@civitai/blocks-react 0.53.1 → 0.55.0

package/README.md

@@ -27,7 +27,7 @@ your block app and the SDK share a single React tree.
 import { useRef } from 'react';
 import { useBlockContext, useBlockResize, useBuzzWorkflow } from '@civitai/blocks-react';
 import { Button } from '@civitai/blocks-react/ui';
-import { isModelSlotContext } from '@civitai/app-sdk/blocks';
+import { isModelSlotContext, isSignedIn } from '@civitai/app-sdk/blocks';
 
 export function App() {
   const { ready, context, viewer, theme } = useBlockContext();
@@ -45,7 +45,8 @@ export function App() {
     // GOTCHA #60: set data-theme on YOUR OWN root — the host can't reach into
     // the iframe to set it. Without this any [data-theme="dark"] CSS is dormant.
     <div ref={rootRef} data-theme={theme}>
-      <p>Block for model {context.modelName} ({viewer ? 'signed in' : 'anon'})</p>
+      {/* Sign-in gate: call `isSignedIn`, never an identity read. */}
+      <p>Block for model {context.modelName} ({isSignedIn(viewer) ? 'signed in' : 'anon'})</p>
       {/* `/ui` Button — themed by the data-theme above; `loading` disables + shows a spinner */}
       <Button
         loading={status === 'submitting' || status === 'polling'}
@@ -113,7 +114,14 @@ const { ready, context, viewer, theme, settings, blockId, blockInstanceId, appId
 
 - `context` — `BlockContext` (`{ slotId, … }`); narrow to `ModelSlotContext` for
   model-page slots.
-- `viewer` — `ViewerInfo | null` (`null` = anonymous).
+- `viewer` — `ViewerInfo | null` (`null` = anonymous). **Gate sign-in with
+  `isSignedIn(viewer)`** (from `@civitai/app-sdk/blocks`), never on
+  `viewer.id`/`viewer.username` (both `@deprecated`). Don't open-code the gate:
+  the SDK owns which spelling is correct — `signedIn` is optional on the wire
+  and is the one viewer field the init validator deliberately does not reject
+  when malformed, so `isSignedIn` answers from presence instead. Hover it for
+  the full reasoning. Need the identity itself? Use
+  [`useViewer()`](#useviewer) — scope-gated and audited per call.
 - `theme` — `'light' | 'dark'`. **Set `data-theme={theme}` on your root** (gotcha #60).
   LIVE: it starts at the `BLOCK_INIT` value and then tracks the host's
   `THEME_CHANGE` push when the viewer toggles dark mode mid-session — see
@@ -684,18 +692,72 @@ async function onCancel(id: string) {
 
 ### `useAppStorage()`
 
-Per-(block instance, viewer) KV datastore, host-mediated. 64 KB per value,
-50 MB + ~1M rows per app.
+KV datastore, host-mediated. Keys are **namespaced** per (block instance,
+viewer); the byte and row **budgets** are enforced per (**app**, viewer), so
+every instance of one app shares one budget for that viewer.
 
 ```tsx
+import {
+  APP_STORAGE_MAX_VALUE_BYTES, // largest single value, in wire bytes
+  APP_STORAGE_MAX_BYTES,       // total stored bytes per (app, viewer)
+  APP_STORAGE_MAX_ROWS,        // total rows per (app, viewer)
+} from '@civitai/app-sdk/blocks';
+
 const storage = useAppStorage();
-await storage.set('key', { any: 'json' });   // throws "PAYLOAD_TOO_LARGE" over a limit
+await storage.set('key', { any: 'json' });   // rejects over ANY of the three ceilings
 const v = await storage.get<MyShape>('key'); // null if unset / anon
 await storage.delete('key');                  // idempotent
 const { keys } = await storage.list({ prefix: 'note-' });
 const quota = await storage.getQuota();       // { usedBytes, rowCount, limitBytes, limitRows }
 ```
 
+🔴 **`getQuota()` is the authority; the constants are a snapshot.** These three
+are the ceilings **as of the version of `@civitai/app-sdk` you installed** —
+compiled-in figures, which is the same frozen-number failure mode this page
+used to demonstrate, just with one copy instead of nine. The host can move a
+ceiling without your lockfile changing. So:
+
+- **Render `getQuota()`'s reply**, never a constant, anywhere a viewer sees a
+  number or a code path decides whether a write will fit.
+- **Reach for the constants only where no quota reply is available** — a
+  build-time sanity check, a test fixture, a rough design-time estimate — and
+  treat the answer as "roughly, at install time".
+- **Re-check after any SDK bump**, and expect movement: the per-viewer clamp
+  was sized against a measured distribution and the host says to expect a
+  re-measure. `appStorageLimits.ts` in `@civitai/app-sdk` carries the
+  provenance and a one-liner that re-derives the current values from the host.
+
+Never hard-code a figure of your own: the docs here used to quote the app-wide
+umbrella instead of the per-viewer clamp and were **25x** out on bytes and
+**1000x** out on rows.
+
+🔴 **The ROW ceiling is usually the binding one, and a byte-based "x of y used"
+readout will not see it coming.** A block caching one modest record per item a
+viewer touches exhausts `limitRows` while still holding a small fraction of
+`limitBytes`. Show rows too.
+
+`createMockHost()` defaults to these same ceilings and enforces the per-value
+cap, the byte budget and — since it was added — the **row** budget on write, so
+a row-limit overrun now fails under `dev:mock` where it previously passed and
+failed only in production. Pass `storage: { quotaBytes, limitRows }` to
+simulate something smaller.
+
+⚠️ The mock is **not** gate-for-gate identical to the host. Three known
+divergences:
+
+- the error string a rejection carries
+  ([#343](https://github.com/civitai/civitai-app-starters/issues/343));
+- the byte gate refusing a shrinking overwrite that the host admits
+  ([#345](https://github.com/civitai/civitai-app-starters/issues/345));
+- 🔴 the byte gate counting **wire** bytes where the host counts **stored**
+  bytes — `octet_length(value::jsonb::text)`, larger for every container, up to
+  ~1.5x ([#347](https://github.com/civitai/civitai-app-starters/issues/347)).
+
+Passing under `dev:mock` is evidence, not proof — and note the third one is
+**permissive**: unlike the other two, it lets a write pass locally that
+production will reject. Size your fixtures against `getQuota()`, not against
+what the mock accepted.
+
 ### `useSharedStorage()`
 
 App-scoped, append-only, community-votable SHARED datastore (every viewer sees
@@ -1134,6 +1196,264 @@ For non-React or advanced use, the transport primitives are exported too:
 `readAllowedOriginsFromEnv`, `getTransport`, and `sendTypedRequest`. Hooks are the
 recommended surface; reach for these only when a hook doesn't fit.
 
+## The `/testing` subexport
+
+`@civitai/blocks-react/testing` is the **host-simulation** entry point: it stands
+in for civitai.com so your block can run in `vitest`/`happy-dom` and in a local
+dev harness. It is a normal, published subpath of a `0.x` package — see
+[Stability](#stability-of-testing) below for exactly what that does and does not
+promise.
+
+**Everything on this subpath is a mock.** No network, no Buzz, no real backend.
+Until `0.55.0` that was not true: `createLiveHost`, which talks to the real
+Civitai backend and spends the token holder's own Buzz, was exported from here
+too, one autocomplete entry from `createMockHost`. It now lives on its own
+subpath — see [The `/live` subexport](#the-live-subexport) below.
+
+### The whole surface
+
+This section is **the one place the surface is written down**, and it is not
+prose: `test/subpathSurfaces.test.ts` parses the two marked regions below and
+fails if they disagree with what `src/testing.tsx` actually exports — in either
+direction. Every other mention of this subpath (module docblock, `AGENTS.md`)
+points here rather than repeating the list, because a second copy is exactly
+what went stale in [#334](https://github.com/civitai/civitai-app-starters/issues/334).
+
+**Values**
+
+<!-- TESTING-SURFACE:VALUES:BEGIN -->
+
+| Export | What it is |
+|---|---|
+| `resetTransport` | Drops the cached singleton transport. Call it in `beforeEach` so each test starts clean. |
+| `createMockHost` | A framework-agnostic fake of the embedding host — answers every `*_RESULT` message, with knobs for generation cost/latency/failure, Buzz balance, app + shared storage, consent, maturity. Returns a `MockHost`; call `.install()` and keep the returned teardown. **No network, no Buzz.** |
+| `readMockHostUrlOptions` | Reads the harness URL toggles (`?viewer` `?consent` `?fail` `?theme` `?pick` `?balance` `?latency` `?seed` …) into a `Partial<MockHostOptions>`. `Harness` applies it for you; call it directly only in a hand-rolled harness. |
+| `Harness` | The React wrapper: installs a `createMockHost` on mount, tears it down on unmount, and renders an optional on-screen outbound-message log. Takes every `MockHostOptions` field plus `applyUrlToggles` and `showLog`. |
+
+<!-- TESTING-SURFACE:VALUES:END -->
+
+**Types** — the transitive closure that makes those values nameable: each is the
+declared type of an option, of a `MockHost` member, or of a property of one of
+those, so you can hoist a sub-object out of an options literal and give it a
+type.
+
+<!-- TESTING-SURFACE:TYPES:BEGIN -->
+
+```text
+CannedPick
+CostSpec
+HarnessProps
+ImageSpec
+MockBuzzBalance
+MockBuzzHandle
+MockBuzzScenario
+MockCannedImageScan
+MockGenerationScenario
+MockHost
+MockHostFailMode
+MockHostOptions
+MockHostScenarioPatch
+MockSharedScenario
+MockSharedSeed
+MockStorageScenario
+```
+
+<!-- TESTING-SURFACE:TYPES:END -->
+
+That is the complete list. Nothing else is exported.
+
+### In a test
+
+```ts
+import {
+  createMockHost,
+  resetTransport,
+  type MockHostOptions,
+  type MockGenerationScenario,
+} from '@civitai/blocks-react/testing';
+
+resetTransport();
+
+// Hoisting a sub-object out of the options literal is why the scenario types
+// are exported.
+const generation: MockGenerationScenario = { costPerGen: 12, latencyMs: 0 };
+const options: MockHostOptions = { viewer: null, failMode: 'some', generation };
+
+const host = createMockHost(options);
+const uninstall = host.install();
+host.setScenario({ failMode: 'none' });   // live-tune mid-test
+uninstall();
+```
+
+### In a dev harness
+
+```tsx
+import { Harness } from '@civitai/blocks-react/testing';
+
+export function DevRoot() {
+  return (
+    <Harness failMode="some" showLog>
+      <App />
+    </Harness>
+  );
+}
+```
+
+`<Harness>` fires host messages from `window.location.origin`, and the transport
+drops inbound messages from origins outside its allowlist — so a dev harness
+must include its own origin, e.g. `VITE_BLOCK_ALLOWED_PARENT_ORIGINS=http://localhost:5173`.
+Otherwise `BLOCK_INIT` never lands.
+
+### Stability of `/testing`
+
+[#334](https://github.com/civitai/civitai-app-starters/issues/334) offered a
+fork: *document the undocumented surface*, **or** *mark the subpath explicitly
+unstable*. This package took the **first** branch, and only the first. The
+section above is that documentation.
+
+Concretely, and with no guarantee beyond what is actually enforced:
+
+- **It is a normal subpath of a `0.x` package**, on the same footing as `.`,
+  `./ui` and `./live` — no stronger, no weaker. Under semver `0.x`, a **minor
+  may break it**. It is not `@internal`, and it is not "unsupported": fleet
+  blocks import it from their dev harnesses and from their test suites.
+- **What is enforced** is that a change to the exported *symbol set* cannot ship
+  silently. `test/subpathSurfaces.test.ts` fails on growth and on shrinkage, and
+  it fails again unless the README section above is updated to match — so any
+  such change is a deliberate edit that a reviewer sees and a changeset names.
+- **What is *not* promised** is the *shape* of the mock-host option and result
+  types. They describe a fake host whose fidelity tracks the real one; a
+  property may be added, tightened or renamed in a minor. The ledger asserts
+  names, not shapes, and deliberately so.
+
+What is *not* listed above is genuinely internal and carries no guarantee. Until
+`0.55.0` this subpath also re-exported 25 symbols with no documentation — the
+catalog client (`fetchCatalog`, `buildCatalogUrl`, `edgeThumb`, `modelToCard`,
+`DEFAULT_LIMIT`, …), the in-harness picker overlay (`openPickerOverlay`),
+`decodeBlockTokenPayload`, `disallowedAccountError`, `mockParentMessage`, and
+the `MockHostProvider` alias — plus `createLiveHost` / `LiveHostOptions`, which
+moved to `./live` rather than disappearing. See the `0.55.0` changelog entry for
+the full list and for the three removals that had a measured fleet consumer. If
+you were importing one of the internal ones, it lives at a path this package
+does not publish — open an issue rather than reaching into `dist/internal/`.
+
+## The `/live` subexport
+
+> ### 🔴 `@civitai/blocks-react/live` spends real Buzz
+>
+> `createLiveHost` forwards the App-Block postMessage protocol to the **real
+> Civitai backend** over a pasted short-lived dev block token —
+> `blocks.submitWorkflow` included — and a successful generation **debits the
+> token holder's own Buzz**. There is no dry-run mode and no confirmation. It
+> exists for one caller: a `pnpm dev:live` harness. **It must never appear in a
+> test suite.** The free one is `createMockHost`, on `./testing`.
+
+### Why it has its own subpath
+
+Until `0.55.0` this code was exported from `./testing`. The argument for moving
+it, in full, is that **a client which spends the caller's money should not be
+reachable through an import path named `testing`** — the import line is the one
+piece of context that travels with every call site, and `…/testing` actively
+asserts the opposite of what this module does. That is
+[#334](https://github.com/civitai/civitai-app-starters/issues/334)'s literal
+closing condition.
+
+Two arguments that were made for this change and **do not hold** — recorded so
+they are not made again:
+
+- **It does not shrink the install.** Measured: **+4,447 B**. See
+  [What the host-simulation subpaths cost you](#what-the-host-simulation-subpaths-cost-you).
+- **It does not close a wrong-autocomplete hazard**, because there was none to
+  close. `createMockHost(options: MockHostOptions = {})` is callable bare;
+  `createLiveHost(options: LiveHostOptions)` takes a **required** argument whose
+  `blockToken` is a **required** short-lived RS256 JWT that a human mints and
+  pastes by hand. `createLiveHost()` and `createLiveHost({})` do not compile, so
+  nobody reaches this module by picking the wrong completion. Earlier revisions
+  of this file, of the changeset, and of #334 called the two signatures
+  "near-identical"; none of them had read the signatures.
+
+### The whole surface
+
+One value and one type. `test/subpathSurfaces.test.ts` pins the runtime export
+set, failing on growth and on shrinkage.
+
+| Export | What it is |
+|---|---|
+| `createLiveHost` | 🔴 **Real backend, real Buzz.** Installs a host that proxies the block's `postMessage` traffic to civitai.com using a dev block token. Returns a handle; call `.install()` and keep the teardown, exactly like `createMockHost`. |
+| `LiveHostOptions` *(type)* | Options for the above. `blockToken` is required; everything else (`backendBaseUrl`, `viewer`, `theme`, `context`, `onOutbound`, …) has a default. |
+
+### In a `dev:live` harness
+
+```ts
+import { createLiveHost, type LiveHostOptions } from '@civitai/blocks-react/live';
+
+// The token is a SHORT-LIVED dev block token pasted into the harness env, never
+// an API key: `POST /api/v1/blocks/dev-token`, ~4h, re-minted by hand.
+const options: LiveHostOptions = {
+  blockToken: devBlockToken,
+  theme: 'dark',
+};
+
+const host = createLiveHost(options);
+const uninstall = host.install();
+```
+
+### Stability of `/live`
+
+The same terms as `./testing`: a normal subpath of a `0.x` package where a minor
+may break it, with the runtime symbol set pinned by
+`test/subpathSurfaces.test.ts` so it cannot change silently.
+
+🔴 One cost worth stating plainly: publishing and documenting this subpath makes
+[#334](https://github.com/civitai/civitai-app-starters/issues/334) **item 3** —
+getting the live-host code out of the tarball entirely — *harder*, not easier.
+`./live` is now a named public entry point, so removing it later is a breaking
+change on a surface consumers pin against, where before it was one export among
+many on a subpath nobody was told to rely on.
+
+## What the host-simulation subpaths cost you
+
+Seven `dist/` modules — 266,790 B of JavaScript plus 77,338 B of `.d.ts` — are
+reachable only from `./testing` and `./live`, and from nothing under `.` or
+`./ui`. Measured by walking the built module graph:
+
+```text
+118,590  dist/internal/mockHost.js        ← ./testing  (createMockHost)
+ 86,688  dist/internal/liveHost.js        ← ./live     (createLiveHost)
+ 29,508  dist/internal/pickerOverlay.js   ← ./live     (via liveHost)
+ 15,351  dist/internal/catalog.js         ← ./live     (via pickerOverlay)
+  9,141  dist/testing.js
+  4,697  dist/internal/consent.js         ← BOTH hosts import it
+  2,815  dist/live.js
+```
+
+**They ship in every install**, production dependency trees included. They are
+tree-shaken out of application *bundles* — no block ships a mock host to a
+browser — so this is `node_modules` weight, not bundle weight.
+
+🔴 **Splitting `createLiveHost` onto its own subpath removed none of this — it
+ADDS 4,447 B of code, and trimming the export list moved nothing either.**
+Measured with `pnpm pack` on both sides of the split, in a detached worktree so
+neither pack is contaminated by the other change in this release: **319 → 323
+entries, 1,590,099 B → 1,597,161 B uncompressed.** The only files that differ are
+
+```text
++6,048  dist/live.*        (new: .js 2,815, .d.ts 2,839, + maps)
+-1,692  dist/testing.*     (the re-export and its docblock leaving)
+   +91  package.json       (the new exports-map key)
++2,615  README.md          (this section)
+```
+
+`liveHost.js`, `pickerOverlay.js` and `catalog.js` do not appear in that diff at
+all — they are byte-identical and still in the tarball. `files` is
+`["dist", "README.md"]` and `tsconfig` compiles all of `src/**/*`, so the
+`exports` map has no bearing whatsoever on tarball contents; it decides only what
+a consumer can *name*.
+**The `/live` split buys safety, not size.** Moving these bytes needs the code
+deleted or published as a second artifact; that is
+[#334](https://github.com/civitai/civitai-app-starters/issues/334) item 3, and it
+is not done here.
+
 ## Examples
 
 Runnable, minimal blocks — one per feature, each with its own README:

package/dist/hooks/useAppStorage.d.ts

@@ -14,9 +14,23 @@ export interface AppStorageListResult {
 export interface AppStorageQuota {
     usedBytes: number;
     rowCount: number;
-    /** Host-enforced ceiling (bytes). Surface in UI so callers don't hard-code 50MB. */
+    /**
+     * Host-enforced byte ceiling for this (app, viewer). **Render THIS, never a
+     * hard-coded figure** — the ceiling moves, and a UI built on a literal goes
+     * quietly wrong rather than loudly wrong. Matches
+     * `APP_STORAGE_MAX_BYTES` from `@civitai/app-sdk/blocks` against the current
+     * host.
+     */
     limitBytes: number;
-    /** Host-enforced row ceiling (~1M today). */
+    /**
+     * Host-enforced row ceiling for this (app, viewer). Same rule: render it.
+     * Matches `APP_STORAGE_MAX_ROWS`.
+     *
+     * 🔴 THIS IS USUALLY THE BINDING ONE. Rows are small; a block caching one
+     * modest record per item a viewer touches exhausts the row ceiling while
+     * still using a small fraction of `limitBytes`, so a byte-only "x of y used"
+     * readout will show plenty of headroom right up to the rejection.
+     */
     limitRows: number;
 }
 export interface UseAppStorage {
@@ -27,9 +41,11 @@ export interface UseAppStorage {
      */
     get<T = unknown>(key: string): Promise<T | null>;
     /**
-     * Upsert a value. Resolves on host ack. Rejects with the host's
-     * `error` string when the value exceeds 64KB, when the per-app 50MB
-     * quota would be crossed, or when the viewer is anonymous.
+     * Upsert a value. Resolves on host ack. Rejects with the host's `error`
+     * string when the value exceeds `APP_STORAGE_MAX_VALUE_BYTES`, when the
+     * per-(app, viewer) byte or ROW ceiling would be crossed
+     * (`APP_STORAGE_MAX_BYTES` / `APP_STORAGE_MAX_ROWS`), or when the viewer is
+     * anonymous. All from `@civitai/app-sdk/blocks`.
      */
     set<T = unknown>(key: string, value: T): Promise<{
         ok: true;
@@ -54,8 +70,10 @@ export interface UseAppStorage {
         cursor?: string;
     }): Promise<AppStorageListResult>;
     /**
-     * Diagnostic: current usage + the v0 ceilings. Build a "X of 50 MB used"
-     * settings widget against this.
+     * Diagnostic: current usage + the host's ceilings. Build an "X of Y used"
+     * settings widget against this — taking **both** numbers from the reply, and
+     * showing ROWS as well as bytes (see {@link AppStorageQuota.limitRows} for
+     * why bytes alone mislead).
      */
     getQuota(): Promise<AppStorageQuota>;
 }
@@ -71,7 +89,20 @@ export interface UseAppStorage {
  * once the transport singleton is created, so it's safe to put in
  * dependency arrays of `useEffect` / `useMemo`.
  *
- * 64 KB per value, 50 MB + ~1M rows per app.
+ * 🔴 THE NAMESPACE AND THE BUDGET ARE SCOPED DIFFERENTLY. Keys are namespaced
+ * per (block instance, viewer) — the tuple above. The BYTE and ROW budgets
+ * (`APP_STORAGE_MAX_BYTES` / `APP_STORAGE_MAX_ROWS`, plus
+ * `APP_STORAGE_MAX_VALUE_BYTES` per value, all from `@civitai/app-sdk/blocks`)
+ * are enforced per (APP, viewer): every instance of the same app draws on ONE
+ * budget for that viewer.
+ *
+ * 🔴 THE CONSTANTS ARE A SNAPSHOT; `getQuota()` IS THE AUTHORITY. They are the
+ * ceilings as of the `@civitai/app-sdk` version you installed — a figure
+ * compiled into a published package is still a frozen figure, and the host can
+ * move a ceiling without your lockfile changing. Render `getQuota()`'s reply
+ * anywhere a viewer sees a number or a code path decides whether a write will
+ * fit; reach for a constant only where no reply is available (a test fixture, a
+ * design-time estimate), and re-check after an SDK bump.
  *
  * @example
  * const storage = useAppStorage();

package/dist/hooks/useAppStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAppStorage.d.ts","sourceRoot":"","sources":["../../src/hooks/useAppStorage.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD;;;;OAIG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7D;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClC;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,IAAI,aAAa,CAiF7C"}
+{"version":3,"file":"useAppStorage.d.ts","sourceRoot":"","sources":["../../src/hooks/useAppStorage.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7D;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,aAAa,IAAI,aAAa,CAiF7C"}

package/dist/hooks/useAppStorage.js

@@ -14,7 +14,20 @@ import { sendTypedRequest } from '../internal/transport.js';
  * once the transport singleton is created, so it's safe to put in
  * dependency arrays of `useEffect` / `useMemo`.
  *
- * 64 KB per value, 50 MB + ~1M rows per app.
+ * 🔴 THE NAMESPACE AND THE BUDGET ARE SCOPED DIFFERENTLY. Keys are namespaced
+ * per (block instance, viewer) — the tuple above. The BYTE and ROW budgets
+ * (`APP_STORAGE_MAX_BYTES` / `APP_STORAGE_MAX_ROWS`, plus
+ * `APP_STORAGE_MAX_VALUE_BYTES` per value, all from `@civitai/app-sdk/blocks`)
+ * are enforced per (APP, viewer): every instance of the same app draws on ONE
+ * budget for that viewer.
+ *
+ * 🔴 THE CONSTANTS ARE A SNAPSHOT; `getQuota()` IS THE AUTHORITY. They are the
+ * ceilings as of the `@civitai/app-sdk` version you installed — a figure
+ * compiled into a published package is still a frozen figure, and the host can
+ * move a ceiling without your lockfile changing. Render `getQuota()`'s reply
+ * anywhere a viewer sees a number or a code path decides whether a write will
+ * fit; reach for a constant only where no reply is available (a test fixture, a
+ * design-time estimate), and re-check after an SDK bump.
  *
  * @example
  * const storage = useAppStorage();

package/dist/hooks/useAppStorage.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAppStorage.js","sourceRoot":"","sources":["../../src/hooks/useAppStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA6D5D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAgB,GAAG,EAAE;QACjC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,OAAO;YACL,KAAK,CAAC,GAAG,CAAc,GAAW;gBAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC7C,wBAAwB,CACzB,CAAC;gBACF,sEAAsE;gBACtE,iEAAiE;gBACjE,qEAAqE;gBACrE,oDAAoD;gBACpD,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;gBAChD,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAa,CAAC;YAC5C,CAAC;YACD,KAAK,CAAC,GAAG,CAAc,GAAW,EAAE,KAAQ;gBAC1C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EACpD,wBAAwB,CACzB,CAAC;gBACF,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;gBACjD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAW;gBACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAChD,2BAA2B,CAC5B,CAAC;gBACF,kBAAkB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;gBACpD,sEAAsE;gBACtE,uEAAuE;gBACvE,mEAAmE;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI;gBACb,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT;oBACE,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI,EAAE,MAAM;wBACpB,KAAK,EAAE,IAAI,EAAE,KAAK;wBAClB,MAAM,EAAE,IAAI,EAAE,MAAM;qBACrB;iBACF,EACD,yBAAyB,CAC1B,CAAC;gBACF,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;wBACV,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;qBACjC,CAAC,CAAC;oBACH,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,QAAQ;gBACZ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,EAC1C,0BAA0B,CAC3B,CAAC;gBACF,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;gBACrD,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC"}
+{"version":3,"file":"useAppStorage.js","sourceRoot":"","sources":["../../src/hooks/useAppStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA+E5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAgB,GAAG,EAAE;QACjC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,OAAO;YACL,KAAK,CAAC,GAAG,CAAc,GAAW;gBAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAC7C,wBAAwB,CACzB,CAAC;gBACF,sEAAsE;gBACtE,iEAAiE;gBACjE,qEAAqE;gBACrE,oDAAoD;gBACpD,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;gBAChD,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAa,CAAC;YAC5C,CAAC;YACD,KAAK,CAAC,GAAG,CAAc,GAAW,EAAE,KAAQ;gBAC1C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EACpD,wBAAwB,CACzB,CAAC;gBACF,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;gBACjD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAW;gBACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAChD,2BAA2B,CAC5B,CAAC;gBACF,kBAAkB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;gBACpD,sEAAsE;gBACtE,uEAAuE;gBACvE,mEAAmE;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI;gBACb,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT;oBACE,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI,EAAE,MAAM;wBACpB,KAAK,EAAE,IAAI,EAAE,KAAK;wBAClB,MAAM,EAAE,IAAI,EAAE,MAAM;qBACrB;iBACF,EACD,yBAAyB,CAC1B,CAAC;gBACF,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;wBACV,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;qBACjC,CAAC,CAAC;oBACH,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,QAAQ;gBACZ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,SAAS,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,EAC1C,0BAA0B,CAC3B,CAAC;gBACF,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;gBACrD,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC"}

package/dist/hooks/useBlockContext.d.ts

@@ -25,10 +25,14 @@ declare function useTransportSnapshot(): BlockSnapshot;
  * moves (today's behaviour).
  *
  * @example
+ * import { isSignedIn } from '@civitai/app-sdk/blocks';
  * const { ready, context, viewer, theme, settings } = useBlockContext();
  * if (!ready) return <div>Loading…</div>;
  * // Set data-theme on YOUR root — the host can't reach into the iframe (gotcha #60).
- * return <div data-theme={theme}>Hi {viewer?.username ?? 'anon'}</div>;
+ * // Sign-in gate: call `isSignedIn`. NOT `viewer?.username` — an identity read
+ * // standing in for a presence check, on a field that is `@deprecated` and
+ * // scheduled for removal. This snippet used to do exactly that.
+ * return <div data-theme={theme}>{isSignedIn(viewer) ? 'Hi there' : 'Hi anon'}</div>;
  */
 export declare function useBlockContext(): Pick<BlockSnapshot, 'ready' | 'renderMode' | 'context' | 'token' | 'settings' | 'viewer' | 'theme' | 'blockId' | 'blockInstanceId' | 'appId'>;
 /** Re-exported so other hooks in this package can share the subscription. */

package/dist/hooks/useBlockContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useBlockContext.d.ts","sourceRoot":"","sources":["../../src/hooks/useBlockContext.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;GAGG;AACH,iBAAS,oBAAoB,IAAI,aAAa,CAS7C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,eAAe,IAAI,IAAI,CACrC,aAAa,EACX,OAAO,GACP,YAAY,GACZ,SAAS,GACT,OAAO,GACP,UAAU,GACV,QAAQ,GACR,OAAO,GACP,SAAS,GACT,iBAAiB,GACjB,OAAO,CACV,CAcA;AAED,6EAA6E;AAC7E,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"useBlockContext.d.ts","sourceRoot":"","sources":["../../src/hooks/useBlockContext.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;GAGG;AACH,iBAAS,oBAAoB,IAAI,aAAa,CAS7C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,IAAI,IAAI,CACrC,aAAa,EACX,OAAO,GACP,YAAY,GACZ,SAAS,GACT,OAAO,GACP,UAAU,GACV,QAAQ,GACR,OAAO,GACP,SAAS,GACT,iBAAiB,GACjB,OAAO,CACV,CAcA;AAED,6EAA6E;AAC7E,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/hooks/useBlockContext.js

@@ -32,10 +32,14 @@ function useTransportSnapshot() {
  * moves (today's behaviour).
  *
  * @example
+ * import { isSignedIn } from '@civitai/app-sdk/blocks';
  * const { ready, context, viewer, theme, settings } = useBlockContext();
  * if (!ready) return <div>Loading…</div>;
  * // Set data-theme on YOUR root — the host can't reach into the iframe (gotcha #60).
- * return <div data-theme={theme}>Hi {viewer?.username ?? 'anon'}</div>;
+ * // Sign-in gate: call `isSignedIn`. NOT `viewer?.username` — an identity read
+ * // standing in for a presence check, on a field that is `@deprecated` and
+ * // scheduled for removal. This snippet used to do exactly that.
+ * return <div data-theme={theme}>{isSignedIn(viewer) ? 'Hi there' : 'Hi anon'}</div>;
  */
 export function useBlockContext() {
     const snap = useTransportSnapshot();

package/dist/hooks/useBlockContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"useBlockContext.js","sourceRoot":"","sources":["../../src/hooks/useBlockContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD;;;GAGG;AACH,SAAS,oBAAoB;IAC3B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,OAAO,oBAAoB,CACzB,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAC/B,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE;IAC7B,iEAAiE;IACjE,mEAAmE;IACnE,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,eAAe;IAa7B,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"useBlockContext.js","sourceRoot":"","sources":["../../src/hooks/useBlockContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD;;;GAGG;AACH,SAAS,oBAAoB;IAC3B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,OAAO,oBAAoB,CACzB,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAC/B,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE;IAC7B,iEAAiE;IACjE,mEAAmE;IACnE,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,eAAe;IAa7B,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/internal/liveHost.d.ts

@@ -47,7 +47,9 @@
  * tRPC procedures (publicProcedure + verifyBlockToken, FLAT `{ blockToken, … }`
  * input). Reads need the `apps:storage:read` scope, writes `apps:storage:write`
  * — the dev token already carries whatever the local manifest declared, and the
- * server enforces. Real per-(block_instance, user) KV, real 64KB/50MB quotas.
+ * server enforces. Real KV — keys namespaced per (block_instance, user), byte
+ * and row budgets enforced per (app, user) — with the REAL ceilings, so a
+ * write this host accepts is one production would accept.
  *
  * SET_USER_CHECKPOINT (Phase 4): FORWARDED (faithful) to the block-token
  * `blocks.updateUserSettings` mutation — never fabricated. The default page

package/dist/internal/liveHost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"liveHost.d.ts","sourceRoot":"","sources":["../../src/internal/liveHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,EACL,KAAK,YAAY,EAGjB,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,UAAU,EAGhB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,QAAQ,EAAyC,MAAM,eAAe,CAAC;AACrF,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAK5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,wEAAwE;IACxE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IAChE,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,UAAU,CAAC;IACpC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;CACvD;AAQD;;;;;GAKG;AACH,UAAU,wBAAwB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAgB/E;AAyHD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAu9CjE"}
+{"version":3,"file":"liveHost.d.ts","sourceRoot":"","sources":["../../src/internal/liveHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,EACL,KAAK,YAAY,EAGjB,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,UAAU,EAGhB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,QAAQ,EAAyC,MAAM,eAAe,CAAC;AACrF,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAK5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,wEAAwE;IACxE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IAChE,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,UAAU,CAAC;IACpC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;CACvD;AAQD;;;;;GAKG;AACH,UAAU,wBAAwB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAgB/E;AAyHD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAw9CjE"}

package/dist/internal/liveHost.js

@@ -47,7 +47,9 @@
  * tRPC procedures (publicProcedure + verifyBlockToken, FLAT `{ blockToken, … }`
  * input). Reads need the `apps:storage:read` scope, writes `apps:storage:write`
  * — the dev token already carries whatever the local manifest declared, and the
- * server enforces. Real per-(block_instance, user) KV, real 64KB/50MB quotas.
+ * server enforces. Real KV — keys namespaced per (block_instance, user), byte
+ * and row budgets enforced per (app, user) — with the REAL ceilings, so a
+ * write this host accepts is one production would accept.
  *
  * SET_USER_CHECKPOINT (Phase 4): FORWARDED (faithful) to the block-token
  * `blocks.updateUserSettings` mutation — never fabricated. The default page
@@ -396,10 +398,9 @@ export function createLiveHost(options) {
                     return anonFallbackViewer();
                 // `/api/v1/blocks/me` is the AUTHORITATIVE self-read and does carry
                 // `status` — but this builds `BLOCK_INIT.viewer`, which the real host
-                // projects down to `{ id, username }` today (civitai/civitai `main`'s
-                // `projectBlockInitViewer`), and to `{ id, username, signedIn }` once
-                // civitai/civitai#3707 (OPEN, unmerged) lands. Never moderation state,
-                // in either version (civitai #2521). Forwarding `me.status` here would
+                // projects down to exactly `{ id, username, signedIn }` (civitai/civitai
+                // `main`'s `withSignedInFlag`). Never moderation state (civitai #2521).
+                // Forwarding `me.status` here would
                 // make the live dev host more generous than production. A block that
                 // wants `status` must ask for it via `GET_VIEWER` / `useViewer()`, which
                 // is exactly the scope-gated path this release steers authors to.
@@ -1012,7 +1013,9 @@ export function createLiveHost(options) {
                     }
                     case 'APP_STORAGE_SET': {
                         // Mutation apps.storage.set {blockToken, key, value} (POST). The
-                        // server enforces apps:storage:write + the 64KB/50MB quotas.
+                        // server enforces apps:storage:write + the per-value cap and both
+                        // per-(app, viewer) budgets — no simulation here, so nothing to
+                        // keep in sync.
                         const key = typed.payload?.key ?? '';
                         const value = typed.payload?.value;
                         void callTrpcData('apps.storage.set', { blockToken: rawToken, key, value }, 'POST').then((r) => {
@@ -1461,23 +1464,21 @@ export function createLiveHost(options) {
 /**
  * A minimal anon-ish viewer used when `/api/v1/blocks/me` can't be reached.
  *
- * Carries EXACTLY `{ id, username, signedIn }` — the key set the BLOCK_INIT
- * contract is moving to. The two halves have different provenance:
+ * Carries EXACTLY `{ id, username, signedIn }` — byte-for-byte the key set the
+ * real host puts on the wire:
  *
- *  - NO `status` is production TODAY. civitai/civitai `main`'s
- *    `projectBlockInitViewer` builds `{ id, username }`, pinned as exactly
- *    `['id', 'username']` by `__tests__/projectBlockInit.test.ts`. The platform
- *    withholds the viewer's moderation state from third-party iframes (civitai
- *    #2521), so a dev host that sends it invites a block to read a field
- *    production never provides.
- *  - `signedIn` is NOT production yet. It appears zero times under
- *    `src/components/AppBlocks/` on `main`; it arrives with civitai/civitai#3707
- *    (OPEN, unmerged), which also moves the host's pinned key set to
- *    `['id', 'signedIn', 'username']`. Emitted here so the field is exercisable
- *    locally ahead of the host — `viewer !== null` is still the gate to SHIP.
+ *  - NO `status`. The platform withholds the viewer's moderation state from
+ *    third-party iframes (civitai #2521), so a dev host that sent it would
+ *    invite a block to read a field production never provides.
+ *  - WITH `signedIn: true`. civitai/civitai `main`'s `withSignedInFlag`
+ *    (`src/components/AppBlocks/projectBlockInit.ts`) stamps it on every
+ *    present viewer from BOTH host surfaces, and that repo's
+ *    `__tests__/projectBlockInit.test.ts` pins the viewer key set as exactly
+ *    `['id', 'signedIn', 'username']`.
  *
- * See {@link DEFAULT_VIEWER} in `mockHost` for the same note and for what to
- * unwind if #3707 is abandoned.
+ * 🔴 THE PROPERTY THIS FENCE HOLDS: the dev hosts must not be more generous
+ * than the host they imitate — this default MATCHES the host, it does not run
+ * ahead of it. See `DEFAULT_VIEWER` in `mockHost` for the same note.
  */
 function anonFallbackViewer() {
     return { id: 0, username: 'dev-live', signedIn: true };