@civitai/blocks-react 0.4.0

package/dist/hooks/useCheckpointPicker.d.ts

@@ -0,0 +1,34 @@
+import type { BlockCheckpointInfo } from '@civitai/app-sdk/blocks';
+/**
+ * Drives the platform-side Checkpoint picker and the persist-override flow.
+ *
+ * `open` opens the host's Resource picker filtered to Checkpoints in the
+ * given ecosystem; resolves with `{ selected }` (undefined when the user
+ * dismissed without picking).
+ *
+ * `persist` writes the chosen versionId into `block_user_settings` via the
+ * host. Pass `null` to clear the override and fall back to the publisher
+ * default at next mount. Throws on host-side validation failure (e.g.
+ * "wrong-ecosystem") — surface the message to the user; don't retry blindly.
+ *
+ * Both flows are host-mediated: the block never touches the picker UI or
+ * the user-settings table directly. Same trust model as useBuzzPurchase /
+ * useBuzzWorkflow.
+ */
+export declare function useCheckpointPicker(): {
+    open: (opts: {
+        /**
+         * Ecosystem key (e.g. 'Flux1', 'SDXL'). Get it from
+         * `useBlockContext().context.checkpoint?.baseModel` — but for the
+         * picker filter the host will collapse to the ecosystem family, so
+         * any baseModel in the family works as a hint.
+         */
+        baseModelGroup: string;
+        /** Currently-selected versionId so the picker can pre-highlight it. */
+        currentVersionId?: number;
+    }) => Promise<{
+        selected?: BlockCheckpointInfo;
+    }>;
+    persist: (versionId: number | null) => Promise<void>;
+};
+//# sourceMappingURL=useCheckpointPicker.d.ts.map

package/dist/hooks/useCheckpointPicker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCheckpointPicker.d.ts","sourceRoot":"","sources":["../../src/hooks/useCheckpointPicker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAKnE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,IAAI,EAAE,CAAC,IAAI,EAAE;QACX;;;;;WAKG;QACH,cAAc,EAAE,MAAM,CAAC;QACvB,uEAAuE;QACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAiCA"}

package/dist/hooks/useCheckpointPicker.js

@@ -0,0 +1,41 @@
+import { useCallback } from 'react';
+import { getTransport } from '../internal/singleton.js';
+import { sendTypedRequest } from '../internal/transport.js';
+/**
+ * Drives the platform-side Checkpoint picker and the persist-override flow.
+ *
+ * `open` opens the host's Resource picker filtered to Checkpoints in the
+ * given ecosystem; resolves with `{ selected }` (undefined when the user
+ * dismissed without picking).
+ *
+ * `persist` writes the chosen versionId into `block_user_settings` via the
+ * host. Pass `null` to clear the override and fall back to the publisher
+ * default at next mount. Throws on host-side validation failure (e.g.
+ * "wrong-ecosystem") — surface the message to the user; don't retry blindly.
+ *
+ * Both flows are host-mediated: the block never touches the picker UI or
+ * the user-settings table directly. Same trust model as useBuzzPurchase /
+ * useBuzzWorkflow.
+ */
+export function useCheckpointPicker() {
+    const open = useCallback(async (opts) => {
+        const { selected } = await sendTypedRequest(getTransport(), {
+            type: 'OPEN_CHECKPOINT_PICKER',
+            payload: {
+                baseModelGroup: opts.baseModelGroup,
+                ...(opts.currentVersionId != null
+                    ? { currentVersionId: opts.currentVersionId }
+                    : {}),
+            },
+        }, 'CHECKPOINT_PICKER_RESULT');
+        return { selected };
+    }, []);
+    const persist = useCallback(async (versionId) => {
+        const { ok, error } = await sendTypedRequest(getTransport(), { type: 'SET_USER_CHECKPOINT', payload: { versionId } }, 'USER_CHECKPOINT_SET');
+        if (!ok) {
+            throw new Error(error ?? 'failed to persist checkpoint');
+        }
+    }, []);
+    return { open, persist };
+}
+//# sourceMappingURL=useCheckpointPicker.js.map

package/dist/hooks/useCheckpointPicker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCheckpointPicker.js","sourceRoot":"","sources":["../../src/hooks/useCheckpointPicker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAIpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB;IAcjC,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,IAA2D,EAAE,EAAE;QACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACzC,YAAY,EAAE,EACd;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI;oBAC/B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;SACF,EACD,0BAA0B,CAC3B,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAwB,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAC1C,YAAY,EAAE,EACd,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EACvD,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,8BAA8B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/hooks/useCivitaiNavigate.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Requests a navigation within civitai.com. The host mediates — `target:
+ * "current"` navigates the parent frame; `"new_tab"` opens a new tab (which
+ * requires `allow-popups-to-escape-sandbox` in the manifest sandbox).
+ *
+ * Fire-and-forget: the host doesn't reply with confirmation.
+ */
+export declare function useCivitaiNavigate(): {
+    navigate: (path: string, target?: 'current' | 'new_tab') => void;
+};
+//# sourceMappingURL=useCivitaiNavigate.d.ts.map

package/dist/hooks/useCivitaiNavigate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCivitaiNavigate.d.ts","sourceRoot":"","sources":["../../src/hooks/useCivitaiNavigate.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI;IACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC;CAClE,CAKA"}

package/dist/hooks/useCivitaiNavigate.js

@@ -0,0 +1,16 @@
+import { useCallback } from 'react';
+import { getTransport } from '../internal/singleton.js';
+/**
+ * Requests a navigation within civitai.com. The host mediates — `target:
+ * "current"` navigates the parent frame; `"new_tab"` opens a new tab (which
+ * requires `allow-popups-to-escape-sandbox` in the manifest sandbox).
+ *
+ * Fire-and-forget: the host doesn't reply with confirmation.
+ */
+export function useCivitaiNavigate() {
+    const navigate = useCallback((path, target = 'current') => {
+        getTransport().sendMessage({ type: 'NAVIGATE', payload: { path, target } });
+    }, []);
+    return { navigate };
+}
+//# sourceMappingURL=useCivitaiNavigate.js.map

package/dist/hooks/useCivitaiNavigate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCivitaiNavigate.js","sourceRoot":"","sources":["../../src/hooks/useCivitaiNavigate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAGhC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,IAAY,EAAE,SAAgC,SAAS,EAAE,EAAE;QACvF,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `@civitai/blocks-react` — React hooks + iframe transport for Civitai App Blocks.
+ *
+ * Pair with `@civitai/app-sdk/blocks` (framework-agnostic contract). Hooks
+ * land in a follow-up commit; this commit ships the transport layer so the
+ * platform side can integration-test against a real iframe receiver.
+ */
+export { IframeTransport } from './internal/iframeTransport.js';
+export type { IframeTransportOptions } from './internal/iframeTransport.js';
+export { InlineTransport } from './internal/inlineTransport.js';
+export { BlockTransportDetector, readAllowedOriginsFromEnv } from './internal/detector.js';
+export type { DetectOptions } from './internal/detector.js';
+export { getTransport } from './internal/singleton.js';
+export { sendTypedRequest } from './internal/transport.js';
+export type { BlockSnapshot, BlockTransport, OutboundRequest, } from './internal/transport.js';
+export { useBlockContext } from './hooks/useBlockContext.js';
+export { useBlockSettings } from './hooks/useBlockSettings.js';
+export { useBlockToken } from './hooks/useBlockToken.js';
+export { useBuzzWorkflow } from './hooks/useBuzzWorkflow.js';
+export { useBlockResize } from './hooks/useBlockResize.js';
+export { useBuzzPurchase } from './hooks/useBuzzPurchase.js';
+export { useCheckpointPicker } from './hooks/useCheckpointPicker.js';
+export { useCivitaiNavigate } from './hooks/useCivitaiNavigate.js';
+export { useBlockAnalytics } from './hooks/useBlockAnalytics.js';
+export { useAppStorage } from './hooks/useAppStorage.js';
+export type { AppStorageKeyEntry, AppStorageListResult, AppStorageQuota, UseAppStorage, } from './hooks/useAppStorage.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EACV,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -0,0 +1,24 @@
+/**
+ * `@civitai/blocks-react` — React hooks + iframe transport for Civitai App Blocks.
+ *
+ * Pair with `@civitai/app-sdk/blocks` (framework-agnostic contract). Hooks
+ * land in a follow-up commit; this commit ships the transport layer so the
+ * platform side can integration-test against a real iframe receiver.
+ */
+export { IframeTransport } from './internal/iframeTransport.js';
+export { InlineTransport } from './internal/inlineTransport.js';
+export { BlockTransportDetector, readAllowedOriginsFromEnv } from './internal/detector.js';
+export { getTransport } from './internal/singleton.js';
+export { sendTypedRequest } from './internal/transport.js';
+// Hooks
+export { useBlockContext } from './hooks/useBlockContext.js';
+export { useBlockSettings } from './hooks/useBlockSettings.js';
+export { useBlockToken } from './hooks/useBlockToken.js';
+export { useBuzzWorkflow } from './hooks/useBuzzWorkflow.js';
+export { useBlockResize } from './hooks/useBlockResize.js';
+export { useBuzzPurchase } from './hooks/useBuzzPurchase.js';
+export { useCheckpointPicker } from './hooks/useCheckpointPicker.js';
+export { useCivitaiNavigate } from './hooks/useCivitaiNavigate.js';
+export { useBlockAnalytics } from './hooks/useBlockAnalytics.js';
+export { useAppStorage } from './hooks/useAppStorage.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAG3F,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,QAAQ;AACR,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/internal/detector.d.ts

@@ -0,0 +1,31 @@
+import type { BlockTransport } from './transport.js';
+/**
+ * Reads the comma-separated allowlist from the build-time env. The block app
+ * sets this at bundling time; the transport refuses to mount without at
+ * least one origin.
+ *
+ * Supported env vars (first match wins):
+ * - `VITE_BLOCK_ALLOWED_PARENT_ORIGINS` (Vite, the PWA starters)
+ * - `NEXT_PUBLIC_BLOCK_ALLOWED_PARENT_ORIGINS` (Next.js)
+ * - `PUBLIC_BLOCK_ALLOWED_PARENT_ORIGINS` (SvelteKit)
+ *
+ * In tests / SSR where no env is present, callers should pass
+ * `detect({ allowedParentOrigins })` explicitly.
+ */
+export declare function readAllowedOriginsFromEnv(): string[];
+export interface DetectOptions {
+    /** Override the env-derived allowlist. Required for tests and inline-mode dev. */
+    allowedParentOrigins?: string[];
+    /** Override `globalThis.window`. Tests use this with `happy-dom`'s window. */
+    window?: Window;
+}
+/**
+ * Returns the right transport for the current runtime.
+ *
+ * - `window.__CIVITAI_BLOCK_CONTEXT__` present → `InlineTransport` (v2)
+ * - otherwise → `IframeTransport`
+ */
+export declare const BlockTransportDetector: {
+    detect(opts?: DetectOptions): BlockTransport;
+};
+//# sourceMappingURL=detector.d.ts.map

package/dist/internal/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/internal/detector.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,EAAE,CAWpD;AAqBD,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;kBACpB,aAAa,GAAQ,cAAc;CAQjD,CAAC"}

package/dist/internal/detector.js

@@ -0,0 +1,67 @@
+import { IframeTransport } from './iframeTransport.js';
+import { InlineTransport } from './inlineTransport.js';
+/**
+ * Reads the comma-separated allowlist from the build-time env. The block app
+ * sets this at bundling time; the transport refuses to mount without at
+ * least one origin.
+ *
+ * Supported env vars (first match wins):
+ * - `VITE_BLOCK_ALLOWED_PARENT_ORIGINS` (Vite, the PWA starters)
+ * - `NEXT_PUBLIC_BLOCK_ALLOWED_PARENT_ORIGINS` (Next.js)
+ * - `PUBLIC_BLOCK_ALLOWED_PARENT_ORIGINS` (SvelteKit)
+ *
+ * In tests / SSR where no env is present, callers should pass
+ * `detect({ allowedParentOrigins })` explicitly.
+ */
+export function readAllowedOriginsFromEnv() {
+    const candidates = [
+        readEnv('VITE_BLOCK_ALLOWED_PARENT_ORIGINS'),
+        readEnv('NEXT_PUBLIC_BLOCK_ALLOWED_PARENT_ORIGINS'),
+        readEnv('PUBLIC_BLOCK_ALLOWED_PARENT_ORIGINS'),
+    ].filter((v) => !!v);
+    if (!candidates.length)
+        return [];
+    return candidates[0]
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function readEnv(key) {
+    // Vite injects import.meta.env at build time; Node exposes process.env.
+    // Read each independently, swallowing access errors (e.g. process undefined in browser).
+    try {
+        const fromImportMeta = import.meta.env?.[key];
+        if (fromImportMeta)
+            return fromImportMeta;
+    }
+    catch {
+        /* ignore */
+    }
+    try {
+        const fromProcess = globalThis
+            .process?.env?.[key];
+        if (fromProcess)
+            return fromProcess;
+    }
+    catch {
+        /* ignore */
+    }
+    return undefined;
+}
+/**
+ * Returns the right transport for the current runtime.
+ *
+ * - `window.__CIVITAI_BLOCK_CONTEXT__` present → `InlineTransport` (v2)
+ * - otherwise → `IframeTransport`
+ */
+export const BlockTransportDetector = {
+    detect(opts = {}) {
+        const win = opts.window ?? globalThis.window;
+        if (win?.__CIVITAI_BLOCK_CONTEXT__) {
+            return new InlineTransport();
+        }
+        const allowedParentOrigins = opts.allowedParentOrigins ?? readAllowedOriginsFromEnv();
+        return new IframeTransport({ allowedParentOrigins, window: opts.window });
+    },
+};
+//# sourceMappingURL=detector.js.map

package/dist/internal/detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/internal/detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,mCAAmC,CAAC;QAC5C,OAAO,CAAC,0CAA0C,CAAC;QACnD,OAAO,CAAC,qCAAqC,CAAC;KAC/C,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,UAAU,CAAC,CAAC,CAAE;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,wEAAwE;IACxE,yFAAyF;IACzF,IAAI,CAAC;QACH,MAAM,cAAc,GAAI,MAAM,CAAC,IAAqD,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAI,UAAyE;aAC3F,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,MAAM,CAAC,OAAsB,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAK,UAAkC,CAAC,MAAM,CAAC;QACtE,IAAI,GAAG,EAAE,yBAAyB,EAAE,CAAC;YACnC,OAAO,IAAI,eAAe,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,IAAI,yBAAyB,EAAE,CAAC;QACtF,OAAO,IAAI,eAAe,CAAC,EAAE,oBAAoB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;CACF,CAAC"}

package/dist/internal/iframeTransport.d.ts

@@ -0,0 +1,55 @@
+import { type BlockInitPayload, type BlockToParentMessage, type ParentToBlockMessageType } from '@civitai/app-sdk/blocks';
+import { type BlockSnapshot, type BlockTransport, type OutboundRequest } from './transport.js';
+export interface IframeTransportOptions {
+    /**
+     * Origins from which `BLOCK_INIT` (and any other inbound message) is
+     * accepted. MUST contain at least one entry. Messages from any other
+     * origin — including the local origin — are dropped silently.
+     *
+     * Typically wired from `import.meta.env.VITE_BLOCK_ALLOWED_PARENT_ORIGINS`
+     * (or the framework's equivalent) at block-app startup.
+     */
+    allowedParentOrigins: string[];
+    /** Override for tests / SSR. Defaults to `globalThis.window`. */
+    window?: Window;
+}
+/**
+ * Iframe-mode transport. Validates `event.origin` on every inbound message,
+ * awaits `BLOCK_INIT` with a 10s timeout (after which `waitForInit` rejects
+ * — the host shows a fallback), queues outbound messages until init, and
+ * correlates request/response pairs by `requestId`.
+ */
+export declare class IframeTransport implements BlockTransport {
+    private readonly allowedOrigins;
+    private readonly window;
+    private snapshot;
+    private readonly listeners;
+    /** Origin of the parent — captured from the first valid `BLOCK_INIT`. */
+    private parentOrigin;
+    /** Messages queued before `BLOCK_INIT` lands. Flushed in arrival order. */
+    private readonly outbound;
+    private readonly pending;
+    private readonly initPromise;
+    private resolveInit;
+    private rejectInit;
+    private initTimeoutId;
+    private initResolved;
+    private readonly messageListener;
+    constructor(opts: IframeTransportOptions);
+    getSnapshot(): BlockSnapshot;
+    subscribe(listener: () => void): () => void;
+    waitForInit(): Promise<BlockInitPayload>;
+    sendMessage(message: BlockToParentMessage): void;
+    sendRequest(request: OutboundRequest, responseType: ParentToBlockMessageType, opts?: {
+        timeoutMs?: number;
+    }): Promise<unknown>;
+    /** Test-only: tear down listeners + reject pending. */
+    dispose(): void;
+    private dispatch;
+    private flushOutbound;
+    private postToParent;
+    private handleMessage;
+    private applyTokenRefresh;
+    private emit;
+}
+//# sourceMappingURL=iframeTransport.d.ts.map

package/dist/internal/iframeTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframeTransport.d.ts","sourceRoot":"","sources":["../../src/internal/iframeTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAQxB,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,cAAc;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,yEAAyE;IACzE,OAAO,CAAC,YAAY,CAAuB;IAE3C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,YAAY,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;gBAEpD,IAAI,EAAE,sBAAsB;IAiCxC,WAAW,IAAI,aAAa;IAI5B,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAIxC,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAIhD,WAAW,CACT,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,wBAAwB,EACtC,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChC,OAAO,CAAC,OAAO,CAAC;IAmBnB,uDAAuD;IACvD,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,aAAa;IAkFrB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,IAAI;CAGb"}

package/dist/internal/iframeTransport.js

@@ -0,0 +1,200 @@
+import { isMessage, } from '@civitai/app-sdk/blocks';
+import { EMPTY_SNAPSHOT, nextRequestId, snapshotFromInit, tokenFromWrapped, } from './transport.js';
+import { payloadValidatorFor } from './validate.js';
+const INIT_TIMEOUT_MS = 10_000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+/**
+ * Iframe-mode transport. Validates `event.origin` on every inbound message,
+ * awaits `BLOCK_INIT` with a 10s timeout (after which `waitForInit` rejects
+ * — the host shows a fallback), queues outbound messages until init, and
+ * correlates request/response pairs by `requestId`.
+ */
+export class IframeTransport {
+    allowedOrigins;
+    window;
+    snapshot = EMPTY_SNAPSHOT;
+    listeners = new Set();
+    /** Origin of the parent — captured from the first valid `BLOCK_INIT`. */
+    parentOrigin = null;
+    /** Messages queued before `BLOCK_INIT` lands. Flushed in arrival order. */
+    outbound = [];
+    pending = new Map();
+    initPromise;
+    resolveInit;
+    rejectInit;
+    initTimeoutId;
+    initResolved = false;
+    messageListener;
+    constructor(opts) {
+        if (!opts.allowedParentOrigins.length) {
+            throw new Error('IframeTransport: allowedParentOrigins must contain at least one entry. ' +
+                'Configure NEXT_PUBLIC_BLOCK_ALLOWED_PARENT_ORIGINS (or the framework equivalent).');
+        }
+        this.allowedOrigins = new Set(opts.allowedParentOrigins);
+        this.window = opts.window ?? globalThis.window;
+        if (!this.window) {
+            throw new Error('IframeTransport: no window available; cannot mount on the server.');
+        }
+        this.initPromise = new Promise((resolve, reject) => {
+            this.resolveInit = resolve;
+            this.rejectInit = reject;
+        });
+        this.initTimeoutId = setTimeout(() => {
+            if (!this.initResolved) {
+                this.initResolved = true;
+                this.rejectInit(new Error(`IframeTransport: timed out waiting for BLOCK_INIT after ${INIT_TIMEOUT_MS}ms. ` +
+                    'Verify the host frame is sending the init message and that its origin is in allowedParentOrigins.'));
+            }
+        }, INIT_TIMEOUT_MS);
+        this.messageListener = (event) => this.handleMessage(event);
+        this.window.addEventListener('message', this.messageListener);
+    }
+    getSnapshot() {
+        return this.snapshot;
+    }
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    waitForInit() {
+        return this.initPromise;
+    }
+    sendMessage(message) {
+        this.dispatch(message.type, message.payload);
+    }
+    sendRequest(request, responseType, opts = {}) {
+        const requestId = nextRequestId();
+        const timeoutMs = opts.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+        return new Promise((resolve, reject) => {
+            const timeoutId = setTimeout(() => {
+                if (this.pending.delete(requestId)) {
+                    reject(new Error(`IframeTransport: request "${request.type}" timed out after ${timeoutMs}ms`));
+                }
+            }, timeoutMs);
+            this.pending.set(requestId, {
+                resolve,
+                reject,
+                timeoutId,
+                responseType,
+            });
+            this.dispatch(request.type, { ...request.payload, requestId });
+        });
+    }
+    /** Test-only: tear down listeners + reject pending. */
+    dispose() {
+        this.window.removeEventListener('message', this.messageListener);
+        clearTimeout(this.initTimeoutId);
+        for (const pending of this.pending.values()) {
+            clearTimeout(pending.timeoutId);
+            pending.reject(new Error('IframeTransport disposed'));
+        }
+        this.pending.clear();
+        this.listeners.clear();
+    }
+    dispatch(type, payload) {
+        if (!this.parentOrigin) {
+            this.outbound.push({ type, payload });
+            return;
+        }
+        this.postToParent({ type, payload });
+    }
+    flushOutbound() {
+        while (this.outbound.length) {
+            const msg = this.outbound.shift();
+            this.postToParent(msg);
+        }
+    }
+    postToParent(msg) {
+        // `parentOrigin` is captured from a validated BLOCK_INIT; safe to use as targetOrigin.
+        this.window.parent.postMessage(msg, this.parentOrigin);
+    }
+    handleMessage(event) {
+        if (!this.allowedOrigins.has(event.origin))
+            return;
+        const data = event.data;
+        if (data == null || typeof data !== 'object' || typeof data.type !== 'string')
+            return;
+        // Trust-boundary shape check. `isMessage` only narrows on `type`;
+        // anything that reaches state-mutating code below must pass the
+        // payload validator for its type. Failures drop with a console.warn
+        // rather than crash — see ./validate.ts.
+        const validator = payloadValidatorFor(data.type);
+        if (validator && !validator(data.payload)) {
+            // eslint-disable-next-line no-console -- developer-facing diagnostic at a trust boundary
+            console.warn(`IframeTransport: dropping malformed "${data.type}" message from ${event.origin}`);
+            return;
+        }
+        if (isMessage(data, 'BLOCK_INIT')) {
+            if (!this.initResolved) {
+                this.initResolved = true;
+                clearTimeout(this.initTimeoutId);
+                this.parentOrigin = event.origin;
+                this.snapshot = snapshotFromInit(data.payload);
+                this.emit();
+                this.flushOutbound();
+                // Auto-send BLOCK_READY so the platform's 10-second ready timeout
+                // doesn't trigger a fallback. We send height: 0 as a placeholder;
+                // useBlockResize takes over with real measurements as soon as the
+                // block's root element mounts. Queued because the iframe's React
+                // tree hasn't rendered yet at this point — the postMessage goes
+                // out on the next microtask via the standard dispatch path.
+                this.dispatch('BLOCK_READY', { height: 0 });
+                this.resolveInit(data.payload);
+            }
+            return;
+        }
+        // Host-pushed token rotation (no requestId). Always apply to the
+        // snapshot; never matches a pending request.
+        if (isMessage(data, 'TOKEN_REFRESH')) {
+            this.applyTokenRefresh(data.payload.token);
+            return;
+        }
+        // For request/response replies, look up the pending entry by `requestId`.
+        const payload = data.payload;
+        let pending;
+        let matchedRequestId = null;
+        if (payload && typeof payload.requestId === 'string') {
+            const candidate = this.pending.get(payload.requestId);
+            if (candidate && candidate.responseType === data.type) {
+                pending = candidate;
+                matchedRequestId = payload.requestId;
+            }
+        }
+        // TOKEN_REFRESH_RESPONSE updates the snapshot whether or not the
+        // requestId matched a pending entry — the platform's IframeHost.tsx
+        // can answer with an empty requestId on its own schedule. Apply
+        // BEFORE resolving so awaiting code (and the useBlockToken effect
+        // re-firing on token.expiresAt) sees the new value.
+        if (isMessage(data, 'TOKEN_REFRESH_RESPONSE')) {
+            this.applyTokenRefresh(data.payload.token);
+        }
+        if (pending && matchedRequestId !== null) {
+            clearTimeout(pending.timeoutId);
+            this.pending.delete(matchedRequestId);
+            pending.resolve(payload);
+            return;
+        }
+        if (isMessage(data, 'SUSPEND')) {
+            // Reserved for future lifecycle hooks; no-op in v1.
+            return;
+        }
+        if (isMessage(data, 'RESUME')) {
+            return;
+        }
+    }
+    applyTokenRefresh(wrapped) {
+        // Replace the whole token — scopes and buzzBudget can change at refresh
+        // time (e.g. a manifest update altered the buzz budget). Carrying the
+        // wrapped value end-to-end avoids the bug class where the snapshot's
+        // expiresAt updated but scopes stayed stale.
+        this.snapshot = { ...this.snapshot, token: tokenFromWrapped(wrapped) };
+        this.emit();
+    }
+    emit() {
+        for (const listener of this.listeners)
+            listener();
+    }
+}
+//# sourceMappingURL=iframeTransport.js.map

package/dist/internal/iframeTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframeTransport.js","sourceRoot":"","sources":["../../src/internal/iframeTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAKV,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,gBAAgB,GAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAIpD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAuB1C;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACT,cAAc,CAAsB;IACpC,MAAM,CAAS;IAExB,QAAQ,GAAkB,cAAc,CAAC;IAChC,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAEnD,yEAAyE;IACjE,YAAY,GAAkB,IAAI,CAAC;IAE3C,2EAA2E;IAC1D,QAAQ,GAA8C,EAAE,CAAC;IACzD,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE5C,WAAW,CAA4B;IAChD,WAAW,CAAuC;IAClD,UAAU,CAAwB;IAClC,aAAa,CAAgC;IAC7C,YAAY,GAAG,KAAK,CAAC;IAEZ,eAAe,CAAgC;IAEhE,YAAY,IAA4B;QACtC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,mFAAmF,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAK,UAAkC,CAAC,MAAO,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;YAC3B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,UAAU,CACb,IAAI,KAAK,CACP,2DAA2D,eAAe,MAAM;oBAC9E,mGAAmG,CACtG,CACF,CAAC;YACJ,CAAC;QACH,CAAC,EAAE,eAAe,CAAC,CAAC;QAEpB,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,SAAS,CAAC,QAAoB;QAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,WAAW,CAAC,OAA6B;QACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,WAAW,CACT,OAAwB,EACxB,YAAsC,EACtC,OAA+B,EAAE;QAEjC,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,0BAA0B,CAAC;QAC/D,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,IAAI,qBAAqB,SAAS,IAAI,CAAC,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC1B,OAAO;gBACP,MAAM;gBACN,SAAS;gBACT,YAAY;aACb,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,OAAO;QACL,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACjE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,OAAgB;QAC7C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAuC;QAC1D,uFAAuF;QACvF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,YAAa,CAAC,CAAC;IAC1D,CAAC;IAEO,aAAa,CAAC,KAAmB;QACvC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAA6C,CAAC;QACjE,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAEtF,kEAAkE;QAClE,gEAAgE;QAChE,oEAAoE;QACpE,yCAAyC;QACzC,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,yFAAyF;YACzF,OAAO,CAAC,IAAI,CACV,wCAAwC,IAAI,CAAC,IAAI,kBAAkB,KAAK,CAAC,MAAM,EAAE,CAClF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,SAAS,CAAqC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACjC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;gBACjC,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrB,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,iEAAiE;gBACjE,gEAAgE;gBAChE,4DAA4D;gBAC5D,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;YACD,OAAO;QACT,CAAC;QAED,iEAAiE;QACjE,6CAA6C;QAC7C,IAAI,SAAS,CAAwC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,OAA8C,CAAC;QACpE,IAAI,OAAmC,CAAC;QACxC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAC3C,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,SAAS,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtD,OAAO,GAAG,SAAS,CAAC;gBACpB,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;YACvC,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,oDAAoD;QACpD,IAAI,SAAS,CAAiD,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;YAC9F,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,OAAO,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACzC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACtC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,SAAS,CAAkC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YAChE,oDAAoD;YACpD,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAiC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,OAAqB;QAC7C,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/internal/inlineTransport.d.ts

@@ -0,0 +1,18 @@
+import type { BlockToParentMessage, ParentToBlockMessageType } from '@civitai/app-sdk/blocks';
+import { type BlockSnapshot, type BlockTransport, type OutboundRequest } from './transport.js';
+declare global {
+    interface Window {
+        __CIVITAI_BLOCK_CONTEXT__?: import('@civitai/app-sdk/blocks').BlockInitPayload;
+    }
+}
+export declare class InlineTransport implements BlockTransport {
+    private snapshot;
+    constructor();
+    getSnapshot(): BlockSnapshot;
+    subscribe(_listener: () => void): () => void;
+    sendMessage(_message: BlockToParentMessage): void;
+    sendRequest(_request: OutboundRequest, _responseType: ParentToBlockMessageType, _opts?: {
+        timeoutMs?: number;
+    }): Promise<unknown>;
+}
+//# sourceMappingURL=inlineTransport.d.ts.map

package/dist/internal/inlineTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inlineTransport.d.ts","sourceRoot":"","sources":["../../src/internal/inlineTransport.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,yBAAyB,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAC;KAChF;CACF;AAED,qBAAa,eAAgB,YAAW,cAAc;IACpD,OAAO,CAAC,QAAQ,CAAgB;;IAOhC,WAAW,IAAI,aAAa;IAI5B,SAAS,CAAC,SAAS,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAI5C,WAAW,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI;IAIjD,WAAW,CACT,QAAQ,EAAE,eAAe,EACzB,aAAa,EAAE,wBAAwB,EACvC,KAAK,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,OAAO,CAAC;CAGpB"}

package/dist/internal/inlineTransport.js

@@ -0,0 +1,36 @@
+// v2 stub. Reads bootstrap state from `window.__CIVITAI_BLOCK_CONTEXT__`;
+// not wired to any real platform path in v1. Lives here so `BlockTransportDetector`
+// can branch and so the public hook surface is identical between modes.
+//
+// Intentionally minimal: tests verify only that the detector picks this when
+// bootstrap is present. The full implementation lands with v2 inline mode.
+//
+// TODO(v2 trust boundary): inline mode currently reads the bootstrap object
+// directly from the host's window without origin or shape validation — the
+// equivalent of `IframeTransport`'s `allowedParentOrigins` + `payloadValidatorFor`
+// gates. v1 impact is bounded because `sendMessage` / `sendRequest` are no-ops
+// here, but the v2 implementation must add an equivalent trust boundary
+// (e.g. validate the bootstrap shape with `isValidBlockInitPayload` from
+// `./validate.ts` before constructing the snapshot, and document any
+// host-cooperation contract that takes the place of origin allowlisting).
+import { EMPTY_SNAPSHOT, snapshotFromInit, } from './transport.js';
+export class InlineTransport {
+    snapshot;
+    constructor() {
+        const bootstrap = globalThis.window?.__CIVITAI_BLOCK_CONTEXT__;
+        this.snapshot = bootstrap ? snapshotFromInit(bootstrap) : EMPTY_SNAPSHOT;
+    }
+    getSnapshot() {
+        return this.snapshot;
+    }
+    subscribe(_listener) {
+        return () => { };
+    }
+    sendMessage(_message) {
+        // v2 will invoke platform APIs directly; intentional no-op in v1.
+    }
+    sendRequest(_request, _responseType, _opts) {
+        return Promise.reject(new Error('InlineTransport.sendRequest is not implemented in v1'));
+    }
+}
+//# sourceMappingURL=inlineTransport.js.map

package/dist/internal/inlineTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inlineTransport.js","sourceRoot":"","sources":["../../src/internal/inlineTransport.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,oFAAoF;AACpF,wEAAwE;AACxE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,mFAAmF;AACnF,+EAA+E;AAC/E,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,0EAA0E;AAO1E,OAAO,EACL,cAAc,EACd,gBAAgB,GAIjB,MAAM,gBAAgB,CAAC;AAQxB,MAAM,OAAO,eAAe;IAClB,QAAQ,CAAgB;IAEhC;QACE,MAAM,SAAS,GAAI,UAAkC,CAAC,MAAM,EAAE,yBAAyB,CAAC;QACxF,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,SAAS,CAAC,SAAqB;QAC7B,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;IAED,WAAW,CAAC,QAA8B;QACxC,kEAAkE;IACpE,CAAC;IAED,WAAW,CACT,QAAyB,EACzB,aAAuC,EACvC,KAA8B;QAE9B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF"}