@civitai/blocks-react 0.63.2 → 0.65.0

package/dist/transport/validate.js

@@ -255,8 +255,120 @@ export function isValidWorkflowSnapshot(s) {
             return false;
         }
     }
+    // ---- The host fields mirrored in #524, plus the training-publish pair. ----
+    //
+    // Same policy as `autoClaim` above: each is OPTIONAL (an older host omits it
+    // and the snapshot stays valid), and a PRESENT but malformed value rejects
+    // the snapshot, because the block dereferences these fields.
+    //
+    // 🔴 ONE DELIBERATE DIFFERENCE: the open-ended string unions
+    // (`modelSubstitutions[].reason`, `trainedEpochs[].$type`, `toolCalls[].type`)
+    // are checked as STRINGS, not against their current members. A rejected snapshot is a dropped
+    // poll reply — the block's request hangs to its timeout — so pinning today's
+    // members here would turn the host adding a value into a fleet-wide hang in
+    // every already-shipped block bundle. The types document that unknown values
+    // may arrive.
+    if (s.modelSubstitutions !== undefined) {
+        if (!Array.isArray(s.modelSubstitutions))
+            return false;
+        for (const m of s.modelSubstitutions) {
+            if (!isObject(m))
+                return false;
+            if (!isFiniteNumber(m.requested) || !isFiniteNumber(m.applied))
+                return false;
+            if (typeof m.reason !== 'string')
+                return false;
+        }
+    }
+    if (s.textOutputs !== undefined) {
+        if (!Array.isArray(s.textOutputs))
+            return false;
+        if (!s.textOutputs.every((t) => typeof t === 'string'))
+            return false;
+    }
+    if (s.textOutputWithheld !== undefined) {
+        if (!isObject(s.textOutputWithheld) || typeof s.textOutputWithheld.reason !== 'string') {
+            return false;
+        }
+    }
+    if (s.toolCalls !== undefined) {
+        if (!Array.isArray(s.toolCalls))
+            return false;
+        for (const c of s.toolCalls) {
+            if (!isObject(c))
+                return false;
+            if (typeof c.id !== 'string' || typeof c.type !== 'string')
+                return false;
+            if (!isObject(c.function))
+                return false;
+            if (typeof c.function.name !== 'string' || typeof c.function.arguments !== 'string') {
+                return false;
+            }
+        }
+    }
+    if (s.stepOutputs !== undefined) {
+        if (!Array.isArray(s.stepOutputs))
+            return false;
+        // `output` is `unknown` by contract — only the `$type` label is dereferenced.
+        for (const o of s.stepOutputs) {
+            if (!isObject(o) || typeof o.$type !== 'string')
+                return false;
+        }
+    }
+    if (s.trainedEpochs !== undefined && !isValidTrainedEpochs(s.trainedEpochs))
+        return false;
+    if (s.publishedModel !== undefined && !isValidPublishedModel(s.publishedModel))
+        return false;
+    if (s.trainingQuote !== undefined && !isValidTrainingQuote(s.trainingQuote))
+        return false;
+    return true;
+}
+/**
+ * Shape check for `trainingQuote` — the quote a `kind: 'training'` estimate
+ * returns. The block passes `quoteId` back verbatim and renders `total`, so both
+ * are pinned: a non-empty string, a finite number. `quoteId`'s `tq_…` FORMAT is
+ * deliberately not pinned — it is opaque, and a host changing it must not turn
+ * every estimate reply into a dropped one.
+ */
+function isValidTrainingQuote(q) {
+    if (!isObject(q))
+        return false;
+    if (!isNonEmptyString(q.quoteId))
+        return false;
+    if (!isFiniteNumber(q.total))
+        return false;
+    if (!Number.isInteger(q.imageCount) || q.imageCount < 0)
+        return false;
+    return typeof q.expiresAt === 'string';
+}
+/**
+ * Shape check for `trainedEpochs` — shared by {@link isValidWorkflowSnapshot}
+ * and the `AppWorkflow` row guard, which carry the same field. `$type` is
+ * checked as a STRING, not against today's members (see the forward-
+ * compatibility note in {@link isValidWorkflowSnapshot}).
+ */
+function isValidTrainedEpochs(epochs) {
+    if (!Array.isArray(epochs))
+        return false;
+    for (const e of epochs) {
+        if (!isObject(e) || typeof e.$type !== 'string')
+            return false;
+        if (!Number.isInteger(e.epochNumber))
+            return false;
+    }
     return true;
 }
+/**
+ * Shape check for `publishedModel` — shared by {@link isValidWorkflowSnapshot}
+ * and the `AppWorkflow` row guard, which carry the same field.
+ */
+function isValidPublishedModel(p) {
+    if (!isObject(p))
+        return false;
+    if (!isFiniteNumber(p.modelId) || !isFiniteNumber(p.modelVersionId))
+        return false;
+    return typeof p.published === 'boolean';
+}
 /**
  * Host-pushed token rotation. No `requestId` field; the host is the initiator.
  * Carries the same wrapped-token shape as the reply path.
@@ -823,6 +935,11 @@ function isValidAppWorkflow(w) {
         if (img.nsfwLevel !== null && !isFiniteNumber(img.nsfwLevel))
             return false;
     }
+    // OPTIONAL — absent on hosts that predate them; checked only when present.
+    if (w.publishedModel !== undefined && !isValidPublishedModel(w.publishedModel))
+        return false;
+    if (w.trainedEpochs !== undefined && !isValidTrainedEpochs(w.trainedEpochs))
+        return false;
     return true;
 }
 /**
@@ -1160,6 +1277,71 @@ export function isValidCreatePostResult(p) {
         return false;
     return true;
 }
+/**
+ * Reply to `PREPARE_TRAINING_DATASET`. A well-formed reply carries EITHER a
+ * `result` (`{ datasetId: non-empty string, count: integer ≥ 0, rejected: [{
+ * imageId: number, reason: string }] }`) OR an `error`; one with neither is
+ * malformed and dropped.
+ *
+ * 🔴 `error` IS SHAPE-CHECKED ONLY — the same decision as
+ * {@link isValidCreatePostResult}: the host's closed codes share the field with
+ * any server message it forwards, and a membership check would drop those
+ * replies before correlation, leaving the request to its timer.
+ *
+ * `rejected[].reason` is checked as a STRING, not against today's six members —
+ * the host adding a reason must not make every prepare reply that carries it a
+ * dropped one (the forward-compatibility rule in {@link isValidWorkflowSnapshot}).
+ */
+export function isValidTrainingDatasetResult(p) {
+    if (!isObject(p))
+        return false;
+    if (!isWireRequestIdShape(p.requestId))
+        return false;
+    if (p.error !== undefined && typeof p.error !== 'string')
+        return false;
+    if (p.result !== undefined) {
+        const r = p.result;
+        if (!isObject(r))
+            return false;
+        if (!isNonEmptyString(r.datasetId))
+            return false;
+        if (!Number.isInteger(r.count) || r.count < 0)
+            return false;
+        if (!Array.isArray(r.rejected))
+            return false;
+        for (const x of r.rejected) {
+            if (!isObject(x) || !isFiniteNumber(x.imageId) || typeof x.reason !== 'string') {
+                return false;
+            }
+        }
+    }
+    if (p.result === undefined && p.error === undefined)
+        return false;
+    return true;
+}
+/**
+ * Reply to `RUN_TRAINING`. A well-formed reply carries EITHER a `snapshot` (a
+ * valid {@link isValidWorkflowSnapshot} — the block polls its `workflowId`) OR an
+ * `error`; one with neither is malformed and dropped.
+ *
+ * 🔴 `error` IS SHAPE-CHECKED ONLY, and here a membership check would cost the
+ * most: this request carries the TEN-MINUTE consent bound, and the host forwards
+ * server refusals (an expired quote, a changed body, an ineligible image) in this
+ * field. A dropped refusal would leave a Train button spinning for ten minutes.
+ */
+export function isValidTrainingResult(p) {
+    if (!isObject(p))
+        return false;
+    if (!isWireRequestIdShape(p.requestId))
+        return false;
+    if (p.error !== undefined && typeof p.error !== 'string')
+        return false;
+    if (p.snapshot !== undefined && !isValidWorkflowSnapshot(p.snapshot))
+        return false;
+    if (p.snapshot === undefined && p.error === undefined)
+        return false;
+    return true;
+}
 // ============================================================
 // App-storage (per-viewer KV) reply validators
 // ============================================================
@@ -1703,6 +1885,13 @@ export function payloadValidatorFor(type) {
         // `validate.test.ts`.
         case 'CREATE_POST_RESULT':
             return isValidCreatePostResult;
+        // Same caveat as CREATE_POST_RESULT: presence is compiler-enforced, the
+        // identity is pinned by test (`validate.test.ts`). TRAINING_RESULT settles a
+        // charged run.
+        case 'TRAINING_DATASET_RESULT':
+            return isValidTrainingDatasetResult;
+        case 'TRAINING_RESULT':
+            return isValidTrainingResult;
         case 'IMAGE_UPLOAD_RESULT':
             return isValidImageUploadResult;
         case 'IMAGE_SCAN_RESOLVED':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/blocks-react",
-  "version": "0.63.2",
+  "version": "0.65.0",
   "description": "React hooks and iframe transport for Civitai Apps. Pairs with @civitai/app-sdk/blocks.",
   "license": "MIT",
   "type": "module",
@@ -37,12 +37,12 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@civitai/components": "^0.9.2",
-    "@civitai/theme": "^0.5.2"
+    "@civitai/theme": "^0.5.2",
+    "@civitai/components": "^0.9.2"
   },
   "comment-peerDependencies": "This floor is DERIVED, not chosen — the lowest published app-sdk that exports every symbol this package imports. Do not edit it without reading ./PEER_FLOOR.md (in-repo, unpublished) and tests/guards/blocks-react-peer-floor.test.mjs.",
   "peerDependencies": {
-    "@civitai/app-sdk": ">=0.55.0 <1.0.0",
+    "@civitai/app-sdk": ">=0.57.0 <1.0.0",
     "react": "^18.0.0 || ^19.0.0"
   },
   "devDependencies": {
@@ -58,7 +58,7 @@
     "typescript": "^5.9.2",
     "vite": "^8.0.14",
     "vitest": "^4.1.11",
-    "@civitai/app-sdk": "^0.56.1"
+    "@civitai/app-sdk": "^0.58.0"
   },
   "publishConfig": {
     "access": "public"