@civitai/app-sdk 0.1.0 → 0.7.0

package/dist/blocks/messages.d.ts

@@ -0,0 +1,289 @@
+/**
+ * postMessage protocol between an embedding host page and an iframe-mode block.
+ *
+ * Discriminated by `type`. Both directions share this module so producers and
+ * consumers stay in lockstep — adding a parent→block message means the block
+ * side gets a compile error until it handles the new variant (and vice versa).
+ *
+ * Wire format: `window.postMessage({ type, payload }, targetOrigin)`.
+ */
+import type { BlockCheckpointInfo, BlockContext, BlockSettings, Theme, ViewerInfo, WorkflowBody, BlockWorkflowSnapshot } from './types.js';
+/**
+ * The wrapped token shape the host sends to the block. `raw` is the JWT;
+ * `scopes`, `expiresAt`, and `buzzBudget` are extracted from the JWT claims
+ * so blocks don't have to decode it themselves. `buzzBudget` is only present
+ * when the manifest declares `ai:write:budgeted`.
+ *
+ * Mirrors the `token` field shape in civitai/civitai's `IframeHost.tsx`.
+ */
+export interface WrappedToken {
+    raw: string;
+    scopes: string[];
+    /** ISO-8601; consumers rehydrate to Date. */
+    expiresAt: string;
+    buzzBudget?: number;
+}
+/**
+ * Payload of the first `BLOCK_INIT` message a block receives. The host waits
+ * for both the iframe `load` event AND a minted token before sending this.
+ *
+ * Mirrors `BlockInitPayload` in civitai/civitai's
+ * `src/components/AppBlocks/types.ts`. Adding a field here without a
+ * matching change on the platform side (or vice versa) is the bug class
+ * `internal/validate.ts` exists to surface — keep the validator in lockstep
+ * with both sides.
+ */
+export interface BlockInitPayload {
+    blockInstanceId: string;
+    blockId: string;
+    /** The OauthClient (app) this block belongs to. */
+    appId: string;
+    token: WrappedToken;
+    context: BlockContext;
+    settings: BlockSettings;
+    /** `null` when the viewer is anonymous. */
+    viewer: ViewerInfo | null;
+    theme: Theme;
+    renderMode: 'iframe' | 'inline';
+}
+export type ParentToBlockMessage = {
+    type: 'BLOCK_INIT';
+    payload: BlockInitPayload;
+} | {
+    type: 'TOKEN_REFRESH';
+    payload: {
+        token: WrappedToken;
+    };
+} | {
+    type: 'TOKEN_REFRESH_RESPONSE';
+    payload: {
+        requestId?: string;
+        token: WrappedToken;
+    };
+} | {
+    type: 'ESTIMATE_RESULT';
+    payload: {
+        requestId: string;
+        snapshot: BlockWorkflowSnapshot;
+    };
+} | {
+    type: 'WORKFLOW_SUBMITTED';
+    payload: {
+        requestId: string;
+        snapshot: BlockWorkflowSnapshot;
+    };
+} | {
+    type: 'WORKFLOW_STATUS';
+    payload: {
+        requestId: string;
+        snapshot: BlockWorkflowSnapshot;
+    };
+} | {
+    type: 'WORKFLOW_CANCELED';
+    payload: {
+        requestId: string;
+        snapshot: BlockWorkflowSnapshot;
+    };
+} | {
+    type: 'BUZZ_PURCHASE_RESULT';
+    payload: {
+        requestId: string;
+        purchased: boolean;
+        newBalance?: number;
+    };
+} | {
+    type: 'CHECKPOINT_PICKER_RESULT';
+    payload: {
+        requestId: string;
+        selected?: BlockCheckpointInfo;
+    };
+} | {
+    type: 'USER_CHECKPOINT_SET';
+    payload: {
+        requestId: string;
+        ok: boolean;
+        error?: string;
+    };
+} | {
+    type: 'APP_STORAGE_GET_RESULT';
+    payload: {
+        requestId: string;
+        value: unknown;
+        error?: string;
+    };
+} | {
+    type: 'APP_STORAGE_SET_RESULT';
+    payload: {
+        requestId: string;
+        ok: boolean;
+        error?: string;
+        sizeBytes?: number;
+    };
+} | {
+    type: 'APP_STORAGE_DELETE_RESULT';
+    payload: {
+        requestId: string;
+        ok: boolean;
+        deleted: boolean;
+        error?: string;
+    };
+} | {
+    type: 'APP_STORAGE_LIST_RESULT';
+    payload: {
+        requestId: string;
+        keys: Array<{
+            key: string;
+            updatedAt: string;
+        }>;
+        nextCursor?: string;
+        error?: string;
+    };
+} | {
+    type: 'APP_STORAGE_QUOTA_RESULT';
+    payload: {
+        requestId: string;
+        usedBytes: number;
+        rowCount: number;
+        limitBytes: number;
+        limitRows: number;
+        error?: string;
+    };
+} | {
+    type: 'SUSPEND';
+    payload?: undefined;
+} | {
+    type: 'RESUME';
+    payload?: undefined;
+};
+export type ParentToBlockMessageType = ParentToBlockMessage['type'];
+export type BlockToParentMessage = {
+    type: 'BLOCK_READY';
+    payload: {
+        height: number;
+    };
+} | {
+    type: 'BLOCK_ERROR';
+    payload: {
+        message: string;
+        fatal: boolean;
+    };
+} | {
+    type: 'REQUEST_TOKEN';
+    payload: {
+        requestId: string;
+        blockInstanceId: string;
+    };
+} | {
+    type: 'RESIZE_IFRAME';
+    payload: {
+        height: number;
+    };
+} | {
+    type: 'SUBMIT_WORKFLOW';
+    payload: {
+        requestId: string;
+        body: WorkflowBody;
+    };
+} | {
+    type: 'ESTIMATE_WORKFLOW';
+    payload: {
+        requestId: string;
+        body: WorkflowBody;
+    };
+} | {
+    type: 'POLL_WORKFLOW';
+    payload: {
+        requestId: string;
+        workflowId: string;
+    };
+} | {
+    type: 'CANCEL_WORKFLOW';
+    payload: {
+        requestId: string;
+        workflowId: string;
+    };
+} | {
+    type: 'OPEN_BUZZ_PURCHASE';
+    payload: {
+        requestId: string;
+        suggestedAmount?: number;
+    };
+} | {
+    type: 'OPEN_CHECKPOINT_PICKER';
+    payload: {
+        requestId: string;
+        baseModelGroup: string;
+        /** Currently-selected versionId so the picker can pre-highlight it. */
+        currentVersionId?: number;
+    };
+} | {
+    type: 'SET_USER_CHECKPOINT';
+    payload: {
+        requestId: string;
+        versionId: number | null;
+    };
+} | {
+    type: 'NAVIGATE';
+    payload: {
+        path: string;
+        target: 'current' | 'new_tab';
+    };
+} | {
+    type: 'TRACK_EVENT';
+    payload: {
+        eventName: string;
+        properties?: Record<string, unknown>;
+    };
+} | {
+    type: 'APP_STORAGE_GET';
+    payload: {
+        requestId: string;
+        key: string;
+    };
+} | {
+    type: 'APP_STORAGE_SET';
+    payload: {
+        requestId: string;
+        key: string;
+        value: unknown;
+    };
+} | {
+    type: 'APP_STORAGE_DELETE';
+    payload: {
+        requestId: string;
+        key: string;
+    };
+} | {
+    type: 'APP_STORAGE_LIST';
+    payload: {
+        requestId: string;
+        prefix?: string;
+        limit?: number;
+        cursor?: string;
+    };
+} | {
+    type: 'APP_STORAGE_QUOTA';
+    payload: {
+        requestId: string;
+    };
+};
+export type BlockToParentMessageType = BlockToParentMessage['type'];
+/**
+ * Narrowing helper for either-direction message handlers.
+ *
+ * **Discriminator-only.** This only checks `data.type`; it does NOT validate
+ * the `payload` shape. A peer sending `{ type: 'BLOCK_INIT' }` with no
+ * payload or a malformed payload will satisfy this guard, and downstream
+ * access to fields like `data.payload.token.raw` will throw at runtime.
+ * Transports that cross a trust boundary (e.g. iframe `postMessage`) MUST
+ * runtime-validate the payload at the boundary before passing it on.
+ *
+ * Example:
+ *   if (isMessage(event.data, 'BLOCK_INIT')) {
+ *     // narrowed to BlockInitPayload — still must be validated
+ *   }
+ */
+export declare function isMessage<T extends ParentToBlockMessage | BlockToParentMessage, K extends T['type']>(data: unknown, type: K): data is Extract<T, {
+    type: K;
+}>;
+//# sourceMappingURL=messages.d.ts.map

package/dist/blocks/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/blocks/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,KAAK,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAMpB;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;IACxB,2CAA2C;IAC3C,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACjC;AAMD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACjD;IAKE,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE;QAAE,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;CAClC,GACD;IAIE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;CACtD,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,CAAA;CAAE,GAC5F;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,CAAA;CAAE,GAC/F;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,CAAA;CAAE,GAC5F;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,CAAA;CAAE,GAC9F;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE,GACD;IAIE,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC;CAChE,GACD;IAIE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D,GACD;IAKE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE,GACD;IAME,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF,GACD;IAKE,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/E,GACD;IAKE,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,GACD;IACE,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAMpE,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClF;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,GAC/E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAK7E;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/E;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACxF;IAKE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,uEAAuE;QACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH,GACD;IAGE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC1D,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,CAAC;CAC1D,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACtE,GAKD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7D,GACD;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAChC,CAAC;AAEN,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,oBAAoB,GAAG,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAClG,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,CAAC,GACN,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,CAOjC"}

package/dist/blocks/messages.js

@@ -0,0 +1,31 @@
+/**
+ * postMessage protocol between an embedding host page and an iframe-mode block.
+ *
+ * Discriminated by `type`. Both directions share this module so producers and
+ * consumers stay in lockstep — adding a parent→block message means the block
+ * side gets a compile error until it handles the new variant (and vice versa).
+ *
+ * Wire format: `window.postMessage({ type, payload }, targetOrigin)`.
+ */
+/**
+ * Narrowing helper for either-direction message handlers.
+ *
+ * **Discriminator-only.** This only checks `data.type`; it does NOT validate
+ * the `payload` shape. A peer sending `{ type: 'BLOCK_INIT' }` with no
+ * payload or a malformed payload will satisfy this guard, and downstream
+ * access to fields like `data.payload.token.raw` will throw at runtime.
+ * Transports that cross a trust boundary (e.g. iframe `postMessage`) MUST
+ * runtime-validate the payload at the boundary before passing it on.
+ *
+ * Example:
+ *   if (isMessage(event.data, 'BLOCK_INIT')) {
+ *     // narrowed to BlockInitPayload — still must be validated
+ *   }
+ */
+export function isMessage(data, type) {
+    return (typeof data === 'object' &&
+        data !== null &&
+        'type' in data &&
+        data.type === type);
+}
+//# sourceMappingURL=messages.js.map

package/dist/blocks/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/blocks/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqOH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CACvB,IAAa,EACb,IAAO;IAEP,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,MAAM,IAAI,IAAI;QACb,IAA0B,CAAC,IAAI,KAAK,IAAI,CAC1C,CAAC;AACJ,CAAC"}

package/dist/blocks/scopes.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Block-scope strings.
+ *
+ * Distinct from the OAuth `TokenScope` bitmask in `../scopes/`: block scopes
+ * are colon-separated lowercase identifiers that appear verbatim in the
+ * manifest and in block-scoped JWTs. The civitai/civitai server owns the
+ * mapping from these strings to OAuth bits.
+ *
+ * Format: `domain:verb:target`, all lowercase. `defineBlock` rejects any
+ * scope that does not match this pattern, including the PascalCase form
+ * used elsewhere in the SDK for OAuth bits.
+ */
+export declare const BLOCK_SCOPES: {
+    readonly MODELS_READ_SELF: "models:read:self";
+    readonly MEDIA_READ_OWNED: "media:read:owned";
+    readonly USER_READ_SELF: "user:read:self";
+    readonly AI_WRITE_BUDGETED: "ai:write:budgeted";
+    readonly BUZZ_READ_SELF: "buzz:read:self";
+    readonly BLOCK_SETTINGS_READ: "block:settings:read";
+    readonly BLOCK_SETTINGS_WRITE: "block:settings:write";
+    readonly SOCIAL_TIP_SELF: "social:tip:self";
+};
+export type BlockScopeKey = keyof typeof BLOCK_SCOPES;
+export type BlockScope = (typeof BLOCK_SCOPES)[BlockScopeKey];
+/**
+ * Regex enforced by `defineBlock` and the JSON schema.
+ *
+ * The 3-segment shape (`domain:verb:target`) is **intentional**: scope
+ * comparisons in token validation rely on it. Relaxing this (e.g. to allow
+ * 4+ segments like `ai:write:image:budgeted`) requires a coordinated change
+ * across the SDK, the JSON schema, the civitai/civitai token validator,
+ * and a `@civitai/app-sdk` major bump.
+ */
+export declare const BLOCK_SCOPE_PATTERN: RegExp;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/blocks/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/blocks/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;CASf,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,YAAY,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,aAAa,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,QAA2B,CAAC"}

package/dist/blocks/scopes.js

@@ -0,0 +1,33 @@
+/**
+ * Block-scope strings.
+ *
+ * Distinct from the OAuth `TokenScope` bitmask in `../scopes/`: block scopes
+ * are colon-separated lowercase identifiers that appear verbatim in the
+ * manifest and in block-scoped JWTs. The civitai/civitai server owns the
+ * mapping from these strings to OAuth bits.
+ *
+ * Format: `domain:verb:target`, all lowercase. `defineBlock` rejects any
+ * scope that does not match this pattern, including the PascalCase form
+ * used elsewhere in the SDK for OAuth bits.
+ */
+export const BLOCK_SCOPES = {
+    MODELS_READ_SELF: 'models:read:self',
+    MEDIA_READ_OWNED: 'media:read:owned',
+    USER_READ_SELF: 'user:read:self',
+    AI_WRITE_BUDGETED: 'ai:write:budgeted',
+    BUZZ_READ_SELF: 'buzz:read:self',
+    BLOCK_SETTINGS_READ: 'block:settings:read',
+    BLOCK_SETTINGS_WRITE: 'block:settings:write',
+    SOCIAL_TIP_SELF: 'social:tip:self',
+};
+/**
+ * Regex enforced by `defineBlock` and the JSON schema.
+ *
+ * The 3-segment shape (`domain:verb:target`) is **intentional**: scope
+ * comparisons in token validation rely on it. Relaxing this (e.g. to allow
+ * 4+ segments like `ai:write:image:budgeted`) requires a coordinated change
+ * across the SDK, the JSON schema, the civitai/civitai token validator,
+ * and a `@civitai/app-sdk` major bump.
+ */
+export const BLOCK_SCOPE_PATTERN = /^[a-z]+:[a-z]+:[a-z]+$/;
+//# sourceMappingURL=scopes.js.map

package/dist/blocks/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/blocks/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,cAAc,EAAE,gBAAgB;IAChC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;IAChC,mBAAmB,EAAE,qBAAqB;IAC1C,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAKX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC"}