@gemmein/sdk 0.4.3 → 0.4.4

package/dist/index.cjs

@@ -671,6 +671,12 @@ class CollectionClient {
      * Pass `{ name }` so the download carries a real filename, and
      * `{ contentType }` when the Blob has no type of its own.
      *
+     * W7.4 — `{ for: userId }` names ONE other person who may read this file
+     * (addressed and direct collections only — the rules where recipients
+     * exist). The attachment on a direct message: upload with
+     * `{ for: recipientId }`, store the ref in the record you send them, and
+     * their `g.files.link(ref)` works. Without `for`, only you can link it.
+     *
      * There is deliberately no `url` here. A URL that outlives a refund is the
      * bug this replaced.
      */
@@ -682,7 +688,7 @@ class CollectionClient {
         // Step 1: Get presigned upload URL
         const presign = await this.request("/upload", {
             method: "POST",
-            body: JSON.stringify({ name, size: file.size, contentType }),
+            body: JSON.stringify({ name, size: file.size, contentType, ...(options?.for ? { for: options.for } : {}) }),
         });
         // Step 2: Upload directly to S3 via presigned POST
         const form = new FormData();

package/dist/index.d.cts

@@ -500,12 +500,19 @@ export declare class CollectionClient<T extends Record<string, unknown> = Record
      * Pass `{ name }` so the download carries a real filename, and
      * `{ contentType }` when the Blob has no type of its own.
      *
+     * W7.4 — `{ for: userId }` names ONE other person who may read this file
+     * (addressed and direct collections only — the rules where recipients
+     * exist). The attachment on a direct message: upload with
+     * `{ for: recipientId }`, store the ref in the record you send them, and
+     * their `g.files.link(ref)` works. Without `for`, only you can link it.
+     *
      * There is deliberately no `url` here. A URL that outlives a refund is the
      * bug this replaced.
      */
     upload(file: Blob | File, options?: {
         name?: string;
         contentType?: string;
+        for?: string;
     }): Promise<{
         id: string;
         ref: FileRef;

package/dist/index.d.ts

@@ -500,12 +500,19 @@ export declare class CollectionClient<T extends Record<string, unknown> = Record
      * Pass `{ name }` so the download carries a real filename, and
      * `{ contentType }` when the Blob has no type of its own.
      *
+     * W7.4 — `{ for: userId }` names ONE other person who may read this file
+     * (addressed and direct collections only — the rules where recipients
+     * exist). The attachment on a direct message: upload with
+     * `{ for: recipientId }`, store the ref in the record you send them, and
+     * their `g.files.link(ref)` works. Without `for`, only you can link it.
+     *
      * There is deliberately no `url` here. A URL that outlives a refund is the
      * bug this replaced.
      */
     upload(file: Blob | File, options?: {
         name?: string;
         contentType?: string;
+        for?: string;
     }): Promise<{
         id: string;
         ref: FileRef;

package/dist/index.js

@@ -655,6 +655,12 @@ export class CollectionClient {
      * Pass `{ name }` so the download carries a real filename, and
      * `{ contentType }` when the Blob has no type of its own.
      *
+     * W7.4 — `{ for: userId }` names ONE other person who may read this file
+     * (addressed and direct collections only — the rules where recipients
+     * exist). The attachment on a direct message: upload with
+     * `{ for: recipientId }`, store the ref in the record you send them, and
+     * their `g.files.link(ref)` works. Without `for`, only you can link it.
+     *
      * There is deliberately no `url` here. A URL that outlives a refund is the
      * bug this replaced.
      */
@@ -666,7 +672,7 @@ export class CollectionClient {
         // Step 1: Get presigned upload URL
         const presign = await this.request("/upload", {
             method: "POST",
-            body: JSON.stringify({ name, size: file.size, contentType }),
+            body: JSON.stringify({ name, size: file.size, contentType, ...(options?.for ? { for: options.for } : {}) }),
         });
         // Step 2: Upload directly to S3 via presigned POST
         const form = new FormData();

package/llms.txt

@@ -291,7 +291,7 @@ go-live. Everything else is yours.
 - Images & files: NEVER base64 into record data and NEVER wire up your own
   storage bucket — uploads are built in:
   `const file = await g.collection("posts").upload(blob, { name })`
-  → `{ id, ref, contentType, sizeBytes }`. Store `file.ref` (`"file:01K…"`)
+  → `{ id, ref, contentType, sizeBytes }`. Store `file.ref` (`"file:9f2c…"` — a UUID form)
   in a record field like any text — that's how a record "has" an image or
   a document.
   Store the REFERENCE, never a URL: a reference never expires and grants
@@ -318,14 +318,27 @@ go-live. Everything else is yours.
   the console shows by name).
   Honest bound: revoking access stops NEW links immediately; a link already
   issued works until it expires. Gemmein controls delivery, it can't take
-  back a file someone already downloaded.
+  back a file someone already downloaded. A file can name ONE other reader:
+  `upload(blob, { for: userId })` (addressed/direct collections only) — the
+  direct message's attachment; the recipient's `files.link` works, everyone
+  else's still refuses. Without `for`, only the uploader can link it —
+  including in a client portal, where the OWNER hands a client a document
+  from the dashboard (attach it on the client's record there).
 - Shapes: collections your users write (community, shared, direct) have a
   SHAPE — the set of fields allowed. While your human builds, the server
   learns it from your writes automatically (nothing to do); when they go
-  live it locks. A 400 invalid_shape means the field isn't in the locked
-  shape. A live shape is sealed and cannot take new fields — stop, tell
-  your human which field you needed, and send only the fields the shape
-  already has. Never rename fields to dodge it.
+  live it locks. Field kinds the shape learns: text, number, yes/no, list,
+  link (a stored record id), json, and FILE — a field that held an
+  upload()'s ref learns as a file field — and WHICH class (an image field
+  vs a document field, from what you actually uploaded). Once locked, the
+  field accepts only a reference to a real, confirmed file of this app
+  that the writer may read, of the right class — a ZIP into a profile
+  photo field is refused with the teach, as is a made-up or foreign ref
+  ("file not found"). A 400 invalid_shape means the field isn't in the locked
+  shape or the value doesn't fit its kind. A live shape is sealed and
+  cannot take new fields — stop, tell your human which field you needed,
+  and send only the fields the shape already has. Never rename fields to
+  dodge it.
 - Contention (bookings, slugs, stock, shared edits): when two users can race
   for the same thing, a permission model can't save you — preconditions do,
   and they're just arguments on calls you already make. A 409 `conflict` from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gemmein/sdk",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Gemmein SDK \u2014 passwordless auth, safe storage, and Stripe-driven record flips for AI-built apps. Small enough that one prompt teaches the whole API.",
   "license": "MIT",
   "type": "module",