@supersuit/artifacts 0.54.0 → 0.55.0

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 `@supersuit/artifacts`. One entry per version, newest first. Each entry says what changed, how a
 host can tell whether it is affected (DETECTOR), what a host does about it (REMEDY), and the tests.
 
+## 0.55.0 (2026-10-26)
+
+**`GET /api/artifacts/<id>` now returns the page as written, not only its narration.** It answered
+`{ id, text }`, and `text` is the narration, which drops every list item, so an agent reading a
+prep sheet through the key got its headings ("Questions for him", "About him, first:") with the
+questions missing.
+
+- The response adds `title`, `subtitle` (when set), `summary`, `to` (when set), `markdown`,
+  `version` and `updatedAt`. `text` is unchanged, so existing callers keep working.
+- Never the password, the access list or reader data.
+- DETECTOR: `GET /api/artifacts/<id>` with the publish key answers no `markdown` field.
+- REMEDY: update the host.
+- Tests: `src/routes/artifacts.test.tsx` "GET returns the narration text and the markdown".
+
 ## 0.54.0 (2026-10-25)
 
 **A page no longer records under a reader left on the browser by another page.** posthog-js keeps

package/README.md

@@ -248,6 +248,12 @@ createArtifactRoutes({ ..., ownerEmail: 'owner@example.com', admins: ['editor@ex
 - `GET /api/artifacts/<id>/versions` lists the history; `POST` it `{ "version": 2, "note": "..." }`
   (or `"note": null`) to write a note onto a version after the fact.
 
+**Reading a page as its owner.** `GET /api/artifacts/<id>` with the publish key answers
+`{ id, title, subtitle?, summary, to?, markdown, version, updatedAt, text }`. `markdown` is the
+body as written, lists included, and is what an agent should read; `text` is the narration, which
+drops list items. Neither ever carries the page's password or anything about its readers. A page
+behind a sign-in door, a password or per-reader links is readable this way by whoever holds the key.
+
 ## Front matter
 
 ```markdown

package/lib/routes/artifacts.d.ts

@@ -251,8 +251,15 @@ export declare function createArtifactRoutes(config: ArtifactRoutesConfig): {
     GET: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
         error: string;
     }> | NextResponse<{
+        markdown: string;
+        version: number;
+        updatedAt: string;
+        to?: string | undefined;
+        summary: string;
+        subtitle?: string | undefined;
         id: string;
         text: string;
+        title: string;
     }>>;
     DELETE: (request: NextRequest, { params }: Params) => Promise<NextResponse<{
         error: string;

package/lib/routes/artifacts.js

@@ -891,7 +891,15 @@ export function createArtifactRoutes(config) {
         const a = await kept.get(id);
         if (!a)
             return NextResponse.json({ error: `no artifact with id ${id}` }, { status: 404 });
-        return NextResponse.json({ id, text: narrationText({ title: a.title, subtitle: a.subtitle, summary: a.summary, markdown: a.markdown }) });
+        // `text` is the narration (lists and headings without their items read badly aloud, so it
+        // drops them); `markdown` is the page as written, which is what an agent reading the page
+        // needs. Never the password or any reader data.
+        return NextResponse.json({
+            id,
+            text: narrationText({ title: a.title, subtitle: a.subtitle, summary: a.summary, markdown: a.markdown }),
+            title: a.title, ...(a.subtitle ? { subtitle: a.subtitle } : {}), summary: a.summary, ...(a.to ? { to: a.to } : {}),
+            markdown: a.markdown, version: a.version ?? 1, updatedAt: a.updatedAt,
+        });
     }
     /** PUT /api/artifacts/<id>/assets/<name>: raw bytes in, public URL out. 16 MiB cap. */
     async function PUT_ASSET(request, { params }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/artifacts",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "description": "Publish markdown as branded, read-aloud pages from a Next.js app: the artifacts store, the route factory, the read-along reader, brand packs, password and confidential pages, and share cards.",
   "license": "MIT",
   "type": "module",