@civitai/blocks-react 0.71.0 → 0.72.2

package/dist/internal/mockWorkflowGraph.js

@@ -289,29 +289,52 @@ function checkStepInput(stepType, input, depth, sources, state) {
     state.loopVars.add(forClause.as);
     return checkStepInput(template.$type, template.input, depth + 2, new Set([...sources, forClause.as]), state);
 }
-/** The host's refusal text for an unquoted training step (`UNQUOTED_TRAINING_ERROR`). */
-export const MOCK_UNQUOTED_TRAINING_ERROR = 'Training needs a price quote and none could be obtained; try again.';
 /**
- * The refusal for a body {@link mockWorkflowBodyRefusal} ACCEPTED when the host
- * could get NO price quote for it, or `null` when it would proceed (reserved at
- * the ceiling). In the host's order: a training step anywhere (its own
- * `training-quote-*` refusal — the mock reports `'training-quote-unavailable'`,
- * the code for "no usable answer"), then a `repeat` anywhere
- * (`workflow_repeat_unbounded`, naming the first such step).
+ * The host's `quoteFailureCause`: why there is no quote, as the clause that
+ * completes "…needs a price quote and ". Only `'unavailable'` says "try again".
+ * The mock has no orchestrator message to pass on, so `'rejected'` is the host's
+ * wording for a rejection with no reason safe to show.
  */
-export function mockUnpricedWorkflowRefusal(body) {
+const MOCK_QUOTE_FAILURE_CAUSE = {
+    rejected: 'the orchestrator rejected the request; check the step inputs and references ' +
+        '(retrying the same body will not help)',
+    unavailable: 'none could be obtained; try again',
+    unpriced: 'the orchestrator answered without one',
+};
+/** The host's refusal text for an unquoted training step (`unquotedTrainingRefusal`). */
+export const mockUnquotedTrainingError = (failure) => `Training needs a price quote and ${MOCK_QUOTE_FAILURE_CAUSE[failure]}.`;
+/**
+ * The refusal, on BOTH the estimate and the submit, for a body
+ * {@link mockWorkflowBodyRefusal} ACCEPTED when the host has no price quote for
+ * it, or `null` when the submit would proceed (reserved at the ceiling). In the
+ * host's order: a training step anywhere (`training-quote-<failure>`), then a
+ * `repeat` anywhere (`workflow_repeat_unbounded`, naming the first such step).
+ * The message states the cause.
+ */
+export function mockUnpricedWorkflowRefusal(body, failure) {
     const types = body.steps.map((step) => collectStepTypes(step.$type, step.input) ?? [step.$type]);
     if (types.some((ts) => ts.some((t) => t === 'training' || t === 'imageResourceTraining'))) {
-        return { error: MOCK_UNQUOTED_TRAINING_ERROR, errorCode: 'training-quote-unavailable' };
+        return { error: mockUnquotedTrainingError(failure), errorCode: `training-quote-${failure}` };
     }
     const index = types.findIndex((ts) => ts.some(isRepeat));
     if (index === -1)
         return null;
     return {
-        error: `workflow step ${index}: a workflow with a repeat needs a price quote and none could be obtained; try again`,
+        error: `workflow step ${index}: a workflow with a repeat needs a price quote and ${MOCK_QUOTE_FAILURE_CAUSE[failure]}`,
         errorCode: 'workflow_repeat_unbounded',
     };
 }
+/**
+ * The host's `unquotedWorkflowEstimateRefusal`: what an ESTIMATE of a workflow
+ * with no price quote fails with when {@link mockUnpricedWorkflowRefusal} did
+ * not already refuse it. Estimate only — the submit of the same body proceeds.
+ */
+export function mockUnquotedWorkflowEstimateRefusal(failure) {
+    return {
+        error: `No price quote for this workflow: ${MOCK_QUOTE_FAILURE_CAUSE[failure]}`,
+        errorCode: `workflow_quote_${failure}`,
+    };
+}
 /** The host's wire schema, mirrored: exact keys, types and sizes. No `errorCode`. */
 function isWellFormedBody(body) {
     if (!isPlainObject(body) || !Object.keys(body).every((key) => BODY_KEYS.has(key)))

package/dist/testing.d.ts

@@ -21,7 +21,7 @@ import { __resetTransport } from './transport/singleton.js';
 import { type MockHostOptions } from './internal/mockHost.js';
 export { __resetTransport as resetTransport };
 export { installPopoverShim, type PopoverShimHandle, type PopoverShimOptions, } from './internal/popoverShim.js';
-export { createMockHost, readMockHostUrlOptions, type MockHost, type MockHostOptions, type MockHostFailMode, type MockHostScenarioPatch, type MockGenerationScenario, type MockBuzzScenario, type MockBuzzBalance, type MockBuzzHandle, type MockStorageScenario, type MockSharedScenario, type MockSharedSeed, type MockCannedImageScan, type MockWorkflowStepInfo, type CostSpec, type ImageSpec, type CannedPick, } from './internal/mockHost.js';
+export { createMockHost, readMockHostUrlOptions, type MockHost, type MockHostOptions, type MockHostFailMode, type MockHostScenarioPatch, type MockGenerationScenario, type MockBuzzScenario, type MockBuzzBalance, type MockBuzzHandle, type MockStorageScenario, type MockSharedScenario, type MockSharedSeed, type MockCannedImageScan, type MockWorkflowStepInfo, type MockWorkflowQuoteFailure, type CostSpec, type ImageSpec, type CannedPick, } from './internal/mockHost.js';
 /**
  * Props for the dev {@link Harness}.
  */

package/dist/transport/iframeTransport.js

@@ -130,6 +130,19 @@ export class IframeTransport {
             this.resolveInit = resolve;
             this.rejectInit = reject;
         });
+        // 🔴 THE TRANSPORT HANDLES ITS OWN INIT TIMEOUT. Every hook connects the
+        // transport at mount, and most blocks never call `waitForInit()`, so without
+        // a handler here the 10s timeout is an UNHANDLED rejection. That fails the
+        // Vitest run of any block app whose tests mount a hook with no host. This
+        // handler makes the rejection handled and keeps the diagnostic (it names the
+        // configured and observed origins) on the console as a warning. It is a
+        // separate branch of the promise: `waitForInit()` still returns
+        // `initPromise` itself, so its callers still receive the rejection.
+        // Pinned by `test/initTimeoutUnhandled.test.tsx`.
+        this.initPromise.catch((err) => {
+            // eslint-disable-next-line no-console -- developer-facing diagnostic; the host shows its own fallback
+            console.warn(err instanceof Error ? err.message : err);
+        });
         this.initTimeoutId = setTimeout(() => {
             if (!this.initResolved) {
                 this.initResolved = true;

package/dist/transport/requestTimeouts.js

@@ -94,6 +94,12 @@ const REQUEST_TIMEOUT_CLASS = {
     // viewer who then clicked Train would start a CHARGED run the block had
     // already reported as failed.
     RUN_TRAINING: 'human',
+    // 🔴 `'human'`, same reason as RUN_TRAINING directly above: the host shows the
+    // viewer the job's price in its own confirm and replies only on their click or
+    // dismiss. At the 30s default the request would reject with the dialog still
+    // open, and a viewer who then confirmed would start a CHARGED job the block
+    // had already reported as failed.
+    RUN_CONFIRMED_STEP: 'human',
     // ── Fire-and-forget: no requestId, so no pending promise to time out ────
     BLOCK_ERROR: 'no-reply',
     BLOCK_HELLO: 'no-reply',

package/dist/transport/singleton.d.ts

@@ -1,5 +1,11 @@
 import { type DetectOptions } from './detector.js';
 import type { BlockTransport } from './transport.js';
+/**
+ * Returns true the FIRST time it is called in this transport lifecycle, false
+ * after. Internal — used by `useTransportConnection` to log a failed connect
+ * once instead of once per hook instance.
+ */
+export declare function claimConnectFailureReport(): boolean;
 /**
  * Returns the process-wide transport, instantiating it on first call.
  *

package/dist/transport/singleton.js

@@ -1,5 +1,24 @@
 import { BlockTransportDetector } from './detector.js';
 let cached = null;
+/**
+ * Whether a failed MOUNT-TIME connect (`useTransportConnection`) has already been
+ * logged. Lives here, not in the hook, so `__resetTransport()` clears it with the
+ * transport it describes: one log per transport lifecycle — once per page in
+ * production, once per reset in tests. A latch that outlived the reset would
+ * silence every misconfigured case in a test worker after the first.
+ */
+let connectFailureReported = false;
+/**
+ * Returns true the FIRST time it is called in this transport lifecycle, false
+ * after. Internal — used by `useTransportConnection` to log a failed connect
+ * once instead of once per hook instance.
+ */
+export function claimConnectFailureReport() {
+    if (connectFailureReported)
+        return false;
+    connectFailureReported = true;
+    return true;
+}
 /**
  * Returns the process-wide transport, instantiating it on first call.
  *
@@ -24,5 +43,6 @@ export function __resetTransport() {
     const disposable = cached;
     disposable?.dispose?.();
     cached = null;
+    connectFailureReported = false;
 }
 //# sourceMappingURL=singleton.js.map

package/dist/transport/validate.d.ts

@@ -445,6 +445,19 @@ export declare function isValidTrainingDatasetResult(p: unknown): boolean;
  * field. A dropped refusal would leave a Train button spinning for ten minutes.
  */
 export declare function isValidTrainingResult(p: unknown): boolean;
+/**
+ * Reply to `RUN_CONFIRMED_STEP`. A well-formed reply carries EITHER a `snapshot`
+ * (a valid {@link isValidWorkflowSnapshot} — the block polls its `workflowId`)
+ * OR an `error`; one with neither is malformed and dropped.
+ *
+ * 🔴 `error` IS SHAPE-CHECKED ONLY, for the reason given on
+ * {@link isValidTrainingResult}: this request carries the same TEN-MINUTE
+ * consent bound, and the host forwards server refusals (an expired or used
+ * quote, a changed body or price, the feature flag) in the same field as its own
+ * codes. A membership check would drop those and leave a Run button spinning for
+ * ten minutes.
+ */
+export declare function isValidConfirmedStepResult(p: unknown): boolean;
 /**
  * Reply to `APP_STORAGE_GET`. `value` is arbitrary JSON (incl. `null` for an
  * unset key / anon viewer), so there is nothing to type-check on it — the guard

package/dist/transport/validate.js

@@ -334,10 +334,56 @@ export function isValidWorkflowSnapshot(s) {
         return false;
     if (s.trainingQuote !== undefined && !isValidTrainingQuote(s.trainingQuote))
         return false;
+    if (s.stepQuote !== undefined && !isValidStepQuote(s.stepQuote))
+        return false;
+    if (s.model3dOutputs !== undefined && !isValidModel3dOutputs(s.model3dOutputs))
+        return false;
     if (s.steps !== undefined && !isValidWorkflowSteps(s.steps))
         return false;
     return true;
 }
+/**
+ * Shape check for `stepQuote` — the viewer-confirmable quote a pass-through
+ * `step` estimate returns when its fixed price is above the per-call budget. The
+ * block passes `quoteId` back verbatim, renders `total` on its confirm button
+ * and may show `stepType`, so all three are pinned to their types.
+ *
+ * `quoteId`'s `sq_…` FORMAT is deliberately not pinned HERE, for the reason
+ * given on {@link isValidTrainingQuote}: a host changing the handle's format
+ * must not turn every such estimate reply into a dropped one. The format is
+ * checked where it is an instruction rather than an observation — on the way
+ * OUT, in `useRunConfirmedStep()`.
+ */
+function isValidStepQuote(q) {
+    if (!isObject(q))
+        return false;
+    if (!isNonEmptyString(q.quoteId))
+        return false;
+    if (!isFiniteNumber(q.total))
+        return false;
+    if (typeof q.stepType !== 'string')
+        return false;
+    return typeof q.expiresAt === 'string';
+}
+/**
+ * Shape check for `model3dOutputs` — shared by {@link isValidWorkflowSnapshot}
+ * and the `AppWorkflow` row guard, which carry the same field. A block matches
+ * an entry's `url` against its image list and loads it, and branches on
+ * `format` / `variant`, so each is pinned to a string. `format` and `variant`
+ * are OPEN sets (the orchestrator's own format names and output field paths)
+ * and are never checked against a list; `variant` may be the empty string.
+ */
+function isValidModel3dOutputs(outputs) {
+    if (!Array.isArray(outputs))
+        return false;
+    for (const o of outputs) {
+        if (!isObject(o) || !isNonEmptyString(o.url))
+            return false;
+        if (typeof o.format !== 'string' || typeof o.variant !== 'string')
+            return false;
+    }
+    return true;
+}
 /**
  * Shape check for `steps` — the per-step view of a `kind: 'workflow'` run.
  * OPTIONAL like its neighbours, and a PRESENT but malformed value rejects the
@@ -1033,6 +1079,8 @@ function isValidAppWorkflow(w) {
         return false;
     if (w.trainedEpochs !== undefined && !isValidTrainedEpochs(w.trainedEpochs))
         return false;
+    if (w.model3dOutputs !== undefined && !isValidModel3dOutputs(w.model3dOutputs))
+        return false;
     return true;
 }
 /**
@@ -1435,6 +1483,31 @@ export function isValidTrainingResult(p) {
         return false;
     return true;
 }
+/**
+ * Reply to `RUN_CONFIRMED_STEP`. A well-formed reply carries EITHER a `snapshot`
+ * (a valid {@link isValidWorkflowSnapshot} — the block polls its `workflowId`)
+ * OR an `error`; one with neither is malformed and dropped.
+ *
+ * 🔴 `error` IS SHAPE-CHECKED ONLY, for the reason given on
+ * {@link isValidTrainingResult}: this request carries the same TEN-MINUTE
+ * consent bound, and the host forwards server refusals (an expired or used
+ * quote, a changed body or price, the feature flag) in the same field as its own
+ * codes. A membership check would drop those and leave a Run button spinning for
+ * ten minutes.
+ */
+export function isValidConfirmedStepResult(p) {
+    if (!isObject(p))
+        return false;
+    if (!isWireRequestIdShape(p.requestId))
+        return false;
+    if (p.error !== undefined && typeof p.error !== 'string')
+        return false;
+    if (p.snapshot !== undefined && !isValidWorkflowSnapshot(p.snapshot))
+        return false;
+    if (p.snapshot === undefined && p.error === undefined)
+        return false;
+    return true;
+}
 // ============================================================
 // App-storage (per-viewer KV) reply validators
 // ============================================================
@@ -2044,6 +2117,9 @@ export function payloadValidatorFor(type) {
             return isValidTrainingDatasetResult;
         case 'TRAINING_RESULT':
             return isValidTrainingResult;
+        // Settles a charged job, like TRAINING_RESULT directly above.
+        case 'CONFIRMED_STEP_RESULT':
+            return isValidConfirmedStepResult;
         case 'IMAGE_UPLOAD_RESULT':
             return isValidImageUploadResult;
         case 'IMAGE_SCAN_RESOLVED':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/blocks-react",
-  "version": "0.71.0",
+  "version": "0.72.2",
   "description": "React hooks and iframe transport for Civitai Apps. Pairs with @civitai/app-sdk/blocks.",
   "license": "MIT",
   "type": "module",
@@ -37,8 +37,8 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@civitai/theme": "^0.5.2",
-    "@civitai/components": "^0.9.3"
+    "@civitai/components": "^0.9.3",
+    "@civitai/theme": "^0.5.2"
   },
   "comment-peerDependencies": "This floor is DERIVED, not chosen — the lowest published app-sdk that exports every symbol this package imports. Do not edit it without reading ./PEER_FLOOR.md (in-repo, unpublished) and tests/guards/blocks-react-peer-floor.test.mjs.",
   "peerDependencies": {
@@ -58,7 +58,7 @@
     "typescript": "^5.9.2",
     "vite": "^8.0.14",
     "vitest": "^4.1.11",
-    "@civitai/app-sdk": "^0.66.0"
+    "@civitai/app-sdk": "^0.68.0"
   },
   "publishConfig": {
     "access": "public"