@civitai/sdk 0.20.0 → 0.20.2

package/BREAKING.md

@@ -25,7 +25,7 @@ messages have no destination yet.
 | `CREATE_POST_FROM_APP` | — | No v1 route, **and deliberately staying on the bridge** — see below |
 | `PUBLISH_GENERATION_OUTPUTS` | `app.host.publishGenerationOutputs` | Same reasoning: it raises host UI, so it stays on the bridge — **carried** rather than replaced |
 | `SET_COLLECTION_FOLLOW` | `POST /api/v1/blocks/collections/{id}/follow` | **Route exists** (scope `collections:write:self`). This row previously said "No v1 route"; that was wrong |
-| `GET_DAILY_COMPENSATION`, `GET_WILDCARD_PACK` | — | Not carried |
+| `GET_DAILY_COMPENSATION`, `GET_WILDCARD_PACK`, `GET_RESOURCE_FILE` | — | Not carried as a typed wrapper. `BlockTransport.request()` knows all three (the host reply ledger lists them): `request('GET_RESOURCE_FILE', { modelVersionId, fileId? })` resolves with `{ file }` on a full-page app host |
 | `TRACK_EVENT` | `app.host.track(eventName, properties)` | **Carried**, same wire as `useBlockAnalytics().track`. 🔴 Only events and properties DECLARED under the manifest's `analytics.events` are recorded — see below |
 
 ⚠ **`TRACK_EVENT` used to be listed here as *not carried*, because no host handled it — every

package/README.md

@@ -1046,9 +1046,15 @@ Where it differs from the server on purpose:
 
 `fake.calls` records every request and answer. Options also cover smaller `limits`,
 `consent` (revoked scopes, or `'unavailable'`), `appStatus`, `disabled` and a custom
-`moderate`; by default the scanner refuses the words in `FAKE_STORAGE_MODERATION`. It
-does not model moderator hides or the review-preview namespace, and at the `Http`
-seam there is no URL resolution — the client refuses the segments a URL would
+`moderate`; by default the scanner refuses the words in `FAKE_STORAGE_MODERATION`.
+That default is the server's enforced moderation. The host picks each app's
+moderation mode for shared data, and enforce is not the default there: expect
+shadow (scanned after the write) or off, where neither a hit nor a scanner outage
+refuses a write. So never rely on a refusal to keep content out of shared data:
+a write the fake refuses may land on the server, and other viewers read it. Pass
+`moderate: () => null` to test what such an app sees. The fake does not model
+moderator hides or the review-preview namespace, and at the `Http` seam there is no
+URL resolution — the client refuses the segments a URL would
 rewrite (`''`, `.`, `..`) before sending.
 
 ### The legacy key/value stores

package/dist/core/transports/host-replies.generated.d.ts

@@ -7,7 +7,7 @@ export interface HostReply {
     readonly keys: readonly string[] | null;
 }
 /** The civitai commit this ledger was read from. A request the host added after it is refused too. */
-export declare const HOST_SNAPSHOT = "05f1d1fa8f";
+export declare const HOST_SNAPSHOT = "4c13f8c629";
 /**
  * Every request the host answered at {@link HOST_SNAPSHOT}. A type absent here is refused.
  * Reply names and framing are fixed at publish time: if the host renames a reply or moves a

package/dist/core/transports/host-replies.generated.js

@@ -1,7 +1,7 @@
 // Generated by scripts/gen-host-replies.mjs from snapshots/host-messages.json
-// (civitai/civitai 05f1d1fa8f, 2026-10-20). Do not edit.
+// (civitai/civitai 4c13f8c629, 2026-10-25). Do not edit.
 /** The civitai commit this ledger was read from. A request the host added after it is refused too. */
-export const HOST_SNAPSHOT = "05f1d1fa8f";
+export const HOST_SNAPSHOT = "4c13f8c629";
 /**
  * Every request the host answered at {@link HOST_SNAPSHOT}. A type absent here is refused.
  * Reply names and framing are fixed at publish time: if the host renames a reply or moves a
@@ -24,6 +24,7 @@ export const HOST_REPLIES = {
     "GET_DAILY_COMPENSATION": { "reply": "DAILY_COMPENSATION_RESULT", "framing": "legacy", "keys": ["result"] },
     "GET_ENTITY_REACTIONS": { "reply": "ENTITY_REACTIONS_RESULT", "framing": "legacy", "keys": ["result"] },
     "GET_IMAGES_BY_IDS": { "reply": "IMAGES_RESULT", "framing": "legacy", "keys": ["result"] },
+    "GET_RESOURCE_FILE": { "reply": "RESOURCE_FILE_RESULT", "framing": "legacy", "keys": ["file"] },
     "GET_VIEWER": { "reply": "VIEWER_RESULT", "framing": "legacy", "keys": ["viewer"] },
     "GET_WILDCARD_PACK": { "reply": "WILDCARD_PACK_RESULT", "framing": "legacy", "keys": ["pack"] },
     "OPEN_BUZZ_PURCHASE": { "reply": "BUZZ_PURCHASE_RESULT", "framing": "legacy", "keys": ["purchased"] },

package/dist/doc-store/fake.js

@@ -22,6 +22,13 @@ import { createDocumentStorage } from './index.js';
  * versions of its own, so which ones a viewer owns is `FakeStorageViewer.modelVersions`
  * (default none).
  *
+ * Moderation is the server's ENFORCE mode, which the contract's moderation cases
+ * describe: a hit refuses `content_rejected` and a scanner outage
+ * `moderation_unavailable`. The host picks each app's shared-data moderation mode,
+ * and enforce is not its default: in `shadow` (the scan runs after the write) or `off`
+ * (no scan) neither a hit nor an outage refuses the write. The fake has no mode of its
+ * own: `moderate: () => null` is what a shadow or off app sees.
+ *
  * NOT MODELLED: moderator hides (a hidden document reads as not found on the server;
  * nothing here hides one), moderator exemption from the scanner, the review-preview
  * namespace, the token middleware's other refusals (revoked instance, context

package/dist/version.generated.d.ts

@@ -1,2 +1,2 @@
 /** This package's version, reported to the host as `sdkVersion` in `BLOCK_READY`. */
-export declare const VERSION = "0.20.0";
+export declare const VERSION = "0.20.2";

package/dist/version.generated.js

@@ -1,3 +1,3 @@
 /* AUTOGENERATED from package.json by scripts/gen-version.mjs. DO NOT EDIT. */
 /** This package's version, reported to the host as `sdkVersion` in `BLOCK_READY`. */
-export const VERSION = "0.20.0";
+export const VERSION = "0.20.2";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/sdk",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "description": "The Civitai SDK: an app holds a token and calls the Civitai API and the orchestrator; a block asks its host only to show host UI.",
   "license": "MIT",
   "type": "module",