@civitai/blocks-react 0.19.0 → 0.21.0

package/README.md

@@ -113,6 +113,29 @@ const { raw, scopes, expiresAt, buzzBudget, refresh } = useBlockToken();
 // after a 401: await refresh(); then retry the request once with the new `raw`.
 ```
 
+### `useHostOrigin()`
+
+The validated host origin to direct-fetch the App Blocks HTTP API against —
+`undefined` until init. Use it as the base URL when you need to bypass the host
+bridge, always paired with the bearer token from `useBlockToken()`.
+
+```tsx
+const host = useHostOrigin();          // e.g. "https://civitai.com" (undefined until BLOCK_INIT)
+const { raw } = useBlockToken();
+// Once `host` is set, fetch the API on that validated origin with the block token:
+if (host) {
+  const res = await fetch(`${host}/api/v1/blocks/me`, {
+    headers: { authorization: `Bearer ${raw}` },
+  });
+}
+```
+
+> **Security:** this is ONLY ever the origin that passed the SDK's origin
+> allowlist (the same gate `BLOCK_INIT` passes) — never `document.referrer` or
+> `window.location` of the parent. The block token is a money-scoped bearer
+> credential, so always send it to *this* origin. Never derive the API host
+> from a spoofable browser signal.
+
 ### `useBlockSettings()`
 
 Shorthand for `useBlockContext().settings`. Read-only from the iframe — settings

package/dist/api/generationResources.d.ts

@@ -0,0 +1,62 @@
+/**
+ * REST client for `GET /api/v1/blocks/generation-resources` — the block-token-
+ * gated REHYDRATE of generation resources by version id (App Blocks Phase-2a
+ * PR-C). When a block loads a saved set of resources it holds only the picked
+ * modelVersionIds; this endpoint returns the SAME public "safe subset" the
+ * `OPEN_RESOURCE_PICKER` result carries (`projectSafeGenerationResource` on the
+ * host), WITHOUT re-opening the picker. It never returns availability /
+ * hasAccess / early-access / usageControl / minor / poi / sfwOnly / cover-image
+ * internals — only the public recommended settings + trained words a block
+ * renders (strength + min/max clamp, trigger words, clipSkip, names).
+ *
+ * MONEY-SAFETY: the returned data is DISCOVERY ONLY. Every `versionId` is a
+ * HINT, never an entitlement — the server re-validates AND re-prices at
+ * estimate/submit. The maturity ceiling is AUTHORITATIVELY CLAMPED server-side
+ * to the block token's signed `maxBrowsingLevel`; the client sends no maturity.
+ *
+ * The URL/param builder + response mapper are PURE + node-testable (mirrors the
+ * `internal/catalog.ts` pure-builder split); {@link useGenerationResources}
+ * layers the React `useHostOrigin()` + bearer-token fetch on top.
+ */
+import type { BlockResourceInfo } from '@civitai/app-sdk/blocks';
+/** The block-token-gated generation-resources rehydrate base. */
+export declare const GENERATION_RESOURCES_API_BASE = "/api/v1/blocks/generation-resources";
+/** Server cap on the number of ids per request (mirrors the endpoint's `MAX_IDS`). */
+export declare const MAX_GENERATION_RESOURCE_IDS = 30;
+/**
+ * Build the rehydrate URL for a set of version ids: `?ids=csv`. Ids are
+ * sanitized + capped at {@link MAX_GENERATION_RESOURCE_IDS} (extra/junk ids are
+ * dropped rather than sent, so the request never 400s on the server's cap).
+ * Pure + deterministic. `base` defaults to {@link GENERATION_RESOURCES_API_BASE}.
+ */
+export declare function buildGenerationResourcesUrl(versionIds: number[], base?: string): string;
+interface RawGenerationResource {
+    versionId?: number;
+    modelId?: number;
+    modelName?: string;
+    versionName?: string;
+    baseModel?: string;
+    modelType?: string;
+    strength?: number;
+    minStrength?: number;
+    maxStrength?: number;
+    trainedWords?: string[];
+    clipSkip?: number | null;
+}
+interface RawGenerationResourcesResponse {
+    items?: RawGenerationResource[];
+    maturity?: {
+        browsingLevel?: number;
+        sfwOnly?: boolean;
+    };
+}
+/**
+ * Map a raw `{ items: [...] }` response → the widened {@link BlockResourceInfo}[]
+ * a block consumes. Skips any row without a usable `versionId`. Carries the
+ * public recommended settings (strength + clamp, trained words, clipSkip)
+ * through unchanged — the host already applied its defaults in
+ * `projectSafeGenerationResource`. Never throws.
+ */
+export declare function responseToResources(raw: RawGenerationResourcesResponse | null | undefined): BlockResourceInfo[];
+export {};
+//# sourceMappingURL=generationResources.d.ts.map

package/dist/api/generationResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generationResources.d.ts","sourceRoot":"","sources":["../../src/api/generationResources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,wCAAwC,CAAC;AAEnF,sFAAsF;AACtF,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAoB9C;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAAE,EACpB,IAAI,GAAE,MAAsC,GAC3C,MAAM,CAKR;AAOD,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,UAAU,8BAA8B;IACtC,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,8BAA8B,GAAG,IAAI,GAAG,SAAS,GACrD,iBAAiB,EAAE,CAsBrB"}

package/dist/api/generationResources.js

@@ -0,0 +1,89 @@
+/**
+ * REST client for `GET /api/v1/blocks/generation-resources` — the block-token-
+ * gated REHYDRATE of generation resources by version id (App Blocks Phase-2a
+ * PR-C). When a block loads a saved set of resources it holds only the picked
+ * modelVersionIds; this endpoint returns the SAME public "safe subset" the
+ * `OPEN_RESOURCE_PICKER` result carries (`projectSafeGenerationResource` on the
+ * host), WITHOUT re-opening the picker. It never returns availability /
+ * hasAccess / early-access / usageControl / minor / poi / sfwOnly / cover-image
+ * internals — only the public recommended settings + trained words a block
+ * renders (strength + min/max clamp, trigger words, clipSkip, names).
+ *
+ * MONEY-SAFETY: the returned data is DISCOVERY ONLY. Every `versionId` is a
+ * HINT, never an entitlement — the server re-validates AND re-prices at
+ * estimate/submit. The maturity ceiling is AUTHORITATIVELY CLAMPED server-side
+ * to the block token's signed `maxBrowsingLevel`; the client sends no maturity.
+ *
+ * The URL/param builder + response mapper are PURE + node-testable (mirrors the
+ * `internal/catalog.ts` pure-builder split); {@link useGenerationResources}
+ * layers the React `useHostOrigin()` + bearer-token fetch on top.
+ */
+/** The block-token-gated generation-resources rehydrate base. */
+export const GENERATION_RESOURCES_API_BASE = '/api/v1/blocks/generation-resources';
+/** Server cap on the number of ids per request (mirrors the endpoint's `MAX_IDS`). */
+export const MAX_GENERATION_RESOURCE_IDS = 30;
+/**
+ * Sanitize a list of version ids the way the server's zod schema does: keep only
+ * positive integers, de-dupe (preserving first-seen order), and cap the count at
+ * {@link MAX_GENERATION_RESOURCE_IDS}. Pure + total.
+ */
+function sanitizeIds(versionIds) {
+    const seen = new Set();
+    const out = [];
+    for (const n of versionIds) {
+        if (!Number.isInteger(n) || n <= 0)
+            continue;
+        if (seen.has(n))
+            continue;
+        seen.add(n);
+        out.push(n);
+        if (out.length >= MAX_GENERATION_RESOURCE_IDS)
+            break; // enforce the ≤30 cap
+    }
+    return out;
+}
+/**
+ * Build the rehydrate URL for a set of version ids: `?ids=csv`. Ids are
+ * sanitized + capped at {@link MAX_GENERATION_RESOURCE_IDS} (extra/junk ids are
+ * dropped rather than sent, so the request never 400s on the server's cap).
+ * Pure + deterministic. `base` defaults to {@link GENERATION_RESOURCES_API_BASE}.
+ */
+export function buildGenerationResourcesUrl(versionIds, base = GENERATION_RESOURCES_API_BASE) {
+    const ids = sanitizeIds(versionIds);
+    const params = new URLSearchParams();
+    params.set('ids', ids.join(','));
+    return `${base}?${params.toString()}`;
+}
+/**
+ * Map a raw `{ items: [...] }` response → the widened {@link BlockResourceInfo}[]
+ * a block consumes. Skips any row without a usable `versionId`. Carries the
+ * public recommended settings (strength + clamp, trained words, clipSkip)
+ * through unchanged — the host already applied its defaults in
+ * `projectSafeGenerationResource`. Never throws.
+ */
+export function responseToResources(raw) {
+    const items = Array.isArray(raw?.items) ? raw.items : [];
+    const out = [];
+    for (const r of items) {
+        if (!r || typeof r !== 'object')
+            continue;
+        const versionId = r.versionId;
+        if (typeof versionId !== 'number' || !Number.isFinite(versionId))
+            continue;
+        out.push({
+            versionId,
+            modelId: typeof r.modelId === 'number' ? r.modelId : 0,
+            modelName: typeof r.modelName === 'string' ? r.modelName : '',
+            versionName: typeof r.versionName === 'string' ? r.versionName : '',
+            baseModel: typeof r.baseModel === 'string' ? r.baseModel : '',
+            modelType: typeof r.modelType === 'string' ? r.modelType : '',
+            ...(typeof r.strength === 'number' ? { strength: r.strength } : {}),
+            ...(typeof r.minStrength === 'number' ? { minStrength: r.minStrength } : {}),
+            ...(typeof r.maxStrength === 'number' ? { maxStrength: r.maxStrength } : {}),
+            ...(Array.isArray(r.trainedWords) ? { trainedWords: r.trainedWords } : {}),
+            ...(r.clipSkip === null || typeof r.clipSkip === 'number' ? { clipSkip: r.clipSkip } : {}),
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=generationResources.js.map

package/dist/api/generationResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generationResources.js","sourceRoot":"","sources":["../../src/api/generationResources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;AAEnF,sFAAsF;AACtF,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;GAIG;AACH,SAAS,WAAW,CAAC,UAAoB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,IAAI,2BAA2B;YAAE,MAAM,CAAC,sBAAsB;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAoB,EACpB,OAAe,6BAA6B;IAE5C,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxC,CAAC;AA0BD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsD;IAEtD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,KAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QAC3E,GAAG,CAAC,IAAI,CAAC;YACP,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtD,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YAC7D,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACnE,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YAC7D,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YAC7D,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/hooks/useGenerationResources.d.ts

@@ -0,0 +1,27 @@
+import type { BlockResourceInfo } from '@civitai/app-sdk/blocks';
+/**
+ * Rehydrate a saved set of generation resources by version id, WITHOUT
+ * re-opening the resource picker. `fetch(versionIds)` GETs the block-token-gated
+ * `/api/v1/blocks/generation-resources` endpoint and returns the SAME widened
+ * {@link BlockResourceInfo} projection `useResourcePicker()` yields (public
+ * recommended settings — strength + min/max clamp, trained words, clipSkip — plus
+ * names), so a picked resource and a rehydrated one look identical to the block.
+ *
+ * Direct-fetch (bypasses the postMessage bridge) against the VALIDATED host
+ * origin (`useHostOrigin()`) with the block bearer token (`useBlockToken().raw`)
+ * — the same security-reviewed pattern as any block REST call. The maturity
+ * ceiling is server-clamped to the token's signed `maxBrowsingLevel`; the client
+ * sends no maturity. Ids are sanitized + capped at 30 by the URL builder.
+ *
+ * DISCOVERY ONLY: every returned `versionId` is a hint, never an entitlement —
+ * the server re-validates + re-prices at estimate/submit.
+ *
+ * @example
+ * const { fetch } = useGenerationResources();
+ * const resources = await fetch([691639, 666002]);   // by saved versionIds
+ * // resources[0].strength / .minStrength / .maxStrength / .trainedWords / .clipSkip
+ */
+export declare function useGenerationResources(): {
+    fetch: (versionIds: number[]) => Promise<BlockResourceInfo[]>;
+};
+//# sourceMappingURL=useGenerationResources.d.ts.map

package/dist/hooks/useGenerationResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGenerationResources.d.ts","sourceRoot":"","sources":["../../src/hooks/useGenerationResources.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AASjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CAC/D,CAyBA"}

package/dist/hooks/useGenerationResources.js

@@ -0,0 +1,46 @@
+import { useCallback } from 'react';
+import { buildGenerationResourcesUrl, responseToResources, } from '../api/generationResources.js';
+import { useHostOrigin } from './useHostOrigin.js';
+import { useBlockToken } from './useBlockToken.js';
+/**
+ * Rehydrate a saved set of generation resources by version id, WITHOUT
+ * re-opening the resource picker. `fetch(versionIds)` GETs the block-token-gated
+ * `/api/v1/blocks/generation-resources` endpoint and returns the SAME widened
+ * {@link BlockResourceInfo} projection `useResourcePicker()` yields (public
+ * recommended settings — strength + min/max clamp, trained words, clipSkip — plus
+ * names), so a picked resource and a rehydrated one look identical to the block.
+ *
+ * Direct-fetch (bypasses the postMessage bridge) against the VALIDATED host
+ * origin (`useHostOrigin()`) with the block bearer token (`useBlockToken().raw`)
+ * — the same security-reviewed pattern as any block REST call. The maturity
+ * ceiling is server-clamped to the token's signed `maxBrowsingLevel`; the client
+ * sends no maturity. Ids are sanitized + capped at 30 by the URL builder.
+ *
+ * DISCOVERY ONLY: every returned `versionId` is a hint, never an entitlement —
+ * the server re-validates + re-prices at estimate/submit.
+ *
+ * @example
+ * const { fetch } = useGenerationResources();
+ * const resources = await fetch([691639, 666002]);   // by saved versionIds
+ * // resources[0].strength / .minStrength / .maxStrength / .trainedWords / .clipSkip
+ */
+export function useGenerationResources() {
+    const host = useHostOrigin();
+    const { raw } = useBlockToken();
+    const doFetch = useCallback(async (versionIds) => {
+        if (!host) {
+            throw new Error('useGenerationResources: host origin not established yet (wait for BLOCK_INIT).');
+        }
+        const url = host + buildGenerationResourcesUrl(versionIds);
+        const res = await fetch(url, {
+            headers: { Authorization: `Bearer ${raw}` },
+        });
+        if (!res.ok) {
+            throw new Error(`generation-resources request failed (${res.status})`);
+        }
+        const body = (await res.json());
+        return responseToResources(body);
+    }, [host, raw]);
+    return { fetch: doFetch };
+}
+//# sourceMappingURL=useGenerationResources.js.map

package/dist/hooks/useGenerationResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGenerationResources.js","sourceRoot":"","sources":["../../src/hooks/useGenerationResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAIpC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB;IAGpC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,WAAW,CACzB,KAAK,EAAE,UAAoB,EAAgC,EAAE;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;QAC3C,OAAO,mBAAmB,CAAC,IAAiD,CAAC,CAAC;IAChF,CAAC,EACD,CAAC,IAAI,EAAE,GAAG,CAAC,CACZ,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/dist/hooks/useHostOrigin.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Returns the validated host (parent) origin the block may safely direct-fetch
+ * the civitai App Blocks HTTP API against — `undefined` until the transport
+ * has established it (iframe: the first allowlist-passing `BLOCK_INIT`;
+ * inline: bootstrap present).
+ *
+ * Use this as the base URL for a direct `fetch` to the App Blocks API when you
+ * need to bypass the host bridge — always paired with the bearer token from
+ * `useBlockToken()`:
+ *
+ * @example
+ * const host = useHostOrigin();
+ * const { raw } = useBlockToken();
+ * if (!host) return null; // not initialized yet
+ * const res = await fetch(`${host}/api/v1/blocks/me`, {
+ *   headers: { authorization: `Bearer ${raw}` },
+ * });
+ *
+ * SECURITY INVARIANT — the whole reason this hook exists: the value it returns
+ * is ONLY ever an origin that passed the transport's trust gate (the iframe
+ * `OriginMatcher` allowlist, or the inline same-origin host). It is NEVER
+ * derived from `document.referrer`, `window.location` of a cross-origin
+ * parent, or any unvalidated `event.origin`. `useBlockToken().raw` is a
+ * money-scoped bearer credential, so sending it to an unvalidated origin would
+ * be a token-exfiltration vector — always send the token to THIS origin, never
+ * to a host you read off a spoofable browser signal.
+ *
+ * Built on the same `useSyncExternalStore` subscription as `useBlockToken` /
+ * `useBlockContext`: the iframe transport captures the origin and emits in the
+ * same tick it applies `BLOCK_INIT`, so the hook re-renders with the origin the
+ * moment init lands.
+ */
+export declare function useHostOrigin(): string | undefined;
+//# sourceMappingURL=useHostOrigin.d.ts.map

package/dist/hooks/useHostOrigin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useHostOrigin.d.ts","sourceRoot":"","sources":["../../src/hooks/useHostOrigin.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAWlD"}

package/dist/hooks/useHostOrigin.js

@@ -0,0 +1,44 @@
+import { useSyncExternalStore } from 'react';
+import { getTransport } from '../internal/singleton.js';
+/**
+ * Returns the validated host (parent) origin the block may safely direct-fetch
+ * the civitai App Blocks HTTP API against — `undefined` until the transport
+ * has established it (iframe: the first allowlist-passing `BLOCK_INIT`;
+ * inline: bootstrap present).
+ *
+ * Use this as the base URL for a direct `fetch` to the App Blocks API when you
+ * need to bypass the host bridge — always paired with the bearer token from
+ * `useBlockToken()`:
+ *
+ * @example
+ * const host = useHostOrigin();
+ * const { raw } = useBlockToken();
+ * if (!host) return null; // not initialized yet
+ * const res = await fetch(`${host}/api/v1/blocks/me`, {
+ *   headers: { authorization: `Bearer ${raw}` },
+ * });
+ *
+ * SECURITY INVARIANT — the whole reason this hook exists: the value it returns
+ * is ONLY ever an origin that passed the transport's trust gate (the iframe
+ * `OriginMatcher` allowlist, or the inline same-origin host). It is NEVER
+ * derived from `document.referrer`, `window.location` of a cross-origin
+ * parent, or any unvalidated `event.origin`. `useBlockToken().raw` is a
+ * money-scoped bearer credential, so sending it to an unvalidated origin would
+ * be a token-exfiltration vector — always send the token to THIS origin, never
+ * to a host you read off a spoofable browser signal.
+ *
+ * Built on the same `useSyncExternalStore` subscription as `useBlockToken` /
+ * `useBlockContext`: the iframe transport captures the origin and emits in the
+ * same tick it applies `BLOCK_INIT`, so the hook re-renders with the origin the
+ * moment init lands.
+ */
+export function useHostOrigin() {
+    const transport = getTransport();
+    const origin = useSyncExternalStore((cb) => transport.subscribe(cb), () => transport.getHostOrigin(), 
+    // Server snapshot: no host origin is known before hydration.
+    () => transport.getHostOrigin());
+    // Normalize the transport's `null` sentinel to `undefined` for the hook's
+    // "not yet available" contract (mirrors the optional-field hook convention).
+    return origin ?? undefined;
+}
+//# sourceMappingURL=useHostOrigin.js.map

package/dist/hooks/useHostOrigin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useHostOrigin.js","sourceRoot":"","sources":["../../src/hooks/useHostOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,oBAAoB,CACjC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAC/B,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE;IAC/B,6DAA6D;IAC7D,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,CAChC,CAAC;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC"}

package/dist/hooks/useImageUpload.d.ts

@@ -0,0 +1,30 @@
+import type { BlockUploadedImageInfo } from '@civitai/app-sdk/blocks';
+/**
+ * Drives the platform-side image-upload flow for App Blocks (Design 1 —
+ * host-chrome). Mirrors {@link useResourcePicker}: `open` asks the host to open
+ * its OWN native upload modal; the iframe never handles the bytes. The upload
+ * routes through civitai's session-authed scan pipeline (real `createImage` +
+ * `ingestImage`) and a hard SFW + no-moderation-flag gate — so the host returns
+ * ONLY a MODERATED image (scanned clean, within the SFW ceiling, unflagged).
+ *
+ * Resolves with the chosen {@link BlockUploadedImageInfo}, or `null` when the
+ * user dismissed the modal without a successful upload. The returned `url` is a
+ * Civitai-hosted image URL usable directly as a `WorkflowBody.sourceImage.url`
+ * (img2img) — feed `{ url, width, height }` into the generation body and submit.
+ *
+ * Human-interactive, so it uses the same generous {@link PICKER_REQUEST_TIMEOUT_MS}
+ * as the pickers (the host still resolves earlier on upload/dismiss/close).
+ * Host-mediated, same trust model as `useResourcePicker` / `useBuzzWorkflow`.
+ *
+ * @example
+ * const { open } = useImageUpload();
+ * const img = await open();
+ * if (!img) return;                       // user dismissed
+ * // img2img: feed the moderated image into the generation body
+ * await submit({ kind: 'textToImage', modelId, modelVersionId,
+ *   sourceImage: { url: img.url, width: 1024, height: 1024 }, params: { prompt } });
+ */
+export declare function useImageUpload(): {
+    open: () => Promise<BlockUploadedImageInfo | null>;
+};
+//# sourceMappingURL=useImageUpload.d.ts.map

package/dist/hooks/useImageUpload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useImageUpload.d.ts","sourceRoot":"","sources":["../../src/hooks/useImageUpload.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAMtE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,IAAI;IAAE,IAAI,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAA;CAAE,CAcvF"}

package/dist/hooks/useImageUpload.js

@@ -0,0 +1,39 @@
+import { useCallback } from 'react';
+import { getTransport } from '../internal/singleton.js';
+import { sendTypedRequest } from '../internal/transport.js';
+import { PICKER_REQUEST_TIMEOUT_MS } from './useCheckpointPicker.js';
+/**
+ * Drives the platform-side image-upload flow for App Blocks (Design 1 —
+ * host-chrome). Mirrors {@link useResourcePicker}: `open` asks the host to open
+ * its OWN native upload modal; the iframe never handles the bytes. The upload
+ * routes through civitai's session-authed scan pipeline (real `createImage` +
+ * `ingestImage`) and a hard SFW + no-moderation-flag gate — so the host returns
+ * ONLY a MODERATED image (scanned clean, within the SFW ceiling, unflagged).
+ *
+ * Resolves with the chosen {@link BlockUploadedImageInfo}, or `null` when the
+ * user dismissed the modal without a successful upload. The returned `url` is a
+ * Civitai-hosted image URL usable directly as a `WorkflowBody.sourceImage.url`
+ * (img2img) — feed `{ url, width, height }` into the generation body and submit.
+ *
+ * Human-interactive, so it uses the same generous {@link PICKER_REQUEST_TIMEOUT_MS}
+ * as the pickers (the host still resolves earlier on upload/dismiss/close).
+ * Host-mediated, same trust model as `useResourcePicker` / `useBuzzWorkflow`.
+ *
+ * @example
+ * const { open } = useImageUpload();
+ * const img = await open();
+ * if (!img) return;                       // user dismissed
+ * // img2img: feed the moderated image into the generation body
+ * await submit({ kind: 'textToImage', modelId, modelVersionId,
+ *   sourceImage: { url: img.url, width: 1024, height: 1024 }, params: { prompt } });
+ */
+export function useImageUpload() {
+    const open = useCallback(async () => {
+        const { selected } = await sendTypedRequest(getTransport(), { type: 'OPEN_IMAGE_UPLOAD', payload: {} }, 'IMAGE_UPLOAD_RESULT', { timeoutMs: PICKER_REQUEST_TIMEOUT_MS });
+        // Normalize the "dismissed" case to an explicit null so callers can
+        // `if (!img) return;` without an `undefined` ambiguity.
+        return selected ?? null;
+    }, []);
+    return { open };
+}
+//# sourceMappingURL=useImageUpload.js.map

package/dist/hooks/useImageUpload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useImageUpload.js","sourceRoot":"","sources":["../../src/hooks/useImageUpload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAIpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,EAC1C,qBAAqB,EACrB,EAAE,SAAS,EAAE,yBAAyB,EAAE,CACzC,CAAC;QACF,oEAAoE;QACpE,wDAAwD;QACxD,OAAO,QAAQ,IAAI,IAAI,CAAC;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/hooks/useSharedStorage.d.ts

@@ -1,8 +1,10 @@
 import type { SharedStorageValue } from '@civitai/app-sdk/blocks';
 /**
- * The value a viewer contributes to the SHARED store: a required `title` plus
- * an optional long-form `body`. Re-exported from the app-sdk contract so block
- * authors get one canonical shape.
+ * The value a viewer contributes to the SHARED store: a required `title`, an
+ * optional long-form `body`, and an optional opaque app-owned `data` blob.
+ * `title`/`body` are the MODERATED, user-visible TEXT; `data` is UNMODERATED
+ * structured app state (keep all user-visible text in title/body). Re-exported
+ * from the app-sdk contract so block authors get one canonical shape.
  */
 export type SharedAppendValue = SharedStorageValue;
 /**
@@ -42,9 +44,11 @@ export interface UseSharedStorage {
      */
     getCounts(keys: string[]): Promise<Record<string, number>>;
     /**
-     * Append a new entry on behalf of the viewer. Resolves with the host-minted
-     * `key`. Rejects with the host's `error` string on validation/host failure
-     * (or when the viewer is anonymous).
+     * Append a new entry on behalf of the viewer. Accepts the generic
+     * `{ title, body?, data? }` value — `data` is an optional opaque app-owned
+     * payload stored alongside the moderated title/body. Resolves with the
+     * host-minted `key`. Rejects with the host's `error` string on validation/host
+     * failure (or when the viewer is anonymous).
      */
     append(value: SharedAppendValue): Promise<{
         key: string;

package/dist/hooks/useSharedStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSharedStorage.d.ts","sourceRoot":"","sources":["../../src/hooks/useSharedStorage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlE;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,CAwFnD"}
+{"version":3,"file":"useSharedStorage.d.ts","sourceRoot":"","sources":["../../src/hooks/useSharedStorage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlE;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,CAwFnD"}

package/dist/hooks/useSharedStorage.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSharedStorage.js","sourceRoot":"","sources":["../../src/hooks/useSharedStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIhC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAsE5D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAmB,GAAG,EAAE;QACpC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,IAAI;gBACb,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT;oBACE,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI,EAAE,MAAM;wBACpB,KAAK,EAAE,IAAI,EAAE,KAAK;wBAClB,MAAM,EAAE,IAAI,EAAE,MAAM;qBACrB;iBACF,EACD,oBAAoB,CACrB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBACjC,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;wBACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;qBACpC,CAAC,CAAC;oBACH,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC9C,yBAAyB,CAC1B,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI;gBAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAChD,0BAA0B,CAC3B,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAC7C,sBAAsB,CACvB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG;gBACZ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EACzC,oBAAoB,CACrB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG;gBACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC3C,sBAAsB,CACvB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC7C,wBAAwB,CACzB,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;SACF,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC"}
+{"version":3,"file":"useSharedStorage.js","sourceRoot":"","sources":["../../src/hooks/useSharedStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIhC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA0E5D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAmB,GAAG,EAAE;QACpC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,IAAI;gBACb,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT;oBACE,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI,EAAE,MAAM;wBACpB,KAAK,EAAE,IAAI,EAAE,KAAK;wBAClB,MAAM,EAAE,IAAI,EAAE,MAAM;qBACrB;iBACF,EACD,oBAAoB,CACrB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBACjC,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;wBACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;qBACpC,CAAC,CAAC;oBACH,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC9C,yBAAyB,CAC1B,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI;gBAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAChD,0BAA0B,CAC3B,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAC7C,sBAAsB,CACvB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG;gBACZ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EACzC,oBAAoB,CACrB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG;gBACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC3C,sBAAsB,CACvB,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC7C,wBAAwB,CACzB,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;SACF,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC"}

package/dist/index.d.ts

@@ -16,6 +16,7 @@ export type { BlockSnapshot, BlockTransport, OutboundRequest, } from './internal
 export { useBlockContext } from './hooks/useBlockContext.js';
 export { useBlockSettings } from './hooks/useBlockSettings.js';
 export { useBlockToken } from './hooks/useBlockToken.js';
+export { useHostOrigin } from './hooks/useHostOrigin.js';
 export { useBuzzWorkflow } from './hooks/useBuzzWorkflow.js';
 export { useBlockResize } from './hooks/useBlockResize.js';
 export { useBuzzPurchase } from './hooks/useBuzzPurchase.js';
@@ -23,6 +24,9 @@ export { useBuzzBalance } from './hooks/useBuzzBalance.js';
 export type { BuzzBalance, UseBuzzBalance } from './hooks/useBuzzBalance.js';
 export { useCheckpointPicker } from './hooks/useCheckpointPicker.js';
 export { useResourcePicker } from './hooks/useResourcePicker.js';
+export { useImageUpload } from './hooks/useImageUpload.js';
+export { useGenerationResources } from './hooks/useGenerationResources.js';
+export { GENERATION_RESOURCES_API_BASE, MAX_GENERATION_RESOURCE_IDS, buildGenerationResourcesUrl, responseToResources, } from './api/generationResources.js';
 export { useCivitaiNavigate } from './hooks/useCivitaiNavigate.js';
 export { useRequestSignIn } from './hooks/useRequestSignIn.js';
 export { useRequestConsent } from './hooks/useRequestConsent.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EACV,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EACV,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -14,12 +14,16 @@ export { sendTypedRequest } from './internal/transport.js';
 export { useBlockContext } from './hooks/useBlockContext.js';
 export { useBlockSettings } from './hooks/useBlockSettings.js';
 export { useBlockToken } from './hooks/useBlockToken.js';
+export { useHostOrigin } from './hooks/useHostOrigin.js';
 export { useBuzzWorkflow } from './hooks/useBuzzWorkflow.js';
 export { useBlockResize } from './hooks/useBlockResize.js';
 export { useBuzzPurchase } from './hooks/useBuzzPurchase.js';
 export { useBuzzBalance } from './hooks/useBuzzBalance.js';
 export { useCheckpointPicker } from './hooks/useCheckpointPicker.js';
 export { useResourcePicker } from './hooks/useResourcePicker.js';
+export { useImageUpload } from './hooks/useImageUpload.js';
+export { useGenerationResources } from './hooks/useGenerationResources.js';
+export { GENERATION_RESOURCES_API_BASE, MAX_GENERATION_RESOURCE_IDS, buildGenerationResourcesUrl, responseToResources, } from './api/generationResources.js';
 export { useCivitaiNavigate } from './hooks/useCivitaiNavigate.js';
 export { useRequestSignIn } from './hooks/useRequestSignIn.js';
 export { useRequestConsent } from './hooks/useRequestConsent.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAG3F,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,QAAQ;AACR,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAG3F,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,QAAQ;AACR,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/internal/iframeTransport.d.ts

@@ -37,6 +37,24 @@ export declare class IframeTransport implements BlockTransport {
     private readonly messageListener;
     constructor(opts: IframeTransportOptions);
     getSnapshot(): BlockSnapshot;
+    /**
+     * The validated parent origin — `null` until `BLOCK_INIT` lands.
+     *
+     * SECURITY INVARIANT — do NOT change what this returns: it hands back ONLY
+     * `this.parentOrigin`, which is set exactly once, in `handleMessage`, from
+     * the `event.origin` of the FIRST `BLOCK_INIT` — AND only after that message
+     * cleared `this.originMatcher.matches(event.origin)` (the allowlist gate at
+     * the very top of `handleMessage`, the same gate every inbound message
+     * passes). It is therefore guaranteed to be a legitimate civitai origin.
+     *
+     * It is NEVER derived from `document.referrer`, `window.location`, or an
+     * unvalidated `event.origin`. Blocks send a money-scoped bearer token
+     * (`useBlockToken().raw`) to this origin, so returning a spoofable value
+     * would be a token-exfiltration vector. This is the same value already
+     * trusted as the `targetOrigin` of every `postMessage` to the parent
+     * (see `postToParent`).
+     */
+    getHostOrigin(): string | null;
     subscribe(listener: () => void): () => void;
     waitForInit(): Promise<BlockInitPayload>;
     sendMessage(message: BlockToParentMessage): void;

package/dist/internal/iframeTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iframeTransport.d.ts","sourceRoot":"","sources":["../../src/internal/iframeTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AASxB,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,cAAc;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,yEAAyE;IACzE,OAAO,CAAC,YAAY,CAAuB;IAE3C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,YAAY,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;gBAEpD,IAAI,EAAE,sBAAsB;IAoCxC,WAAW,IAAI,aAAa;IAI5B,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAIxC,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAIhD,WAAW,CACT,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,wBAAwB,EACtC,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChC,OAAO,CAAC,OAAO,CAAC;IAmBnB,uDAAuD;IACvD,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,aAAa;IA2FrB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,IAAI;CAGb"}
+{"version":3,"file":"iframeTransport.d.ts","sourceRoot":"","sources":["../../src/internal/iframeTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AASxB,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,cAAc;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,yEAAyE;IACzE,OAAO,CAAC,YAAY,CAAuB;IAE3C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,YAAY,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;gBAEpD,IAAI,EAAE,sBAAsB;IAoCxC,WAAW,IAAI,aAAa;IAI5B;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,IAAI,MAAM,GAAG,IAAI;IAI9B,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAIxC,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAIhD,WAAW,CACT,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,wBAAwB,EACtC,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChC,OAAO,CAAC,OAAO,CAAC;IAmBnB,uDAAuD;IACvD,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,aAAa;IA2FrB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,IAAI;CAGb"}

package/dist/internal/iframeTransport.js

@@ -56,6 +56,26 @@ export class IframeTransport {
     getSnapshot() {
         return this.snapshot;
     }
+    /**
+     * The validated parent origin — `null` until `BLOCK_INIT` lands.
+     *
+     * SECURITY INVARIANT — do NOT change what this returns: it hands back ONLY
+     * `this.parentOrigin`, which is set exactly once, in `handleMessage`, from
+     * the `event.origin` of the FIRST `BLOCK_INIT` — AND only after that message
+     * cleared `this.originMatcher.matches(event.origin)` (the allowlist gate at
+     * the very top of `handleMessage`, the same gate every inbound message
+     * passes). It is therefore guaranteed to be a legitimate civitai origin.
+     *
+     * It is NEVER derived from `document.referrer`, `window.location`, or an
+     * unvalidated `event.origin`. Blocks send a money-scoped bearer token
+     * (`useBlockToken().raw`) to this origin, so returning a spoofable value
+     * would be a token-exfiltration vector. This is the same value already
+     * trusted as the `targetOrigin` of every `postMessage` to the parent
+     * (see `postToParent`).
+     */
+    getHostOrigin() {
+        return this.parentOrigin;
+    }
     subscribe(listener) {
         this.listeners.add(listener);
         return () => {