feat(templates): page-money uses SDK Harness + unit/e2e test boilerplate

[ZacxDev]

What

Phase 2 of the App Blocks DX work: the page-money scaffold now adopts the published SDK mock host shipped in @civitai/[email protected] (the /testing export) and ships unit + component + e2e test boilerplate, so a freshly-created app runs locally and is tested out of the box.

Templates-only change (plus a CI job). No CLI command code touched (that's #6 / the app create PR #5/#6 — no overlap).

Changes

• Slim the Harness: replace the ~250-line hand-rolled src/Harness.tsx simulator with a ~15-line wrapper around the SDK's <Harness> (createMockHost under the hood). Net -232 lines of per-block boilerplate.
• Transport-origin wiring: add src/dev-transport.ts that allowlists window.location.origin for the dev harness AND tests — the mock host replies from that origin and the SDK IframeTransport drops mismatched-origin messages. main.tsx calls installHarnessTransport() before render in harness mode (prod still uses the baked-in VITE_BLOCK_ALLOWED_PARENT_ORIGINS).
• Dep bumps: @civitai/blocks-react ^0.8.0 + @civitai/app-sdk ^0.12.0 (the 0.8.0 peer requires >=0.10.0). Add @testing-library/react + @testing-library/jest-dom + @testing-library/user-event devDeps.
• vitest split: two projects in one vitest run — node (*.test.ts, pure logic) + dom (*.test.tsx, jsdom) via test.projects. Add src/test-setup.ts (jest-dom matchers + per-test transport reset + cleanup). Existing generation.test.ts kept.
• New tests:
  • src/App.test.tsx — component: anon → sign-in affordance, signed-in → prompt + Generate, loading state.
  • src/e2e.test.tsx — the money-path proof, driving the FULL flow through the real SDK transport (no hook mocking): estimate → consent → submit → poll → succeeded (+cost), plus the insufficient-Buzz Top-Up path.
• README updated for the new harness + test split.
• CI rot-guard: a new template-page-money job scaffolds the template and runs npm install / typecheck / test / build / app validate against the published SDK, so the template can't silently rot after an SDK bump.

Verification (real scaffolded project)

Scaffolded page-money via the built CLI, then on the rendered project:

• npm install → resolved @civitai/[email protected] + @civitai/[email protected], 0 vulnerabilities.
• npm run typecheck → clean.
• npm test → 14 passed (3 files): 9 node + 5 dom (3 component + 2 e2e). The full money-path e2e exercises the real transport round-trips (~2.1s).
• npm run build → tsc + vite build OK (208 kB / 66 kB gzip).
• civitai app validate → OK — . is valid.
• go test ./... → green (scaffold render tests unaffected; subset checks tolerate the new files).

🤖 Generated with Claude Code