@gemmein/sdk 0.3.1 → 0.3.2

package/dist/index.cjs

@@ -242,8 +242,13 @@ exports.PurchasesClient = PurchasesClient;
  * are, what the collection's rule says, whether the file is yours, and whether
  * you still hold whatever the collection requires.
  *
- * That is why the same app code keeps working when a collection later changes
- * from public to private — and why a refund actually takes a download away.
+ * That is why the same app code keeps working across collections, and why a
+ * refund takes away a download the buyer had not yet resolved. Two honest
+ * bounds: an already-issued link keeps working until it expires (minutes),
+ * and a file uploaded while its collection was public keeps its permanent
+ * URL even if the rule is later tightened — new uploads seal, old ones are
+ * moved only by an owner reseal. Sell access with the rule set from the
+ * start, not tightened afterwards.
  *
  * Don't store what this returns. Store the reference and call this again.
  */

package/dist/index.d.cts

@@ -242,8 +242,13 @@ export type FileRef = string & {
  * are, what the collection's rule says, whether the file is yours, and whether
  * you still hold whatever the collection requires.
  *
- * That is why the same app code keeps working when a collection later changes
- * from public to private — and why a refund actually takes a download away.
+ * That is why the same app code keeps working across collections, and why a
+ * refund takes away a download the buyer had not yet resolved. Two honest
+ * bounds: an already-issued link keeps working until it expires (minutes),
+ * and a file uploaded while its collection was public keeps its permanent
+ * URL even if the rule is later tightened — new uploads seal, old ones are
+ * moved only by an owner reseal. Sell access with the rule set from the
+ * start, not tightened afterwards.
  *
  * Don't store what this returns. Store the reference and call this again.
  */

package/dist/index.d.ts

@@ -242,8 +242,13 @@ export type FileRef = string & {
  * are, what the collection's rule says, whether the file is yours, and whether
  * you still hold whatever the collection requires.
  *
- * That is why the same app code keeps working when a collection later changes
- * from public to private — and why a refund actually takes a download away.
+ * That is why the same app code keeps working across collections, and why a
+ * refund takes away a download the buyer had not yet resolved. Two honest
+ * bounds: an already-issued link keeps working until it expires (minutes),
+ * and a file uploaded while its collection was public keeps its permanent
+ * URL even if the rule is later tightened — new uploads seal, old ones are
+ * moved only by an owner reseal. Sell access with the rule set from the
+ * start, not tightened afterwards.
  *
  * Don't store what this returns. Store the reference and call this again.
  */

package/dist/index.js

@@ -231,8 +231,13 @@ export class PurchasesClient {
  * are, what the collection's rule says, whether the file is yours, and whether
  * you still hold whatever the collection requires.
  *
- * That is why the same app code keeps working when a collection later changes
- * from public to private — and why a refund actually takes a download away.
+ * That is why the same app code keeps working across collections, and why a
+ * refund takes away a download the buyer had not yet resolved. Two honest
+ * bounds: an already-issued link keeps working until it expires (minutes),
+ * and a file uploaded while its collection was public keeps its permanent
+ * URL even if the rule is later tightened — new uploads seal, old ones are
+ * moved only by an owner reseal. Sell access with the rule set from the
+ * start, not tightened afterwards.
  *
  * Don't store what this returns. Store the reference and call this again.
  */

package/llms.txt

@@ -186,11 +186,14 @@
   `await g.subscriptions.mine()` → `{ plan, status }` or null, and gates features
   with `sub?.plan === "pro"`.
 - Paid ACCESS (entitlements): a collection can require a key — your human
-  sets `requires: "access:pro"` in its settings — and the engine refuses
-  anyone without it, on every operation, under all seven rules. Keys are
-  granted by money: a plan or product lists what it unlocks (e.g.
+  sets `requires: "access:pro"` in the "Unlocked by" row on its Collections
+  card — and the engine refuses customers without it, under all seven
+  rules. (Server secret keys and the owner's console are exempt by design;
+  link/expand silently hide gated records rather than naming them.) Keys
+  are granted by money: a plan or product lists what it unlocks (e.g.
   `access:pro, access:exports`), the paid webhook grants those keys, and a
-  refund or cancellation revokes exactly what it granted — nothing else.
+  FULL refund or a cancellation revokes exactly what it granted — nothing
+  else. A partial refund leaves access in place.
   Owners also grant and revoke by hand (trials, comps, support). Effective
   access is the UNION of a customer's live grants. A signed-in customer
   without the key gets `403 entitlement_required` naming it — show your
@@ -211,12 +214,13 @@
   payment itself — `await g.purchases.mine()` is the buyer's proof:
   { item, kind, status: "paid"|"part_refunded"|"refunded", amountMinor,
   currency, refundedMinor, grants, paidAt }. A receipts collection (rule
-  `addressed`) is OPTIONAL — add one when you want receipts as records the
-  app renders; only the buyer and the owner read them. Delivery: attach
-  the thing to the product — a sealed Gemmein file (the receipt carries a
-  `file:` ref; resolve it per reader with `g.files.link`, which re-checks
-  access on every mint) or an external `deliveryUrl` (a plain handover:
-  Gemmein controls who is TOLD, not who can use it). Gate fulfilment on
+  `addressed`) is OPTIONAL for proof — but TODAY it is REQUIRED for file
+  delivery: the file reference only reaches the buyer on the receipt
+  record (its `deliveryFile` field, a `file:` ref — resolve it per reader
+  with `g.files.link`, which re-checks access on every mint). Selling a
+  file? Configure a receipts collection, or the buyer has no way to reach
+  their download. External `deliveryUrl` is a plain handover: Gemmein
+  controls who is TOLD, not who can use it. Gate fulfilment on
   the purchase or the entitlement it granted, never on the redirect coming
   back — redirects can be faked; the record comes from Stripe's signed
   webhook. NO carts, NO quantities — one product per checkout by design; a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gemmein/sdk",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Gemmein SDK — passwordless auth, safe storage, and Stripe-driven record flips for AI-built apps. Small enough that one prompt teaches the whole API.",
   "license": "MIT",
   "type": "module",