@nibgate/sdk 0.1.4 → 0.1.6

package/README.md

@@ -17,7 +17,7 @@ import { createCircleGatewayServer, createNibgateServer } from '@nibgate/sdk/ser
 
 This works with Next.js, React apps with an API backend, Express, NestJS, Remix, SvelteKit, Astro SSR, custom servers, and CMS/plugin environments. Plain HTML can use the widget and browser events, but real gating still requires a server, edge function, API route, or signed file endpoint.
 
-Agents integrating Nibgate should read [`SKILL.md`](./SKILL.md) or the public copy at [https://nibgate.xyz/skill.md](https://nibgate.xyz/skill.md) for the compact operating guide.
+Agents integrating Nibgate should read [`SKILL.md`](./SKILL.md) or the public copy at [https://nibgate.xyz/skill.md](https://nibgate.xyz/skill.md) for the compact operating guide. If you are handing a creator site to an AI coding agent, point it at `node_modules/@nibgate/sdk/SKILL.md` or `https://nibgate.xyz/skill.md` before it edits routes, payment code, or widget setup.
 
 ## Usage
 

package/SKILL.md

@@ -13,6 +13,15 @@ Use `@nibgate/sdk` in the creator-owned site that actually serves the content. N
 npm install @nibgate/sdk
 ```
 
+## Agent Handoff
+
+When an AI agent is helping install Nibgate, give it this file first:
+
+- package copy: `node_modules/@nibgate/sdk/SKILL.md`
+- public copy: `https://nibgate.xyz/skill.md`
+
+The guide is intentionally compact so agents can follow the correct package, widget, server gating, payment, and event patterns without guessing. If an agent is modifying a creator site, tell it to read `SKILL.md` before editing routes or checkout code.
+
 Use browser helpers from `@nibgate/sdk` and access enforcement from `@nibgate/sdk/server`:
 
 ```ts
@@ -119,6 +128,23 @@ export function GET(request: Request) {
 
 The route should return a real `402 Payment Required` challenge until the request has a valid payment proof or signed unlock proof.
 
+## Hardcoded Or File-Based Content
+
+Hardcoded content, MDX files, Markdown files, static JSON files, and repo-local media metadata can be gated when the protected payload stays server-side until access is allowed.
+
+Safe pattern:
+
+1. keep the public teaser, title, price, and metadata in the page;
+2. keep the full paid body in a server-only module, route handler, CMS fetch, DB row, private file, or signed URL endpoint;
+3. run `accessResponse(...)`, `accessFor(...)`, middleware, or a framework guard before returning the full payload.
+
+Unsafe pattern:
+
+- rendering the paid body into public HTML and hiding it with CSS;
+- bundling the paid body into client JavaScript;
+- putting private text into `nibgate.json`, JSON-LD, meta tags, page source, or static exports;
+- exposing an open API route that returns the protected body without checking payment proof.
+
 ## Required Env Vars
 
 Creator site:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nibgate/sdk",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Framework-agnostic browser and server package for creator-owned gated content, unlock events, and receipts.",
   "type": "module",
   "sideEffects": false,

package/src/server.d.ts

@@ -22,6 +22,12 @@ export type NibgateServerResource = {
   currency?: string;
   access?: NibgateAccessMode | NibgateAccessPolicy;
   unlock?: NibgateUnlockMode | NibgateUnlockPolicy;
+  ratingsEnabled?: boolean;
+  enableRatings?: boolean;
+  reputation?: {
+    ratingsEnabled?: boolean;
+    [key: string]: unknown;
+  };
   [key: string]: unknown;
 };