@civitai/app-sdk 0.71.0 → 0.72.0

package/dist/blocks/messages.d.ts

@@ -938,6 +938,25 @@ export type BlockToParentMessage = {
         multiple?: {
             max: number;
         };
+        /**
+         * Offer only images in a published, non-`Private` post: `true`
+         * narrows the `'posted'` library to those. It does not filter by
+         * rating or by any other post setting. The `'generated'` library is
+         * unaffected. OMIT it (or `false`) for today's behaviour, which also
+         * offers images in a `Private` post. Send a boolean or nothing: the
+         * host refuses any other value with `{ requestId, error }`.
+         *
+         * Set it when the pick becomes PUBLIC-FACING, e.g. an App Store
+         * sub-listing card image (`imageId` on
+         * `POST /api/v1/blocks/sub-listings/upsert`, `app.subListings.upsert`
+         * in `@civitai/sdk`), which the store refuses for a non-public image.
+         * Leave it off when the pick is a private input (a generation source).
+         *
+         * 🔴 A HOST THAT PREDATES THIS FIELD IGNORES IT and still offers
+         * `Private`-post images, so an app setting it must still handle the
+         * store's `image_not_public` refusal.
+         */
+        publicOnly?: boolean;
     };
 } | {
     type: 'SET_USER_CHECKPOINT';

package/dist/blocks/types.d.ts

@@ -304,6 +304,11 @@ export type BlockGenerationSourceImageInfo = BlockSourceImage;
  *
  * The request's `sources` narrows the picker to one of them; omitting it offers
  * both. Images only — neither library offers video through this picker.
+ *
+ * The request's `publicOnly: true` further narrows `'posted'` to images whose
+ * post is published and not `Private` (for a public-facing pick such as an App
+ * Store sub-listing card image); it does not change `'generated'`. A host that
+ * predates `publicOnly` ignores it.
  */
 export type BlockImagePickerSource = 'posted' | 'generated';
 /**
@@ -314,7 +319,8 @@ export type BlockImagePickerSource = 'posted' | 'generated';
  *
  * WHAT IS PICKABLE is decided by the host, never by the block:
  *  - `'posted'`: the viewer's own images that are in a published post, fully
- *    scanned, not flagged, and rated.
+ *    scanned, not flagged, and rated. A `Private` post counts as published
+ *    here unless the request set `publicOnly: true`, which leaves those out.
  *  - `'generated'`: the viewer's own succeeded generator outputs that carry a
  *    rating the host recognises.
  *  - Either way the image's rating has to be one the VIEWER'S OWN browsing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/app-sdk",
-  "version": "0.71.0",
+  "version": "0.72.0",
   "description": "OAuth + PKCE, encrypted-cookie sessions, scopes, and orchestrator helpers for building third-party Civitai apps.",
   "license": "MIT",
   "type": "module",