Share private versions with teams
Share an exact released Block or Project Type without publishing its source.
An owner can share an existing private released version of a Block or Project Type with active teammates. This is a host library permission, not a manifest permission. Do not put team IDs, credentials or sharing grants in a portable package. The sandbox and typed input/output contract are unchanged.
Share a version
- Open the released version from My builds → Installed versions → Open source.
- Choose Share with teams, select your teams, and confirm that you have
permission to share the source. Save team access.
- Teammates find the version under Shared with your teams in the Block library
or Project Types library. Preview and install opens the real import review dialog, including the sandbox, tests, permissions and sample execution.
- After review, choose Install this version. The account keeps an installation
and this device keeps a source checkpoint. Installed Blocks also appear when adding a Block to a project's workflow.
Sharing covers one exact entity, version and source digest. Editing a draft, releasing a later version or changing a Project Type does not extend the grant. The release stays private: it receives no public listing, public source link, search entry or sitemap entry. Existing private work stays private after Max ends. Sharing an existing private release does not require buying Max again. Shared draft editing and automatic updates of installed copies are separate features.
Both the source owner and recipient must be active members of a granted team when fetching source or confirming a new installation. StillMade rechecks access after the package review. Removing a grant or leaving/suspending team membership removes future cloud library access and downloads. Previously downloaded source, local checkpoints and embedded project copies remain with their recipients; revocation cannot retract source already delivered. Team access does not grant access to the creator's other projects, media, secrets, or payment account.
Imported third-party source keeps its original license and attribution. A private grant is still source distribution: share only where your license permits it. Hosted capabilities retain the recipient's normal model, payment, cost and review confirmations. A team grant never authorizes a provider call or bypasses runtime tests. Project Type imports remain subject to the current whole-workflow admission rules; sharing does not enable an unsupported runtime combination.
Authenticated host API
These are account APIs for StillMade's UI. They are unavailable inside guest code. All paths below are relative to /api/blocks and require the current account's bearer token. Use the cloud entity UUID, not the manifest's namespace.name ID.
| Request | Behavior |
|---|---|
GET /releases/:entityId/:version/team-access | Owner reads {entityId, version, digest, teams:[{id,name,shared,canShare}]} for a private version. Previously granted inactive teams remain available for removal; canShare:false prevents adding them. |
PUT /releases/:entityId/:version/team-access | Owner sends {teamId, shared, sourceDigest, rightsConfirmed:true} to grant access; rightsConfirmed is unnecessary when shared:false. |
GET /library?collection=teams | Returns authorized private releases as {items,nextCursor}; pass the returned opaque cursor for the next page. |
GET /library?collection=installs | Lists installed releases the account can currently retrieve from the cloud. |
GET /releases/:entityId/:version | Fetches authorized source and its digest through authenticated storage. |
POST /install | Confirms {entityId,version,sourceDigest,confirmed:true} after review; include the existing comfyuiReview or capabilityReview receipt when the runtime requires one. |
A denied or removed release returns 404; a changed digest returns 409. When team sharing is not set up on a StillMade server, team-sharing endpoints return 503 with TEAM_ACCESS_SETUP_REQUIRED. Existing owner/public source access continues; unavailable team storage never grants access to a private release.