@civitai/sdk 0.3.0 → 0.4.0

package/README.md

@@ -51,9 +51,12 @@ Both give you:
 A block's `app` also has `host`, `viewer`, `context`, `settings`, `theme` and
 `onChange(listener)`. Outside a block they do not exist, and the types say so.
 
-> **Not yet end to end for blocks.** The host still mints a block-scoped JWT,
-> which `/api/v1` and the orchestrator do not accept; they take API keys and
-> OAuth tokens. Apps with one of those work today, from a browser or a server.
+A block opts in by declaring `auth: "oauth"` in its `block.manifest.json`. The
+host then hands it a real OAuth access token that `/api/v1`, the orchestrator
+and the MCP accept, and consent — including `requestGrants` — goes through the
+host's consent dialog. A block that does not opt in keeps the block-scoped
+token, which those APIs reject; `initialize()` throws a `CivitaiError` saying
+so for a signed-in viewer. Such blocks should stay on `@civitai/app-sdk`.
 
 ## Signing in outside civitai.com
 

package/dist/app/index.js

@@ -1,4 +1,4 @@
-import { BridgeError } from '../core/errors.js';
+import { BridgeError, CivitaiError } from '../core/errors.js';
 import { getTransport } from '../core/get-transport.js';
 import { createHost, createHostSession } from '../host/index.js';
 import { createHttp } from '../http/index.js';
@@ -14,6 +14,10 @@ export async function initialize(options = {}) {
     const transport = options.transport ?? getTransport();
     await ready(transport, options.timeoutMs ?? DEFAULT_INIT_TIMEOUT_MS, options.signal);
     const snapshot = () => transport.snapshot.get();
+    if (snapshot().viewer !== null && snapshot().token.kind === 'block') {
+        throw new CivitaiError('This block receives a block-scoped token, which the Civitai API and the orchestrator ' +
+            'do not accept. Declare `auth: "oauth"` in block.manifest.json to use @civitai/sdk.');
+    }
     return {
         ...createAppClient(createHostSession(transport), options),
         host: createHost(transport),

package/dist/core/handshake.d.ts

@@ -63,18 +63,22 @@ export interface BlockSettings {
     publisherSettings: Record<string, unknown>;
     userSettings: Record<string, unknown>;
 }
+/** `block` is accepted only by the host; `oauth` also by the API and orchestrator. Older hosts send none. */
+export type TokenKind = 'block' | 'oauth';
 /** A token on the wire; `expiresAt` is ISO-8601 until the transport parses it. */
 export interface WrappedToken {
     raw: string;
     scopes: string[];
     expiresAt: string;
     buzzBudget?: number;
+    kind?: TokenKind;
 }
 export interface BlockToken {
     raw: string;
     scopes: string[];
     expiresAt: Date;
     buzzBudget?: number;
+    kind?: TokenKind;
 }
 /**
  * The host still sends `blockId` and `appId`; they are build-time identity a

package/dist/core/transport.js

@@ -33,5 +33,6 @@ export function tokenFromWrapped(wrapped) {
         scopes: wrapped.scopes,
         expiresAt: new Date(wrapped.expiresAt),
         buzzBudget: wrapped.buzzBudget,
+        kind: wrapped.kind,
     };
 }

package/dist/index.d.ts

@@ -21,4 +21,4 @@ export type { BridgeErrorCode, BridgeFailureCode } from './core/errors.js';
 export { getTransport } from './core/get-transport.js';
 export type { DetectOptions } from './core/get-transport.js';
 export type { BlockSnapshot, BlockTransport } from './core/transport.js';
-export type { BlockCheckpointInfo, BlockContext, BlockSettings, BlockToken, ColorDomain, ModelSlotContext, ModelSlotId, PageSlotContext, PageSlotId, ShowcaseImage, Theme, UnknownSlotContext, ViewerInfo, } from './core/handshake.js';
+export type { BlockCheckpointInfo, BlockContext, BlockSettings, BlockToken, ColorDomain, ModelSlotContext, ModelSlotId, PageSlotContext, PageSlotId, ShowcaseImage, Theme, TokenKind, UnknownSlotContext, ViewerInfo, } from './core/handshake.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/sdk",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The Civitai SDK: an app holds a token and calls the Civitai API and the orchestrator; a block asks its host only to show host UI.",
   "license": "MIT",
   "type": "module",