@civitai/sdk 0.17.0 → 0.18.0

package/README.md

@@ -282,6 +282,55 @@ before moderation and before any write budget. An absent field is allowed;
 ownership is checked only when the document is written. Only phase-one operations exist: no batch writes, change feed, TTL or
 owner-written documents yet.
 
+### In a dev-tunnel preview: local to the tab
+
+A dev-tunnel preview (`civitai app dev-tunnel`, the App Assistant's live
+preview) has **no server-side storage**: an app that is not approved has no storage
+namespace, and unreviewed code must not write into a published app's data. So when
+the host marks the frame `storageMode: 'local-preview'` in `BLOCK_INIT`,
+`initialize()` serves `app.storage.collection(name)` and `app.storage.info()` from an
+**in-memory store in this tab** — [`createFakeStorage`](#a-fake-document-store), the
+real client over a seam that enforces the server's rules — and sends **no request**
+to `blocks/storage/*`. Your code does not change; show a badge so nobody mistakes the
+data for real:
+
+```ts
+if (app.storage.mode === 'local-preview') {
+  showBadge('Preview data is local to this tab');
+}
+```
+
+- **Your LOCAL manifest decides the collections**, not the server's copy:
+  `blockManifestPlugin()` from `@civitai/app-sdk/vite` hands its `scopes` and
+  `storage` to the page on the dev server (never in a build); that is the only way
+  the manifest reaches the SDK. It does so from the `@civitai/app-sdk` release that
+  includes this change (the one whose CHANGELOG entry reads "`blockManifestPlugin()`
+  exposes the manifest's `scopes` and `storage` to `@civitai/sdk` on the dev server
+  only"); a `^0.x` range never moves to a newer minor, so raise that pin by hand.
+  Not every scaffold registers the plugin (the CLI's `page-money` template does
+  not); add it there. Without it, every document-store call rejects
+  `local_preview_no_manifest` (a `StorageError`, status 404, sent nowhere); a
+  declaration the local store cannot serve rejects `local_preview_invalid_manifest`
+  (also 404), and a local store that failed to load rejects
+  `local_preview_unavailable` (also 404; reload the preview). None is a status this
+  SDK treats as retryable, and none falls back to the real routes.
+- **Model-version ownership is not checked locally.** A collection's
+  `ownedModelVersions` fields accept any well-formed model version id in a preview;
+  the server checks that the writer owns it. A malformed value is still refused.
+- **One viewer, one tab, gone on reload.** It cannot show other people's entries,
+  real vote totals, ranking across users, the minimum-trust gate on shared writes,
+  or moderation of real content.
+- **Only the document store.** The deprecated `app.storage.get/set/…`,
+  `app.sharedStorage` and `@civitai/blocks-react`'s `useAppStorage` /
+  `useSharedStorage` keep calling the real routes, which refuse a preview.
+- **Only on the host's signal.** `app.storage.mode` is latched when `initialize()`
+  resolves, and never inferred from the token: a published app whose manifest forgot
+  `apps:storage` holds a token that looks the same, and keeps getting the real
+  route's `insufficient_scope`. That refusal's message says what to do —
+  declare `apps:storage` under `scopes`; it is granted once the app is approved — and
+  that in a preview this SDK would have kept the data locally had the host marked the
+  frame.
+
 The legacy stores below keep working, unchanged, while apps move; their methods are
 `@deprecated`. Nothing is copied from them into collections.
 

package/dist/app/index.d.ts

@@ -9,6 +9,21 @@ import { type SiteClient } from '../site/index.js';
 import { type StorageClient } from '../storage/index.js';
 import { type SubListingsClient } from '../sub-listings/index.js';
 import { type WorkflowsClient } from '../workflows/index.js';
+/**
+ * Which store serves `app.storage.collection(name)` and `app.storage.info()`.
+ *
+ * - `'remote'` — the server's document store, `/api/v1/blocks/storage/…`.
+ * - `'local-preview'` — an in-memory store in this tab, because the host marked
+ *   the frame a dev-tunnel preview (which has no server-side storage). It
+ *   enforces the server's rules against the LOCAL manifest, models ONE viewer,
+ *   and is gone on reload. Show the viewer a "preview data is local to this tab"
+ *   badge.
+ *
+ * Latched when `initialize()` resolves. Only the document store switches: the
+ * deprecated key/value methods on `app.storage`, `app.sharedStorage` and the
+ * `@civitai/blocks-react` storage hooks keep calling the real routes.
+ */
+export type StorageMode = 'remote' | 'local-preview';
 export interface AppClient {
     /**
      * The public Civitai REST API (`/api/v1`), as the viewer.
@@ -36,7 +51,9 @@ export interface AppClient {
      * with an OAuth access token is refused. The legacy store refuses an anonymous
      * viewer outright; the document store lets one read SHARED collections only.
      */
-    readonly storage: StorageClient & DocumentStorage;
+    readonly storage: StorageClient & DocumentStorage & {
+        readonly mode: StorageMode;
+    };
     /**
      * @deprecated Declare a `shared` collection under `storage.collections` and use
      * `app.storage.collection(name)`. This store keeps working, unchanged, until the

package/dist/app/index.js

@@ -6,6 +6,7 @@ import { createOrchestrationClient, DEFAULT_ORCHESTRATION_URL, } from '../orches
 import { createTokenSession, } from '../session/index.js';
 import { createSharedStorageClient, } from '../shared-storage/index.js';
 import { createDocumentStorage } from '../doc-store/index.js';
+import { createLocalPreviewStorage, readInjectedManifest } from '../doc-store/local-preview.js';
 import { createSiteClient, DEFAULT_SITE_URL } from '../site/index.js';
 import { createStorageClient } from '../storage/index.js';
 import { createSubListingsClient } from '../sub-listings/index.js';
@@ -21,8 +22,17 @@ export async function initialize(options = {}) {
     const holdsBlockTokenNow = holdsBlockToken(snapshot);
     // Read live, like the predicate above: the host rotates the token.
     const holdsOAuthTokenNow = () => snapshot().token.kind === 'oauth';
+    // 🔴 Latched here, ONCE, and only on the host's exact signal — never inferred
+    // from `token.scopes`. A published app whose manifest forgot `apps:storage`
+    // holds a token that looks the same as a preview's, and must keep getting the
+    // real route's `insufficient_scope` rather than a silent local store.
+    const local = snapshot().storageMode === 'local-preview'
+        ? // The manifest arrives only from `blockManifestPlugin()`'s dev-server
+            // global: there is deliberately no option to pass one.
+            await createLocalPreviewStorage(readInjectedManifest(), snapshot().viewer)
+        : undefined;
     return {
-        ...createAppClient(createHostSession(transport), options, holdsBlockTokenNow, holdsOAuthTokenNow),
+        ...createAppClient(createHostSession(transport), options, holdsBlockTokenNow, holdsOAuthTokenNow, local),
         host: createHost(transport),
         get viewer() {
             return snapshot().viewer;
@@ -81,7 +91,9 @@ const OAUTH_OPT_IN = 'declare `auth: "oauth"` in block.manifest.json';
  * refuses, with nothing in this repo able to notice it going stale.
  */
 const BLOCK_NAMESPACE = /^\/*blocks\//;
-function createAppClient(session, options, holdsBlockTokenNow = () => false, holdsOAuthTokenNow = () => false) {
+function createAppClient(session, options, holdsBlockTokenNow = () => false, holdsOAuthTokenNow = () => false, 
+/** A local preview's document store; when present, the site HTTP client never reaches the document store. */
+localDocuments) {
     const http = (baseUrl) => createHttp({ session, baseUrl, fetch: options.fetch });
     // One instance for every site-hosted surface: the storage, sub-listings and
     // workflows clients' routes live under the same base URL, so a `siteUrl`
@@ -100,7 +112,15 @@ function createAppClient(session, options, holdsBlockTokenNow = () => false, hol
         // One object, two stores, no shared names: the legacy five and the document
         // store's `collection`/`info`. Spread rather than chained so neither keeps a
         // reference to the other.
-        storage: { ...createStorageClient(siteHttp), ...createDocumentStorage(siteHttp) },
+        //
+        // In a local preview the document store is the in-memory one and is never
+        // handed `siteHttp`: zero `blocks/storage/*` requests by construction. The
+        // legacy key/value methods are out of scope and keep the real routes.
+        storage: {
+            ...createStorageClient(siteHttp),
+            ...(localDocuments ?? createDocumentStorage(siteHttp, { explainInsufficientScope: true })),
+            mode: localDocuments ? 'local-preview' : 'remote',
+        },
         sharedStorage: createSharedStorageClient(siteHttp),
         subListings: createSubListingsClient(siteHttp),
         workflows: createWorkflowsClient(explainWorkflowRefusal(siteHttp, holdsOAuthTokenNow)),

package/dist/core/handshake.d.ts

@@ -98,7 +98,17 @@ export interface BlockInitPayload {
     maxBrowsingLevel?: number;
     /** The domain ceiling narrowed to this viewer. Always a subset of the above. */
     effectiveBrowsingLevel?: number;
+    /**
+     * `'local-preview'` when the host mounted this frame as a dev-tunnel preview,
+     * which has no server-side storage. The host sets it from the surface it
+     * mounted, never from the token or anything the block sent. Absent everywhere
+     * else, and from a host that predates it. Typed `unknown` on the wire: only
+     * the exact string switches anything — see {@link LOCAL_PREVIEW_STORAGE}.
+     */
+    storageMode?: unknown;
 }
+/** The one value of `BLOCK_INIT.storageMode` the SDK acts on. Compared exactly. */
+export declare const LOCAL_PREVIEW_STORAGE = "local-preview";
 /**
  * Host messages the transport itself acts on. Domains own everything else.
  *

package/dist/core/handshake.js

@@ -2,6 +2,8 @@
  * The host's side of the handshake, as it arrives on the wire. The shapes are
  * the host's and must track it.
  */
+/** The one value of `BLOCK_INIT.storageMode` the SDK acts on. Compared exactly. */
+export const LOCAL_PREVIEW_STORAGE = 'local-preview';
 /** Discriminator only — the payload is still unvalidated wire data. */
 export function isHostMessage(data, type) {
     return (typeof data === 'object' &&

package/dist/core/transport.d.ts

@@ -29,6 +29,12 @@ export interface BlockSnapshot {
     maxBrowsingLevel?: number;
     /** The domain ceiling narrowed to this viewer. Always a subset of `maxBrowsingLevel`. */
     effectiveBrowsingLevel?: number;
+    /**
+     * `'local-preview'` when the host said this frame is a dev-tunnel preview with
+     * no server-side storage; absent otherwise. `initialize()` reads it ONCE, so a
+     * later change cannot move an app's storage between stores mid-session.
+     */
+    storageMode?: 'local-preview';
 }
 export interface RequestOptions {
     signal?: AbortSignal;

package/dist/core/transport.js

@@ -1,3 +1,4 @@
+import { LOCAL_PREVIEW_STORAGE } from './handshake.js';
 export const EMPTY_SNAPSHOT = {
     ready: false,
     renderMode: 'iframe',
@@ -24,6 +25,9 @@ export function snapshotFromInit(payload, hostOrigin) {
         domain: payload.domain,
         maxBrowsingLevel: payload.maxBrowsingLevel,
         effectiveBrowsingLevel: payload.effectiveBrowsingLevel,
+        // The exact string or nothing: a value this SDK does not know must read as
+        // "not a local preview", which keeps today's behaviour (the real routes).
+        ...(payload.storageMode === LOCAL_PREVIEW_STORAGE ? { storageMode: LOCAL_PREVIEW_STORAGE } : {}),
     };
 }
 /** Wire `WrappedToken` (ISO expiry) → runtime `BlockToken` (Date expiry). */

package/dist/doc-store/index.d.ts

@@ -171,7 +171,16 @@ export interface DocumentStorage {
  * Every code the server documents for these routes. The type stays open
  * (`string & {}`) so a code a later server adds still reaches the caller.
  */
-export type StorageErrorCode = 'invalid_request' | 'index_not_declared' | 'unauthenticated' | 'sign_in_required' | 'insufficient_scope' | 'consent_required' | 'not_eligible' | 'not_author' | 'write_policy' | 'resource_not_owned' | 'not_found' | 'collection_not_declared' | 'method_not_allowed' | 'version_conflict' | 'index_building' | 'cursor_expired' | 'too_large' | 'quota_exceeded' | 'content_rejected' | 'rate_limited' | 'internal_error' | 'storage_disabled' | 'moderation_unavailable' | 'consent_unavailable' | 'service_unavailable' | (string & {});
+export type StorageErrorCode = 'invalid_request' | 'index_not_declared' | 'unauthenticated' | 'sign_in_required' | 'insufficient_scope' | 'consent_required' | 'not_eligible' | 'not_author' | 'write_policy' | 'resource_not_owned' | 'not_found' | 'collection_not_declared' | 'method_not_allowed' | 'version_conflict' | 'index_building' | 'cursor_expired' | 'too_large' | 'quota_exceeded' | 'content_rejected' | 'rate_limited' | 'internal_error' | 'storage_disabled' | 'moderation_unavailable' | 'consent_unavailable' | 'service_unavailable'
+/**
+ * LOCAL, never sent by the server: the host marked this frame a dev-tunnel
+ * local preview, and no manifest reached the SDK to say which collections exist.
+ */
+ | 'local_preview_no_manifest'
+/** LOCAL, never sent by the server: the local preview's manifest declares storage the local store cannot serve. */
+ | 'local_preview_invalid_manifest'
+/** LOCAL, never sent by the server: the local preview's in-memory store could not be loaded. */
+ | 'local_preview_unavailable' | (string & {});
 /**
  * A refusal from the document store, in its one envelope `{ code, message, error, details? }`.
  * Branch on `code`; `status` and `body` are {@link ApiError}'s, as sent.
@@ -184,4 +193,16 @@ export declare class StorageError extends ApiError {
     /** Seconds to wait before retrying, when the server named one (`rate_limited`, a retryable 503). */
     get retryAfter(): number | undefined;
 }
-export declare function createDocumentStorage(http: Http): DocumentStorage;
+/**
+ * Appended to a REAL route's `insufficient_scope`, after the server's own sentence.
+ * The server cannot tell a published app whose manifest forgot the scope from a
+ * dev-tunnel preview (which is never granted it), so the message covers both —
+ * and says that, in a preview, this SDK keeps the data locally once the host
+ * marks the frame, so seeing this refusal there means the host did not.
+ */
+export declare const INSUFFICIENT_SCOPE_HINT: string;
+export interface DocumentStorageOptions {
+    /** Append {@link INSUFFICIENT_SCOPE_HINT} to an `insufficient_scope` refusal. The server's `code` is unchanged. */
+    explainInsufficientScope?: boolean;
+}
+export declare function createDocumentStorage(http: Http, options?: DocumentStorageOptions): DocumentStorage;

package/dist/doc-store/index.js

@@ -42,8 +42,19 @@ export class StorageError extends ApiError {
         return typeof value === 'number' ? value : undefined;
     }
 }
+/**
+ * Appended to a REAL route's `insufficient_scope`, after the server's own sentence.
+ * The server cannot tell a published app whose manifest forgot the scope from a
+ * dev-tunnel preview (which is never granted it), so the message covers both —
+ * and says that, in a preview, this SDK keeps the data locally once the host
+ * marks the frame, so seeing this refusal there means the host did not.
+ */
+export const INSUFFICIENT_SCOPE_HINT = 'Declare `apps:storage` under `scopes` in block.manifest.json; it is granted once the app is approved. ' +
+    'In a dev-tunnel preview, this version of @civitai/sdk keeps preview data in a local in-memory store ' +
+    "instead, when the host marks the frame `storageMode: 'local-preview'` — this refusal came from the real " +
+    'route, so this frame was not marked.';
 /** An {@link ApiError} whose body is the store's envelope becomes a {@link StorageError}; anything else passes through. */
-function toStorageError(error) {
+function toStorageError(error, options = {}) {
     if (!(error instanceof ApiError) || error instanceof StorageError)
         return error;
     const body = error.body;
@@ -52,7 +63,10 @@ function toStorageError(error) {
     const { code, message, details } = body;
     if (typeof code !== 'string')
         return error;
-    return new StorageError(error.status, code, typeof message === 'string' ? message : error.message, body, details != null && typeof details === 'object' && !Array.isArray(details)
+    const said = typeof message === 'string' ? message : error.message;
+    return new StorageError(error.status, code, 
+    // `body` stays as the server sent it; only the human-readable sentence grows.
+    options.explainInsufficientScope && code === 'insufficient_scope' ? `${said} — ${INSUFFICIENT_SCOPE_HINT}` : said, body, details != null && typeof details === 'object' && !Array.isArray(details)
         ? details
         : undefined, { cause: error });
 }
@@ -87,13 +101,13 @@ function segment(what, value) {
     }
     return encodeURIComponent(value);
 }
-export function createDocumentStorage(http) {
+export function createDocumentStorage(http, options = {}) {
     const call = async (method, path, opts = {}) => {
         try {
             return await http(method, path, opts);
         }
         catch (error) {
-            throw toStorageError(error);
+            throw toStorageError(error, options);
         }
     };
     return {

package/dist/doc-store/local-preview.d.ts

@@ -0,0 +1,49 @@
+import type { ViewerInfo } from '../core/handshake.js';
+import { type DocumentStorage } from './index.js';
+/**
+ * The document store for a DEV-TUNNEL PREVIEW: the host marked the frame
+ * `storageMode: 'local-preview'` (a preview has no server-side storage namespace,
+ * by design), so `app.storage.collection(name)` is served by an in-memory store
+ * in this tab instead of `/api/v1/blocks/storage/…`.
+ *
+ * That store is `createFakeStorage` — the real client over a seam that enforces
+ * the server's rules — loaded with a dynamic `import()`, so it is a separate
+ * chunk that an app outside a preview never downloads. It never receives the
+ * site HTTP client, so no request can reach a real route by construction.
+ *
+ * The collections come from the app's LOCAL manifest, the one being previewed,
+ * never from the server. With none available, every call fails with a local
+ * error instead of falling through to the real routes or to a permissive store.
+ */
+/**
+ * Where `@civitai/app-sdk/vite` puts the local manifest's `scopes` and `storage`
+ * in a DEV SERVER page (never in a build). Spelled again, on purpose, in
+ * `packages/civitai-app-sdk/src/vite/index.ts`; the two copies are pinned equal by
+ * `tests/guards/local-preview-manifest-global.test.mjs`.
+ */
+export declare const LOCAL_PREVIEW_MANIFEST_GLOBAL = "__CIVITAI_LOCAL_PREVIEW_MANIFEST__";
+/** What a local preview reads from the manifest: the scopes it declares and its `storage` block. */
+export interface LocalPreviewManifest {
+    scopes?: readonly string[];
+    storage?: unknown;
+}
+/** The manifest the dev server injected, if any. */
+export declare function readInjectedManifest(): LocalPreviewManifest | undefined;
+/**
+ * The status of every local error (`local_preview_no_manifest`,
+ * `local_preview_invalid_manifest`, `local_preview_unavailable`). A missing or
+ * unservable manifest is a SETUP mistake that no wait fixes, so it must not be a status `isTransient`
+ * (`src/http/retry.ts`) reads as retryable — that is every 5xx and 429. 404 is
+ * the status the server gives the nearest case it has, `collection_not_declared`:
+ * with no usable manifest, no collection is declared. `get` still rejects (it
+ * reads only the code `not_found` as "no document"), and the `code` tells them
+ * apart. A store that failed to load is not retried either: a reload is the fix,
+ * and the message says so.
+ */
+export declare const LOCAL_PREVIEW_ERROR_STATUS = 404;
+/**
+ * Builds the preview's document store. Never throws: a missing or unusable
+ * manifest, or a local store that fails to load, yields a store whose every call
+ * rejects, so storage cannot stop the rest of the app from starting.
+ */
+export declare function createLocalPreviewStorage(manifest: LocalPreviewManifest | undefined, viewer: ViewerInfo | null): Promise<DocumentStorage>;

package/dist/doc-store/local-preview.js

@@ -0,0 +1,131 @@
+import { createDocumentStorage, StorageError } from './index.js';
+/**
+ * The document store for a DEV-TUNNEL PREVIEW: the host marked the frame
+ * `storageMode: 'local-preview'` (a preview has no server-side storage namespace,
+ * by design), so `app.storage.collection(name)` is served by an in-memory store
+ * in this tab instead of `/api/v1/blocks/storage/…`.
+ *
+ * That store is `createFakeStorage` — the real client over a seam that enforces
+ * the server's rules — loaded with a dynamic `import()`, so it is a separate
+ * chunk that an app outside a preview never downloads. It never receives the
+ * site HTTP client, so no request can reach a real route by construction.
+ *
+ * The collections come from the app's LOCAL manifest, the one being previewed,
+ * never from the server. With none available, every call fails with a local
+ * error instead of falling through to the real routes or to a permissive store.
+ */
+/**
+ * Where `@civitai/app-sdk/vite` puts the local manifest's `scopes` and `storage`
+ * in a DEV SERVER page (never in a build). Spelled again, on purpose, in
+ * `packages/civitai-app-sdk/src/vite/index.ts`; the two copies are pinned equal by
+ * `tests/guards/local-preview-manifest-global.test.mjs`.
+ */
+export const LOCAL_PREVIEW_MANIFEST_GLOBAL = '__CIVITAI_LOCAL_PREVIEW_MANIFEST__';
+/** The manifest the dev server injected, if any. */
+export function readInjectedManifest() {
+    const value = globalThis[LOCAL_PREVIEW_MANIFEST_GLOBAL];
+    return value != null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+const NO_MANIFEST = "local preview storage: the host marked this frame `storageMode: 'local-preview'` (a dev-tunnel preview, " +
+    'which has no server-side storage), and no block.manifest.json reached @civitai/sdk to say which ' +
+    'collections exist. Add `blockManifestPlugin()` from `@civitai/app-sdk/vite` to vite.config and run the ' +
+    'Vite dev server, with the @civitai/app-sdk release that includes the local-preview manifest injection or ' +
+    'later — the plugin does not inject it before that release, and a `^0.x` range never moves to a newer ' +
+    'minor, so raise the pin by hand. Nothing was sent to the server.';
+/**
+ * The status of every local error (`local_preview_no_manifest`,
+ * `local_preview_invalid_manifest`, `local_preview_unavailable`). A missing or
+ * unservable manifest is a SETUP mistake that no wait fixes, so it must not be a status `isTransient`
+ * (`src/http/retry.ts`) reads as retryable — that is every 5xx and 429. 404 is
+ * the status the server gives the nearest case it has, `collection_not_declared`:
+ * with no usable manifest, no collection is declared. `get` still rejects (it
+ * reads only the code `not_found` as "no document"), and the `code` tells them
+ * apart. A store that failed to load is not retried either: a reload is the fix,
+ * and the message says so.
+ */
+export const LOCAL_PREVIEW_ERROR_STATUS = 404;
+/**
+ * Builds the preview's document store. Never throws: a missing or unusable
+ * manifest, or a local store that fails to load, yields a store whose every call
+ * rejects, so storage cannot stop the rest of the app from starting.
+ */
+export async function createLocalPreviewStorage(manifest, viewer) {
+    if (manifest === undefined)
+        return refusingStorage('local_preview_no_manifest', NO_MANIFEST);
+    let createFakeStorage;
+    try {
+        ({ createFakeStorage } = await import('./fake.js'));
+    }
+    catch (error) {
+        return refusingStorage('local_preview_unavailable', `local preview storage: the local store could not be loaded — ${error?.message ?? String(error)}. ` +
+            'Reload the preview. Nothing was sent to the server.');
+    }
+    // MODEL-VERSION OWNERSHIP IS NOT CHECKED LOCALLY. The server checks a write's
+    // `ownedModelVersions` fields against the model versions the writer really
+    // owns; the local store knows of none, and would refuse every such write the
+    // server accepts. So every well-formed id a write carries is added to the
+    // viewer's `modelVersions` — the fake's own seam, read per call — before the
+    // write reaches it. Malformed values are still refused, as the server refuses them.
+    const owned = [];
+    const localViewer = viewer === null
+        ? null
+        : {
+            username: viewer.username ?? `user-${viewer.id}`,
+            get modelVersions() {
+                return owned;
+            },
+        };
+    try {
+        const fake = createFakeStorage({
+            manifest: { scopes: manifest.scopes, storage: manifest.storage },
+            // Latched at init, like the mode: a sign-in remounts the frame.
+            viewer: localViewer,
+        });
+        const http = (method, path, opts) => {
+            collectIds(opts?.body, owned);
+            return fake.http(method, path, opts);
+        };
+        return createDocumentStorage(http);
+    }
+    catch (error) {
+        return refusingStorage('local_preview_invalid_manifest', `local preview storage: block.manifest.json declares storage the local preview store cannot serve — ` +
+            `${error.message}. Nothing was sent to the server.`);
+    }
+}
+/** Every integer a write body carries that could be a model version id. */
+function collectIds(value, into) {
+    if (typeof value === 'number') {
+        if (Number.isInteger(value) && value >= 1 && !into.includes(value))
+            into.push(value);
+    }
+    else if (Array.isArray(value)) {
+        for (const item of value)
+            collectIds(item, into);
+    }
+    else if (value !== null && typeof value === 'object') {
+        for (const item of Object.values(value))
+            collectIds(item, into);
+    }
+}
+/** A store that refuses every call with one LOCAL, non-retryable error. */
+function refusingStorage(code, message) {
+    const refuse = () => Promise.reject(new StorageError(LOCAL_PREVIEW_ERROR_STATUS, code, message, { code, message, error: message }));
+    // Every method of `StorageCollection`, so `satisfies` fails the build if one is added.
+    const collection = {
+        get: refuse,
+        getMany: refuse,
+        put: refuse,
+        create: refuse,
+        delete: refuse,
+        list: refuse,
+        increment: refuse,
+        mark: refuse,
+        unmark: refuse,
+    };
+    return {
+        collection: () => collection,
+        info: refuse,
+    };
+}

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  * inside a civitai.com page, `app.host`. Outside one, `createSignIn()` gets the token.
  */
 export { initialize } from './app/index.js';
-export type { AppClient, BlockAppClient, BlockInitializeOptions, TokenInitializeOptions, } from './app/index.js';
+export type { AppClient, BlockAppClient, BlockInitializeOptions, StorageMode, TokenInitializeOptions, } from './app/index.js';
 export { createSignIn, SignInError } from './sign-in/index.js';
 export type { SignIn, SignInOptions } from './sign-in/index.js';
 export { SCOPES } from './session/index.js';

package/dist/version.generated.d.ts

@@ -1,2 +1,2 @@
 /** This package's version, reported to the host as `sdkVersion` in `BLOCK_READY`. */
-export declare const VERSION = "0.17.0";
+export declare const VERSION = "0.18.0";

package/dist/version.generated.js

@@ -1,3 +1,3 @@
 /* AUTOGENERATED from package.json by scripts/gen-version.mjs. DO NOT EDIT. */
 /** This package's version, reported to the host as `sdkVersion` in `BLOCK_READY`. */
-export const VERSION = "0.17.0";
+export const VERSION = "0.18.0";

package/dist/workflows/types.generated.d.ts

@@ -612,8 +612,14 @@ export type WorkflowBodyPassThroughStep = {
      *
      * Consequently the orchestrator's per-`$type` schema is the ONLY authority for
      * what a given `$type` accepts; nothing in this package or on the host mirrors
-     * it. Bounded only by size: at most **262144 bytes** (256 KB) serialized, which
-     * is a payload-DoS bound and not a shape gate.
+     * it. Its shape is not checked; its size is: at most **262144 bytes** (256 KB)
+     * serialized, which is a payload-DoS bound and not a shape gate.
+     *
+     * 🔴 **No inline media.** The host refuses a `data:image|video|audio` URI or a
+     * long raw base64 string anywhere in here: upload the image, video or audio
+     * with `useMediaUpload()` (an image also works with
+     * `useImageUpload({ purpose: 'generationSource' })` or `useImagePicker()`)
+     * and pass the returned `url`.
      */
     input: Record<string, unknown>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/sdk",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "The Civitai SDK: an app holds a token and calls the Civitai API and the orchestrator; a block asks its host only to show host UI.",
   "license": "MIT",
   "type": "module",