@supersuit/artifacts 0.1.0

package/lib/reader/reader-watch.js

@@ -0,0 +1,125 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+// What a gated page does in the reader's browser: count how long they actually read, how far
+// they got, and catch the moves that take the page away from here (save, print, a large copy,
+// saving an image, opening the inspector). Each of those is stopped where a browser lets a page
+// stop it, told to the reader in a line, and recorded under their name.
+//
+// HONEST LIMITS. A screenshot, a phone camera, or a reader who disables scripts cannot be seen
+// by any web page. That is what the banner and the watermark are for: they make every copy
+// carry the name of the person it was shown to.
+import { useEffect, useRef, useState } from 'react';
+const BEAT_MS = 15_000;
+/** A reader idle this long stops earning time, so a tab left open overnight is not "reading". */
+const IDLE_MS = 60_000;
+/** Quoting a sentence is fine; lifting a section is not. */
+export const COPY_LIMIT = 280;
+export function ReaderWatch({ artifactId, endpoint, accent }) {
+    const [notice, setNotice] = useState(null);
+    const state = useRef({ session: '', lastActive: Date.now(), maxScroll: 0, pending: 0, lastBeat: Date.now() });
+    useEffect(() => {
+        const s = state.current;
+        s.session = (crypto.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`).replace(/[^A-Za-z0-9-]/g, '');
+        const send = (body, beacon = false) => {
+            const payload = JSON.stringify({ id: artifactId, session: s.session, ...body });
+            if (beacon && navigator.sendBeacon) {
+                navigator.sendBeacon(endpoint, new Blob([payload], { type: 'application/json' }));
+                return;
+            }
+            fetch(endpoint, { method: 'POST', body: payload, headers: { 'content-type': 'application/json' }, keepalive: true, credentials: 'same-origin' }).catch(() => { });
+        };
+        const scroll = () => {
+            const h = document.documentElement.scrollHeight - window.innerHeight;
+            const pct = h <= 0 ? 100 : Math.min(100, Math.round((window.scrollY / h) * 100));
+            s.maxScroll = Math.max(s.maxScroll, pct);
+        };
+        const active = () => { s.lastActive = Date.now(); };
+        // Seconds actually read since the last beat: visible, and touched within the idle window.
+        const accrue = () => {
+            const now = Date.now();
+            if (document.visibilityState === 'visible' && now - s.lastActive < IDLE_MS)
+                s.pending += (now - s.lastBeat) / 1000;
+            s.lastBeat = now;
+        };
+        const beat = (beacon = false) => {
+            accrue();
+            const add = Math.min(60, Math.round(s.pending));
+            s.pending -= add;
+            send({ kind: 'beat', active: add, scroll: s.maxScroll }, beacon);
+        };
+        const flag = (kind, detail, message) => {
+            send({ kind: 'flag', flag: kind, ...(detail ? { detail } : {}) });
+            if (message) {
+                setNotice(message);
+                window.setTimeout(() => setNotice(null), 6000);
+            }
+        };
+        scroll();
+        send({ kind: 'beat', active: 0, scroll: s.maxScroll });
+        const timer = window.setInterval(() => beat(), BEAT_MS);
+        const onVisibility = () => { if (document.visibilityState === 'hidden')
+            beat(true);
+        else
+            s.lastBeat = Date.now(); };
+        const onHide = () => beat(true);
+        const onKey = (e) => {
+            active();
+            const mod = e.metaKey || e.ctrlKey;
+            const k = e.key.toLowerCase();
+            if (mod && k === 's') {
+                e.preventDefault();
+                flag('save', 'keyboard', 'Saving is turned off for this page, and the attempt was recorded.');
+            }
+            else if (mod && k === 'p') {
+                e.preventDefault();
+                flag('print', 'keyboard', 'Printing is turned off for this page, and the attempt was recorded.');
+            }
+            else if (e.key === 'F12' || (mod && e.altKey && k === 'i') || (mod && e.shiftKey && (k === 'i' || k === 'c')))
+                flag('devtools', 'keyboard');
+        };
+        const onBeforePrint = () => flag('print', 'menu', 'Printing is turned off for this page, and the attempt was recorded.');
+        const onCopy = (e) => {
+            const text = String(window.getSelection() ?? '');
+            if (text.length <= COPY_LIMIT)
+                return;
+            e.preventDefault();
+            e.clipboardData?.setData('text/plain', 'This passage is confidential and was not copied.');
+            flag('copy', `${text.length} characters`, 'Copying more than a sentence or two is turned off for this page, and the attempt was recorded.');
+        };
+        const onContext = (e) => {
+            if (e.target?.closest?.('img')) {
+                e.preventDefault();
+                flag('image', 'right-click', 'Saving images is turned off for this page, and the attempt was recorded.');
+            }
+        };
+        const onDrag = (e) => {
+            if (e.target?.closest?.('img')) {
+                e.preventDefault();
+                flag('image', 'drag');
+            }
+        };
+        window.addEventListener('scroll', () => { scroll(); active(); }, { passive: true });
+        for (const ev of ['mousemove', 'pointerdown', 'touchstart', 'wheel'])
+            window.addEventListener(ev, active, { passive: true });
+        window.addEventListener('keydown', onKey);
+        window.addEventListener('beforeprint', onBeforePrint);
+        document.addEventListener('copy', onCopy);
+        document.addEventListener('contextmenu', onContext);
+        document.addEventListener('dragstart', onDrag);
+        document.addEventListener('visibilitychange', onVisibility);
+        window.addEventListener('pagehide', onHide);
+        return () => {
+            window.clearInterval(timer);
+            window.removeEventListener('keydown', onKey);
+            window.removeEventListener('beforeprint', onBeforePrint);
+            document.removeEventListener('copy', onCopy);
+            document.removeEventListener('contextmenu', onContext);
+            document.removeEventListener('dragstart', onDrag);
+            document.removeEventListener('visibilitychange', onVisibility);
+            window.removeEventListener('pagehide', onHide);
+            for (const ev of ['mousemove', 'pointerdown', 'touchstart', 'wheel'])
+                window.removeEventListener(ev, active);
+        };
+    }, [artifactId, endpoint]);
+    return notice ? (_jsx("div", { role: "status", "data-nospeak": true, className: "fixed inset-x-0 bottom-6 z-50 mx-auto w-fit max-w-[90vw] rounded-lg px-4 py-3 text-sm shadow-lg", style: { background: '#111', color: '#fff', border: `1px solid ${accent}` }, children: notice })) : null;
+}

package/lib/routes/artifacts.d.ts

@@ -0,0 +1,115 @@
+import type { Metadata } from 'next';
+import { NextRequest, NextResponse } from 'next/server';
+import type { ArtifactStore } from '../artifacts/store.js';
+import { type ArtifactAssets } from '../artifacts/assets.js';
+import type { BrandPack } from '../brand/pack.js';
+import { type Access } from '../artifacts/reader.js';
+import { type ReadersStore } from '../artifacts/readers-store.js';
+export type ArtifactRoutesConfig = {
+    store: ArtifactStore;
+    /** Where uploaded files go. Optional; without it PUT_ASSET answers 501. */
+    assets?: ArtifactAssets;
+    brand: BrandPack;
+    /** The host that serves a 200, e.g. https://artifacts.example.com. No trailing slash. */
+    siteUrl: string;
+    /** Read at request time, so a rotated key needs no rebuild. */
+    publishKey: () => string | undefined;
+    /** Share image when an artifact has no cover. Absolute or site-relative. */
+    defaultShareImage?: string;
+    /** Where a page lives under the origin. '/' on a dedicated host (artifacts.<name>/<id>);
+     *  '/a/' when the instance is a route inside a larger site. Default '/'. */
+    pagePrefix?: string;
+    /** Read one request cookie by name. Default reads through next/headers; tests inject one. */
+    readCookie?: (name: string) => Promise<string | undefined>;
+    /** The record for gated pages (`access:` in front matter). Without it a gated page stays shut
+     *  to everyone, never open: failing closed is the only safe default for a confidential page. */
+    readers?: ReadersStore;
+    /** Shared with the sign-in authority, which mints the pass. Read at request time. */
+    readerSecret?: () => string | undefined;
+    /** The sign-in authority's origin; readers go to `<signInOrigin>/artifact/sign-in?to=<page>`.
+     *  No default: without it a gated page shows its door with no way through (fails closed). */
+    signInOrigin?: string;
+    /** Who the banner says grants access, e.g. "Example Co". Default the brand name. */
+    owner?: string;
+};
+/** Ids are 8 chars from the safe alphabet; anything else is not a page and never reaches the store. */
+export declare const ARTIFACT_ID: RegExp;
+type Params = {
+    params: Promise<{
+        id: string;
+    }>;
+};
+type PageProps = Params & {
+    searchParams?: Promise<{
+        key?: string | string[];
+    }>;
+};
+export declare function createArtifactRoutes(config: ArtifactRoutesConfig): {
+    Page: ({ params, searchParams }: PageProps) => Promise<import("react").JSX.Element>;
+    generateMetadata: ({ params }: Params) => Promise<Metadata>;
+    POST: (request: NextRequest) => Promise<NextResponse<{
+        error: string;
+    }> | NextResponse<{
+        id: string;
+        url: string;
+        version: number;
+    }>>;
+    GET: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
+        error: string;
+    }> | NextResponse<{
+        id: string;
+        text: string;
+    }>>;
+    DELETE: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
+        error: string;
+    }> | NextResponse<{
+        deleted: boolean;
+    }>>;
+    PUT_ASSET: (request: NextRequest, { params }: {
+        params: Promise<{
+            id: string;
+            name: string;
+        }>;
+    }) => Promise<NextResponse<{
+        error: string;
+    }> | NextResponse<{
+        id: string;
+        name: string;
+        url: string;
+    }>>;
+    SHARE_IMAGE: (_request: NextRequest, { params }: Params) => Promise<Response>;
+    ENTER: (request: NextRequest) => Promise<NextResponse<unknown>>;
+    LEAVE: (request: NextRequest) => Promise<NextResponse<unknown>>;
+    TRACK: (request: NextRequest) => Promise<NextResponse<unknown>>;
+    ACK: (request: NextRequest) => Promise<NextResponse<unknown>>;
+    ACCESS: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
+        error: string;
+    }> | NextResponse<{
+        id: string;
+        access: Access | null;
+        readers: import("../index.js").AllowEntry[];
+    }>>;
+    READS: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
+        error: string;
+    }> | NextResponse<{
+        acks: {
+            email: string;
+            name: string | null;
+            at: string;
+        }[];
+        readers: import("../artifacts/readers-store.js").ReaderSummary[];
+        refused: {
+            email: string;
+            name: string | null;
+            attempts: number;
+            lastAt: string;
+        }[];
+        id: string;
+        title: string;
+        access: Access | null;
+        views: number;
+    }>>;
+    dynamic: "force-dynamic";
+    maxDuration: number;
+};
+export {};

package/lib/routes/artifacts.js

@@ -0,0 +1,345 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { revalidatePath } from 'next/cache';
+import { notFound } from 'next/navigation';
+import { NextResponse } from 'next/server';
+import { isPublishAuthed } from '../artifacts/auth.js';
+import { parseArtifactSource } from '../artifacts/front-matter.js';
+import { narrationText } from '../artifacts/narration.js';
+import { ArtifactMarkdown } from '../artifacts/render.js';
+import { ArtifactDoor } from '../artifacts/door.js';
+import { isUnlocked, keyHash, unlockCookieName } from '../artifacts/unlock.js';
+import { ASSET_NAME, contentTypeFor } from '../artifacts/assets.js';
+import { BrandGround } from '../brand/wrapper.js';
+import { renderShareCard } from '../brand/share-card.js';
+import { ArtifactReader } from '../reader/artifact-reader.js';
+import { ReaderWatch } from '../reader/reader-watch.js';
+import { ACCESS_LEVELS, GRANT_COOKIE, GRANT_TTL_SECONDS, decide, firstName, mintGrant, safeReturnPath, signInUrl, verifyGrant, verifyPass, } from '../artifacts/reader.js';
+import { FLAG_KINDS, summarize } from '../artifacts/readers-store.js';
+import { AckDoor, ConfidentialBanner, NO_PRINT_CSS, NotAllowedDoor, SignInDoor, Watermark, ackText } from '../artifacts/confidential.js';
+/** Ids are 8 chars from the safe alphabet; anything else is not a page and never reaches the store. */
+export const ARTIFACT_ID = /^[abcdefghjkmnpqrstuvwxyz23456789]{8}$/;
+async function defaultReadCookie(name) {
+    const { cookies } = await import('next/headers');
+    return (await cookies()).get(name)?.value;
+}
+export function createArtifactRoutes(config) {
+    const { store, brand, siteUrl } = config;
+    const prefix = config.pagePrefix ?? '/';
+    const pageUrl = (id) => `${siteUrl}${prefix}${id}`;
+    const pagePath = (id) => `${prefix}${id}`;
+    const absolute = (p) => (p ? (/^https?:\/\//.test(p) ? p : `${siteUrl}${p}`) : undefined);
+    // The version in the URL is what makes a re-publish show up: every unfurler caches by URL.
+    const signInOrigin = config.signInOrigin;
+    const owner = config.owner ?? brand.name;
+    const readerSecret = () => config.readerSecret?.();
+    const signOutUrl = (id) => `/api/reader/leave?to=${encodeURIComponent(pagePath(id))}`;
+    const shareCardUrl = (id, updatedAt) => `${pageUrl(id)}/share.png?v=${encodeURIComponent(updatedAt)}`;
+    async function generateMetadata({ params }) {
+        const { id } = await params;
+        const a = ARTIFACT_ID.test(id) ? await store.get(id) : null;
+        if (!a)
+            return { title: 'Not found', robots: { index: false, follow: false } };
+        const url = pageUrl(a.id);
+        const image = absolute(a.cover) ?? (brand.share ? shareCardUrl(a.id, a.updatedAt) : absolute(config.defaultShareImage));
+        return {
+            title: a.title,
+            description: a.summary,
+            alternates: { canonical: pagePath(a.id) },
+            robots: { index: false, follow: false },
+            openGraph: {
+                title: a.title,
+                description: a.summary,
+                url,
+                siteName: brand.name,
+                type: 'article',
+                ...(image ? { images: [{ url: image, alt: a.cover ? a.title : brand.name }] } : {}),
+            },
+            twitter: {
+                card: image ? 'summary_large_image' : 'summary',
+                title: a.title,
+                description: a.summary,
+                ...(image ? { images: [image] } : {}),
+            },
+        };
+    }
+    async function Page({ params, searchParams }) {
+        const { id } = await params;
+        const a = ARTIFACT_ID.test(id) ? await store.get(id) : null;
+        if (!a)
+            notFound();
+        if (a.access)
+            return GatedPage(a, id);
+        // A password shuts the body, never the title: the header stays so the reader knows which
+        // page they were sent, and the unfurl (generateMetadata) keeps reading as the page.
+        const sp = (await searchParams) ?? {};
+        const key = Array.isArray(sp.key) ? sp.key[0] : sp.key;
+        const readCookie = config.readCookie ?? defaultReadCookie;
+        const cookie = a.password ? await readCookie(unlockCookieName(id)) : undefined;
+        const open = isUnlocked({ id, password: a.password, key, cookie });
+        // Opened by the key in the URL: remember it in a cookie holding the hash, never the
+        // password, scoped to this page, so a refresh or a shared device does not ask again.
+        const remember = open && a.password && key !== undefined && cookie !== keyHash(id, a.password)
+            ? `document.cookie=${JSON.stringify(`${unlockCookieName(id)}=${keyHash(id, a.password)}; Path=${pagePath(id)}; Max-Age=31536000; SameSite=Lax; Secure`)}`
+            : null;
+        if (!open) {
+            return (_jsxs(BrandGround, { pack: brand, children: [_jsxs("div", { className: "mx-auto max-w-2xl px-6 pt-24 pb-8 text-center sm:pt-28", children: [_jsx("p", { "data-nospeak": true, className: "mb-4 text-[11px] font-medium uppercase tracking-[0.3em]", style: { color: brand.accent }, children: brand.kicker }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary })] }), _jsx(ArtifactDoor, { brand: brand, wrongKey: key !== undefined })] }));
+        }
+        void store.bumpViews(id);
+        let words = [];
+        if (a.narration && a.timings) {
+            try {
+                const r = await fetch(a.timings, { next: { revalidate: 3600 } });
+                if (r.ok)
+                    words = (await r.json()).words ?? [];
+            }
+            catch {
+                words = [];
+            }
+        }
+        const when = new Date(a.updatedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' });
+        return (_jsxs(BrandGround, { pack: brand, children: [remember ? _jsx("script", { dangerouslySetInnerHTML: { __html: remember } }) : null, _jsxs("div", { id: "artifact-narration-root", children: [_jsxs("div", { className: "mx-auto max-w-2xl px-6 pt-24 pb-8 text-center sm:pt-28", children: [_jsx("p", { "data-nospeak": true, className: "mb-4 text-[11px] font-medium uppercase tracking-[0.3em]", style: { color: brand.accent }, children: brand.kicker }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary }), _jsxs("p", { "data-nospeak": true, className: "mt-4 text-xs opacity-50", children: ["Updated ", when] })] }), a.cover ? (_jsx("div", { className: "mx-auto max-w-2xl px-6 pb-8", children: _jsx("img", { src: a.cover, alt: "", className: "w-full rounded-xl border border-white/10" }) })) : null, _jsx("article", { className: "mx-auto max-w-2xl px-6 pb-24", children: _jsx(ArtifactMarkdown, { markdown: a.markdown }) })] }), a.narration && words.length > 0 ? (_jsx(ArtifactReader, { src: a.narration, words: words, rootId: "artifact-narration-root", label: brand.narratorLabel(a.voice), accent: brand.accent, ground: brand.ground })) : null] }));
+    }
+    /** A page with `access:`. The body is rendered only after the reader is known and allowed;
+     *  everyone else gets the title, the summary, and a door. */
+    async function GatedPage(a, id) {
+        const readCookie = config.readCookie ?? defaultReadCookie;
+        const reader = verifyGrant(readerSecret(), await readCookie(GRANT_COOKIE));
+        const allow = config.readers && reader ? await config.readers.allowList(id) : [];
+        const d = config.readers ? decide(a.access, reader, allow) : { open: false, why: 'signed-out' };
+        const header = (_jsxs("div", { className: "mx-auto max-w-2xl px-6 pt-24 pb-8 text-center sm:pt-28", children: [_jsx("p", { "data-nospeak": true, className: "mb-4 text-[11px] font-medium uppercase tracking-[0.3em]", style: { color: brand.accent }, children: brand.kicker }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary })] }));
+        if (!d.open) {
+            if (d.why === 'not-allowed' && config.readers)
+                void config.readers.flag({ artifactId: id, reader: d.reader, kind: 'refused' }).catch(() => { });
+            return (_jsxs(BrandGround, { pack: brand, children: [header, d.why === 'not-allowed'
+                        ? _jsx(NotAllowedDoor, { brand: brand, reader: d.reader, signOutUrl: signOutUrl(id) })
+                        : _jsx(SignInDoor, { brand: brand, href: signInOrigin ? signInUrl(signInOrigin, pageUrl(id)) : undefined })] }));
+        }
+        const r = reader;
+        // The agreement comes before the body, every reader, once per page. No agreement, no body.
+        if (config.readers && !(await config.readers.acknowledged(id, r.email))) {
+            return (_jsxs(BrandGround, { pack: brand, children: [header, _jsx(AckDoor, { brand: brand, name: firstName(r, allow), email: r.email, owner: owner, pageId: id, signOutUrl: signOutUrl(id) })] }));
+        }
+        void store.bumpViews(id);
+        return (_jsxs(BrandGround, { pack: brand, children: [_jsx("style", { dangerouslySetInnerHTML: { __html: NO_PRINT_CSS } }), _jsx(Watermark, { email: r.email }), _jsx("div", { className: "px-6 pt-20 sm:pt-24", children: _jsx(ConfidentialBanner, { name: firstName(r, allow), email: r.email, reason: d.reason, owner: owner, brand: brand, signOutUrl: signOutUrl(id) }) }), await Body(a, { top: false }), _jsx(ReaderWatch, { artifactId: id, endpoint: "/api/reader/track", accent: brand.accent })] }));
+    }
+    /** The page itself, shared by open and gated pages. */
+    async function Body(a, { top }) {
+        let words = [];
+        if (a.narration && a.timings) {
+            try {
+                const r = await fetch(a.timings, { next: { revalidate: 3600 } });
+                if (r.ok)
+                    words = (await r.json()).words ?? [];
+            }
+            catch {
+                words = [];
+            }
+        }
+        const when = new Date(a.updatedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' });
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { id: "artifact-narration-root", children: [_jsxs("div", { className: `mx-auto max-w-2xl px-6 ${top ? 'pt-24 sm:pt-28' : 'pt-12'} pb-8 text-center`, children: [_jsx("p", { "data-nospeak": true, className: "mb-4 text-[11px] font-medium uppercase tracking-[0.3em]", style: { color: brand.accent }, children: brand.kicker }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary }), _jsxs("p", { "data-nospeak": true, className: "mt-4 text-xs opacity-50", children: ["Updated ", when] })] }), a.cover ? (_jsx("div", { className: "mx-auto max-w-2xl px-6 pb-8", children: _jsx("img", { src: a.cover, alt: "", className: "w-full rounded-xl border border-white/10" }) })) : null, _jsx("article", { className: "mx-auto max-w-2xl px-6 pb-24", children: _jsx(ArtifactMarkdown, { markdown: a.markdown }) })] }), a.narration && words.length > 0 ? (_jsx(ArtifactReader, { src: a.narration, words: words, rootId: "artifact-narration-root", label: brand.narratorLabel(a.voice), accent: brand.accent, ground: brand.ground })) : null] }));
+    }
+    const cookieLine = (value, maxAge) => `${GRANT_COOKIE}=${value}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
+    /** GET /api/reader/enter?pass=<pass>&to=/<id>: where the sign-in authority sends a signed-in
+     *  reader. Swaps the five-minute pass for this host's grant and lands them on the page, with
+     *  the pass gone from the address bar. A bad pass lands them on the page's door again. */
+    async function ENTER(request) {
+        const to = safeReturnPath(request.nextUrl.searchParams.get('to'), prefix);
+        if (!to)
+            return NextResponse.json({ error: 'to must be a page on this host' }, { status: 400 });
+        const secret = readerSecret();
+        const reader = verifyPass(secret, request.nextUrl.searchParams.get('pass'));
+        const res = NextResponse.redirect(`${siteUrl}${to}`, 303);
+        res.headers.set('cache-control', 'no-store');
+        if (reader && secret)
+            res.headers.append('set-cookie', cookieLine(mintGrant(secret, reader), GRANT_TTL_SECONDS));
+        return res;
+    }
+    /** GET /api/reader/leave?to=/<id>: sign out of this host's gated pages. */
+    async function LEAVE(request) {
+        const to = safeReturnPath(request.nextUrl.searchParams.get('to'), prefix) ?? '/';
+        const res = NextResponse.redirect(`${siteUrl}${to}`, 303);
+        res.headers.append('set-cookie', cookieLine('', 0));
+        return res;
+    }
+    /** POST /api/reader/ack: the reader agrees to keep the page confidential. A plain form post
+     *  from AckDoor; records the exact wording and lands them on the page. Only a reader the page
+     *  is open to can agree, and only with the box ticked. */
+    async function ACK(request) {
+        const form = await request.formData().catch(() => null);
+        const id = String(form?.get('id') ?? '');
+        if (!ARTIFACT_ID.test(id))
+            return NextResponse.json({ error: 'no page' }, { status: 400 });
+        const back = NextResponse.redirect(`${siteUrl}${pagePath(id)}`, 303);
+        if (!config.readers || form?.get('agree') !== 'yes')
+            return back;
+        const reader = verifyGrant(readerSecret(), request.cookies.get(GRANT_COOKIE)?.value);
+        const a = await store.get(id);
+        if (!reader || !a?.access)
+            return back;
+        if (!decide(a.access, reader, await config.readers.allowList(id)).open)
+            return back;
+        await config.readers.acknowledge({ artifactId: id, reader, text: ackText(owner), country: request.headers.get('x-vercel-ip-country') ?? undefined });
+        return back;
+    }
+    /** POST /api/reader/track: the reading heartbeat and the flags, from ReaderWatch. Recorded
+     *  only for a reader the page is open to right now, so the record cannot be written into by
+     *  anyone the page would refuse. */
+    async function TRACK(request) {
+        if (!config.readers)
+            return new NextResponse(null, { status: 204 });
+        const reader = verifyGrant(readerSecret(), request.cookies.get(GRANT_COOKIE)?.value);
+        if (!reader)
+            return new NextResponse(null, { status: 401 });
+        const raw = await request.text();
+        if (raw.length > 2048)
+            return new NextResponse(null, { status: 413 });
+        let b;
+        try {
+            b = JSON.parse(raw);
+        }
+        catch {
+            return new NextResponse(null, { status: 400 });
+        }
+        const id = String(b.id ?? '');
+        const session = String(b.session ?? '');
+        if (!ARTIFACT_ID.test(id) || !/^[A-Za-z0-9-]{8,64}$/.test(session))
+            return new NextResponse(null, { status: 400 });
+        const a = await store.get(id);
+        if (!a?.access)
+            return new NextResponse(null, { status: 404 });
+        if (!decide(a.access, reader, await config.readers.allowList(id)).open)
+            return new NextResponse(null, { status: 403 });
+        const country = request.headers.get('x-vercel-ip-country') ?? undefined;
+        if (b.kind === 'beat') {
+            const add = Math.max(0, Math.min(60, Math.round(Number(b.active) || 0)));
+            const scroll = Math.max(0, Math.min(100, Math.round(Number(b.scroll) || 0)));
+            const device = /Mobi|Android|iPhone|iPad/i.test(request.headers.get('user-agent') ?? '') ? 'mobile' : 'desktop';
+            await config.readers.touchSession({ artifactId: id, session, reader, addSeconds: add, scroll, device, country });
+            return new NextResponse(null, { status: 204 });
+        }
+        if (b.kind === 'flag' && FLAG_KINDS.includes(b.flag) && b.flag !== 'refused') {
+            const detail = typeof b.detail === 'string' ? b.detail.slice(0, 80) : undefined;
+            await config.readers.flag({ artifactId: id, reader, kind: b.flag, detail, country });
+            return new NextResponse(null, { status: 204 });
+        }
+        return new NextResponse(null, { status: 400 });
+    }
+    /** GET|POST /api/artifacts/<id>/access, publish key: the page's level and its list.
+     *  POST body: { access?: 'freedom'|'invite'|'public', add?: [{ email, name?, reason? }], remove?: [email] }. */
+    async function ACCESS(request, { params }) {
+        if (!isPublishAuthed(request, config.publishKey()))
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        if (!config.readers)
+            return NextResponse.json({ error: 'this host keeps no reader record' }, { status: 501 });
+        const { id } = await params;
+        const a = ARTIFACT_ID.test(id) ? await store.get(id) : null;
+        if (!a)
+            return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+        if (request.method === 'GET')
+            return NextResponse.json({ id, access: a.access ?? null, readers: await config.readers.allowList(id) });
+        const b = (await request.json().catch(() => null));
+        let access = a.access ?? null;
+        if (b?.access !== undefined) {
+            if (b.access !== 'public' && !ACCESS_LEVELS.includes(b.access))
+                return NextResponse.json({ error: `access must be one of: public, ${ACCESS_LEVELS.join(', ')}` }, { status: 400 });
+            if (!store.setAccess)
+                return NextResponse.json({ error: 'this store cannot change access' }, { status: 501 });
+            await store.setAccess(id, b.access);
+            access = b.access === 'public' ? null : b.access;
+        }
+        const add = Array.isArray(b?.add) ? b.add : [];
+        const remove = Array.isArray(b?.remove) ? b.remove : [];
+        const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        for (const e of add) {
+            if (!e || typeof e !== 'object' || typeof e.email !== 'string' || !EMAIL.test(e.email.trim()))
+                return NextResponse.json({ error: 'each add needs a valid email' }, { status: 400 });
+        }
+        if (!remove.every((e) => typeof e === 'string'))
+            return NextResponse.json({ error: 'remove is a list of emails' }, { status: 400 });
+        const readers = await config.readers.allow(id, add, remove);
+        return NextResponse.json({ id, access, readers });
+    }
+    /** GET /api/artifacts/<id>/reads, publish key: who read it, for how long, how far, and every
+     *  attempt to take it away or to open it without being let in. */
+    async function READS(request, { params }) {
+        if (!isPublishAuthed(request, config.publishKey()))
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        if (!config.readers)
+            return NextResponse.json({ error: 'this host keeps no reader record' }, { status: 501 });
+        const { id } = await params;
+        const a = ARTIFACT_ID.test(id) ? await store.get(id) : null;
+        if (!a)
+            return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+        const [sessions, flags, acks] = await Promise.all([config.readers.sessions(id), config.readers.flags(id), config.readers.acks(id)]);
+        return NextResponse.json({ id, title: a.title, access: a.access ?? null, views: a.views, ...summarize(sessions, flags), acks: acks.map((k) => ({ email: k.email, name: k.name, at: k.at })) }, { headers: { 'cache-control': 'no-store' } });
+    }
+    async function POST(request) {
+        if (!isPublishAuthed(request, config.publishKey()))
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        const text = await request.text();
+        const parsed = parseArtifactSource(text);
+        if (!parsed.ok)
+            return NextResponse.json({ error: parsed.error }, { status: 400 });
+        const id = request.nextUrl.searchParams.get('id') ?? parsed.meta.id ?? undefined;
+        const result = await store.save({ id, meta: parsed.meta, markdown: parsed.body });
+        if ('notFound' in result)
+            return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+        revalidatePath(pagePath(result.id));
+        return NextResponse.json({ id: result.id, url: pageUrl(result.id), version: result.version }, { status: result.created ? 201 : 200 });
+    }
+    async function GET(request, { params }) {
+        if (!isPublishAuthed(request, config.publishKey()))
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        const { id } = await params;
+        const a = await store.get(id);
+        if (!a)
+            return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+        return NextResponse.json({ id, text: narrationText({ title: a.title, summary: a.summary, markdown: a.markdown }) });
+    }
+    /** PUT /api/artifacts/<id>/assets/<name>: raw bytes in, public URL out. 16 MiB cap. */
+    async function PUT_ASSET(request, { params }) {
+        if (!isPublishAuthed(request, config.publishKey()))
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        if (!config.assets)
+            return NextResponse.json({ error: 'this host does not store assets' }, { status: 501 });
+        const { id, name } = await params;
+        if (!ARTIFACT_ID.test(id))
+            return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+        if (!(await store.get(id)))
+            return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+        if (!ASSET_NAME.test(name))
+            return NextResponse.json({ error: 'asset name must be one path segment: letters, digits, dot, dash, underscore' }, { status: 400 });
+        const type = contentTypeFor(name);
+        if (!type)
+            return NextResponse.json({ error: 'asset type not allowed; use webp, png, jpg, gif, mp3 or json' }, { status: 415 });
+        const bytes = Buffer.from(await request.arrayBuffer());
+        if (bytes.length === 0)
+            return NextResponse.json({ error: 'empty body' }, { status: 400 });
+        if (bytes.length > 16 * 1024 * 1024)
+            return NextResponse.json({ error: 'asset over 16 MiB' }, { status: 413 });
+        const url = await config.assets.put(id, name, bytes, type);
+        return NextResponse.json({ id, name, url }, { status: 201 });
+    }
+    /** GET /<id>/share.png: the page's title card. 404 when the pack draws none, so a
+     *  tenant on the static default never serves a half-styled card. */
+    async function SHARE_IMAGE(_request, { params }) {
+        const { id } = await params;
+        if (!brand.share)
+            return new NextResponse('no share card for this host', { status: 404 });
+        const a = ARTIFACT_ID.test(id) ? await store.get(id) : null;
+        if (!a)
+            return new NextResponse(`no artifact with id ${id}`, { status: 404 });
+        return renderShareCard(brand, a.title);
+    }
+    async function DELETE(request, { params }) {
+        if (!isPublishAuthed(request, config.publishKey()))
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        const { id } = await params;
+        const ok = await store.delete(id);
+        if (!ok)
+            return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+        revalidatePath(pagePath(id));
+        return NextResponse.json({ deleted: true });
+    }
+    return { Page, generateMetadata, POST, GET, DELETE, PUT_ASSET, SHARE_IMAGE, ENTER, LEAVE, TRACK, ACK, ACCESS, READS, dynamic: 'force-dynamic', maxDuration: 30 };
+}