@civitai/app-sdk 0.47.0 → 0.48.0

package/README.md

@@ -19,12 +19,19 @@ pnpm add @civitai/app-sdk
 | `cookies/*` — `sealCookie`, `unsealCookie`, `buildSetCookieHeader`, `readCookie` | AES-256-GCM authenticated cookie crypto. Use to seal a session blob (refresh token, expiry, scope) into an `httpOnly` cookie with zero external session store. |
 | `orchestrator/*` — `createOrchestratorClient`, `estimateWorkflow`, `submitWorkflow`, `getWorkflow`, `pollWorkflow`, `buildTextToImageBody`, `buildImageGenBody`, `buildWorkflowBody`, `WORKFLOW_STEP_TYPES`, `IMAGE_GEN_ENGINES`, `isTerminal`, `extractImageUrls`, `OrchestratorError`, `WorkflowSnapshot`, `GenerateInput`, `ImageGenInput`, `WorkflowStepType`, `ImageGenEngine`, `DEFAULT_MODEL_AIR` | Orchestrator workflow glue — types, body builders, raw HTTP, and long-poll helper. Client + server safe (fetch-only). `estimateWorkflow` calls `?whatif=true` to preview Buzz cost without spending. `pollWorkflow` long-polls to terminal status. `WORKFLOW_STEP_TYPES` is the catalog of every step `$type` the orchestrator accepts. |
 | `orchestrator/steps` — `WorkflowStepTemplates`, `WorkflowStepTemplateFor`, `WorkflowStepInputFor`, `AnyWorkflowStepTemplate`, `TypedWorkflowTemplate` | **Type-only** subpath (0 runtime bytes) keying the orchestrator's generated workflow-step shapes from `@civitai/client` by wire `$type`, so apps compose real step bodies against types that track the spec instead of hand-maintained copies. Requires the optional peer `@civitai/client@beta`. Type surface only — it grants no submit permission; see "Typed step shapes" below. |
-| `blocks/*` — `defineBlock`, `BlockManifestError`, `BLOCK_SCOPES`, `BLOCK_SCOPE_PATTERN`, `isMessage`, types (`BlockManifestV1`, `BlockContext`, `BlockToken`, `BlockSettings`, `ViewerInfo`, `ThemeInfo`, `BlockWorkflowSnapshot`, `BlockInitPayload`, `ParentToBlockMessage`, `BlockToParentMessage`, …) | Framework-agnostic contract for [Civitai Apps](https://github.com/civitai/civitai-app-starters/blob/main/docs/build-your-first-app-block.md). `defineBlock(config)` validates a `BlockManifestV1` at startup so authoring mistakes surface in `pnpm dev` instead of at `civitai app validate`/submit. Ships a byte-identical copy of the server-published canonical JSON Schema (draft 2020-12, https://civitai.com/schemas/app-block/v1.json) at the `./schemas/app-block/v1.json` subpath for offline validation; a CI drift-check keeps it in sync. Runtime-agnostic — no React or DOM types. Hooks and the iframe transport live in a separate package. |
+| `blocks/*` — `BlockManifestError`, `BLOCK_SCOPES`, `BLOCK_SCOPE_PATTERN`, `isMessage`, types (`BlockManifestV1`, `BlockContext`, `BlockToken`, `BlockSettings`, `ViewerInfo`, `ThemeInfo`, `BlockWorkflowSnapshot`, `BlockInitPayload`, `ParentToBlockMessage`, `BlockToParentMessage`, …) | Framework-agnostic contract for [Civitai Apps](https://github.com/civitai/civitai-app-starters/blob/main/docs/build-your-first-app-block.md). Ships a byte-identical copy of the server-published canonical JSON Schema (draft 2020-12, https://civitai.com/schemas/app-block/v1.json) at the `./schemas/app-block/v1.json` subpath for offline validation; a CI drift-check keeps it in sync. Runtime-agnostic and **zero runtime dependencies** — no React, no DOM types, nothing in your install graph. Hooks and the iframe transport live in a separate package. |
+| `manifest/*` — `defineBlock`, `SCHEMA_DIVERGENCES`, `KNOWN_GAPS` (**Node only**) | Build-time manifest validation. `defineBlock(config)` compiles the vendored canonical schema with [Ajv](https://ajv.js.org) and validates a `BlockManifestV1` against it, so authoring mistakes surface in `pnpm dev` instead of at `civitai app validate`/submit. It is **derived from the schema, not a hand-written mirror of it** — that mirror is what produced [#330](https://github.com/civitai/civitai-app-starters/issues/330). Needs `node:fs` and the optional peer `ajv`, which is why it is not on the browser-facing `./blocks` surface. |
+| `vite/*` — `blockManifestPlugin` (**Node only**) | A Vite plugin wrapping `defineBlock`, firing from `configResolved` — the one hook Vite calls on both the dev-server and the build path. Every block scaffold registers it, so `pnpm dev`, `pnpm dev:harness` and `pnpm build` all fail on a bad manifest with the offending field path. Optional peers: `ajv` (runtime) and `vite` (types only). |
 
 ## Subpath imports
 
 ```ts
-import { defineBlock, BLOCK_SCOPES } from '@civitai/app-sdk/blocks';
+import { BLOCK_SCOPES, isSignedIn } from '@civitai/app-sdk/blocks';
+// Build-time manifest validation (NODE ONLY — needs the optional peer `ajv`).
+// Most projects want the Vite plugin below rather than calling this directly:
+import { defineBlock } from '@civitai/app-sdk/manifest';
+// The same gate as a Vite plugin (NODE ONLY — optional peers `ajv` + `vite`):
+import { blockManifestPlugin } from '@civitai/app-sdk/vite';
 // Type-only: the orchestrator's generated per-step shapes. Needs the optional
 // peer `@civitai/client@beta` — see "Typed step shapes" below:
 import type { TypedWorkflowTemplate } from '@civitai/app-sdk/orchestrator/steps';
@@ -37,9 +44,11 @@ import manifestSchema from '@civitai/app-sdk/schemas/app-block/v1.json' with { t
 ## Civitai Apps contract (`@civitai/app-sdk/blocks`)
 
 > Building a **Civitai App** (an iframe-embedded UI on a civitai.com page)? This
-> subpath is the framework-agnostic contract — manifest types, scope strings,
-> the `postMessage` protocol, and the `defineBlock` validator. The React hooks +
-> transport that consume it live in
+> subpath is the framework-agnostic contract — manifest types, scope strings and
+> the `postMessage` protocol. (The `defineBlock` validator moved to the node-only
+> [`@civitai/app-sdk/manifest`](#defineblock-validator-rules) subpath; `./blocks`
+> keeps zero runtime dependencies.) The React hooks + transport that consume it
+> live in
 > [`@civitai/blocks-react`](https://www.npmjs.com/package/@civitai/blocks-react).
 > Start from the runnable [examples](https://github.com/civitai/civitai-app-starters/tree/main/starters/examples).
 >
@@ -103,8 +112,7 @@ interface BlockInitPayload {
 
 | Export | What |
 |---|---|
-| `defineBlock({ manifest })` | Validates a `BlockManifestV1` (subset of the server checks) and returns it. Call at module scope so authoring mistakes throw before mount. Throws `BlockManifestError` (has a `.field` dot-path). |
-| `BLOCK_SCOPES` / `BLOCK_SCOPE_PATTERN` | The 15 known block scope strings (the authoritative enum `defineBlock` validates against) + the `domain:verb:target` format-helper regex. A scope is valid only if it's a member of `BLOCK_SCOPES`, matching the [canonical schema](https://civitai.com/schemas/app-block/v1.json). |
+| `BLOCK_SCOPES` / `BLOCK_SCOPE_PATTERN` | The 15 known block scope strings (the authoritative enum the canonical schema validates `scopes` against) + the `domain:verb:target` format-helper regex. A scope is valid only if it's a member of `BLOCK_SCOPES`, matching the [canonical schema](https://civitai.com/schemas/app-block/v1.json). |
 | `isMessage(data, type)` | Discriminator-only message narrowing (see above). |
 | `isModelSlotContext(ctx)` / `isPageSlotContext(ctx)` | Runtime narrowing for the `slotId`-discriminated `BlockContext` union. Real checks on a value that crossed a `postMessage` boundary — they verify every field they assert, not just `slotId`. |
 | `isSignedIn(viewer)` | **The sign-in gate.** `isSignedIn(useBlockContext().viewer)` — do not open-code it as `viewer !== null` or `viewer?.signedIn === true`. Which of those is correct has already changed once with the host contract, and this is the one place it is decided. It reads neither `viewer.id` nor `viewer.username` (both `@deprecated`), so nothing written through it changes when those are removed. Need the identity rather than the presence? `useViewer()` — scope-gated and audited per call. |
@@ -154,31 +162,67 @@ const body: WorkflowBody = {
 
 ### `defineBlock` validator rules
 
-Mirrors a strict subset of the civitai/civitai server gate. It throws on:
-
-- A missing **required** field: `$schema`, `appId`, `blockId`, `version`, `name`,
-  `type`, `targets`, `scopes`, `iframe`, `contentRating`, `minApiVersion`.
-- `$schema` ≠ `https://civitai.com/schemas/app-block/v1.json`.
-- `blockId` not matching the canonical `/^[a-z][a-z0-9-]*[a-z0-9]$/` (DNS-subdomain-safe:
-  lowercase, starts with a letter, ends alphanumeric) or outside 3–40 chars —
-  the blockId becomes `<blockId>.civit.ai`; `version` not semver; `name` > 80 chars.
-- `type` not `block` | `embed`; `contentRating` not `g|pg|pg13|r|x`.
-- **Empty `scopes`** (must be a non-empty array) or any scope that isn't one of
-  the 15 known block scopes (`BLOCK_SCOPES`). The [canonical schema](https://civitai.com/schemas/app-block/v1.json)
-  validates `scopes` by **enum membership**, so a well-formed but unknown scope
-  (e.g. `models:read:all`) is rejected; PascalCase like `ModelsReadSelf` gets a
-  pointed error.
-- **Empty `targets`**, or a target with a non-string `slotId` / non-integer `priority`.
-- `iframe.src` not https (http only for `localhost`/`127.0.0.1`/`[::1]`/`*.localhost`);
-  a banned sandbox token (`allow-same-origin`, any `allow-top-navigation*`);
-  non-positive integer `minHeight`; bad `maxHeight`; non-boolean `resizable`.
-- `settings` with a bad key (must be `snake_case`), > 32 fields, or a field
-  missing/mis-typed `scope` / `type` / `label` / `description`.
-
-> The validator does **not** check that `iframe.src` hostname equals
-> `<blockId>.<APPS_DOMAIN>` or that the path is root — those are enforced
-> **server-side** at submit time (gotcha #33). Keep `iframe.src` =
-> `https://<blockId>.civit.ai/` (root, no path prefix) and your Vite `base: '/'`.
+**There is no rule list here, and that is the point.** `defineBlock` does not
+maintain one: it compiles the vendored copy of the
+[canonical schema](https://civitai.com/schemas/app-block/v1.json) with
+[Ajv](https://ajv.js.org) and validates against **that**. Every `required`,
+`enum`, `pattern`, bound, `additionalProperties` and `allOf` the canonical
+expresses is enforced, and moves when the canonical moves. The schema is the
+rule list; read it, or read the errors.
+
+That is [#330](https://github.com/civitai/civitai-app-starters/issues/330)'s own
+proposed fix. The previous implementation hand-mirrored the schema, and the
+mirror diverged exactly as the issue predicted: it required 11 fields where the
+canonical requires **five** (`blockId`, `version`, `name`, `contentRating`,
+`scopes`), required `appId` — not a canonical property at all — and *required*
+the SERVER-OWNED `iframe.src` that `civitai app submit` refuses, so it rejected
+every `block.manifest.json` this repo ships.
+
+On top of the schema, `defineBlock` applies exactly five extra rules, each
+mirroring a server rejection the canonical states only in **prose**:
+
+| Rule | The canonical prose it mirrors |
+|---|---|
+| a dev-set **`iframe.src`** is rejected | *"SERVER-OWNED. Do NOT set `iframe.src` — the platform assigns it."* The JSON-Schema `not` is deliberately absent; the top-level `allOf` `$comment` says the platform validator and the Go CLI reject it instead. |
+| a dev-set **`trustTier`** is rejected | *"SERVER-OWNED … the platform assigns the trust tier during review."* Same shape. |
+| **`iframe.sandbox`** rejects `allow-same-origin` and every `allow-top-navigation*` token | *"Never combine allow-same-origin with allow-scripts."* Top-navigation is refused because a block must route navigation through the `NAVIGATE` postMessage. |
+| every **`scopeJustifications`** key must be a scope in `scopes` | *"The requirement is enforced imperatively by the manifest validator (not expressed as JSON-Schema conditionals here)."* |
+| **`settings`** is validated against the W3 settings meta-schema | Not in the app-block schema at all — settings are validated server-side by `manifest-settings.meta.schema.ts`. |
+
+Each is **strictly additive**: it can only reject a manifest Ajv accepted, never
+relax a canonical rule. `test/manifest/divergences.test.ts` asserts exactly that
+per entry — the fixture must be schema-VALID and `defineBlock`-REJECTED — and the
+table and the fixture set must be the same set, so a sixth hand-written rule with
+no entry fails the suite.
+
+> **Passing is necessary, not sufficient**, and it is **not** a replacement for
+> `civitai app validate` (the Go CLI's local pre-check against the same
+> canonical). Run that before `civitai app submit`. `KNOWN_GAPS` in
+> `src/manifest/defineBlock.ts` names each thing only the server can check —
+> including one that cuts the *other* way: the canonical's sandbox description is
+> an **allowlist** (*"Unverified tier allows only: allow-scripts, allow-forms"*)
+> while the rule above is a denylist, so `allow-popups`, `allow-modals` and
+> `allow-downloads` **pass here and may be refused at review**. The tier is
+> assigned server-side, so it cannot be enforced locally.
+
+**Where it runs.** Every scaffold that ships a `block.manifest.json`
+(`starters/civitai-block-starter` and all six `starters/examples/*`) registers
+`blockManifestPlugin` from `@civitai/app-sdk/vite` in its `vite.config.ts`. It
+fires from Vite's `configResolved`, the one hook called on both the dev-server
+and the build path — so `pnpm dev`, `pnpm dev:harness` and `pnpm build` all fail
+loudly on a bad manifest, with the offending field path in the message. Add
+`ajv` to your devDependencies (it is an optional peer):
+
+```bash
+pnpm add -D ajv
+```
+
+```ts
+// vite.config.ts — drop this into your existing `defineConfig({ plugins: [...] })`.
+import { blockManifestPlugin } from '@civitai/app-sdk/vite';
+
+const plugins = [blockManifestPlugin()];
+```
 
 ### Web storage in a block (`@civitai/app-sdk/safe-storage`)
 

package/dist/blocks/index.d.ts

@@ -1,16 +1,28 @@
 /**
  * `@civitai/app-sdk/blocks` — framework-agnostic contract for Civitai Apps.
  *
- * This subpath exports the manifest type, scope strings, postMessage protocol,
- * and the `defineBlock` validator. Hooks and transport implementations live in
- * a separate package (see `@civitai/blocks-react`) so this module stays usable
- * from any runtime — Node, browsers, workers — with no React dependency.
+ * This subpath exports the manifest type, scope strings and postMessage
+ * protocol. Hooks and transport implementations live in a separate package (see
+ * `@civitai/blocks-react`) so this module stays usable from any runtime — Node,
+ * browsers, workers — with no React dependency and no runtime dependencies at
+ * all. Build-time manifest validation lives at `@civitai/app-sdk/manifest`
+ * (node-only); see the note on `BlockManifestError` below.
  */
 import '../safe-storage/index.js';
 export { installSafeStorage, createMemoryStorage } from '../safe-storage/index.js';
 export type { SafeStorageInstallResult, SafeStorageName } from '../safe-storage/index.js';
-export { defineBlock, BlockManifestError } from './defineBlock.js';
-export type { DefineBlockConfig } from './defineBlock.js';
+/**
+ * `defineBlock` MOVED to `@civitai/app-sdk/manifest` (a NODE-ONLY subpath) in
+ * the release that closed #330. It now validates by compiling the vendored
+ * canonical schema with Ajv instead of maintaining a hand-written mirror of it,
+ * which needs `node:fs` and a runtime dependency — neither of which belongs on
+ * this browser-facing, zero-dependency surface. Most callers want the Vite
+ * plugin at `@civitai/app-sdk/vite` rather than the function.
+ *
+ * `BlockManifestError` stays exported here, from its own module, so
+ * `instanceof` means the same thing on both subpaths.
+ */
+export { BlockManifestError } from './manifestError.js';
 export { BLOCK_SCOPES, BLOCK_SCOPE_PATTERN, BLOCK_CATEGORIES, BLOCK_TAGLINE_MAX_LENGTH, } from './scopes.js';
 export type { BlockScope, BlockScopeKey, BlockCategory } from './scopes.js';
 export { BrowsingLevel, SFW_LEVELS, NSFW_LEVELS, isSfwCeiling, isLevelAllowed, effectiveBrowsingCeiling, } from './browsingLevel.js';
@@ -32,5 +44,5 @@ export { isModelSlotContext, isPageSlotContext } from './types.js';
  * in `types.ts` for which of the two it uses and why.
  */
 export { isSignedIn } from './types.js';
-export type { BlockContext, KnownSlotId, ModelSlotId, PageSlotContext, PageSlotId, UnknownSlotContext, BlockManifest, BlockManifestV1, BlockSettings, BlockToken, ContentRating, ManifestAsset, ManifestBooleanField, ManifestIframe, ManifestNumberField, ManifestPreview, ManifestSettingField, ManifestSettings, ManifestStringField, ManifestTarget, ModelSlotContext, SettingScope, SettingWidget, Theme, ViewerInfo, BlockCheckpointInfo, BlockResourceInfo, BlockResourcePickerType, BlockSourceImage, BlockUploadedImageInfo, BlockGenerationSourceImageInfo, BlockPendingImageInfo, BlockImageScanResult, BlockUploadPurpose, BlockTextToImageParams, BlockWorkflowSnapshot, BuzzAccountType, ShowcaseImage, WorkflowBody, WorkflowBodyTextToImage, WorkflowBodyCustomComfy, WorkflowBodyCustomComfyRecipe, WorkflowBodyCustomComfyInline, InlineComfyNode, WorkflowBodyStep, WorkflowBodyPassThroughStep, WorkflowStatus, BlockBuzzTransaction, BlockBuzzAccount, BlockDailyCompensationResource, BlockViewer, BlockWildcardPack, BlockWildcardPackErrorCode, AppWorkflow, AppWorkflowImage, BlockGatedImage, BlockCollectionFollowErrorCode, BlockCollectionFollowResult, BlockPostSource, BlockCreatePostRequest, BlockCreatePostResult, BlockCreatePostHostError, } from './types.js';
+export type { BlockContext, KnownSlotId, ModelSlotId, PageSlotContext, PageSlotId, UnknownSlotContext, BlockManifest, BlockManifestV1, BlockSettings, BlockToken, ContentRating, ManifestBooleanField, ManifestIframe, ManifestNumberField, ManifestPage, ManifestPreview, ManifestSettingField, ManifestSettings, ManifestStringField, ManifestTarget, ModelSlotContext, SettingScope, SettingWidget, Theme, ViewerInfo, BlockCheckpointInfo, BlockResourceInfo, BlockResourcePickerType, BlockSourceImage, BlockUploadedImageInfo, BlockGenerationSourceImageInfo, BlockPendingImageInfo, BlockImageScanResult, BlockUploadPurpose, BlockTextToImageParams, BlockWorkflowSnapshot, BuzzAccountType, ShowcaseImage, WorkflowBody, WorkflowBodyTextToImage, WorkflowBodyCustomComfy, WorkflowBodyCustomComfyRecipe, WorkflowBodyCustomComfyInline, InlineComfyNode, WorkflowBodyStep, WorkflowBodyPassThroughStep, WorkflowStatus, BlockBuzzTransaction, BlockBuzzAccount, BlockDailyCompensationResource, BlockViewer, BlockWildcardPack, BlockWildcardPackErrorCode, AppWorkflow, AppWorkflowImage, BlockGatedImage, BlockCollectionFollowErrorCode, BlockCollectionFollowResult, BlockPostSource, BlockCreatePostRequest, BlockCreatePostResult, BlockCreatePostHostError, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/blocks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blocks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACnF,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,aAAa,EACb,UAAU,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE1F,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,2BAA2B,EAC3B,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,YAAY,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,KAAK,EACL,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,8BAA8B,EAC9B,WAAW,EACX,iBAAiB,EACjB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,8BAA8B,EAC9B,2BAA2B,EAC3B,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blocks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACnF,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE1F;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,aAAa,EACb,UAAU,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE1F,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,2BAA2B,EAC3B,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,YAAY,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,aAAa,EACb,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,KAAK,EACL,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,8BAA8B,EAC9B,WAAW,EACX,iBAAiB,EACjB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,8BAA8B,EAC9B,2BAA2B,EAC3B,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC"}

package/dist/blocks/index.js

@@ -1,10 +1,12 @@
 /**
  * `@civitai/app-sdk/blocks` — framework-agnostic contract for Civitai Apps.
  *
- * This subpath exports the manifest type, scope strings, postMessage protocol,
- * and the `defineBlock` validator. Hooks and transport implementations live in
- * a separate package (see `@civitai/blocks-react`) so this module stays usable
- * from any runtime — Node, browsers, workers — with no React dependency.
+ * This subpath exports the manifest type, scope strings and postMessage
+ * protocol. Hooks and transport implementations live in a separate package (see
+ * `@civitai/blocks-react`) so this module stays usable from any runtime — Node,
+ * browsers, workers — with no React dependency and no runtime dependencies at
+ * all. Build-time manifest validation lives at `@civitai/app-sdk/manifest`
+ * (node-only); see the note on `BlockManifestError` below.
  */
 // FIRST import, on purpose. Blocks are framed at an opaque origin (sandbox
 // without `allow-same-origin`), where touching `localStorage`/`sessionStorage`
@@ -14,7 +16,18 @@
 // or is absent (Node/SSR/workers); see `../safe-storage/index.ts`.
 import '../safe-storage/index.js';
 export { installSafeStorage, createMemoryStorage } from '../safe-storage/index.js';
-export { defineBlock, BlockManifestError } from './defineBlock.js';
+/**
+ * `defineBlock` MOVED to `@civitai/app-sdk/manifest` (a NODE-ONLY subpath) in
+ * the release that closed #330. It now validates by compiling the vendored
+ * canonical schema with Ajv instead of maintaining a hand-written mirror of it,
+ * which needs `node:fs` and a runtime dependency — neither of which belongs on
+ * this browser-facing, zero-dependency surface. Most callers want the Vite
+ * plugin at `@civitai/app-sdk/vite` rather than the function.
+ *
+ * `BlockManifestError` stays exported here, from its own module, so
+ * `instanceof` means the same thing on both subpaths.
+ */
+export { BlockManifestError } from './manifestError.js';
 export { BLOCK_SCOPES, BLOCK_SCOPE_PATTERN, BLOCK_CATEGORIES, BLOCK_TAGLINE_MAX_LENGTH, } from './scopes.js';
 export { BrowsingLevel, SFW_LEVELS, NSFW_LEVELS, isSfwCeiling, isLevelAllowed, effectiveBrowsingCeiling, } from './browsingLevel.js';
 export { APP_STORAGE_MAX_VALUE_BYTES, APP_STORAGE_MAX_BYTES, APP_STORAGE_MAX_ROWS, } from './appStorageLimits.js';

package/dist/blocks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/blocks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,mEAAmE;AACnE,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGnF,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,aAAa,EACb,UAAU,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AAiBvB;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/blocks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,mEAAmE;AACnE,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGnF;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,aAAa,EACb,UAAU,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AAiBvB;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}

package/dist/blocks/manifestError.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The manifest-validation error type, in its own zero-dependency module.
+ *
+ * It lives here rather than beside `defineBlock` because `defineBlock` now
+ * lives at the node-only `@civitai/app-sdk/manifest` subpath (it reads the
+ * vendored canonical schema off disk and compiles it with Ajv). The error class
+ * has to stay importable from the browser-safe `./blocks` surface so that
+ * `instanceof BlockManifestError` means the same thing on both sides — one
+ * class, one module, no duplicate identity.
+ */
+/** Thrown by `defineBlock` for any manifest violation. */
+export declare class BlockManifestError extends Error {
+    /** Dot-path to the offending field, e.g. `iframe.sandbox`. */
+    readonly field?: string | undefined;
+    readonly name = "BlockManifestError";
+    constructor(message: string, 
+    /** Dot-path to the offending field, e.g. `iframe.sandbox`. */
+    field?: string | undefined);
+}
+//# sourceMappingURL=manifestError.d.ts.map

package/dist/blocks/manifestError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestError.d.ts","sourceRoot":"","sources":["../../src/blocks/manifestError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0DAA0D;AAC1D,qBAAa,kBAAmB,SAAQ,KAAK;IAIzC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;IAJzB,SAAkB,IAAI,wBAAwB;gBAE5C,OAAO,EAAE,MAAM;IACf,8DAA8D;IACrD,KAAK,CAAC,EAAE,MAAM,YAAA;CAI1B"}

package/dist/blocks/manifestError.js

@@ -0,0 +1,22 @@
+/**
+ * The manifest-validation error type, in its own zero-dependency module.
+ *
+ * It lives here rather than beside `defineBlock` because `defineBlock` now
+ * lives at the node-only `@civitai/app-sdk/manifest` subpath (it reads the
+ * vendored canonical schema off disk and compiles it with Ajv). The error class
+ * has to stay importable from the browser-safe `./blocks` surface so that
+ * `instanceof BlockManifestError` means the same thing on both sides — one
+ * class, one module, no duplicate identity.
+ */
+/** Thrown by `defineBlock` for any manifest violation. */
+export class BlockManifestError extends Error {
+    field;
+    name = 'BlockManifestError';
+    constructor(message, 
+    /** Dot-path to the offending field, e.g. `iframe.sandbox`. */
+    field) {
+        super(message);
+        this.field = field;
+    }
+}
+//# sourceMappingURL=manifestError.js.map

package/dist/blocks/manifestError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestError.js","sourceRoot":"","sources":["../../src/blocks/manifestError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0DAA0D;AAC1D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAKhC;IAJO,IAAI,GAAG,oBAAoB,CAAC;IAC9C,YACE,OAAe;IACf,8DAA8D;IACrD,KAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAS;IAGzB,CAAC;CACF"}

package/dist/blocks/scopes.d.ts

@@ -67,11 +67,15 @@ export type BlockCategory = (typeof BLOCK_CATEGORIES)[number];
  * `src/server/services/block-manifest-validator.service.ts` (the authoritative
  * gate) and the `tagline.maxLength` in the canonical schema
  * (https://civitai.com/schemas/app-block/v1.json). Keep all three in lockstep —
- * the schema-parity test asserts this const equals the vendored schema's bound.
+ * `test/manifest/canonical-derivation.test.ts` asserts this const equals the
+ * vendored schema's bound.
  *
  * NOTE: the SERVER measures the TRIMMED length; JSON Schema's `maxLength` counts
- * the raw string. `defineBlock` mirrors the server (trimmed) so an author is
- * never rejected locally for padding the server would ignore.
+ * the RAW string, so a tagline padded with whitespace past 140 is rejected by
+ * the schema and accepted by the server. `defineBlock` takes the SCHEMA's
+ * verdict — it applies no relaxation to any canonical rule — so that one shape
+ * is rejected locally. The canonical documents the asymmetry as deliberate
+ * ("this schema is never more permissive than the server"); trim the tagline.
  */
 export declare const BLOCK_TAGLINE_MAX_LENGTH = 140;
 //# sourceMappingURL=scopes.d.ts.map

package/dist/blocks/scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/blocks/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;CAsCf,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,YAAY,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,aAAa,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB,QAAuC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,8FAQnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC"}
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/blocks/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;CAsCf,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,YAAY,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,aAAa,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB,QAAuC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,8FAQnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC"}

package/dist/blocks/scopes.js

@@ -96,11 +96,15 @@ export const BLOCK_CATEGORIES = [
  * `src/server/services/block-manifest-validator.service.ts` (the authoritative
  * gate) and the `tagline.maxLength` in the canonical schema
  * (https://civitai.com/schemas/app-block/v1.json). Keep all three in lockstep —
- * the schema-parity test asserts this const equals the vendored schema's bound.
+ * `test/manifest/canonical-derivation.test.ts` asserts this const equals the
+ * vendored schema's bound.
  *
  * NOTE: the SERVER measures the TRIMMED length; JSON Schema's `maxLength` counts
- * the raw string. `defineBlock` mirrors the server (trimmed) so an author is
- * never rejected locally for padding the server would ignore.
+ * the RAW string, so a tagline padded with whitespace past 140 is rejected by
+ * the schema and accepted by the server. `defineBlock` takes the SCHEMA's
+ * verdict — it applies no relaxation to any canonical rule — so that one shape
+ * is rejected locally. The canonical documents the asymmetry as deliberate
+ * ("this schema is never more permissive than the server"); trim the tagline.
  */
 export const BLOCK_TAGLINE_MAX_LENGTH = 140;
 //# sourceMappingURL=scopes.js.map

package/dist/blocks/scopes.js.map

@@ -1 +1 @@
-{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/blocks/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,gBAAgB,EAAE,kBAAkB;IACpC,cAAc,EAAE,gBAAgB;IAChC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,0EAA0E;IAC1E,8EAA8E;IAC9E,gEAAgE;IAChE,iBAAiB,EAAE,mBAAmB;IACtC,kBAAkB,EAAE,oBAAoB;IACxC,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,wBAAwB,EAAE,0BAA0B;IACpD,yBAAyB,EAAE,2BAA2B;IACtD,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,kFAAkF;IAClF,yEAAyE;IACzE,qFAAqF;IACrF,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,wBAAwB,EAAE,0BAA0B;IACpD,4EAA4E;IAC5E,qEAAqE;IACrE,8EAA8E;IAC9E,4DAA4D;IAC5D,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,8BAA8B;IAC9B,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAKX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY;IACZ,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,OAAO;CACC,CAAC;AAIX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC"}
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/blocks/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,gBAAgB,EAAE,kBAAkB;IACpC,cAAc,EAAE,gBAAgB;IAChC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,0EAA0E;IAC1E,8EAA8E;IAC9E,gEAAgE;IAChE,iBAAiB,EAAE,mBAAmB;IACtC,kBAAkB,EAAE,oBAAoB;IACxC,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,wBAAwB,EAAE,0BAA0B;IACpD,yBAAyB,EAAE,2BAA2B;IACtD,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,kFAAkF;IAClF,yEAAyE;IACzE,qFAAqF;IACrF,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,wBAAwB,EAAE,0BAA0B;IACpD,4EAA4E;IAC5E,qEAAqE;IACrE,8EAA8E;IAC9E,4DAA4D;IAC5D,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,8BAA8B;IAC9B,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAKX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY;IACZ,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,OAAO;CACC,CAAC;AAIX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC"}

package/dist/blocks/types.d.ts

@@ -1335,20 +1335,47 @@ export type ManifestSettings = Record<string, ManifestSettingField>;
 export type ContentRating = 'g' | 'pg' | 'pg13' | 'r' | 'x';
 export interface ManifestTarget {
     slotId: string;
-    priority: number;
+    /**
+     * Slot ordering hint. NOT a property of the canonical schema (whose target
+     * items require only `slotId`), so it is optional and shape-checked only.
+     */
+    priority?: number;
     requiredContext?: string[];
 }
+/**
+ * iframe envelope. Every field is optional — the canonical schema declares no
+ * `required` list here, and the platform supplies its own defaults.
+ */
 export interface ManifestIframe {
-    src: string;
-    minHeight: number;
-    /** Optional. Omit or set to `null` for no cap. */
+    /**
+     * SERVER-OWNED — the platform stamps the canonical bundle URL at
+     * build/approve time. Typed `never` so setting it is a compile error;
+     * `defineBlock` rejects it at runtime too. Until #330 the SDK REQUIRED this
+     * field, which made every valid manifest fail local validation and every
+     * locally-valid manifest fail `civitai app submit`.
+     */
+    src?: never;
+    /** Canonical bounds: integer, 40–4000 px. */
+    minHeight?: number;
+    /** Optional. Omit or set to `null` for no cap. Canonical bounds: 40–4000 px. */
     maxHeight?: number | null;
-    resizable: boolean;
-    sandbox: string;
+    resizable?: boolean;
+    sandbox?: string;
 }
-export interface ManifestAsset {
-    url: string;
-    integrity: string;
+/** Full-page surface descriptor (W10). Page apps mount at `/apps/run/<slug>`. */
+export interface ManifestPage {
+    /** Sub-path the page mounts at; must start with `/`. */
+    path: string;
+    /** Title shown in host chrome. */
+    title: string;
+    icon?: string;
+    /**
+     * Per-generation Buzz SAFETY CEILING for `ai:write:budgeted` tokens — a
+     * ceiling against a drained wallet, NOT a cost forecast. Size it well above
+     * your worst-case generation; a budget set to your estimate becomes a hard
+     * outage the moment real cost drifts up.
+     */
+    buzzBudgetPerGen?: number;
 }
 export interface ManifestPreview {
     thumbnail: string;
@@ -1358,18 +1385,42 @@ export interface ManifestPreview {
 /**
  * v1 manifest shape. Mirrors `schemas/app-block/v1.json` — keep them in sync.
  *
- * The trailing `renderMode` / `assetBundle` / `trustTier` fields are
- * forward-compat hooks for v2 inline mode; they are accepted but unused
- * by the v1 iframe runtime.
+ * REQUIRED HERE = REQUIRED THERE. Only `blockId`, `version`, `name`,
+ * `contentRating` and `scopes` are required, because those are exactly the five
+ * entries in the canonical schema's `required` array. Before #330 this
+ * interface required eleven (including `appId`, which the canonical does not
+ * declare at all, and `iframe.src`, which the platform REFUSES), so the type
+ * itself rejected every manifest the starters ship.
  */
 export interface BlockManifestV1 {
-    $schema: 'https://civitai.com/schemas/app-block/v1.json';
-    appId: string;
+    /**
+     * Optional JSON-Schema reference. The canonical types it as a plain string
+     * and its own description says it is "ignored by the platform validator", so
+     * `defineBlock` does NOT constrain the value — point it at a vendored copy or
+     * a preview draft if that is what your editor needs. Until #330 a mismatch
+     * was a hard throw, which (once the gate was wired into Vite) failed the
+     * build on a field the server provably ignores.
+     *
+     * The union below is an AUTOCOMPLETE NUDGE, not a rule: `string & {}` keeps
+     * the literal visible in editor suggestions while still admitting any string.
+     */
+    $schema?: 'https://civitai.com/schemas/app-block/v1.json' | (string & {});
+    /**
+     * NOT a canonical manifest property, and NOT validated. Your app id lives in
+     * `civitai.app.json` (`{"appId": "..."}`), which is what the `civitai` CLI
+     * reads. The canonical does not forbid extra top-level keys, so the server
+     * ignores this one; the scaffolds still carry `"app_REPLACE_ME"` and it is
+     * inert.
+     */
+    appId?: string;
     blockId: string;
     version: string;
+    /** Human-readable display name. Non-empty; the canonical imposes NO length cap. */
     name: string;
-    type: 'block' | 'embed';
-    targets: ManifestTarget[];
+    /** Canonical enum — `block` is the only member. */
+    type?: 'block';
+    /** Optional (page-only apps declare none). Canonical cap: 16 entries. */
+    targets?: ManifestTarget[];
     scopes: string[];
     /**
      * Optional per-scope justification: a map of scope-id → free-text rationale
@@ -1381,8 +1432,17 @@ export interface BlockManifestV1 {
      * with the canonical schema's `scopeJustifications` (civitai #3195).
      */
     scopeJustifications?: Record<string, string>;
-    iframe: ManifestIframe;
-    assets?: ManifestAsset[];
+    /** Optional; the canonical declares no required sub-field. */
+    iframe?: ManifestIframe;
+    /** Full-page surface descriptor (W10). */
+    page?: ManifestPage;
+    /**
+     * The app's shipped `index.html` paints its own loading state inside `#root`,
+     * so the full-page run host stands down its branded overlay. Only declare it
+     * if the markup really exists — with the overlay gone, an empty `#root` is a
+     * blank iframe for the whole load.
+     */
+    bootSkeleton?: boolean;
     /**
      * Per-field settings declaration the platform validates user input
      * against AND renders the publisher/viewer settings UI from. v0 shape;
@@ -1403,26 +1463,54 @@ export interface BlockManifestV1 {
      * + detail page. Manifest-governed: it flows to the store listing on
      * moderator-approve and is re-synced from the manifest on every subsequent
      * approved version — for an ON-SITE app the manifest is the ONLY surface that
-     * sets it. Omit it and the store simply shows no tagline. Trimmed and capped at
+     * sets it. Omit it and the store simply shows no tagline. Capped at
      * {@link BLOCK_TAGLINE_MAX_LENGTH} (140) characters, the same bound off-site
      * listings use, so both store kinds render the same slot. Kept in lockstep with
-     * the canonical schema's `tagline` (civitai #3441).
+     * the canonical schema's `tagline` (civitai #3441). NOTE the canonical counts
+     * the RAW string while the server measures the trimmed one, and `defineBlock`
+     * takes the canonical's verdict — so trim before you count.
      */
     tagline?: string;
+    /**
+     * Optional PUBLIC source-repository link rendered as a `Source` row on the
+     * app's store detail page. `https://` root URL on github.com, gitlab.com or
+     * codeberg.org, at most 200 chars. `defineBlock` mirrors the canonical's
+     * COARSE pattern; the server applies stricter per-segment rules, so passing
+     * locally is necessary, not sufficient.
+     */
+    repository?: string;
     preview?: ManifestPreview;
     promotionEligible?: boolean;
-    minApiVersion: string;
+    /** Optional; dot-separated integers (e.g. `"1"` or `"1.0"`). Informational. */
+    minApiVersion?: string;
     /**
      * Author-declared mode preference. `hybrid` is a manifest-only hint that
      * the host resolves to a concrete `iframe` | `inline` value before sending
      * `BLOCK_INIT` — that's why `BlockInitPayload.renderMode` is narrower.
      */
     renderMode?: 'iframe' | 'inline' | 'hybrid';
+    /**
+     * Config-as-code: the command the platform runs to build the static bundle.
+     * One of an allowlisted set (`npm|pnpm|yarn run <script>`, `vite build`,
+     * `npx vite build`). When set, `outputDir` is REQUIRED.
+     */
+    buildCommand?: string;
+    /** Directory `buildCommand` emits into. Safe relative path; required with `buildCommand`. */
+    outputDir?: string;
+    /** Allowlist of settings keys exposed to anonymous viewers. Max 32 keys, 64 chars each. */
+    publicSettingsKeys?: string[];
+    /** Optional v2 surface — a public `https://` URL to a hosted asset bundle. */
+    assetBundleUrl?: string;
     assetBundle?: {
         url: string | null;
         sha256: string | null;
     };
-    trustTier?: 'unverified' | 'verified' | 'internal';
+    /**
+     * SERVER-OWNED — the platform assigns the trust tier during review. Typed
+     * `never` so setting it is a compile error; `defineBlock` rejects it at
+     * runtime too.
+     */
+    trustTier?: never;
 }
 export type BlockManifest = BlockManifestV1;
 /**