@supersuit/artifacts 0.56.0 → 0.57.2

package/CHANGELOG.md

@@ -3,6 +3,40 @@
 `@supersuit/artifacts`. One entry per version, newest first. Each entry says what changed, how a
 host can tell whether it is affected (DETECTOR), what a host does about it (REMEDY), and the tests.
 
+## 0.57.2 (2026-10-26)
+
+**0.57.1, published.** 0.57.1 was tagged but never reached npm: its publish run refused it, because
+a second test (`src/routes/page-analytics-mount.test.tsx`) still expected the label as the PostHog
+name. That test now asserts the identity carries no `name`. Everything in the 0.57.1 entry below
+ships in this version.
+
+## 0.57.1 (2026-10-26, never published: see 0.57.2)
+
+**Page analytics no longer send a per-reader link's label to PostHog.** A per-reader page identified its
+reader as `recipient:<rid>` with `name` set to the label the publisher gave the link, which is the
+person's name, so every reader's name sat in the analytics provider. The operator's ruling for
+superlinks (2026-10-26): analytics gets the link's id, never who it is for.
+
+- The identity is `{ distinctId: 'recipient:<rid>' }`, no `name`. A signed-in reader on a gated page is
+  unchanged.
+- DETECTOR: a PostHog person whose distinct id starts `recipient:` carries a `name` property.
+- REMEDY: update the host. Names already sent stay in PostHog until deleted there.
+- Tests: src/reader/analytics-plan.test.ts (the per-reader identity is the id alone).
+
+## 0.57.0 (2026-10-26)
+
+**`GET /api/artifacts/<id>` says what a link to the page lets its reader do.** A sender approves a
+message before any reader's link is minted, so the only way to tell the operator, on the send card,
+whether the person can forward the page, must sign in to comment, or has a link that expires, is the
+page's own settings. The response adds `share: { links, forward, comments, expires }`.
+
+- `links`: `per-reader` or `open`. `forward`: the page's `forward:` line, `off` when unset.
+  `comments`: the page's `comments:`, `off` when unset. `expires`: a per-reader page's expiry, or null.
+- Never anything about a reader.
+- DETECTOR: `GET /api/artifacts/<id>` with the publish key answers no `share` field.
+- REMEDY: update the host.
+- Tests: forward.test.tsx "GET /api/artifacts/<id> says what a link to the page lets its reader do".
+
 ## 0.56.0 (2026-10-26)
 
 **A reader can pass a per-reader page on, and the link they make says who made it and from which

package/README.md

@@ -254,6 +254,11 @@ body as written, lists included, and is what an agent should read; `text` is the
 drops list items. Neither ever carries the page's password or anything about its readers. A page
 behind a sign-in door, a password or per-reader links is readable this way by whoever holds the key.
 
+The answer also carries `share: { links, forward, comments, expires }` (0.57.0): `links` is
+`per-reader` or `open`, `forward` the page's `forward:` (`off` when unset), `comments` its
+`comments:` (`off` when unset), and `expires` the per-reader page's expiry or null. It is what a
+sender reads to say, before a reader's link exists, what that link will let its reader do.
+
 ## Front matter
 
 ```markdown
@@ -1274,7 +1279,7 @@ Who is recorded, and as whom (`analyticsPlan`, `src/reader/analytics-plan.ts`):
 - Never the owner or an admin (signed in, previewing `?as=reader`, or on the owner's own per-reader
   link), never a link-preview fetcher, never a past version.
 - A gated page identifies the signed-in reader by email.
-- A per-reader link identifies as `recipient:<rid>` with the label the publisher gave it.
+- A per-reader link identifies as `recipient:<rid>` and nothing more: never the label the publisher gave it, which names the person (0.57.1). The id-to-person map stays with the publisher, in the recipients store.
 - A public or password page stays anonymous.
 - Every page, whatever its kind, records replays with all text and all inputs masked
   (`RECORDING_MASK`), and autocapture collects no element text. There is no opt-out.

package/lib/reader/analytics-plan.js

@@ -6,8 +6,8 @@
 //  - The owner and the host's admins are never recorded, signed in or on their own per-reader link.
 //  - A link-preview fetcher is never handed the script.
 //  - A reader is identified only where the page already knows who they are: a gated page by the
-//    signed-in email, a per-reader link by its opaque recipient id and the label the publisher gave
-//    it (never a phone or an email, which the recipients store does not hold). A public or password
+//    signed-in email, a per-reader link by its opaque recipient id alone: never the label the
+//    publisher gave it, which names the person (2026-10-26), and never a phone or an email. A public or password
 //    page stays anonymous, even when its reader happens to be signed in.
 export const DEFAULT_POSTHOG_HOST = 'https://us.i.posthog.com';
 export function analyticsPlan(input) {
@@ -20,7 +20,8 @@ export function analyticsPlan(input) {
         identity = { distinctId: email, email, ...(input.reader.name ? { name: input.reader.name } : {}) };
     }
     else if (input.kind === 'per-reader' && input.recipient?.rid) {
-        identity = { distinctId: `recipient:${input.recipient.rid}`, name: input.recipient.label };
+        // The link's id alone: who it is for stays with the publisher (superlinks, 2026-10-26).
+        identity = { distinctId: `recipient:${input.recipient.rid}` };
     }
     return {
         key,

package/lib/routes/artifacts.d.ts

@@ -1,6 +1,7 @@
 import type { Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
 import { type ArtifactRecord, type ArtifactStore, type VersionEntry } from '../artifacts/store.js';
+import { type CommentsMode } from '../artifacts/comments.js';
 import type { StateStore } from '../artifacts/state-store.js';
 import { type ArtifactAssets } from '../artifacts/assets.js';
 import type { BrandPack } from '../brand/pack.js';
@@ -126,7 +127,7 @@ export type ArtifactRoutesConfig = {
      *  autocapture, scroll depth on leave, and section_viewed / narration_* events. Without a key no
      *  page loads any analytics script. Never records the owner or an admin, never a link-preview
      *  fetcher, never a past version; identifies a reader only on a gated page (their email) or a
-     *  per-reader link (its recipient id and label). See reader/analytics-plan.ts. */
+     *  per-reader link (its recipient id alone, never the label). See reader/analytics-plan.ts. */
     analytics?: AnalyticsConfig | null;
 };
 /** Ids are 8 chars from the safe alphabet; anything else is not a page and never reaches the store. */
@@ -259,6 +260,12 @@ export declare function createArtifactRoutes(config: ArtifactRoutesConfig): {
         markdown: string;
         version: number;
         updatedAt: string;
+        share: {
+            links: string;
+            forward: "signed-in" | "off" | "open";
+            comments: CommentsMode;
+            expires: string | null;
+        };
         to?: string | undefined;
         summary: string;
         subtitle?: string | undefined;

package/lib/routes/artifacts.js

@@ -906,6 +906,14 @@ export function createArtifactRoutes(config) {
             text: narrationText({ title: a.title, subtitle: a.subtitle, summary: a.summary, markdown: a.markdown }),
             title: a.title, ...(a.subtitle ? { subtitle: a.subtitle } : {}), summary: a.summary, ...(a.to ? { to: a.to } : {}),
             markdown: a.markdown, version: a.version ?? 1, updatedAt: a.updatedAt,
+            // What a link to this page lets its reader do (0.57.0), so a sender can say so before the
+            // reader's link exists: the send card is approved before anything is minted.
+            share: {
+                links: a.links === 'per-reader' ? 'per-reader' : 'open',
+                forward: a.forward ?? 'off',
+                comments: a.comments ?? 'off',
+                expires: a.links === 'per-reader' && config.recipients ? (await config.recipients.get(id))?.expireAt ?? null : null,
+            },
         });
     }
     /** PUT /api/artifacts/<id>/assets/<name>: raw bytes in, public URL out. 16 MiB cap. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/artifacts",
-  "version": "0.56.0",
+  "version": "0.57.2",
   "description": "Publish markdown as branded, read-aloud pages from a Next.js app: the artifacts store, the route factory, the read-along reader, brand packs, password and confidential pages, and share cards.",
   "license": "MIT",
   "type": "module",