@supersuit/artifacts 0.57.0 → 0.58.0

package/CHANGELOG.md

@@ -3,6 +3,39 @@
 `@supersuit/artifacts`. One entry per version, newest first. Each entry says what changed, how a
 host can tell whether it is affected (DETECTOR), what a host does about it (REMEDY), and the tests.
 
+## 0.58.0 (2026-10-27)
+
+**A link's provenance can name its reader by an opaque person id.** Superlinks step 6: a funnel
+suggestion ("Ada read the proposal to the end: move her to proposed?") has to know whose opens these
+are. A label is a name and cannot be trusted as an identity; the sender's opaque person id can.
+
+- `provenance.subject`: a person id, `p_` and 8 characters from the sender's records. Anything else
+  (a name, a different shape) is refused 400 and nothing is added. Kept on the row and answered back
+  like the rest of the provenance.
+- DETECTOR: a sender that posts `provenance.subject` and reads it back missing is on 0.57.x or older.
+- REMEDY: update the host.
+- Tests: recipients-api.test.tsx (subject kept; a name and malformed ids refused).
+
+## 0.57.2 (2026-10-26)
+
+**0.57.1, published.** 0.57.1 was tagged but never reached npm: its publish run refused it, because
+a second test (`src/routes/page-analytics-mount.test.tsx`) still expected the label as the PostHog
+name. That test now asserts the identity carries no `name`. Everything in the 0.57.1 entry below
+ships in this version.
+
+## 0.57.1 (2026-10-26, never published: see 0.57.2)
+
+**Page analytics no longer send a per-reader link's label to PostHog.** A per-reader page identified its
+reader as `recipient:<rid>` with `name` set to the label the publisher gave the link, which is the
+person's name, so every reader's name sat in the analytics provider. The operator's ruling for
+superlinks (2026-10-26): analytics gets the link's id, never who it is for.
+
+- The identity is `{ distinctId: 'recipient:<rid>' }`, no `name`. A signed-in reader on a gated page is
+  unchanged.
+- DETECTOR: a PostHog person whose distinct id starts `recipient:` carries a `name` property.
+- REMEDY: update the host. Names already sent stay in PostHog until deleted there.
+- Tests: src/reader/analytics-plan.test.ts (the per-reader identity is the id alone).
+
 ## 0.57.0 (2026-10-26)
 
 **`GET /api/artifacts/<id>` says what a link to the page lets its reader do.** A sender approves a

package/README.md

@@ -1085,7 +1085,7 @@ mark is counted as before-send; senders mark as soon as delivery is confirmed.
 ### Who minted a link (0.53.0)
 
 Every link can say who made it, on whose authority, and when: `add: [{ label, provenance: { actor,
-authority, at?, link?, funnel?, stage? } }]`. `actor` is a person acting by hand or "<person>'s
+authority, at?, link?, funnel?, stage?, subject? } }]`; `subject` (0.58.0) is the sender's opaque person id (`p_` and 8 characters), never a name. `actor` is a person acting by hand or "<person>'s
 Pluma"; `authority` names what they acted under ("approved by <person> on the send card", "on
 <person>'s explicit request", "under the recurrent <name>"), with `link` to the session or message
 where one exists (https only); `at` defaults to now. `funnel` (a slug) and `stage` (an id, only with
@@ -1279,7 +1279,7 @@ Who is recorded, and as whom (`analyticsPlan`, `src/reader/analytics-plan.ts`):
 - Never the owner or an admin (signed in, previewing `?as=reader`, or on the owner's own per-reader
   link), never a link-preview fetcher, never a past version.
 - A gated page identifies the signed-in reader by email.
-- A per-reader link identifies as `recipient:<rid>` with the label the publisher gave it.
+- A per-reader link identifies as `recipient:<rid>` and nothing more: never the label the publisher gave it, which names the person (0.57.1). The id-to-person map stays with the publisher, in the recipients store.
 - A public or password page stays anonymous.
 - Every page, whatever its kind, records replays with all text and all inputs masked
   (`RECORDING_MASK`), and autocapture collects no element text. There is no opt-out.

package/lib/artifacts/recipients-store.d.ts

@@ -36,6 +36,7 @@ export type Provenance = {
     link?: string;
     funnel?: string;
     stage?: string;
+    subject?: string;
 };
 export type RecipientsRecord = {
     recipients: Record<string, Recipient>;

package/lib/reader/analytics-plan.js

@@ -6,8 +6,8 @@
 //  - The owner and the host's admins are never recorded, signed in or on their own per-reader link.
 //  - A link-preview fetcher is never handed the script.
 //  - A reader is identified only where the page already knows who they are: a gated page by the
-//    signed-in email, a per-reader link by its opaque recipient id and the label the publisher gave
-//    it (never a phone or an email, which the recipients store does not hold). A public or password
+//    signed-in email, a per-reader link by its opaque recipient id alone: never the label the
+//    publisher gave it, which names the person (2026-10-26), and never a phone or an email. A public or password
 //    page stays anonymous, even when its reader happens to be signed in.
 export const DEFAULT_POSTHOG_HOST = 'https://us.i.posthog.com';
 export function analyticsPlan(input) {
@@ -20,7 +20,8 @@ export function analyticsPlan(input) {
         identity = { distinctId: email, email, ...(input.reader.name ? { name: input.reader.name } : {}) };
     }
     else if (input.kind === 'per-reader' && input.recipient?.rid) {
-        identity = { distinctId: `recipient:${input.recipient.rid}`, name: input.recipient.label };
+        // The link's id alone: who it is for stays with the publisher (superlinks, 2026-10-26).
+        identity = { distinctId: `recipient:${input.recipient.rid}` };
     }
     return {
         key,

package/lib/routes/artifacts.d.ts

@@ -127,7 +127,7 @@ export type ArtifactRoutesConfig = {
      *  autocapture, scroll depth on leave, and section_viewed / narration_* events. Without a key no
      *  page loads any analytics script. Never records the owner or an admin, never a link-preview
      *  fetcher, never a past version; identifies a reader only on a gated page (their email) or a
-     *  per-reader link (its recipient id and label). See reader/analytics-plan.ts. */
+     *  per-reader link (its recipient id alone, never the label). See reader/analytics-plan.ts. */
     analytics?: AnalyticsConfig | null;
 };
 /** Ids are 8 chars from the safe alphabet; anything else is not a page and never reaches the store. */

package/lib/routes/recipients-routes.js

@@ -18,7 +18,7 @@ const SLUG = /^[a-z0-9][a-z0-9_-]{0,63}$/;
  *  now), and the funnel step it serves. -> the clean record, or the reason it is refused. */
 export function readProvenance(v, now = new Date()) {
     if (!v || typeof v !== 'object' || Array.isArray(v))
-        return { ok: false, why: 'provenance is { actor, authority, at?, link?, funnel?, stage? }' };
+        return { ok: false, why: 'provenance is { actor, authority, at?, link?, funnel?, stage?, subject? }' };
     const p = v;
     const text = (x, max) => (typeof x === 'string' && x.trim() ? x.trim().slice(0, max) : '');
     const actor = text(p.actor, 120), authority = text(p.authority, 300);
@@ -42,8 +42,12 @@ export function readProvenance(v, now = new Date()) {
         return { ok: false, why: 'provenance.funnel must be a funnel slug' };
     if (p.stage !== undefined && (typeof p.stage !== 'string' || !SLUG.test(p.stage) || p.funnel === undefined))
         return { ok: false, why: 'provenance.stage must be a stage id, with its funnel' };
+    // The reader by the sender's opaque person id (superlinks step 6), so a funnel can tell whose opens
+    // these are without a name ever reaching the host.
+    if (p.subject !== undefined && (typeof p.subject !== 'string' || !/^p_[0-9abcdefghjkmnpqrstvwxyz]{8}$/.test(p.subject)))
+        return { ok: false, why: 'provenance.subject must be an opaque person id (p_ and 8 characters), never a name' };
     const at = typeof p.at === 'string' ? new Date(p.at).toISOString() : now.toISOString();
-    return { ok: true, value: { actor, authority, at, ...(link ? { link } : {}), ...(p.funnel ? { funnel: p.funnel } : {}), ...(p.stage ? { stage: p.stage } : {}) } };
+    return { ok: true, value: { actor, authority, at, ...(link ? { link } : {}), ...(p.funnel ? { funnel: p.funnel } : {}), ...(p.stage ? { stage: p.stage } : {}), ...(p.subject ? { subject: p.subject } : {}) } };
 }
 const none = () => new NextResponse(null, { status: 204, headers: { 'cache-control': 'no-store' } });
 const json = (b, status = 200) => NextResponse.json(b, { status, headers: { 'cache-control': 'no-store' } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/artifacts",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "Publish markdown as branded, read-aloud pages from a Next.js app: the artifacts store, the route factory, the read-along reader, brand packs, password and confidential pages, and share cards.",
   "license": "MIT",
   "type": "module",