@supersuit/artifacts 0.47.0 → 0.49.0

package/CHANGELOG.md

@@ -3,6 +3,50 @@
 `@supersuit/artifacts`. One entry per version, newest first. Each entry says what changed, how a
 host can tell whether it is affected (DETECTOR), what a host does about it (REMEDY), and the tests.
 
+## 0.49.0 (2026-10-16)
+
+**The default look is Supersuit's, the Maison.** The product the default pack is named for became
+Supersuit on 2026-10-14, and its maker's house look, the Maison, became the brand on 2026-10-15.
+`freedomDefault` (the export keeps its name, so no host breaks) now reads "A page from Supersuit"
+and names Supersuit in metadata (`siteName`); paints night `#17171a` with mist `#d8d1c4` and bronze
+`#a8834f` by default and travertine `#e8e0d2` with ink `#1c1a17` and bronze deepened with ink in
+light mode, each text and accent pairing at 4.5:1 or better; and sets DM Serif Display over DM Sans
+by name (Georgia and the system face if a host does not load them; README, "The default look's
+faces"). The default mark (`BrandMark` with no `Mark`) is a short rule in the accent instead of a
+dove: the dove stood for the agent, and no figure stands in for her until her look is designed.
+What a reader reads moves with the name: the confidential door's default line ("the Google account
+your Supersuit account uses"), the member reason ("you are a Supersuit user"), and the share
+sheet's "Any Supersuit account" and "Supersuit accounts get in without being on the list." The
+`freedom` access level keeps its identifier. A pack of a host's own is untouched, and the share
+card keeps the bundled Newsreader so no tracing config changes.
+
+- DETECTOR: a host whose operators have no pack of their own (`freedomDefault`, or a spread of it
+  with only the kicker changed) renders on the night ground with bronze, not the old near-black and
+  gold, and its kicker says Supersuit.
+- REMEDY: nothing required. To draw the default look in its own faces, load DM Serif Display and
+  DM Sans in the host's root layout (README).
+- Tests: pack.test.tsx (the default look: tokens only, 4.5:1 pairings, the house pair, no dove, no
+  Freedom), the default-pages golden regenerated on purpose (palette, faces and kicker only), and
+  the kicker, metadata and door expectations in artifacts, to, extension-points and gated.
+
+## 0.48.0
+
+**Unpublishing keeps the history.** `POST /api/artifacts?id=<id>&unpublish=1` takes a page off the
+web and keeps everything that happened on it: the record, every version, every comment, every
+file. Every reader-facing path (the page, its versions, its share card, comments, answers, per-reader
+links) reads through a view of the store that does not see an unpublished page, so each answers
+404; the publisher's own routes (publish, the narration GET, uploads, DELETE) still reach it. A
+republish to the id puts the page back at the same link. Until now the only way to take a page
+down was DELETE, which destroys every version and every comment for good. DELETE is unchanged,
+and is now the explicit "destroy" rather than the only "take down". The new store method is
+`setUnpublished(id, at | null)`; the Firestore store has it, and a store without it answers 501.
+On the publish route rather than a new one, so no host has a route file to add, and a host older
+than this answers the empty body with a 400 and changes nothing.
+
+- DETECTOR: a publisher that sends `?unpublish=1` and gets a 400 is talking to a host before 0.48.0.
+- REMEDY: update the dependency. Nothing to configure.
+- Tests: unpublish.test.tsx.
+
 ## 0.47.0
 
 **Figures and Helm scenes play inline, as two new embed fences.** A ```` ```figure ```` block

package/README.md

@@ -5,7 +5,7 @@ site shell behind that: the store, the route handlers, the read-along reader, br
 password pages, confidential pages with a signed-in reader list, and the share card a link
 unfurls as. You mount it in a Next.js App Router app with a handful of one-line route files.
 
-It is the shell that serves every Freedom operator's `artifacts.<theirname>` page, published
+It is the shell that serves every Supersuit operator's `artifacts.<theirname>` page, published
 openly because none of it is secret and all of it is better with more eyes on it.
 
 ```bash
@@ -23,7 +23,7 @@ Firestore), and optionally `@google-cloud/storage >= 7` for uploaded files.
 | `createArtifactStore(db, path)` | Firestore store for pages and their version history, under any collection path |
 | `createReadersStore(db, path)` | The record for confidential pages: allowlist, agreements, reading sessions, flags |
 | `createArtifactAssets(bucket, prefix, { privateBucket? })` | Uploaded images for a page, in a Cloud Storage bucket; private media in a separate private bucket |
-| `freedomDefault`, `BrandPack` | The default look and the type any other look implements |
+| `freedomDefault`, `BrandPack` | The default look (Supersuit's, the Maison) and the type any other look implements |
 | `BrandGround`, `BrandMark` | The pack's page backdrop and mark, for your own pages (a home, a 404) |
 | `parseArtifactSource` | The front-matter contract, as a parser you can call before publishing (widget fences included) |
 | `headingsOf`, `scanWidgets`, `placeNotes` | The notes widget's pure parts: heading slugs, fence validation, where each note shows |
@@ -116,6 +116,13 @@ hostname and pick by the `host` header.
 body. The response carries the page's id and URL. Posting a file whose front matter carries
 that `id:` republishes it in place, keeping every earlier version.
 
+**Taking a page down keeps its history (0.48.0).** `POST /api/artifacts?id=<id>&unpublish=1`
+(publish key, empty body) takes the page off the web: every reader path answers 404, and the
+record, every version, every comment and every file are kept. Republishing to that id puts it back
+at the same link. `DELETE /api/artifacts/<id>` is the separate act that destroys all of it. A host
+older than 0.48.0 answers the unpublish with a 400 and changes nothing, so a publisher can never
+mistake it for a delete; a store without `setUnpublished` answers 501, likewise changing nothing.
+
 ## The page menu
 
 Every page, past version and door carries one small round **⋯** button in the top right corner
@@ -157,7 +164,7 @@ anyone else. `PageMenu`, `roleLine` and `menuItems` are exported from `/reader`.
 The owner and the hub's admins change a page's settings from the menu, with no republish. Each item
 opens a sheet (from the bottom on a phone, under the button on a desk):
 
-- **Share settings.** Who can open it: anyone with the link, any Freedom account (plus the list),
+- **Share settings.** Who can open it: anyone with the link, any Supersuit account (plus the list),
   or only the list. The list itself: add or remove an email. On a page open to anyone, a password
   on or off (on makes a 12-character key). The link to send, with a Copy button: on a password page
   it carries the key. Under them, read-only lines: what a stranger with the bare URL sees and what
@@ -307,7 +314,7 @@ their change alone.
 
 ## A confidential page (`access:`)
 
-`access: freedom` opens the page only to a signed-in reader with an active Freedom account or
+`access: freedom` opens the page only to a signed-in reader with an active Supersuit account or
 on the page's list; `access: invite` opens it only to the list. Everyone else gets the title,
 the summary and a sign-in door; the body never reaches them.
 
@@ -1174,6 +1181,16 @@ an optional full-page `Wrapper` and `Mark`, and an optional `share` block
 (a font loader and a backdrop) that draws the unfurl card. `freedomDefault` is the default look.
 Keep a pack carrying your own trademark in your own app, not in a pull request here.
 
+**The default look's faces.** Since 0.49.0 `freedomDefault` is Supersuit's own look, the Maison:
+night with mist type and bronze by default, travertine with ink behind the light toggle, every
+colour one of seven stone tokens or a mix of two, and the mark above the kicker a short rule in
+the accent (no dove). It sets DM Serif Display for headings and DM Sans for reading, by name. The
+package does not fetch them, so a host that wants them loads them itself, for example
+`import '@fontsource/dm-serif-display/400.css'` and `import '@fontsource/dm-sans/400.css'` (plus
+500 and 600) in its root layout, which serves the files from the host's own origin. A host that
+does not falls back to Georgia and the system face. The share card still sets its title in the
+bundled Newsreader, so no host's `outputFileTracingIncludes` has to change.
+
 **Light, dark or system.** A pack's `ground`, `ink` and `accent` are its dark palette; `light` is
 the other one (absent, warm paper with the pack's accent), and `mode` is the one a page opens in
 (`dark` by default; a page's `theme:` overrides it). Pages paint with CSS variables

package/lib/artifacts/confidential.d.ts

@@ -25,9 +25,10 @@ export declare function Watermark({ email }: {
 }): import("react").JSX.Element;
 /** Printing shows this and nothing else, whichever way the print dialog was reached. */
 export declare const NO_PRINT_CSS = "@media print { body * { visibility: hidden !important; } body::after { content: \"This page is confidential and cannot be printed.\"; visibility: visible; position: fixed; top: 40%; left: 0; right: 0; text-align: center; font: 16px sans-serif; color: #000; } }";
-/** The door's default line, for a host whose readers sign in with a Freedom account. A host
+/** The door's default line, for a host whose readers sign in with a Supersuit account (the product
+ *  called Freedom until 2026-10-14; the access level keeps its `freedom` identifier). A host
  *  that signs readers in some other way passes `signInNote` to say so in its own words. */
-export declare const DEFAULT_SIGN_IN_NOTE = "This page is confidential. Sign in with the Google account your Freedom account uses, or the address it was shared with.";
+export declare const DEFAULT_SIGN_IN_NOTE = "This page is confidential. Sign in with the Google account your Supersuit account uses, or the address it was shared with.";
 export declare function SignInDoor({ brand, href, note }: {
     brand: BrandPack;
     href?: string;

package/lib/artifacts/confidential.js

@@ -19,9 +19,10 @@ export function Watermark({ email }) {
 }
 /** Printing shows this and nothing else, whichever way the print dialog was reached. */
 export const NO_PRINT_CSS = `@media print { body * { visibility: hidden !important; } body::after { content: "This page is confidential and cannot be printed."; visibility: visible; position: fixed; top: 40%; left: 0; right: 0; text-align: center; font: 16px sans-serif; color: #000; } }`;
-/** The door's default line, for a host whose readers sign in with a Freedom account. A host
+/** The door's default line, for a host whose readers sign in with a Supersuit account (the product
+ *  called Freedom until 2026-10-14; the access level keeps its `freedom` identifier). A host
  *  that signs readers in some other way passes `signInNote` to say so in its own words. */
-export const DEFAULT_SIGN_IN_NOTE = 'This page is confidential. Sign in with the Google account your Freedom account uses, or the address it was shared with.';
+export const DEFAULT_SIGN_IN_NOTE = 'This page is confidential. Sign in with the Google account your Supersuit account uses, or the address it was shared with.';
 export function SignInDoor({ brand, href, note = DEFAULT_SIGN_IN_NOTE }) {
     // No href means the host configured no sign-in authority: the door stays, with no way through.
     if (!href) {

package/lib/artifacts/reader.d.ts

@@ -50,7 +50,7 @@ export type Decision = {
     why: 'not-allowed';
     reader: Reader;
 };
-export declare const MEMBER_REASON = "you are a Freedom user";
+export declare const MEMBER_REASON = "you are a Supersuit user";
 export declare const LISTED_REASON = "you were given access to it by name";
 export declare const STAFF_REASON = "you are its owner or an admin of this hub";
 /** Whether this reader may open a page with this access level. The allowlist opens both

package/lib/artifacts/reader.js

@@ -90,7 +90,7 @@ export function mintGrant(secret, reader, now = Date.now()) {
 export function verifyGrant(secret, grant, now = Date.now()) {
     return decode(secret, 'artifact-grant', 'g1', grant, now);
 }
-export const MEMBER_REASON = 'you are a Freedom user';
+export const MEMBER_REASON = 'you are a Supersuit user';
 export const LISTED_REASON = 'you were given access to it by name';
 export const STAFF_REASON = 'you are its owner or an admin of this hub';
 /** Whether this reader may open a page with this access level. The allowlist opens both

package/lib/artifacts/store.d.ts

@@ -57,6 +57,10 @@ export type ArtifactRecord = {
      *  given: a version is never described by anything its author did not write. */
     note?: string;
     views: number;
+    /** When the page was taken off the web (0.48.0). The record, every version, every comment and
+     *  every file are KEPT: an unpublished page is served to no reader, and a republish to its id
+     *  puts it back. DELETE is the separate act that destroys. */
+    unpublishedAt?: string;
 };
 /** One line of a page's history. `at` is when that version went live. */
 export type VersionEntry = {
@@ -130,6 +134,9 @@ export interface ArtifactStore {
     version?(id: string, n: number): Promise<VersionRecord | null>;
     /** Write (or, with null, clear) the change note on one version after the fact. */
     setNote?(id: string, n: number, note: string | null): Promise<boolean>;
+    /** Take a page off the web keeping everything (an ISO time), or put it back (null). False when
+     *  no such page. A store without it can only destroy, and the host refuses to unpublish. */
+    setUnpublished?(id: string, at: string | null): Promise<boolean>;
     /** Every page of one kind, newest first, without bodies (0.37.0): the owner's documents and the
      *  owner's broadcasts are two lists. */
     list?(kind: ArtifactKind): Promise<ArtifactListItem[]>;

package/lib/artifacts/store.js

@@ -69,6 +69,13 @@ export function createArtifactStore(db, collection = 'artifacts') {
         history: (id) => historyOf(col, id),
         version: (id, n) => versionOf(col, id, n),
         setNote: (id, n, note) => setNote(col, id, n, note),
+        setUnpublished: async (id, at) => {
+            const ref = col().doc(id);
+            if (!(await ref.get()).exists)
+                return false;
+            await ref.update({ unpublishedAt: at ?? FieldValue.delete() });
+            return true;
+        },
         list: async (kind) => {
             // `select` keeps every body out of the listing; a tenant's pages number in the hundreds.
             const snap = await col().select('title', 'summary', 'template', 'createdAt', 'updatedAt', 'views').get();
@@ -231,6 +238,8 @@ async function saveArtifact(col, input) {
             // `updatedAt` is when this version went live; finishing its own publish does not move it.
             ...(fresh || input.markdown !== existing.markdown ? { updatedAt: now } : {}),
             note: nextNote ?? FieldValue.delete(),
+            // A republish is the page going back up: an unpublished page is live again at the same link.
+            unpublishedAt: FieldValue.delete(),
             ...(existing.versions ? { versions: FieldValue.delete() } : {}),
         });
         return { id: input.id, version: next, created: false };

package/lib/brand/pack.d.ts

@@ -38,7 +38,7 @@ export type BrandPack = {
     };
     /** The small uppercase line above a title, e.g. "From Sam Rivera". */
     kicker: string;
-    /** Unused since 0.33.1: the player bar names no narrator (it read "Read aloud by Freedom").
+    /** Unused since 0.33.1: the player bar names no narrator.
      *  Optional so a pack that still sets it compiles; nothing reads it. */
     narratorLabel?: (voice?: string) => string;
     /** Optional full-page backdrop. Receives the page as children. */
@@ -140,4 +140,19 @@ export type ShareCardAssets = {
      *  a blur or a glow is baked in here; the renderer only sets type. Absent, `ground` fills. */
     backdrop?: () => Promise<string>;
 };
+/**
+ * THE DEFAULT LOOK: Supersuit's own, for every operator with no pack of their own. Named
+ * `freedomDefault` because the product was Freedom until 2026-10-14; the export keeps its name so
+ * no host breaks, and everything a reader sees says Supersuit.
+ *
+ * Since 0.49.0 it is the Maison, the house look of Supersuit's maker: stone, and colour only for
+ * context. Night (#17171a) with mist type and bronze by default; travertine with ink one tap away,
+ * its accent bronze deepened with ink so a link reads at 4.5:1. Every value is one of the house's
+ * seven tokens or a mix of two (night, walnut, travertine, marble, bronze, ink, mist). The dark
+ * palette stays plain hex because the share card draws with it and its renderer has no color-mix().
+ *
+ * Type is the house pair: DM Serif Display to inscribe, DM Sans to read. Both are named, not
+ * fetched: a host loads them (README, "The default look's faces"), and one that does not falls back
+ * to Georgia and the system face rather than asking a font service for them on every page view.
+ */
 export declare const freedomDefault: BrandPack;

package/lib/brand/pack.js

@@ -1,16 +1,31 @@
 import { newsreader } from './default-share.js';
+/**
+ * THE DEFAULT LOOK: Supersuit's own, for every operator with no pack of their own. Named
+ * `freedomDefault` because the product was Freedom until 2026-10-14; the export keeps its name so
+ * no host breaks, and everything a reader sees says Supersuit.
+ *
+ * Since 0.49.0 it is the Maison, the house look of Supersuit's maker: stone, and colour only for
+ * context. Night (#17171a) with mist type and bronze by default; travertine with ink one tap away,
+ * its accent bronze deepened with ink so a link reads at 4.5:1. Every value is one of the house's
+ * seven tokens or a mix of two (night, walnut, travertine, marble, bronze, ink, mist). The dark
+ * palette stays plain hex because the share card draws with it and its renderer has no color-mix().
+ *
+ * Type is the house pair: DM Serif Display to inscribe, DM Sans to read. Both are named, not
+ * fetched: a host loads them (README, "The default look's faces"), and one that does not falls back
+ * to Georgia and the system face rather than asking a font service for them on every page view.
+ */
 export const freedomDefault = {
     id: 'freedom-default',
-    name: 'Freedom',
-    ground: '#0e0f13',
-    ink: '#ece7dc',
-    accent: '#c9a96e',
-    light: { ground: '#f6f1e7', ink: '#1c1a17', accent: '#8a6a2c' },
+    name: 'Supersuit',
+    ground: '#17171a',
+    ink: '#d8d1c4',
+    accent: '#a8834f',
+    light: { ground: '#e8e0d2', ink: '#1c1a17', accent: 'color-mix(in srgb,#a8834f 60%,#1c1a17)' },
     type: {
-        display: 'Georgia, "Iowan Old Style", "Times New Roman", serif',
-        body: 'ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif',
+        display: '"DM Serif Display", Georgia, "Times New Roman", serif',
+        body: '"DM Sans", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif',
     },
-    kicker: 'A page from Freedom',
+    kicker: 'A page from Supersuit',
     // Pages unfurl as their title on the ground colour. A pack with a backdrop of its own
     // overrides this whole field.
     share: { font: newsreader },

package/lib/brand/wrapper.d.ts

@@ -9,7 +9,8 @@ export declare function BrandGround({ pack, mode, children }: {
     mode?: ThemeMode;
     children: ReactNode;
 }): import("react").JSX.Element;
-/** The mark above the kicker: the pack's own, else a small dove. */
+/** The mark above the kicker: the pack's own, else a short rule in the accent. Not a dove: the dove
+ *  stood for the agent, and no bird or figure stands in for her until her own look is designed. */
 export declare function BrandMark({ pack, className }: {
     pack: BrandPack;
     className?: string;

package/lib/brand/wrapper.js

@@ -15,9 +15,10 @@ export function BrandGround({ pack, mode, children }) {
         // isolation puts the fixed backdrop (z-index -1) above this ground and below the page.
         style: { background: 'var(--a-ground)', color: 'var(--a-ink)', fontFamily: pack.type.body, position: 'relative', isolation: 'isolate' }, children: [css, pack.backdrop?.kind === 'bubbles' ? _jsx(Bubbles, { backdrop: pack.backdrop }) : null, children] }));
 }
-/** The mark above the kicker: the pack's own, else a small dove. */
+/** The mark above the kicker: the pack's own, else a short rule in the accent. Not a dove: the dove
+ *  stood for the agent, and no bird or figure stands in for her until her own look is designed. */
 export function BrandMark({ pack, className }) {
     if (pack.Mark)
         return _jsx(pack.Mark, { className: className });
-    return (_jsx("span", { "data-brand-mark": pack.id, "aria-hidden": true, className: className, style: { color: pack.accent }, children: "\uD83D\uDD4A" }));
+    return (_jsx("span", { "data-brand-mark": pack.id, "aria-hidden": true, className: className, style: { display: 'inline-block', width: 28, height: 1, verticalAlign: 'middle', background: pack.accent } }));
 }

package/lib/reader/settings-sheet.js

@@ -13,7 +13,7 @@ import { useEffect, useRef, useState } from 'react';
 import { NO_ZOOM_FONT } from './no-zoom.js';
 export const ACCESS_LABEL = {
     public: 'Anyone with the link',
-    freedom: 'Any Freedom account',
+    freedom: 'Any Supersuit account',
     invite: 'Only the list',
 };
 export const COMMENTS_LABEL = { anyone: 'Anyone', 'signed-in': 'Signed-in readers', off: 'Nobody' };
@@ -132,7 +132,7 @@ export function SettingsSheet({ kind, settings, phone, vars, onClose, onCopy, sa
     const primary = { ...btn, background: 'var(--a-accent, #111)', borderColor: 'var(--a-accent, #111)', color: 'var(--a-ground, #fff)', fontWeight: 600 };
     const muted = { margin: '4px 0 0', fontSize: 12, opacity: 0.65 };
     const radio = (name, value, current, set, label, note) => (_jsxs("label", { style: choice, "data-settings-choice": `${name}:${value}`, children: [_jsx("input", { type: "radio", name: name, value: value, checked: current === value, onChange: () => set(value), style: { width: 18, height: 18, margin: 0, accentColor: 'var(--a-accent, #111)' } }), _jsxs("span", { children: [label, note ? _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: note }) : null] })] }, value));
-    const share = (_jsxs(_Fragment, { children: [_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Who can open it" }), s.levels.map((l) => radio('access', l, access, setAccess, ACCESS_LABEL[l], l === 'freedom' ? 'Plus anyone on the list' : undefined))] }), access === 'public' ? (_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Password" }), _jsxs("label", { style: choice, "data-settings-choice": "password", children: [_jsx("input", { type: "checkbox", checked: password, onChange: (e) => setPassword(e.target.checked), style: { width: 18, height: 18, margin: 0, accentColor: 'var(--a-accent, #111)' } }), _jsxs("span", { children: ["Require a password", _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: "The link to send carries the key" })] })] })] })) : null, dirty || busy ? (_jsxs("div", { style: { display: 'flex', gap: 8, margin: '0 0 14px' }, children: [_jsx("button", { type: "button", "data-settings-save": true, onClick: () => void save(), disabled: busy, style: primary, children: busy ? 'Saving' : 'Save' }), _jsx("button", { type: "button", onClick: () => { setAccess(s.access); setPassword(s.password); }, disabled: busy, style: btn, children: "Undo" })] })) : null, s.list && s.access !== 'public' ? (_jsxs("fieldset", { style: fieldset, "data-settings-list": true, children: [_jsx("legend", { style: legend, children: `The list (${s.list.length})` }), s.list.length === 0 ? _jsx("p", { style: { ...muted, margin: '0 0 6px' }, children: "Nobody yet." }) : null, _jsx("ul", { style: { listStyle: 'none', margin: '0 0 8px', padding: 0 }, children: s.list.map((e) => (_jsxs("li", { "data-settings-list-entry": e.email, style: { display: 'flex', alignItems: 'center', gap: 8, padding: '4px 0', borderBottom: '1px solid var(--a-line, rgba(127,127,127,0.2))' }, children: [_jsx("span", { style: { flex: 1, minWidth: 0, overflowWrap: 'anywhere' }, children: e.name ? _jsxs(_Fragment, { children: [e.name, _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: e.email })] }) : e.email }), _jsx("button", { type: "button", "aria-label": `Remove ${e.email}`, onClick: () => void listChange({ remove: [e.email] }), disabled: busy, style: btn, children: "Remove" })] }, e.email))) }), _jsxs("form", { onSubmit: onAdd, style: { display: 'flex', gap: 8 }, children: [_jsx("input", { type: "email", inputMode: "email", autoComplete: "off", placeholder: "name@example.com", "aria-label": "Email to add", value: email, onChange: (e) => setEmail(e.target.value), style: { flex: 1, minWidth: 0, font: 'inherit', ...NO_ZOOM_FONT, padding: phone ? '8px 10px' : '6px 8px', borderRadius: 8, border: '1px solid var(--a-line, rgba(127,127,127,0.4))', background: 'transparent', color: 'inherit' } }), _jsx("button", { type: "submit", disabled: busy, style: btn, children: "Add" })] }), s.access === 'invite' ? null : _jsx("p", { style: muted, children: "Freedom accounts get in without being on the list." })] })) : null, _jsxs("div", { style: { margin: '0 0 14px' }, "data-settings-link": true, children: [_jsx("p", { style: legend, children: "The link to send" }), _jsxs("div", { style: { display: 'flex', gap: 8, alignItems: 'center' }, children: [_jsx("code", { style: { flex: 1, minWidth: 0, fontSize: 13, overflowWrap: 'anywhere' }, children: s.link }), _jsx("button", { type: "button", onClick: () => void copy(), style: btn, children: "Copy" })] })] }), s.facts.length ? (_jsx("dl", { style: { display: 'grid', gap: 8, margin: 0 }, "data-settings-facts": true, children: s.facts.map((f) => (_jsxs("div", { children: [_jsx("dt", { style: { fontSize: 12, fontWeight: 600, opacity: 0.7 }, children: f.label }), _jsx("dd", { style: { margin: 0, fontSize: 13, opacity: 0.85 }, children: f.text })] }, f.label))) })) : null] }));
+    const share = (_jsxs(_Fragment, { children: [_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Who can open it" }), s.levels.map((l) => radio('access', l, access, setAccess, ACCESS_LABEL[l], l === 'freedom' ? 'Plus anyone on the list' : undefined))] }), access === 'public' ? (_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Password" }), _jsxs("label", { style: choice, "data-settings-choice": "password", children: [_jsx("input", { type: "checkbox", checked: password, onChange: (e) => setPassword(e.target.checked), style: { width: 18, height: 18, margin: 0, accentColor: 'var(--a-accent, #111)' } }), _jsxs("span", { children: ["Require a password", _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: "The link to send carries the key" })] })] })] })) : null, dirty || busy ? (_jsxs("div", { style: { display: 'flex', gap: 8, margin: '0 0 14px' }, children: [_jsx("button", { type: "button", "data-settings-save": true, onClick: () => void save(), disabled: busy, style: primary, children: busy ? 'Saving' : 'Save' }), _jsx("button", { type: "button", onClick: () => { setAccess(s.access); setPassword(s.password); }, disabled: busy, style: btn, children: "Undo" })] })) : null, s.list && s.access !== 'public' ? (_jsxs("fieldset", { style: fieldset, "data-settings-list": true, children: [_jsx("legend", { style: legend, children: `The list (${s.list.length})` }), s.list.length === 0 ? _jsx("p", { style: { ...muted, margin: '0 0 6px' }, children: "Nobody yet." }) : null, _jsx("ul", { style: { listStyle: 'none', margin: '0 0 8px', padding: 0 }, children: s.list.map((e) => (_jsxs("li", { "data-settings-list-entry": e.email, style: { display: 'flex', alignItems: 'center', gap: 8, padding: '4px 0', borderBottom: '1px solid var(--a-line, rgba(127,127,127,0.2))' }, children: [_jsx("span", { style: { flex: 1, minWidth: 0, overflowWrap: 'anywhere' }, children: e.name ? _jsxs(_Fragment, { children: [e.name, _jsx("span", { style: { display: 'block', fontSize: 12, opacity: 0.6 }, children: e.email })] }) : e.email }), _jsx("button", { type: "button", "aria-label": `Remove ${e.email}`, onClick: () => void listChange({ remove: [e.email] }), disabled: busy, style: btn, children: "Remove" })] }, e.email))) }), _jsxs("form", { onSubmit: onAdd, style: { display: 'flex', gap: 8 }, children: [_jsx("input", { type: "email", inputMode: "email", autoComplete: "off", placeholder: "name@example.com", "aria-label": "Email to add", value: email, onChange: (e) => setEmail(e.target.value), style: { flex: 1, minWidth: 0, font: 'inherit', ...NO_ZOOM_FONT, padding: phone ? '8px 10px' : '6px 8px', borderRadius: 8, border: '1px solid var(--a-line, rgba(127,127,127,0.4))', background: 'transparent', color: 'inherit' } }), _jsx("button", { type: "submit", disabled: busy, style: btn, children: "Add" })] }), s.access === 'invite' ? null : _jsx("p", { style: muted, children: "Supersuit accounts get in without being on the list." })] })) : null, _jsxs("div", { style: { margin: '0 0 14px' }, "data-settings-link": true, children: [_jsx("p", { style: legend, children: "The link to send" }), _jsxs("div", { style: { display: 'flex', gap: 8, alignItems: 'center' }, children: [_jsx("code", { style: { flex: 1, minWidth: 0, fontSize: 13, overflowWrap: 'anywhere' }, children: s.link }), _jsx("button", { type: "button", onClick: () => void copy(), style: btn, children: "Copy" })] })] }), s.facts.length ? (_jsx("dl", { style: { display: 'grid', gap: 8, margin: 0 }, "data-settings-facts": true, children: s.facts.map((f) => (_jsxs("div", { children: [_jsx("dt", { style: { fontSize: 12, fontWeight: 600, opacity: 0.7 }, children: f.label }), _jsx("dd", { style: { margin: 0, fontSize: 13, opacity: 0.85 }, children: f.text })] }, f.label))) })) : null] }));
     const commentSheet = (_jsxs(_Fragment, { children: [_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Who can comment" }), ['anyone', 'signed-in', 'off'].map((m) => radio('comments', m, comments, setComments, COMMENTS_LABEL[m], m === 'anyone' && s.gated ? 'This page is private, so only signed-in readers it is open to can' : undefined))] }), comments !== 'off' ? (_jsxs("fieldset", { style: fieldset, children: [_jsx("legend", { style: legend, children: "Who can read the comments" }), ['owner', 'readers'].map((v) => radio('visible', v, visible, setVisible, VISIBLE_LABEL[v], v === 'owner' ? 'Each commenter also sees their own' : undefined))] })) : null, dirty || busy ? (_jsxs("div", { style: { display: 'flex', gap: 8 }, children: [_jsx("button", { type: "button", "data-settings-save": true, onClick: () => void save(), disabled: busy, style: primary, children: busy ? 'Saving' : 'Save' }), _jsx("button", { type: "button", onClick: () => { setComments(s.comments); setVisible(s.commentsVisible); }, disabled: busy, style: btn, children: "Undo" })] })) : null] }));
     return (_jsxs(_Fragment, { children: [_jsx("div", { "aria-hidden": true, "data-settings-scrim": true, onClick: onClose, style: { position: 'fixed', inset: 0, zIndex: 60, background: phone ? 'rgba(0,0,0,0.28)' : 'transparent' } }), _jsxs("div", { ref: panel, role: "dialog", "aria-modal": "true", "aria-label": kind === 'share' ? 'Share settings' : 'Comment settings', tabIndex: -1, "data-settings-sheet": kind, "data-nospeak": true, "data-comment-ui": true, style: style, children: [_jsxs("div", { style: { display: 'flex', alignItems: 'baseline', justifyContent: 'space-between', gap: 8 }, children: [_jsx("h2", { style: h, children: kind === 'share' ? 'Share settings' : 'Comment settings' }), _jsx("button", { type: "button", onClick: onClose, "aria-label": "Close", style: { ...btn, border: 0, padding: '2px 6px', fontSize: 20, lineHeight: 1 }, children: "\u00D7" })] }), kind === 'share' ? share : commentSheet, _jsx("p", { role: "status", "aria-live": "polite", "data-settings-said": true, style: { margin: said ? '10px 0 0' : 0, fontSize: 13, minHeight: 0 }, children: said ?? '' })] })] }));
 }

package/lib/routes/artifacts.d.ts

@@ -229,6 +229,10 @@ export declare function createArtifactRoutes(config: ArtifactRoutesConfig): {
     }>>;
     POST: (request: NextRequest) => Promise<NextResponse<{
         error: string;
+    }> | NextResponse<{
+        id: string;
+        unpublished: boolean;
+        at: string;
     }> | NextResponse<{
         warning?: string | undefined;
         expireAt?: string | null | undefined;

package/lib/routes/artifacts.js

@@ -71,7 +71,11 @@ function ViewingAsReader({ back }) {
     return (_jsx("div", { "data-viewing-as-reader": true, "data-nospeak": true, className: "fixed inset-x-0 top-3 z-50 flex justify-center px-3", children: _jsxs("p", { className: "m-0 rounded-full border border-[color:var(--a-line-strong)] bg-[color:var(--a-surface)] px-4 py-1.5 font-sans text-xs text-[color:var(--a-strong)] shadow-lg", children: ["Viewing as a reader \u00B7 ", _jsx("a", { href: back, className: "underline", children: "Back to your view" })] }) }));
 }
 export function createArtifactRoutes(config) {
-    const { store, siteUrl } = config;
+    const { store: kept, siteUrl } = config;
+    // An unpublished page (0.48.0) is KEPT, versions, comments and files all, and served to nobody:
+    // every reader-facing path reads through this view, which does not see it. The publisher's own
+    // routes (POST, GET, DELETE, the uploads) read `kept`, so the page can be put back or destroyed.
+    const store = { ...kept, get: async (id) => { const a = await kept.get(id); return a?.unpublishedAt ? null : a; } };
     // The pack as configured draws the share card; the page paints with its theme variables, so a
     // page follows its light, dark or system mode (brand/theme.ts).
     const pack = config.brand;
@@ -771,6 +775,21 @@ export function createArtifactRoutes(config) {
     async function POST(request) {
         if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        // `?unpublish=1`: take the page off the web and keep everything. On the publish route rather
+        // than a route of its own so no host has a file to add, and so a host older than 0.48.0 refuses
+        // the empty body with a 400 instead of doing anything at all: it can never be mistaken for a delete.
+        if (request.nextUrl.searchParams.get('unpublish') === '1') {
+            const id = request.nextUrl.searchParams.get('id');
+            if (!id || !ARTIFACT_ID.test(id))
+                return NextResponse.json({ error: 'unpublish needs ?id=<page id>' }, { status: 400 });
+            if (!kept.setUnpublished)
+                return NextResponse.json({ error: 'this store cannot keep a page unpublished; nothing was changed' }, { status: 501 });
+            const at = new Date().toISOString();
+            if (!(await kept.get(id)) || !(await kept.setUnpublished(id, at)))
+                return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
+            revalidatePath(pagePath(id));
+            return NextResponse.json({ id, unpublished: true, at });
+        }
         const text = await request.text();
         let parsed = parseArtifactSource(text);
         if (!parsed.ok)
@@ -779,7 +798,7 @@ export function createArtifactRoutes(config) {
         // The kind is sticky, like `links:`: a republish of a broadcast that leaves `template:` out is
         // still a broadcast, and one that says `document` is refused rather than quietly changed.
         if (id && parsed.meta.template === 'document') {
-            const stored = await store.get(id);
+            const stored = await kept.get(id);
             if (stored && kindOf(stored) === 'broadcast') {
                 const again = parseArtifactSource(text, { defaultKind: 'broadcast' });
                 if (!again.ok)
@@ -792,10 +811,10 @@ export function createArtifactRoutes(config) {
         // Fail closed: private media needs a private store. Without one the media would have to sit in
         // the public bucket, which may carry a bucket-wide public read grant, so nothing is saved.
         // `media:` is sticky, so a stored page that already keeps private media counts too.
-        if (!keepsPrivateMedia() && (parsed.meta.privateMedia || (id && (await store.get(id))?.privateMedia)))
+        if (!keepsPrivateMedia() && (parsed.meta.privateMedia || (id && (await kept.get(id))?.privateMedia)))
             return NextResponse.json({ error: NO_PRIVATE_STORE }, { status: 501 });
         if (id && parsed.meta.state) {
-            const existing = await store.get(id);
+            const existing = await kept.get(id);
             const changed = shapeChanges(existing?.state, parsed.meta.state);
             if (changed.length)
                 return NextResponse.json({ error: changed.join('; ') }, { status: 400 });
@@ -822,7 +841,7 @@ export function createArtifactRoutes(config) {
         // `?amend=1` is the publisher finishing the publish it started (image URLs, then narration).
         const note = cleanNote(request.nextUrl.searchParams.get('note')) ?? parsed.meta.change;
         const amend = request.nextUrl.searchParams.get('amend') === '1';
-        const result = await store.save({ id, meta: parsed.meta, markdown: parsed.body, note, amend });
+        const result = await kept.save({ id, meta: parsed.meta, markdown: parsed.body, note, amend });
         if ('notFound' in result)
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
         // A broadcast with no date gets one: 90 days from now. A date already set (by the sender, or
@@ -850,7 +869,7 @@ export function createArtifactRoutes(config) {
         if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
-        const a = await store.get(id);
+        const a = await kept.get(id);
         if (!a)
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
         return NextResponse.json({ id, text: narrationText({ title: a.title, subtitle: a.subtitle, summary: a.summary, markdown: a.markdown }) });
@@ -867,7 +886,7 @@ export function createArtifactRoutes(config) {
         const { id, name } = await params;
         if (!ARTIFACT_ID.test(id))
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
-        if (!(await store.get(id)))
+        if (!(await kept.get(id)))
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
         if (!ASSET_NAME.test(name))
             return NextResponse.json({ error: 'asset name must be one path segment: letters, digits, dot, dash, underscore' }, { status: 400 });
@@ -917,7 +936,7 @@ export function createArtifactRoutes(config) {
         const { id, name } = await params;
         if (!ARTIFACT_ID.test(id))
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
-        if (!(await store.get(id)))
+        if (!(await kept.get(id)))
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
         if (!ASSET_NAME.test(name))
             return NextResponse.json({ error: 'asset name must be one path segment: letters, digits, dot, dash, underscore' }, { status: 400 });
@@ -977,7 +996,7 @@ export function createArtifactRoutes(config) {
         if (!authed(request))
             return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
         const { id } = await params;
-        if (!ARTIFACT_ID.test(id) || !(await store.get(id)))
+        if (!ARTIFACT_ID.test(id) || !(await kept.get(id)))
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
         let files = 0;
         if (config.assets?.deletePage) {
@@ -995,7 +1014,7 @@ export function createArtifactRoutes(config) {
         catch (e) {
             return NextResponse.json({ error: `the page's readers could not be forgotten, so the page was kept; delete it again: ${e instanceof Error ? e.message : String(e)}` }, { status: 502 });
         }
-        const ok = await store.delete(id);
+        const ok = await kept.delete(id);
         if (!ok)
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
         revalidatePath(pagePath(id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/artifacts",
-  "version": "0.47.0",
+  "version": "0.49.0",
   "description": "Publish markdown as branded, read-aloud pages from a Next.js app: the artifacts store, the route factory, the read-along reader, brand packs, password and confidential pages, and share cards.",
   "license": "MIT",
   "type": "module",