@civitai/app-sdk 0.63.0 → 0.64.0

package/README.md

@@ -85,12 +85,13 @@ over `window.postMessage({ type, payload }, targetOrigin)`, discriminated by
 `type`. The full union is exported:
 
 - **parent → block**: `BLOCK_INIT`, `TOKEN_REFRESH`, `TOKEN_REFRESH_RESPONSE`,
-  `ESTIMATE_RESULT`, `WORKFLOW_SUBMITTED`, `WORKFLOW_STATUS`,
+  `ESTIMATE_RESULT`, `ESTIMATE_BATCH_RESULT`, `WORKFLOW_SUBMITTED`, `WORKFLOW_STATUS`,
   `BUZZ_PURCHASE_RESULT`, `CHECKPOINT_PICKER_RESULT`, `USER_CHECKPOINT_SET`,
   `APP_STORAGE_*_RESULT`, `SUSPEND`, `RESUME`, `THEME_CHANGE`, `ROUTE_CHANGED`,
   `CONSENT_UNAVAILABLE` (`ParentToBlockMessage`).
 - **block → parent**: `BLOCK_READY`, `BLOCK_ERROR`, `REQUEST_TOKEN`,
-  `RESIZE_IFRAME`, `SUBMIT_WORKFLOW`, `ESTIMATE_WORKFLOW`, `POLL_WORKFLOW`,
+  `RESIZE_IFRAME`, `SUBMIT_WORKFLOW`, `ESTIMATE_WORKFLOW`,
+  `ESTIMATE_WORKFLOW_BATCH`, `POLL_WORKFLOW`,
   `QUERY_APP_WORKFLOWS`, `CANCEL_APP_WORKFLOW`, `OPEN_BUZZ_PURCHASE`,
   `OPEN_CHECKPOINT_PICKER`, `SET_USER_CHECKPOINT`, `NAVIGATE`, `TRACK_EVENT`,
   `APP_STORAGE_*` (`BlockToParentMessage`).

package/dist/blocks/index.d.ts

@@ -96,7 +96,7 @@ export type { AppStorageRejectionReason } from './appStorageErrors.js';
 export { BLOCK_INIT_FRAGMENT_MARKER_KEY, BLOCK_INIT_FRAGMENT_VERSION, BLOCK_INIT_FRAGMENT_KEYS, encodeBlockInitFragment, parseBlockInitFragment, stripBlockInitFragment, } from './initFragment.js';
 export type { BlockInitFragment } from './initFragment.js';
 export { isMessage, BLOCK_TO_PARENT_MESSAGE_TYPES, OTHER_MESSAGE_TYPE_LABEL, boundBlockToParentMessageType, } from './messages.js';
-export type { BlockInitPayload, BlockToParentMessage, BlockToParentMessageType, ConsentUnavailablePayload, ConsentUnavailableReason, ParentToBlockMessage, ParentToBlockMessageType, SharedStorageItemWire, SharedStorageValue, WrappedToken, BlockBuzzTransactionsParams, BlockDailyCompensationParams, AppWorkflowsParams, } from './messages.js';
+export type { BlockInitPayload, BlockToParentMessage, BlockToParentMessageType, ConsentUnavailablePayload, ConsentUnavailableReason, ParentToBlockMessage, ParentToBlockMessageType, SharedStorageItemWire, SharedStorageRateLimit, SharedStorageValue, WrappedToken, BlockBuzzTransactionsParams, BlockDailyCompensationParams, AppWorkflowsParams, } from './messages.js';
 /**
  * Runtime narrowing for the `slotId`-discriminated {@link BlockContext} union.
  * Values, not types — a slot context crosses a `postMessage` boundary, so its
@@ -109,7 +109,7 @@ export { isModelSlotContext, isPageSlotContext } from './types.js';
  * in `types.ts` for which of the two it uses and why.
  */
 export { isSignedIn } from './types.js';
-export type { BlockContext, KnownSlotId, ModelSlotId, PageSlotContext, PageSlotId, UnknownSlotContext, BlockAnalyticsDeclaration, BlockAnalyticsEventDeclaration, BlockAnalyticsPropertyDeclaration, BlockManifest, BlockManifestGood, BlockManifestV1, BlockSettings, BlockToken, ContentRating, ManifestBooleanField, ManifestIframe, ManifestNumberField, ManifestPage, ManifestPreview, ManifestSettingField, ManifestSettings, ManifestStringField, ManifestTarget, ModelSlotContext, SettingScope, SettingWidget, Theme, ViewerInfo, BlockCheckpointInfo, BlockResourceInfo, BlockResourcePickerType, BlockSourceImage, BlockUploadedImageInfo, BlockGenerationSourceImageInfo, BlockPendingImageInfo, BlockImageScanResult, BlockUploadPurpose, BlockNavigateScope, BlockTextToImageParams, BlockWorkflowSnapshot, BlockModelSubstitution, ModelSubstitutionReason, BlockStepToolCall, BlockTrainedEpoch, BlockPublishedModel, BuzzAccountType, ShowcaseImage, WorkflowBody, WorkflowBodyTextToImage, WorkflowBodyCustomComfy, WorkflowBodyCustomComfyRecipe, WorkflowBodyCustomComfyInline, InlineComfyNode, WorkflowBodyStep, WorkflowBodyPassThroughStep, WorkflowStatus, BlockBuzzTransaction, BlockBuzzAccount, BlockDailyCompensationResource, BlockViewer, BlockWildcardPack, BlockWildcardPackErrorCode, AppWorkflow, AppWorkflowImage, BlockGatedImage, BlockCollectionFollowErrorCode, BlockCollectionFollowResult, BlockPostSource, BlockCreatePostRequest, BlockCreatePostResult, BlockCreatePostHostError, WorkflowBodyTraining, AiToolkitTrainingParams, AiToolkitTrainingParamsBase, AiToolkitPlainEcosystem, AiToolkitLrScheduler, AiToolkitOptimizerType, BlockTrainingQuote, BlockTrainingDatasetItem, BlockTrainingDatasetResult, BlockTrainingRejectionReason, BlockPrepareTrainingDatasetHostError, BlockRunTrainingHostError, } from './types.js';
+export type { BlockContext, KnownSlotId, ModelSlotId, PageSlotContext, PageSlotId, UnknownSlotContext, BlockAnalyticsDeclaration, BlockAnalyticsEventDeclaration, BlockAnalyticsPropertyDeclaration, BlockManifest, BlockManifestGood, BlockManifestV1, BlockSettings, BlockToken, ContentRating, ManifestBooleanField, ManifestIframe, ManifestNumberField, ManifestPage, ManifestPreview, ManifestSettingField, ManifestSettings, ManifestStringField, ManifestTarget, ModelSlotContext, SettingScope, SettingWidget, Theme, ViewerInfo, BlockCheckpointInfo, BlockResourceInfo, BlockResourcePickerType, BlockSourceImage, BlockUploadedImageInfo, BlockGenerationSourceImageInfo, BlockPendingImageInfo, BlockImageScanResult, BlockUploadPurpose, BlockNavigateScope, BlockTextToImageParams, BlockWorkflowSnapshot, BlockEstimateBatchAggregate, BlockModelSubstitution, ModelSubstitutionReason, BlockStepToolCall, BlockTrainedEpoch, BlockPublishedModel, BuzzAccountType, ShowcaseImage, WorkflowBody, WorkflowBodyTextToImage, WorkflowBodyCustomComfy, WorkflowBodyCustomComfyRecipe, WorkflowBodyCustomComfyInline, InlineComfyNode, WorkflowBodyStep, WorkflowBodyPassThroughStep, WorkflowStatus, BlockBuzzTransaction, BlockBuzzAccount, BlockDailyCompensationResource, BlockViewer, BlockWildcardPack, BlockWildcardPackErrorCode, AppWorkflow, AppWorkflowImage, BlockGatedImage, BlockCollectionFollowErrorCode, BlockCollectionFollowResult, BlockPostSource, BlockCreatePostRequest, BlockCreatePostResult, BlockCreatePostHostError, WorkflowBodyTraining, AiToolkitTrainingParams, AiToolkitTrainingParamsBase, AiToolkitPlainEcosystem, AiToolkitLrScheduler, AiToolkitOptimizerType, BlockTrainingQuote, BlockTrainingDatasetItem, BlockTrainingDatasetResult, BlockTrainingRejectionReason, BlockPrepareTrainingDatasetHostError, BlockRunTrainingHostError, } from './types.js';
 /**
  * Host bounds for the App Blocks `kind: 'training'` flow, mirrored from
  * civitai/civitai's zod — see `WorkflowBodyTraining`.

package/dist/blocks/messages.d.ts

@@ -8,7 +8,7 @@
  * Wire format: `window.postMessage({ type, payload }, targetOrigin)`.
  */
 import type { ColorDomain } from './browsingLevel.js';
-import type { BlockCheckpointInfo, BlockResourceInfo, BlockResourcePickerType, BlockUploadedImageInfo, BlockGenerationSourceImageInfo, BlockPendingImageInfo, BlockImageScanResult, BlockUploadPurpose, BlockNavigateScope, BlockContext, BlockSettings, Theme, ViewerInfo, WorkflowBody, BlockWorkflowSnapshot, BlockBuzzTransaction, BlockBuzzAccount, BlockDailyCompensationResource, BlockViewer, BlockWildcardPack, BlockWildcardPackErrorCode, AppWorkflow, BlockGatedImage, BlockCollectionFollowErrorCode, BlockCollectionFollowResult, BlockPostSource, BlockCreatePostResult, BlockTrainingDatasetItem, BlockTrainingDatasetResult, WorkflowBodyTraining } from './types.js';
+import type { BlockCheckpointInfo, BlockResourceInfo, BlockResourcePickerType, BlockUploadedImageInfo, BlockGenerationSourceImageInfo, BlockPendingImageInfo, BlockImageScanResult, BlockUploadPurpose, BlockNavigateScope, BlockContext, BlockSettings, Theme, ViewerInfo, WorkflowBody, BlockWorkflowSnapshot, BlockEstimateBatchAggregate, BlockBuzzTransaction, BlockBuzzAccount, BlockDailyCompensationResource, BlockViewer, BlockWildcardPack, BlockWildcardPackErrorCode, AppWorkflow, BlockGatedImage, BlockCollectionFollowErrorCode, BlockCollectionFollowResult, BlockPostSource, BlockCreatePostResult, BlockTrainingDatasetItem, BlockTrainingDatasetResult, WorkflowBodyTraining } from './types.js';
 /**
  * Filter params for `GET_BUZZ_TRANSACTIONS`. All optional; the host validates
  * them server-side (they are NEVER trusted for auth — the account is self-bound
@@ -239,6 +239,27 @@ export interface SharedStorageValue {
      */
     data?: unknown;
 }
+/**
+ * Retry metadata on a RATE-LIMITED shared-storage refusal. The host adds it
+ * beside `error` on the six write replies (`SHARED_APPEND_RESULT`,
+ * `SHARED_UPDATE_RESULT`, `SHARED_VOTE_RESULT`, `SHARED_UNVOTE_RESULT`,
+ * `SHARED_WITHDRAW_RESULT`, `SHARED_REPORT_RESULT`) when the server refused the
+ * write because a per-(viewer, app) budget is empty, so a block can render the
+ * wait instead of parsing it out of the prose `error`.
+ *
+ * Its PRESENCE marks the refusal as rate-limited; every other refusal omits it.
+ * ADDITIVE + OPTIONAL: a host that predates it never sends it, so a block must
+ * treat "absent" as "not known to be rate-limited", never as "retry now".
+ *
+ * Same shape as the platform's tRPC `error.data.rateLimit` and the REST 429
+ * body's `rateLimit` (which also comes with a `Retry-After` header).
+ */
+export interface SharedStorageRateLimit {
+    /** Whole seconds until a retry can succeed. An integer, at least 1. */
+    retryAfterSeconds: number;
+    /** ISO-8601 instant at which a retry can succeed. */
+    retryAt: string;
+}
 /**
  * One SHARED-storage entry as it appears on the wire in `SHARED_LIST_RESULT`.
  * `createdAt`/`updatedAt` are ISO-8601 strings; the block-side hook rehydrates
@@ -360,6 +381,14 @@ export type ParentToBlockMessage = {
         requestId: string;
         snapshot: BlockWorkflowSnapshot;
     };
+} | {
+    type: 'ESTIMATE_BATCH_RESULT';
+    payload: {
+        requestId: string;
+        snapshots?: BlockWorkflowSnapshot[];
+        aggregate?: BlockEstimateBatchAggregate;
+        error?: string;
+    };
 } | {
     type: 'WORKFLOW_SUBMITTED';
     payload: {
@@ -515,6 +544,8 @@ export type ParentToBlockMessage = {
     payload: {
         requestId: string;
         selected?: BlockResourceInfo;
+        selectedResources?: BlockResourceInfo[];
+        error?: string;
     };
 } | {
     type: 'IMAGE_UPLOAD_RESULT';
@@ -610,6 +641,7 @@ export type ParentToBlockMessage = {
         requestId: string;
         key: string;
         error?: string;
+        rateLimit?: SharedStorageRateLimit;
     };
 } | {
     type: 'SHARED_VOTE_RESULT';
@@ -617,6 +649,7 @@ export type ParentToBlockMessage = {
         requestId: string;
         count: number;
         error?: string;
+        rateLimit?: SharedStorageRateLimit;
     };
 } | {
     type: 'SHARED_UNVOTE_RESULT';
@@ -624,6 +657,7 @@ export type ParentToBlockMessage = {
         requestId: string;
         count: number;
         error?: string;
+        rateLimit?: SharedStorageRateLimit;
     };
 } | {
     type: 'SHARED_WITHDRAW_RESULT';
@@ -632,6 +666,7 @@ export type ParentToBlockMessage = {
         ok?: boolean;
         deleted?: boolean;
         error?: string;
+        rateLimit?: SharedStorageRateLimit;
     };
 } | {
     type: 'SHARED_UPDATE_RESULT';
@@ -639,6 +674,7 @@ export type ParentToBlockMessage = {
         requestId: string;
         ok?: boolean;
         error?: string;
+        rateLimit?: SharedStorageRateLimit;
     };
 } | {
     type: 'SHARED_GET_RESULT';
@@ -653,6 +689,7 @@ export type ParentToBlockMessage = {
         requestId: string;
         ok?: boolean;
         error?: string;
+        rateLimit?: SharedStorageRateLimit;
     };
 } | {
     type: 'SAVE_IMAGE_RESULT';
@@ -712,6 +749,12 @@ export type BlockToParentMessage = {
         requestId: string;
         body: WorkflowBody;
     };
+} | {
+    type: 'ESTIMATE_WORKFLOW_BATCH';
+    payload: {
+        requestId: string;
+        bodies: WorkflowBody[];
+    };
 } | {
     type: 'POLL_WORKFLOW';
     payload: {
@@ -831,6 +874,16 @@ export type BlockToParentMessage = {
         resourceType: BlockResourcePickerType;
         /** Optional base-model family hint (ecosystem key or baseModel name). */
         baseModelGroup?: string;
+        /**
+         * Ask for SEVERAL resources in one picker session. LoRA only — the host
+         * refuses it with a Checkpoint. `max` is a whole number ≥ 1; the host
+         * clamps anything above 5 (the `additionalResources` cap) to 5. The
+         * reply is then `selectedResources`, not `selected`. OMIT the key for
+         * a single pick: its absence is what keeps that path unchanged.
+         */
+        multiple?: {
+            max: number;
+        };
     };
 } | {
     type: 'OPEN_IMAGE_UPLOAD';
@@ -1040,7 +1093,7 @@ export type BlockToParentMessageType = BlockToParentMessage['type'];
  * it is a measurement, not an invariant, and civitai's own compile-time gate
  * (published SDK union ⊆ `keyof INVENTORY`) is what holds one direction of it.
  */
-export declare const BLOCK_TO_PARENT_MESSAGE_TYPES: readonly ["BLOCK_HELLO", "BLOCK_READY", "BLOCK_ERROR", "BLOCK_MESSAGE_REJECTED", "REQUEST_TOKEN", "RESIZE_IFRAME", "SUBMIT_WORKFLOW", "ESTIMATE_WORKFLOW", "POLL_WORKFLOW", "CANCEL_WORKFLOW", "OPEN_BUZZ_PURCHASE", "GET_BUZZ_BALANCE", "GET_VIEWER", "GET_BUZZ_TRANSACTIONS", "GET_BUZZ_ACCOUNTS", "GET_DAILY_COMPENSATION", "GET_WILDCARD_PACK", "QUERY_APP_WORKFLOWS", "PUBLISH_GENERATION_OUTPUTS", "CREATE_POST_FROM_APP", "PREPARE_TRAINING_DATASET", "RUN_TRAINING", "GET_IMAGES_BY_IDS", "CANCEL_APP_WORKFLOW", "OPEN_CHECKPOINT_PICKER", "OPEN_RESOURCE_PICKER", "OPEN_IMAGE_UPLOAD", "SET_USER_CHECKPOINT", "NAVIGATE", "REQUEST_SIGN_IN", "REQUEST_CONSENT", "TRACK_EVENT", "APP_STORAGE_GET", "APP_STORAGE_SET", "APP_STORAGE_DELETE", "APP_STORAGE_LIST", "APP_STORAGE_QUOTA", "SHARED_LIST", "SHARED_GET_COUNT", "SHARED_GET_COUNTS", "SHARED_APPEND", "SHARED_VOTE", "SHARED_UNVOTE", "SHARED_WITHDRAW", "SHARED_UPDATE", "SHARED_GET", "SHARED_REPORT", "SAVE_IMAGE", "SET_COLLECTION_FOLLOW"];
+export declare const BLOCK_TO_PARENT_MESSAGE_TYPES: readonly ["BLOCK_HELLO", "BLOCK_READY", "BLOCK_ERROR", "BLOCK_MESSAGE_REJECTED", "REQUEST_TOKEN", "RESIZE_IFRAME", "SUBMIT_WORKFLOW", "ESTIMATE_WORKFLOW", "ESTIMATE_WORKFLOW_BATCH", "POLL_WORKFLOW", "CANCEL_WORKFLOW", "OPEN_BUZZ_PURCHASE", "GET_BUZZ_BALANCE", "GET_VIEWER", "GET_BUZZ_TRANSACTIONS", "GET_BUZZ_ACCOUNTS", "GET_DAILY_COMPENSATION", "GET_WILDCARD_PACK", "QUERY_APP_WORKFLOWS", "PUBLISH_GENERATION_OUTPUTS", "CREATE_POST_FROM_APP", "PREPARE_TRAINING_DATASET", "RUN_TRAINING", "GET_IMAGES_BY_IDS", "CANCEL_APP_WORKFLOW", "OPEN_CHECKPOINT_PICKER", "OPEN_RESOURCE_PICKER", "OPEN_IMAGE_UPLOAD", "SET_USER_CHECKPOINT", "NAVIGATE", "REQUEST_SIGN_IN", "REQUEST_CONSENT", "TRACK_EVENT", "APP_STORAGE_GET", "APP_STORAGE_SET", "APP_STORAGE_DELETE", "APP_STORAGE_LIST", "APP_STORAGE_QUOTA", "SHARED_LIST", "SHARED_GET_COUNT", "SHARED_GET_COUNTS", "SHARED_APPEND", "SHARED_VOTE", "SHARED_UNVOTE", "SHARED_WITHDRAW", "SHARED_UPDATE", "SHARED_GET", "SHARED_REPORT", "SAVE_IMAGE", "SET_COLLECTION_FOLLOW"];
 /**
  * The bucket a message type falls into when the protocol does not declare it.
  *

package/dist/blocks/messages.js

@@ -57,6 +57,7 @@ export const BLOCK_TO_PARENT_MESSAGE_TYPES = [
     'RESIZE_IFRAME',
     'SUBMIT_WORKFLOW',
     'ESTIMATE_WORKFLOW',
+    'ESTIMATE_WORKFLOW_BATCH',
     'POLL_WORKFLOW',
     'CANCEL_WORKFLOW',
     'OPEN_BUZZ_PURCHASE',

package/dist/blocks/types.d.ts

@@ -1468,7 +1468,27 @@ export interface BlockWorkflowSnapshot {
     workflowId: string;
     status: 'pending' | 'processing' | 'succeeded' | 'failed' | 'expired' | 'canceled';
     cost?: {
+        /** Whole Buzz. Includes {@link authorFee} whenever that field is present. */
         total: number;
+        /**
+         * The part of `total` that is the app author's per-generation fee, in whole
+         * Buzz — so `total - authorFee` is the generation's own price. Display only:
+         * it is the amount the host added into `total` for this reply.
+         *
+         * - **A number** wherever `total` was built from a fee quote: the
+         *   `estimate()` result for a `textToImage` or registered-`step` body, and
+         *   the refusal `submit()` resolves for those kinds when a budget, spend cap
+         *   or rate limit refuses the quoted price. **`0` means a fee was looked up
+         *   and none applies** to this request.
+         * - **Absent** when the total is not itemised: a host that predates the
+         *   field; every snapshot of a submitted workflow (`submit` success, `poll`,
+         *   `cancel` — its total is the realized generation cost and the fee is a
+         *   separate charge); the registered-`step` `submit()` refusal for a missing
+         *   orchestrator price quote, which refuses before any fee is looked up; and
+         *   the kinds that price no fee (`customComfy`, pass-through `step`,
+         *   `training`). **Do not read absent as `0`** — show `total` on its own.
+         */
+        authorFee?: number;
     };
     imageUrls?: string[];
     error?: string;
@@ -1674,6 +1694,27 @@ export interface BlockWorkflowSnapshot {
      */
     trainingQuote?: BlockTrainingQuote;
 }
+/**
+ * The run total a BATCH estimate reports beside its per-cell snapshots
+ * (`ESTIMATE_BATCH_RESULT`, sent in reply to `ESTIMATE_WORKFLOW_BATCH`).
+ *
+ * `total` is the sum of `cost.total` over the cells that PRICED: a snapshot that
+ * is not `'failed'` and carries a numeric `cost.total`, the same rule one
+ * estimate is held to. It is the total for the whole list only when
+ * `pricedCells === cellCount`. Otherwise it is a partial sum; show it as one.
+ *
+ * 🔴 IT IS A QUOTE, NOT A LOCK, exactly as each cell is. Nothing reserves it. The
+ * host creates no workflow and no batch for the list, and each cell is priced
+ * again when the app submits it.
+ */
+export interface BlockEstimateBatchAggregate {
+    /** Sum of `cost.total` over the priced cells, in Buzz. `0` when none priced. */
+    total: number;
+    /** How many cells priced and are therefore in `total`. */
+    pricedCells: number;
+    /** How many cells the host answered — the length of the list it was sent. */
+    cellCount: number;
+}
 /** {@link BlockWorkflowSnapshot.trainingQuote}. */
 export interface BlockTrainingQuote {
     /** `tq_` + 32 hex characters. Opaque — pass it back verbatim. */

package/dist/index.d.ts

@@ -25,11 +25,11 @@
  *
  *  - **`./blocks`** — importing it RUNS `./safe-storage` for its side effect
  *    (repairing `localStorage`/`sessionStorage` at an opaque origin). Folding
- *    157 symbols and that side effect into the root would make every OAuth app
+ *    159 symbols and that side effect into the root would make every OAuth app
  *    that writes `import { exchangeCode } from '@civitai/app-sdk'` pay for the
  *    Civitai-Apps contract it does not use. Blocks and OAuth apps are disjoint
  *    audiences; see this package's README.
- *    🔴 That 157 is ASSERTED, not merely quoted — by
+ *    🔴 That 159 is ASSERTED, not merely quoted — by
  *    `packages/civitai-app-sdk/test/export-surface.test.ts`, which pins
  *    `surface.get('./blocks').size`. It said 119 here against a real 125 until
  *    2026-10-04, because the existing checks pin the root as an exact union and

package/dist/index.js

@@ -25,11 +25,11 @@
  *
  *  - **`./blocks`** — importing it RUNS `./safe-storage` for its side effect
  *    (repairing `localStorage`/`sessionStorage` at an opaque origin). Folding
- *    157 symbols and that side effect into the root would make every OAuth app
+ *    159 symbols and that side effect into the root would make every OAuth app
  *    that writes `import { exchangeCode } from '@civitai/app-sdk'` pay for the
  *    Civitai-Apps contract it does not use. Blocks and OAuth apps are disjoint
  *    audiences; see this package's README.
- *    🔴 That 157 is ASSERTED, not merely quoted — by
+ *    🔴 That 159 is ASSERTED, not merely quoted — by
  *    `packages/civitai-app-sdk/test/export-surface.test.ts`, which pins
  *    `surface.get('./blocks').size`. It said 119 here against a real 125 until
  *    2026-10-04, because the existing checks pin the root as an exact union and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",