@civitai/blocks-react 0.43.0 → 0.44.0

package/dist/hooks/useBuzzWorkflow.js

@@ -112,46 +112,57 @@ function sleep(ms, signal) {
  * reproduces the bug one layer down: a caller who logs `message` expecting the
  * server's words gets a constant and is exactly as stuck as before.
  *
- *   - {@link WorkflowEstimateError.snapshot}`.error` — the server's own words,
- *     verbatim. **Server-authored and UNSANITISED**: civitai's `errorHandling.ts`
- *     documents that raw upstream text — Prisma/`pg` column and constraint names
- *     among it — can reach this field. Log it, or show it in a developer-facing
- *     error surface; do NOT render it as trusted copy.
- *   - {@link WorkflowEstimateError.message} — a CONSTANT template with only
- *     `code` interpolated. It contains no server text and nothing to sanitise, so
- *     it is safe to print. That is deliberate: `message` is what an uncaught
+ * 🔴 THREE FIELDS, THREE AUDIENCES — AND **NONE OF THEM IS VIEWER-FACING COPY**.
+ * The viewer-facing string is one the APP owns; this error carries nothing you
+ * may render as-is. Two apps migrating to `0.43.0` each had a `catch` that piped
+ * `err.message` straight into rendered UI, and each would have shipped
+ * `estimate did not return a usable price (failed) — reason on .snapshot.error`
+ * to end users; both were caught only by a test asserting that exact string.
+ *
+ *   - {@link WorkflowEstimateError.snapshot}`.error` — **the DIAGNOSTIC read.**
+ *     The server's own words, verbatim. **Server-authored and UNSANITISED**:
+ *     civitai's `errorHandling.ts` documents that raw upstream text —
+ *     Prisma/`pg` column and constraint names among it — can reach this field.
+ *     Log it, or show it in a developer-facing error surface. **NEVER render it
+ *     verbatim into markup**, and think before shipping it to a third-party
+ *     error tracker.
+ *   - {@link WorkflowEstimateError.message} — **DEVELOPER-FACING.** A CONSTANT
+ *     template with only `code` interpolated. It contains no server text and
+ *     nothing to sanitise, so it is safe to LOG and safe to let a stack trace
+ *     print — that is deliberate, because `message` is what an uncaught
  *     rejection prints and what a third-party block's error reporter ships
  *     upstream by default, and this is a package consumed by third-party code.
- *     Its exact wording is NOT a contract.
- *   - {@link WorkflowEstimateError.code} — the only stable branch target.
+ *     **It is NOT intended for display to viewers**: it names an internal field
+ *     path, it is not localised, and **its exact wording is NOT a contract** —
+ *     it can change in any release, so a UI built on it silently rots.
+ *   - {@link WorkflowEstimateError.code} — **the BRANCH TARGET**, and the only
+ *     stable one. Switch on it to pick a viewer-facing string YOUR APP owns
+ *     (see the mapper in the `@example` on {@link useBuzzWorkflow}).
  *
  * 🔴 DO NOT "SIMPLIFY" THIS BY PUTTING `snapshot.error` BACK ON `message`. The
  * two fields are split on purpose and the split is what keeps database internals
  * off a third party's default-printed surface. `test/useBuzzWorkflow.test.tsx`
  * pins it with a realistic `Unique constraint failed: Key (email)=(…)` fixture.
  *
- * 🔴 NOT APPLIED TO `submit`, and the reason is narrower than it looks. On
- * `WORKFLOW_SUBMITTED` there are likewise TWO producers, indistinguishable by
- * `status`: budget/cap REJECTIONS, which are a documented outcome the block
- * recovers from (open a top-up flow) and which carry a `cost`; and caught server
- * exceptions posted via the SAME `failureSnapshot(err)` used above, which do not.
- * The `#4159` defect is therefore live on `submit` too, discriminated by `cost`
- * presence rather than by `status`. Fixing it there is a separate change with its
- * own blast radius on the recovery path (a fix MUST keep the budget-rejection arm
- * RESOLVING, or the top-up flow breaks) and is deliberately NOT attempted here —
- * so `submit` is left resolving BOTH, and the accompanying test pins only the
- * budget-rejection producer, not a claim that submit is correct.
- *
- * 🔴 TRACKED, NOT FORGOTTEN: civitai/civitai-app-starters#251. Read it before
- * touching `submit`'s failure handling.
+ * 🔴 `submit` HAS ITS OWN CLASS — {@link WorkflowSubmitError} — BECAUSE ITS
+ * DISCRIMINATOR IS DIFFERENT. On `WORKFLOW_SUBMITTED` both producers report
+ * `status:'failed'`, so `status` separates nothing there and `cost` presence is
+ * what does. Do not merge the two classes or reuse this one for submit: the
+ * question each answers is different ("was a usable price returned?" vs "was a
+ * workflow actually queued?") and so is the arm that must keep resolving.
+ * (civitai/civitai-app-starters#251, the `submit` half of civitai/civitai#4159.)
  */
 export class WorkflowEstimateError extends Error {
     /**
      * WHICH PRODUCER this was, structurally — so a caller branches on an enum
      * rather than on prose. It is the ONLY stable branch target here:
      * `snapshot.error` is server-authored and can change without notice, and
-     * {@link WorkflowEstimateError.message} is a generic summary whose exact
-     * wording is not a contract either.
+     * {@link WorkflowEstimateError.message} is a generic developer-facing summary
+     * whose exact wording is not a contract either.
+     *
+     * 🔴 THIS IS WHAT A VIEWER-FACING MESSAGE MUST BE DERIVED FROM. Branch on
+     * `code` and return a string your app owns and localises; never render
+     * `message` or `snapshot.error` to a viewer.
      *
      * - `'failed'`  — the reply's `status` is `'failed'`. USUALLY that means
      *   `blocks.estimateWorkflow` threw server-side and the host posted its
@@ -176,8 +187,8 @@ export class WorkflowEstimateError extends Error {
      * will not price — the whole point of civitai/civitai#4159), but civitai's
      * `errorHandling.ts` documents that raw upstream text — Prisma/`pg` column and
      * constraint names among it — can reach that field. Log it, show it in a
-     * developer-facing error surface, do NOT render it as trusted copy and do not
-     * ship it to a third-party error tracker without thinking about it.
+     * developer-facing error surface, **NEVER render it verbatim into markup**,
+     * and do not ship it to a third-party error tracker without thinking about it.
      */
     snapshot;
     constructor(snapshot, code) {
@@ -190,20 +201,245 @@ export class WorkflowEstimateError extends Error {
         // wire), so routing the raw text to `.snapshot.error` alone costs a
         // deliberate debugger nothing and changes only the DISPOSITION. `code` is
         // carried IN the message so an uncaught rejection is still self-describing.
+        //
+        // 🔴 IT IS DEVELOPER-FACING, NOT VIEWER-FACING — it names an internal field
+        // path and is not localised, so it must not reach rendered UI. Its exact
+        // wording is NOT a contract: it may change in any release. A viewer-facing
+        // string is derived from `code` by the app (see the class docs).
         super(`estimate did not return a usable price (${code}) — reason on .snapshot.error`);
         this.name = 'WorkflowEstimateError';
         this.code = code;
         this.snapshot = snapshot;
     }
 }
+/**
+ * The `workflowId` the host stamps on a snapshot it SYNTHESISED itself, rather
+ * than one derived from a real orchestrator workflow.
+ *
+ * 🔴 THIS IS A REAL WIRE INVARIANT, NOT A HEURISTIC. Every reply the host builds
+ * itself goes through `failureSnapshot()` (civitai
+ * `src/components/AppBlocks/failureSnapshot.ts`), which hardcodes this exact
+ * literal — from its `catch` arms AND from non-catch short-circuits such as the
+ * moderator-review nack. The server's `snapshotFromWorkflow` instead returns
+ * `workflow.id ?? 'whatif'`.
+ *
+ * 🔴 COMPARE IT WITH `===` — EXACT AND CASE-SENSITIVE. Every looser comparison
+ * quietly reclassifies a reply the host did NOT synthesise into the reassuring
+ * "nothing to report" arm, and each direction has to be pinned separately:
+ * `.startsWith()` accepts `failed-x`, `.endsWith()` accepts `x-failed`, and a
+ * case-folding compare accepts `FAILED`. All three are WIDENINGS, which a
+ * delete-only mutation sweep cannot see. Pinned by three near-miss fixtures in
+ * `test/useBuzzWorkflow.test.tsx`; an earlier version of this comment said only
+ * "never a prefix test" while the tests pinned only that one direction — a
+ * description wider than its coverage.
+ *
+ * 🔴 THE FAIL-SAFETY IS ONE-DIRECTIONAL, AND SAYING OTHERWISE WAS A BUG IN AN
+ * EARLIER REVISION OF THIS COMMENT. An id that is NOT this literal is treated as
+ * possibly-charged, so an unrecognised id never buys the reassuring reading —
+ * that direction holds. The converse does NOT: this sentinel is also what the
+ * host stamps when a submit threw for reasons that may still have created and
+ * charged a workflow (a lost response, an in-progress idempotency conflict). So
+ * the sentinel arm means "the host had no workflow to report", never "nothing
+ * happened". See {@link WorkflowSubmitError.code}.
+ */
+const HOST_SYNTHESISED_WORKFLOW_ID = 'failed';
+/**
+ * Thrown by {@link UseBuzzWorkflowReturn.submit} when the host's reply carries no
+ * usable workflow outcome — either the submit ERRORED before anything was queued,
+ * or a workflow-shaped reply came back already failed with no price.
+ *
+ * 🔴 READ {@link WorkflowSubmitError.code} BEFORE SAYING ANYTHING ABOUT MONEY.
+ * The two codes differ on exactly that, and getting it wrong is expensive in both
+ * directions — see the per-code notes below.
+ *
+ * 🔴 WHY THIS EXISTS — civitai/civitai-app-starters#251, the `submit` half of
+ * civitai/civitai#4159. A server-side `blocks.submitWorkflow` throw cannot reach
+ * the block as a rejection; the reply crosses `postMessage`. The host instead
+ * posts a well-formed `WORKFLOW_SUBMITTED` carrying its `failureSnapshot(err)` —
+ * `{ workflowId: 'failed', status: 'failed', error: '<server message>' }`, with
+ * **no `cost`**. That snapshot is perfectly legal, so `submit()` resolved it and
+ * moved the hook to `'done'`, handing the caller a "workflow" that does not
+ * exist.
+ *
+ * 🔴 TWO PRODUCERS, ONE `status` — AND HERE `status` DISCRIMINATES NOTHING. This
+ * is what makes submit's version of the defect different from estimate's, and
+ * why {@link WorkflowEstimateError}'s guard could not simply be copied:
+ *
+ *   - **budget / spend-cap REJECTION** — a legitimate OUTCOME. The server quotes
+ *     the price it refused to charge, so the snapshot carries a numeric
+ *     `cost.total`. Blocks recover from it (open a top-up flow), so it MUST keep
+ *     RESOLVING. Every such exit on the server attaches a cost: the per-call
+ *     `buzzBudget` gate, the per-user daily Buzz cap, the per-app aggregate and
+ *     velocity caps, and the dev-tunnel session cap — on all three body kinds.
+ *   - **caught server EXCEPTION** — `failureSnapshot(err)`, no `cost`, and the
+ *     `'failed'` sentinel id. The host had no workflow to report — usually
+ *     nothing was queued, but a lost response or an in-progress idempotency
+ *     conflict lands here too. Rejects as `'exception'`.
+ *   - **a reply that came back failed and unpriced with a NON-sentinel id** —
+ *     normally a genuine orchestrator id, no `cost` (the server's
+ *     `snapshotFromWorkflow` omits the key whenever `workflow.cost?.total` is not
+ *     numeric). Rejects as `'workflow-failed'`, and **money may already be
+ *     committed** — see that code's note.
+ *
+ * So the rule is `cost` presence, and ONLY among failure-shaped replies: an
+ * ordinary in-flight submit (`{ workflowId:'wf_…', status:'pending' }`) is
+ * cost-less too and must keep resolving, which is why the guard is not keyed on
+ * `cost` alone either. Both clauses are load-bearing; each has its own control
+ * in `test/useBuzzWorkflow.test.tsx`.
+ *
+ * 🔴 THE GUARD IS DELIBERATELY NOT WIDENED TO ALL TERMINAL STATUSES. A cost-less
+ * `succeeded` / `canceled` / `expired` reply is a legitimate outcome and must
+ * RESOLVE; only `'failed'` is unusable. Swapping the clause for
+ * `TERMINAL_STATUSES.has(...)` is a silent WIDENING that a delete-only mutation
+ * sweep cannot see — `test/useBuzzWorkflow.test.tsx` pins each of those three
+ * statuses explicitly for exactly that reason.
+ *
+ * 🔴 THREE FIELDS, THREE AUDIENCES — AND **NONE OF THEM IS VIEWER-FACING COPY**,
+ * exactly as on {@link WorkflowEstimateError}. Two apps migrating to `0.43.0`
+ * piped that class's `err.message` straight into rendered UI
+ * (civitai/civitai-app-starters#253); the same split applies here so the same
+ * mistake is not re-enabled on the submit path.
+ *
+ *   - {@link WorkflowSubmitError.snapshot}`.error` — **the DIAGNOSTIC read.** The
+ *     server's own words, verbatim. **Server-authored and UNSANITISED**:
+ *     civitai's `errorHandling.ts` documents that raw upstream text —
+ *     Prisma/`pg` column and constraint names among it — can reach this field.
+ *     Log it, or show it in a developer-facing error surface. **NEVER render it
+ *     verbatim into markup**, and think before shipping it to a third-party
+ *     error tracker.
+ *   - {@link WorkflowSubmitError.message} — **DEVELOPER-FACING.** A CONSTANT
+ *     template with only `code` interpolated. It contains no server text, so it
+ *     is safe to LOG and safe to let a stack trace print — deliberate, because
+ *     `message` is what an uncaught rejection prints and what a third-party
+ *     block's error reporter ships upstream by default. **It is NOT intended for
+ *     display to viewers** and **its exact wording is NOT a contract.**
+ *   - {@link WorkflowSubmitError.code} — **the BRANCH TARGET**, and the only
+ *     stable one.
+ *
+ * 🔴 DO NOT "SIMPLIFY" THIS BY PUTTING `snapshot.error` BACK ON `message`, and do
+ * not widen the guard to reject a budget rejection. The first re-opens #253; the
+ * second breaks the top-up recovery flow, which is the one thing #251 says must
+ * not break.
+ */
+export class WorkflowSubmitError extends Error {
+    /**
+     * WHICH PRODUCER this was, structurally — so a caller branches on an enum
+     * rather than on prose. It is the ONLY stable branch target here:
+     * `snapshot.error` is server-authored and can change without notice, and
+     * {@link WorkflowSubmitError.message} is a generic developer-facing summary
+     * whose exact wording is not a contract either.
+     *
+     * 🔴 THE TWO CODES DIFFER ON WHETHER MONEY MOVED. Do not collapse them, and do
+     * not write recovery copy that ignores the distinction.
+     *
+     * - `'exception'` — the host built this reply itself
+     *   (`failureSnapshot(err)`, id {@link HOST_SYNTHESISED_WORKFLOW_ID}), from a
+     *   `catch` OR from a non-catch short-circuit such as the moderator-review
+     *   nack. **It means the host had no workflow to report — NOT that nothing
+     *   happened.**
+     *
+     *   🔴 USUALLY nothing was queued and nothing was charged, and a retry is the
+     *   sensible recovery. But the same shape is reachable when a workflow MAY have
+     *   been created and charged, because the failure happened after the request
+     *   left the block:
+     *     - a **lost response** — the server's own catch concedes that "the
+     *       orchestrator externalId dedupe still protects a retry that DID create a
+     *       workflow server-side despite a lost response". What that path refunds
+     *       is its own reservation and cap counters; the Buzz debit happens inside
+     *       the orchestrator's submit.
+     *     - an **in-progress idempotency CONFLICT** — a concurrent first attempt is
+     *       still in flight and may be committing right now. Retrying blind is the
+     *       worst option there.
+     *     - a **transient transport failure** (5xx / 408 / 429 / 401), which the
+     *       `dev:live` host collapses into this same shape.
+     *
+     *   So prefer **reusing the same {@link SubmitWorkflowOptions.idempotencyKey}**
+     *   on retry rather than letting a fresh one be minted, and do not render
+     *   "nothing was charged" to a viewer as a certainty. There is no workflow id
+     *   on this arm to poll.
+     *
+     * - `'workflow-failed'` — the id was NOT the host's sentinel, so the reply came
+     *   from the server's `snapshotFromWorkflow`: normally a real orchestrator id,
+     *   already `'failed'` and with no price.
+     *
+     *   🔴 **DO NOT TELL THE VIEWER NOTHING WAS CHARGED, AND DO NOT BLIND-RETRY.**
+     *   Server-side, `blocks.submitWorkflow` treats *any resolved* submit as
+     *   money-COMMITTED: its own comment is "A resolved submit is money-COMMITTED
+     *   (the reservation is kept regardless of snapshot status)… we do NOT refund
+     *   on a non-throwing failed snapshot", and `finalizeGenIdempotency` runs on
+     *   that path. So Buzz may already be spent for this call.
+     *
+     *   A retry is a SECOND reservation unless you reuse the same
+     *   {@link SubmitWorkflowOptions.idempotencyKey} — `submit()` mints a fresh key
+     *   per call by default, so an automatic retry double-reserves.
+     *
+     *   🔴 `err.snapshot.workflowId` IS USUALLY POLLABLE, BUT CHECK IT FIRST — this
+     *   arm is defined by what the id is NOT. The server emits `workflow.id ??
+     *   'whatif'`, and it treats **both** `'failed'` and `'whatif'` as non-workflow
+     *   sentinels (it skips its own persistence and settle steps on either). So
+     *   `'whatif'` lands here — correctly, because the cautious money reading still
+     *   applies — but there is nothing to poll. Guard with
+     *   `err.snapshot.workflowId !== 'whatif'` before calling
+     *   {@link UseBuzzWorkflowReturn.watch} / {@link UseBuzzWorkflowReturn.poll} to
+     *   learn the workflow's actual fate before spending again.
+     *
+     * A union rather than a boolean so a future producer gets its own code without
+     * breaking a caller's `switch`.
+     *
+     * 🔴 A BUDGET REJECTION NEVER ARRIVES HERE. It resolves, and is read off the
+     * returned snapshot as `status === 'failed'` with a numeric `cost.total`.
+     */
+    code;
+    /**
+     * The snapshot the host replied with, VERBATIM — including `snapshot.error`,
+     * the server's own words, when there are any.
+     *
+     * 🔴 `snapshot.error` IS SERVER-AUTHORED AND UNSANITISED. It is where the
+     * reason lives, but raw upstream text — Prisma/`pg` column and constraint
+     * names among it — can reach that field. Log it, show it in a developer-facing
+     * error surface, **NEVER render it verbatim into markup**.
+     */
+    snapshot;
+    constructor(snapshot, code) {
+        // 🔴 GENERIC, AND DELIBERATELY NOT `snapshot.error` — see the class docs and
+        // civitai/civitai-app-starters#253. `message` is the field an uncaught
+        // rejection PRINTS and the field a third-party block's error reporter ships
+        // upstream by default, so putting the raw server string here would put
+        // database internals on the default-printed surface of somebody else's code.
+        // Exposure to the block is identical either way (`snapshot.error` was always
+        // on the wire); only the DISPOSITION changes. `code` is carried IN the
+        // message so an uncaught rejection is still self-describing.
+        //
+        // 🔴 IT MAKES NO CLAIM ABOUT MONEY, AND THAT IS THE POINT. An earlier draft
+        // read "submit did not queue a workflow", which is FALSE for
+        // `'workflow-failed'` — that arm has a workflow-shaped reply and
+        // possibly-committed
+        // spend. A single template that is true for BOTH codes cannot mislead a
+        // developer reading a stack trace; the money semantics live on `code`.
+        super(`submit did not return a usable workflow (${code}) — reason on .snapshot.error`);
+        this.name = 'WorkflowSubmitError';
+        this.code = code;
+        this.snapshot = snapshot;
+    }
+}
 /**
  * Orchestrates the estimate → confirm → submit → poll dance through the
  * host-mediated `postMessage` path.
  *
- * The host enforces budget rules (`cost_estimate <= token.buzzBudget`)
- * before forwarding to the orchestrator; submit() will reject if the host
- * refuses. Block apps should call `useBuzzPurchase().openPurchaseModal()`
- * when that happens.
+ * The host enforces budget rules (`cost_estimate <= token.buzzBudget`) before
+ * forwarding to the orchestrator.
+ *
+ * 🔴 A BUDGET REFUSAL DOES **NOT** REJECT — IT RESOLVES. It comes back as a
+ * snapshot with `status: 'failed'`, an `error` string and the `cost` the server
+ * declined to charge, and THAT resolved shape is the cue to call
+ * `useBuzzPurchase().openPurchaseModal()`. What DOES reject is a submit with no
+ * usable outcome — see {@link WorkflowSubmitError}. Routing a rejection into a
+ * top-up sells Buzz for a failure Buzz cannot fix.
+ *
+ * 🔴 NOR IS EVERY RESOLVED `'failed'` AN AFFORDABILITY PROBLEM. The per-app
+ * velocity limit, the per-app aggregate daily cap, a fail-closed "temporarily
+ * unavailable" deny and a missing price quote are all priced, resolving outcomes
+ * too. Branch on the message/your own policy before offering to sell anything.
  *
  * AFTER `submit` FLIPS `status` TO `'polling'`, USE `watch(workflowId)`. It owns
  * the loop, resolves on the terminal snapshot, and pushes every intermediate
@@ -246,21 +482,58 @@ export class WorkflowEstimateError extends Error {
  *   modelVersionId,
  *   params: { prompt: 'a cat' },
  * };
+ * // A viewer-facing string YOUR APP owns, chosen by `code`. Neither
+ * // `err.message` (developer-facing, wording not a contract) nor
+ * // `err.snapshot.error` (server-authored, unsanitised) may be rendered.
+ * const estimateFailureMessage = (err: WorkflowEstimateError) =>
+ *   err.code === 'no-cost'
+ *     ? 'We could not get a price for this configuration. Try adjusting it.'
+ *     : 'Pricing is unavailable right now. Please try again shortly.';
+ *
  * // 🔴 estimate() REJECTS when the reply carries no usable price — an errored
  * // estimate, or one that came back with no numeric cost. ALWAYS catch it.
  * try {
  *   await estimate(body);          // status 'estimating' → 'confirming' (cost in result.cost.total)
  * } catch (err) {
  *   // status is now 'error'; `result` holds the unusable snapshot, never a
- *   // STALE priced one. Branch on err.code ('failed' | 'no-cost'); the server's
- *   // reason is on err.snapshot.error (unsanitised — log it, don't render it as
- *   // trusted copy). See WorkflowEstimateError.
+ *   // STALE priced one. See WorkflowEstimateError for the three-audience split.
  *   if (!(err instanceof WorkflowEstimateError)) throw err;
- *   logForDebugging(err.snapshot.error);
- *   showError('This configuration cannot be priced right now.');
+ *   logForDebugging(err.message, err.snapshot.error); // developer-facing: LOG only
+ *   showError(estimateFailureMessage(err));           // viewer-facing: app-owned
+ * }
+ * // 🔴 submit() REJECTS when the reply carries no usable workflow outcome, so it
+ * // needs a catch too — and the two codes differ on whether MONEY MOVED.
+ * try {
+ *   const snap = await submit(body); // status 'submitting' → 'polling'
+ *   if (snap.status === 'failed') {
+ *     // RESOLVED + priced = a server outcome (affordability, a cap, a velocity
+ *     // limit, a transient deny). Only some of those are fixable by buying Buzz.
+ *     showError(submitOutcomeMessage(snap));
+ *   } else {
+ *     const done = await watch(snap.workflowId, { onUpdate: render }); // → terminal
+ *     if (done.status === 'succeeded') setImages(done.imageUrls ?? []);
+ *   }
+ * } catch (err) {
+ *   if (!(err instanceof WorkflowSubmitError)) throw err;
+ *   logForDebugging(err.message, err.snapshot.error); // developer-facing: LOG only
+ *   // 🔴 TWO SEPARATE QUESTIONS: `code` decides what you may say about MONEY,
+ *   // the id decides only whether there is anything to POLL. Conjoining them
+ *   // sends a 'whatif' id into the reassuring arm.
+ *   if (err.code === 'workflow-failed') {
+ *     // Spend may already be committed. Do NOT retry blindly (that mints a new
+ *     // idempotency key = a second reservation) and do NOT claim nothing was
+ *     // charged.
+ *     showError('The generation may have started but did not complete.');
+ *     // 'whatif' is a non-workflow sentinel — nothing behind it to poll.
+ *     if (err.snapshot.workflowId !== 'whatif') {
+ *       await watch(err.snapshot.workflowId, { onUpdate: render });
+ *     }
+ *   } else {
+ *     // 'exception' — usually nothing was queued. Retry, but reuse the SAME
+ *     // idempotencyKey: a lost response can also land here.
+ *     showError('Could not start the generation. Please try again.');
+ *   }
  * }
- * const snap = await submit(body); // status 'submitting' → 'polling'; returns a workflowId
- * const done = await watch(snap.workflowId, { onUpdate: render }); // → terminal
  */
 export function useBuzzWorkflow() {
     const [status, setStatus] = useState('idle');
@@ -324,7 +597,45 @@ export function useBuzzWorkflow() {
         const idempotencyKey = options?.idempotencyKey ?? generateIdempotencyKey();
         try {
             const { snapshot } = await sendTypedRequest(getTransport(), { type: 'SUBMIT_WORKFLOW', payload: { body, idempotencyKey } }, 'WORKFLOW_SUBMITTED', { timeoutMs: WORKFLOW_REQUEST_TIMEOUT_MS });
+            // 🔴 PUBLISH THE SNAPSHOT BEFORE THE REJECTION BELOW, for the same reason
+            // `estimate` does: a block may render from `result` rather than from the
+            // returned value, and jumping over this line would leave the PREVIOUS
+            // submit's snapshot in place — a live control pointing at a workflow THIS
+            // submit did not queue.
             setResult(snapshot);
+            // 🔴 AN ERRORED SUBMIT MUST REJECT (civitai/civitai-app-starters#251, the
+            // `submit` half of civitai/civitai#4159). Two producers report
+            // `status:'failed'` and `status` separates neither:
+            //
+            //   - a budget / spend-cap REJECTION is an OUTCOME the block recovers from
+            //     (open a top-up flow). The server quotes the price it refused to
+            //     charge, so `cost.total` is present. It RESOLVES — turning this arm
+            //     into a throw is the one change that would break the recovery path.
+            //   - a failure-shaped reply with NO `cost` is not a usable outcome. It
+            //     REJECTS — and the `code` says which kind, because they differ on
+            //     whether money moved (see WorkflowSubmitError.code).
+            //
+            // BOTH clauses are load-bearing. Dropping `status === 'failed'` would
+            // reject every ordinary in-flight reply (`{status:'pending'}` is cost-less
+            // too); dropping the cost test would reject the budget rejection. And the
+            // test is `typeof … !== 'number'`, never `!snapshot.cost?.total`: `0` is a
+            // real price and falsy.
+            //
+            // 🔴 `status === 'failed'`, NOT `TERMINAL_STATUSES.has(status)`. Widening it
+            // would reject cost-less `succeeded`/`canceled`/`expired` replies, which are
+            // legitimate outcomes the server really does emit without a price
+            // (`snapshotFromWorkflow` omits `cost` on any non-numeric total). That
+            // WIDENING is invisible to a mutation sweep that only deletes clauses, so
+            // all three statuses are pinned by their own fixtures in the test file.
+            if (snapshot.status === 'failed' && typeof snapshot.cost?.total !== 'number') {
+                // 🔴 WHICH ARM: the host stamps its own synthesised failures with the
+                // `'failed'` sentinel, while a server-built reply carries `workflow.id`
+                // (or the `'whatif'` sentinel).
+                // Anything unrecognised falls to `'workflow-failed'`, the arm that assumes
+                // money MAY be committed — an unknown id must never buy the reassuring
+                // "nothing was charged" reading.
+                throw new WorkflowSubmitError(snapshot, snapshot.workflowId === HOST_SYNTHESISED_WORKFLOW_ID ? 'exception' : 'workflow-failed');
+            }
             setStatus(TERMINAL_STATUSES.has(snapshot.status) ? 'done' : 'polling');
             return snapshot;
         }

package/dist/hooks/useBuzzWorkflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"useBuzzWorkflow.js","sourceRoot":"","sources":["../../src/hooks/useBuzzWorkflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI9C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEpF;;;;GAIG;AACH,MAAM,iBAAiB,GAAiD,IAAI,GAAG,CAAC;IAC9E,WAAW;IACX,QAAQ;IACR,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7C,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAwDpC;;;;;;;;;GASG;AACH,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C;;;;;;;;;;;;;;;;;;;OAmBG;IACM,IAAI,CAAuB;IAEpC;;;;;;;;;;;OAWG;IACM,QAAQ,CAAwB;IAEzC,YAAY,QAA+B,EAAE,IAA0B;QACrE,+EAA+E;QAC/E,sEAAsE;QACtE,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,oEAAoE;QACpE,0EAA0E;QAC1E,4EAA4E;QAC5E,KAAK,CAAC,2CAA2C,IAAI,+BAA+B,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAyFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAiB,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA+B,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACxD,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAChD,iBAAiB,EACjB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;YACF,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,oBAAoB;YACpB,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,2EAA2E;YAC3E,wEAAwE;YACxE,iEAAiE;YACjE,EAAE;YACF,4EAA4E;YAC5E,2DAA2D;YAC3D,yEAAyE;YACzE,0CAA0C;YAC1C,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,EAAE;YACF,qEAAqE;YACrE,0EAA0E;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC;YAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,SAAS,CAAC,YAAY,CAAC,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,IAAkB,EAAE,OAA+B,EAAE,EAAE;QACvF,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,sBAAsB,EAAE,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAC9D,oBAAoB,EACpB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;YACF,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;OAIG;IACH,MAAM,QAAQ,GAAG,WAAW,CAC1B,KAAK,EAAE,UAAkB,EAAE,WAAoB,EAAkC,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACP,UAAU;gBACV,iEAAiE;gBACjE,gEAAgE;gBAChE,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE;SACF,EACD,iBAAiB,EACjB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,yCAAyC;QACzC,2EAA2E;QAC3E,yEAAyE;QACzE,yBAAyB;QACzB,EAAE;QACF,0EAA0E;QAC1E,iEAAiE;QACjE,yEAAyE;QACzE,qEAAqE;QACrE,4DAA4D;QAC5D,2EAA2E;QAC3E,oEAAoE;QACpE,eAAe;QACf,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uDAAuD,UAAU,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,UAAkB,EAAE,EAAE;QAC3B,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5C,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,SAAS,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EACD,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CACvB,KAAK,EAAE,UAAkB,EAAE,OAA8B,EAAE,EAAE;QAC3D,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,IAAI,yBAAyB,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,0BAA0B,CAAC;QACvE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,yBAAyB,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,wBAAwB,CAAC,CAAC;QAE/E,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,SAAS,CAAC,CAAC;QAErB,IAAI,IAAI,GAAiC,IAAI,CAAC;QAC9C,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAE5B,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,2CAA2C;QAC3C,SAAS,CAAC;YACR,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO;gBAAE,MAAM;YAEpC,IAAI,QAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACnD,mBAAmB,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,6DAA6D;gBAC7D,6CAA6C;gBAC7C,mBAAmB,IAAI,CAAC,CAAC;gBACzB,IAAI,mBAAmB,GAAG,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC/D,QAAQ,CAAC,GAAY,CAAC,CAAC;oBACvB,SAAS,CAAC,OAAO,CAAC,CAAC;oBACnB,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,IAAI,GAAG,QAAQ,CAAC;YAChB,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,4CAA4C;YAC5C,EAAE;YACF,uEAAuE;YACvE,2DAA2D;YAC3D,OAAO,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClB,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,sEAAsE;YACtE,wEAAwE;YACxE,uDAAuD;YACvD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,QAAQ;gBAAE,MAAM;YAC7C,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,SAAS,UAAU,+BAA+B,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;QAC5B,MAAM,OAAO,CAAC;IAChB,CAAC,EACD,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,EACpD,mBAAmB,EACnB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;YACF,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,sEAAsE;YACtE,sDAAsD;YACtD,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"useBuzzWorkflow.js","sourceRoot":"","sources":["../../src/hooks/useBuzzWorkflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI9C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEpF;;;;GAIG;AACH,MAAM,iBAAiB,GAAiD,IAAI,GAAG,CAAC;IAC9E,WAAW;IACX,QAAQ;IACR,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7C,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAwDpC;;;;;;;;;GASG;AACH,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACM,IAAI,CAAuB;IAEpC;;;;;;;;;;;OAWG;IACM,QAAQ,CAAwB;IAEzC,YAAY,QAA+B,EAAE,IAA0B;QACrE,+EAA+E;QAC/E,sEAAsE;QACtE,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,oEAAoE;QACpE,0EAA0E;QAC1E,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,KAAK,CAAC,2CAA2C,IAAI,+BAA+B,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,4BAA4B,GAAG,QAAQ,CAAC;AAQ9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkEG;IACM,IAAI,CAA0B;IAEvC;;;;;;;;OAQG;IACM,QAAQ,CAAwB;IAEzC,YAAY,QAA+B,EAAE,IAA6B;QACxE,6EAA6E;QAC7E,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,6EAA6E;QAC7E,6EAA6E;QAC7E,uEAAuE;QACvE,6DAA6D;QAC7D,EAAE;QACF,4EAA4E;QAC5E,6DAA6D;QAC7D,iEAAiE;QACjE,qBAAqB;QACrB,wEAAwE;QACxE,uEAAuE;QACvE,KAAK,CAAC,4CAA4C,IAAI,+BAA+B,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAmID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAiB,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA+B,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACxD,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAChD,iBAAiB,EACjB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;YACF,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,oBAAoB;YACpB,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,2EAA2E;YAC3E,wEAAwE;YACxE,iEAAiE;YACjE,EAAE;YACF,4EAA4E;YAC5E,2DAA2D;YAC3D,yEAAyE;YACzE,0CAA0C;YAC1C,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,EAAE;YACF,qEAAqE;YACrE,0EAA0E;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC;YAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,SAAS,CAAC,YAAY,CAAC,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,IAAkB,EAAE,OAA+B,EAAE,EAAE;QACvF,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,sBAAsB,EAAE,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAC9D,oBAAoB,EACpB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;YACF,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,wBAAwB;YACxB,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,0EAA0E;YAC1E,+DAA+D;YAC/D,oDAAoD;YACpD,EAAE;YACF,2EAA2E;YAC3E,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,EAAE;YACF,sEAAsE;YACtE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,wBAAwB;YACxB,EAAE;YACF,6EAA6E;YAC7E,6EAA6E;YAC7E,kEAAkE;YAClE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7E,sEAAsE;gBACtE,wEAAwE;gBACxE,gCAAgC;gBAChC,2EAA2E;gBAC3E,uEAAuE;gBACvE,iCAAiC;gBACjC,MAAM,IAAI,mBAAmB,CAC3B,QAAQ,EACR,QAAQ,CAAC,UAAU,KAAK,4BAA4B,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CACvF,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;OAIG;IACH,MAAM,QAAQ,GAAG,WAAW,CAC1B,KAAK,EAAE,UAAkB,EAAE,WAAoB,EAAkC,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACP,UAAU;gBACV,iEAAiE;gBACjE,gEAAgE;gBAChE,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE;SACF,EACD,iBAAiB,EACjB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,yCAAyC;QACzC,2EAA2E;QAC3E,yEAAyE;QACzE,yBAAyB;QACzB,EAAE;QACF,0EAA0E;QAC1E,iEAAiE;QACjE,yEAAyE;QACzE,qEAAqE;QACrE,4DAA4D;QAC5D,2EAA2E;QAC3E,oEAAoE;QACpE,eAAe;QACf,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uDAAuD,UAAU,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,UAAkB,EAAE,EAAE;QAC3B,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5C,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,SAAS,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EACD,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CACvB,KAAK,EAAE,UAAkB,EAAE,OAA8B,EAAE,EAAE;QAC3D,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,IAAI,yBAAyB,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,0BAA0B,CAAC;QACvE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,yBAAyB,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,wBAAwB,CAAC,CAAC;QAE/E,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,SAAS,CAAC,CAAC;QAErB,IAAI,IAAI,GAAiC,IAAI,CAAC;QAC9C,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAE5B,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,2CAA2C;QAC3C,SAAS,CAAC;YACR,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO;gBAAE,MAAM;YAEpC,IAAI,QAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACnD,mBAAmB,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,6DAA6D;gBAC7D,6CAA6C;gBAC7C,mBAAmB,IAAI,CAAC,CAAC;gBACzB,IAAI,mBAAmB,GAAG,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC/D,QAAQ,CAAC,GAAY,CAAC,CAAC;oBACvB,SAAS,CAAC,OAAO,CAAC,CAAC;oBACnB,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,IAAI,GAAG,QAAQ,CAAC;YAChB,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,4CAA4C;YAC5C,EAAE;YACF,uEAAuE;YACvE,2DAA2D;YAC3D,OAAO,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClB,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,sEAAsE;YACtE,wEAAwE;YACxE,uDAAuD;YACvD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,QAAQ;gBAAE,MAAM;YAC7C,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,SAAS,UAAU,+BAA+B,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;QAC5B,MAAM,OAAO,CAAC;IAChB,CAAC,EACD,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,EACpD,mBAAmB,EACnB,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAC3C,CAAC;YACF,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,sEAAsE;YACtE,sDAAsD;YACtD,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC"}

package/dist/hooks/useCheckpointPicker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckpointPicker.d.ts","sourceRoot":"","sources":["../../src/hooks/useCheckpointPicker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAMnE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,IAAI,EAAE,CAAC,IAAI,EAAE;QACX;;;;;WAKG;QACH,cAAc,EAAE,MAAM,CAAC;QACvB,uEAAuE;QACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAkCA"}
+{"version":3,"file":"useCheckpointPicker.d.ts","sourceRoot":"","sources":["../../src/hooks/useCheckpointPicker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAMnE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,IAAI,EAAE,CAAC,IAAI,EAAE;QACX;;;;;WAKG;QACH,cAAc,EAAE,MAAM,CAAC;QACvB,uEAAuE;QACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAuCA"}

package/dist/hooks/useCheckpointPicker.js

@@ -38,8 +38,13 @@ export function useCheckpointPicker() {
     }, []);
     const persist = useCallback(async (versionId) => {
         const { ok, error } = await sendTypedRequest(getTransport(), { type: 'SET_USER_CHECKPOINT', payload: { versionId } }, 'USER_CHECKPOINT_SET');
-        if (!ok) {
-            throw new Error(error ?? 'failed to persist checkpoint');
+        // A PRESENT `error` is the reject signal, not a TRUTHY one: the reply
+        // validator early-accepts anything carrying an `error` key, so `error: ''`
+        // reaches here having skipped the success-field checks. This site tested
+        // `!ok` ALONE before, so the `error` clause is new, not merely retyped.
+        // `||` (not `??`) so an empty error string still yields readable copy.
+        if (!ok || error !== undefined) {
+            throw new Error(error || 'failed to persist checkpoint');
         }
     }, []);
     return { open, persist };

package/dist/hooks/useCheckpointPicker.js.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckpointPicker.js","sourceRoot":"","sources":["../../src/hooks/useCheckpointPicker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAIpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB;IAcjC,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,IAA2D,EAAE,EAAE;QACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI;oBAC/B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;SACF,EACD,0BAA0B,EAC1B,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAC5C,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAwB,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAC1C,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EACvD,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,8BAA8B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"useCheckpointPicker.js","sourceRoot":"","sources":["../../src/hooks/useCheckpointPicker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAIpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB;IAcjC,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,IAA2D,EAAE,EAAE;QACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI;oBAC/B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;SACF,EACD,0BAA0B,EAC1B,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAC5C,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAwB,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAC1C,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EACvD,qBAAqB,CACtB,CAAC;QACF,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,CAAC,EAAE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,8BAA8B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/hooks/useSaveImage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSaveImage.d.ts","sourceRoot":"","sources":["../../src/hooks/useSaveImage.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,IAAI,YAAY,CAiB3C"}
+{"version":3,"file":"useSaveImage.d.ts","sourceRoot":"","sources":["../../src/hooks/useSaveImage.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,IAAI,YAAY,CAqB3C"}

package/dist/hooks/useSaveImage.js

@@ -18,8 +18,12 @@ export function useSaveImage() {
             ? { url: input.url, filename: input.filename }
             : { imageId: input.imageId, filename: input.filename };
         const reply = await sendTypedRequest(getTransport(), { type: 'SAVE_IMAGE', payload }, 'SAVE_IMAGE_RESULT');
-        if (!reply.ok || reply.error) {
-            throw new Error(reply.error ?? 'failed to save image');
+        // A PRESENT `error` is the reject signal, not a TRUTHY one: the reply
+        // validator early-accepts anything carrying an `error` key, so `error: ''`
+        // reaches here having skipped the success-field checks. `||` (not `??`) so
+        // an empty error string still yields readable copy.
+        if (!reply.ok || reply.error !== undefined) {
+            throw new Error(reply.error || 'failed to save image');
         }
     }, []);
     return { saveImage };

package/dist/hooks/useSaveImage.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSaveImage.js","sourceRoot":"","sources":["../../src/hooks/useSaveImage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAgC5D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,KAAqB,EAAiB,EAAE;QAC3E,MAAM,OAAO,GACX,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAC9C,CAAC,CAAC,EAAE,OAAO,EAAG,KAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAC/B,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,sBAAsB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"useSaveImage.js","sourceRoot":"","sources":["../../src/hooks/useSaveImage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAgC5D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,KAAqB,EAAiB,EAAE;QAC3E,MAAM,OAAO,GACX,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAC9C,CAAC,CAAC,EAAE,OAAO,EAAG,KAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAC/B,mBAAmB,CACpB,CAAC;QACF,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,sBAAsB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC"}

package/dist/hooks/useSharedStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSharedStorage.d.ts","sourceRoot":"","sources":["../../src/hooks/useSharedStorage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAyB,MAAM,yBAAyB,CAAC;AAKzF;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACjD;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACnE;AA8CD,wBAAgB,gBAAgB,IAAI,gBAAgB,CA8GnD"}
+{"version":3,"file":"useSharedStorage.d.ts","sourceRoot":"","sources":["../../src/hooks/useSharedStorage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAyB,MAAM,yBAAyB,CAAC;AAKzF;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACjD;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACnE;AA8CD,wBAAgB,gBAAgB,IAAI,gBAAgB,CA8HnD"}

package/dist/hooks/useSharedStorage.js

@@ -72,8 +72,12 @@ export function useSharedStorage() {
             },
             async report(key, reason) {
                 const result = await sendTypedRequest(transport, { type: 'SHARED_REPORT', payload: { key, reason } }, 'SHARED_REPORT_RESULT');
-                if (!result.ok || result.error) {
-                    throw new Error(result.error ?? 'shared report failed');
+                // A PRESENT `error` is the reject signal, not a TRUTHY one: the reply
+                // validator early-accepts anything carrying an `error` key, so
+                // `error: ''` reaches here having skipped the success-field checks.
+                // `||` (not `??`) so an empty error string still yields readable copy.
+                if (!result.ok || result.error !== undefined) {
+                    throw new Error(result.error || 'shared report failed');
                 }
             },
             async getCount(key) {
@@ -96,8 +100,9 @@ export function useSharedStorage() {
             },
             async update(key, value) {
                 const result = await sendTypedRequest(transport, { type: 'SHARED_UPDATE', payload: { key, value } }, 'SHARED_UPDATE_RESULT');
-                if (!result.ok || result.error) {
-                    throw new Error(result.error ?? 'shared update failed');
+                // PRESENT, not truthy — see `report()` above.
+                if (!result.ok || result.error !== undefined) {
+                    throw new Error(result.error || 'shared update failed');
                 }
             },
             async vote(key) {
@@ -117,6 +122,17 @@ export function useSharedStorage() {
                 if (!result.ok || result.error) {
                     throw new Error(result.error ?? 'shared withdraw failed');
                 }
+                // `deleted` is optional on the wire type because an error reply omits
+                // it. On the success path the validator requires a boolean, so this is
+                // defence in depth rather than a reachable branch through the real
+                // transport — but it is what makes the `boolean` we return honest,
+                // instead of a cast asserting a guarantee this function cannot see.
+                // NOTE: this site still tests `error` for TRUTHINESS. It is not one of
+                // the six this change normalized (it early-accepted before PR #273);
+                // the remaining truthiness sites are a tracked follow-up.
+                if (typeof result.deleted !== 'boolean') {
+                    throw new Error('shared withdraw failed: reply carried no `deleted` flag');
+                }
                 return { ok: true, deleted: result.deleted };
             },
         };