@civitai/app-sdk 0.46.0 → 0.48.0

package/dist/oauth/token.d.ts

@@ -5,12 +5,33 @@ interface CommonOpts {
     /** Only required for confidential clients. Public clients omit this. */
     clientSecret?: string;
 }
-export interface ExchangeCodeOpts extends CommonOpts {
+/** Mixed into the grants that return tokens (not into revoke). */
+interface ScopeFallbackOpts {
+    /**
+     * Bitmask to use when the token response's `scope` is absent or unusable.
+     * RFC 6749 §5.1/§6 let the server omit `scope` when the grant is identical
+     * to what was requested, so pass the scope you asked for
+     * (`REQUESTED_SCOPES` on exchange, the previously granted `tokens.scope` on
+     * refresh). Without it, an absent or unusable `scope` resolves to `0`, i.e.
+     * "no permissions".
+     *
+     * Must itself be a whole number in `[0, 2**31-1]`. `NaN` (the result of
+     * `Number(undefined)` — easy to pass by accident from a half-populated
+     * store), a negative, a fraction and anything past the ceiling are
+     * **discarded in favour of `0`**, with a warning: an unchecked fallback is
+     * the same silent-`NaN` defect this guard exists to close.
+     *
+     * On a *present but unreadable* `scope` this value can **over-state** the
+     * grant — see {@link parseScope}. The over-statement is logged.
+     */
+    fallbackScope?: number;
+}
+export interface ExchangeCodeOpts extends CommonOpts, ScopeFallbackOpts {
     code: string;
     redirectUri: string;
     codeVerifier: string;
 }
-export interface RefreshTokenOpts extends CommonOpts {
+export interface RefreshTokenOpts extends CommonOpts, ScopeFallbackOpts {
     refreshToken: string;
 }
 export interface RevokeTokenOpts extends CommonOpts {
@@ -26,7 +47,9 @@ export declare class OAuthError extends Error {
  * Exchange an authorization code for tokens (PKCE flow). Call this in your
  * `redirect_uri` callback handler with the `code` from the query string and the
  * `codeVerifier` you stashed when starting the flow. Omit `clientSecret` for
- * public clients. Throws {@link OAuthError} on a non-2xx token response.
+ * public clients. Throws {@link OAuthError} on a non-2xx token response. Pass
+ * `fallbackScope` so a `scope` the server omits — or one this SDK cannot read
+ * as a bitmask — resolves to what you requested rather than to `0`.
  *
  * @example
  * const tokens = await exchangeCode({
@@ -35,6 +58,7 @@ export declare class OAuthError extends Error {
  *   redirectUri: 'https://your-app.com/api/auth/callback/civitai',
  *   code: codeFromQuery,
  *   codeVerifier: verifierFromSealedCookie,
+ *   fallbackScope: REQUESTED_SCOPES,
  * });
  */
 export declare function exchangeCode(opts: ExchangeCodeOpts): Promise<OAuthTokens>;
@@ -43,11 +67,18 @@ export declare function exchangeCode(opts: ExchangeCodeOpts): Promise<OAuthToken
  * {@link OAuthTokens} (with a recomputed `expires_at`). Throws
  * {@link OAuthError} on failure — treat that as "re-authenticate."
  *
+ * Pass `fallbackScope: stored.scope`: RFC 6749 §6 lets the server omit `scope`
+ * when the refreshed grant is unchanged, and callers that replace the whole
+ * token blob (`{ ...session, tokens: fresh }`) would otherwise persist a `0`
+ * scope and lock the user out of their own features. The same value is used if
+ * the server sends a `scope` this SDK cannot read as a bitmask.
+ *
  * @example
  * const tokens = await refreshToken({
  *   clientId: process.env.CIVITAI_CLIENT_ID!,
  *   clientSecret: process.env.CIVITAI_CLIENT_SECRET, // omit for public clients
  *   refreshToken: stored.refresh_token,
+ *   fallbackScope: stored.scope,
  * });
  */
 export declare function refreshToken(opts: RefreshTokenOpts): Promise<OAuthTokens>;

package/dist/oauth/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,WAAW,EAAE,MAAM,aAAa,CAAC;AAOnE,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,UAAW,SAAQ,KAAK;IAIjC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO;IAJxB,SAAkB,IAAI,gBAAgB;gBAEpC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO;CAIzB;AA0CD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAW/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAS/E;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtE;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/F;AAED,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7E,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,+CAA+C;IAC/C,WAAW,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAqBzF"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,WAAW,EAAE,MAAM,aAAa,CAAC;AAOnE,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,kEAAkE;AAClE,UAAU,iBAAiB;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,iBAAiB;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,iBAAiB;IACrE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,UAAW,SAAQ,KAAK;IAIjC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO;IAJxB,SAAkB,IAAI,gBAAgB;gBAEpC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO;CAIzB;AAsJD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAW/E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAS/E;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtE;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/F;AAED,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7E,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,+CAA+C;IAC/C,WAAW,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAqBzF"}

package/dist/oauth/token.js

@@ -36,12 +36,114 @@ async function postForm(url, body) {
     }
     return parsed;
 }
+/**
+ * Largest value accepted as a scope bitmask. Scopes are combined and tested
+ * with `&`/`|`, which are 32-bit *signed* operations in JS — anything at or
+ * above 2**31 wraps negative and silently corrupts every later `hasScope`
+ * check. `TokenScope.Full` is 2**25-1, so this leaves six bits of headroom.
+ */
+const MAX_SCOPE_BITMASK = 2 ** 31 - 1;
+/**
+ * The one predicate for "is this a bitmask we can safely `&`/`|`". Both the
+ * wire value and the caller-supplied `fallback` go through it — a fallback
+ * checked by a *different* rule (or by none) is how #326 comes back through
+ * the very option that was added to prevent it.
+ */
+function isUsableBitmask(value) {
+    return Number.isSafeInteger(value) && value >= 0 && value <= MAX_SCOPE_BITMASK;
+}
+/**
+ * Resolve the caller's `fallback` into a bitmask that is safe to return.
+ *
+ * `fallback` is typed `number`, which admits `NaN`, `Infinity`, negatives and
+ * values past the ceiling — and `?? ` does **not** catch any of them. A caller
+ * writing `fallbackScope: Number(stored.scope)` against an absent
+ * `stored.scope` passes `NaN`, so an unvalidated fallback puts `NaN` straight
+ * into `tokens.scope` and every `hasScope()` answers `false`: #326 verbatim.
+ *
+ * An unusable fallback is therefore **discarded in favour of `0`**, with its
+ * own warning. `0` is the same "no permissions" answer a caller who passed no
+ * fallback at all gets; it is wrong in the safe direction (features stay
+ * disabled) where `NaN` is wrong in a direction nothing downstream can detect,
+ * and an over-ceiling value is wrong in the *unsafe* direction once `|` wraps
+ * it negative. The warning fires on the absent-scope path too, which is
+ * otherwise silent — the caller's own argument is a caller bug, not a server
+ * quirk, so it is worth saying out loud.
+ */
+function usableFallback(fallback) {
+    if (fallback === undefined)
+        return 0;
+    if (!isUsableBitmask(fallback)) {
+        console.warn(`[@civitai/app-sdk] \`fallbackScope\` is not a usable bitmask: ${String(fallback)}. ` +
+            `Expected a whole number in [0, ${MAX_SCOPE_BITMASK}] (e.g. 114689). ` +
+            `Discarding it and using 0 ("no permissions") instead.`);
+        return 0;
+    }
+    return fallback;
+}
+/**
+ * Coerce a token response's `scope` into a usable bitmask.
+ *
+ * Civitai sends a decimal bitmask as a JSON string (`"scope": "114689"` — see
+ * https://developer.civitai.com/site/oauth/endpoints), so `Number()` is the
+ * right coercion; what was missing is a guard on its RESULT. RFC 6749 §5.1
+ * defines `scope` as a space-delimited *list*, and
+ * `Number('ai:write:budgeted user:read:self')` is `NaN`. `NaN & anything` is
+ * `0`, so every `hasScope()` answered `false` and a user who had just consented
+ * was told they granted nothing, with no error anywhere (#326). Anything that
+ * is not a whole number in `[0, 2**31-1]` is therefore rejected — including the
+ * `fallback`, see {@link usableFallback}.
+ *
+ * The `typeof` check before `Number()` is load-bearing on its own: `Number()`
+ * coerces a one-element array and a boolean into *valid-looking* bitmasks
+ * (`Number(['65537'])` is `65537`, `Number(true)` is `1`, i.e.
+ * `TokenScope.UserRead`), so without it a wrong-typed `scope` becomes a real,
+ * wrong grant rather than a rejected one.
+ *
+ * **Rejected means fall back and warn, not throw.** #326 left that open
+ * ("ignored *or* an error — say which"). A throw here turns a
+ * degraded-but-working session into a hard login failure, and the callers that
+ * could act on the distinction are exactly the ones already passing `fallback`
+ * — a better answer than either `0` or an abort. The warning names the value
+ * received so an unexpected wire format stays diagnosable.
+ *
+ * The two rejected-into-`fallback` paths are **not** equally sound, and the
+ * difference is invisible at this seam:
+ *
+ * - An **absent** `scope` (`undefined`, `null`, or whitespace-only) is not a
+ *   fault at all — RFC 6749 §5.1/§6 make it optional precisely when the grant
+ *   *matches the request*, so the requested scope IS the granted scope and
+ *   `fallback` is exactly right. This path is silent.
+ * - A **present but unreadable** `scope` carries no such guarantee. The server
+ *   is saying something about the grant that this SDK cannot read, and it may
+ *   be a *reduced* grant. Falling back to the requested scope can therefore
+ *   **over-state** what the user granted — every starter renders
+ *   `scopesFromBitmask(tokens.scope)` to the user as "Granted scopes". #326
+ *   weighed that against `0` and against throwing and chose fallback ("more
+ *   honest than 0"), which is why this path warns: the over-statement is a
+ *   known, logged trade, not an invariant.
+ */
+function parseScope(raw, fallback) {
+    if (raw === undefined || raw === null)
+        return usableFallback(fallback);
+    if (typeof raw === 'string' && raw.trim() === '')
+        return usableFallback(fallback);
+    const value = typeof raw === 'number' || typeof raw === 'string' ? Number(raw) : NaN;
+    if (!isUsableBitmask(value)) {
+        const resolved = usableFallback(fallback);
+        console.warn(`[@civitai/app-sdk] OAuth token response has an unusable \`scope\`: ${JSON.stringify(raw)}. ` +
+            `Expected a decimal bitmask in [0, ${MAX_SCOPE_BITMASK}] (e.g. "114689"). ` +
+            `Falling back to ${resolved}.`);
+        return resolved;
+    }
+    return value;
+}
 function shapeTokens(json, fallbackScope) {
     return {
         access_token: json.access_token,
         refresh_token: json.refresh_token,
         expires_at: Date.now() + (json.expires_in ?? 3600) * 1000,
-        scope: typeof json.scope === 'number' ? json.scope : Number(json.scope ?? fallbackScope ?? 0),
+        scope: parseScope(json.scope, fallbackScope),
         token_type: json.token_type ?? 'Bearer',
     };
 }
@@ -49,7 +151,9 @@ function shapeTokens(json, fallbackScope) {
  * Exchange an authorization code for tokens (PKCE flow). Call this in your
  * `redirect_uri` callback handler with the `code` from the query string and the
  * `codeVerifier` you stashed when starting the flow. Omit `clientSecret` for
- * public clients. Throws {@link OAuthError} on a non-2xx token response.
+ * public clients. Throws {@link OAuthError} on a non-2xx token response. Pass
+ * `fallbackScope` so a `scope` the server omits — or one this SDK cannot read
+ * as a bitmask — resolves to what you requested rather than to `0`.
  *
  * @example
  * const tokens = await exchangeCode({
@@ -58,6 +162,7 @@ function shapeTokens(json, fallbackScope) {
  *   redirectUri: 'https://your-app.com/api/auth/callback/civitai',
  *   code: codeFromQuery,
  *   codeVerifier: verifierFromSealedCookie,
+ *   fallbackScope: REQUESTED_SCOPES,
  * });
  */
 export async function exchangeCode(opts) {
@@ -70,18 +175,25 @@ export async function exchangeCode(opts) {
         client_secret: opts.clientSecret,
         code_verifier: opts.codeVerifier,
     }));
-    return shapeTokens(json);
+    return shapeTokens(json, opts.fallbackScope);
 }
 /**
  * Refresh an access token using a refresh_token grant. Returns a fresh
  * {@link OAuthTokens} (with a recomputed `expires_at`). Throws
  * {@link OAuthError} on failure — treat that as "re-authenticate."
  *
+ * Pass `fallbackScope: stored.scope`: RFC 6749 §6 lets the server omit `scope`
+ * when the refreshed grant is unchanged, and callers that replace the whole
+ * token blob (`{ ...session, tokens: fresh }`) would otherwise persist a `0`
+ * scope and lock the user out of their own features. The same value is used if
+ * the server sends a `scope` this SDK cannot read as a bitmask.
+ *
  * @example
  * const tokens = await refreshToken({
  *   clientId: process.env.CIVITAI_CLIENT_ID!,
  *   clientSecret: process.env.CIVITAI_CLIENT_SECRET, // omit for public clients
  *   refreshToken: stored.refresh_token,
+ *   fallbackScope: stored.scope,
  * });
  */
 export async function refreshToken(opts) {
@@ -92,7 +204,7 @@ export async function refreshToken(opts) {
         client_id: opts.clientId,
         client_secret: opts.clientSecret,
     }));
-    return shapeTokens(json);
+    return shapeTokens(json, opts.fallbackScope);
 }
 /**
  * Revoke an access or refresh token (e.g. on logout). Omit `clientSecret` for

package/dist/oauth/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAEA,kEAAkE;AAClE,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AACzD,6DAA6D;AAC7D,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAuBnD,MAAM,OAAO,UAAW,SAAQ,KAAK;IAIxB;IACA;IAJO,IAAI,GAAG,YAAY,CAAC;IACtC,YACE,OAAe,EACN,MAAc,EACd,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;IAGxB,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,IAAwC;IAExC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EACvD,GAAG,CAAC,MAAM,EACV,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB,EAAE,aAAsB;IACnE,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;QACzD,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,IAAI,CAAC,CAAC;QAC7F,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC3D,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAuB,CAAC;IAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC3D,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAuB,CAAC;IAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACnD,MAAM,QAAQ,CAAC,GAAG,IAAI,wBAAwB,EAAE;QAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAA+C;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,+BAA+B,EAAE;QAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,+BAA+B,GAAG,CAAC,MAAM,EAAE,EAC3C,GAAG,CAAC,MAAM,EACV,MAAM,GAAG,CAAC,IAAI,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,iEAAiE;IACjE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAEA,kEAAkE;AAClE,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AACzD,6DAA6D;AAC7D,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AA6CnD,MAAM,OAAO,UAAW,SAAQ,KAAK;IAIxB;IACA;IAJO,IAAI,GAAG,YAAY,CAAC;IACtC,YACE,OAAe,EACN,MAAc,EACd,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;IAGxB,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,IAAwC;IAExC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EACvD,GAAG,CAAC,MAAM,EACV,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,iBAAiB,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,cAAc,CAAC,QAA4B;IAClD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CACV,iEAAiE,MAAM,CAAC,QAAQ,CAAC,IAAI;YACnF,kCAAkC,iBAAiB,mBAAmB;YACtE,uDAAuD,CAC1D,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAS,UAAU,CAAC,GAAY,EAAE,QAAiB;IACjD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IAElF,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrF,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CACV,sEAAsE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI;YAC3F,qCAAqC,iBAAiB,qBAAqB;YAC3E,mBAAmB,QAAQ,GAAG,CACjC,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB,EAAE,aAAsB;IACnE,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;QACzD,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC;QAC5C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC3D,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAuB,CAAC;IAC1B,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC3D,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAuB,CAAC;IAC1B,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACnD,MAAM,QAAQ,CAAC,GAAG,IAAI,wBAAwB,EAAE;QAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAA+C;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,+BAA+B,EAAE;QAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,+BAA+B,GAAG,CAAC,MAAM,EAAE,EAC3C,GAAG,CAAC,MAAM,EACV,MAAM,GAAG,CAAC,IAAI,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,iEAAiE;IACjE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/vite/index.d.ts

@@ -0,0 +1,14 @@
+import type { Plugin } from 'vite';
+export interface BlockManifestPluginOptions {
+    /**
+     * Path to the manifest. Relative paths resolve against `root`, which defaults
+     * to the Vite project root reported by `configResolved`. Defaults to
+     * `./block.manifest.json`.
+     */
+    manifestPath?: string;
+    /** Overrides the Vite project root used to resolve a relative `manifestPath`. */
+    root?: string;
+}
+export declare function blockManifestPlugin(options?: BlockManifestPluginOptions): Plugin;
+export { BlockManifestError } from '../blocks/manifestError.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAKnC,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,MAAM,CA+BpF;AAGD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/vite/index.js

@@ -0,0 +1,61 @@
+/**
+ * `@civitai/app-sdk/vite` — NODE-ONLY Vite plugin that validates
+ * `block.manifest.json` on every dev-server boot and every build.
+ *
+ * WHY THIS EXISTS. `defineBlock` shipped for months with zero callers outside
+ * markdown (#330), so the manifests this repo ships were never validated by
+ * anything and the validator was free to drift into rejecting all of them. A
+ * gate that only runs where someone remembers to run it is the defect, not the
+ * fix. This is the cheapest place that runs unavoidably: `pnpm dev`,
+ * `pnpm dev:harness` and `pnpm build` all pass through `configResolved`.
+ *
+ * `configResolved` rather than `buildStart` on purpose — it is the one hook
+ * Vite calls in BOTH the dev-server and build paths, so there is no mode in
+ * which the check silently does not run. It is kept SYNCHRONOUS so the throw
+ * cannot depend on whether Vite awaits the hook.
+ *
+ * This is NOT a substitute for `civitai app validate` (the Go CLI's own local
+ * pre-check against the same canonical). It exists so a manifest mistake
+ * surfaces in the dev loop rather than at submit time.
+ *
+ * PEERS: `ajv` (used at runtime by `@civitai/app-sdk/manifest`) and `vite`
+ * (types only). Both are optional peers of `@civitai/app-sdk`; a scaffold using
+ * this plugin needs both in its devDependencies.
+ */
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { BlockManifestError, defineBlock } from '../manifest/index.js';
+export function blockManifestPlugin(options = {}) {
+    return {
+        name: 'civitai-block-manifest',
+        // `enforce: 'pre'` so the manifest error is the FIRST thing reported rather
+        // than being buried under whatever else a slow plugin logs.
+        enforce: 'pre',
+        configResolved(config) {
+            // Resolve against the Vite root (or an explicit override) rather than
+            // this module's own location — this file now lives inside the installed
+            // package, not next to the consumer's manifest.
+            const root = options.root ?? config?.root ?? process.cwd();
+            const manifestPath = resolve(root, options.manifestPath ?? './block.manifest.json');
+            let manifest;
+            try {
+                manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+            }
+            catch (err) {
+                throw new Error(`block.manifest.json could not be read or parsed (${manifestPath}): ${err.message}`);
+            }
+            try {
+                defineBlock({ manifest });
+            }
+            catch (err) {
+                // Re-thrown with the field path up front: Vite prints the message, not
+                // the error's own properties, so `.field` would otherwise be invisible.
+                const field = err instanceof BlockManifestError && err.field ? ` [${err.field}]` : '';
+                throw new Error(`block.manifest.json is invalid${field}: ${err.message}`);
+            }
+        },
+    };
+}
+// Re-exported so a consumer can catch the typed error without a second import.
+export { BlockManifestError } from '../blocks/manifestError.js';
+//# sourceMappingURL=index.js.map

package/dist/vite/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAcvE,MAAM,UAAU,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,4EAA4E;QAC5E,4DAA4D;QAC5D,OAAO,EAAE,KAAK;QACd,cAAc,CAAC,MAAM;YACnB,sEAAsE;YACtE,wEAAwE;YACxE,gDAAgD;YAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAC;YAEpF,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAkB,CAAC;YAC7E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,YAAY,MAAO,GAAa,CAAC,OAAO,EAAE,CAC/F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,KAAK,GAAG,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",
@@ -43,6 +43,14 @@
       "types": "./dist/safe-storage/index.d.ts",
       "import": "./dist/safe-storage/index.js"
     },
+    "./manifest": {
+      "types": "./dist/manifest/index.d.ts",
+      "import": "./dist/manifest/index.js"
+    },
+    "./vite": {
+      "types": "./dist/vite/index.d.ts",
+      "import": "./dist/vite/index.js"
+    },
     "./schemas/app-block/v1.json": "./schemas/app-block/v1.json"
   },
   "files": [
@@ -74,18 +82,49 @@
     "`semver.satisfies('0.1.1-beta.0', '^0.2.0-beta.98')` === false.",
     "Install with the tag: `pnpm add -D @civitai/client@beta`."
   ],
+  "comment-peerDependencies-ajv-vite": [
+    "ajv and vite are OPTIONAL peers of the NODE-ONLY subpaths added when #330",
+    "was closed: `./manifest` (defineBlock) and `./vite` (blockManifestPlugin).",
+    "",
+    "`dependencies` stays EMPTY for the same reason it always has: this package",
+    "ships into sandboxed browser iframes and every app inherits its install",
+    "graph. A build-time JSON-Schema engine has no business in that graph, so",
+    "ajv is a peer a scaffold opts into: `pnpm add -D ajv`.",
+    "",
+    "ajv: a VALUE import (`ajv/dist/2020.js`, the draft 2020-12 entry — the",
+    "canonical schema declares $schema draft/2020-12, so the default `ajv`",
+    "entry point would refuse to compile it). FLOOR ^8.17.1: `ajv/dist/2020`",
+    "has existed since 8.6.0, but 8.17.x is what this repo builds and tests",
+    "against, and 8.x is a single major so the caret admits every later 8.",
+    "",
+    "vite: TYPES ONLY (`import type { Plugin }`). Nothing is value-imported, so",
+    "there is no module-evaluation failure mode -- only a typecheck one. The",
+    "range spans 5-8 because `Plugin.configResolved(config)` (the one member",
+    "`./vite` reads) has been stable across all of them; this repo builds and",
+    "tests against vite 8, which is what every scaffold pins."
+  ],
   "peerDependencies": {
-    "@civitai/client": "^0.2.0-beta.98"
+    "@civitai/client": "^0.2.0-beta.98",
+    "ajv": "^8.17.1",
+    "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
   },
   "peerDependenciesMeta": {
     "@civitai/client": {
       "optional": true
+    },
+    "ajv": {
+      "optional": true
+    },
+    "vite": {
+      "optional": true
     }
   },
   "devDependencies": {
     "@civitai/client": "0.2.0-beta.98",
     "@types/node": "^25.9.1",
+    "ajv": "^8.17.1",
     "typescript": "^5.9.2",
+    "vite": "^8.0.14",
     "vitest": "^4.1.11"
   },
   "publishConfig": {
@@ -113,6 +152,7 @@
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test:types": "tsc -p tsconfig.typecheck.json",
+    "test:exports": "node scripts/check-exports.mjs",
     "test": "vitest run && tsc -p tsconfig.typecheck.json",
     "test:watch": "vitest"
   }

package/dist/blocks/defineBlock.d.ts

@@ -1,53 +0,0 @@
-/**
- * Build-time / startup validation for a `BlockManifestV1`.
- *
- * This is a subset of what the civitai/civitai server enforces — the client
- * runs it so authoring mistakes surface in `pnpm dev` rather than at
- * `civitai deploy` time. Rules here MUST stay a strict subset of the
- * server's; if the server tightens, mirror the change here.
- *
- * Every check guards `typeof` before pattern-testing — the highest-value
- * caller is `JSON.parse(fs.readFileSync('block.manifest.json'))`, where
- * the TypeScript type is a lie.
- */
-import type { BlockManifest } from './types.js';
-/** Thrown by `defineBlock` for any manifest violation. */
-export declare class BlockManifestError extends Error {
-    /** Dot-path to the offending field, e.g. `iframe.sandbox`. */
-    readonly field?: string | undefined;
-    readonly name = "BlockManifestError";
-    constructor(message: string, 
-    /** Dot-path to the offending field, e.g. `iframe.sandbox`. */
-    field?: string | undefined);
-}
-export interface DefineBlockConfig {
-    manifest: BlockManifest;
-}
-/**
- * Validates the manifest and returns it unchanged. Acts as a typed identity
- * function — call it at module scope in the block app so violations throw
- * before the app mounts. Mirrors a strict subset of the civitai/civitai server
- * gate, so authoring mistakes surface in `pnpm dev` instead of at submit time.
- * Throws {@link BlockManifestError} (with a `.field` dot-path) on a bad manifest.
- *
- * @example
- * import { defineBlock } from '@civitai/app-sdk/blocks';
- *
- * export const manifest = defineBlock({
- *   manifest: {
- *     $schema: 'https://civitai.com/schemas/app-block/v1.json',
- *     appId: 'my-app',
- *     blockId: 'my-block',
- *     version: '1.0.0',
- *     name: 'My Block',
- *     type: 'block',
- *     targets: [{ slotId: 'model.sidebar_top', priority: 100 }],
- *     scopes: ['ai:write:budgeted'],
- *     iframe: { src: 'https://my-block.civit.ai/', minHeight: 200 },
- *     contentRating: 'pg',
- *     minApiVersion: '1.0',
- *   },
- * });
- */
-export declare function defineBlock(config: DefineBlockConfig): BlockManifest;
-//# sourceMappingURL=defineBlock.d.ts.map

package/dist/blocks/defineBlock.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defineBlock.d.ts","sourceRoot":"","sources":["../../src/blocks/defineBlock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EAAE,aAAa,EAAiB,MAAM,YAAY,CAAC;AA8D/D,0DAA0D;AAC1D,qBAAa,kBAAmB,SAAQ,KAAK;IAIzC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;IAJzB,SAAkB,IAAI,wBAAwB;gBAE5C,OAAO,EAAE,MAAM;IACf,8DAA8D;IACrD,KAAK,CAAC,EAAE,MAAM,YAAA;CAI1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,aAAa,CAAC;CAIzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa,CA6HpE"}