@civitai/app-sdk 0.58.0 → 0.59.0

package/README.md

@@ -266,7 +266,7 @@ no entry fails the suite.
 > assigned server-side, so it cannot be enforced locally.
 
 **Where it runs.** Every scaffold that ships a `block.manifest.json`
-(`starters/civitai-block-starter` and all six `starters/examples/*`) registers
+(`starters/civitai-block-starter` and every `starters/examples/*` app) registers
 `blockManifestPlugin` from `@civitai/app-sdk/vite` in its `vite.config.ts`. It
 fires from Vite's `configResolved`, the one hook called on both the dev-server
 and the build path — so `pnpm dev`, `pnpm dev:harness` and `pnpm build` all fail

package/dist/blocks/messages.d.ts

@@ -213,7 +213,8 @@ export interface BlockInitPayload {
      * fail-closed defaults for you. `@civitai/blocks-react`'s
      * `useDomainMaturity()` is the React wrapper over the same thing — it is one
      * way to get this right, not the only one, since this module is
-     * runtime-agnostic and two of the starters ship without React.
+     * runtime-agnostic and several starters — the Civitai App starter among
+     * them — ship without React.
      */
     effectiveBrowsingLevel?: number;
 }

package/dist/blocks/scopes.d.ts

@@ -26,6 +26,7 @@ export declare const BLOCK_SCOPES: {
     readonly POSTS_WRITE_SELF: "posts:write:self";
     readonly GOODS_READ_SELF: "goods:read:self";
     readonly GOODS_PURCHASE_SELF: "goods:purchase:self";
+    readonly APPS_STORE_ITEMS_WRITE: "apps:store:items:write";
 };
 export type BlockScopeKey = keyof typeof BLOCK_SCOPES;
 export type BlockScope = (typeof BLOCK_SCOPES)[BlockScopeKey];
@@ -44,8 +45,8 @@ export type BlockScope = (typeof BLOCK_SCOPES)[BlockScopeKey];
  *
  * The 4th segment was added to mirror the server's 4-segment
  * `apps:storage:shared:read` / `apps:storage:shared:write` scopes (the SHARED
- * cross-user datastore). The SDK now tracks the server's 4-segment scopes
- * directly, so this is no longer a coordinated-major-bump situation — the
+ * cross-user datastore); `apps:store:items:write` is the same shape. The SDK
+ * now tracks the server's 4-segment scopes directly, so this is no longer a coordinated-major-bump situation — the
  * pattern just widened to accept the shapes the canonical enum already lists.
  */
 export declare const BLOCK_SCOPE_PATTERN: RegExp;

package/dist/blocks/scopes.js

@@ -24,7 +24,7 @@ export const BLOCK_SCOPES = {
     // apps:storage:shared:* — the SHARED (app-global / cross-user) datastore. Same
     // no-OAuth-bit posture as apps:storage:*; the server gates them by presence in
     // the block's approved scope set (plus a min-trust gate + fail-closed flag).
-    // These are the SDK's only 4-segment scopes — see BLOCK_SCOPE_PATTERN below.
+    // 4-segment (as is `apps:store:items:write`) — see BLOCK_SCOPE_PATTERN below.
     APPS_STORAGE_SHARED_READ: 'apps:storage:shared:read',
     APPS_STORAGE_SHARED_WRITE: 'apps:storage:shared:write',
     // collections:* — the App Blocks Collections surface. These have no OAuth bit
@@ -62,6 +62,22 @@ export const BLOCK_SCOPES = {
     // always needs an explicit grant. Do not collapse the two.
     GOODS_READ_SELF: 'goods:read:self',
     GOODS_PURCHASE_SELF: 'goods:purchase:self',
+    // apps:store:items:write — publish the VIEWER'S OWN app items into the App
+    // Store as sub-listing cards under the calling app (civitai/civitai#5511,
+    // `/api/v1/blocks/sub-listings/{upsert,withdraw,mine}`). No OAuth bit.
+    //
+    // SENSITIVE: it writes store cards every visitor sees, under the viewer's
+    // name, so a declaring manifest MUST carry a `scopeJustifications` entry or
+    // the server rejects it at submit (not mirrored by `defineBlock` — see
+    // KNOWN_GAPS in `../manifest/defineBlock.ts`).
+    //
+    // CONSENT-EXEMPT on the server, like `apps:storage:shared:write`: the real
+    // gates run per call (the parent's enable switch, the shared-write trust
+    // check, item authorship, text safety, rate limits, moderator approval), and
+    // a consent-gated scope would be dropped from tokens before any could run.
+    // Requires a signed-in (non-anonymous) subject. 4-segment, like the shared
+    // storage scopes — see BLOCK_SCOPE_PATTERN below.
+    APPS_STORE_ITEMS_WRITE: 'apps:store:items:write',
 };
 /**
  * Format helper for the block-scope shape — 3 OR 4 colon-separated lowercase
@@ -78,8 +94,8 @@ export const BLOCK_SCOPES = {
  *
  * The 4th segment was added to mirror the server's 4-segment
  * `apps:storage:shared:read` / `apps:storage:shared:write` scopes (the SHARED
- * cross-user datastore). The SDK now tracks the server's 4-segment scopes
- * directly, so this is no longer a coordinated-major-bump situation — the
+ * cross-user datastore); `apps:store:items:write` is the same shape. The SDK
+ * now tracks the server's 4-segment scopes directly, so this is no longer a coordinated-major-bump situation — the
  * pattern just widened to accept the shapes the canonical enum already lists.
  */
 export const BLOCK_SCOPE_PATTERN = /^[a-z]+:[a-z]+:[a-z]+(?::[a-z]+)?$/;

package/dist/blocks/types.d.ts

@@ -1933,11 +1933,13 @@ export interface BlockManifestV1 {
      */
     $schema?: 'https://civitai.com/schemas/app-block/v1.json' | (string & {});
     /**
-     * NOT a canonical manifest property, and NOT validated. Your app id lives in
-     * `civitai.app.json` (`{"appId": "..."}`), which is what the `civitai` CLI
-     * reads. The canonical does not forbid extra top-level keys, so the server
-     * ignores this one; the scaffolds still carry `"app_REPLACE_ME"` and it is
-     * inert.
+     * NOT a canonical manifest property, and NOT validated. Nothing reads it: the
+     * canonical does not forbid extra top-level keys, so the server ignores this
+     * one, and the Go `civitai` CLI identifies an app by the manifest's
+     * `blockId` (its `app submit` keys the submission on it). There is no
+     * separate app-id file either — an earlier version of this comment pointed at
+     * a `civitai.app.json`, which no current tool reads. Scaffolds that still
+     * carry `"app_REPLACE_ME"` here are carrying an inert key.
      */
     appId?: string;
     blockId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",

package/schemas/app-block/v1.json

@@ -101,13 +101,14 @@
           "collections:read:private",
           "posts:write:self",
           "goods:read:self",
-          "goods:purchase:self"
+          "goods:purchase:self",
+          "apps:store:items:write"
         ]
       }
     },
     "scopeJustifications": {
       "type": "object",
-      "description": "Per-scope justification: a map of scope-id → free-text rationale explaining WHY the app needs that permission, shown to the moderator during review. REQUIRED for SENSITIVE scopes — any declared scope that can spend or read the viewer's Buzz, read the viewer's private data, or write data other users see (e.g. `ai:write:budgeted`, `social:tip:self`, `goods:purchase:self`, `buzz:read:self`, `collections:read:private`, `apps:storage:shared:write`, `posts:write:self`) MUST carry a non-empty justification here, or the manifest is rejected at submit time. OPTIONAL for non-sensitive scopes — omit those and the manifest stays valid. Every key MUST be a scope also present in `scopes` (justifications for scopes you don't request are rejected). Each value is a non-empty string of at most 500 characters. The requirement is enforced imperatively by the manifest validator (not expressed as JSON-Schema conditionals here). NOTE: the justification captures the developer's STATED rationale only; the platform does not verify the truth of the claims.",
+      "description": "Per-scope justification: a map of scope-id → free-text rationale explaining WHY the app needs that permission, shown to the moderator during review. REQUIRED for SENSITIVE scopes — any declared scope that can spend or read the viewer's Buzz, read the viewer's private data, or write data other users see (e.g. `ai:write:budgeted`, `social:tip:self`, `goods:purchase:self`, `buzz:read:self`, `collections:read:private`, `apps:storage:shared:write`, `posts:write:self`, `apps:store:items:write`) MUST carry a non-empty justification here, or the manifest is rejected at submit time. OPTIONAL for non-sensitive scopes — omit those and the manifest stays valid. Every key MUST be a scope also present in `scopes` (justifications for scopes you don't request are rejected). Each value is a non-empty string of at most 500 characters. The requirement is enforced imperatively by the manifest validator (not expressed as JSON-Schema conditionals here). NOTE: the justification captures the developer's STATED rationale only; the platform does not verify the truth of the claims.",
       "additionalProperties": {
         "type": "string",
         "minLength": 1,