
     /** Music generation via ACE Step 1.5 (lyrics + style → song). */
     aceStepAudio: 'Music generation (ACE Step 1.5)',
     /**
@@ -143,6 +152,8 @@ export const WORKFLOW_STEP_TYPES = {
     soniloAudioGen: 'Music or a sound effect from a text prompt (Sonilo)',
     /** Speech-to-text transcription. */
     transcription: 'Speech-to-text transcription',
+    /** Speech-to-text over audio streamed in while the user is still talking. */
+    liveTranscription: 'Live speech-to-text from audio streamed while the user talks',
     /** Generate captions from audio. */
     audioCaptioning: 'Caption generation from audio',
     // ----- Media composition -------------------------------------------------
@@ -226,6 +237,8 @@ export const WORKFLOW_STEP_TYPES = {
     echo: 'Echo step — round-trip the input for testing',
     /** Package multiple blobs into a zip archive. */
     blobArchive: 'Zip multiple blobs into an archive',
+    /** Combine fields from earlier steps' outputs into a single result. */
+    merge: "Merge — combine fields from earlier steps' outputs into one result",
     // ----- Platform internals ------------------------------------------------
     // Present in the consumer spec, so listed here for completeness — but these
     // exist to serve Civitai's own pipelines. A third-party app has no reason to
@@ -234,15 +247,8 @@ export const WORKFLOW_STEP_TYPES = {
     comfyNodepackSnapshot: 'Snapshot a worker’s installed ComfyUI node packs (internal)',
     /** Qwen image benchmarking harness. */
     qwenImageBench: 'Qwen image benchmarking (internal)',
-    // ----- Auto-added 2026-10-06 from the orchestrator spec ----------------------
-    // Added by scripts/sync-orchestrator-catalogs.mjs: the live spec accepts
-    // these and this catalog did not list them. MOVE each entry into the right
-    // section above, and replace any TODO(catalog) line with a real one-line
-    // description — `pnpm check:catalogs` names every placeholder that is left.
-    // (That check is advisory, so it will not stop this merging. It is a
-    // reminder, not a gate.)
-    liveTranscription: 'Live speech-to-text from audio streamed while the user talks',
-    merge: "Merge — combine fields from earlier steps' outputs into one result",
+    /** Per-label scores and flags for a positive / negative prompt pair, under a versioned policy. */
+    promptModeration: 'Prompt moderation — per-label scores and flags for a prompt pair (internal)',
 };
 /**
  * Engines that the `imageGen` step accepts. Each one has its own input shape;

package/dist/orchestrator/steps.d.ts

@@ -3,7 +3,7 @@
  * own generated client (`@civitai/client`).
  *
  * The sibling `@civitai/app-sdk/orchestrator` module gives you the *catalog*
- * (`WORKFLOW_STEP_TYPES` — 53 `$type` names and what each one does) and the
+ * (`WORKFLOW_STEP_TYPES` — 55 `$type` names and what each one does) and the
  * fetch helpers (`submitWorkflow`, `estimateWorkflow`, …), but its body
  * builders take `input: unknown`. This module is the missing half: the actual
  * per-step input shapes, tracked against the orchestrator's OpenAPI spec by
@@ -78,9 +78,9 @@
  * orchestrator's own authorization still decides.
  *
  * ⚠️ `WORKFLOW_STEP_TYPES` does NOT mark most of them. Counted at this commit:
- * of its 53 entries, exactly TWO sit under its "Platform internals" heading —
- * `comfyNodepackSnapshot` and `qwenImageBench`. `training`, `webScrape`,
- * `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
+ * of its 55 entries, exactly THREE sit under its "Platform internals" heading —
+ * `comfyNodepackSnapshot`, `qwenImageBench` and `promptModeration`. `training`,
+ * `webScrape`, `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
  * ordinary documented entries under ordinary headings, and `webScrape` carries
  * consumer-facing usage notes. So "the catalog already flags these as internal"
  * is not a reason this map types them, and an earlier version of this docblock
@@ -97,9 +97,10 @@
  * (#315) without anything going red. The measured state, derived rather than
  * typed:
  *
- * `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with
+ * `WORKFLOW_STEP_TYPES` documents 55 `$type`s; this map covers 47. The 8 with
  * no generated template in the pinned `@civitai/client` are `imageScanning`,
- * `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and
+ * `liveTextToSpeech`, `liveTranscription`, `merge`, `preprocessVideo`,
+ * `promptModeration`, `soniloAudioGen`, `yuE2`, and
  * `WorkflowStepTemplateFor<…>` is a compile error for each of them.
  *
  * That gap is EXPECTED and is not a defect in either surface. The catalog
@@ -110,7 +111,7 @@
  * stated: it is spelled as a `never` ledger in
  * `test/orchestrator/step-templates.test-d.ts` (which also pins the compile
  * error above, one `@ts-expect-error` per gap `$type`), and the sentence naming
- * the 3 is pinned character for character — here and in the README — by
+ * the gap is pinned character for character — here and in the README — by
  * `test/orchestrator/step-count-prose.test.ts`, which derives all four numbers
  * from `WORKFLOW_STEP_TYPES` and this file's own AST. Both go red when the gap
  * moves in either direction.
@@ -308,7 +309,7 @@ interface StepTemplateMap {
     xGuardModeration: XGuardModerationStepTemplate;
 }
 /**
- * `$type` → its step-template type, for 47 of the catalog's 53 step types.
+ * `$type` → its step-template type, for 47 of the catalog's 55 step types.
  *
  * Keyed by the WIRE name rather than the generated type name, because the wire
  * name is what you actually have in hand and the generator does not always

package/dist/orchestrator/steps.js

@@ -3,7 +3,7 @@
  * own generated client (`@civitai/client`).
  *
  * The sibling `@civitai/app-sdk/orchestrator` module gives you the *catalog*
- * (`WORKFLOW_STEP_TYPES` — 53 `$type` names and what each one does) and the
+ * (`WORKFLOW_STEP_TYPES` — 55 `$type` names and what each one does) and the
  * fetch helpers (`submitWorkflow`, `estimateWorkflow`, …), but its body
  * builders take `input: unknown`. This module is the missing half: the actual
  * per-step input shapes, tracked against the orchestrator's OpenAPI spec by
@@ -78,9 +78,9 @@
  * orchestrator's own authorization still decides.
  *
  * ⚠️ `WORKFLOW_STEP_TYPES` does NOT mark most of them. Counted at this commit:
- * of its 53 entries, exactly TWO sit under its "Platform internals" heading —
- * `comfyNodepackSnapshot` and `qwenImageBench`. `training`, `webScrape`,
- * `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
+ * of its 55 entries, exactly THREE sit under its "Platform internals" heading —
+ * `comfyNodepackSnapshot`, `qwenImageBench` and `promptModeration`. `training`,
+ * `webScrape`, `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
  * ordinary documented entries under ordinary headings, and `webScrape` carries
  * consumer-facing usage notes. So "the catalog already flags these as internal"
  * is not a reason this map types them, and an earlier version of this docblock
@@ -97,9 +97,10 @@
  * (#315) without anything going red. The measured state, derived rather than
  * typed:
  *
- * `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with
+ * `WORKFLOW_STEP_TYPES` documents 55 `$type`s; this map covers 47. The 8 with
  * no generated template in the pinned `@civitai/client` are `imageScanning`,
- * `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and
+ * `liveTextToSpeech`, `liveTranscription`, `merge`, `preprocessVideo`,
+ * `promptModeration`, `soniloAudioGen`, `yuE2`, and
  * `WorkflowStepTemplateFor<…>` is a compile error for each of them.
  *
  * That gap is EXPECTED and is not a defect in either surface. The catalog
@@ -110,7 +111,7 @@
  * stated: it is spelled as a `never` ledger in
  * `test/orchestrator/step-templates.test-d.ts` (which also pins the compile
  * error above, one `@ts-expect-error` per gap `$type`), and the sentence naming
- * the 3 is pinned character for character — here and in the README — by
+ * the gap is pinned character for character — here and in the README — by
  * `test/orchestrator/step-count-prose.test.ts`, which derives all four numbers
  * from `WORKFLOW_STEP_TYPES` and this file's own AST. Both go red when the gap
  * moves in either direction.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",