@civitai/blocks-react 0.53.0 → 0.54.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/blocks-react",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "React hooks and iframe transport for Civitai Apps. Pairs with @civitai/app-sdk/blocks.",
   "license": "MIT",
   "type": "module",
@@ -38,47 +38,76 @@
     "The @civitai/app-sdk floor is DERIVED, not chosen: it is the lowest published",
     "version that exports every symbol this package imports from the peer.",
     "",
-    "🔴 RAISED 0.40.0 -> 0.45.0 when this package began importing two NEW peer VALUE",
-    "symbols -- `boundBlockToParentMessageType` and `OTHER_MESSAGE_TYPE_LABEL`, used by",
-    "`internal/iframeTransport.ts` to bound the `BLOCK_MESSAGE_REJECTED` label. Both",
-    "ship for the first time in the app-sdk minor released alongside this change, so",
-    "0.45.0 is not a margin: it is the first version that has them. Measured against",
-    "the then-latest published 0.44.0 -- which SATISFIED the old range -- both are",
-    "absent from every subpath, and the failure is not a type error: `dist/index.js`",
-    "re-exports `IframeTransport`, so the package's MAIN ENTRY is in the failing module",
-    "graph and the block does not boot at all. Caught by an adversarial audit that",
-    "built the dist and resolved it, not by any gate; the paragraph below says why no",
-    "gate can. Step 4's positive control was run (a symbol that cannot exist reported",
-    "as absent), so the zero for the other symbols is a measurement and not a silent",
-    "pass.",
+    "🔴 RAISED 0.45.0 -> 0.47.0 (THE THIRD TIME THIS CLASS HAS BITTEN: #309, then",
+    "#317 caught it in review, then this) when `internal/mockHost.ts` began importing",
+    "three NEW peer VALUE symbols -- `APP_STORAGE_MAX_BYTES`, `APP_STORAGE_MAX_ROWS`",
+    "and `APP_STORAGE_MAX_VALUE_BYTES`, the App Storage ceilings, which it assigns to",
+    "its mock storage defaults. All three ship for the first time in the app-sdk minor",
+    "released alongside this change.",
     "",
-    "⚠️ 0.45.0 IS A PREDICTION ABOUT RELEASE ORDERING, NOT A MEASURED VERSION. It is",
-    "what the pending minor changeset publishes ONCE THIS BRANCH IS ON TOP OF a main",
-    "where app-sdk is already 0.44.0 and the catalog changeset has been consumed. If",
-    "another minor releases FIRST, the two symbols ship in 0.46.0 while 0.45.0",
-    "publishes WITHOUT them and SATISFIES this range -- #309's shape exactly, the one",
-    "this floor exists to close.",
+    "HOW 0.47.0 WAS DERIVED (computed, not predicted from release ordering):",
+    "  - in-tree `packages/civitai-app-sdk/package.json` is 0.46.0, and 0.46.0 is also",
+    "    `npm view @civitai/app-sdk version` -- the tree is at the last published",
+    "    version, so nothing is mid-flight.",
+    "  - the pending changeset set is exactly ONE file, `.changeset/",
+    "    app-storage-real-ceilings-2026-09-19.md`, declaring `@civitai/app-sdk: minor`;",
+    "    `git ls-tree -r origin/main .changeset/` shows main carries no others.",
+    "  - `pnpm exec changeset status --verbose` on this branch prints",
+    "    `@civitai/app-sdk 0.47.0` (and `@civitai/blocks-react 0.54.0`). That is the",
+    "    tool that will actually run, answering with the number it will actually write.",
     "",
-    "🔴 AND `changeset version` WILL REWRITE THIS RANGE DOWNWARD IF IT RUNS TOO EARLY.",
-    "An earlier revision of this note said onlyUpdatePeerDependentsWhenOutOfRange",
-    "'guarantees changeset version will not correct it'. That is BACKWARDS, and it is",
-    "measured: run on this branch as it stands (app-sdk 0.43.0 in-tree, the catalog",
-    "changeset still present, so app-sdk computes to 0.44.0), `changeset version`",
-    "rewrites `>=0.45.0 <1.0.0` to `>=0.44.0` -- it LOWERS the floor to the exact",
-    "version that lacks the symbols AND drops the upper bound. The flag rewrites a",
-    "peer range precisely when the computed version falls OUT of it. Post-merge it",
-    "computes 0.45.0 and leaves the range alone, which is why this is not a live",
-    "defect -- but never run `changeset version` on this branch before rebasing, and",
-    "re-read the range afterwards rather than trusting the flag to protect it.",
+    "MEASURED, both directions, against the REAL tarballs (not the workspace copy):",
+    "  - published 0.46.0 -- which the OLD `>=0.45.0` range SATISFIED, installing with",
+    "    no peer warning at all -- does not export any of the three. `node -e` on a",
+    "    scratch `npm i @civitai/app-sdk@0.46.0`:",
+    "      SyntaxError: The requested module '@civitai/app-sdk/blocks'",
+    "        does not provide an export named 'APP_STORAGE_MAX_BYTES'",
+    "    Controls were run BOTH ways before believing that zero: an impossible symbol",
+    "    reported absent (the probe can go red) and `BrowsingLevel`/`SFW_LEVELS`",
+    "    resolved (the probe can see a symbol that IS there).",
+    "  - blast radius is the `./testing` subpath ONLY, and that is measured too, by",
+    "    `pnpm pack`ing this package and importing both entries against 0.46.0:",
+    "    `@civitai/blocks-react` resolved 61 exports fine; `@civitai/blocks-react/",
+    "    testing` threw the SyntaxError above out of `dist/internal/mockHost.js`.",
+    "    `src/testing.tsx` reaches `mockHost`, `src/index.ts` does not -- so the block",
+    "    boots and every dev harness and downstream test suite dies instead.",
+    "  - with the floor at 0.47.0, that same install is refused: npm reports",
+    "    ERESOLVE against `@civitai/app-sdk@0.46.0`.",
+    "",
+    "⚠️ THE RESIDUAL RISK IS RELEASE ORDERING, AND IT IS NOT REMOVABLE FROM HERE.",
+    "0.47.0 is the version THIS changeset publishes from THIS base. If another app-sdk",
+    "minor merges and publishes before this PR does, 0.47.0 ships WITHOUT the",
+    "constants, this changeset publishes 0.48.0, and this range admits a broken",
+    "version -- #309's shape exactly. So: RE-RUN `changeset status --verbose` after any",
+    "rebase onto a moved main, and re-read this range. The number here is a",
+    "measurement of a base, and a rebase invalidates the base.",
+    "",
+    "🔴 `changeset version` WILL NOT FIX A STALE FLOOR -- IT IS NOT A BACKSTOP.",
+    "`.changeset/config.json` sets `onlyUpdatePeerDependentsWhenOutOfRange: true`, so a",
+    "peer range is rewritten ONLY when the computed version falls OUT of it. A floor",
+    "that is too LOW is, by construction, still satisfied -- so it is left exactly as",
+    "it is and ships stale. (The flag does bite in the other direction, which an",
+    "earlier note recorded: run before a rebase, when the computed version is BELOW the",
+    "declared floor, it rewrites the range DOWNWARD and drops the upper bound. Both",
+    "readings say the same thing -- never let this number be the flag's problem.)",
     "",
     "🔴 A PEER RANGE IS METADATA AND NOTHING CHECKS IT AGAINST THE CODE. 0.49.0-0.51.0",
     "declared >=0.29.0 while importing `effectiveBrowsingCeiling` (app-sdk 0.39.0) and",
     "the create-post types (0.40.0). The range was SATISFIED, so no install warned;",
     "the failure landed at module evaluation in a consumer's tests, where 27 of 43",
     "test files collected ZERO tests -- 292 tests stopped running and the summary line",
-    "reported no failures. See #309. CI cannot catch this: `pnpm.overrides` maps the",
-    "peer to the workspace copy, so every in-repo typecheck is blind to whatever this",
-    "range says.",
+    "reported no failures. See #309. NO BUILD OR TYPECHECK CAN CATCH THIS:",
+    "`pnpm.overrides` maps the peer to the workspace copy, so every in-repo typecheck,",
+    "test and build resolves the symbol from `packages/civitai-app-sdk` and is",
+    "structurally blind to whatever this range says.",
+    "",
+    "🔴 SINCE #344 ONE GATE DOES SEE PART OF IT: `tests/guards/",
+    "blocks-react-peer-floor.test.mjs` fails when this range admits an app-sdk version",
+    "measured NOT to export the App Storage constants, and when the derivation below",
+    "stops being recorded here. Read its KNOWN LIMITS before relying on it -- CI checks",
+    "out at `fetch-depth: 1` and the guard job has no registry access, so it is",
+    "offline and tree-local: it re-asserts a measurement taken by hand, it does not",
+    "take one. The steps below are still the only way to MAKE the measurement.",
     "",
     "🔴 AND #309'S OWN SUGGESTED FLOOR (>=0.39.0) WAS WRONG. `effectiveBrowsingCeiling`",
     "arrives in 0.39.0, but `BlockCreatePostRequest`, `BlockCreatePostResult`,",
@@ -89,8 +118,10 @@
     "TO RE-DERIVE IT (do this when this package starts importing a new peer symbol):",
     "  1. collect the symbols -- every named `import`/`export … from '@civitai/app-sdk*'`",
     "     clause in src/, plus bare and star forms, which name a SUBPATH and no symbols",
-    "     but still have to resolve. At the time of writing: 62 symbols, 2 subpaths",
-    "     ('/blocks' and '/safe-storage').",
+    "     but still have to resolve. Measured at #344: 64 distinct symbols over 2",
+    "     subpaths ('/blocks' and '/safe-storage'), counting unique names across every",
+    "     named import clause in src/**/*.ts{,x}. An earlier derivation recorded 62;",
+    "     re-count rather than trusting either figure.",
     "  2. in a scratch dir OUTSIDE this workspace (pnpm would resolve the peer to the",
     "     workspace copy and measure nothing), `npm i @civitai/app-sdk@<version>` and",
     "     typecheck a file importing all of them -- each in the POSITION it is imported",
@@ -107,7 +138,7 @@
     "the tool was the expensive half."
   ],
   "peerDependencies": {
-    "@civitai/app-sdk": ">=0.45.0 <1.0.0",
+    "@civitai/app-sdk": ">=0.47.0 <1.0.0",
     "react": "^18.0.0 || ^19.0.0"
   },
   "devDependencies": {
@@ -122,7 +153,7 @@
     "react-dom": "^19.0.0",
     "typescript": "^5.9.2",
     "vitest": "^4.1.11",
-    "@civitai/app-sdk": "^0.45.0"
+    "@civitai/app-sdk": "^0.47.0"
   },
   "publishConfig": {
     "access": "public"