@atelic-action/ui 0.15.0 → 0.15.1

package/README.md

@@ -226,7 +226,7 @@ The two pieces a reader sees are ordinary components, in `@atelic-action/ui/comp
 
 `@atelic-action/ui/artifact` is everything the artifact template shared across its cuts, so a fix reaches every business's documents with one version bump:
 
-- **The documents:** `Writeup`, `Report`, and `Gate` (the sealed document, with its `GatePayload` type), plus the `GradeChip` and `SignOff` the first two share, and every content type they take (`WriteupProps`, `ReportProps`, `GateProps`, and the rest).
+- **The documents:** `Writeup`, `Report`, and `Gate` (the sealed document, with its `GatePayload` type; a reader's address is the key, so a payload never lists it, and the component identifies a reader to HubSpot by the address they typed), plus the `GradeChip` and `SignOff` the first two share, and every content type they take (`WriteupProps`, `ReportProps`, `GateProps`, and the rest).
 - **The shell:** `ArtifactShell`, the `.mkt` scope with the skip link, the dark header, the credit band, and the watermark around a page.
 - **The contract and the head:** the `ArtifactConfig` types, and `buildPageHead` and `canonicalUrl` with their `PageMeta` type.
 - **Who opened it:** `mintToken`, `sealReader`, `openReader`, `readerId`, `readerLink`, and `whoIsReading`. The same six are also built and exported alone as `@atelic-action/ui/artifact/readers`, because a Playwright spec and a script run under Node, which compiles nothing inside `node_modules`.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@atelic-action/ui",
-	"version": "0.15.0",
+	"version": "0.15.1",
 	"description": "Shared UI for the Atelic templates: site chrome, base styles, the component library, and the access gate they install",
 	"type": "module",
 	"license": "UNLICENSED",

package/src/artifact/Gate.tsx

@@ -19,10 +19,13 @@ export interface GatePerson {
 	/** Stable handle for the reader, used in the payload and in `onUnlock`. */
 	id: string;
 	/**
-	 * The reader's email address: the secret their key derives from, and,
-	 * when it matches `identifyDomain`, the identity pushed to HubSpot.
+	 * Never read, and a payload sealed today does not carry it. The reader's
+	 * address is the secret their key derives from, so a payload that lists
+	 * it hands the key to anyone who reads the page's script; payloads sealed
+	 * before 2026-10-08 did. The address a reader types is the one this
+	 * component uses.
 	 */
-	email: string;
+	email?: string;
 	/** Base64: this reader's PBKDF2 salt, GCM nonce, and wrapped content key. */
 	salt: string;
 	iv: string;
@@ -83,6 +86,8 @@ function fromBase64(value: string): Uint8Array {
 
 interface Opened {
 	person: GatePerson;
+	/** The address that opened the document, as the reader gave it. */
+	email: string;
 	html: string;
 }
 
@@ -137,7 +142,7 @@ async function openDocument(payload: GatePayload, rawEmail: string): Promise<Ope
 				contentKey,
 				fromBase64(payload.ct) as BufferSource,
 			);
-			return { person, html: new TextDecoder().decode(plain) };
+			return { person, email: rawEmail, html: new TextDecoder().decode(plain) };
 		} catch {
 			// Wrong email for this reader. Try the next one; say nothing.
 		}
@@ -145,11 +150,18 @@ async function openDocument(payload: GatePayload, rawEmail: string): Promise<Ope
 	return null;
 }
 
-function identifyReader(person: GatePerson, domain: string | undefined) {
-	if (!domain || !person.email) return;
-	if (!person.email.toLowerCase().endsWith(`@${domain.toLowerCase()}`)) return;
+/**
+ * Tells HubSpot who opened the document, from the address the reader gave:
+ * the payload names no one. The key forgives what the reader types (case,
+ * spaces, even a missing at sign), so the address is sent only when it reads
+ * as one, and only on the domain the site names.
+ */
+function identifyReader(rawEmail: string, domain: string | undefined) {
+	const email = rawEmail.trim().toLowerCase();
+	if (!domain || !/^[^\s@]+@[^\s@]+$/.test(email)) return;
+	if (!email.endsWith(`@${domain.toLowerCase()}`)) return;
 	window._hsq = window._hsq || [];
-	window._hsq.push(["identify", { email: person.email }]);
+	window._hsq.push(["identify", { email }]);
 	window._hsq.push(["setPath", window.location.pathname]);
 	window._hsq.push(["trackPageView"]);
 }
@@ -238,7 +250,7 @@ export function Gate({
 				if (cancelled) return;
 				if (opened) {
 					writeStored(storageKey, fromQuery);
-					identifyReader(opened.person, identifyDomain);
+					identifyReader(opened.email, identifyDomain);
 					setHtml(opened.html);
 					onUnlockRef.current?.(opened.person);
 					return;
@@ -252,7 +264,7 @@ export function Gate({
 			if (!stored) return;
 			const opened = await openDocument(payload, stored);
 			if (cancelled || !opened) return;
-			identifyReader(opened.person, identifyDomain);
+			identifyReader(opened.email, identifyDomain);
 			setHtml(opened.html);
 			onUnlockRef.current?.(opened.person);
 		}
@@ -275,7 +287,7 @@ export function Gate({
 			return;
 		}
 		writeStored(storageKey, value);
-		identifyReader(opened.person, identifyDomain);
+		identifyReader(opened.email, identifyDomain);
 		setHtml(opened.html);
 		onUnlockRef.current?.(opened.person);
 	}