@nibgate/sdk 0.1.5 → 0.1.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/SKILL.md +26 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -17,7 +17,7 @@ import { createCircleGatewayServer, createNibgateServer } from '@nibgate/sdk/ser
|
|
|
17
17
|
|
|
18
18
|
This works with Next.js, React apps with an API backend, Express, NestJS, Remix, SvelteKit, Astro SSR, custom servers, and CMS/plugin environments. Plain HTML can use the widget and browser events, but real gating still requires a server, edge function, API route, or signed file endpoint.
|
|
19
19
|
|
|
20
|
-
Agents integrating Nibgate should read [`SKILL.md`](./SKILL.md) or the public copy at [https://nibgate.xyz/skill.md](https://nibgate.xyz/skill.md) for the compact operating guide.
|
|
20
|
+
Agents integrating Nibgate should read [`SKILL.md`](./SKILL.md) or the public copy at [https://nibgate.xyz/skill.md](https://nibgate.xyz/skill.md) for the compact operating guide. If you are handing a creator site to an AI coding agent, point it at `node_modules/@nibgate/sdk/SKILL.md` or `https://nibgate.xyz/skill.md` before it edits routes, payment code, or widget setup.
|
|
21
21
|
|
|
22
22
|
## Usage
|
|
23
23
|
|
package/SKILL.md
CHANGED
|
@@ -13,6 +13,15 @@ Use `@nibgate/sdk` in the creator-owned site that actually serves the content. N
|
|
|
13
13
|
npm install @nibgate/sdk
|
|
14
14
|
```
|
|
15
15
|
|
|
16
|
+
## Agent Handoff
|
|
17
|
+
|
|
18
|
+
When an AI agent is helping install Nibgate, give it this file first:
|
|
19
|
+
|
|
20
|
+
- package copy: `node_modules/@nibgate/sdk/SKILL.md`
|
|
21
|
+
- public copy: `https://nibgate.xyz/skill.md`
|
|
22
|
+
|
|
23
|
+
The guide is intentionally compact so agents can follow the correct package, widget, server gating, payment, and event patterns without guessing. If an agent is modifying a creator site, tell it to read `SKILL.md` before editing routes or checkout code.
|
|
24
|
+
|
|
16
25
|
Use browser helpers from `@nibgate/sdk` and access enforcement from `@nibgate/sdk/server`:
|
|
17
26
|
|
|
18
27
|
```ts
|
|
@@ -119,6 +128,23 @@ export function GET(request: Request) {
|
|
|
119
128
|
|
|
120
129
|
The route should return a real `402 Payment Required` challenge until the request has a valid payment proof or signed unlock proof.
|
|
121
130
|
|
|
131
|
+
## Hardcoded Or File-Based Content
|
|
132
|
+
|
|
133
|
+
Hardcoded content, MDX files, Markdown files, static JSON files, and repo-local media metadata can be gated when the protected payload stays server-side until access is allowed.
|
|
134
|
+
|
|
135
|
+
Safe pattern:
|
|
136
|
+
|
|
137
|
+
1. keep the public teaser, title, price, and metadata in the page;
|
|
138
|
+
2. keep the full paid body in a server-only module, route handler, CMS fetch, DB row, private file, or signed URL endpoint;
|
|
139
|
+
3. run `accessResponse(...)`, `accessFor(...)`, middleware, or a framework guard before returning the full payload.
|
|
140
|
+
|
|
141
|
+
Unsafe pattern:
|
|
142
|
+
|
|
143
|
+
- rendering the paid body into public HTML and hiding it with CSS;
|
|
144
|
+
- bundling the paid body into client JavaScript;
|
|
145
|
+
- putting private text into `nibgate.json`, JSON-LD, meta tags, page source, or static exports;
|
|
146
|
+
- exposing an open API route that returns the protected body without checking payment proof.
|
|
147
|
+
|
|
122
148
|
## Required Env Vars
|
|
123
149
|
|
|
124
150
|
Creator site:
|
package/package.json
CHANGED