@supersuit/artifacts 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -3,6 +3,50 @@
 `@supersuit/artifacts`. One entry per version, newest first. Each entry says what changed, how a
 host can tell whether it is affected (DETECTOR), what a host does about it (REMEDY), and the tests.
 
+## 0.18.0 (2026-09-29)
+
+**No page is ever read by the browser's own voice, and a page can turn its audio off.** 0.10.0
+made a page with no recorded narration read itself with `speechSynthesis`, which on a phone is
+Safari's built-in voice. The operator heard it on a letter going to a partner: *"NEVER PUT
+DEFAULT SAFARI VOICE DICTATION. ALWAYS KOKORO OR IF I WANT TO SPEND MONEY 11LABS."* A page is
+now read by the audio recorded at publish, or it has no player at all.
+
+And *"add ability to disable audio"*: `voice: none` on a republish removes the page's stored
+narration, timings and hash, so the player goes too. Before this, an update merged fields, so a
+recording survived every republish that did not mention it and there was no way to take it off.
+
+- Removed: `BrowserReader`, `planSentences`, `wordAt`, `sentenceOf`, `fromWord`,
+  `MAX_SENTENCE_WORDS` from `./reader`. Nothing in a host should have mounted them directly.
+- DETECTOR: an un-narrated page that shows a player bar, or any `speechSynthesis` in `lib/`.
+- REMEDY: bump. To silence a page, republish it with `voice: none` (a publisher that sends it;
+  Freedom's publish-artifact does from the release after this).
+- Tests: route GUARDs that an un-narrated page, and one whose timings fail, mount no reader; store
+  tests that audio survives a silent republish and `voice: none` clears it; `check-packed` fails if
+  the tarball carries `speechSynthesis` or the fixture page mounts a player. The default-pages
+  golden was regenerated on purpose: the only change is the removed browser-reader element.
+
+## 0.17.0 (2026-09-29)
+
+**A host can accept a signed, hour-long publisher pass wherever it accepts the publish key.** A
+shared key cannot be self-served and cannot be revoked for one person without rotating it for
+everyone. New routes config `publisherSecret` and `publisherHost`: when both are set, every
+publish-key route (publish, read, delete, versions, access, reads, assets, upload, responses, the
+comments feed) also accepts `Authorization: Bearer p1.<payload>.<sig>`, a pass naming one person
+and this host, signed with the reader pass's HMAC scheme under its own domain
+(`artifact-publisher`). New exports `mintPublisherPass`, `verifyPublisherPass`,
+`PUBLISHER_PASS_TTL_SECONDS` (3600), `isPublisherAuthed`. `isPublishAuthed` is unchanged.
+
+- DETECTOR: none needed. A host that sets neither field refuses every pass and takes its key
+  exactly as on 0.16.0.
+- REMEDY: nothing, unless you want admins to publish without the key: set both fields, and have
+  your sign-in side mint passes for the people it vouches for.
+- Tests: the pass vector pinned byte for byte; a valid pass for the right host gets exactly what
+  the key gets on every publish-key handler; wrong host, expired, bad signature, a reader pass
+  (`a1`) and a grant (`g1`) are refused on every handler; a `p1` pass never verifies as a reader
+  pass or grant; a host missing either field refuses a pass and still takes its key. Broken on
+  purpose twice and failed: the host check removed (11 failures), and the comments feed left on
+  the bare key check (its pass case failed).
+
 ## 0.16.0 (2026-09-29)
 
 **A brand pack can draw a page's structure, and one page can wear a pack of its own.** Four new

package/README.md

@@ -28,6 +28,7 @@ Firestore), and optionally `@google-cloud/storage >= 7` for uploaded files.
 | `parseArtifactSource` | The front-matter contract, as a parser you can call before publishing (widget fences included) |
 | `headingsOf`, `scanWidgets`, `placeNotes` | The notes widget's pure parts: heading slugs, fence validation, where each note shows |
 | `mintPass`, `verifyPass` | The reader pass, for the sign-in side (see below) |
+| `mintPublisherPass`, `verifyPublisherPass` | The publisher pass: an hour-long stand-in for the publish key, for one person on one host (see below) |
 | `ARTIFACT_PUBLIC_PREFIXES` (`/gate`) | Paths to leave open if you mount artifacts inside a gated site |
 
 Subpath imports: `@supersuit/artifacts/artifacts`, `/routes`, `/brand`, `/reader`, `/gate`.
@@ -153,7 +154,7 @@ summary: Three bets, what each costs, and what we stop doing to afford them.
 | `audience` | Free text stored with the page, never shown |
 | `id` | Republish in place instead of minting a new page |
 | `cover` | An image URL (absolute or site-relative) used as the unfurl image instead of the share card |
-| `voice`, `narration`, `timings`, `narrationHash` | Read-aloud: the audio and word timings a publisher generated. Absent (or the timings will not load), the page is read by the browser's own voice instead, lighting the same words; a browser with no `speechSynthesis` shows no player |
+| `voice`, `narration`, `timings`, `narrationHash` | Read-aloud: the audio and word timings a publisher generated (Kokoro by default, ElevenLabs on request). Absent, or the timings will not load, the page has no player: it is never read by the browser's own voice. `voice: none` turns audio off and removes any recording the page already had |
 | `password` | Shuts the body behind a door (below) |
 | `access` | `freedom`, `invite` or `public`: a confidential page (below) |
 | `theme` | `light`, `dark` or `system` (follow the reader's device). Overrides the brand pack's mode for this page |
@@ -232,6 +233,29 @@ reimplement it. Keep passes short-lived (five minutes is what the tests assume).
 Without `signInOrigin`, a confidential page shows its door with no way through. It fails
 closed, never open.
 
+### The publisher pass (publishing without the shared key)
+
+A shared publish key cannot be handed to one person and taken back from one person. A host can
+also accept a **publisher pass** wherever it accepts the key: a signed, hour-long statement that
+a named person may publish on that host, minted by an authority that knows who may.
+
+```ts
+createArtifactRoutes({
+  // ...
+  publisherSecret: () => process.env.ARTIFACT_PASS_SECRET, // shared with the minting side
+  publisherHost: 'artifacts.example.com',                  // the host a pass must name
+})
+```
+
+Both fields are optional; without either, passes are refused and only the key works. The pass is
+`p1.<payload>.<sig>`: `payload` is the base64url of
+`{"u": uid, "e": email, "n": name|null, "h": host, "x": expiry-unix-seconds}`, and `sig` is the
+first 32 hex characters of `HMAC-SHA256(secret, "artifact-publisher:p1.<payload>")`. It is sent as
+`Authorization: Bearer <pass>`. A pass for another host is refused even under the same secret, and
+a reader pass or grant never verifies as a publisher pass (nor the reverse), because the domain
+and version differ. `mintPublisherPass(secret, { uid, email, name, host }, exp)` builds one;
+`PUBLISHER_PASS_TTL_SECONDS` is 3600.
+
 ## Reader answers (`state:`)
 
 A page can take answers from the people reading it: a vote, a reaction, a short response.
@@ -576,6 +600,7 @@ the page's pack.
 |---|---|
 | your publish key (named by you, read in `publishKey`) | Authorises publish, delete and access changes |
 | `ARTIFACT_PASS_SECRET` (named by you, read in `readerSecret`) | Verifies reader passes and signs grants; shared with your sign-in side |
+| a publisher-pass secret (named by you, read in `publisherSecret`; may be the same one) | Verifies publisher passes; shared with whatever mints them |
 | Firebase Admin credentials | The store and readers store |
 
 ## Contributing

package/lib/artifacts/auth.d.ts

@@ -1 +1,13 @@
+/** The Bearer is exactly this instance's publish key. */
 export declare function isPublishAuthed(request: Request, key: string | undefined): boolean;
+export type PublishAuth = {
+    /** The tenant's shared publish key. Read at request time. */
+    publishKey: () => string | undefined;
+    /** Verifies publisher passes. Absent, or returning nothing, means passes are refused. */
+    publisherSecret?: () => string | undefined;
+    /** The hostname a pass must name (`h`), e.g. artifacts.example.com. Absent means passes are refused. */
+    publisherHost?: string;
+};
+/** Every publish-key route's check: the tenant key, OR a valid publisher pass for this host
+ *  when the host opted in. A host that configures neither pass field behaves exactly as before. */
+export declare function isPublisherAuthed(request: Request, auth: PublishAuth, now?: number): boolean;

package/lib/artifacts/auth.js

@@ -1,8 +1,22 @@
-// One publish key per instance. The site gate lets the artifacts API through precisely
-// because this header is the whole authorization.
+// Who may publish. The site gate lets the artifacts API through precisely because the
+// Authorization header is the whole authorization.
+import { verifyPublisherPass } from './publisher.js';
+/** The Bearer is exactly this instance's publish key. */
 export function isPublishAuthed(request, key) {
     if (!key)
         return false;
     const h = request.headers.get('authorization') ?? '';
     return h === `Bearer ${key}`;
 }
+/** Every publish-key route's check: the tenant key, OR a valid publisher pass for this host
+ *  when the host opted in. A host that configures neither pass field behaves exactly as before. */
+export function isPublisherAuthed(request, auth, now = Date.now()) {
+    if (isPublishAuthed(request, auth.publishKey()))
+        return true;
+    if (!auth.publisherHost || !auth.publisherSecret)
+        return false;
+    const h = request.headers.get('authorization') ?? '';
+    if (!h.startsWith('Bearer '))
+        return false;
+    return verifyPublisherPass(auth.publisherSecret(), h.slice(7).trim(), auth.publisherHost, now) !== null;
+}

package/lib/artifacts/index.d.ts

@@ -2,7 +2,8 @@ export { parseArtifactSource, type ArtifactMeta } from './front-matter.js';
 export { ArtifactMarkdown } from './render.js';
 export { narrationText, narrationTextFromMarkdown, normalizeWord } from './narration.js';
 export { createArtifactStore, newArtifactId, cleanNote, MAX_CHANGE_NOTE_CHARS, type ArtifactStore, type ArtifactRecord, type SaveResult, type SaveInput, type VersionEntry, type VersionRecord } from './store.js';
-export { isPublishAuthed } from './auth.js';
+export { isPublishAuthed, isPublisherAuthed, type PublishAuth } from './auth.js';
+export { mintPublisherPass, verifyPublisherPass, PUBLISHER_PASS_TTL_SECONDS, type Publisher } from './publisher.js';
 export { createArtifactAssets, contentTypeFor, storedName, hashedName, ASSET_NAME, ASSET_DIGEST, type ArtifactAssets } from './assets.js';
 export { isUnlocked, keyHash, unlockCookieName, unlockedUrl } from './unlock.js';
 export { verifyPass, mintPass, verifyGrant, mintGrant, decide, firstName, signInUrl, safeReturnPath, GRANT_COOKIE, ACCESS_LEVELS, type Access, type Reader, type AllowEntry, type Decision } from './reader.js';

package/lib/artifacts/index.js

@@ -2,7 +2,8 @@ export { parseArtifactSource } from './front-matter.js';
 export { ArtifactMarkdown } from './render.js';
 export { narrationText, narrationTextFromMarkdown, normalizeWord } from './narration.js';
 export { createArtifactStore, newArtifactId, cleanNote, MAX_CHANGE_NOTE_CHARS } from './store.js';
-export { isPublishAuthed } from './auth.js';
+export { isPublishAuthed, isPublisherAuthed } from './auth.js';
+export { mintPublisherPass, verifyPublisherPass, PUBLISHER_PASS_TTL_SECONDS } from './publisher.js';
 export { createArtifactAssets, contentTypeFor, storedName, hashedName, ASSET_NAME, ASSET_DIGEST } from './assets.js';
 export { isUnlocked, keyHash, unlockCookieName, unlockedUrl } from './unlock.js';
 export { verifyPass, mintPass, verifyGrant, mintGrant, decide, firstName, signInUrl, safeReturnPath, GRANT_COOKIE, ACCESS_LEVELS } from './reader.js';

package/lib/artifacts/publisher.d.ts

@@ -0,0 +1,15 @@
+export declare const PUBLISHER_DOMAIN = "artifact-publisher";
+export declare const PUBLISHER_VERSION = "p1";
+export declare const PUBLISHER_PASS_TTL_SECONDS = 3600;
+/** Who a publisher pass names, and the one host it is good for. */
+export type Publisher = {
+    uid: string;
+    email: string;
+    name: string | null;
+    host: string;
+};
+export declare function mintPublisherPass(secret: string, p: Publisher, exp: number): string;
+/** The publisher a pass names, if it is correctly signed, unexpired, and for `host` (a hostname
+ *  like `artifacts.example.com`, no scheme). Anything else is null: a pass for another host is
+ *  refused even under the same secret, because two hosts can share one. */
+export declare function verifyPublisherPass(secret: string | undefined, pass: string | null | undefined, host: string | undefined, now?: number): Publisher | null;

package/lib/artifacts/publisher.js

@@ -0,0 +1,48 @@
+// The publisher pass: a short-lived, signed statement that a named person may do what the
+// publish key does, on ONE host.
+//
+// A shared publish key cannot be self-served and cannot be revoked for one person without
+// rotating it for everyone. A host that opts in (routes config `publisherSecret` +
+// `publisherHost`) also accepts this pass as the Bearer: a sign-in authority that knows who the
+// host's admins are mints it for one of them, and it expires within an hour, so revoking the
+// admin stops new passes and an outstanding one dies on its own.
+//
+// THE SHAPE IS A CONTRACT WITH THE AUTHORITY THAT MINTS IT, byte for byte: `p1.<payload>.<sig>`,
+// payload the base64url of `{ u, e, n, h, x }`, sig the first 32 hex of
+// HMAC-SHA256(secret, `artifact-publisher:p1.<payload>`). Same scheme as the reader pass, with its
+// own domain and version, so a reader pass (a1) or grant (g1) never verifies here and a
+// publisher pass never verifies as either (publisher.test.ts pins both directions and the vector).
+import { openToken, signToken } from './reader.js';
+export const PUBLISHER_DOMAIN = 'artifact-publisher';
+export const PUBLISHER_VERSION = 'p1';
+export const PUBLISHER_PASS_TTL_SECONDS = 3600;
+const normHost = (h) => h.trim().toLowerCase();
+export function mintPublisherPass(secret, p, exp) {
+    return signToken(secret, PUBLISHER_DOMAIN, PUBLISHER_VERSION, {
+        u: p.uid,
+        e: p.email.trim().toLowerCase(),
+        n: p.name,
+        h: normHost(p.host),
+        x: exp,
+    });
+}
+/** The publisher a pass names, if it is correctly signed, unexpired, and for `host` (a hostname
+ *  like `artifacts.example.com`, no scheme). Anything else is null: a pass for another host is
+ *  refused even under the same secret, because two hosts can share one. */
+export function verifyPublisherPass(secret, pass, host, now = Date.now()) {
+    if (!host)
+        return null;
+    const d = openToken(secret, PUBLISHER_DOMAIN, PUBLISHER_VERSION, pass, now);
+    if (!d)
+        return null;
+    if (typeof d.u !== 'string' || !d.u || typeof d.e !== 'string' || !d.e.includes('@') || typeof d.h !== 'string')
+        return null;
+    if (normHost(d.h) !== normHost(host))
+        return null;
+    return {
+        uid: d.u,
+        email: d.e.trim().toLowerCase(),
+        name: typeof d.n === 'string' && d.n.trim() ? d.n.trim() : null,
+        host: normHost(d.h),
+    };
+}

package/lib/artifacts/reader.d.ts

@@ -12,6 +12,13 @@ export declare const PASS_TTL_SECONDS = 300;
  *  changes need no wait: the list is read on every request. */
 export declare const GRANT_TTL_SECONDS: number;
 export declare const GRANT_COOKIE = "artifact_reader";
+/** Sign a small JSON payload as `<version>.<b64url(json)>.<sig>` under one domain. The domain is
+ *  in the MAC and the version is the token's first segment, so a token minted for one purpose
+ *  (reader pass, grant, publisher pass) never verifies as another. */
+export declare function signToken(secret: string, domain: string, version: string, data: Record<string, unknown>): string;
+/** The payload of a correctly signed, unexpired token of this domain and version, else null.
+ *  `x` (unix seconds) is required and checked; every other field is the caller's to validate. */
+export declare function openToken(secret: string | undefined, domain: string, version: string, token: string | null | undefined, now: number): Record<string, unknown> | null;
 export declare function mintPass(secret: string, reader: Reader, exp: number): string;
 export declare function verifyPass(secret: string | undefined, pass: string | null | undefined, now?: number): Reader | null;
 export declare function mintGrant(secret: string, reader: Reader, now?: number): string;

package/lib/artifacts/reader.js

@@ -29,13 +29,16 @@ function safeEqual(a, b) {
         return false;
     return timingSafeEqual(Buffer.from(a), Buffer.from(b));
 }
-function encode(secret, domain, version, reader, exp) {
-    // Short keys: this rides in a URL and a cookie.
-    const payload = b64url(JSON.stringify({ u: reader.uid, e: reader.email, n: reader.name, m: reader.member, x: exp }));
-    const body = `${version}.${payload}`;
+/** Sign a small JSON payload as `<version>.<b64url(json)>.<sig>` under one domain. The domain is
+ *  in the MAC and the version is the token's first segment, so a token minted for one purpose
+ *  (reader pass, grant, publisher pass) never verifies as another. */
+export function signToken(secret, domain, version, data) {
+    const body = `${version}.${b64url(JSON.stringify(data))}`;
     return `${body}.${sig(secret, domain, body)}`;
 }
-function decode(secret, domain, version, token, now) {
+/** The payload of a correctly signed, unexpired token of this domain and version, else null.
+ *  `x` (unix seconds) is required and checked; every other field is the caller's to validate. */
+export function openToken(secret, domain, version, token, now) {
     if (!secret || typeof token !== 'string')
         return null;
     const parts = token.split('.');
@@ -51,7 +54,20 @@ function decode(secret, domain, version, token, now) {
     catch {
         return null;
     }
-    if (typeof d.x !== 'number' || d.x * 1000 < now)
+    if (!d || typeof d !== 'object' || Array.isArray(d))
+        return null;
+    const o = d;
+    if (typeof o.x !== 'number' || o.x * 1000 < now)
+        return null;
+    return o;
+}
+function encode(secret, domain, version, reader, exp) {
+    // Short keys: this rides in a URL and a cookie.
+    return signToken(secret, domain, version, { u: reader.uid, e: reader.email, n: reader.name, m: reader.member, x: exp });
+}
+function decode(secret, domain, version, token, now) {
+    const d = openToken(secret, domain, version, token, now);
+    if (!d)
         return null;
     if (typeof d.u !== 'string' || !d.u || typeof d.e !== 'string' || !d.e.includes('@'))
         return null;

package/lib/artifacts/store.js

@@ -126,7 +126,7 @@ async function saveArtifact(col, input) {
         ...(input.meta.to ? { to: input.meta.to } : {}),
         ...(input.meta.audience ? { audience: input.meta.audience } : {}),
         ...(input.meta.cover ? { cover: input.meta.cover } : {}),
-        ...(input.meta.voice ? { voice: input.meta.voice } : {}),
+        ...(input.meta.voice && input.meta.voice !== 'none' ? { voice: input.meta.voice } : {}),
         ...(input.meta.narration ? { narration: input.meta.narration } : {}),
         ...(input.meta.timings ? { timings: input.meta.timings } : {}),
         ...(input.meta.narrationHash ? { narrationHash: input.meta.narrationHash } : {}),
@@ -190,8 +190,13 @@ async function saveArtifact(col, input) {
             ...(input.meta.comments ? {} : { comments: FieldValue.delete() }),
             ...(input.meta.commentsVisible ? {} : { commentsVisible: FieldValue.delete() }),
         };
+        // `voice: none` is the page declaring it has no audio. An update merges, so the recording it
+        // had would otherwise survive every republish; clear it on purpose, and the player goes with it.
+        const audio = input.meta.voice === 'none'
+            ? { voice: FieldValue.delete(), narration: FieldValue.delete(), timings: FieldValue.delete(), narrationHash: FieldValue.delete() }
+            : {};
         await ref.update({
-            ...fields, ...password, ...subtitle, ...to, ...access, ...state, ...look, markdown: input.markdown, version: next,
+            ...fields, ...password, ...subtitle, ...to, ...access, ...state, ...look, ...audio, markdown: input.markdown, version: next,
             // `updatedAt` is when this version went live; finishing its own publish does not move it.
             ...(fresh || input.markdown !== existing.markdown ? { updatedAt: now } : {}),
             note: nextNote ?? FieldValue.delete(),

package/lib/reader/index.d.ts

@@ -1,7 +1,5 @@
 export { ArtifactReader, wrapWords, seekableWord, litWordIndex, type WordTiming } from './artifact-reader.js';
-export { BrowserReader } from './browser-reader.js';
 export { PlayerBar } from './player-bar.js';
-export { planSentences, wordAt, sentenceOf, fromWord, MAX_SENTENCE_WORDS, type Sentence } from './speech-plan.js';
 export { CommentLayer } from './comment-layer.js';
 export { CommentCard, warningLine, DEVICE_LINE } from './comment-card.js';
 export { deviceNotes, deviceNotesKey, addDeviceNote, replaceDeviceNote, removeDeviceNote } from './device-notes.js';

package/lib/reader/index.js

@@ -1,9 +1,7 @@
-// The `./reader` entry: both readers and the bar they share. Each component module carries its
+// The `./reader` entry: the reader and the bar it uses. Each component module carries its
 // own 'use client'; this barrel is plain re-exports so it can be imported from either side.
 export { ArtifactReader, wrapWords, seekableWord, litWordIndex } from './artifact-reader.js';
-export { BrowserReader } from './browser-reader.js';
 export { PlayerBar } from './player-bar.js';
-export { planSentences, wordAt, sentenceOf, fromWord, MAX_SENTENCE_WORDS } from './speech-plan.js';
 export { CommentLayer } from './comment-layer.js';
 export { CommentCard, warningLine, DEVICE_LINE } from './comment-card.js';
 export { deviceNotes, deviceNotesKey, addDeviceNote, replaceDeviceNote, removeDeviceNote } from './device-notes.js';

package/lib/routes/artifacts.d.ts

@@ -28,6 +28,13 @@ export type ArtifactRoutesConfig = {
     siteUrl: string;
     /** Read at request time, so a rotated key needs no rebuild. */
     publishKey: () => string | undefined;
+    /** Verifies publisher passes (`p1`, see artifacts/publisher.ts): a signed, hour-long stand-in
+     *  for the publish key, minted for one person by an authority that knows who may publish here.
+     *  Read at request time. Without it, or without `publisherHost`, passes are refused. */
+    publisherSecret?: () => string | undefined;
+    /** The hostname a publisher pass must name, e.g. artifacts.example.com. Set it only on a host
+     *  that opts in to passes. */
+    publisherHost?: string;
     /** Share image when an artifact has no cover. Absolute or site-relative. */
     defaultShareImage?: string;
     /** Where a page lives under the origin. '/' on a dedicated host (artifacts.<name>/<id>);

package/lib/routes/artifacts.js

@@ -2,7 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { revalidatePath } from 'next/cache';
 import { notFound, redirect } from 'next/navigation';
 import { NextResponse } from 'next/server';
-import { isPublishAuthed } from '../artifacts/auth.js';
+import { isPublisherAuthed } from '../artifacts/auth.js';
 import { parseArtifactSource } from '../artifacts/front-matter.js';
 import { narrationText } from '../artifacts/narration.js';
 import { ArtifactMarkdown } from '../artifacts/render.js';
@@ -17,7 +17,6 @@ import { themedPack } from '../brand/theme.js';
 import { showToc, tocOf, TocInline, TocRail } from '../artifacts/toc.js';
 import { renderShareCard } from '../brand/share-card.js';
 import { ArtifactReader } from '../reader/artifact-reader.js';
-import { BrowserReader } from '../reader/browser-reader.js';
 import { CommentLayer } from '../reader/comment-layer.js';
 import { ReaderWatch } from '../reader/reader-watch.js';
 import { UpdatedTime } from '../reader/updated-time.js';
@@ -69,8 +68,11 @@ export function createArtifactRoutes(config) {
     // Readers' recordings are played through short-lived signed URLs, issued only beside the comment
     // or note they belong to; a host whose assets cannot sign them shows no play control.
     const audioUrl = config.assets?.audioUrl ? (id, path) => config.assets.audioUrl(id, path) : undefined;
+    const publishAuth = { publishKey: config.publishKey, publisherSecret: config.publisherSecret, publisherHost: config.publisherHost };
+    const authed = (request) => isPublisherAuthed(request, publishAuth);
     const stateRoutes = createStateRoutes({
-        store, state: config.state, readers: config.readers, readerSecret, publishKey: config.publishKey, pageUrl, signInOrigin, siteUrl,
+        store, state: config.state, readers: config.readers, readerSecret, publishKey: config.publishKey,
+        publisherSecret: config.publisherSecret, publisherHost: config.publisherHost, pageUrl, signInOrigin, siteUrl,
         clientIp: config.clientIp, ownerEmail: config.ownerEmail, audioUrl,
     });
     const personalRoutes = createPersonalRoutes({ store, personal: config.personal, readers: config.readers, readerSecret, pageUrl, signInOrigin, siteUrl, audioUrl });
@@ -259,9 +261,9 @@ export function createArtifactRoutes(config) {
                         const meta = (_jsxs(_Fragment, { children: [_jsx(VersionLine, { a: a, n: n, at: a.updatedAt, history: await historyOf(a.id) }), top && reader ? (_jsxs("p", { "data-nospeak": true, "data-reader-line": true, className: "mt-2 text-xs opacity-60", children: [`Signed in as ${reader.email} · `, _jsx("a", { href: switchUrl(a.id), className: "underline", children: "Use a different account" }), ' · ', _jsx("a", { href: signOutUrl(a.id), className: "underline", children: "Sign out" })] })) : null] }));
                         const header = pack.Cover ? (_jsx(pack.Cover, { title: a.title, subtitle: a.subtitle, summary: a.summary, to: a.to, markdown: a.markdown, kicker: _jsx(Kicker, { to: a.to, brand: brand }), meta: meta, version: n, updatedAt: a.updatedAt, createdAt: a.createdAt })) : (_jsxs("div", { className: `mx-auto max-w-2xl px-6 ${top ? 'pt-24 sm:pt-28' : 'pt-12'} pb-8 text-center`, children: [_jsx(Kicker, { to: a.to, brand: brand }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary }), meta] }));
                         return (_jsx(Framed, { pack: pack, toc: toc.length ? _jsx(TocInline, { items: toc }) : null, cover: _jsxs(_Fragment, { children: [header, a.cover ? (_jsx("div", { className: "mx-auto max-w-2xl px-6 pb-8", children: _jsx("img", { src: a.cover, alt: "", className: "w-full rounded-xl border border-[color:var(--a-line)]" }) })) : null] }), children: _jsx(ArtifactMarkdown, { markdown: a.markdown, definitions: a.definitions, notes: config.state && a.state ? { artifactId: a.id, accent: brand.accent } : undefined, Section: pack.Section, figure: pack.figure }) }));
-                    })() }), _jsx(CommentLayer, { artifactId: a.id, rootId: "artifact-narration-root", ownerName: owner, comments: mode, canShare: mode !== 'off' && (reader !== null || effectiveWriters(a.state, a.access, COMMENTS_SLOT) === 'anyone'), signedIn: reader !== null, isOwner: !!reader && !!ownerEmail && reader.email === ownerEmail, version: a.version ?? (a.versions?.length ?? 0) + 1, accent: brand.accent, ground: brand.ground, signIn: signInOrigin ? signInUrl(signInOrigin, pageUrl(a.id)) : null }), a.narration && words.length > 0 ? (_jsx(ArtifactReader, { src: a.narration, words: words, rootId: "artifact-narration-root", label: brand.narratorLabel(a.voice), accent: brand.accent, ground: brand.ground })) : (
-                // No recorded narration, or its timings would not load: the browser reads the page.
-                _jsx(BrowserReader, { rootId: "artifact-narration-root", accent: brand.accent, ground: brand.ground }))] }));
+                    })() }), _jsx(CommentLayer, { artifactId: a.id, rootId: "artifact-narration-root", ownerName: owner, comments: mode, canShare: mode !== 'off' && (reader !== null || effectiveWriters(a.state, a.access, COMMENTS_SLOT) === 'anyone'), signedIn: reader !== null, isOwner: !!reader && !!ownerEmail && reader.email === ownerEmail, version: a.version ?? (a.versions?.length ?? 0) + 1, accent: brand.accent, ground: brand.ground, signIn: signInOrigin ? signInUrl(signInOrigin, pageUrl(a.id)) : null }), a.narration && words.length > 0 ? (_jsx(ArtifactReader, { src: a.narration, words: words, rootId: "artifact-narration-root", label: brand.narratorLabel(a.voice), accent: brand.accent, ground: brand.ground })) : null /* No recorded narration: no player. Never the browser's own voice (the operator,
+                  2026-09-29: "NEVER PUT DEFAULT SAFARI VOICE DICTATION"); the audio is Kokoro or ElevenLabs,
+                  recorded at publish, or there is none. */] }));
     }
     const cookieLine = (value, maxAge) => `${GRANT_COOKIE}=${value}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
     /** GET /api/reader/enter?pass=<pass>&to=/<id>: where the sign-in authority sends a signed-in
@@ -355,7 +357,7 @@ export function createArtifactRoutes(config) {
     /** GET|POST /api/artifacts/<id>/access, publish key: the page's level and its list.
      *  POST body: { access?: 'freedom'|'invite'|'public', add?: [{ email, name?, reason? }], remove?: [email] }. */
     async function ACCESS(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         if (!config.readers)
             return NextResponse.json({ error: 'this host keeps no reader record' }, { status: 501 });
@@ -390,7 +392,7 @@ export function createArtifactRoutes(config) {
     /** GET /api/artifacts/<id>/reads, publish key: who read it, for how long, how far, and every
      *  attempt to take it away or to open it without being let in. */
     async function READS(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         if (!config.readers)
             return NextResponse.json({ error: 'this host keeps no reader record' }, { status: 501 });
@@ -402,7 +404,7 @@ export function createArtifactRoutes(config) {
         return NextResponse.json({ id, title: a.title, access: a.access ?? null, views: a.views, ...summarize(sessions, flags), acks: acks.map((k) => ({ email: k.email, name: k.name, at: k.at })) }, { headers: { 'cache-control': 'no-store' } });
     }
     async function POST(request) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const text = await request.text();
         const parsed = parseArtifactSource(text);
@@ -447,7 +449,7 @@ export function createArtifactRoutes(config) {
         }, { status: result.created ? 201 : 200 });
     }
     async function GET(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
         const a = await store.get(id);
@@ -457,7 +459,7 @@ export function createArtifactRoutes(config) {
     }
     /** PUT /api/artifacts/<id>/assets/<name>: raw bytes in, public URL out. 16 MiB cap. */
     async function PUT_ASSET(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         if (!config.assets)
             return NextResponse.json({ error: 'this host does not store assets' }, { status: 501 });
@@ -501,7 +503,7 @@ export function createArtifactRoutes(config) {
             const { id, name } = await params;
             return voiceRoutes.readerUpload(request, id, name, body);
         }
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const assets = config.assets;
         if (!assets?.signUpload || !assets.finishUpload)
@@ -542,7 +544,7 @@ export function createArtifactRoutes(config) {
     /** GET|POST /api/artifacts/<id>/versions, publish key: the history, and a note written onto one
      *  version after the fact. POST body: { version: number, note: string | null }. */
     async function VERSIONS(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
         if (!store.history || !store.setNote)
@@ -561,7 +563,7 @@ export function createArtifactRoutes(config) {
         return NextResponse.json({ id, versions: await store.history(id) });
     }
     async function DELETE(request, { params }) {
-        if (!isPublishAuthed(request, config.publishKey()))
+        if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
         const ok = await store.delete(id);

package/lib/routes/state-routes.d.ts

@@ -20,6 +20,9 @@ export type StateRoutesContext = {
     readers?: ReadersStore;
     readerSecret: () => string | undefined;
     publishKey: () => string | undefined;
+    /** Publisher passes, as in ArtifactRoutesConfig. Both absent means passes are refused. */
+    publisherSecret?: () => string | undefined;
+    publisherHost?: string;
     pageUrl: (id: string) => string;
     signInOrigin?: string;
     siteUrl: string;

package/lib/routes/state-routes.js

@@ -11,7 +11,7 @@
 // signed-in reader, once, and the cookie is cleared.
 import { createHmac, randomBytes } from 'node:crypto';
 import { NextResponse } from 'next/server';
-import { isPublishAuthed } from '../artifacts/auth.js';
+import { isPublisherAuthed } from '../artifacts/auth.js';
 import { ARTIFACT_ID_RE } from './ids.js';
 import { GRANT_COOKIE, decide, firstName, signInUrl, verifyGrant } from '../artifacts/reader.js';
 import { isUnlocked, unlockCookieName } from '../artifacts/unlock.js';
@@ -290,7 +290,7 @@ export function createStateRoutes(ctx) {
         return res;
     }
     async function RESPONSES(req, { params }) {
-        if (!isPublishAuthed(req, ctx.publishKey()))
+        if (!isPublisherAuthed(req, ctx))
             return json({ error: 'Unauthorized' }, 401);
         if (!ctx.state)
             return json({ error: 'this host keeps no answers' }, 501);
@@ -316,7 +316,7 @@ export function createStateRoutes(ctx) {
      *  page. It reads the `comments` slot of the state core only; personal notes live in a store no
      *  publisher route reads, so they cannot appear here. The publisher's own notifier polls it. */
     async function COMMENTS_FEED(req) {
-        if (!isPublishAuthed(req, ctx.publishKey()))
+        if (!isPublisherAuthed(req, ctx))
             return json({ error: 'Unauthorized' }, 401);
         const since = feedSince(req.nextUrl.searchParams.get('since'));
         if (!since)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/artifacts",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Publish markdown as branded, read-aloud pages from a Next.js app: the artifacts store, the route factory, the read-along reader, brand packs, password and confidential pages, and share cards.",
   "license": "MIT",
   "type": "module",

package/lib/reader/browser-reader.d.ts

@@ -1,8 +0,0 @@
-export declare const BROWSER_READER_LABEL = "Read aloud by your browser";
-export declare function BrowserReader({ rootId, label, accent, ground, }: {
-    rootId: string;
-    /** The line under the play button. */
-    label?: string;
-    accent: string;
-    ground: string;
-}): import("react").JSX.Element;

package/lib/reader/browser-reader.js

@@ -1,171 +0,0 @@
-'use client';
-import { jsx as _jsx } from "react/jsx-runtime";
-// Read-along for a page with no recorded narration: the browser's own voice (speechSynthesis)
-// reads the same word spans the recorded reader lights, and its word-boundary events light them.
-// It sounds worse than a recorded narrator and sends nothing anywhere.
-//
-// One utterance per sentence (see speech-plan.ts). Safari's boundary charIndex drifts on long
-// passages; every new utterance restarts it at zero against offsets we know, so a drift cannot
-// outlast the sentence it began in. Every utterance carries the generation it was spoken in, and
-// an event from an older generation (a sentence cancelled by a click, a seek or a speed change,
-// whose end or error the engine still reports) is ignored.
-//
-// The mount is rendered hidden and empty on the server and on the first client render, so the
-// markup always hydrates; it shows only once the browser is known to have speechSynthesis. It
-// never carries data-artifact-player while hidden, because the popovers measure that element to
-// keep clear of the bar, and a hidden element measures as the whole screen.
-import { useEffect, useRef, useState } from 'react';
-import { BLOCK, seekableWord, wrapWords } from './artifact-reader.js';
-import { nextRate, PlayerBar } from './player-bar.js';
-import { fromWord, planSentences, wordAt } from './speech-plan.js';
-export const BROWSER_READER_LABEL = 'Read aloud by your browser';
-function spokenWords(spans) {
-    const words = [];
-    const starts = new Set();
-    let prevBlock = null;
-    spans.forEach((span, i) => {
-        // Punctuation glued on across an element edge ("**bold**.") is a tail, not a word; it is
-        // spoken with the word it follows, which is also what lets it end a sentence.
-        const tail = span.nextSibling instanceof HTMLElement && span.nextSibling.classList.contains('artifact-word-tail') ? span.nextSibling.textContent ?? '' : '';
-        words.push((span.textContent ?? '') + tail);
-        const block = span.closest(BLOCK);
-        if (i > 0 && block !== prevBlock)
-            starts.add(i);
-        prevBlock = block;
-    });
-    return { words, starts };
-}
-export function BrowserReader({ rootId, label = BROWSER_READER_LABEL, accent, ground, }) {
-    const [ready, setReady] = useState(false);
-    const [playing, setPlaying] = useState(false);
-    const [current, setCurrent] = useState(-1);
-    const [count, setCount] = useState(0);
-    const [rate, setRate] = useState(1);
-    const spansRef = useRef([]);
-    const planRef = useRef([]);
-    const genRef = useRef(0);
-    const rateRef = useRef(1);
-    const currentRef = useRef(-1);
-    const playingRef = useRef(false);
-    // True from the first play until the page is finished: pause and resume act on a live queue.
-    const startedRef = useRef(false);
-    const litRef = useRef(null);
-    const setPlay = (p) => {
-        playingRef.current = p;
-        setPlaying(p);
-    };
-    const light = (i) => {
-        const el = i >= 0 ? spansRef.current[i] ?? null : null;
-        if (el !== litRef.current) {
-            litRef.current?.classList.remove('artifact-word-lit');
-            el?.classList.add('artifact-word-lit');
-            litRef.current = el;
-            if (el && playingRef.current) {
-                const r = el.getBoundingClientRect();
-                if (r.top < 80 || r.bottom > window.innerHeight - 140)
-                    el.scrollIntoView?.({ block: 'center', behavior: 'smooth' });
-            }
-        }
-        currentRef.current = i;
-        setCurrent(i);
-    };
-    const finish = () => {
-        startedRef.current = false;
-        setPlay(false);
-        light(-1);
-    };
-    const speak = (s, gen) => {
-        const synth = window.speechSynthesis;
-        const u = new SpeechSynthesisUtterance(s.text);
-        u.rate = rateRef.current;
-        u.onboundary = (e) => {
-            if (gen !== genRef.current || e.name !== 'word')
-                return;
-            light(wordAt(s, e.charIndex));
-        };
-        u.onend = () => {
-            if (gen !== genRef.current)
-                return;
-            const next = s.first + s.offsets.length;
-            if (next < spansRef.current.length)
-                speak(fromWord(planRef.current, next), gen);
-            else
-                finish();
-        };
-        u.onerror = () => {
-            if (gen === genRef.current)
-                finish();
-        };
-        // Light the sentence's first word now: some engines send no boundary events at all, and the
-        // page should still show where it is.
-        light(s.first);
-        synth.speak(u);
-    };
-    /** Cancel whatever is speaking and read from word `i` on. */
-    const speakFrom = (i) => {
-        if (!planRef.current.length)
-            return;
-        const synth = window.speechSynthesis;
-        const gen = ++genRef.current;
-        synth.cancel();
-        // An engine paused before the cancel stays paused for the next utterance in some browsers.
-        synth.resume();
-        startedRef.current = true;
-        setPlay(true);
-        speak(fromWord(planRef.current, Math.max(0, Math.min(i, spansRef.current.length - 1))), gen);
-    };
-    const speakFromRef = useRef(speakFrom);
-    speakFromRef.current = speakFrom;
-    useEffect(() => {
-        if (typeof window === 'undefined' || !('speechSynthesis' in window))
-            return;
-        const root = document.getElementById(rootId);
-        if (!root)
-            return;
-        const spans = wrapWords(root);
-        if (!spans.length)
-            return;
-        const { words, starts } = spokenWords(spans);
-        spansRef.current = spans;
-        planRef.current = planSentences(words, starts);
-        setCount(spans.length);
-        setReady(true);
-        const onClick = (e) => {
-            const el = seekableWord(e.target);
-            if (!el)
-                return;
-            const idx = spansRef.current.indexOf(el);
-            if (idx !== -1)
-                speakFromRef.current(idx);
-        };
-        root.addEventListener('click', onClick);
-        return () => {
-            root.removeEventListener('click', onClick);
-            genRef.current++;
-            window.speechSynthesis.cancel();
-        };
-    }, [rootId]);
-    const toggle = () => {
-        const synth = window.speechSynthesis;
-        if (!startedRef.current)
-            speakFrom(0);
-        else if (playingRef.current) {
-            synth.pause();
-            setPlay(false);
-        }
-        else {
-            synth.resume();
-            setPlay(true);
-        }
-    };
-    if (!ready)
-        return _jsx("div", { "data-artifact-reader": "browser", hidden: true });
-    return (_jsx("div", { "data-artifact-reader": "browser", children: _jsx(PlayerBar, { playing: playing, onToggle: toggle, label: label, accent: accent, ground: ground, value: Math.max(current, 0), max: Math.max(count - 1, 0), step: 1, onSeek: (v) => speakFrom(v), progress: `${current + 1} / ${count}`, rate: rate, onRate: () => {
-                const r = nextRate(rateRef.current);
-                rateRef.current = r;
-                setRate(r);
-                // The engine fixes the rate when an utterance starts, so restart at the current word.
-                if (startedRef.current && playingRef.current)
-                    speakFrom(Math.max(currentRef.current, 0));
-            } }) }));
-}

package/lib/reader/speech-plan.d.ts

@@ -1,20 +0,0 @@
-export type Sentence = {
-    /** The words joined by single spaces: exactly what is handed to the speech engine. */
-    text: string;
-    /** Index of the sentence's first word in the page's word list. */
-    first: number;
-    /** offsets[i] is the char offset, inside `text`, of word `first + i`. */
-    offsets: number[];
-};
-export declare const MAX_SENTENCE_WORDS = 60;
-/** Split a page's words into sentences. `starts` holds word indexes that begin a new block
- *  (a heading, a paragraph, a list item), which always begin a new sentence. */
-export declare function planSentences(words: string[], starts?: ReadonlySet<number>): Sentence[];
-/** The absolute word index a boundary event's `charIndex` falls in: the last word whose offset
- *  is at or before it. */
-export declare function wordAt(s: Sentence, charIndex: number): number;
-/** The index of the sentence holding `wordIndex`. */
-export declare function sentenceOf(plan: Sentence[], wordIndex: number): number;
-/** The sentence holding `wordIndex`, cut so it starts AT that word, with offsets rebased to the
- *  cut text. What is spoken when a reader clicks a word in the middle of a sentence. */
-export declare function fromWord(plan: Sentence[], wordIndex: number): Sentence;

package/lib/reader/speech-plan.js

@@ -1,67 +0,0 @@
-// How the browser read-aloud splits a page into utterances, and maps a speech engine's
-// word-boundary events back to the page's word spans. Pure, so it is tested without a browser.
-//
-// One utterance per sentence is the drift bound: Safari's boundary charIndex wanders on long
-// passages, and every new utterance restarts it at zero against a sentence whose word offsets
-// are known. The cap keeps a page with no punctuation (a list, a table) from becoming one long
-// utterance, which is also where Chrome is known to stop speaking part-way.
-export const MAX_SENTENCE_WORDS = 60;
-// A word ends a sentence when it ends in . ! ? or :, optionally followed by closing quotes or
-// brackets. "10:30" and "example.com" do not, because the punctuation is not at the end.
-const ENDS_SENTENCE = /[.!?:]["'”’)\]]*$/;
-/** Split a page's words into sentences. `starts` holds word indexes that begin a new block
- *  (a heading, a paragraph, a list item), which always begin a new sentence. */
-export function planSentences(words, starts) {
-    const plan = [];
-    let cur = null;
-    for (let i = 0; i < words.length; i++) {
-        if (cur && (cur.offsets.length >= MAX_SENTENCE_WORDS || starts?.has(i))) {
-            plan.push(cur);
-            cur = null;
-        }
-        if (!cur)
-            cur = { text: '', first: i, offsets: [] };
-        if (cur.offsets.length)
-            cur.text += ' ';
-        cur.offsets.push(cur.text.length);
-        cur.text += words[i];
-        if (ENDS_SENTENCE.test(words[i])) {
-            plan.push(cur);
-            cur = null;
-        }
-    }
-    if (cur)
-        plan.push(cur);
-    return plan;
-}
-/** The absolute word index a boundary event's `charIndex` falls in: the last word whose offset
- *  is at or before it. */
-export function wordAt(s, charIndex) {
-    let i = 0;
-    for (let k = 0; k < s.offsets.length; k++) {
-        if (s.offsets[k] <= charIndex)
-            i = k;
-        else
-            break;
-    }
-    return s.first + i;
-}
-/** The index of the sentence holding `wordIndex`. */
-export function sentenceOf(plan, wordIndex) {
-    let idx = 0;
-    for (let k = 0; k < plan.length; k++) {
-        if (plan[k].first <= wordIndex)
-            idx = k;
-        else
-            break;
-    }
-    return idx;
-}
-/** The sentence holding `wordIndex`, cut so it starts AT that word, with offsets rebased to the
- *  cut text. What is spoken when a reader clicks a word in the middle of a sentence. */
-export function fromWord(plan, wordIndex) {
-    const s = plan[sentenceOf(plan, wordIndex)];
-    const k = Math.max(0, Math.min(wordIndex - s.first, s.offsets.length - 1));
-    const base = s.offsets[k];
-    return { text: s.text.slice(base), first: s.first + k, offsets: s.offsets.slice(k).map((o) => o - base) };
-}