@commonpub/layer 0.73.0 → 0.73.2

package/composables/useCookieConsent.ts

@@ -19,8 +19,12 @@ const BUILTIN_COOKIES: CookieDefinition[] = [
   },
   {
     name: 'cpub-color-scheme',
-    category: 'functional',
-    description: 'Remembers your light/dark mode preference across visits.',
+    // Essential, not functional: it's a preference the user explicitly
+    // requests by pressing the Light/Dark toggle (consent-exempt class:
+    // stores no identifier, does no tracking). When it was consent-gated,
+    // anyone on "Essential only" lost their theme on every refresh.
+    category: 'essential',
+    description: 'Remembers your light/dark mode preference. Set only when you use the theme toggle.',
     duration: '1 year',
   },
 ];

package/composables/useTheme.ts

@@ -8,8 +8,11 @@ import { THEME_TO_FAMILY, FAMILY_VARIANTS } from '../utils/themeConfig';
  * between light and dark mode within that theme's family. The server middleware
  * resolves the correct theme on every request — no theme-selection cookie needed.
  *
- * The dark mode preference cookie (`cpub-color-scheme`) is only persisted
- * when the user has accepted functional cookies via the consent banner.
+ * The dark mode preference cookie (`cpub-color-scheme`) is an ESSENTIAL
+ * preference cookie (set only by the user pressing the toggle, no
+ * identifier) — always persisted, no consent gate. It used to be gated on
+ * functional consent, which silently dropped the preference on refresh for
+ * anyone who chose "Essential only".
  *
  * Custom themes (`cpub-custom-*`) and code-registered themes pass through —
  * the user's cookie toggle is recorded but the server picks the actual variant
@@ -35,15 +38,12 @@ export function useTheme(): {
     path: '/',
     sameSite: 'lax',
   });
-  const { allowsFunctional } = useCookieConsent();
-
   function setDarkMode(dark: boolean): void {
     isDark.value = dark;
 
-    // Only persist to cookie if user consented to functional cookies
-    if (allowsFunctional.value) {
-      schemeCookie.value = dark ? 'dark' : 'light';
-    }
+    // Always persist — pressing the toggle IS the consent for this
+    // preference cookie (registered as essential in useCookieConsent).
+    schemeCookie.value = dark ? 'dark' : 'light';
 
     // Custom light/dark PAIR: both variants' tokens are injected (scoped to
     // their data-theme attr), so flip the attribute client-side for an instant

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.73.0",
+  "version": "0.73.2",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -53,17 +53,17 @@
     "vue": "^3.4.0",
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
-    "@commonpub/docs": "0.6.3",
-    "@commonpub/config": "0.22.0",
-    "@commonpub/editor": "0.7.11",
     "@commonpub/auth": "0.8.0",
+    "@commonpub/docs": "0.6.3",
     "@commonpub/learning": "0.5.2",
-    "@commonpub/schema": "0.40.1",
-    "@commonpub/explainer": "0.7.15",
+    "@commonpub/config": "0.22.1",
+    "@commonpub/editor": "0.7.11",
     "@commonpub/protocol": "0.13.0",
+    "@commonpub/schema": "0.40.1",
+    "@commonpub/theme-studio": "0.6.1",
     "@commonpub/server": "2.84.1",
     "@commonpub/ui": "0.13.1",
-    "@commonpub/theme-studio": "0.6.1"
+    "@commonpub/explainer": "0.7.15"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",

package/pages/privacy.vue

@@ -67,7 +67,7 @@ const { federation: federationEnabled } = useFeatures();
         <ul>
           <li><strong>Session cookie</strong> (<code>better-auth.session_token</code>): strictly necessary, authenticates your login session. HttpOnly, secure, 7-day expiry.</li>
           <li><strong>Consent cookie</strong> (<code>cpub-consent</code>): strictly necessary, stores your cookie consent choice.</li>
-          <li><strong>Color scheme</strong> (<code>cpub-color-scheme</code>): functional, remembers your light/dark mode preference. Set only with your consent.</li>
+          <li><strong>Color scheme</strong> (<code>cpub-color-scheme</code>): strictly necessary preference, remembers your light/dark mode choice. Set only when you use the theme toggle. No identifier, no tracking.</li>
         </ul>
         <p>We do not use any advertising or tracking cookies. Your instance operator may add analytics cookies, these require your explicit consent. For the full list of cookies and to manage your preferences, visit our <NuxtLink to="/cookies">Cookie Policy</NuxtLink>.</p>
       </section>

package/server/api/search/index.get.ts

@@ -119,14 +119,19 @@ export default defineEventHandler(async (event): Promise<{ items: unknown[]; tot
   // items the instance's own homepage shows. Delegate to listContent (same
   // merge, same pagination invariants, items already in ContentCard's shape)
   // whenever the request uses only filters listContent supports. Search-only
-  // filters (author, date range, multiple tags) and a configured Meilisearch
-  // keep the dedicated local path: federated rows aren't indexed and don't
-  // carry those fields. `resolveContentQuery` pins status=published +
+  // filters (author, date range, multiple tags) keep the dedicated local
+  // path: federated rows aren't indexed and don't carry those fields.
+  // NOTE this branch deliberately OUTRANKS Meilisearch when federation is on:
+  // meili only ever indexes LOCAL content, so on a mirror-heavy instance a
+  // configured-but-mostly-empty index would shadow the merge and return 0
+  // (exactly what happened on commonpub.io, whose compose stack sets
+  // MEILI_URL — the first ship of this fix gated on `!meiliClient` and was
+  // inert there). `resolveContentQuery` pins status=published +
   // visibility=public so this path can never widen what search exposes.
   const tagList = params.tags?.split(',').map((t) => t.trim()).filter(Boolean) ?? [];
   const usesSearchOnlyFilters = !!(params.author || params.dateFrom || params.dateTo || tagList.length > 1);
   const CONTENT_TYPES = new Set(['project', 'article', 'blog', 'explainer']);
-  if (!meiliClient && config.features.seamlessFederation && !usesSearchOnlyFilters) {
+  if (config.features.seamlessFederation && !usesSearchOnlyFilters) {
     const raw: ContentFilters = {
       search: q,
       type: params.type && CONTENT_TYPES.has(params.type) ? (params.type as ContentFilters['type']) : undefined,