@civitai/app-sdk 0.50.0 → 0.51.0

package/dist/blocks/types.d.ts

@@ -1489,6 +1489,16 @@ export interface BlockManifestV1 {
      * `BLOCK_INIT` — that's why `BlockInitPayload.renderMode` is narrower.
      */
     renderMode?: 'iframe' | 'inline' | 'hybrid';
+    /**
+     * Which credential the host hands the block. OPTIONAL, and the canonical does
+     * NOT list it in `required`: omitting it means `"block-token"` — the
+     * block-scoped JWT that `BLOCK_INIT` already carries. `"oauth"` opts the block
+     * into a real OAuth access token for its own `OauthClient`, accepted unchanged
+     * by `/api/v1`, the orchestrator and the MCP. Kept in lockstep with the
+     * canonical schema's `auth` enum; `defineBlock` derives the runtime check from
+     * the vendored schema, so the two cannot disagree on the accepted values.
+     */
+    auth?: 'block-token' | 'oauth';
     /**
      * Config-as-code: the command the platform runs to build the static bundle.
      * One of an allowlisted set (`npm|pnpm|yarn run <script>`, `vite build`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",

package/schemas/app-block/v1.json

@@ -70,6 +70,11 @@
       "description": "How the block renders. Defaults to \"iframe\". \"inline\"/\"hybrid\" require a verified/internal trust tier (server-assigned), so authors should leave this as iframe.",
       "enum": ["iframe", "inline", "hybrid"]
     },
+    "auth": {
+      "type": "string",
+      "description": "Which credential the host hands the block: \"block-token\" (default when omitted) is the block-scoped JWT; \"oauth\" opts the block into a real OAuth access token for its own OauthClient, accepted unchanged by /api/v1, the orchestrator and the MCP.",
+      "enum": ["block-token", "oauth"]
+    },
     "trustTier": {
       "type": "string",
       "description": "SERVER-OWNED. Do NOT set this in your manifest — the platform assigns the trust tier during review. Present here only to reject dev-set values.",