Gemmein

Says whetherConnects Stripe through Gemmein's own one-purpose page — a restricted key is connectednever intyped Developmentinto alreadya (andchat. withAnswers one state: connected (which kindStripe ofaccount, key);test whenor itlive isn'tmode), returnswaiting (the dashboardpage's link for connectingyour human: it opens Stripe's key page with every permission already ticked, Development's also ticking the two test-payment rows, then they paste the key there and Gemmein checks it on the exactspot), permissionsbroken (the restrictedconnected key needs.was Connectingrolled Stripeor islost thea founder'spermission step;— with a restrictedfresh page), expired, cancelled or revoked (nothing changed), or not_live (Live's key iscomes after go-live). A refused paste says exactly why — a live key in Development, a named missing permission, a key that can do too much — and what your human does next. wait: up to 40 seconds, answering the moment it changes — send the link, then call again with wait: 40; never typedask intoyour human to say when they're done. env live: Live's key, which asks for the code Gemmein emails on the page. plans: true when the app will sell subscriptions (the link then asks for the two plan permissions up front). Calling again never opens a chat.second page. This is what a founder may call setting ⟨5 unchanged words⟩ 

{"additionalProperties":false,"properties":{"env":{"description":"which environment's key (default development)","enum":["development","live"],"type":"string"},"plans":{"description":"the app sells subscriptions: ask for the two plan permissions now","type":"boolean"},"wait":{"description":"seconds to wait for your human (0-40); the answer comes the moment it changes","maximum":40,"minimum":0,"type":"number"}},"type":"object"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":truefalse,"title":"Connect Stripe (your human)"}

 ⟨34 unchanged words⟩ rule or field is refused with the fix. Don't store health or medical data, biometric data, government ID numbers (such as social security or passport numbers) or payment card details in a collection; payments go through Stripe, which holds card details. A field whose name says it holds one of those (ssn, passport_number, card_number, cvc, diagnosis, medical_record…) is refused (sensitive_field). A rule never changes on an existing collection  ⟨36 unchanged words⟩ 

 ⟨43 unchanged words⟩  — removing Live's is its own request (request_live_action delete_ai_toolrequest_delete_ai_tool), approved by the founder in their browser. ⟨8 unchanged words⟩ 

 ⟨42 unchanged words⟩  — removing Live's is its own request (request_live_action delete_collectionrequest_delete_collection), approved by the founder in their browser. ⟨9 unchanged words⟩ 

 ⟨42 unchanged words⟩  — removing Live's is its own request (request_live_action delete_relayrequest_delete_relay), approved by the founder in their browser. ⟨8 unchanged words⟩ 

 ⟨172 unchanged words⟩ Each fresh look is on the founder's Logs. ChangesWhen nothing.the look sees the ownership record of a domain still waiting to be proved, Gemmein confirms it right there — the same check as the dashboard's Check again — and, for a domain the founder chose to show the Gemmein site at, starts its secure connection; the answer says so (confirmedNow). Gemmein checks a domain that isn't proved yet on its own: every 10 minutes for the first day, then hourly, for 7 days after it was added or last checked by hand; a check by hand (Check again, domain_check, npx gemmein domains) starts the 7 days again. The answer's autoCheck says where the domain is on that schedule. It changes nothing else, and never anything at the DNS provider.

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":truefalse,"title":"Check a domain"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":true,"title":"One-click domain setup link"}

 ⟨14 unchanged words⟩ carries it to the cloud. A relay is onethe triggersecure (receiverboundary for three jobs. React, nothing charged: a receiver (a provider's webhook;webhook), schedule: (a clock;clock), data_change: (a record changing), credits_low or run_started trigger runs Gemmein's own verbs, and call_url sends a signed notice to the founder's server. Charge for an action, when the user's action costs credits (book a class, unlock, post): an app_call trigger — the app calls the relay by name with g.relays.call before anything is written — whose first action spend_credits takes the caller's own credits, or refuses with 402 credits_exhausted so nothing else runs, refunded if what it pays for (the first write) fails; once that is done the charge stands and later actions are follow-ups that retry. Charge for work the founder's own server does, AI or not: that is a pipeline, a tool on provider external (put_ai_tool), not call_url; a relay's start_run starts such a paid job from an event. One trigger and up to ten actions in Gemmein's own verbs (write_record, grant_access, revoke_access, grant_credits, spend_credits, email_person, call_url, start_run, fulfil_product, refund_product, grant_plan, revoke_plan) —  ⟨89 unchanged words⟩ 

 ⟨49 unchanged words⟩  returns the all-eight cheat-sheet plus the cross-cutting law and, the two options beside a rule (show / hide times, rankable numbers, followers-only) and follows and blocks, including what no rule supports (team/group/workspace scope ⟨23 unchanged words⟩ 

 ⟨38 unchanged words⟩ emailed code is asked for a reply); onceapproving approvedit sends it, once (live_action_status sendswith itwait: true reads the outcome) — plain text, to that conversation's customer  ⟨228 unchanged words⟩ 

Carry out anWhere approveda Live actionrequest stands

ChecksReads where a Live request stands (one a request_* tool, inbox_reply, site_promote, site_rebuild or replay_relay with env live, a moderation tool with env live, domain_site on a Live app or request_server_key asked) — it changes nothing (approving it in the approvalbrowser request_live_actionis started;what oncecarries it out). status: pending (waiting for the founder), approvedrunning (approved; Gemmein is carrying it out), carriesunconfirmed the(started actionand outmay —already oncehave gone through; still being confirmed — andnever answersask whatagain happened.on Waitingit), done (with what happened: athe repeatdoor's callown answer — a fewdomain's secondsDNS laterrecords, checksthe again.site's Deniedaddress, orthe expiredcustomer reached), failed (why: either nothing changed.changed Refused— when carriedthe outapproval (wasn't used up the planfounder isn'tcan press Try again on the approval page once the cause is fixed, the plan paid for example — or, when its approval was used, that it may have gone through and where the namefounder movedchecks; never ask again on that), arefused rate(denied, limitcancelled or revoked) or expired. wait: nothingtrue changedwaits up to 40 seconds and answers the moment it is done, failed, refused or expired (a failed one whose approval isn'twas used upsays it may have gone through — never nothing changed) — call it again with wait: true while it is still pending, rather than asking the answerfounder saysto say when they have approved. attempts lists every carry-out of the approval — its number, when it ran, how it ended and why, and giveswho astarted newit handle(the forApprove, aor retrya onceTry theagain causeand isby fixed.whom).

{"additionalProperties":false,"properties":{"handle":{"description":"the handle the request returned","type":"string"},"wait":{"description":"true: wait up to 40 seconds for the outcome","type":"boolean"}},"required":["handle"],"type":"object"}

{"destructiveHint":truefalse,"idempotentHint":falsetrue,"openWorldHint":false,"readOnlyHint":falsetrue,"title":"Carry out anWhere approveda Live actionrequest stands"}

{"destructiveHint":falsetrue,"idempotentHint":false,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Prove the app works"}

Says whether anAn AI provider's key, ispasted setby your human on Gemmein's own one-purpose page — never in Developmenta alreadychat. Answers one state: connected (the key works, with itsthe lastmodel call'sit resultanswered (workedas), failedconnected_with_problem and(the whykey is saved but the account has no credit, orthe notmodel calledisn't yet)available to it — nevernaming the key;tool whenthat noneuses isit set— or the provider was busy), returnswaiting (the dashboardpage's link: whereit opens the founderprovider's own key page, then your human pastes the key; Gemmein makes one tiny test call before saving, and a key the provider rejects is never saved), broken (OpenAIthe key's last call was rejected — with a fresh page), Anthropicexpired, Googlecancelled or revoked, or not_live. provider: openai, anthropic, google, replicate, fal, assemblyai, deepgram, elevenlabs, runway or openai-compatible (your human types the endpoint's address and its name on the page — you never choose where a pipeline'skey ownis sent; before saving, the page shows the host the key will be sent to). Thewait: up to 40 seconds, answering the moment it changes — send the link, then call again with wait: 40. env live: Live's key, iswhich neverasks typedfor intothe code Gemmein emails on the page. A pipeline on the founder's own server has no key — its tool takes a chat.URL.

{"additionalProperties":false,"properties":{"env":{"enum":["development","live"],"type":"string"},"provider":{"description":"openai, anthropic, google, replicate, fal, assemblyai, deepgram, elevenlabs, runway or openai-compatible","type":"string"},"wait":{"maximum":40,"minimum":0,"type":"number"}},"type":"object"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":truefalse,"title":"An AI provider's key (your human)"}

 ⟨57 unchanged words⟩ founder may call an AI feature or a chatbot.chatbot — and, on provider external, a pipeline: a paid job on their own server, AI or not, where Gemmein holds the price, sends the run to the tool's URL and settles the units the server reports.

 ⟨52 unchanged words⟩  may describe as 'when X happens, do Y'.Y' — or, with an app_call trigger and spend_credits as its first action, as 'booking a class costs a credit': the app calls it by name and the caller's own credits are taken before anything is written. Work the founder's own server charges for is a pipeline (put_ai_tool, provider external), not a relay's call_url.

 ⟨21 unchanged words⟩  the founder approves it in the browser (request_live_action rename_apprequest_rename_app).

 ⟨86 unchanged words⟩ moves money or calls an address — and live_action_statusapproving it runs it, once approved.(live_action_status with wait: true reads the outcome). A run that is still queued or running ⟨9 unchanged words⟩ 

{"destructiveHint":falsetrue,"idempotentHint":false,"openWorldHint":true,"readOnlyHint" ⟨7 unchanged words⟩ 

 ⟨43 unchanged words⟩ a product's downloadable file is uploaded on the dashboard'sdashboard, producton cardthe product's own page (a file path can't travel through a  ⟨19 unchanged words⟩ 

{"destructiveHint":true,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Set plans and products"}

 ⟨35 unchanged words⟩  in their browser, with the code Gemmein emails;emails, live_action_statusand thenapproving it carries it out, onceonce; andlive_action_status (wait: true) answers PUBLISHED (env live) or FAILED. Refused ⟨41 unchanged words⟩ 

{"destructiveHint":falsetrue,"idempotentHint":false,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Ask to  ⟨5 unchanged words⟩ 

 ⟨109 unchanged words⟩ ). The Development site is a private preview:, onlyand the founder,answer signedcarries inits tolink Gemmein,— plushand anyoneyour holdinghuman athat 7-daylink: shareOpen your preview with its link. Anyone with the link can open it; change the link to cut everyone off. (With the preview link turned off, only the founder can open it, signed in to Gemmein, and the answer says so.) 30 days idle unpublishes it (its files are ⟨35 unchanged words⟩  Logs; Development caps how many publishes a day. After publishing, read site_errors: a blank page or an empty list shows there. This is what a founder may call updating ⟨6 unchanged words⟩ 

{"destructiveHint":true,"idempotentHint":false,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Publish the Development site"}

 ⟨63 unchanged words⟩  their browser with the code Gemmein emails, thenand live_action_statusapproving it carries it out, once (if Live serves another version by then, nothing is rebuilt); andlive_action_status the(wait: approvaltrue) isn'treads used).the outcome. Refused before asking when the app isn't live ⟨28 unchanged words⟩ 

{"destructiveHint":false,"idempotentHint":false,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Rebuild the site"}

Turn off everythe preview link off

Turns offthe everyDevelopment sharepreview's link (site_share_link)off, andthe everyway signed-inthe previewdashboard's ofPreview thelink Developmentswitch sitedoes: atno once,link opens the waypreview, theold dashboard'sor "Turnnew, offand every previewdevice link"that does:opened anyoneit holdingis ancut oldoff. linkIt can'tstays off: only the founder can open the preview, anysigned more.in Theto site'sGemmein. filessite_share_link andwith theon: versiontrue turns it servesback don'ton change;with thea foundernew openslink it(anything againshared frombefore thestays dashboard,dead). The site's files and site_share_linkthe makesversion newit links.serves don't change. Development only — the Live site is public and has no preview links.link. Development caps how many a day. On the founder's Logs.

 ⟨5 unchanged words⟩ :false,"readOnlyHint":false,"title":"Turn off everythe preview link off"}

A link to theThe site previewpreview's link

MakesAnswers athe app's preview link: thatit opens the Development site's private preview on any device for 7 days, with no Gemmein sign-in — forhow showingthe founder opens their own preview, and how they show the app to someone. Your preview has one link. Anyone holdingwith it can open it. Change the link to cut everyone off. Turn the link off to keep the preview private: then only you can open it, signed in to Gemmein. One link per app, the previewsame each time: asking again answers the same link. It has no end date; it works until it ends.is Eachchanged, callthe preview link is turned off (site_revoke_previews) or the site is unpublished. While it is off, this answers that it is off; on: true turns it back on with a NEW link (anything shared before stays dead). change: true makes a new link;link each— change it to cut off everyone who has it: the old link stops and every device that opened the preview with it is cut off at once (the preview is put up again with nothing else changed); Development allows 20 changes a day. It is short (https://<slug>-dev.gemmein.dev/p/ and ten letters; tell your human: "The link is on your preview's own address."): give it to your human exactly as the answer has it, never re-typed — a link that says it looks incomplete lost letters on the way; ask for it again. A new or changed link is on the founder's Logs. This is what a founder may call a link to show someone, or letting a friend try it.it, or a new link.

{"additionalProperties":false,"properties":{"change":{"description":"true = a new link; the old one stops working at once. Leave out to get the link as it is.","type":"boolean"},"on":{"description":"true = turn the preview link back on (a new link) after it was turned off. Leave out otherwise.","type":"boolean"}},"type":"object"}

{"destructiveHint":falsetrue,"idempotentHint":false,"openWorldHint":false,"readOnlyHint":false,"title":"A link to theThe site previewpreview's link"}

 ⟨7 unchanged words⟩ (the private preview every publish lands on) with the link that opens it (the app's share link; with the preview link turned off, the founder's own signed-in route) and the Live address (public, once a  ⟨44 unchanged words⟩  site — its status (connecting, live, offline, needs attention, hosted elsewhere, not connected), whether the founder chose to show the Gemmein site there, and the one record to add.add when one is needed (never for a domain hosted elsewhere). env live reads from the Live side. Changes ⟨13 unchanged words⟩ 

 ⟨96 unchanged words⟩ only; the server refuses Live changes here — request_live_actionrequest_promote handlesasks those.the founder to carry them to Live. One call carries up to 1 MB of ⟨44 unchanged words⟩ 

{"destructiveHint":true,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Sync the gemmein/ files"}

 ⟨85 unchanged words⟩ it never reaches Live — Live's customers through request_live_action cancel_subscriptionrequest_cancel_subscription, approved by the founder. test_outcome reads what  ⟨5 unchanged words⟩ 

{"destructiveHint":true,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Cancel a test member's subscription"}

 ⟨40 unchanged words⟩ reaches Live — Live's customers get credits through request_live_action grant_creditsrequest_grant_credits, approved by the founder. amount is whole  ⟨20 unchanged words⟩ 

 ⟨52 unchanged words⟩ it never reaches Live — Live's customers through request_live_action suspend_personrequest_suspend_person, approved by the founder. test_member_unsuspend lifts it. On the founder's Logs.

 ⟨10 unchanged words⟩  through the app's real checkout in Stripe's sandbox (test mode), withto Stripe'sprove publishedwhat testthe cardapp (card:does visaafter a payment. outcome names what to prove: pays (a paid purchase), declined (Stripe declines it; nothing is declined,granted) 3dsor asks_to_verify (Stripe asks 3-Dthe Securepayer to verify, then it pays). —Gemmein pays with Stripe's own published sandbox numbers for that outcome — nothing real is charged, and no payment details are ever typed into or sent through this chat. Sandbox keys only, test members only, the test kit's daily caps. When this server can't typecomplete theStripe's cardsandbox page itself, the answer is the sandbox checkout link and the test card for theyour founderhuman to payfinish in their browser; test_outcome then reads the result. Nothing real is ever charged. This is what a founder may call trying a payment.

 ⟨7 unchanged words⟩  member's name","type":"string"},"carditem":{"enumdescription":["visa","declined","3dsthe plan or product's name"],"type":"string"},"itemoutcome":{"description":"thewhat planto orprove product's— namedefault pays","enum":["pays","declined","asks_to_verify"],"type":"string"}},"required":[ ⟨4 unchanged words⟩ 

{"destructiveHint":false,"idempotentHint":false,"openWorldHint":falsetrue,"readOnlyHint":false,"title":"Test a payment"}