stillmade-sdk 0.1.4 → 0.1.6

package/packages/block-sdk/generation-catalog.js

@@ -26,7 +26,8 @@ export const VIDEO_GENERATION_MODELS=Object.freeze({
  'seedance-2.0-fast':video('Seedance 2.0 Fast',{aspectRatios:SEEDANCE_ASPECTS,resolutions:['480p','720p'],durations:SEEDANCE_DURATIONS,lastFrame:true,seed:true,nativeAudio:true}),
  'seedance-2.0-mini':video('Seedance 2.0 Mini',{aspectRatios:SEEDANCE_ASPECTS,resolutions:['480p','720p'],durations:SEEDANCE_DURATIONS,lastFrame:true,seed:true,nativeAudio:true}),
  'kling-v3-turbo':video('Kling 3.0 Turbo',{aspectRatios:['16:9','9:16','1:1'],durations:[5,10]}),
- 'wan-2.6-flash':video('Wan 2.6 Flash',{aspectRatios:['16:9','9:16','1:1'],durations:[3,4,5]}),
+ // Atlas serves Wan 2.6 Flash as image-to-video only (its text-to-video Flash was withdrawn).
+ 'wan-2.6-flash':video('Wan 2.6 Flash',{aspectRatios:['16:9','9:16','1:1'],durations:[3,4,5],requiresFirstFrame:true}),
  'veo-3.1-lite':video('Veo 3.1 Lite',{aspectRatios:['16:9','9:16'],resolutions:['720p','1080p'],durations:[4,6,8],lastFrame:true,nativeAudio:true}),
  'vidu-q3-turbo':video('Vidu Q3 Turbo',{durations:[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16],lastFrame:true,nativeAudio:true}),
  'wan-2.7':video('Wan 2.7',{resolutions:['720p','1080p'],durations:[2,3,4,5,6,7,8,9,10,11,12,13,14,15],lastFrame:true,requiresFirstFrame:true,seed:true}),
@@ -38,7 +39,7 @@ export const DEFAULT_SETTING='default';
 export const IMAGE_SETTING_KEYS=Object.freeze(['model','aspectRatio','resolution','quality']);
 export const VIDEO_SETTING_KEYS=Object.freeze(['model','duration','resolution','aspectRatio','generateAudio']);
 export const DEFAULT_IMAGE_MODEL='nano-banana-2';
-export const DEFAULT_VIDEO_MODEL='seedance-2.0-fast';
+export const DEFAULT_VIDEO_MODEL='vidu-q3-turbo';
 export const GENERATION_LIMITS=Object.freeze({references:8,negativePrompt:2000,seed:2147483647});
 
 const pick=(allowed,value,fallback)=>allowed.length?(allowed.includes(value)?value:fallback??allowed[0]):DEFAULT_SETTING;

package/packages/block-sdk/index.d.ts

@@ -6,6 +6,7 @@ export * from './workflow-approvals.js';
 export * from './package-semantics.js';
 export * from './define-block.js';
 export * from './adapter-registry.js';
+export * from './native-application-package.js';
 export * from './block-storage.js';
 export type {BlockViewDocumentTools,DocumentDraftOperation,DocumentEntry,DocumentPath} from './document-drafts.js';
 export type {BlockViewDocumentOptions,BlockViewDocumentConnection} from './document-store-binding.js';
@@ -26,7 +27,7 @@ export interface Manifest {
   /** Events the Block can run on by itself, once the project owner turns them on. */
   triggers?: import('./triggers.js').BlockTrigger[];
   semantics?: import('./semantic-contracts.js').SemanticDefinition[];
-  provenance?: { remixSource?: BlockPackage; remixPolicy?: {allowRemixing: boolean; sourceInspection?: "yes"|"no"|"license-controlled"}; remixAncestors?: {id: string; version: string; digest: string}[]; remixedFrom?: { id: string; version: string; digest: string }; [key: string]: unknown };
+  provenance?: { remixSource?: BlockPackage; remixPolicy?: {allowRemixing: boolean; sourceInspection?: "yes"|"no"|"license-controlled"}; remixAncestors?: {id: string; version: string; digest: string}[]; remixedFrom?: { id: string; version: string; digest: string }; githubSource?: {repository: string; commit: string; path: string}; [key: string]: unknown };
   summary?: Record<string, unknown>;
   license?: string;
   category?: string;
@@ -671,3 +672,21 @@ export function gainFor(measuredLufs: number, peak: number, targetLufs?: number)
 export function wavWriter(channelCount: number, sampleRate: number, frames: number): Readonly<{buffer: ArrayBuffer; write(channels: Float32Array[], from?: number, to?: number, gain?: number): void}>;
 export function encodeWav(channels: Float32Array[], sampleRate: number): ArrayBuffer;
 export function decodeWav(buffer: ArrayBuffer): {channels: Float32Array[]; sampleRate: number};
+/** Browser application bundle profiles. They describe a bundle format, not runtime admission.
+ * `desktop-browser-application/2` adds srcdoc frames (features: wasm, srcdocFrames);
+ * `desktop-browser-application/3` also declares local Web Workers (features: wasm, srcdocFrames, localWorkers: true). */
+export const BROWSER_APPLICATION_EMBEDDED_PROFILE:'desktop-browser-application/2';
+export const BROWSER_APPLICATION_LOCAL_WORKER_PROFILE:'desktop-browser-application/3';
+/** Content digests of a validated browser application package: packageDigest covers the whole package, bundleDigest only its application bundle. */
+export function getBrowserApplicationSourceDigests(value:unknown,options?:{signal?:AbortSignal}):Promise<Readonly<{packageDigest:string;bundleDigest:string}>>;
+/** Static check that every input and output declares a semantic meaning, whether it is required, a description, and a field schema for json/object outputs, so the Block can take part in typed resolution. runtimeVerified is always false. */
+export function reviewResolverContract(pkg:unknown):{name:string;runtimeVerified:false;contract:'semantic-resolver/1';passed:boolean;code?:'RESOLVER_CONTRACT';issues?:string[];message:string;manual?:{inputs:Array<{name:string;type:string;semantic:string;required:boolean;sources:string[]}>;outputs:Array<{name:string;type:string;semantic:string}>}};
+/** Native (desktop-only) application packages: exactly { manifest, nativeApplication }, bound to an exact GitHub source pin.
+ * Ordinary SDK execution and admission refuse them (NATIVE_APPLICATION_RUNTIME_UNAVAILABLE); installation needs host-verified
+ * admission bound to the exact source and runtime plus a managed interactive runtime. See NATIVE_APPLICATION_ADAPTATION.md. */
+export const NATIVE_APPLICATION_PACKAGE_CONTRACT:'native-application-package/1';
+export const NATIVE_APPLICATION_PACKAGE_LIMITS:Readonly<{packageBytes:262144;manifestBytes:65536;adapterBytes:64000;adapterFiles:8;ports:16;operations:16;capturedFiles:8}>;
+export const NATIVE_APPLICATION_RUNTIME_REQUIREMENT:string;
+/** Validates a native application package's strict source syntax and returns its detached, frozen copy. Throws NATIVE_APPLICATION_PACKAGE errors. Not runtime admission. */
+export function defineNativeApplicationPackage<T=unknown>(value:T):T;
+export function validateNativeApplicationPackage(value:unknown):true;

package/packages/block-sdk/index.js

@@ -148,6 +148,7 @@ export * from './repository-application.js';
 export * from './browser-application.js';
 export * from './browser-application-execution.js';
 export * from './browser-application-guest.js';
+export * from './native-application-package.js';
 
 export * from './browser-application-artifacts.js';
 export * from './connected-app.js';

package/packages/block-sdk/native-application-package.d.ts

@@ -0,0 +1,22 @@
+import type {Manifest,Port} from './index.js';
+export type NativeApplicationPort=Omit<Port,'type'> & {type:'text'|'number'|'integer'|'boolean'|'json'|'object'|'image'};
+export interface NativeApplicationSourcePin {repository:string;commit:string;path:string}
+export interface NativeApplicationPackage {
+ manifest:Omit<Manifest,'runtime'|'kind'|'inputs'|'outputs'|'provenance'|'state'> & {
+  runtime:'native-application';kind:'workspace';inputs:Record<string,NativeApplicationPort>;outputs:Record<string,NativeApplicationPort>;
+  provenance:{githubSource:NativeApplicationSourcePin};
+ };
+ nativeApplication:{
+  schemaVersion:1;
+  build:{family:'cmake'|'qmake'|'upstream-artifact'|'other';sourcePaths:string[];arguments:string[];artifacts:string[];dependencies:{kind:'system-package'|'git-source'|'git-data'|'toolchain';name:string;sourcePaths:string[]}[];sourceEdits?:{path:string;baseSha256:string;edits:{match:string;replacement:string}[]}[]};
+  launch:{entry:string;args:string[]};adapterFiles:{path:string;content:string}[];documentPaths:string[];
+  operations:{id:string;files:{port:string;path:string;mimeType:'image/png'|'text/plain'|'application/json'}[]}[];
+  stateGuidance:string;
+ };
+}
+export const NATIVE_APPLICATION_PACKAGE_CONTRACT:'native-application-package/1';
+export const NATIVE_APPLICATION_PACKAGE_LIMITS:Readonly<{packageBytes:262144;manifestBytes:65536;adapterBytes:64000;adapterFiles:8;ports:16;operations:16;capturedFiles:8}>;
+export const NATIVE_APPLICATION_RUNTIME_REQUIREMENT:string;
+/** Source validation only; this never installs or admits a runtime. */
+export function defineNativeApplicationPackage(value:unknown):Readonly<NativeApplicationPackage>;
+export function validateNativeApplicationPackage(value:unknown):true;

package/packages/block-sdk/native-application-package.js

@@ -0,0 +1,77 @@
+import {assert,plain,safeDocument,validateManifest} from './contracts.js';
+
+// Source requests only. None of these limits, build flags or dependencies grant
+// execution, installation, networking, filesystem access or paid calls.
+export const NATIVE_APPLICATION_PACKAGE_CONTRACT='native-application-package/1';
+export const NATIVE_APPLICATION_PACKAGE_LIMITS=Object.freeze({packageBytes:262144,manifestBytes:65536,adapterBytes:64000,adapterFiles:8,ports:16,operations:16,capturedFiles:8});
+export const NATIVE_APPLICATION_RUNTIME_REQUIREMENT='Native application installation requires native package validation, host-verified admission bound to the exact source and runtime, and managed interactive application loading. A build or development-session report cannot grant installation. Single-capability extraction is a separate explicit request.';
+const check=(ok,message)=>assert(ok,'NATIVE_APPLICATION_PACKAGE',message);
+const exact=(v,keys)=>plain(v)&&Reflect.ownKeys(v).length===keys.length&&keys.every(k=>Object.hasOwn(v,k));
+const bytes=v=>new TextEncoder().encode(typeof v==='string'?v:JSON.stringify(v)).length;
+const scalar=new Set(['text','number','integer','boolean','json','object']);
+const hash=v=>typeof v==='string'&&/^[a-f0-9]{64}$/.test(v);
+const text=(v,max)=>typeof v==='string'&&v.trim().length>0&&v.length<=max&&!/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(v);
+const utf8=v=>new TextDecoder('utf-8',{fatal:true}).decode(new TextEncoder().encode(v))===v;
+const distinct=v=>new Set(v).size===v.length;
+const noAliases=v=>distinct(v)&&!v.some(p=>v.some(q=>p!==q&&q.startsWith(p+'/')));
+const path=v=>typeof v==='string'&&v.length>0&&v.length<=240&&/^[a-zA-Z0-9_.\/-]+$/.test(v)&&v.split('/').every(p=>p&&p!=='.'&&p!=='..');
+const paths=(v,count)=>Array.isArray(v)&&v.length>0&&v.length<=count&&v.every(path)&&distinct(v);
+const args=(v,count,itemBytes)=>Array.isArray(v)&&v.length<=count&&v.every(x=>typeof x==='string'&&bytes(x)<=itemBytes&&!/[\x00-\x1f\x7f]/.test(x))&&bytes(v)<=16384;
+const freeze=v=>{if(v&&typeof v==='object'){Object.values(v).forEach(freeze);Object.freeze(v);}return v;};
+const defined=new WeakSet();
+
+/** Strict source syntax, not runtime admission. Keep the original package
+ * digest; root-owned runtime bindings and saved revisions are held separately. */
+export function defineNativeApplicationPackage(value){
+ if(defined.has(value))return value;
+ safeDocument(value);check(exact(value,['manifest','nativeApplication']),'Use exactly manifest and nativeApplication. Reports, runtime grants and build results are not portable package fields.');
+ check(bytes(value)<=NATIVE_APPLICATION_PACKAGE_LIMITS.packageBytes,'Native package source exceeds 256 KiB.');
+ const source=structuredClone(value),m=source.manifest,a=source.nativeApplication;
+ check(plain(m)&&m.runtime==='native-application'&&bytes(m)<=65536,'Use a bounded native-application manifest.');
+ // Ordinary SDK execution stays unavailable. Retain every other common check.
+ const errors=validateManifest(m).errors.filter(error=>error.path!=='runtime');
+ check(!errors.length,JSON.stringify(errors));
+ check(m.kind==='workspace'&&!m.id.startsWith('sm.'),'Native applications use an independently versioned creator workspace identity.');
+ check(m.platforms?.desktop?.supported===true&&m.platforms?.browser?.supported===false&&m.platforms?.phone?.supported===false,'Declare this managed native profile desktop-only. Browser feasibility is assessed separately.');
+ check(exact(m.provenance?.githubSource,['repository','commit','path']),'Bind the package to its exact canonical GitHub source pin.');
+ check(m.entry===undefined&&!m.desktopTools&&!m.permissions.desktop?.length&&!m.permissions.capabilities?.length&&!m.permissions.actions?.length,'Native application source grants no host tool, paid integration or arbitrary action access. Launch is declared inside nativeApplication.');
+ check(Array.isArray(m.permissions.project)&&m.permissions.project.every(scope=>['asset.read','asset.create'].includes(scope)),'Only host-mediated input and output assets are supported by this native profile.');
+ for(const [direction,ports] of [['inputs',m.inputs],['outputs',m.outputs]])check(Object.keys(ports).length<=(NATIVE_APPLICATION_PACKAGE_LIMITS.ports)&&Object.values(ports).every(p=>scalar.has(p.type)||p.type==='image'),direction+' require bounded scalar/JSON or host-materialized PNG ports.');
+ check(Object.keys(m.outputs).length>0,'Declare at least one real typed output.');
+ check(!Object.values(m.inputs).some(p=>p.type==='image')||m.permissions.project.includes('asset.read'),'PNG inputs require asset.read.');
+ check(!Object.values(m.outputs).some(p=>p.type==='image')||m.permissions.project.includes('asset.create'),'PNG outputs require asset.create.');
+ check(exact(a,['schemaVersion','build','launch','adapterFiles','documentPaths','operations','stateGuidance'])&&a.schemaVersion===1,'Use the versioned nativeApplication schemaVersion 1 contract.');
+ check(text(a.stateGuidance,1000),'Describe actual document checkpoint/restore behavior in bounded text. This prose does not grant state or multiplayer authority.');
+ const b=a.build;
+ check(exact(b,['family','sourcePaths','arguments','artifacts','dependencies',...(Object.hasOwn(b??{},'sourceEdits')?['sourceEdits']:[])])&&['cmake','qmake','upstream-artifact','other'].includes(b.family),'Declare a bounded build-family request, not installation commands.');
+ const scoped=p=>!m.provenance.githubSource.path||p.startsWith(m.provenance.githubSource.path+'/')||p===m.provenance.githubSource.path;
+ check(paths(b.sourcePaths,128)&&b.sourcePaths.every(scoped)&&args(b.arguments,16,240)&&paths(b.artifacts,8)&&noAliases(b.artifacts),'Use scoped source paths, bounded build arguments and distinct relative build artifacts.');
+ check(Array.isArray(b.dependencies)&&b.dependencies.length<=64,'Bound source-backed dependency requests.');
+ for(const d of b.dependencies)check(exact(d,['kind','name','sourcePaths'])&&['system-package','git-source','git-data','toolchain'].includes(d.kind)&&text(d.name,240)&&paths(d.sourcePaths,128)&&d.sourcePaths.every(scoped),'Dependencies require bounded names and source evidence; they never authorize an installer.');
+ if(Object.hasOwn(b,'sourceEdits')){
+  check(b.family==='cmake'&&Array.isArray(b.sourceEdits)&&b.sourceEdits.length>0&&b.sourceEdits.length<=8&&distinct(b.sourceEdits.map(r=>r?.path))&&bytes(b.sourceEdits)<=64000,'Exact derived-source edits require the reviewed CMake profile and bounded distinct files.');
+  for(const row of b.sourceEdits){check(exact(row,['path','baseSha256','edits'])&&path(row.path)&&scoped(row.path)&&hash(row.baseSha256)&&Array.isArray(row.edits)&&row.edits.length>0&&row.edits.length<=32,'Source edits bind bounded literal replacements to exact original source bytes.');for(const e of row.edits)check(exact(e,['match','replacement'])&&text(e.match,8192)&&typeof e.replacement==='string'&&e.replacement.length<=8192&&!e.replacement.includes('\0'),'Source edits are literal text, never commands; the host independently verifies each match.');}
+ }
+ check(Array.isArray(a.adapterFiles)&&a.adapterFiles.length>0&&a.adapterFiles.length<=8&&distinct(a.adapterFiles.map(f=>f?.path)),'Declare distinct bounded adapter source files.');
+ let adapterBytes=0;
+ for(const f of a.adapterFiles){check(exact(f,['path','content'])&&path(f.path)&&typeof f.content==='string'&&f.content.length>0&&!f.content.includes('\0')&&utf8(f.content),'Adapters contain bounded relative UTF-8 source files.');adapterBytes+=bytes(f.content);}
+ check(adapterBytes<=64000,'Adapter source exceeds 64,000 bytes.');
+ const adapters=a.adapterFiles.map(f=>f.path);
+ check(noAliases([...adapters,...b.artifacts]),'Adapters and build artifacts cannot alias.');
+ check(exact(a.launch,['entry','args'])&&path(a.launch.entry)&&[...adapters,...b.artifacts].includes(a.launch.entry)&&args(a.launch.args,32,1024),'Launch a declared adapter or artifact with bounded arguments.');
+ check(adapters.includes(a.launch.entry)||a.launch.args.some(arg=>adapters.some(p=>arg===p||arg.endsWith('='+p))),'The launcher must load an adapter through its actual startup hook.');
+ check(paths(a.documentPaths,8)&&noAliases(a.documentPaths),'Saved document paths are bounded distinct literal files.');
+ check(a.documentPaths.every(p=>p!=='.stillmade-exports'&&!p.startsWith('.stillmade-exports/')),'Saved documents cannot occupy the host-owned fresh export namespace.');
+ check(Array.isArray(a.operations)&&a.operations.length>0&&a.operations.length<=16&&distinct(a.operations.map(o=>o?.id)),'Declare distinct bounded export operations.');
+ const covered=new Set();
+ for(const o of a.operations){
+  check(exact(o,['id','files'])&&/^[a-z][a-z0-9._-]{0,63}$/.test(o.id||'')&&Array.isArray(o.files)&&o.files.length>0&&o.files.length+a.documentPaths.length<=8,'Each operation declares an ID and at most eight captured documents/exports.');
+  const mapped=new Set(),files=[];
+  for(const f of o.files){check(exact(f,['port','path','mimeType'])&&Object.hasOwn(m.outputs,f.port)&&!mapped.has(f.port)&&path(f.path),'Map each declared output once to a literal export path.');const t=m.outputs[f.port].type;check(f.mimeType===(t==='image'?'image/png':t==='text'?'text/plain':'application/json'),'Export MIME must match its typed output port.');mapped.add(f.port);covered.add(f.port);files.push(f.path);}
+  check(noAliases([...a.documentPaths,...files]),'Exports cannot alias saved documents or another export.');
+  check(Object.entries(m.outputs).every(([p,v])=>mapped.has(p)||v.required===false),'An operation may omit only optional output ports.');
+ }
+ check(covered.size===Object.keys(m.outputs).length,'Every declared output must have a real export mapping. Saved documents belong in documentPaths.');
+ freeze(source);defined.add(source);return source;
+}
+export function validateNativeApplicationPackage(value){defineNativeApplicationPackage(value);return true;}

package/packages/block-sdk/native_adapter.py

@@ -0,0 +1,76 @@
+"""Unprivileged native application adapter protocol. Call poll() on the app's
+event loop (e.g. a Qt timer). Handlers belong to the Block, never to the host.
+Acknowledgements are untrusted; the host separately captures/validates outputs.
+No host filesystem, credential, network or billing service is exposed here.
+"""
+import json, os, socket, stat
+
+PROTOCOL = 'stillmade.native.adapter/1'
+
+
+class NativeAdapter:
+    def __init__(self, handlers, directory='/run/stillmade-adapter'):
+        if not isinstance(handlers, dict) or not handlers or not all(isinstance(key, str) and callable(handler) for key, handler in handlers.items()):
+            raise ValueError('Declare native adapter handlers')
+        self.handlers = dict(handlers)
+        self.directory = directory
+        self.context = self._read('context.json', 4096)
+        if set(self.context) != {'schemaVersion', 'protocol', 'sessionId', 'applicationSha256'} or self.context['schemaVersion'] != 1 or self.context['protocol'] != PROTOCOL:
+            raise ValueError('Unsupported native adapter context')
+        self.seen = set()
+
+    def _read(self, name, limit):
+        fd = os.open(os.path.join(self.directory, name), os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        try:
+            info = os.fstat(fd)
+            if not stat.S_ISREG(info.st_mode) or info.st_size > limit:
+                raise ValueError('Bounded native adapter message required')
+            chunks, count = [], 0
+            while True:
+                chunk = os.read(fd, min(4096, limit + 1 - count))
+                if not chunk:
+                    break
+                count += len(chunk)
+                if count > limit:
+                    raise ValueError('Native adapter message limit')
+                chunks.append(chunk)
+            return json.loads(b''.join(chunks))
+        finally:
+            os.close(fd)
+
+    def poll(self):
+        """Handle at most one command. This never creates a background thread;
+        GUI adapters choose the application's own event-loop scheduling."""
+        try:
+            request = self._read('request.json', 32768)
+        except FileNotFoundError:
+            return False
+        if set(request) != {'schemaVersion', 'sessionId', 'applicationSha256', 'requestId', 'action', 'payload'} or request['schemaVersion'] != 1 or request['sessionId'] != self.context['sessionId'] or request['applicationSha256'] != self.context['applicationSha256'] or request['action'] not in ['checkpoint', 'execute'] or not isinstance(request['payload'], dict) or not isinstance(request['requestId'], str) or len(request['requestId']) != 36:
+            raise ValueError('Native adapter request binding changed')
+        if request['requestId'] in self.seen:
+            return False
+        if len(self.seen) >= 64:
+            raise ValueError('Native adapter request limit')
+        # Mark before dispatch: a handler must never repeat after an uncertain
+        # acknowledgement or a subsequent event-loop tick.
+        self.seen.add(request['requestId'])
+        reply = {key: request[key] for key in ['schemaVersion', 'sessionId', 'applicationSha256', 'requestId']}
+        try:
+            handler = self.handlers.get(request['action'])
+            if handler is None:
+                raise ValueError('This application has no handler for ' + request['action'])
+            if handler(request['payload']) is not True:
+                raise ValueError('The application did not confirm its native operation')
+            reply['phase'] = 'completed'
+        except Exception as error:
+            reply['phase'] = 'failed'
+            reply['message'] = str(error)[:512]
+        encoded = json.dumps(reply, separators=(',', ':')).encode('utf-8')
+        if len(encoded) > 8192:
+            raise ValueError('Native adapter response limit')
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
+            connection.settimeout(1.0)
+            connection.connect(os.path.join(self.directory, 'response.sock'))
+            connection.sendall(encoded)
+            connection.shutdown(socket.SHUT_WR)
+        return True

package/packages/block-sdk/package.json

@@ -27,6 +27,7 @@
   "files": [
     "*.js",
     "*.d.ts",
+    "*.py",
     "README.md",
     "*.schema.json"
   ],

package/packages/block-sdk/pipeline-runtime-host.d.ts

@@ -2,6 +2,8 @@ export const PIPELINE_RUNTIME_HOST_VERSION:1;
 export const PIPELINE_RUNTIME_FUNCTIONS:readonly string[];
 export interface PipelineRuntimeHost {
  version:1;
+ /** Optional host-owned authenticated image projection; grants no artifact authority. */
+ BlockImagePreview?: (props:{value:unknown})=>unknown;
  [key:string]:unknown;
 }
 export function requirePipelineRuntimeHost(host:unknown):PipelineRuntimeHost;

package/packages/block-sdk/project-flow-contract.js

@@ -69,6 +69,8 @@ export function projectFlowSnapshot(value){
  assert(snapshot.goalSourceMaterials===undefined||Array.isArray(snapshot.goalSourceMaterials)&&snapshot.goalSourceMaterials.length<=8&&new Set(snapshot.goalSourceMaterials.map(item=>item.key)).size===snapshot.goalSourceMaterials.length&&snapshot.goalSourceMaterials.every(item=>plain(item)&&Object.keys(item).sort().join(',')==='description,key,type'&&typeof item.key==='string'&&/^[a-z][a-z0-9_]{0,63}$/.test(item.key)&&knownType(item.type)&&typeof item.description==='string'&&item.description.length<=240),'PROJECT_FLOW_SNAPSHOT','Goal source descriptions are bounded assumptions, not selected files.');
  assert(snapshot.goalSourceInputs===undefined||Array.isArray(snapshot.goalSourceInputs)&&snapshot.goalSourceInputs.length<=32&&new Set(snapshot.goalSourceInputs.map(item=>`${item.stageId}\0${item.inputKey}`)).size===snapshot.goalSourceInputs.length&&snapshot.goalSourceInputs.every(item=>plain(item)&&Object.keys(item).sort().join(',')==='blockId,inputKey,sourceKeys,stageId,version'&&typeof item.stageId==='string'&&item.stageId.length<=160&&typeof item.blockId==='string'&&item.blockId.length<=160&&typeof item.version==='string'&&item.version.length<=40&&typeof item.inputKey==='string'&&item.inputKey.length<=160&&Array.isArray(item.sourceKeys)&&item.sourceKeys.length>=1&&item.sourceKeys.length<=8&&new Set(item.sourceKeys).size===item.sourceKeys.length&&item.sourceKeys.every(key=>snapshot.goalSourceMaterials?.some(material=>material.key===key))),'PROJECT_FLOW_SNAPSHOT','Planned material-to-input links are bounded assumptions, not actual bindings.');
  assert(typeof snapshot.partial==='boolean','PROJECT_FLOW_SNAPSHOT','The Flow completeness state is required.');
+ // One Step per job: the jobs a person sees, each naming the placements that are its parts.
+ assert(snapshot.jobs===undefined||Array.isArray(snapshot.jobs)&&snapshot.jobs.length<=50&&snapshot.jobs.every(job=>plain(job)&&Object.keys(job).length===3&&typeof job.id==='string'&&job.id.length<=80&&typeof job.label==='string'&&job.label.length<=40&&Array.isArray(job.parts)&&job.parts.length>=2&&job.parts.length<=12&&job.parts.every(id=>typeof id==='string')),'PROJECT_FLOW_SNAPSHOT','Each Flow job needs an ID, a name and its parts.');
  assert(Array.isArray(snapshot.placements)&&snapshot.placements.length<=PROJECT_FLOW_LIMITS.placements,'PROJECT_FLOW_SNAPSHOT','The Flow placement list exceeds its limit.');
  assert(Array.isArray(snapshot.edges)&&snapshot.edges.length<=PROJECT_FLOW_LIMITS.edges,'PROJECT_FLOW_SNAPSHOT','The Flow connection list exceeds its limit.');
  assert(Array.isArray(snapshot.issues)&&snapshot.issues.length<=PROJECT_FLOW_LIMITS.issues,'PROJECT_FLOW_SNAPSHOT','The Flow issue list exceeds its limit.');

package/packages/block-sdk/remix-policy.js

@@ -11,6 +11,8 @@ export function blockRemixPolicy(content,{checkPreference=true}={}) {
  if(!m||content.stages)return blocked('BLOCK_ONLY','Select a Block to remix.');
  if(content.protected||m.id===ROOT_CHAT_ID)return blocked('PROTECTED','Starting Chat cannot be remixed.');
  if(!['recipe','javascript','module','capability','comfyui'].includes(m.runtime))return blocked('RUNTIME_RESTRICTED','This Block still requires a trusted application workspace. An independent sandboxed remix is not available.');
+ // A creator who chose to hide the code keeps remixing off: the remix draft still
+ // carries the package, so the choice is enforced here, not only in the builder.
  if(checkPreference&&(m.provenance?.remixPolicy?.allowRemixing===false||m.provenance?.remixPolicy?.sourceInspection==='no'))return blocked('REMIX_DISABLED','The creator has disabled the in-app remix action for this version. Existing upstream license rights are unchanged.');
  if(!licenses.has(m.license)&&!(content.portable&&isPortableLicenseExpression(m.license)))return blocked('LICENSE_RESTRICTED','This license needs review before automatic remixing. Missing, custom and copyleft terms cannot be cleared by a checkbox.');
  try {
@@ -29,4 +31,4 @@ export function assertRemixReady(content) {
  return policy;
 }
 
-export const REMIX_AUTHORING_REQUIREMENT = 'Every finished Block must support automatic remixing through the standard SDK contract. Include complete editable runtime source/configuration, typed inputs/outputs, UI controls, fixtures, and a supported permissive manifest.license with its complete real copyright/license notice in manifest.provenance.notice (or verified portable evidence). Do not disable remixing or source inspection. No custom remix endpoint or host callback is needed. Preserve inherited source, notices and lineage. Never invent ownership, copyright holders or permission, or apply a new license to unresolved third-party source; return unsupported with a clear licensing reason instead. The shared SDK admission validator enforces this requirement.';
+export const REMIX_AUTHORING_REQUIREMENT = 'Every finished Block must support automatic remixing through the standard SDK contract. Include complete editable runtime source/configuration, typed inputs/outputs, UI controls, fixtures, and a supported permissive manifest.license with its complete real copyright/license notice in manifest.provenance.notice (or verified portable evidence). Do not disable remixing. The code stays private to its creator; others remix only through StillMade’s AI builder. No custom remix endpoint or host callback is needed. Preserve inherited source, notices and lineage. Never invent ownership, copyright holders or permission, or apply a new license to unresolved third-party source; return unsupported with a clear licensing reason instead. The shared SDK admission validator enforces this requirement.';

package/packages/block-sdk/resolver-admission.js

@@ -0,0 +1,17 @@
+export function reviewResolverContract(pkg){
+ const base={name:'Input/output resolver contract',runtimeVerified:false,contract:'semantic-resolver/1'},manifest=pkg?.manifest||{},issues=[];
+ for(const [name,port] of Object.entries(manifest.inputs||{})){
+  if(typeof port?.semantic!=='string')issues.push(`${name} input needs an exact semantic meaning`);
+  if(typeof port?.required!=='boolean')issues.push(`${name} input must declare whether it is required`);
+  if(typeof port?.description!=='string'||!port.description.trim())issues.push(`${name} input needs a purpose/format description`);
+ }
+ for(const [name,port] of Object.entries(manifest.outputs||{})){
+  if(typeof port?.semantic!=='string')issues.push(`${name} output needs an exact semantic meaning`);
+  if(typeof port?.description!=='string'||!port.description.trim())issues.push(`${name} output needs a result description`);
+  if(['json','object'].includes(port?.type?.replace(/\[\]$/,''))){if(port.schema==null)issues.push(`${name} output needs a declared field schema for safe resolution`);else if(JSON.stringify(port.schema).length>4000)issues.push(`${name} output schema exceeds the resolver manual limit`);}
+ }
+ if(issues.length)return {...base,passed:false,code:'RESOLVER_CONTRACT',issues:issues.slice(0,20),message:`Import is blocked until every input and output can participate in typed resolution: ${issues.slice(0,8).join('; ')}${issues.length>8?`; ${issues.length-8} more`:''}. Physical JSON types alone do not establish compatible meaning.`};
+ const inputs=Object.entries(manifest.inputs||{}).map(([name,port])=>({name,type:port.type,semantic:port.semantic,required:port.required,sources:port.sources||[]}));
+ const outputs=Object.entries(manifest.outputs||{}).map(([name,port])=>({name,type:port.type,semantic:port.semantic}));
+ return {...base,passed:true,manual:{inputs,outputs},message:`All ${inputs.length} input${inputs.length===1?'':'s'} and ${outputs.length} output${outputs.length===1?'':'s'} declare physical types, semantic meanings and descriptions. Workflow composition must still validate each exact output-to-input pair, schema, adapter pin and required permission.`};
+}

package/packages/block-sdk/runtime.js

@@ -5,6 +5,7 @@ import { assert, validateValues, validateBlockOutputs } from './contracts.js';
 import {validateComfyInput,testComfyOutputs} from './comfyui.js';
 import {prepareCapabilityInvocation,validateCapabilityResult} from './capabilities.js';
 import {requiresDesktopExecution,prepareDesktopExecution,validateDesktopExecutionResult} from './desktop-execution.js';
+import {NATIVE_APPLICATION_RUNTIME_REQUIREMENT} from './native-application-package.js';
 
 async function executeHostCall(pkg,input,{signal,execute}){
   let abort;
@@ -18,9 +19,11 @@ async function executeHostCall(pkg,input,{signal,execute}){
 export async function runPackageAsync(pkg, values, options = {}) {
   assert(!options.signal?.aborted, 'CANCELLED', 'Run cancelled');
   if(pkg?.manifest?.runtime==='native-application'){
+    // Native source runs only through a paired, reviewed local worker; without
+    // one (a browser or desktop download alone) it stays unavailable.
+    assert(options.experimentalBrowser,'NATIVE_APPLICATION_RUNTIME_UNAVAILABLE',NATIVE_APPLICATION_RUNTIME_REQUIREMENT);
     const snapshot=structuredClone(pkg),input=structuredClone(values),scope={...options};
     const source=await defineNativeApplicationSource(snapshot);
-    assert(scope.experimentalBrowser,'LOCAL_WORKER_REQUIRED','Pair a reviewed local worker for this application. A browser or desktop download alone cannot execute its native source.');
     assert(typeof scope.check==='function','NATIVE_APPLICATION_AUTHORITY','Use the scoped project execution checkpoint.');
     return executeExperimentalBrowser(scope.experimentalBrowser,source,validateValues(source.manifest.inputs,input),scope);
   }

package/packages/block-sdk/schema-fields.js

@@ -50,8 +50,40 @@ export function createSchemaFields(lockedInputKeys=[]) {
  function fromState(input,state,bindings){const values=copy(input);inert(state);inert(bindings);for(const key of Object.keys(bindings))if(!locked.has(key)&&Object.hasOwn(state,key))values[key]=copy(state[key]);return values;}
  function edits(values,state,bindings){inert(values);inert(state);inert(bindings);const patch={},before={};for(const key of Object.keys(bindings))if(!locked.has(key)&&Object.hasOwn(values,key)&&JSON.stringify(values[key])!==JSON.stringify(state[key])){patch[key]=copy(values[key]);before[key]=Object.hasOwn(state,key)?{exists:true,value:copy(state[key])}:{exists:false};}if(JSON.stringify(patch).length>393216)throw Error('Saved task fields exceed 384 KiB. Use an upstream source for larger data.');return {patch,before,changed:Object.keys(patch).length>0};}
  function preview(value,{maximumFields=20}={}){
-  value=copy(value);if(!Number.isSafeInteger(maximumFields)||maximumFields<1||maximumFields>100)throw Error('Use a bounded result preview.');const rows=[];let omitted=false;
-  const visit=(item,path,depth)=>{if(rows.length>=maximumFields||depth>8){omitted=true;return;}if(item===null||typeof item!=='object'){const label=path.map(key=>typeof key==='number'?'Item '+(key+1):String(key).replaceAll('_',' ')).join(' / ')||'Result';const text=item===null?'No value':typeof item==='boolean'?(item?'Yes':'No'):String(item);rows.push({tag:'li',children:[{tag:'strong',text:label.slice(0,240)},{tag:'p',text:text.slice(0,1500)+(text.length>1500?'…':'')}]});return;}if(Array.isArray(item)){item.slice(0,50).forEach((entry,index)=>visit(entry,path.concat(index),depth+1));if(item.length>50)omitted=true;}else for(const [key,entry] of Object.entries(item))visit(entry,path.concat(key),depth+1);};visit(value,[],0);return [{tag:'h3',text:'Result'},{tag:'ul',children:rows},...(omitted?[{tag:'small',text:'Preview is bounded. The saved result retains its complete permitted data.'}]:[])];
+  value=copy(value);if(!Number.isSafeInteger(maximumFields)||maximumFields<1||maximumFields>100)throw Error('Use a bounded result preview.');
+  // Any app's data: lists of records become tables, other lists become bullet
+  // lists, objects become field tables with nested sections. Bounded in size.
+  const ROWS=50,COLUMNS=12;let budget=6000,omitted=false;
+  const label=key=>{const text=String(key).replaceAll('_',' ').slice(0,120);return text.charAt(0).toUpperCase()+text.slice(1);};
+  const scalar=item=>{const text=item===null||item===undefined?'—':typeof item==='boolean'?(item?'Yes':'No'):String(item);return text.length>500?text.slice(0,500)+'…':text;};
+  const record=item=>item!==null&&typeof item==='object'&&!Array.isArray(item);
+  const node=(tag,extra)=>{budget--;return {tag,...extra};};
+  const count=list=>`${list.length} ${list.length===1?'item':'items'}${list.length>ROWS?`, showing the first ${ROWS}`:''}`;
+  const render=(item,depth)=>{
+   if(budget<=0||depth>5){omitted=true;return node('p',{text:'…'});}
+   if(item===null||typeof item!=='object')return node('p',{text:scalar(item)});
+   if(Array.isArray(item)){
+    if(!item.length)return node('p',{text:'No items'});
+    const rows=item.slice(0,ROWS);if(item.length>ROWS)omitted=true;
+    if(rows.every(record)){
+     const columns=[...new Set(rows.flatMap(row=>Object.keys(row)))],shown=columns.slice(0,COLUMNS);if(columns.length>COLUMNS)omitted=true;
+     // Nested values in a cell read as short text, e.g. "link click: 540".
+     const brief=entry=>entry!==null&&typeof entry==='object'?(Array.isArray(entry)?entry.map(brief).join(', '):Object.values(entry).map(brief).join(': ')):scalar(entry);
+     const cell=entry=>{const text=brief(entry);return text.length>200?text.slice(0,200)+'…':text;};
+     return node('div',{className:'connection-table',children:[node('small',{text:count(item)}),node('table',{children:[node('thead',{children:[node('tr',{children:shown.map(column=>node('th',{text:label(column)}))})]}),node('tbody',{children:rows.map(row=>node('tr',{children:shown.map(column=>node('td',{text:cell(row[column])}))}))})]})]});
+    }
+    return node('div',{children:[node('small',{text:count(item)}),node('ul',{children:rows.map(entry=>node('li',{children:[render(entry,depth+1)]}))})]});
+   }
+   const entries=Object.entries(item),flat=entries.filter(([,entry])=>entry===null||typeof entry!=='object'),nested=entries.filter(([,entry])=>entry!==null&&typeof entry==='object');
+   const children=[];
+   if(flat.length)children.push(node('table',{className:'connection-fields',children:[node('tbody',{children:flat.map(([key,entry])=>node('tr',{children:[node('th',{text:label(key)}),node('td',{text:scalar(entry)})]}))})]}));
+   // The top level shows its sections openly; deeper detail stays collapsed.
+   for(const [key,entry] of nested)children.push(depth===0?node('section',{children:[node('h4',{text:label(key)}),render(entry,depth+1)]}):node('details',{children:[node('summary',{text:label(key)}),render(entry,depth+1)]}));
+   if(!children.length)children.push(node('p',{text:'No fields'}));
+   return node('div',{children});
+  };
+  const body=render(value,0);
+  return [{tag:'h3',text:'Result'},body,...(omitted?[{tag:'small',text:'Preview is bounded. The saved result retains its complete permitted data.'}]:[])];
  }
  function currencyDigits(currency){if(typeof currency!=='string'||!/^[A-Z]{3}$/.test(currency))throw Error('Choose a three-letter currency code.');return new Intl.NumberFormat('en',{style:'currency',currency}).resolvedOptions().maximumFractionDigits;}
  function minorUnits(decimal,currency){const digits=currencyDigits(currency),parts=String(decimal).split('.');if(parts.length>2||!/^\d+$/.test(parts[0])||parts[1]!==undefined&&(!/^\d+$/.test(parts[1])||parts[1].length>digits))throw Error('Enter a budget using this currency’s supported decimal places.');const amount=Number(parts[0])*10**digits+Number((parts[1]||'').padEnd(digits,'0'));if(!Number.isSafeInteger(amount)||amount<=0)throw Error('Enter a positive supported budget.');return amount;}

package/packages/block-sdk/semantic-relationships.js

@@ -6,10 +6,24 @@ export const STANDARD_SEMANTIC_RELATIONSHIPS=Object.freeze([
   Object.freeze({name:'reference_image',parents:Object.freeze(['image'])}),
   Object.freeze({name:'generated_image',parents:Object.freeze(['image','source_image'])}),
   Object.freeze({name:'processed_image',parents:Object.freeze(['image','source_image'])}),
+  // A description of an image is plain text any text Step can work from (captions, copy).
+  Object.freeze({name:'visual_description',parents:Object.freeze(['plain_text'])}),
+  // A transcript's words are plain text once converted (transcript-to-text).
+  Object.freeze({name:'transcript_text',parents:Object.freeze(['plain_text'])}),
+  // Workspace timelines are timelines: Export video takes any of them.
+  Object.freeze({name:'editor_timeline',parents:Object.freeze(['timeline'])}),
+  Object.freeze({name:'legacy.timeline.updatededitor',parents:Object.freeze(['timeline'])}),
+  // A narration is audio that can be transcribed.
+  Object.freeze({name:'narration_audio',parents:Object.freeze(['source_audio'])}),
 ]);
 
 const parents=new Map(STANDARD_SEMANTIC_RELATIONSHIPS.map(entry=>[entry.name,entry.parents]));
 export function standardSemanticIsA(actual,expected) {
+  // A connected task's own input fields (email, phone, message…) take any value
+  // of the right type that the user wires to them, such as a lead's email.
+  if(/^external_input_[a-f0-9]{16}_\d+$/.test(expected))return true;
   if(typeof actual!=='string' || typeof expected!=='string')return false;
+  // Every connected-app task names its own result meaning; all are external data.
+  if(expected==='external_data' && /^external_result_[a-f0-9]{16}$/.test(actual))return true;
   return actual===expected || (parents.get(actual) || []).some(parent=>standardSemanticIsA(parent,expected));
 }

package/packages/block-sdk/shared-controls.js

@@ -46,7 +46,9 @@ export function installSharedControls(document,api,onError,textControls=null,loc
   let base={exists:false},draft,dirty=false,saving=false,timer=null,disposed=false,canEdit=false,inFlight=null,problem=null,dirtySince=null,composing=false,compositionRevoked=false,retainedComposition;
   const textual=node.tagName==='TEXTAREA'||node.tagName==='INPUT'&&node.type==='text';
   const report=error=>{problem=error;node.setCustomValidity(error.message);onError(error.message);};
-  const write=value=>{if(node.type==='checkbox')node.checked=!!value;else if(node.value!==String(value??''))node.value=String(value??'');};
+  // A written value reaches the view through onShared (never an input event),
+  // after the listeners of this update, whatever order they subscribed in.
+  const write=value=>{const before=node.type==='checkbox'?node.checked:node.value;if(node.type==='checkbox')node.checked=!!value;else if(node.value!==String(value??''))node.value=String(value??'');if((node.type==='checkbox'?node.checked:node.value)!==before)queueMicrotask(()=>{if(!disposed)api.announce?.();});};
   const read=()=>node.type==='checkbox'?node.checked:['number','range'].includes(node.type)?node.valueAsNumber:node.value;
   let fallback=read();
   const flush=()=>{

package/packages/block-sdk/shared-view.js

@@ -91,7 +91,7 @@ export function installSharedViewBridge(channel,session,limits=SHARED_VIEW_LIMIT
   }
   else if(data.op==='dispose'){closed=true;ready=false;listeners.clear();rejectQueue('Block closed');}
  });
- return {
+ const api={
   getShared(){return structuredClone(snapshot);},
   onShared(fn){if(typeof fn!=='function')throw Error('Expected a function');listeners.add(fn);if(ready)fn(structuredClone(snapshot));return()=>listeners.delete(fn);},
   updateShared(values,preconditions,options){
@@ -114,4 +114,9 @@ export function installSharedViewBridge(channel,session,limits=SHARED_VIEW_LIMIT
    return new Promise((resolve,reject)=>{queue.push({id:String(++sequence),resolve,reject,values,before,merge,bytes});drain();});
   }
  };
+ // Shared text arrives through its own channel after the snapshot. Its control
+ // calls this once the text is in place, so views recompute from onShared. Not
+ // enumerable: the view API is spread from this object and does not offer it.
+ Object.defineProperty(api,'announce',{value:()=>{if(ready&&!closed)notify();}});
+ return api;
 }

package/packages/block-sdk/source-rights.js

@@ -1,5 +1,7 @@
-// Public inspection is an access preference, not a change to a source license.
-// The host's existing private-release ACL is the supported no-public-source path.
+// A Block's code is private to its creator (and StillMade admins): no one else
+// views or downloads it, and others change it only by remixing through
+// StillMade's AI builder. A creator's old preference still decides whether
+// their releases must stay private; it no longer opens the code to anyone.
 import {isPortableLicenseExpression} from './portable.js';
 export const SOURCE_INSPECTION_CHOICES=Object.freeze(['yes','no','license-controlled']);
 const permissive=new Set(['MIT','Apache-2.0','BSD-2-Clause','BSD-3-Clause','ISC']);
@@ -8,13 +10,12 @@ export function blockSourceRights(manifest) {
  const preference=manifest?.provenance?.remixPolicy?.sourceInspection;
  const declared=manifest?.license,recognized=permissive.has(declared)||isPortableLicenseExpression(declared)||sourceObligations.has(declared)||declared==='CC0-1.0';
  return {preference:preference||'yes',
-  // Preserve established access for legacy packages without an explicit choice.
-  publicInspection:preference===undefined||preference==='yes'||preference==='license-controlled'&&recognized,
+  publicInspection:false,
   requiresPrivateRelease:preference==='no'||preference==='license-controlled'&&!recognized,
   commercialUse:recognized?'Subject to the declared license and retained upstream terms':'Unresolved — review the source license',
   attribution:declared==='CC0-1.0'?'Retain source provenance and any third-party notices':recognized?'Retain required copyright, license and notice text':'Unresolved — retain all upstream notices pending review',
   sourceObligations:sourceObligations.has(declared)?'Distribution may require corresponding source and other license obligations; automatic remix clearance remains restricted.':null,
-  explanation:preference==='no'?'Public source inspection is off. Publish privately using the existing account/team access rules. Authorized recipients keep their license rights.':preference==='license-controlled'&&!recognized?'The source license is unresolved. Choose a reviewed license or retain a private release.':'Public inspection does not itself grant permission to reuse the source. Remixing still checks retained licensing evidence.'};
+  explanation:preference==='no'?'This Block is released privately using the existing account/team access rules. Authorized recipients keep their license rights.':preference==='license-controlled'&&!recognized?'The source license is unresolved. Choose a reviewed license or retain a private release.':'The code stays private to its creator. Others can remix it only through StillMade, and a remix belongs to the creator.'};
 }
 export function packageSourceRights(content) {
  const packages=content?.stages?content.packages||[]:[content];

package/packages/block-sdk/testing.js

@@ -9,9 +9,11 @@ import { runPackageAsync } from './runtime.js';
 import {validateView} from './view.js';
 import {validateComfyWorkflow,validateComfyExpectations,testComfyOutputs} from './comfyui.js';
 import {CAPABILITY_LIMITS,validateCapability,prepareCapabilityInvocation,validateCapabilityExpectations,testCapabilityOutputs} from './capabilities.js';
+import {validateNativeApplicationPackage,NATIVE_APPLICATION_RUNTIME_REQUIREMENT} from './native-application-package.js';
 import {validateModuleDescriptor,MODULE_LIMITS} from './module-runtime.js';
 export function validatePackage(pkg) {
   safeDocument(pkg);
+  if(pkg?.manifest?.runtime==='native-application')return validateNativeApplicationPackage(pkg);
   assert(pkg && Object.keys(pkg).every(k => ['manifest', 'recipe', 'code', 'module', 'comfyui', 'capability', 'tests', 'view', 'portable', 'desktop'].includes(k)), 'PACKAGE', 'Unknown package field');
   if(typeof pkg.manifest?.id==='string'&&pkg.manifest.id.startsWith('sm.'))assert(stableStringify(firstPartySdkPackage(pkg.manifest)??null)===stableStringify(pkg),'FIRST_PARTY_SOURCE','Use the exact published first-party package, or create a remix with a new identity.');
   const result = validateManifest(pkg.manifest);
@@ -66,6 +68,7 @@ export function validatePackage(pkg) {
 }
 export async function testPackage(pkg, { timeoutMs = 10000, wasmLocation, comfyui, capability, desktop, module } = {}) {
   validatePackage(pkg);
+  assert(pkg.manifest.runtime!=='native-application','NATIVE_APPLICATION_RUNTIME_UNAVAILABLE',NATIVE_APPLICATION_RUNTIME_REQUIREMENT);
   const results = [];
   // Module fixtures may run real WebAssembly work, so their suite may use the module run limit.
   const ceiling = pkg.manifest.runtime === 'module' ? MODULE_LIMITS.wallClockMs : 10000;

package/packages/design-system/theme.css

@@ -1,7 +1,5 @@
 @font-face{font-family:"Hanken Grotesk";font-style:normal;font-weight:100 900;font-display:swap;src:url("/fonts/HankenGrotesk-Variable.ttf") format("truetype")}
 @font-face{font-family:"Hanken Grotesk";font-style:italic;font-weight:100 900;font-display:swap;src:url("/fonts/HankenGrotesk-Italic-Variable.ttf") format("truetype")}
-@font-face{font-family:"JetBrains Mono";font-style:normal;font-weight:100 900;font-display:swap;src:url("/fonts/JetBrainsMono-Variable.ttf") format("truetype")}
-@font-face{font-family:"JetBrains Mono";font-style:italic;font-weight:100 900;font-display:swap;src:url("/fonts/JetBrainsMono-Italic-Variable.ttf") format("truetype")}
 /* Shared StillMade foundations. App and public listing pages use this file. */
 :root {
   /* ---------- Raw palette: two anchors + tonal steps ---------- */
@@ -26,7 +24,8 @@
   /* ---------- Type families ---------- */
   --font-display: "Balgin", "Hanken Grotesk", ui-sans-serif, sans-serif;
   --font-body:    "Hanken Grotesk", ui-sans-serif, sans-serif;
-  --font-mono:    "JetBrains Mono", ui-monospace, monospace;
+  /* Code only (source, code blocks). Interface text never uses it. */
+  --font-mono:    ui-monospace, "SF Mono", Menlo, Consolas, monospace;
   --font: var(--font-body);
 
   /* ---------- Type scale ---------- */
@@ -153,6 +152,11 @@
   --success: var(--fg);
   --warning: var(--signal);
   --danger:  var(--signal);
+  /* Block attention (placement-attention.js): yellow = needs an answer or rerun, red = needs a fix. Green = live or ready, blue = working. */
+  --attention-warning: #E0B24F;
+  --attention-error:   #E26A5F;
+  --attention-ok:      #6BC38E;
+  --attention-info:    #7DA7E8;
   --shadow:    var(--shadow-1);
   --shadow-lg: var(--shadow-2);
 }
@@ -216,6 +220,10 @@
   --success: var(--fg);
   --warning: var(--signal);
   --danger:  var(--signal);
+  --attention-warning: #B98200;
+  --attention-error:   #C2453D;
+  --attention-ok:      #2E7D4F;
+  --attention-info:    #2F67B8;
   --shadow:    var(--shadow-1);
   --shadow-lg: var(--shadow-2);
 }
@@ -241,6 +249,7 @@
   --editor-standout-bg: #24211D; --editor-standout-fg: #FFFFFF;
   --text-primary: var(--fg); --text-secondary: var(--fg-muted); --text-muted: var(--fg-subtle);
   --success: var(--fg); --warning: var(--signal); --danger: var(--signal);
+  --attention-warning: #B98200; --attention-error: #C2453D; --attention-ok: #2E7D4F; --attention-info: #2F67B8;
   --shadow: var(--shadow-1); --shadow-lg: var(--shadow-2);
 }