@civitai/app-sdk 0.58.0 → 0.60.0

package/README.md

@@ -266,7 +266,7 @@ no entry fails the suite.
 > assigned server-side, so it cannot be enforced locally.
 
 **Where it runs.** Every scaffold that ships a `block.manifest.json`
-(`starters/civitai-block-starter` and all six `starters/examples/*`) registers
+(`starters/civitai-block-starter` and every `starters/examples/*` app) registers
 `blockManifestPlugin` from `@civitai/app-sdk/vite` in its `vite.config.ts`. It
 fires from Vite's `configResolved`, the one hook called on both the dev-server
 and the build path — so `pnpm dev`, `pnpm dev:harness` and `pnpm build` all fail
@@ -528,7 +528,7 @@ The starters in `civitai/civitai-app-starters` wire this into framework-specific
 
 ## Choosing a workflow step type
 
-The orchestrator is a workflow API: each request submits a list of typed steps. `WORKFLOW_STEP_TYPES` is the in-code catalog of every step `$type` it accepts, with a one-line description for each — `textToImage`, `imageGen`, `videoGen`, `comfy`, `customComfy`, `textToSpeech`, `aceStepAudio`, `transcription`, `imageUpscaler` among them (53 in total).
+The orchestrator is a workflow API: each request submits a list of typed steps. `WORKFLOW_STEP_TYPES` is the in-code catalog of every step `$type` it accepts, with a one-line description for each — `textToImage`, `imageGen`, `videoGen`, `comfy`, `customComfy`, `textToSpeech`, `aceStepAudio`, `transcription`, `imageUpscaler` among them (55 in total).
 
 The catalog is pinned to the orchestrator's published OpenAPI spec two ways — an offline unit test against a transcribed copy of the spec's `WorkflowStepTemplate` discriminator mapping, and a CI job (`pnpm check:catalogs`) that re-fetches the live spec and diffs it. If a `$type` is listed here, the orchestrator accepts it.
 
@@ -603,15 +603,15 @@ What it exports:
 
 | Export | What |
 |---|---|
-| `WorkflowStepTemplates` | `$type` → template type, for 47 of the catalog's 53 step types. Keyed by the WIRE name, which the generated type names don't always match (`model3DPreview` → `Model3dPreviewStepTemplate`). |
+| `WorkflowStepTemplates` | `$type` → template type, for 47 of the catalog's 55 step types. Keyed by the WIRE name, which the generated type names don't always match (`model3DPreview` → `Model3dPreviewStepTemplate`). |
 | `WorkflowStepTemplateFor<'videoGen'>` | One step's template. |
 | `WorkflowStepInputFor<'videoGen'>` | One step's `input` shape, without needing the generated `*Input` name. |
 | `AnyWorkflowStepTemplate` | Discriminated union of all 47 mapped templates — `Extract<…, { $type: 'comfy' }>` and exhaustive `switch` work. `@civitai/client`'s base `WorkflowStepTemplate` has `$type` as a bare `string`, so it narrows nothing. |
 | `TypedWorkflowTemplate` | The submit envelope with `steps` narrowed to that union. Pass it straight to `submitWorkflow` / `estimateWorkflow`. |
 
-> 🔴 **The map is not total over the catalog, and that is the expected state.** `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with no generated template in the pinned `@civitai/client` are `imageScanning`, `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and `WorkflowStepTemplateFor<…>` is a compile error for each of them.
+> 🔴 **The map is not total over the catalog, and that is the expected state.** `WORKFLOW_STEP_TYPES` documents 55 `$type`s; this map covers 47. The 8 with no generated template in the pinned `@civitai/client` are `imageScanning`, `liveTextToSpeech`, `liveTranscription`, `merge`, `preprocessVideo`, `promptModeration`, `soniloAudioGen`, `yuE2`, and `WorkflowStepTemplateFor<…>` is a compile error for each of them.
 >
-> The two surfaces move independently on purpose: the catalog tracks the **live** orchestrator spec (a daily job syncs it), while these types track whatever `@civitai/client` was last published from. So the catalog runs ahead and the client catches up. The gap is never silent — `test/orchestrator/step-templates.test-d.ts` carries it as a `never` ledger plus one `@ts-expect-error` per gap `$type`, and `test/orchestrator/step-count-prose.test.ts` derives all four numbers (53, 47, 6, and the names) from `WORKFLOW_STEP_TYPES` and the map's own AST, then fails if this paragraph or its twin in `src/orchestrator/steps.ts` disagrees by one character.
+> The two surfaces move independently on purpose: the catalog tracks the **live** orchestrator spec (a daily job syncs it), while these types track whatever `@civitai/client` was last published from. So the catalog runs ahead and the client catches up. The gap is never silent — `test/orchestrator/step-templates.test-d.ts` carries it as a `never` ledger plus one `@ts-expect-error` per gap `$type`, and `test/orchestrator/step-count-prose.test.ts` derives all four numbers (55, 47, 8, and the names) from `WORKFLOW_STEP_TYPES` and the map's own AST, then fails if this paragraph or its twin in `src/orchestrator/steps.ts` disagrees by one character.
 
 The generated `*StepTemplate` and `*Input` types are **not** re-exported individually. Using this subpath already requires `@civitai/client` installed, so if you want one by name, import it straight from there — `import type { TextToImageStepTemplate } from '@civitai/client'`.
 
@@ -650,7 +650,7 @@ Several of the 47 exist to serve Civitai's own pipelines rather than third-party
 
 `training` and `imageResourceTraining` are the exception: an App Block's host explicitly **allows** them on the pass-through arm (see `WorkflowBodyPassThroughStep` under Primitives above for the `maxBuzz` bound, and how a trained epoch is published). For a standalone app, the orchestrator's own authorization still decides.
 
-Note that `WORKFLOW_STEP_TYPES` does **not** mark most of them: of its 53 entries exactly two — `comfyNodepackSnapshot` and `qwenImageBench` — sit under its "Platform internals" heading, and the rest are ordinary documented entries (`webScrape` even carries usage notes). The reason the platform steps are typed anyway is not that the catalog flags them as internal; it's that the catalog *documents* them, so skipping them would make `WorkflowStepTemplateFor<'training'>` a compile error for a step type the SDK documents — which is exactly what is live today for the 3 `$type`s the pinned client cannot type, and is why that gap is spelled out above rather than left to be discovered.
+Note that `WORKFLOW_STEP_TYPES` does **not** mark most of them: of its 55 entries exactly three — `comfyNodepackSnapshot`, `qwenImageBench` and `promptModeration` — sit under its "Platform internals" heading, and the rest are ordinary documented entries (`webScrape` even carries usage notes). The reason the platform steps are typed anyway is not that the catalog flags them as internal; it's that the catalog *documents* them, so skipping them would make `WorkflowStepTemplateFor<'training'>` a compile error for a step type the SDK documents — which is exactly what is live today for each `$type` the pinned client cannot type, and is why that gap is spelled out above rather than left to be discovered.
 
 ## Public vs. confidential clients
 

package/dist/blocks/messages.d.ts

@@ -213,7 +213,8 @@ export interface BlockInitPayload {
      * fail-closed defaults for you. `@civitai/blocks-react`'s
      * `useDomainMaturity()` is the React wrapper over the same thing — it is one
      * way to get this right, not the only one, since this module is
-     * runtime-agnostic and two of the starters ship without React.
+     * runtime-agnostic and several starters — the Civitai App starter among
+     * them — ship without React.
      */
     effectiveBrowsingLevel?: number;
 }

package/dist/blocks/scopes.d.ts

@@ -26,6 +26,7 @@ export declare const BLOCK_SCOPES: {
     readonly POSTS_WRITE_SELF: "posts:write:self";
     readonly GOODS_READ_SELF: "goods:read:self";
     readonly GOODS_PURCHASE_SELF: "goods:purchase:self";
+    readonly APPS_STORE_ITEMS_WRITE: "apps:store:items:write";
 };
 export type BlockScopeKey = keyof typeof BLOCK_SCOPES;
 export type BlockScope = (typeof BLOCK_SCOPES)[BlockScopeKey];
@@ -44,8 +45,8 @@ export type BlockScope = (typeof BLOCK_SCOPES)[BlockScopeKey];
  *
  * The 4th segment was added to mirror the server's 4-segment
  * `apps:storage:shared:read` / `apps:storage:shared:write` scopes (the SHARED
- * cross-user datastore). The SDK now tracks the server's 4-segment scopes
- * directly, so this is no longer a coordinated-major-bump situation — the
+ * cross-user datastore); `apps:store:items:write` is the same shape. The SDK
+ * now tracks the server's 4-segment scopes directly, so this is no longer a coordinated-major-bump situation — the
  * pattern just widened to accept the shapes the canonical enum already lists.
  */
 export declare const BLOCK_SCOPE_PATTERN: RegExp;

package/dist/blocks/scopes.js

@@ -24,7 +24,7 @@ export const BLOCK_SCOPES = {
     // apps:storage:shared:* — the SHARED (app-global / cross-user) datastore. Same
     // no-OAuth-bit posture as apps:storage:*; the server gates them by presence in
     // the block's approved scope set (plus a min-trust gate + fail-closed flag).
-    // These are the SDK's only 4-segment scopes — see BLOCK_SCOPE_PATTERN below.
+    // 4-segment (as is `apps:store:items:write`) — see BLOCK_SCOPE_PATTERN below.
     APPS_STORAGE_SHARED_READ: 'apps:storage:shared:read',
     APPS_STORAGE_SHARED_WRITE: 'apps:storage:shared:write',
     // collections:* — the App Blocks Collections surface. These have no OAuth bit
@@ -62,6 +62,22 @@ export const BLOCK_SCOPES = {
     // always needs an explicit grant. Do not collapse the two.
     GOODS_READ_SELF: 'goods:read:self',
     GOODS_PURCHASE_SELF: 'goods:purchase:self',
+    // apps:store:items:write — publish the VIEWER'S OWN app items into the App
+    // Store as sub-listing cards under the calling app (civitai/civitai#5511,
+    // `/api/v1/blocks/sub-listings/{upsert,withdraw,mine}`). No OAuth bit.
+    //
+    // SENSITIVE: it writes store cards every visitor sees, under the viewer's
+    // name, so a declaring manifest MUST carry a `scopeJustifications` entry or
+    // the server rejects it at submit (not mirrored by `defineBlock` — see
+    // KNOWN_GAPS in `../manifest/defineBlock.ts`).
+    //
+    // CONSENT-EXEMPT on the server, like `apps:storage:shared:write`: the real
+    // gates run per call (the parent's enable switch, the shared-write trust
+    // check, item authorship, text safety, rate limits, moderator approval), and
+    // a consent-gated scope would be dropped from tokens before any could run.
+    // Requires a signed-in (non-anonymous) subject. 4-segment, like the shared
+    // storage scopes — see BLOCK_SCOPE_PATTERN below.
+    APPS_STORE_ITEMS_WRITE: 'apps:store:items:write',
 };
 /**
  * Format helper for the block-scope shape — 3 OR 4 colon-separated lowercase
@@ -78,8 +94,8 @@ export const BLOCK_SCOPES = {
  *
  * The 4th segment was added to mirror the server's 4-segment
  * `apps:storage:shared:read` / `apps:storage:shared:write` scopes (the SHARED
- * cross-user datastore). The SDK now tracks the server's 4-segment scopes
- * directly, so this is no longer a coordinated-major-bump situation — the
+ * cross-user datastore); `apps:store:items:write` is the same shape. The SDK
+ * now tracks the server's 4-segment scopes directly, so this is no longer a coordinated-major-bump situation — the
  * pattern just widened to accept the shapes the canonical enum already lists.
  */
 export const BLOCK_SCOPE_PATTERN = /^[a-z]+:[a-z]+:[a-z]+(?::[a-z]+)?$/;

package/dist/blocks/types.d.ts

@@ -1933,11 +1933,13 @@ export interface BlockManifestV1 {
      */
     $schema?: 'https://civitai.com/schemas/app-block/v1.json' | (string & {});
     /**
-     * NOT a canonical manifest property, and NOT validated. Your app id lives in
-     * `civitai.app.json` (`{"appId": "..."}`), which is what the `civitai` CLI
-     * reads. The canonical does not forbid extra top-level keys, so the server
-     * ignores this one; the scaffolds still carry `"app_REPLACE_ME"` and it is
-     * inert.
+     * NOT a canonical manifest property, and NOT validated. Nothing reads it: the
+     * canonical does not forbid extra top-level keys, so the server ignores this
+     * one, and the Go `civitai` CLI identifies an app by the manifest's
+     * `blockId` (its `app submit` keys the submission on it). There is no
+     * separate app-id file either — an earlier version of this comment pointed at
+     * a `civitai.app.json`, which no current tool reads. Scaffolds that still
+     * carry `"app_REPLACE_ME"` here are carrying an inert key.
      */
     appId?: string;
     blockId: string;

package/dist/orchestrator/index.d.ts

@@ -113,6 +113,15 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly transcode: "Audio/video transcoding";
     /** Text-to-speech (multi-voice, multi-language). */
     readonly textToSpeech: "Text-to-speech synthesis";
+    /**
+     * Streaming text-to-speech. Inputs mirror `textToSpeech`, restricted to voices
+     * that stream with low first-audio latency. The output hands back an
+     * `inputUrl` you POST UTF-8 text chunks to (`?seq=0,1,…`, `final=true` on the
+     * last) and one continuous `audioUrl` stream (`pcm` s16le 24 kHz mono, or
+     * `ogg` Opus). The session ends at `maxCharacters` or after
+     * `idleTimeoutSeconds` without input, and is billed on characters spoken.
+     */
+    readonly liveTextToSpeech: "Streaming text-to-speech — post text in chunks, read back one continuous audio stream";
     /** Music generation via ACE Step 1.5 (lyrics + style → song). */
     readonly aceStepAudio: "Music generation (ACE Step 1.5)";
     /**
@@ -139,6 +148,8 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly soniloAudioGen: "Music or a sound effect from a text prompt (Sonilo)";
     /** Speech-to-text transcription. */
     readonly transcription: "Speech-to-text transcription";
+    /** Speech-to-text over audio streamed in while the user is still talking. */
+    readonly liveTranscription: "Live speech-to-text from audio streamed while the user talks";
     /** Generate captions from audio. */
     readonly audioCaptioning: "Caption generation from audio";
     /**
@@ -215,12 +226,14 @@ export declare const WORKFLOW_STEP_TYPES: {
     readonly echo: "Echo step — round-trip the input for testing";
     /** Package multiple blobs into a zip archive. */
     readonly blobArchive: "Zip multiple blobs into an archive";
+    /** Combine fields from earlier steps' outputs into a single result. */
+    readonly merge: "Merge — combine fields from earlier steps' outputs into one result";
     /** Snapshot the installed ComfyUI custom-node packs on a worker. */
     readonly comfyNodepackSnapshot: "Snapshot a worker’s installed ComfyUI node packs (internal)";
     /** Qwen image benchmarking harness. */
     readonly qwenImageBench: "Qwen image benchmarking (internal)";
-    readonly liveTranscription: "Live speech-to-text from audio streamed while the user talks";
-    readonly merge: "Merge — combine fields from earlier steps' outputs into one result";
+    /** Per-label scores and flags for a positive / negative prompt pair, under a versioned policy. */
+    readonly promptModeration: "Prompt moderation — per-label scores and flags for a prompt pair (internal)";
 };
 export type WorkflowStepType = keyof typeof WORKFLOW_STEP_TYPES;
 /**

package/dist/orchestrator/index.js

@@ -117,6 +117,15 @@ export const WORKFLOW_STEP_TYPES = {
     // ----- Audio -------------------------------------------------------------
     /** Text-to-speech (multi-voice, multi-language). */
     textToSpeech: 'Text-to-speech synthesis',
+    /**
+     * Streaming text-to-speech. Inputs mirror `textToSpeech`, restricted to voices
+     * that stream with low first-audio latency. The output hands back an
+     * `inputUrl` you POST UTF-8 text chunks to (`?seq=0,1,…`, `final=true` on the
+     * last) and one continuous `audioUrl` stream (`pcm` s16le 24 kHz mono, or
+     * `ogg` Opus). The session ends at `maxCharacters` or after
+     * `idleTimeoutSeconds` without input, and is billed on characters spoken.
+     */
+    liveTextToSpeech: 'Streaming text-to-speech — post text in chunks, read back one continuous audio stream',
     /** Music generation via ACE Step 1.5 (lyrics + style → song). */
     aceStepAudio: 'Music generation (ACE Step 1.5)',
     /**
@@ -143,6 +152,8 @@ export const WORKFLOW_STEP_TYPES = {
     soniloAudioGen: 'Music or a sound effect from a text prompt (Sonilo)',
     /** Speech-to-text transcription. */
     transcription: 'Speech-to-text transcription',
+    /** Speech-to-text over audio streamed in while the user is still talking. */
+    liveTranscription: 'Live speech-to-text from audio streamed while the user talks',
     /** Generate captions from audio. */
     audioCaptioning: 'Caption generation from audio',
     // ----- Media composition -------------------------------------------------
@@ -226,6 +237,8 @@ export const WORKFLOW_STEP_TYPES = {
     echo: 'Echo step — round-trip the input for testing',
     /** Package multiple blobs into a zip archive. */
     blobArchive: 'Zip multiple blobs into an archive',
+    /** Combine fields from earlier steps' outputs into a single result. */
+    merge: "Merge — combine fields from earlier steps' outputs into one result",
     // ----- Platform internals ------------------------------------------------
     // Present in the consumer spec, so listed here for completeness — but these
     // exist to serve Civitai's own pipelines. A third-party app has no reason to
@@ -234,15 +247,8 @@ export const WORKFLOW_STEP_TYPES = {
     comfyNodepackSnapshot: 'Snapshot a worker’s installed ComfyUI node packs (internal)',
     /** Qwen image benchmarking harness. */
     qwenImageBench: 'Qwen image benchmarking (internal)',
-    // ----- Auto-added 2026-10-06 from the orchestrator spec ----------------------
-    // Added by scripts/sync-orchestrator-catalogs.mjs: the live spec accepts
-    // these and this catalog did not list them. MOVE each entry into the right
-    // section above, and replace any TODO(catalog) line with a real one-line
-    // description — `pnpm check:catalogs` names every placeholder that is left.
-    // (That check is advisory, so it will not stop this merging. It is a
-    // reminder, not a gate.)
-    liveTranscription: 'Live speech-to-text from audio streamed while the user talks',
-    merge: "Merge — combine fields from earlier steps' outputs into one result",
+    /** Per-label scores and flags for a positive / negative prompt pair, under a versioned policy. */
+    promptModeration: 'Prompt moderation — per-label scores and flags for a prompt pair (internal)',
 };
 /**
  * Engines that the `imageGen` step accepts. Each one has its own input shape;

package/dist/orchestrator/steps.d.ts

@@ -3,7 +3,7 @@
  * own generated client (`@civitai/client`).
  *
  * The sibling `@civitai/app-sdk/orchestrator` module gives you the *catalog*
- * (`WORKFLOW_STEP_TYPES` — 53 `$type` names and what each one does) and the
+ * (`WORKFLOW_STEP_TYPES` — 55 `$type` names and what each one does) and the
  * fetch helpers (`submitWorkflow`, `estimateWorkflow`, …), but its body
  * builders take `input: unknown`. This module is the missing half: the actual
  * per-step input shapes, tracked against the orchestrator's OpenAPI spec by
@@ -78,9 +78,9 @@
  * orchestrator's own authorization still decides.
  *
  * ⚠️ `WORKFLOW_STEP_TYPES` does NOT mark most of them. Counted at this commit:
- * of its 53 entries, exactly TWO sit under its "Platform internals" heading —
- * `comfyNodepackSnapshot` and `qwenImageBench`. `training`, `webScrape`,
- * `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
+ * of its 55 entries, exactly THREE sit under its "Platform internals" heading —
+ * `comfyNodepackSnapshot`, `qwenImageBench` and `promptModeration`. `training`,
+ * `webScrape`, `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
  * ordinary documented entries under ordinary headings, and `webScrape` carries
  * consumer-facing usage notes. So "the catalog already flags these as internal"
  * is not a reason this map types them, and an earlier version of this docblock
@@ -97,9 +97,10 @@
  * (#315) without anything going red. The measured state, derived rather than
  * typed:
  *
- * `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with
+ * `WORKFLOW_STEP_TYPES` documents 55 `$type`s; this map covers 47. The 8 with
  * no generated template in the pinned `@civitai/client` are `imageScanning`,
- * `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and
+ * `liveTextToSpeech`, `liveTranscription`, `merge`, `preprocessVideo`,
+ * `promptModeration`, `soniloAudioGen`, `yuE2`, and
  * `WorkflowStepTemplateFor<…>` is a compile error for each of them.
  *
  * That gap is EXPECTED and is not a defect in either surface. The catalog
@@ -110,7 +111,7 @@
  * stated: it is spelled as a `never` ledger in
  * `test/orchestrator/step-templates.test-d.ts` (which also pins the compile
  * error above, one `@ts-expect-error` per gap `$type`), and the sentence naming
- * the 3 is pinned character for character — here and in the README — by
+ * the gap is pinned character for character — here and in the README — by
  * `test/orchestrator/step-count-prose.test.ts`, which derives all four numbers
  * from `WORKFLOW_STEP_TYPES` and this file's own AST. Both go red when the gap
  * moves in either direction.
@@ -308,7 +309,7 @@ interface StepTemplateMap {
     xGuardModeration: XGuardModerationStepTemplate;
 }
 /**
- * `$type` → its step-template type, for 47 of the catalog's 53 step types.
+ * `$type` → its step-template type, for 47 of the catalog's 55 step types.
  *
  * Keyed by the WIRE name rather than the generated type name, because the wire
  * name is what you actually have in hand and the generator does not always

package/dist/orchestrator/steps.js

@@ -3,7 +3,7 @@
  * own generated client (`@civitai/client`).
  *
  * The sibling `@civitai/app-sdk/orchestrator` module gives you the *catalog*
- * (`WORKFLOW_STEP_TYPES` — 53 `$type` names and what each one does) and the
+ * (`WORKFLOW_STEP_TYPES` — 55 `$type` names and what each one does) and the
  * fetch helpers (`submitWorkflow`, `estimateWorkflow`, …), but its body
  * builders take `input: unknown`. This module is the missing half: the actual
  * per-step input shapes, tracked against the orchestrator's OpenAPI spec by
@@ -78,9 +78,9 @@
  * orchestrator's own authorization still decides.
  *
  * ⚠️ `WORKFLOW_STEP_TYPES` does NOT mark most of them. Counted at this commit:
- * of its 53 entries, exactly TWO sit under its "Platform internals" heading —
- * `comfyNodepackSnapshot` and `qwenImageBench`. `training`, `webScrape`,
- * `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
+ * of its 55 entries, exactly THREE sit under its "Platform internals" heading —
+ * `comfyNodepackSnapshot`, `qwenImageBench` and `promptModeration`. `training`,
+ * `webScrape`, `xGuardModeration`, `modelPickleScan` and the `model*` / `media*` steps are
  * ordinary documented entries under ordinary headings, and `webScrape` carries
  * consumer-facing usage notes. So "the catalog already flags these as internal"
  * is not a reason this map types them, and an earlier version of this docblock
@@ -97,9 +97,10 @@
  * (#315) without anything going red. The measured state, derived rather than
  * typed:
  *
- * `WORKFLOW_STEP_TYPES` documents 53 `$type`s; this map covers 47. The 6 with
+ * `WORKFLOW_STEP_TYPES` documents 55 `$type`s; this map covers 47. The 8 with
  * no generated template in the pinned `@civitai/client` are `imageScanning`,
- * `liveTranscription`, `merge`, `preprocessVideo`, `soniloAudioGen`, `yuE2`, and
+ * `liveTextToSpeech`, `liveTranscription`, `merge`, `preprocessVideo`,
+ * `promptModeration`, `soniloAudioGen`, `yuE2`, and
  * `WorkflowStepTemplateFor<…>` is a compile error for each of them.
  *
  * That gap is EXPECTED and is not a defect in either surface. The catalog
@@ -110,7 +111,7 @@
  * stated: it is spelled as a `never` ledger in
  * `test/orchestrator/step-templates.test-d.ts` (which also pins the compile
  * error above, one `@ts-expect-error` per gap `$type`), and the sentence naming
- * the 3 is pinned character for character — here and in the README — by
+ * the gap is pinned character for character — here and in the README — by
  * `test/orchestrator/step-count-prose.test.ts`, which derives all four numbers
  * from `WORKFLOW_STEP_TYPES` and this file's own AST. Both go red when the gap
  * moves in either direction.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",

package/schemas/app-block/v1.json

@@ -101,13 +101,14 @@
           "collections:read:private",
           "posts:write:self",
           "goods:read:self",
-          "goods:purchase:self"
+          "goods:purchase:self",
+          "apps:store:items:write"
         ]
       }
     },
     "scopeJustifications": {
       "type": "object",
-      "description": "Per-scope justification: a map of scope-id → free-text rationale explaining WHY the app needs that permission, shown to the moderator during review. REQUIRED for SENSITIVE scopes — any declared scope that can spend or read the viewer's Buzz, read the viewer's private data, or write data other users see (e.g. `ai:write:budgeted`, `social:tip:self`, `goods:purchase:self`, `buzz:read:self`, `collections:read:private`, `apps:storage:shared:write`, `posts:write:self`) MUST carry a non-empty justification here, or the manifest is rejected at submit time. OPTIONAL for non-sensitive scopes — omit those and the manifest stays valid. Every key MUST be a scope also present in `scopes` (justifications for scopes you don't request are rejected). Each value is a non-empty string of at most 500 characters. The requirement is enforced imperatively by the manifest validator (not expressed as JSON-Schema conditionals here). NOTE: the justification captures the developer's STATED rationale only; the platform does not verify the truth of the claims.",
+      "description": "Per-scope justification: a map of scope-id → free-text rationale explaining WHY the app needs that permission, shown to the moderator during review. REQUIRED for SENSITIVE scopes — any declared scope that can spend or read the viewer's Buzz, read the viewer's private data, or write data other users see (e.g. `ai:write:budgeted`, `social:tip:self`, `goods:purchase:self`, `buzz:read:self`, `collections:read:private`, `apps:storage:shared:write`, `posts:write:self`, `apps:store:items:write`) MUST carry a non-empty justification here, or the manifest is rejected at submit time. OPTIONAL for non-sensitive scopes — omit those and the manifest stays valid. Every key MUST be a scope also present in `scopes` (justifications for scopes you don't request are rejected). Each value is a non-empty string of at most 500 characters. The requirement is enforced imperatively by the manifest validator (not expressed as JSON-Schema conditionals here). NOTE: the justification captures the developer's STATED rationale only; the platform does not verify the truth of the claims.",
       "additionalProperties": {
         "type": "string",
         "minLength": 1,