@supersuit/artifacts 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 `@supersuit/artifacts`. One entry per version, newest first. Each entry says what changed, how a
 host can tell whether it is affected (DETECTOR), what a host does about it (REMEDY), and the tests.
 
+## 0.17.0 (2026-09-29)
+
+**A host can accept a signed, hour-long publisher pass wherever it accepts the publish key.** A
+shared key cannot be self-served and cannot be revoked for one person without rotating it for
+everyone. New routes config `publisherSecret` and `publisherHost`: when both are set, every
+publish-key route (publish, read, delete, versions, access, reads, assets, upload, responses, the
+comments feed) also accepts `Authorization: Bearer p1.<payload>.<sig>`, a pass naming one person
+and this host, signed with the reader pass's HMAC scheme under its own domain
+(`artifact-publisher`). New exports `mintPublisherPass`, `verifyPublisherPass`,
+`PUBLISHER_PASS_TTL_SECONDS` (3600), `isPublisherAuthed`. `isPublishAuthed` is unchanged.
+
+- DETECTOR: none needed. A host that sets neither field refuses every pass and takes its key
+  exactly as on 0.16.0.
+- REMEDY: nothing, unless you want admins to publish without the key: set both fields, and have
+  your sign-in side mint passes for the people it vouches for.
+- Tests: the pass vector pinned byte for byte; a valid pass for the right host gets exactly what
+  the key gets on every publish-key handler; wrong host, expired, bad signature, a reader pass
+  (`a1`) and a grant (`g1`) are refused on every handler; a `p1` pass never verifies as a reader
+  pass or grant; a host missing either field refuses a pass and still takes its key. Broken on
+  purpose twice and failed: the host check removed (11 failures), and the comments feed left on
+  the bare key check (its pass case failed).
+
 ## 0.16.0 (2026-09-29)
 
 **A brand pack can draw a page's structure, and one page can wear a pack of its own.** Four new

package/README.md

@@ -28,6 +28,7 @@ Firestore), and optionally `@google-cloud/storage >= 7` for uploaded files.
 | `parseArtifactSource` | The front-matter contract, as a parser you can call before publishing (widget fences included) |
 | `headingsOf`, `scanWidgets`, `placeNotes` | The notes widget's pure parts: heading slugs, fence validation, where each note shows |
 | `mintPass`, `verifyPass` | The reader pass, for the sign-in side (see below) |
+| `mintPublisherPass`, `verifyPublisherPass` | The publisher pass: an hour-long stand-in for the publish key, for one person on one host (see below) |
 | `ARTIFACT_PUBLIC_PREFIXES` (`/gate`) | Paths to leave open if you mount artifacts inside a gated site |
 
 Subpath imports: `@supersuit/artifacts/artifacts`, `/routes`, `/brand`, `/reader`, `/gate`.
@@ -232,6 +233,29 @@ reimplement it. Keep passes short-lived (five minutes is what the tests assume).
 Without `signInOrigin`, a confidential page shows its door with no way through. It fails
 closed, never open.
 
+### The publisher pass (publishing without the shared key)
+
+A shared publish key cannot be handed to one person and taken back from one person. A host can
+also accept a **publisher pass** wherever it accepts the key: a signed, hour-long statement that
+a named person may publish on that host, minted by an authority that knows who may.
+
+```ts
+createArtifactRoutes({
+  // ...
+  publisherSecret: () => process.env.ARTIFACT_PASS_SECRET, // shared with the minting side
+  publisherHost: 'artifacts.example.com',                  // the host a pass must name
+})
+```
+
+Both fields are optional; without either, passes are refused and only the key works. The pass is
+`p1.<payload>.<sig>`: `payload` is the base64url of
+`{"u": uid, "e": email, "n": name|null, "h": host, "x": expiry-unix-seconds}`, and `sig` is the
+first 32 hex characters of `HMAC-SHA256(secret, "artifact-publisher:p1.<payload>")`. It is sent as
+`Authorization: Bearer <pass>`. A pass for another host is refused even under the same secret, and
+a reader pass or grant never verifies as a publisher pass (nor the reverse), because the domain
+and version differ. `mintPublisherPass(secret, { uid, email, name, host }, exp)` builds one;
+`PUBLISHER_PASS_TTL_SECONDS` is 3600.
+
 ## Reader answers (`state:`)
 
 A page can take answers from the people reading it: a vote, a reaction, a short response.
@@ -576,6 +600,7 @@ the page's pack.
 |---|---|
 | your publish key (named by you, read in `publishKey`) | Authorises publish, delete and access changes |
 | `ARTIFACT_PASS_SECRET` (named by you, read in `readerSecret`) | Verifies reader passes and signs grants; shared with your sign-in side |
+| a publisher-pass secret (named by you, read in `publisherSecret`; may be the same one) | Verifies publisher passes; shared with whatever mints them |
 | Firebase Admin credentials | The store and readers store |
 
 ## Contributing

package/lib/artifacts/auth.d.ts

@@ -1 +1,13 @@
+/** The Bearer is exactly this instance's publish key. */
 export declare function isPublishAuthed(request: Request, key: string | undefined): boolean;
+export type PublishAuth = {
+    /** The tenant's shared publish key. Read at request time. */
+    publishKey: () => string | undefined;
+    /** Verifies publisher passes. Absent, or returning nothing, means passes are refused. */
+    publisherSecret?: () => string | undefined;
+    /** The hostname a pass must name (`h`), e.g. artifacts.example.com. Absent means passes are refused. */
+    publisherHost?: string;
+};
+/** Every publish-key route's check: the tenant key, OR a valid publisher pass for this host
+ *  when the host opted in. A host that configures neither pass field behaves exactly as before. */
+export declare function isPublisherAuthed(request: Request, auth: PublishAuth, now?: number): boolean;

package/lib/artifacts/auth.js

@@ -1,8 +1,22 @@
-// One publish key per instance. The site gate lets the artifacts API through precisely
-// because this header is the whole authorization.
+// Who may publish. The site gate lets the artifacts API through precisely because the
+// Authorization header is the whole authorization.
+import { verifyPublisherPass } from './publisher.js';
+/** The Bearer is exactly this instance's publish key. */
 export function isPublishAuthed(request, key) {
     if (!key)
         return false;
     const h = request.headers.get('authorization') ?? '';
     return h === `Bearer ${key}`;
 }
+/** Every publish-key route's check: the tenant key, OR a valid publisher pass for this host
+ *  when the host opted in. A host that configures neither pass field behaves exactly as before. */
+export function isPublisherAuthed(request, auth, now = Date.now()) {
+    if (isPublishAuthed(request, auth.publishKey()))
+        return true;
+    if (!auth.publisherHost || !auth.publisherSecret)
+        return false;
+    const h = request.headers.get('authorization') ?? '';
+    if (!h.startsWith('Bearer '))
+        return false;
+    return verifyPublisherPass(auth.publisherSecret(), h.slice(7).trim(), auth.publisherHost, now) !== null;
+}

package/lib/artifacts/index.d.ts

@@ -2,7 +2,8 @@ export { parseArtifactSource, type ArtifactMeta } from './front-matter.js';
 export { ArtifactMarkdown } from './render.js';
 export { narrationText, narrationTextFromMarkdown, normalizeWord } from './narration.js';
 export { createArtifactStore, newArtifactId, cleanNote, MAX_CHANGE_NOTE_CHARS, type ArtifactStore, type ArtifactRecord, type SaveResult, type SaveInput, type VersionEntry, type VersionRecord } from './store.js';
-export { isPublishAuthed } from './auth.js';
+export { isPublishAuthed, isPublisherAuthed, type PublishAuth } from './auth.js';
+export { mintPublisherPass, verifyPublisherPass, PUBLISHER_PASS_TTL_SECONDS, type Publisher } from './publisher.js';
 export { createArtifactAssets, contentTypeFor, storedName, hashedName, ASSET_NAME, ASSET_DIGEST, type ArtifactAssets } from './assets.js';
 export { isUnlocked, keyHash, unlockCookieName, unlockedUrl } from './unlock.js';
 export { verifyPass, mintPass, verifyGrant, mintGrant, decide, firstName, signInUrl, safeReturnPath, GRANT_COOKIE, ACCESS_LEVELS, type Access, type Reader, type AllowEntry, type Decision } from './reader.js';

package/lib/artifacts/index.js

@@ -2,7 +2,8 @@ export { parseArtifactSource } from './front-matter.js';
 export { ArtifactMarkdown } from './render.js';
 export { narrationText, narrationTextFromMarkdown, normalizeWord } from './narration.js';
 export { createArtifactStore, newArtifactId, cleanNote, MAX_CHANGE_NOTE_CHARS } from './store.js';
-export { isPublishAuthed } from './auth.js';
+export { isPublishAuthed, isPublisherAuthed } from './auth.js';
+export { mintPublisherPass, verifyPublisherPass, PUBLISHER_PASS_TTL_SECONDS } from './publisher.js';
 export { createArtifactAssets, contentTypeFor, storedName, hashedName, ASSET_NAME, ASSET_DIGEST } from './assets.js';
 export { isUnlocked, keyHash, unlockCookieName, unlockedUrl } from './unlock.js';
 export { verifyPass, mintPass, verifyGrant, mintGrant, decide, firstName, signInUrl, safeReturnPath, GRANT_COOKIE, ACCESS_LEVELS } from './reader.js';

package/lib/artifacts/publisher.d.ts

@@ -0,0 +1,15 @@
+export declare const PUBLISHER_DOMAIN = "artifact-publisher";
+export declare const PUBLISHER_VERSION = "p1";
+export declare const PUBLISHER_PASS_TTL_SECONDS = 3600;
+/** Who a publisher pass names, and the one host it is good for. */
+export type Publisher = {
+    uid: string;
+    email: string;
+    name: string | null;
+    host: string;
+};
+export declare function mintPublisherPass(secret: string, p: Publisher, exp: number): string;
+/** The publisher a pass names, if it is correctly signed, unexpired, and for `host` (a hostname
+ *  like `artifacts.example.com`, no scheme). Anything else is null: a pass for another host is
+ *  refused even under the same secret, because two hosts can share one. */
+export declare function verifyPublisherPass(secret: string | undefined, pass: string | null | undefined, host: string | undefined, now?: number): Publisher | null;

package/lib/artifacts/publisher.js

@@ -0,0 +1,48 @@
+// The publisher pass: a short-lived, signed statement that a named person may do what the
+// publish key does, on ONE host.
+//
+// A shared publish key cannot be self-served and cannot be revoked for one person without
+// rotating it for everyone. A host that opts in (routes config `publisherSecret` +
+// `publisherHost`) also accepts this pass as the Bearer: a sign-in authority that knows who the
+// host's admins are mints it for one of them, and it expires within an hour, so revoking the
+// admin stops new passes and an outstanding one dies on its own.
+//
+// THE SHAPE IS A CONTRACT WITH THE AUTHORITY THAT MINTS IT, byte for byte: `p1.<payload>.<sig>`,
+// payload the base64url of `{ u, e, n, h, x }`, sig the first 32 hex of
+// HMAC-SHA256(secret, `artifact-publisher:p1.<payload>`). Same scheme as the reader pass, with its
+// own domain and version, so a reader pass (a1) or grant (g1) never verifies here and a
+// publisher pass never verifies as either (publisher.test.ts pins both directions and the vector).
+import { openToken, signToken } from './reader.js';
+export const PUBLISHER_DOMAIN = 'artifact-publisher';
+export const PUBLISHER_VERSION = 'p1';
+export const PUBLISHER_PASS_TTL_SECONDS = 3600;
+const normHost = (h) => h.trim().toLowerCase();
+export function mintPublisherPass(secret, p, exp) {
+    return signToken(secret, PUBLISHER_DOMAIN, PUBLISHER_VERSION, {
+        u: p.uid,
+        e: p.email.trim().toLowerCase(),
+        n: p.name,
+        h: normHost(p.host),
+        x: exp,
+    });
+}
+/** The publisher a pass names, if it is correctly signed, unexpired, and for `host` (a hostname
+ *  like `artifacts.example.com`, no scheme). Anything else is null: a pass for another host is
+ *  refused even under the same secret, because two hosts can share one. */
+export function verifyPublisherPass(secret, pass, host, now = Date.now()) {
+    if (!host)
+        return null;
+    const d = openToken(secret, PUBLISHER_DOMAIN, PUBLISHER_VERSION, pass, now);
+    if (!d)
+        return null;
+    if (typeof d.u !== 'string' || !d.u || typeof d.e !== 'string' || !d.e.includes('@') || typeof d.h !== 'string')
+        return null;
+    if (normHost(d.h) !== normHost(host))
+        return null;
+    return {
+        uid: d.u,
+        email: d.e.trim().toLowerCase(),
+        name: typeof d.n === 'string' && d.n.trim() ? d.n.trim() : null,
+        host: normHost(d.h),
+    };
+}

package/lib/artifacts/reader.d.ts

@@ -12,6 +12,13 @@ export declare const PASS_TTL_SECONDS = 300;
  *  changes need no wait: the list is read on every request. */
 export declare const GRANT_TTL_SECONDS: number;
 export declare const GRANT_COOKIE = "artifact_reader";
+/** Sign a small JSON payload as `<version>.<b64url(json)>.<sig>` under one domain. The domain is
+ *  in the MAC and the version is the token's first segment, so a token minted for one purpose
+ *  (reader pass, grant, publisher pass) never verifies as another. */
+export declare function signToken(secret: string, domain: string, version: string, data: Record<string, unknown>): string;
+/** The payload of a correctly signed, unexpired token of this domain and version, else null.
+ *  `x` (unix seconds) is required and checked; every other field is the caller's to validate. */
+export declare function openToken(secret: string | undefined, domain: string, version: string, token: string | null | undefined, now: number): Record<string, unknown> | null;
 export declare function mintPass(secret: string, reader: Reader, exp: number): string;
 export declare function verifyPass(secret: string | undefined, pass: string | null | undefined, now?: number): Reader | null;
 export declare function mintGrant(secret: string, reader: Reader, now?: number): string;

package/lib/artifacts/reader.js

@@ -29,13 +29,16 @@ function safeEqual(a, b) {
         return false;
     return timingSafeEqual(Buffer.from(a), Buffer.from(b));
 }
-function encode(secret, domain, version, reader, exp) {
-    // Short keys: this rides in a URL and a cookie.
-    const payload = b64url(JSON.stringify({ u: reader.uid, e: reader.email, n: reader.name, m: reader.member, x: exp }));
-    const body = `${version}.${payload}`;
+/** Sign a small JSON payload as `<version>.<b64url(json)>.<sig>` under one domain. The domain is
+ *  in the MAC and the version is the token's first segment, so a token minted for one purpose
+ *  (reader pass, grant, publisher pass) never verifies as another. */
+export function signToken(secret, domain, version, data) {
+    const body = `${version}.${b64url(JSON.stringify(data))}`;
     return `${body}.${sig(secret, domain, body)}`;
 }
-function decode(secret, domain, version, token, now) {
+/** The payload of a correctly signed, unexpired token of this domain and version, else null.
+ *  `x` (unix seconds) is required and checked; every other field is the caller's to validate. */
+export function openToken(secret, domain, version, token, now) {
     if (!secret || typeof token !== 'string')
         return null;
     const parts = token.split('.');
@@ -51,7 +54,20 @@ function decode(secret, domain, version, token, now) {
     catch {
         return null;
     }
-    if (typeof d.x !== 'number' || d.x * 1000 < now)
+    if (!d || typeof d !== 'object' || Array.isArray(d))
+        return null;
+    const o = d;
+    if (typeof o.x !== 'number' || o.x * 1000 < now)
+        return null;
+    return o;
+}
+function encode(secret, domain, version, reader, exp) {
+    // Short keys: this rides in a URL and a cookie.
+    return signToken(secret, domain, version, { u: reader.uid, e: reader.email, n: reader.name, m: reader.member, x: exp });
+}
+function decode(secret, domain, version, token, now) {
+    const d = openToken(secret, domain, version, token, now);
+    if (!d)
         return null;
     if (typeof d.u !== 'string' || !d.u || typeof d.e !== 'string' || !d.e.includes('@'))
         return null;

package/lib/routes/artifacts.d.ts

@@ -28,6 +28,13 @@ export type ArtifactRoutesConfig = {
     siteUrl: string;
     /** Read at request time, so a rotated key needs no rebuild. */
     publishKey: () => string | undefined;
+    /** Verifies publisher passes (`p1`, see artifacts/publisher.ts): a signed, hour-long stand-in
+     *  for the publish key, minted for one person by an authority that knows who may publish here.
+     *  Read at request time. Without it, or without `publisherHost`, passes are refused. */
+    publisherSecret?: () => string | undefined;
+    /** The hostname a publisher pass must name, e.g. artifacts.example.com. Set it only on a host
+     *  that opts in to passes. */
+    publisherHost?: string;
     /** Share image when an artifact has no cover. Absolute or site-relative. */
     defaultShareImage?: string;
     /** Where a page lives under the origin. '/' on a dedicated host (artifacts.<name>/<id>);

package/lib/routes/artifacts.js

@@ -2,7 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { revalidatePath } from 'next/cache';
 import { notFound, redirect } from 'next/navigation';
 import { NextResponse } from 'next/server';
-import { isPublishAuthed } from '../artifacts/auth.js';
+import { isPublisherAuthed } from '../artifacts/auth.js';
 import { parseArtifactSource } from '../artifacts/front-matter.js';
 import { narrationText } from '../artifacts/narration.js';
 import { ArtifactMarkdown } from '../artifacts/render.js';
@@ -69,8 +69,11 @@ export function createArtifactRoutes(config) {
     // Readers' recordings are played through short-lived signed URLs, issued only beside the comment
     // or note they belong to; a host whose assets cannot sign them shows no play control.
     const audioUrl = config.assets?.audioUrl ? (id, path) => config.assets.audioUrl(id, path) : undefined;
+    const publishAuth = { publishKey: config.publishKey, publisherSecret: config.publisherSecret, publisherHost: config.publisherHost };
+    const authed = (request) => isPublisherAuthed(request, publishAuth);
     const stateRoutes = createStateRoutes({
-        store, state: config.state, readers: config.readers, readerSecret, publishKey: config.publishKey, pageUrl, signInOrigin, siteUrl,
+        store, state: config.state, readers: config.readers, readerSecret, publishKey: config.publishKey,
+        publisherSecret: config.publisherSecret, publisherHost: config.publisherHost, pageUrl, signInOrigin, siteUrl,
         clientIp: config.clientIp, ownerEmail: config.ownerEmail, audioUrl,
     });
     const personalRoutes = createPersonalRoutes({ store, personal: config.personal, readers: config.readers, readerSecret, pageUrl, signInOrigin, siteUrl, audioUrl });
@@ -355,7 +358,7 @@ export function createArtifactRoutes(config) {
     /** GET|POST /api/artifacts/<id>/access, publish key: the page's level and its list.
      *  POST body: { access?: 'freedom'|'invite'|'public', add?: [{ email, name?, reason? }], remove?: [email] }. */
     async function ACCESS(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         if (!config.readers)
             return NextResponse.json({ error: 'this host keeps no reader record' }, { status: 501 });
@@ -390,7 +393,7 @@ export function createArtifactRoutes(config) {
     /** GET /api/artifacts/<id>/reads, publish key: who read it, for how long, how far, and every
      *  attempt to take it away or to open it without being let in. */
     async function READS(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         if (!config.readers)
             return NextResponse.json({ error: 'this host keeps no reader record' }, { status: 501 });
@@ -402,7 +405,7 @@ export function createArtifactRoutes(config) {
         return NextResponse.json({ id, title: a.title, access: a.access ?? null, views: a.views, ...summarize(sessions, flags), acks: acks.map((k) => ({ email: k.email, name: k.name, at: k.at })) }, { headers: { 'cache-control': 'no-store' } });
     }
     async function POST(request) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const text = await request.text();
         const parsed = parseArtifactSource(text);
@@ -447,7 +450,7 @@ export function createArtifactRoutes(config) {
         }, { status: result.created ? 201 : 200 });
     }
     async function GET(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
         const a = await store.get(id);
@@ -457,7 +460,7 @@ export function createArtifactRoutes(config) {
     }
     /** PUT /api/artifacts/<id>/assets/<name>: raw bytes in, public URL out. 16 MiB cap. */
     async function PUT_ASSET(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         if (!config.assets)
             return NextResponse.json({ error: 'this host does not store assets' }, { status: 501 });
@@ -501,7 +504,7 @@ export function createArtifactRoutes(config) {
             const { id, name } = await params;
             return voiceRoutes.readerUpload(request, id, name, body);
         }
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const assets = config.assets;
         if (!assets?.signUpload || !assets.finishUpload)
@@ -542,7 +545,7 @@ export function createArtifactRoutes(config) {
     /** GET|POST /api/artifacts/<id>/versions, publish key: the history, and a note written onto one
      *  version after the fact. POST body: { version: number, note: string | null }. */
     async function VERSIONS(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
         if (!store.history || !store.setNote)
@@ -561,7 +564,7 @@ export function createArtifactRoutes(config) {
         return NextResponse.json({ id, versions: await store.history(id) });
     }
     async function DELETE(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
         const ok = await store.delete(id);

package/lib/routes/state-routes.d.ts

@@ -20,6 +20,9 @@ export type StateRoutesContext = {
     readers?: ReadersStore;
     readerSecret: () => string | undefined;
     publishKey: () => string | undefined;
+    /** Publisher passes, as in ArtifactRoutesConfig. Both absent means passes are refused. */
+    publisherSecret?: () => string | undefined;
+    publisherHost?: string;
     pageUrl: (id: string) => string;
     signInOrigin?: string;
     siteUrl: string;

package/lib/routes/state-routes.js

@@ -11,7 +11,7 @@
 // signed-in reader, once, and the cookie is cleared.
 import { createHmac, randomBytes } from 'node:crypto';
 import { NextResponse } from 'next/server';
-import { isPublishAuthed } from '../artifacts/auth.js';
+import { isPublisherAuthed } from '../artifacts/auth.js';
 import { ARTIFACT_ID_RE } from './ids.js';
 import { GRANT_COOKIE, decide, firstName, signInUrl, verifyGrant } from '../artifacts/reader.js';
 import { isUnlocked, unlockCookieName } from '../artifacts/unlock.js';
@@ -290,7 +290,7 @@ export function createStateRoutes(ctx) {
         return res;
     }
     async function RESPONSES(req, { params }) {
-        if (!isPublishAuthed(req, ctx.publishKey()))
+        if (!isPublisherAuthed(req, ctx))
             return json({ error: 'Unauthorized' }, 401);
         if (!ctx.state)
             return json({ error: 'this host keeps no answers' }, 501);
@@ -316,7 +316,7 @@ export function createStateRoutes(ctx) {
      *  page. It reads the `comments` slot of the state core only; personal notes live in a store no
      *  publisher route reads, so they cannot appear here. The publisher's own notifier polls it. */
     async function COMMENTS_FEED(req) {
-        if (!isPublishAuthed(req, ctx.publishKey()))
+        if (!isPublisherAuthed(req, ctx))
             return json({ error: 'Unauthorized' }, 401);
         const since = feedSince(req.nextUrl.searchParams.get('since'));
         if (!since)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/artifacts",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Publish markdown as branded, read-aloud pages from a Next.js app: the artifacts store, the route factory, the read-along reader, brand packs, password and confidential pages, and share cards.",
   "license": "MIT",
   "type": "module",