@supersuit/artifacts 0.30.2 → 0.31.0

package/CHANGELOG.md

@@ -3,6 +3,48 @@
 `@supersuit/artifacts`. One entry per version, newest first. Each entry says what changed, how a
 host can tell whether it is affected (DETECTOR), what a host does about it (REMEDY), and the tests.
 
+## 0.31.0
+
+**The owner and admins change a page's share and comment settings from the page menu, and a later
+publish of the same file no longer undoes it.** Release 2 of the page menu design. Until now these
+settings changed only by editing front matter and republishing, so an admin on a phone could see a
+page's settings (on hosts that drew their own panel) but not change them.
+
+- Two items for the owner and the hub's admins: **Share settings** (who can open it: anyone with the
+  link, any Freedom account, only the list; the list, add or remove an email; a password on or off,
+  with the link carrying the key and a Copy button; read-only lines on what a stranger and search
+  engines see) and **Comment settings** (who can comment: anyone, signed-in readers, nobody; who
+  reads them: the owner and admins, or every reader). Each opens a sheet on a phone, a panel on a
+  desk. A save reloads the page and reopens the sheet saying "Saved".
+- `GET|POST /api/artifacts/<id>/settings` (`SETTINGS`): the reader grant naming `ownerEmail` or
+  one of `admins`, nobody else (401 signed out, 403 otherwise, before the page is looked up; the
+  publish key is not accepted). A POST must be same-origin JSON. Validated; unknown fields refused.
+- `ArtifactStore.setSettings(id, patch)`, implemented by `createArtifactStore`: access, password,
+  comments and their visibility in place, the comments slot added to or removed from `state`, no
+  new version.
+- **Settings changed on the page win.** Each publish records what the file said about `access:`,
+  `password:` (as a hash), `comments:` and `comments_visible:` (`declared`); the next publish
+  changes a setting only when the file's line differs from that. Access already ignored a file that
+  named none; this extends the idea to a line the file still carries, and to the password and
+  comments. `settleOnPublish` and `applySettingsPatch` are exported.
+- `shareFacts` (route config): a host's own read-only rows for the Share settings sheet, replacing
+  the package's two.
+- DETECTOR: signed in as an admin, open the page menu. No "Share settings" item means an older
+  version, or a store without `setSettings`. A host route file is needed at
+  `app/api/artifacts/[id]/settings/route.ts`; without it a save answers 404.
+- REMEDY: update the dependency and add the route file (`GET` and `POST` delegating to `SETTINGS`).
+  A host that drew its own share-settings panel on the page can remove it and pass its facts
+  through `shareFacts`. Pages published before 0.31.0 behave as before until their next publish.
+- Tests: `artifacts/settings.test.ts` (the page-wins rule, every setting, legacy records),
+  `artifacts/store.test.ts` (setSettings round trips; a republish of the same file keeps the page's
+  change; a changed line wins), `routes/settings.test.tsx` (visitor, reader, owner, admin; CSRF;
+  validation; each setting round-trips; the list and key handed to nobody else; menu items by role;
+  `shareFacts`), `reader/settings-sheet.test.tsx` (sheets show current values, a save posts only
+  what moved, the list, reopen after reload), and `check-packed` (the tarball's endpoint, items and a
+  password set from the menu shutting the page). Driven in headless Chrome at 390x844 and 1280x800
+  against the packed fixture: open the menu, Share settings, change access, save, reopen, ⋯ still
+  reachable.
+
 ## 0.30.2
 
 **Play from here is kept inside the screen on a host that insets the page.** 0.30.1 clamped the

package/README.md

@@ -76,6 +76,7 @@ The rest, each exporting the named handler(s) from `artifacts`:
 | `app/api/artifacts/[id]/route.ts` | `GET`, `DELETE` |
 | `app/api/artifacts/[id]/assets/[name]/route.ts` | `PUT` = `PUT_ASSET` |
 | `app/api/artifacts/[id]/access/route.ts` | `GET`, `POST` = `ACCESS` |
+| `app/api/artifacts/[id]/settings/route.ts` | `GET`, `POST` = `SETTINGS` (see [Share settings and Comment settings](#share-settings-and-comment-settings)) |
 | `app/api/artifacts/[id]/reads/route.ts` | `GET` = `READS` |
 | `app/api/artifacts/[id]/versions/route.ts` | `GET`, `POST` = `VERSIONS` |
 | `app/api/reader/enter/route.ts` | `GET` = `ENTER` |
@@ -130,7 +131,7 @@ cannot use is absent, never greyed out.**
 | Visitor (signed out) | Not signed in | Share, Show / Hide comments, Sign in |
 | Reader (signed in) | Signed in as Dana | Share, Show / Hide comments, Sign out |
 | Shut out (at a gated page's door) | Signed in as Dana · not on this page's list | Share, Sign out |
-| Owner (`ownerEmail`) | Signed in as Robin · owner of this page | Share, Show / Hide comments, Version history, Copy the markdown, Sign out |
+| Owner (`ownerEmail`) | Signed in as Robin · owner of this page | Share, Show / Hide comments, Share settings, Comment settings, Version history, Copy the markdown, Sign out |
 | Admin (`admins`) | Signed in as Casey · admin of this hub | the owner's items |
 
 - **Share** opens the phone's own share sheet where there is one, and otherwise copies the link and
@@ -150,6 +151,46 @@ The server decides every item and hands the browser only what this reader may us
 source, a share link carrying a password, and the version list are never in a page rendered for
 anyone else. `PageMenu`, `roleLine` and `menuItems` are exported from `/reader`.
 
+### Share settings and Comment settings
+
+The owner and the hub's admins change a page's settings from the menu, with no republish. Each item
+opens a sheet (from the bottom on a phone, under the button on a desk):
+
+- **Share settings.** Who can open it: anyone with the link, any Freedom account (plus the list),
+  or only the list. The list itself: add or remove an email. On a page open to anyone, a password
+  on or off (on makes a 12-character key). The link to send, with a Copy button: on a password page
+  it carries the key. Under them, read-only lines: what a stranger with the bare URL sees and what
+  search engines are told. A host that knows more (its robots.txt, who its sign-in admits) passes
+  `shareFacts: (artifact) => [{ label, text }]`, whose rows replace those two.
+- **Comment settings.** Who can comment (anyone, signed-in readers, nobody) and who can read the
+  comments (the owner and admins, or every reader). A gated page takes comments only from
+  signed-in readers it is open to, whatever is chosen; the sheet says so.
+
+A save that changes how the page renders reloads it and reopens the sheet saying "Saved"; adding or
+removing someone on the list changes nothing on the page and does not.
+
+The sheets need a store with `setSettings` (`createArtifactStore` has it). The gated levels and the
+list need `readers`; Comment settings need `state`. Without them those parts are absent.
+
+Both talk to `GET|POST /api/artifacts/<id>/settings` (`SETTINGS`):
+
+- **Who:** a reader whose grant names `ownerEmail` or one of `admins`. Signed out is 401, anyone
+  else 403, before the page is looked up. The publish key is not accepted here.
+- **CSRF:** a POST is refused (403) when its `Origin` is another site or `Sec-Fetch-Site` is not
+  `same-origin`, and (415) unless it is `application/json`, which a cross-site form cannot send.
+- **Body**, every field optional: `{ "access": "public"|"freedom"|"invite", "password": "on"|"off",
+  "comments": "off"|"anyone"|"signed-in", "commentsVisible": "owner"|"readers", "add": [{ "email",
+  "name"? }], "remove": ["email"] }`. Unknown fields and bad values are 400 and change nothing.
+- **Answer:** the settings as the sheets show them.
+
+**Settings changed on the page win.** The record keeps what the file said about `access:`,
+`password:`, `comments:` and `comments_visible:` at its last publish (`declared`). A republish
+changes one of them only when the file's line differs from what it said the time before: republish
+the same file and an admin's change stands; edit the line and the file wins. Dropping a line counts
+as a change for the password and comments (as before, it takes the password off and comments back to
+off), and never for `access:`, which a file that names none leaves alone. A page last published
+before 0.31.0 has no `declared` and takes its file on its next publish, as every publish did.
+
 ## Version history
 
 Every page names its version under the summary, "Version 4 · Updated <minute>", and the page
@@ -240,7 +281,9 @@ on a defined word opens its definition instead of seeking.
 `password: <string>` shuts the body behind a door. The title, summary and unfurl stay, so the
 link still reads as itself in a thread. It opens on `?key=<password>` in the URL, or on the
 cookie that first open sets, which holds a hash bound to the page id: it names no password and
-opens no other page. Republishing without the line takes the door down.
+opens no other page. Republishing without the line takes the door down. The owner and admins can
+also turn it on or off from the page menu (Share settings); a republish of the same file leaves
+their change alone.
 
 ## A confidential page (`access:`)
 

package/lib/artifacts/index.d.ts

@@ -20,3 +20,5 @@ export { COMMENTS_SLOT, COMMENTS_MODES, COMMENT_TRANSCRIPTS, MAX_COMMENT_CHARS,
 export { createPersonalStore, createMemoryPersonalStore, validatePersonal, personalAudioDir, MAX_PERSONAL_PER_READER, type PersonalStore, type PersonalNote, type PersonalNoteValue } from './personal-store.js';
 export { deepgramTranscriber, openaiTranscriber, type Transcriber } from './transcribe.js';
 export { AUDIO_TYPES, audioExtFor, audioTypeFor, baseMime, MAX_AUDIO_BYTES, MAX_MEMO_MS, MEMO_NAME, commentAudioPath, isCommentAudioPath, personalAudioPath, isPersonalAudioPath } from './audio.js';
+export { settleOnPublish, applySettingsPatch, withComments, declaredOf, passwordDigest, newPageKey, type DeclaredSettings, type LiveSettings, type SettingsPatch } from './settings.js';
+export type { PageSettings, SettingsFact, AccessLevel } from '../reader/settings-sheet.js';

package/lib/artifacts/index.js

@@ -20,3 +20,4 @@ export { COMMENTS_SLOT, COMMENTS_MODES, COMMENT_TRANSCRIPTS, MAX_COMMENT_CHARS,
 export { createPersonalStore, createMemoryPersonalStore, validatePersonal, personalAudioDir, MAX_PERSONAL_PER_READER } from './personal-store.js';
 export { deepgramTranscriber, openaiTranscriber } from './transcribe.js';
 export { AUDIO_TYPES, audioExtFor, audioTypeFor, baseMime, MAX_AUDIO_BYTES, MAX_MEMO_MS, MEMO_NAME, commentAudioPath, isCommentAudioPath, personalAudioPath, isPersonalAudioPath } from './audio.js';
+export { settleOnPublish, applySettingsPatch, withComments, declaredOf, passwordDigest, newPageKey } from './settings.js';

package/lib/artifacts/settings.d.ts

@@ -0,0 +1,62 @@
+import type { Access } from './reader.js';
+import type { StateConfig } from './state.js';
+import { type CommentsMode, type CommentsVisible } from './comments.js';
+/** What the FILE said at its last publish, one entry per setting; null means it said nothing.
+ *  The password is kept as a hash, never a second copy of the key. */
+export type DeclaredSettings = {
+    access: Access | 'public' | null;
+    password: string | null;
+    comments: CommentsMode | null;
+    commentsVisible: CommentsVisible | null;
+};
+/** The settings as they apply to the page; undefined is absent (public, no password, comments off, owner). */
+export type LiveSettings = {
+    access?: Access;
+    password?: string;
+    comments?: CommentsMode;
+    commentsVisible?: CommentsVisible;
+    state?: StateConfig;
+};
+export declare const passwordDigest: (p: string | undefined) => string | null;
+/** What a file declares, as the record keeps it. */
+export declare function declaredOf(meta: {
+    access?: Access | 'public';
+    password?: string;
+    comments?: CommentsMode;
+    commentsVisible?: CommentsVisible;
+}): DeclaredSettings;
+/** The page's state with the comments slot set for `mode` and `visible`: removed when off, put
+ *  back (or changed) when on. A state left with no slots at all is no state. Null when the page
+ *  declares a slot of its own named `comments`, which comments cannot share. */
+export declare function withComments(state: StateConfig | undefined, mode: CommentsMode | undefined, visible: CommentsVisible | undefined, ownSlot?: boolean): StateConfig | undefined | null;
+/** The settings a publish leaves on the page. `existing` is the record before it (null on the
+ *  first publish); a record with no `declared` predates 0.31.0 and takes the file as it always did. */
+export declare function settleOnPublish(existing: (LiveSettings & {
+    declared?: DeclaredSettings;
+}) | null, meta: {
+    access?: Access | 'public';
+    password?: string;
+    comments?: CommentsMode;
+    commentsVisible?: CommentsVisible;
+    state?: StateConfig;
+}): LiveSettings & {
+    declared: DeclaredSettings;
+};
+/** What an owner or admin may change from the page. Absent leaves a setting as it is. */
+export type SettingsPatch = {
+    access?: Access | 'public';
+    /** A key to set, or null to take the password off. */
+    password?: string | null;
+    comments?: CommentsMode;
+    commentsVisible?: CommentsVisible;
+};
+/** The live settings after a patch, or an error a person can read. */
+export declare function applySettingsPatch(existing: LiveSettings, patch: SettingsPatch): {
+    ok: true;
+    live: LiveSettings;
+} | {
+    ok: false;
+    error: string;
+};
+/** A fresh key for a password turned on from the page. 12 characters, about 59 bits. */
+export declare function newPageKey(): string;

package/lib/artifacts/settings.js

@@ -0,0 +1,86 @@
+// A page's share and comment settings, changed two ways: by its file on publish, and by its owner
+// or an admin from the page menu (0.31.0). Settings changed on the page WIN. A publish changes one
+// only when the file names a value that differs from what the file named the time before, which
+// the record keeps as `declared`. That is how `access:` already behaved for a line the file drops
+// (absent leaves it alone); this extends the same idea to a line the file still carries, and to
+// the password and the comment settings, so an admin's change is never quietly undone by the
+// next republish of an unchanged file.
+//
+// Pure and server-only (node:crypto). The Firestore store applies what this decides.
+import { createHash, randomInt } from 'node:crypto';
+import { COMMENTS_SLOT, mergeCommentsState } from './comments.js';
+export const passwordDigest = (p) => (p ? createHash('sha256').update(`declared\n${p}`).digest('hex') : null);
+/** What a file declares, as the record keeps it. */
+export function declaredOf(meta) {
+    return { access: meta.access ?? null, password: passwordDigest(meta.password), comments: meta.comments ?? null, commentsVisible: meta.commentsVisible ?? null };
+}
+/** The page's state with the comments slot set for `mode` and `visible`: removed when off, put
+ *  back (or changed) when on. A state left with no slots at all is no state. Null when the page
+ *  declares a slot of its own named `comments`, which comments cannot share. */
+export function withComments(state, mode, visible, ownSlot = false) {
+    let base = state;
+    if (base && !ownSlot && Object.hasOwn(base.slots, COMMENTS_SLOT)) {
+        const { [COMMENTS_SLOT]: _gone, ...rest } = base.slots;
+        base = Object.keys(rest).length ? { ...base, slots: rest } : undefined;
+    }
+    const merged = mergeCommentsState(base, mode, visible);
+    return merged.ok ? merged.state : null;
+}
+/** The settings a publish leaves on the page. `existing` is the record before it (null on the
+ *  first publish); a record with no `declared` predates 0.31.0 and takes the file as it always did. */
+export function settleOnPublish(existing, meta) {
+    const declared = declaredOf(meta);
+    const fileAccess = meta.access === 'public' ? undefined : meta.access;
+    if (!existing) {
+        return { access: fileAccess, password: meta.password, comments: meta.comments, commentsVisible: meta.commentsVisible, state: meta.state, declared };
+    }
+    const d = existing.declared;
+    // The file's value stands only where it changed since the last publish; else the page's stands.
+    const kept = (k) => !!d && d[k] === declared[k];
+    // Access: a file that names none never touches it (sticky since 0.13), with or without `declared`.
+    const access = meta.access === undefined || kept('access') ? existing.access : fileAccess;
+    const password = kept('password') ? existing.password : meta.password;
+    const comments = kept('comments') ? existing.comments : meta.comments;
+    const commentsVisible = kept('commentsVisible') ? existing.commentsVisible : meta.commentsVisible;
+    if (comments === meta.comments && commentsVisible === meta.commentsVisible) {
+        return { access, password, comments, commentsVisible, state: meta.state, declared };
+    }
+    // The page's comment settings outlive the file's: rebuild the slot from them. The file's
+    // comments slot (when `comments:` put one there) is replaced; a slot the page itself declares
+    // under that name is never touched, and then comments stay as the file has them.
+    const fileMadeSlot = !!meta.comments && meta.comments !== 'off';
+    const state = withComments(meta.state, comments, commentsVisible, !fileMadeSlot && !!meta.state && Object.hasOwn(meta.state.slots, COMMENTS_SLOT));
+    if (state === null)
+        return { access, password, comments: meta.comments, commentsVisible: meta.commentsVisible, state: meta.state, declared };
+    return { access, password, comments, commentsVisible, state, declared };
+}
+/** The live settings after a patch, or an error a person can read. */
+export function applySettingsPatch(existing, patch) {
+    const live = { ...existing };
+    if (patch.access !== undefined)
+        live.access = patch.access === 'public' ? undefined : patch.access;
+    if (patch.password !== undefined)
+        live.password = patch.password ?? undefined;
+    if (patch.comments !== undefined || patch.commentsVisible !== undefined) {
+        const mode = patch.comments ?? existing.comments;
+        const visible = patch.commentsVisible ?? existing.commentsVisible;
+        const on = !!existing.comments && existing.comments !== 'off';
+        const ownSlot = !on && !!existing.state && Object.hasOwn(existing.state.slots, COMMENTS_SLOT);
+        const state = withComments(existing.state, mode, visible, ownSlot);
+        if (state === null)
+            return { ok: false, error: `this page declares its own slot named "${COMMENTS_SLOT}", so shared comments cannot be turned on from the page` };
+        live.comments = mode === 'off' ? undefined : mode;
+        live.commentsVisible = visible;
+        live.state = state;
+    }
+    return { ok: true, live };
+}
+// No 0/o, 1/l/i, like page ids: a key read aloud or retyped from a screenshot must survive it.
+const KEY_ALPHABET = 'abcdefghjkmnpqrstuvwxyz23456789';
+/** A fresh key for a password turned on from the page. 12 characters, about 59 bits. */
+export function newPageKey() {
+    let s = '';
+    for (let i = 0; i < 12; i++)
+        s += KEY_ALPHABET[randomInt(KEY_ALPHABET.length)];
+    return s;
+}

package/lib/artifacts/store.d.ts

@@ -5,6 +5,7 @@ import type { StateConfig } from './state.js';
 import type { ThemeMode } from '../brand/theme.js';
 import type { Definition } from './definitions.js';
 import type { CommentsMode, CommentsVisible } from './comments.js';
+import { type DeclaredSettings, type SettingsPatch } from './settings.js';
 export type ArtifactRecord = {
     id: string;
     title: string;
@@ -30,6 +31,10 @@ export type ArtifactRecord = {
     /** Who may leave shared comments; absent is off. Personal notes need nothing. */
     comments?: CommentsMode;
     commentsVisible?: CommentsVisible;
+    /** What the file said about access, password and comments at its last publish (0.31.0), so a
+     *  republish changes a setting only when the file's line changed: settings changed on the page
+     *  win (artifacts/settings.ts). Absent on pages last published before 0.31.0. */
+    declared?: DeclaredSettings;
     markdown: string;
     createdAt: string;
     updatedAt: string;
@@ -89,6 +94,9 @@ export interface ArtifactStore {
     bumpViews(id: string): Promise<void>;
     /** Set who may read a page without republishing it; 'public' opens it. False if no such page. */
     setAccess?(id: string, access: Access | 'public'): Promise<boolean>;
+    /** Change a page's share and comment settings from the page, without a new version. Null when
+     *  no such page; throws an Error whose message a person can read when the change cannot apply. */
+    setSettings?(id: string, patch: SettingsPatch): Promise<ArtifactRecord | null>;
     /** Every version, newest first, current included, without bodies. Null when no such page. */
     history?(id: string): Promise<VersionEntry[] | null>;
     /** One version by number, current included. Null when the page or the version does not exist. */

package/lib/artifacts/store.js

@@ -9,6 +9,7 @@
 // first save of a page still carrying the array moves it into the subcollection.
 import { randomInt } from 'node:crypto';
 import { FieldValue } from 'firebase-admin/firestore';
+import { applySettingsPatch, settleOnPublish } from './settings.js';
 /** A change note is one line: whitespace collapsed, capped, empty means none. */
 export const MAX_CHANGE_NOTE_CHARS = 280;
 export function cleanNote(note) {
@@ -41,6 +42,20 @@ export function createArtifactStore(db, collection = 'artifacts') {
             await ref.update({ access: access === 'public' ? FieldValue.delete() : access });
             return true;
         },
+        setSettings: async (id, patch) => {
+            const a = await getArtifact(col, id);
+            if (!a)
+                return null;
+            const r = applySettingsPatch(a, patch);
+            if (!r.ok)
+                throw new Error(r.error);
+            const v = r.live;
+            const or = (x) => (x === undefined ? FieldValue.delete() : x);
+            await col().doc(id).update({
+                access: or(v.access), password: or(v.password), comments: or(v.comments), commentsVisible: or(v.commentsVisible), state: or(v.state),
+            });
+            return getArtifact(col, id);
+        },
         history: (id) => historyOf(col, id),
         version: (id, n) => versionOf(col, id, n),
         setNote: (id, n, note) => setNote(col, id, n, note),
@@ -130,15 +145,10 @@ async function saveArtifact(col, input) {
         ...(input.meta.narration ? { narration: input.meta.narration } : {}),
         ...(input.meta.timings ? { timings: input.meta.timings } : {}),
         ...(input.meta.narrationHash ? { narrationHash: input.meta.narrationHash } : {}),
-        ...(input.meta.password ? { password: input.meta.password } : {}),
-        ...(input.meta.access && input.meta.access !== 'public' ? { access: input.meta.access } : {}),
-        ...(input.meta.state ? { state: input.meta.state } : {}),
         ...(input.meta.theme ? { theme: input.meta.theme } : {}),
         ...(input.meta.pack ? { pack: input.meta.pack } : {}),
         ...(input.meta.toc !== undefined ? { toc: input.meta.toc } : {}),
         ...(input.meta.definitions?.length ? { definitions: input.meta.definitions } : {}),
-        ...(input.meta.comments ? { comments: input.meta.comments } : {}),
-        ...(input.meta.commentsVisible ? { commentsVisible: input.meta.commentsVisible } : {}),
     };
     if (input.id) {
         const existing = await getArtifact(col, input.id);
@@ -167,28 +177,26 @@ async function saveArtifact(col, input) {
             });
         }
         const next = fresh ? current + 1 : current;
-        // An update merges, so a password the file no longer carries has to be cleared on purpose:
-        // otherwise removing the line from the file would leave the door up on the live page.
-        const password = input.meta.password ? {} : { password: FieldValue.delete() };
+        // Access, the password and the comment settings: the file's line stands only where it changed
+        // since the last publish, so a setting changed on the page is never undone by a republish of
+        // an unchanged file (settings.ts). An update merges, so anything that settles to absent is
+        // cleared on purpose: removing the password line takes the door down, `access: public` opens.
+        const live = settleOnPublish(existing, input.meta);
+        const or = (x) => (x === undefined ? FieldValue.delete() : x);
+        const settings = {
+            access: or(live.access), password: or(live.password), state: or(live.state),
+            comments: or(live.comments), commentsVisible: or(live.commentsVisible), declared: live.declared,
+        };
         // A subtitle the file no longer carries is gone from the page, like any other content.
         const subtitle = input.meta.subtitle ? {} : { subtitle: FieldValue.delete() };
         // Who it is for is a label on the content, never an access control: absent clears it.
         const to = input.meta.to ? {} : { to: FieldValue.delete() };
-        // Access is the opposite of password on purpose: absent leaves it alone, and only an explicit
-        // `access: public` opens the page. Reopening a confidential page must never be a side effect.
-        const access = input.meta.access === 'public' ? { access: FieldValue.delete() } : {};
-        // Content, like the body: a republish that no longer declares state removes the slots.
-        const state = input.meta.state ? {} : { state: FieldValue.delete() };
         // How the page looks is content too: a line the file no longer carries goes back to the default.
         const look = {
             ...(input.meta.theme ? {} : { theme: FieldValue.delete() }),
             ...(input.meta.pack ? {} : { pack: FieldValue.delete() }),
             ...(input.meta.toc !== undefined ? {} : { toc: FieldValue.delete() }),
             ...(input.meta.definitions?.length ? {} : { definitions: FieldValue.delete() }),
-            // Comments are not an access control, so a line the file no longer carries goes back to
-            // off / owner. The comments already left are kept, like every answer.
-            ...(input.meta.comments ? {} : { comments: FieldValue.delete() }),
-            ...(input.meta.commentsVisible ? {} : { commentsVisible: FieldValue.delete() }),
         };
         // `voice: none` is the page declaring it has no audio. An update merges, so the recording it
         // had would otherwise survive every republish; clear it on purpose, and the player goes with it.
@@ -196,7 +204,7 @@ async function saveArtifact(col, input) {
             ? { voice: FieldValue.delete(), narration: FieldValue.delete(), timings: FieldValue.delete(), narrationHash: FieldValue.delete() }
             : {};
         await ref.update({
-            ...fields, ...password, ...subtitle, ...to, ...access, ...state, ...look, ...audio, markdown: input.markdown, version: next,
+            ...fields, ...settings, ...subtitle, ...to, ...look, ...audio, markdown: input.markdown, version: next,
             // `updatedAt` is when this version went live; finishing its own publish does not move it.
             ...(fresh || input.markdown !== existing.markdown ? { updatedAt: now } : {}),
             note: nextNote ?? FieldValue.delete(),
@@ -205,9 +213,16 @@ async function saveArtifact(col, input) {
         return { id: input.id, version: next, created: false };
     }
     const id = newArtifactId();
+    const live = settleOnPublish(null, input.meta);
     const rec = {
         id,
         ...fields,
+        ...(live.access ? { access: live.access } : {}),
+        ...(live.password ? { password: live.password } : {}),
+        ...(live.state ? { state: live.state } : {}),
+        ...(live.comments ? { comments: live.comments } : {}),
+        ...(live.commentsVisible ? { commentsVisible: live.commentsVisible } : {}),
+        declared: live.declared,
         markdown: input.markdown,
         createdAt: now,
         updatedAt: now,

package/lib/reader/index.d.ts

@@ -2,6 +2,7 @@ export { ArtifactReader, wrapWords, seekableWord, litWordIndex, type WordTiming
 export { PlayerBar } from './player-bar.js';
 export { CommentLayer } from './comment-layer.js';
 export { PageMenu, roleLine, menuItems, type PageMenuProps, type PageRole } from './page-menu.js';
+export { SettingsSheet, settingsChanges, ACCESS_LABEL, COMMENTS_LABEL, VISIBLE_LABEL, REOPEN_KEY, type PageSettings, type SettingsFact, type SheetKind, type AccessLevel } from './settings-sheet.js';
 export { VersionHistory, HistoryPanel, VersionList, type HistoryItem } from './version-history.js';
 export { requestPins, announcePins, signInBack, PINS_SET, PINS_STATE } from './page-bridge.js';
 export { CommentCard, warningLine, DEVICE_LINE } from './comment-card.js';

package/lib/reader/index.js

@@ -4,6 +4,7 @@ export { ArtifactReader, wrapWords, seekableWord, litWordIndex } from './artifac
 export { PlayerBar } from './player-bar.js';
 export { CommentLayer } from './comment-layer.js';
 export { PageMenu, roleLine, menuItems } from './page-menu.js';
+export { SettingsSheet, settingsChanges, ACCESS_LABEL, COMMENTS_LABEL, VISIBLE_LABEL, REOPEN_KEY } from './settings-sheet.js';
 export { VersionHistory, HistoryPanel, VersionList } from './version-history.js';
 export { requestPins, announcePins, signInBack, PINS_SET, PINS_STATE } from './page-bridge.js';
 export { CommentCard, warningLine, DEVICE_LINE } from './comment-card.js';

package/lib/reader/page-menu.d.ts

@@ -1,4 +1,5 @@
 import { type HistoryItem } from './version-history.js';
+import { type PageSettings } from './settings-sheet.js';
 export type PageRole = 'visitor' | 'reader' | 'owner' | 'admin';
 export type PageMenuProps = {
     role: PageRole;
@@ -26,9 +27,12 @@ export type PageMenuProps = {
     } | null;
     /** The published source, for the owner and admins only. */
     markdown: string | null;
+    /** The page's share and comment settings, for the owner and admins only; null for everyone
+     *  else, so nobody else's page carries the list or the key. */
+    settings?: PageSettings | null;
 };
 /** The menu's first line: who this reader is to this page. */
 export declare function roleLine(role: PageRole, name: string | null, shutOut?: boolean): string;
 /** The items this reader gets, in order. Exported so the server markup and tests can name them. */
-export declare function menuItems(p: Pick<PageMenuProps, 'share' | 'comments' | 'signIn' | 'signOut' | 'history' | 'markdown'>): string[];
+export declare function menuItems(p: Pick<PageMenuProps, 'share' | 'comments' | 'signIn' | 'signOut' | 'history' | 'markdown' | 'settings'>): string[];
 export declare function PageMenu(props: PageMenuProps): import("react").JSX.Element;

package/lib/reader/page-menu.js

@@ -6,7 +6,8 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // that role. Items a role cannot use are absent, never greyed out.
 //
 // Release 1 (0.30.0): Share, Show / Hide comments, Sign in / Sign out, Version history and Copy
-// the markdown. The server decides every item (routes/artifacts.tsx) and passes only what this
+// the markdown. Release 2 (0.31.0): Share settings and Comment settings for the owner and the
+// hub's admins, each opening a sheet (settings-sheet.tsx) that changes the page without a republish. The server decides every item (routes/artifacts.tsx) and passes only what this
 // reader may have: the markdown source and the history list never reach a reader who may not use
 // them, so nothing here has to hide anything.
 //
@@ -20,6 +21,7 @@ import { createPortal } from 'react-dom';
 import { themeVarsAround } from './theme-vars.js';
 import { HistoryPanel, VersionList } from './version-history.js';
 import { PINS_STATE, requestPins, signInBack } from './page-bridge.js';
+import { REOPEN_KEY, SettingsSheet } from './settings-sheet.js';
 /** The menu's first line: who this reader is to this page. */
 export function roleLine(role, name, shutOut = false) {
     if (role === 'visitor' || !name)
@@ -35,6 +37,8 @@ export function menuItems(p) {
     return [
         p.share ? 'share' : null,
         p.comments ? 'comments' : null,
+        p.settings ? 'share-settings' : null,
+        p.settings && p.settings.comments !== null ? 'comment-settings' : null,
         p.history ? 'history' : null,
         p.markdown !== null ? 'markdown' : null,
         p.signOut ? 'sign-out' : p.signIn ? 'sign-in' : null,
@@ -75,7 +79,7 @@ async function copyText(text) {
     }
 }
 export function PageMenu(props) {
-    const { role, name, shutOut, share, comments, signIn, signOut, history, markdown } = props;
+    const { role, name, shutOut, share, comments, signIn, signOut, history, markdown, settings } = props;
     const items = menuItems(props);
     const [mounted, setMounted] = useState(false);
     const [open, setOpen] = useState(false);
@@ -84,6 +88,7 @@ export function PageMenu(props) {
     const [pins, setPins] = useState(true);
     const [said, setSaid] = useState(null);
     const [historyOpen, setHistoryOpen] = useState(false);
+    const [sheet, setSheet] = useState(null);
     const marker = useRef(null);
     const button = useRef(null);
     const menu = useRef(null);
@@ -92,6 +97,18 @@ export function PageMenu(props) {
         setMounted(true);
         const onPins = (e) => setPins(e.detail === true);
         window.addEventListener(PINS_STATE, onPins);
+        // A settings save reloads the page; open the sheet it came from again, saying it saved.
+        if (settings) {
+            try {
+                const kind = window.sessionStorage.getItem(REOPEN_KEY);
+                window.sessionStorage.removeItem(REOPEN_KEY);
+                if (kind === 'share' || kind === 'comments') {
+                    setPhone(isPhone());
+                    setSheet({ kind, saved: true });
+                }
+            }
+            catch { /* no storage: the page itself shows what changed */ }
+        }
         return () => window.removeEventListener(PINS_STATE, onPins);
     }, []);
     const close = useCallback((focus = true) => {
@@ -150,6 +167,10 @@ export function PageMenu(props) {
         setPins(!pins);
         close();
     };
+    const onSheet = (kind) => {
+        setOpen(false);
+        setSheet({ kind, saved: false });
+    };
     const onHistory = () => {
         setOpen(false);
         setHistoryOpen(true);
@@ -176,6 +197,6 @@ export function PageMenu(props) {
                     color: 'var(--a-ink, #111)', background: 'color-mix(in srgb, var(--a-ground, #fff) 82%, transparent)',
                     border: '1px solid var(--a-line, rgba(127,127,127,0.3))', boxShadow: '0 1px 4px rgba(0,0,0,0.12)',
                     backdropFilter: 'blur(8px)', WebkitBackdropFilter: 'blur(8px)',
-                }, children: _jsxs("svg", { width: "18", height: "18", viewBox: "0 0 18 18", "aria-hidden": true, focusable: "false", children: [_jsx("circle", { cx: "3.5", cy: "9", r: "1.6", fill: "currentColor" }), _jsx("circle", { cx: "9", cy: "9", r: "1.6", fill: "currentColor" }), _jsx("circle", { cx: "14.5", cy: "9", r: "1.6", fill: "currentColor" })] }) }), open && phone ? _jsx("div", { "aria-hidden": true, "data-page-menu-scrim": true, style: { position: 'fixed', inset: 0, zIndex: 59, background: 'rgba(0,0,0,0.28)' } }) : null, open ? (_jsxs("div", { ref: menu, "data-page-menu": true, role: "menu", "aria-label": "Page menu", style: panelStyle, children: [_jsx("p", { "data-page-menu-role": true, style: { margin: 0, padding: phone ? '10px 12px 8px' : '8px 10px 6px', fontSize: 12, lineHeight: 1.35, opacity: 0.7, overflowWrap: 'anywhere' }, children: line }), items.length ? _jsx("div", { "aria-hidden": true, style: { height: 1, margin: '0 6px 4px', background: 'var(--a-line, rgba(127,127,127,0.3))' } }) : null, share ? (_jsxs("button", { type: "button", role: "menuitem", "data-page-menu-item": "share", onClick: () => void onShare(), style: itemStyle, children: [said === 'Link copied' || said === 'Could not copy the link' ? said : 'Share', share.note ? _jsx("span", { "data-page-menu-note": true, style: sub, children: share.note }) : null] })) : null, comments ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "comments", onClick: onPins, style: itemStyle, children: pins ? 'Hide comments' : 'Show comments' })) : null, history ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "history", "aria-haspopup": "dialog", onClick: onHistory, style: itemStyle, children: "Version history" })) : null, markdown !== null ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "markdown", onClick: () => void onMarkdown(), style: itemStyle, children: said === 'Markdown copied' || said === 'Could not copy the markdown' ? said : 'Copy the markdown' })) : null, signOut ? (_jsx("a", { role: "menuitem", "data-page-menu-item": "sign-out", href: signOut, style: itemStyle, children: "Sign out" })) : signIn ? (_jsx("a", { role: "menuitem", "data-page-menu-item": "sign-in", href: signIn, onClick: (e) => { e.currentTarget.href = signInBack(signIn); }, style: itemStyle, children: "Sign in" })) : null, _jsx("span", { role: "status", "aria-live": "polite", style: { position: 'absolute', width: 1, height: 1, overflow: 'hidden', clip: 'rect(0 0 0 0)' }, children: said ?? '' })] })) : null, historyOpen && history ? (_jsx(HistoryPanel, { items: history.items, base: history.base, viewing: history.viewing, anchor: button, onClose: () => { setHistoryOpen(false); button.current?.focus(); }, onOutside: () => setHistoryOpen(false) })) : null] })) : null;
+                }, children: _jsxs("svg", { width: "18", height: "18", viewBox: "0 0 18 18", "aria-hidden": true, focusable: "false", children: [_jsx("circle", { cx: "3.5", cy: "9", r: "1.6", fill: "currentColor" }), _jsx("circle", { cx: "9", cy: "9", r: "1.6", fill: "currentColor" }), _jsx("circle", { cx: "14.5", cy: "9", r: "1.6", fill: "currentColor" })] }) }), open && phone ? _jsx("div", { "aria-hidden": true, "data-page-menu-scrim": true, style: { position: 'fixed', inset: 0, zIndex: 59, background: 'rgba(0,0,0,0.28)' } }) : null, open ? (_jsxs("div", { ref: menu, "data-page-menu": true, role: "menu", "aria-label": "Page menu", style: panelStyle, children: [_jsx("p", { "data-page-menu-role": true, style: { margin: 0, padding: phone ? '10px 12px 8px' : '8px 10px 6px', fontSize: 12, lineHeight: 1.35, opacity: 0.7, overflowWrap: 'anywhere' }, children: line }), items.length ? _jsx("div", { "aria-hidden": true, style: { height: 1, margin: '0 6px 4px', background: 'var(--a-line, rgba(127,127,127,0.3))' } }) : null, share ? (_jsxs("button", { type: "button", role: "menuitem", "data-page-menu-item": "share", onClick: () => void onShare(), style: itemStyle, children: [said === 'Link copied' || said === 'Could not copy the link' ? said : 'Share', share.note ? _jsx("span", { "data-page-menu-note": true, style: sub, children: share.note }) : null] })) : null, comments ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "comments", onClick: onPins, style: itemStyle, children: pins ? 'Hide comments' : 'Show comments' })) : null, settings ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "share-settings", "aria-haspopup": "dialog", onClick: () => onSheet('share'), style: itemStyle, children: "Share settings" })) : null, settings && settings.comments !== null ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "comment-settings", "aria-haspopup": "dialog", onClick: () => onSheet('comments'), style: itemStyle, children: "Comment settings" })) : null, history ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "history", "aria-haspopup": "dialog", onClick: onHistory, style: itemStyle, children: "Version history" })) : null, markdown !== null ? (_jsx("button", { type: "button", role: "menuitem", "data-page-menu-item": "markdown", onClick: () => void onMarkdown(), style: itemStyle, children: said === 'Markdown copied' || said === 'Could not copy the markdown' ? said : 'Copy the markdown' })) : null, signOut ? (_jsx("a", { role: "menuitem", "data-page-menu-item": "sign-out", href: signOut, style: itemStyle, children: "Sign out" })) : signIn ? (_jsx("a", { role: "menuitem", "data-page-menu-item": "sign-in", href: signIn, onClick: (e) => { e.currentTarget.href = signInBack(signIn); }, style: itemStyle, children: "Sign in" })) : null, _jsx("span", { role: "status", "aria-live": "polite", style: { position: 'absolute', width: 1, height: 1, overflow: 'hidden', clip: 'rect(0 0 0 0)' }, children: said ?? '' })] })) : null, sheet && settings ? (_jsx(SettingsSheet, { kind: sheet.kind, settings: settings, saved: sheet.saved, phone: phone, vars: vars, onCopy: copyText, onClose: () => { setSheet(null); button.current?.focus(); } })) : null, historyOpen && history ? (_jsx(HistoryPanel, { items: history.items, base: history.base, viewing: history.viewing, anchor: button, onClose: () => { setHistoryOpen(false); button.current?.focus(); }, onOutside: () => setHistoryOpen(false) })) : null] })) : null;
     return (_jsxs(_Fragment, { children: [_jsx("span", { ref: marker, hidden: true, "data-page-menu-for": role, "data-page-menu-items": items.join(' '), children: history ? _jsx(VersionList, { items: history.items, base: history.base, marker: true }) : null }), ui ? createPortal(ui, document.body) : null] }));
 }

package/lib/reader/settings-sheet.d.ts

@@ -0,0 +1,55 @@
+export type AccessLevel = 'public' | 'freedom' | 'invite';
+export type SettingsFact = {
+    label: string;
+    text: string;
+};
+/** Everything the sheets show and change, for one page. The endpoint answers in the same shape. */
+export type PageSettings = {
+    /** POST here to change, GET to read. */
+    endpoint: string;
+    access: AccessLevel;
+    /** The levels this host can offer: 'public' always; the gated ones only on a host that keeps a list. */
+    levels: AccessLevel[];
+    /** A password shuts the page (only meaningful while it is open to anyone with the link). */
+    password: boolean;
+    /** The link to send: with the key when a password is on, else the page. */
+    link: string;
+    /** Who is on the page's list, or null on a host that keeps none. */
+    list: {
+        email: string;
+        name?: string;
+    }[] | null;
+    /** Who may comment, or null on a host that keeps no comments. */
+    comments: 'off' | 'anyone' | 'signed-in' | null;
+    commentsVisible: 'owner' | 'readers';
+    /** A gated page takes comments only from signed-in readers, whatever the setting says. */
+    gated: boolean;
+    /** Read-only lines: what a stranger sees, search engines, anything the host adds. */
+    facts: SettingsFact[];
+};
+export type SheetKind = 'share' | 'comments';
+export declare const ACCESS_LABEL: Record<AccessLevel, string>;
+export declare const COMMENTS_LABEL: {
+    readonly anyone: "Anyone";
+    readonly 'signed-in': "Signed-in readers";
+    readonly off: "Nobody";
+};
+export declare const VISIBLE_LABEL: {
+    readonly owner: "Owner and admins";
+    readonly readers: "Every reader";
+};
+/** Where a reload leaves a note for the sheet to open again with. */
+export declare const REOPEN_KEY = "artifact:settings-reopen";
+/** The body of a settings POST, from what the sheet holds against what the page had. Only what
+ *  changed is sent, so a save never touches a setting nobody moved. */
+export declare function settingsChanges(was: PageSettings, now: Pick<PageSettings, 'access' | 'password' | 'comments' | 'commentsVisible'>): Record<string, unknown>;
+export declare function SettingsSheet({ kind, settings, phone, vars, onClose, onCopy, saved }: {
+    kind: SheetKind;
+    settings: PageSettings;
+    phone: boolean;
+    vars: Record<string, string>;
+    onClose: () => void;
+    onCopy: (text: string) => Promise<boolean>;
+    /** Opened again after the reload a save caused: say so. */
+    saved?: boolean;
+}): import("react").JSX.Element;

package/lib/reader/settings-sheet.js

@@ -0,0 +1,138 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+// The page menu's two owner-and-admin sheets (0.31.0): Share settings and Comment settings. The
+// server hands the page these settings ONLY for the owner and the hub's admins (routes/artifacts
+// `settingsFor`), and every change goes through POST /api/artifacts/<id>/settings, which checks
+// the same thing again. On a phone a sheet from the bottom, on a desk a panel under the button,
+// styled like the menu itself.
+//
+// A save that changes how the page renders (who opens it, the password, the comments) reloads
+// the page so it shows the new settings, and the sheet opens again on the other side saying
+// "Saved". Adding or removing someone on the list changes nothing on the page, so it does not.
+import { useEffect, useRef, useState } from 'react';
+import { NO_ZOOM_FONT } from './no-zoom.js';
+export const ACCESS_LABEL = {
+    public: 'Anyone with the link',
+    freedom: 'Any Freedom account',
+    invite: 'Only the list',
+};
+export const COMMENTS_LABEL = { anyone: 'Anyone', 'signed-in': 'Signed-in readers', off: 'Nobody' };
+export const VISIBLE_LABEL = { owner: 'Owner and admins', readers: 'Every reader' };
+/** Where a reload leaves a note for the sheet to open again with. */
+export const REOPEN_KEY = 'artifact:settings-reopen';
+/** The body of a settings POST, from what the sheet holds against what the page had. Only what
+ *  changed is sent, so a save never touches a setting nobody moved. */
+export function settingsChanges(was, now) {
+    const body = {};
+    if (now.access !== was.access)
+        body.access = now.access;
+    if (now.password !== was.password)
+        body.password = now.password ? 'on' : 'off';
+    if (now.comments !== null && now.comments !== was.comments)
+        body.comments = now.comments;
+    if (now.commentsVisible !== was.commentsVisible)
+        body.commentsVisible = now.commentsVisible;
+    return body;
+}
+async function send(endpoint, body) {
+    try {
+        const r = await fetch(endpoint, { method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin', body: JSON.stringify(body) });
+        const j = (await r.json().catch(() => null));
+        if (!r.ok || !j)
+            return { ok: false, error: j?.error ?? `Could not save (${r.status})` };
+        return { ok: true, settings: j };
+    }
+    catch {
+        return { ok: false, error: 'Could not reach the page. Check the connection and try again.' };
+    }
+}
+export function SettingsSheet({ kind, settings, phone, vars, onClose, onCopy, saved = false }) {
+    const [s, setS] = useState(settings);
+    const [access, setAccess] = useState(settings.access);
+    const [password, setPassword] = useState(settings.password);
+    const [comments, setComments] = useState(settings.comments);
+    const [visible, setVisible] = useState(settings.commentsVisible);
+    const [email, setEmail] = useState('');
+    const [busy, setBusy] = useState(false);
+    const [said, setSaid] = useState(saved ? 'Saved' : null);
+    const panel = useRef(null);
+    useEffect(() => {
+        panel.current?.focus();
+        const onKey = (e) => { if (e.key === 'Escape')
+            onClose(); };
+        document.addEventListener('keydown', onKey);
+        return () => document.removeEventListener('keydown', onKey);
+    }, [onClose]);
+    const changes = settingsChanges(s, { access, password, comments, commentsVisible: visible });
+    const dirty = Object.keys(changes).length > 0;
+    const save = async () => {
+        if (!dirty || busy)
+            return;
+        setBusy(true);
+        setSaid(null);
+        const r = await send(s.endpoint, changes);
+        setBusy(false);
+        if (!r.ok) {
+            setSaid(r.error);
+            return;
+        }
+        setS(r.settings);
+        setSaid('Saved');
+        // The page renders from these settings, so show it as it now is, and come back to this sheet.
+        try {
+            window.sessionStorage.setItem(REOPEN_KEY, kind);
+        }
+        catch { /* the reload still shows it */ }
+        window.location.reload();
+    };
+    const listChange = async (body) => {
+        if (busy)
+            return;
+        setBusy(true);
+        setSaid(null);
+        const r = await send(s.endpoint, body);
+        setBusy(false);
+        if (!r.ok) {
+            setSaid(r.error);
+            return;
+        }
+        setS(r.settings);
+        if (body.add)
+            setEmail('');
+        setSaid(body.add ? 'Added' : 'Removed');
+    };
+    const onAdd = (e) => {
+        e.preventDefault();
+        const v = email.trim();
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v)) {
+            setSaid('That is not an email address');
+            return;
+        }
+        void listChange({ add: [{ email: v }] });
+    };
+    const copy = async () => setSaid((await onCopy(s.link)) ? 'Link copied' : 'Could not copy the link');
+    const font = phone ? 16 : 14;
+    const style = {
+        ...vars,
+        position: 'fixed', zIndex: 61, boxSizing: 'border-box', background: 'var(--a-surface, var(--a-ground, #fff))', color: 'var(--a-strong, var(--a-ink, #111))',
+        border: '1px solid var(--a-line, rgba(127,127,127,0.3))', boxShadow: '0 12px 32px rgba(0,0,0,0.22)', fontFamily: 'ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif',
+        fontStyle: 'normal', fontWeight: 400, letterSpacing: 'normal', textTransform: 'none', outline: 'none', fontSize: font, lineHeight: 1.4, overflowY: 'auto',
+        ...(phone
+            ? { left: 8, right: 8, bottom: 'calc(env(safe-area-inset-bottom, 0px) + 8px)', borderRadius: 16, padding: '14px 14px 12px', maxHeight: '82vh' }
+            : { top: 'calc(env(safe-area-inset-top, 0px) + 56px)', right: 12, width: 360, borderRadius: 12, padding: '14px 14px 12px', maxHeight: 'calc(100vh - 72px)' }),
+    };
+    const h = { margin: '0 0 10px', fontSize: font + 1, fontWeight: 600 };
+    const legend = { padding: 0, margin: '0 0 6px', fontSize: 12, fontWeight: 600, opacity: 0.7, textTransform: 'uppercase', letterSpacing: '0.06em' };
+    const fieldset = { border: 0, margin: '0 0 14px', padding: 0, minWidth: 0 };
+    const choice = { display: 'flex', alignItems: 'center', gap: 10, padding: phone ? '8px 2px' : '5px 2px', cursor: 'pointer' };
+    const btn = {
+        font: 'inherit', fontSize: font - 1, borderRadius: 8, padding: phone ? '9px 14px' : '6px 12px', cursor: 'pointer',
+        border: '1px solid var(--a-line, rgba(127,127,127,0.3))', background: 'transparent', color: 'inherit',
+    };
+    const primary = { ...btn, background: 'var(--a-accent, #111)', borderColor: 'var(--a-accent, #111)', color: 'var(--a-ground, #fff)', fontWeight: 600 };
+    const muted = { margin: '4px 0 0', fontSize: 12, opacity: 0.65 };
+    const radio = (name, value, current, set, label, note) => (_jsxs("label", { style: choice, "data-settings-choice": `${name}:${value}`, children: [_jsx("input", { type: "radio", name: name, value: value, checked: current === value, onChange: () => set(value), style: { width: 18, height: 18, margin: 0, accentColor: 'var(--a-accent, #111)' } }), _jsxs("span", { children: [label, note ? _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: note }) : null] })] }, value));
+    const share = (_jsxs(_Fragment, { children: [_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Who can open it" }), s.levels.map((l) => radio('access', l, access, setAccess, ACCESS_LABEL[l], l === 'freedom' ? 'Plus anyone on the list' : undefined))] }), access === 'public' ? (_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Password" }), _jsxs("label", { style: choice, "data-settings-choice": "password", children: [_jsx("input", { type: "checkbox", checked: password, onChange: (e) => setPassword(e.target.checked), style: { width: 18, height: 18, margin: 0, accentColor: 'var(--a-accent, #111)' } }), _jsxs("span", { children: ["Require a password", _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: "The link to send carries the key" })] })] })] })) : null, dirty || busy ? (_jsxs("div", { style: { display: 'flex', gap: 8, margin: '0 0 14px' }, children: [_jsx("button", { type: "button", "data-settings-save": true, onClick: () => void save(), disabled: busy, style: primary, children: busy ? 'Saving' : 'Save' }), _jsx("button", { type: "button", onClick: () => { setAccess(s.access); setPassword(s.password); }, disabled: busy, style: btn, children: "Undo" })] })) : null, s.list && s.access !== 'public' ? (_jsxs("fieldset", { style: fieldset, "data-settings-list": true, children: [_jsx("legend", { style: legend, children: `The list (${s.list.length})` }), s.list.length === 0 ? _jsx("p", { style: { ...muted, margin: '0 0 6px' }, children: "Nobody yet." }) : null, _jsx("ul", { style: { listStyle: 'none', margin: '0 0 8px', padding: 0 }, children: s.list.map((e) => (_jsxs("li", { "data-settings-list-entry": e.email, style: { display: 'flex', alignItems: 'center', gap: 8, padding: '4px 0', borderBottom: '1px solid var(--a-line, rgba(127,127,127,0.2))' }, children: [_jsx("span", { style: { flex: 1, minWidth: 0, overflowWrap: 'anywhere' }, children: e.name ? _jsxs(_Fragment, { children: [e.name, _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: e.email })] }) : e.email }), _jsx("button", { type: "button", "aria-label": `Remove ${e.email}`, onClick: () => void listChange({ remove: [e.email] }), disabled: busy, style: btn, children: "Remove" })] }, e.email))) }), _jsxs("form", { onSubmit: onAdd, style: { display: 'flex', gap: 8 }, children: [_jsx("input", { type: "email", inputMode: "email", autoComplete: "off", placeholder: "name@example.com", "aria-label": "Email to add", value: email, onChange: (e) => setEmail(e.target.value), style: { flex: 1, minWidth: 0, font: 'inherit', ...NO_ZOOM_FONT, padding: phone ? '8px 10px' : '6px 8px', borderRadius: 8, border: '1px solid var(--a-line, rgba(127,127,127,0.4))', background: 'transparent', color: 'inherit' } }), _jsx("button", { type: "submit", disabled: busy, style: btn, children: "Add" })] }), s.access === 'invite' ? null : _jsx("p", { style: muted, children: "Freedom accounts get in without being on the list." })] })) : null, _jsxs("div", { style: { margin: '0 0 14px' }, "data-settings-link": true, children: [_jsx("p", { style: legend, children: "The link to send" }), _jsxs("div", { style: { display: 'flex', gap: 8, alignItems: 'center' }, children: [_jsx("code", { style: { flex: 1, minWidth: 0, fontSize: 13, overflowWrap: 'anywhere' }, children: s.link }), _jsx("button", { type: "button", onClick: () => void copy(), style: btn, children: "Copy" })] })] }), s.facts.length ? (_jsx("dl", { style: { display: 'grid', gap: 8, margin: 0 }, "data-settings-facts": true, children: s.facts.map((f) => (_jsxs("div", { children: [_jsx("dt", { style: { fontSize: 12, fontWeight: 600, opacity: 0.7 }, children: f.label }), _jsx("dd", { style: { margin: 0, fontSize: 13, opacity: 0.85 }, children: f.text })] }, f.label))) })) : null] }));
+    const commentSheet = (_jsxs(_Fragment, { children: [_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Who can comment" }), ['anyone', 'signed-in', 'off'].map((m) => radio('comments', m, comments, setComments, COMMENTS_LABEL[m], m === 'anyone' && s.gated ? 'This page is private, so only signed-in readers it is open to can' : undefined))] }), comments !== 'off' ? (_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Who can read the comments" }), ['owner', 'readers'].map((v) => radio('visible', v, visible, setVisible, VISIBLE_LABEL[v], v === 'owner' ? 'Each commenter also sees their own' : undefined))] })) : null, dirty || busy ? (_jsxs("div", { style: { display: 'flex', gap: 8 }, children: [_jsx("button", { type: "button", "data-settings-save": true, onClick: () => void save(), disabled: busy, style: primary, children: busy ? 'Saving' : 'Save' }), _jsx("button", { type: "button", onClick: () => { setComments(s.comments); setVisible(s.commentsVisible); }, disabled: busy, style: btn, children: "Undo" })] })) : null] }));
+    return (_jsxs(_Fragment, { children: [_jsx("div", { "aria-hidden": true, "data-settings-scrim": true, onClick: onClose, style: { position: 'fixed', inset: 0, zIndex: 60, background: phone ? 'rgba(0,0,0,0.28)' : 'transparent' } }), _jsxs("div", { ref: panel, role: "dialog", "aria-modal": "true", "aria-label": kind === 'share' ? 'Share settings' : 'Comment settings', tabIndex: -1, "data-settings-sheet": kind, "data-nospeak": true, "data-comment-ui": true, style: style, children: [_jsxs("div", { style: { display: 'flex', alignItems: 'baseline', justifyContent: 'space-between', gap: 8 }, children: [_jsx("h2", { style: h, children: kind === 'share' ? 'Share settings' : 'Comment settings' }), _jsx("button", { type: "button", onClick: onClose, "aria-label": "Close", style: { ...btn, border: 0, padding: '2px 6px', fontSize: 20, lineHeight: 1 }, children: "\u00D7" })] }), kind === 'share' ? share : commentSheet, _jsx("p", { role: "status", "aria-live": "polite", "data-settings-said": true, style: { margin: said ? '10px 0 0' : 0, fontSize: 13, minHeight: 0 }, children: said ?? '' })] })] }));
+}

package/lib/routes/artifacts.d.ts

@@ -4,6 +4,7 @@ import { type ArtifactRecord, type ArtifactStore, type VersionEntry } from '../a
 import type { StateStore } from '../artifacts/state-store.js';
 import { type ArtifactAssets } from '../artifacts/assets.js';
 import type { BrandPack } from '../brand/pack.js';
+import type { PageSettings, SettingsFact } from '../reader/settings-sheet.js';
 import { type Access, type AllowEntry } from '../artifacts/reader.js';
 import { type ReadersStore } from '../artifacts/readers-store.js';
 import { type ReaderEvent } from '../artifacts/read-alerts.js';
@@ -91,6 +92,12 @@ export type ArtifactRoutesConfig = {
      *  event into the alerts worth sending). Awaited, and anything it throws is swallowed: a broken
      *  sink never costs a reader their page or their record. Without it nothing extra is read. */
     onReaderEvent?: (event: ReaderEvent) => void | Promise<void>;
+    /** The read-only lines under the controls in the page menu's Share settings sheet (0.31.0), for
+     *  a host that knows more than the package about how its pages are found: its robots.txt, who
+     *  its sign-in admits. Given, its rows REPLACE the package's own two (what a stranger with the
+     *  bare URL sees, and search engines). Called only for the owner and admins; a throw falls back
+     *  to the package's rows. */
+    shareFacts?: (artifact: ArtifactRecord) => SettingsFact[] | Promise<SettingsFact[]>;
 };
 /** Ids are 8 chars from the safe alphabet; anything else is not a page and never reaches the store. */
 export declare const ARTIFACT_ID: RegExp;
@@ -208,6 +215,9 @@ export declare function createArtifactRoutes(config: ArtifactRoutesConfig): {
         access: Access | null;
         readers: AllowEntry[];
     }>>;
+    SETTINGS: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
+        error: string;
+    }> | NextResponse<PageSettings | null>>;
     READS: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
         error: string;
     }> | NextResponse<{

package/lib/routes/artifacts.js

@@ -22,6 +22,9 @@ import { CommentLayer } from '../reader/comment-layer.js';
 import { ReaderWatch } from '../reader/reader-watch.js';
 import { UpdatedTime } from '../reader/updated-time.js';
 import { PageMenu } from '../reader/page-menu.js';
+import { COMMENTS_MODES } from '../artifacts/comments.js';
+import { newPageKey } from '../artifacts/settings.js';
+import { unlockedUrl } from '../artifacts/unlock.js';
 import { ACCESS_LEVELS, GRANT_COOKIE, GRANT_TTL_SECONDS, decide, firstName, mintGrant, safeReturnPath, signInUrl, verifyGrant, verifyPass, } from '../artifacts/reader.js';
 import { FLAG_KINDS, summarize } from '../artifacts/readers-store.js';
 import { readSecondsFor, wordCount } from '../artifacts/read-alerts.js';
@@ -145,6 +148,46 @@ export function createArtifactRoutes(config) {
         }
         return { pages, readers: count };
     }
+    /** The package's own read-only lines for the Share settings sheet, from the rule `serve` applies
+     *  and the metadata it emits (every page is noindex, nofollow). */
+    function defaultFacts(a) {
+        const unfurl = 'The title, the summary and the share card';
+        const stranger = a.access
+            ? `${unfurl}, then a sign-in door. The body never reaches them.`
+            : a.password ? `${unfurl}, then a door asking for the key.` : 'The whole page. The bare link is all anyone needs.';
+        return [
+            { label: 'A stranger with the bare URL sees', text: stranger },
+            { label: 'Search engines', text: 'Hidden from search engines (noindex, nofollow). People find it only through a link someone sends.' },
+        ];
+    }
+    /** The page's settings as the sheets show them, or null: null for anyone but the owner and the
+     *  admins, and on a store that cannot change them, so no one else's page carries the list or
+     *  the key. The settings endpoint answers in this same shape. */
+    async function settingsFor(a, reader) {
+        if (!isAdmin(reader) || !store.setSettings)
+            return null;
+        const list = config.readers ? await config.readers.allowList(a.id).catch(() => []) : null;
+        let facts = defaultFacts(a);
+        if (config.shareFacts) {
+            try {
+                facts = await config.shareFacts(a);
+            }
+            catch { /* the package's own lines stand */ }
+        }
+        const on = !!a.comments && a.comments !== 'off' && !!a.state && Object.hasOwn(a.state.slots, COMMENTS_SLOT);
+        return {
+            endpoint: `/api/artifacts/${a.id}/settings`,
+            access: a.access ?? 'public',
+            levels: config.readers ? ['public', 'freedom', 'invite'] : ['public'],
+            password: !!a.password,
+            link: !a.access && a.password ? unlockedUrl(pageUrl(a.id), a.password) : pageUrl(a.id),
+            list: list ? list.map((e) => ({ email: e.email, ...(e.name ? { name: e.name } : {}) })) : null,
+            comments: config.state ? (on ? a.comments : 'off') : null,
+            commentsVisible: a.commentsVisible ?? 'owner',
+            gated: !!a.access,
+            facts,
+        };
+    }
     /** The page menu for one reader on one page. Everything an item needs is decided here, and only
      *  what this reader may use is passed: the markdown source and the history list never reach a
      *  reader who may not have them, so the browser has nothing to hide.
@@ -153,7 +196,7 @@ export function createArtifactRoutes(config) {
      *    link, since only they hold it.
      *  - Version history: whoever `history` lets see past versions (admins by default).
      *  - Copy the markdown: the owner and admins. */
-    function Menu({ a, reader, shutOut, allow, comments, history, viewing, source }) {
+    function Menu({ a, reader, shutOut, allow, comments, history, viewing, source, settings }) {
         const role = roleOf(reader);
         const admin = isAdmin(reader);
         const name = reader ? (firstName(reader, allow ?? []) ?? reader.email) : null;
@@ -162,7 +205,7 @@ export function createArtifactRoutes(config) {
             : a.password
                 ? (admin ? { url: `${pageUrl(a.id)}?key=${encodeURIComponent(a.password)}`, title: a.title, note: 'The link carries the password.' } : null)
                 : { url: pageUrl(a.id), title: a.title };
-        return (_jsx(PageMenu, { role: role, name: name, shutOut: shutOut, share: share, comments: !!comments, signIn: !reader && signInOrigin ? signInUrl(signInOrigin, pageUrl(a.id)) : null, signOut: reader ? signOutUrl(a.id) : null, history: history && history.length > 1 && seesHistory(reader) && viewing ? { items: history, base: pagePath(a.id), viewing } : null, markdown: admin && source ? source : null }));
+        return (_jsx(PageMenu, { role: role, name: name, shutOut: shutOut, share: share, comments: !!comments, signIn: !reader && signInOrigin ? signInUrl(signInOrigin, pageUrl(a.id)) : null, signOut: reader ? signOutUrl(a.id) : null, history: history && history.length > 1 && seesHistory(reader) && viewing ? { items: history, base: pagePath(a.id), viewing } : null, markdown: admin && source ? source : null, settings: admin ? settings ?? null : null }));
     }
     /** The kicker over every title: the pack's line, then who the page is for. Never spoken: the
      *  whole paragraph is data-nospeak, and narrationText has no `to` to read. */
@@ -255,7 +298,7 @@ export function createArtifactRoutes(config) {
         // says who they are. Only a host that signs readers in can know one; the read never fails the page.
         const reader = readerSecret() ? verifyGrant(readerSecret(), await readCookie(GRANT_COOKIE).catch(() => undefined)) : null;
         if (!open) {
-            return (_jsxs(BrandGround, { pack: pack, mode: a.theme, children: [_jsx(Menu, { a: a, reader: reader }), _jsxs("div", { className: "mx-auto max-w-2xl px-6 pt-24 pb-8 text-center sm:pt-28", children: [_jsx(Kicker, { to: a.to, brand: brand }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary })] }), _jsx(ArtifactDoor, { brand: brand, wrongKey: key !== undefined })] }));
+            return (_jsxs(BrandGround, { pack: pack, mode: a.theme, children: [_jsx(Menu, { a: a, reader: reader, settings: await settingsFor(a, reader) }), _jsxs("div", { className: "mx-auto max-w-2xl px-6 pt-24 pb-8 text-center sm:pt-28", children: [_jsx(Kicker, { to: a.to, brand: brand }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary })] }), _jsx(ArtifactDoor, { brand: brand, wrongKey: key !== undefined })] }));
         }
         const page = await render(true, reader);
         if (n === null)
@@ -282,14 +325,14 @@ export function createArtifactRoutes(config) {
                 else
                     void flagged;
             }
-            return (_jsxs(BrandGround, { pack: pack, mode: a.theme, children: [_jsx(Menu, { a: a, reader: reader, shutOut: d.why === 'not-allowed' }), header, d.why === 'not-allowed'
+            return (_jsxs(BrandGround, { pack: pack, mode: a.theme, children: [_jsx(Menu, { a: a, reader: reader, shutOut: d.why === 'not-allowed', settings: await settingsFor(a, reader) }), header, d.why === 'not-allowed'
                         ? _jsx(NotAllowedDoor, { brand: brand, reader: d.reader, signOutUrl: switchUrl(id) })
                         : _jsx(SignInDoor, { brand: brand, href: signInOrigin ? signInUrl(signInOrigin, here) : undefined, note: config.signInNote })] }));
         }
         const r = reader;
         // The agreement comes before the body, every reader, once per page. No agreement, no body.
         if (config.readers && !(await config.readers.acknowledged(id, r.email))) {
-            return (_jsxs(BrandGround, { pack: pack, mode: a.theme, children: [_jsx(Menu, { a: a, reader: r, allow: allow }), header, _jsx(AckDoor, { brand: brand, name: firstName(r, allow), email: r.email, owner: owner, pageId: id, signOutUrl: switchUrl(id) })] }));
+            return (_jsxs(BrandGround, { pack: pack, mode: a.theme, children: [_jsx(Menu, { a: a, reader: r, allow: allow, settings: await settingsFor(a, r) }), header, _jsx(AckDoor, { brand: brand, name: firstName(r, allow), email: r.email, owner: owner, pageId: id, signOutUrl: switchUrl(id) })] }));
         }
         const page = await render(false, r);
         if (n === null)
@@ -339,7 +382,7 @@ export function createArtifactRoutes(config) {
         const title = v.title ?? a.title;
         const summary = v.summary ?? a.summary;
         const toc = showToc(v.markdown, a.toc) ? tocOf(v.markdown) : [];
-        return (_jsxs(_Fragment, { children: [_jsx(Menu, { a: a, reader: reader, history: history, viewing: n, source: isAdmin(reader) ? sourceOf(a.id, { title, subtitle: v.subtitle, summary, to: v.to }, v.markdown) : null }), toc.length ? _jsx(TocRail, { items: toc }) : null, _jsx("div", { "data-nospeak": true, className: `mx-auto max-w-2xl px-6 ${top ? 'pt-20 sm:pt-24' : 'pt-8'}`, children: _jsxs("p", { "data-version-banner": true, role: "status", className: "rounded-lg border px-4 py-3 text-sm", style: { borderColor: brand.accent }, children: [`You are reading version ${n} of ${of}. `, _jsx("a", { href: pagePath(a.id), className: "underline underline-offset-4", style: { color: brand.accent }, children: "Read the current version" })] }) }), _jsx(Framed, { pack: pack, toc: toc.length ? _jsx(TocInline, { items: toc }) : null, cover: pack.Cover ? (_jsx(pack.Cover, { title: title, subtitle: v.subtitle, summary: summary, to: v.to, markdown: v.markdown, kicker: _jsx(Kicker, { to: v.to, brand: brand }), meta: _jsx(VersionLine, { n: n, at: v.at }), version: n, updatedAt: v.at, createdAt: a.createdAt })) : (_jsxs("div", { className: `mx-auto max-w-2xl px-6 ${top ? 'pt-10 sm:pt-12' : 'pt-10'} pb-8 text-center`, children: [_jsx(Kicker, { to: v.to, brand: brand }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: title }), v.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: v.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: summary }), _jsx(VersionLine, { n: n, at: v.at })] })), children: _jsx(ArtifactMarkdown, { markdown: v.markdown, simulator: config.simulatorEmbed ? { embed: config.simulatorEmbed } : undefined, messages: config.messagesEmbed ? { embed: config.messagesEmbed } : undefined, definitions: a.definitions, checklist: { artifactId: a.id, accent: brand.accent }, Section: pack.Section, figure: pack.figure }) })] }));
+        return (_jsxs(_Fragment, { children: [_jsx(Menu, { a: a, reader: reader, history: history, viewing: n, settings: await settingsFor(a, reader), source: isAdmin(reader) ? sourceOf(a.id, { title, subtitle: v.subtitle, summary, to: v.to }, v.markdown) : null }), toc.length ? _jsx(TocRail, { items: toc }) : null, _jsx("div", { "data-nospeak": true, className: `mx-auto max-w-2xl px-6 ${top ? 'pt-20 sm:pt-24' : 'pt-8'}`, children: _jsxs("p", { "data-version-banner": true, role: "status", className: "rounded-lg border px-4 py-3 text-sm", style: { borderColor: brand.accent }, children: [`You are reading version ${n} of ${of}. `, _jsx("a", { href: pagePath(a.id), className: "underline underline-offset-4", style: { color: brand.accent }, children: "Read the current version" })] }) }), _jsx(Framed, { pack: pack, toc: toc.length ? _jsx(TocInline, { items: toc }) : null, cover: pack.Cover ? (_jsx(pack.Cover, { title: title, subtitle: v.subtitle, summary: summary, to: v.to, markdown: v.markdown, kicker: _jsx(Kicker, { to: v.to, brand: brand }), meta: _jsx(VersionLine, { n: n, at: v.at }), version: n, updatedAt: v.at, createdAt: a.createdAt })) : (_jsxs("div", { className: `mx-auto max-w-2xl px-6 ${top ? 'pt-10 sm:pt-12' : 'pt-10'} pb-8 text-center`, children: [_jsx(Kicker, { to: v.to, brand: brand }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: title }), v.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: v.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: summary }), _jsx(VersionLine, { n: n, at: v.at })] })), children: _jsx(ArtifactMarkdown, { markdown: v.markdown, simulator: config.simulatorEmbed ? { embed: config.simulatorEmbed } : undefined, messages: config.messagesEmbed ? { embed: config.messagesEmbed } : undefined, definitions: a.definitions, checklist: { artifactId: a.id, accent: brand.accent }, Section: pack.Section, figure: pack.figure }) })] }));
     }
     /** The page itself, shared by open and gated pages. */
     async function Body(a, { top, reader }) {
@@ -360,7 +403,7 @@ export function createArtifactRoutes(config) {
         const mode = config.state && a.state && a.comments && a.comments !== 'off' && a.state.slots[COMMENTS_SLOT] ? a.comments : 'off';
         const history = await historyOf(a.id);
         const current = a.version ?? (a.versions?.length ?? 0) + 1;
-        return (_jsxs(_Fragment, { children: [_jsx(Menu, { a: a, reader: reader, comments: mode !== 'off', history: history, viewing: current, source: isAdmin(reader) ? sourceOf(a.id, a, a.markdown) : null }), toc.length ? _jsx(TocRail, { items: toc }) : null, _jsx("div", { id: "artifact-narration-root", children: await (async () => {
+        return (_jsxs(_Fragment, { children: [_jsx(Menu, { a: a, reader: reader, comments: mode !== 'off', history: history, viewing: current, settings: await settingsFor(a, reader), source: isAdmin(reader) ? sourceOf(a.id, a, a.markdown) : null }), toc.length ? _jsx(TocRail, { items: toc }) : null, _jsx("div", { id: "artifact-narration-root", children: await (async () => {
                         const n = a.version ?? (a.versions?.length ?? 0) + 1;
                         const meta = (_jsxs(_Fragment, { children: [_jsx(VersionLine, { n: n, at: a.updatedAt }), top && reader ? (_jsxs("p", { "data-nospeak": true, "data-reader-line": true, className: "mt-2 text-xs opacity-60", children: [`Signed in as ${reader.email} · `, _jsx("a", { href: switchUrl(a.id), className: "underline", children: "Use a different account" }), ' · ', _jsx("a", { href: signOutUrl(a.id), className: "underline", children: "Sign out" })] })) : null] }));
                         const header = pack.Cover ? (_jsx(pack.Cover, { title: a.title, subtitle: a.subtitle, summary: a.summary, to: a.to, markdown: a.markdown, kicker: _jsx(Kicker, { to: a.to, brand: brand }), meta: meta, version: n, updatedAt: a.updatedAt, createdAt: a.createdAt })) : (_jsxs("div", { className: `mx-auto max-w-2xl px-6 ${top ? 'pt-24 sm:pt-28' : 'pt-12'} pb-8 text-center`, children: [_jsx(Kicker, { to: a.to, brand: brand }), _jsx("h1", { className: "text-4xl sm:text-5xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.title }), a.subtitle ? (_jsx("p", { className: "mx-auto mt-4 max-w-xl text-xl sm:text-2xl", style: { fontFamily: brand.type.display, color: brand.ink }, children: a.subtitle })) : null, _jsx("p", { className: "mx-auto mt-6 max-w-xl text-lg italic opacity-80", children: a.summary }), meta] }));
@@ -501,6 +544,107 @@ export function createArtifactRoutes(config) {
         const readers = await config.readers.allow(id, add, remove);
         return NextResponse.json({ id, access, readers });
     }
+    /** GET|POST /api/artifacts/<id>/settings: the page menu's Share settings and Comment settings
+     *  (0.31.0). Signed in as the owner or an admin of this host, by the reader grant; nobody else,
+     *  and never the publish key, which belongs to a session rather than a person on the page.
+     *  Everyone else is refused before the page is even looked up, so a refusal says nothing about
+     *  it. A POST must come from this host's own pages (Origin, Sec-Fetch-Site) as JSON, which a
+     *  cross-site form cannot send. Body, every field optional:
+     *  { access: 'public'|'freedom'|'invite', password: 'on'|'off', comments: 'off'|'anyone'|'signed-in',
+     *    commentsVisible: 'owner'|'readers', add: [{ email, name? }], remove: [email] }.
+     *  Answers with the settings as the sheet shows them. */
+    async function SETTINGS(request, { params }) {
+        const no = (error, status) => NextResponse.json({ error }, { status, headers: { 'cache-control': 'no-store' } });
+        const reader = verifyGrant(readerSecret(), request.cookies.get(GRANT_COOKIE)?.value);
+        if (!reader)
+            return no('sign in to change this page', 401);
+        if (!isAdmin(reader))
+            return no('only the owner and this hub\'s admins change a page\'s settings', 403);
+        if (!store.setSettings)
+            return no('this store cannot change settings', 501);
+        const { id } = await params;
+        const a = ARTIFACT_ID.test(id) ? await store.get(id) : null;
+        if (!a)
+            return no(`no artifact with id ${id}`, 404);
+        const view = async (rec) => NextResponse.json(await settingsFor(rec, reader), { headers: { 'cache-control': 'no-store' } });
+        if (request.method === 'GET')
+            return view(a);
+        const origin = request.headers.get('origin');
+        const site = request.headers.get('sec-fetch-site');
+        if ((origin !== null && origin !== new URL(siteUrl).origin) || (site !== null && site !== 'same-origin'))
+            return no('wrong origin', 403);
+        if (!/^application\/json\b/i.test(request.headers.get('content-type') ?? ''))
+            return no('send JSON', 415);
+        const raw = await request.text();
+        if (raw.length > 8192)
+            return no('too long', 413);
+        let b;
+        try {
+            b = JSON.parse(raw);
+        }
+        catch {
+            return no('the body is not JSON', 400);
+        }
+        if (!b || typeof b !== 'object' || Array.isArray(b))
+            return no('the body is an object', 400);
+        const KEYS = ['access', 'password', 'comments', 'commentsVisible', 'add', 'remove'];
+        const unknown = Object.keys(b).filter((k) => !KEYS.includes(k));
+        if (unknown.length)
+            return no(`unknown setting: ${unknown.join(', ')}`, 400);
+        const patch = {};
+        if (b.access !== undefined) {
+            if (b.access !== 'public' && !ACCESS_LEVELS.includes(b.access))
+                return no(`access must be one of: public, ${ACCESS_LEVELS.join(', ')}`, 400);
+            // Without a reader record a gated page is shut to everyone; the sheet never offers it.
+            if (b.access !== 'public' && !config.readers)
+                return no('this host keeps no reader list, so a page here is public or has a password', 400);
+            patch.access = b.access;
+        }
+        if (b.password !== undefined) {
+            if (b.password !== 'on' && b.password !== 'off')
+                return no('password is on or off', 400);
+            patch.password = b.password === 'off' ? null : (a.password ?? newPageKey());
+        }
+        if (b.comments !== undefined) {
+            if (!COMMENTS_MODES.includes(b.comments))
+                return no(`comments must be one of: ${COMMENTS_MODES.join(', ')}`, 400);
+            patch.comments = b.comments;
+        }
+        if (b.commentsVisible !== undefined) {
+            if (b.commentsVisible !== 'owner' && b.commentsVisible !== 'readers')
+                return no('commentsVisible is owner or readers', 400);
+            patch.commentsVisible = b.commentsVisible;
+        }
+        if ((patch.comments !== undefined || patch.commentsVisible !== undefined) && !config.state)
+            return no('this host keeps no comments', 400);
+        const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        const add = b.add === undefined ? [] : b.add;
+        const remove = b.remove === undefined ? [] : b.remove;
+        if (!Array.isArray(add) || add.length > 50 || !add.every((e) => !!e && typeof e === 'object' && typeof e.email === 'string'
+            && EMAIL.test(e.email.trim()) && e.email.length <= 254
+            && (e.name === undefined || (typeof e.name === 'string' && (e.name).length <= 120))))
+            return no('add is a list of { email, name? } with a valid email', 400);
+        if (!Array.isArray(remove) || remove.length > 50 || !remove.every((e) => typeof e === 'string' && e.length <= 254))
+            return no('remove is a list of emails', 400);
+        if ((add.length || remove.length) && !config.readers)
+            return no('this host keeps no reader list', 400);
+        let rec = a;
+        if (Object.keys(patch).length) {
+            try {
+                rec = await store.setSettings(id, patch);
+            }
+            catch (e) {
+                return no(e instanceof Error ? e.message : 'could not change the settings', 409);
+            }
+            if (!rec)
+                return no(`no artifact with id ${id}`, 404);
+        }
+        if (add.length || remove.length) {
+            await config.readers.allow(id, add.map((e) => ({ email: e.email.trim(), ...(e.name ? { name: e.name.trim() } : {}) })), remove);
+        }
+        revalidatePath(pagePath(id));
+        return view(rec);
+    }
     /** GET /api/artifacts/<id>/reads, publish key: who read it, for how long, how far, and every
      *  attempt to take it away or to open it without being let in. */
     async function READS(request, { params }) {
@@ -684,5 +828,5 @@ export function createArtifactRoutes(config) {
         revalidatePath(pagePath(id));
         return NextResponse.json({ deleted: true });
     }
-    return { Page, generateMetadata, VersionPage, generateVersionMetadata, VERSIONS, POST, GET, DELETE, PUT_ASSET, UPLOAD, SHARE_IMAGE, ENTER, LEAVE, TRACK, ACK, ACCESS, READS, sweepReaders, TRANSCRIBE: voiceRoutes.TRANSCRIBE, ...stateRoutes, ...personalRoutes, dynamic: 'force-dynamic', maxDuration: 30 };
+    return { Page, generateMetadata, VersionPage, generateVersionMetadata, VERSIONS, POST, GET, DELETE, PUT_ASSET, UPLOAD, SHARE_IMAGE, ENTER, LEAVE, TRACK, ACK, ACCESS, SETTINGS, READS, sweepReaders, TRANSCRIBE: voiceRoutes.TRANSCRIBE, ...stateRoutes, ...personalRoutes, dynamic: 'force-dynamic', maxDuration: 30 };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/artifacts",
-  "version": "0.30.2",
+  "version": "0.31.0",
   "description": "Publish markdown as branded, read-aloud pages from a Next.js app: the artifacts store, the route factory, the read-along reader, brand packs, password and confidential pages, and share cards.",
   "license": "MIT",
   "type": "module",