@anthusai/papyrus 2.0.0-next.40 → 2.0.0-next.42

package/app/api/reader/rating/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "rating");
+}

package/app/api/reader/report/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "report");
+}

package/app/api/reader/retired/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRetiredSubjects } from "../../../../lib/reader-retirement-route";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleReaderRetiredSubjects(request);
+}

package/app/api/reader/submit/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "submit");
+}

package/app/api/reader/vote/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "vote");
+}

package/components/moderation-panel.tsx

@@ -0,0 +1,248 @@
+"use client";
+
+import { generateClient } from "aws-amplify/data";
+import amplifyOutputs from "papyrus-amplify-outputs";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { pluginSettings, type PluginOutputs } from "../lib/plugin-settings";
+import {
+  buildActionLog,
+  buildHidden,
+  buildQueue,
+  moderationModeText,
+  receiptMessage,
+  shortReader,
+  type ActionEntry,
+  type ActionRow,
+  type CommentRow,
+  type ModerationActionName,
+  type ModerationRow,
+  type ModerationTarget,
+  type Receipt,
+  type ReportRow,
+  type SubmissionRow,
+} from "../lib/reader-moderation";
+
+const SUBMISSION_FIELDS = "id canonicalUrl domain title kind note readerId state moderation reportCount signals itemId createdAt";
+const COMMENT_FIELDS = "id subjectKey readerId body parentId state moderation reportCount signals createdAt";
+
+const QUEUE_SUBMISSIONS = `query Queue($nextToken: String) { listReaderSubmissionsByModerationAndCreatedAt(moderation: "new", sortDirection: DESC, limit: 100, nextToken: $nextToken) { items { ${SUBMISSION_FIELDS} } nextToken } }`;
+const QUEUE_COMMENTS = `query Queue($nextToken: String) { listReaderCommentsByModerationAndCreatedAt(moderation: "new", sortDirection: DESC, limit: 100, nextToken: $nextToken) { items { ${COMMENT_FIELDS} } nextToken } }`;
+const HIDDEN_SUBMISSIONS = `query Hidden($nextToken: String) { listReaderSubmissions(filter: { state: { eq: "hidden" } }, limit: 500, nextToken: $nextToken) { items { ${SUBMISSION_FIELDS} } nextToken } }`;
+const HIDDEN_COMMENTS = `query Hidden($nextToken: String) { listReaderComments(filter: { state: { eq: "hidden" } }, limit: 500, nextToken: $nextToken) { items { ${COMMENT_FIELDS} } nextToken } }`;
+const OPEN_REPORTS = `query Reports($nextToken: String) { listReaderReports(filter: { state: { eq: "open" } }, limit: 500, nextToken: $nextToken) { items { id targetType target reporterReaderId reason state createdAt } nextToken } }`;
+const ACTIONS = `query Actions($nextToken: String) { listModerationActions(limit: 500, nextToken: $nextToken) { items { id by actorSub action targetType target reason fromState toState undoOf undoneBy at } nextToken } }`;
+const HANDLES = `query Handles($nextToken: String) { listReaderHandles(limit: 1000, nextToken: $nextToken) { items { id readerId } nextToken } }`;
+const MODERATE = `mutation Moderate($action: String!, $targetType: String!, $target: String!, $reason: String, $undoOf: String) { moderateReader(action: $action, targetType: $targetType, target: $target, reason: $reason, undoOf: $undoOf) { status id error message } }`;
+
+type GraphResult = { data?: Record<string, { items: unknown[]; nextToken?: string | null } | Receipt | null>; errors?: { message?: string }[] };
+const MAXIMUM_PAGES = 20;
+
+async function loadAll<T>(query: string, field: string): Promise<T[]> {
+  const client = generateClient({ authMode: "userPool" });
+  const rows: T[] = [];
+  let nextToken: string | null | undefined;
+  for (let page = 0; page < MAXIMUM_PAGES; page += 1) {
+    const result = (await client.graphql({ query, variables: { nextToken } })) as GraphResult;
+    if (result.errors?.length) throw new Error(result.errors[0]?.message ?? "Could not load moderation data.");
+    const connection = result.data?.[field] as { items: T[]; nextToken?: string | null } | undefined;
+    rows.push(...(connection?.items ?? []).filter(Boolean));
+    nextToken = connection?.nextToken;
+    if (!nextToken) break;
+  }
+  return rows;
+}
+
+async function moderate(variables: Record<string, string | undefined>): Promise<Receipt> {
+  const client = generateClient({ authMode: "userPool" });
+  const result = (await client.graphql({ query: MODERATE, variables })) as GraphResult;
+  if (result.errors?.length) return { status: "refused", message: result.errors[0]?.message ?? "The action failed." };
+  return (result.data?.moderateReader as Receipt | null) ?? { status: "refused", message: "The action did not answer." };
+}
+
+export type ModerationViewProps = {
+  mode: unknown;
+  queue: ModerationRow[];
+  hidden: ModerationRow[];
+  log: ActionEntry[];
+  tab: "queue" | "hidden" | "log";
+  busy: boolean;
+  status: string;
+  reason: string;
+  onTab: (tab: "queue" | "hidden" | "log") => void;
+  onReason: (reason: string) => void;
+  onAction: (action: ModerationActionName, targetType: ModerationTarget, target: string, undoOf?: string) => void;
+  onRefresh: () => void;
+};
+
+function Row({ row, busy, onAction, listed }: { row: ModerationRow; busy: boolean; onAction: ModerationViewProps["onAction"]; listed: "queue" | "hidden" }) {
+  const kind = row.kind === "submission" ? "Submission" : "Comment";
+  return (
+    <li data-moderation-row={row.id}>
+      <article aria-label={`${kind} by ${shortReader(row.readerId, row.handle)}`}>
+        <p>
+          <strong>{kind}</strong> by {shortReader(row.readerId, row.handle)} <time dateTime={row.createdAt}>{row.createdAt}</time> ({row.state}
+          {row.reports.length > 0 ? `, ${row.reports.length} ${row.reports.length === 1 ? "report" : "reports"}` : ""})
+        </p>
+        {row.kind === "submission" ? (
+          <p>
+            {row.url ? (
+              <a href={row.url} target="_blank" rel="noopener noreferrer nofollow">{row.title}</a>
+            ) : (
+              <span>{row.title}</span>
+            )}
+          </p>
+        ) : null}
+        {row.text ? <p style={{ whiteSpace: "pre-wrap", overflowWrap: "anywhere" }}>{row.text}</p> : null}
+        {row.signals.length > 0 ? (
+          <ul aria-label="Automatic signals">
+            {row.signals.map((signal, index) => (
+              <li key={`${signal.detector}-${index}`}>Signal ({signal.severity}): {signal.policy} / {signal.detector}{signal.excerpt ? ` — “${signal.excerpt}”` : ""}</li>
+            ))}
+          </ul>
+        ) : null}
+        {row.reports.length > 0 ? (
+          <ul aria-label="Reports">
+            {row.reports.map((report) => (
+              <li key={report.id}>Reported: {report.reason}</li>
+            ))}
+          </ul>
+        ) : null}
+        <p>
+          {listed === "queue" ? (
+            <button type="button" disabled={busy} onClick={() => onAction("approve", row.kind, row.id)}>Approve</button>
+          ) : (
+            <button type="button" disabled={busy} onClick={() => onAction("unhide", row.kind, row.id)}>Show again</button>
+          )}{" "}
+          {row.state !== "hidden" ? <button type="button" disabled={busy} onClick={() => onAction("hide", row.kind, row.id)}>Hide</button> : null}{" "}
+          {row.canPromote ? <button type="button" disabled={busy} onClick={() => onAction("promote", row.kind, row.id)}>Promote to a draft</button> : null}{" "}
+          <button type="button" disabled={busy} onClick={() => onAction("ban", "reader", row.readerId)}>Ban reader</button>{" "}
+          <button type="button" disabled={busy} onClick={() => onAction("limit", "reader", row.readerId)}>Limit reader</button>
+        </p>
+      </article>
+    </li>
+  );
+}
+
+export function ModerationView(props: ModerationViewProps) {
+  const { queue, hidden, log, tab, busy } = props;
+  return (
+    <section aria-labelledby="newsroom-moderation-title" data-news-desk-admin-panel="moderation">
+      <h3 id="newsroom-moderation-title">Moderation</h3>
+      <p>{moderationModeText(props.mode)} Only editors and admins can see this.</p>
+      <p role="tablist" aria-label="Moderation views">
+        <button type="button" role="tab" aria-selected={tab === "queue"} onClick={() => props.onTab("queue")}>Queue ({queue.length})</button>{" "}
+        <button type="button" role="tab" aria-selected={tab === "hidden"} onClick={() => props.onTab("hidden")}>Hidden ({hidden.length})</button>{" "}
+        <button type="button" role="tab" aria-selected={tab === "log"} onClick={() => props.onTab("log")}>Recent actions</button>{" "}
+        <button type="button" onClick={props.onRefresh} disabled={busy}>Refresh</button>
+      </p>
+      <label>
+        Reason for the next action (optional){" "}
+        <input type="text" value={props.reason} maxLength={500} onChange={(event) => props.onReason(event.target.value)} />
+      </label>
+      <p role="status" aria-live="polite">{props.status}</p>
+      {tab === "queue" ? (
+        queue.length === 0 ? <p>Nothing is waiting for a decision.</p> : <ul>{queue.map((row) => <Row key={row.id} row={row} busy={busy} onAction={props.onAction} listed="queue" />)}</ul>
+      ) : null}
+      {tab === "hidden" ? (
+        hidden.length === 0 ? <p>Nothing is hidden.</p> : <ul>{hidden.map((row) => <Row key={row.id} row={row} busy={busy} onAction={props.onAction} listed="hidden" />)}</ul>
+      ) : null}
+      {tab === "log" ? (
+        log.length === 0 ? <p>No moderation actions yet.</p> : (
+          <table>
+            <thead>
+              <tr><th scope="col">When</th><th scope="col">Action</th><th scope="col">Target</th><th scope="col">By</th><th scope="col">Reason</th><th scope="col"><span>Undo</span></th></tr>
+            </thead>
+            <tbody>
+              {log.map((entry) => (
+                <tr key={entry.id}>
+                  <td>{entry.at}</td>
+                  <td>{entry.label} ({entry.fromState} to {entry.toState}){entry.undoneBy ? ", undone" : ""}</td>
+                  <td>{entry.targetType} {entry.target.slice(0, 12)}</td>
+                  <td>{entry.byLabel}</td>
+                  <td>{entry.reason}</td>
+                  <td>
+                    {entry.undoable ? (
+                      <button type="button" disabled={busy} onClick={() => props.onAction("undo", entry.targetType as ModerationTarget, entry.target, entry.id)}>Undo</button>
+                    ) : null}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        )
+      ) : null}
+    </section>
+  );
+}
+
+export function ModerationPanel() {
+  const mode = useMemo(() => pluginSettings(amplifyOutputs as PluginOutputs, "reader-steering")?.moderation, []);
+  const [tab, setTab] = useState<"queue" | "hidden" | "log">("queue");
+  const [data, setData] = useState<{ queue: ModerationRow[]; hidden: ModerationRow[]; log: ActionEntry[] } | null>(null);
+  const [status, setStatus] = useState("Loading...");
+  const [busy, setBusy] = useState(false);
+  const [reason, setReason] = useState("");
+
+  const refresh = useCallback(async (quiet = false) => {
+    setBusy(true);
+    try {
+      const [newSubmissions, newComments, hiddenSubmissions, hiddenComments, reports, actions, handleRows] = await Promise.all([
+        loadAll<SubmissionRow>(QUEUE_SUBMISSIONS, "listReaderSubmissionsByModerationAndCreatedAt"),
+        loadAll<CommentRow>(QUEUE_COMMENTS, "listReaderCommentsByModerationAndCreatedAt"),
+        loadAll<SubmissionRow>(HIDDEN_SUBMISSIONS, "listReaderSubmissions"),
+        loadAll<CommentRow>(HIDDEN_COMMENTS, "listReaderComments"),
+        loadAll<ReportRow>(OPEN_REPORTS, "listReaderReports"),
+        loadAll<ActionRow>(ACTIONS, "listModerationActions"),
+        loadAll<{ id: string; readerId: string }>(HANDLES, "listReaderHandles"),
+      ]);
+      const handles = Object.fromEntries(handleRows.map((row) => [row.readerId, row.id]));
+      setData({
+        queue: buildQueue({ submissions: newSubmissions, comments: newComments, reports, handles }),
+        hidden: buildHidden({ submissions: hiddenSubmissions, comments: hiddenComments, reports, handles }),
+        log: buildActionLog(actions),
+      });
+      if (!quiet) setStatus("");
+    } catch (error) {
+      setStatus(`Error: ${error instanceof Error ? error.message : "Could not load moderation data."}`);
+    } finally {
+      setBusy(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  const onAction = useCallback(
+    async (action: ModerationActionName, targetType: ModerationTarget, target: string, undoOf?: string) => {
+      setBusy(true);
+      setStatus("Working...");
+      try {
+        const receipt = await moderate({ action, targetType, target, ...(reason.trim() ? { reason: reason.trim() } : {}), ...(undoOf ? { undoOf } : {}) });
+        setStatus(receiptMessage(receipt));
+        if (receipt.status === "ok") setReason("");
+      } catch (error) {
+        setStatus(`Error: ${error instanceof Error ? error.message : "The action failed."}`);
+      }
+      await refresh(true);
+    },
+    [reason, refresh],
+  );
+
+  return (
+    <ModerationView
+      mode={mode}
+      queue={data?.queue ?? []}
+      hidden={data?.hidden ?? []}
+      log={data?.log ?? []}
+      tab={tab}
+      busy={busy}
+      status={status}
+      reason={reason}
+      onTab={setTab}
+      onReason={setReason}
+      onAction={(action, targetType, target, undoOf) => void onAction(action, targetType, target, undoOf)}
+      onRefresh={() => void refresh()}
+    />
+  );
+}

package/components/reference-cyclotron-priming.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState } from "react";
+import { useId, useRef, useState, type KeyboardEvent } from "react";
 import { primingStateText, type PrimingRequestView } from "../lib/relevance-status";
 
 export type PrimingFormInput = { url: string; label: string; explanation: string };
@@ -23,6 +23,19 @@ export function ReferenceCyclotronPriming({
   const [explanation, setExplanation] = useState("");
   const [message, setMessage] = useState<string | null>(null);
 
+  const ratingLabelId = useId();
+  const buttons = useRef<Array<HTMLButtonElement | null>>([]);
+
+  function moveSelection(event: KeyboardEvent<HTMLButtonElement>, index: number) {
+    const forward = event.key === "ArrowRight" || event.key === "ArrowDown";
+    const backward = event.key === "ArrowLeft" || event.key === "ArrowUp";
+    if (!forward && !backward) return;
+    event.preventDefault();
+    const next = (index + (forward ? 1 : -1) + labels.length) % labels.length;
+    setLabel(labels[next]);
+    buttons.current[next]?.focus();
+  }
+
   async function submit() {
     setMessage("Adding…");
     try {
@@ -38,13 +51,13 @@ export function ReferenceCyclotronPriming({
   return (
     <div className="space-y-2 text-sm" data-reference-cyclotron-priming>
       <form
-        className="flex flex-wrap items-end gap-3"
+        className="flex flex-col gap-3"
         onSubmit={(event) => {
           event.preventDefault();
           void submit();
         }}
       >
-        <label className="flex min-w-64 flex-1 flex-col gap-1">
+        <label className="flex flex-col gap-1">
           <span className="text-xs text-muted-foreground">Web page address</span>
           <input
             aria-label="Reference URL"
@@ -55,20 +68,46 @@ export function ReferenceCyclotronPriming({
             value={url}
           />
         </label>
+        <div className="flex flex-col gap-1">
+          <span className="text-xs text-muted-foreground" id={ratingLabelId}>Should Papyrus include or exclude pages like this?</span>
+          <div aria-labelledby={ratingLabelId} className="flex flex-wrap gap-2" role="radiogroup">
+            {labels.map((choice, index) => {
+              const checked = choice === label;
+              return (
+                <button
+                  aria-checked={checked}
+                  className={`min-w-32 flex-1 rounded border px-4 py-3 text-base font-semibold capitalize ${checked ? "border-foreground bg-foreground text-background" : "border-border bg-transparent"}`}
+                  data-rating-choice={choice}
+                  key={choice}
+                  onClick={() => setLabel(choice)}
+                  onKeyDown={(event) => moveSelection(event, index)}
+                  ref={(node) => { buttons.current[index] = node; }}
+                  role="radio"
+                  tabIndex={checked || (!labels.includes(label) && index === 0) ? 0 : -1}
+                  type="button"
+                >
+                  {choice}
+                </button>
+              );
+            })}
+          </div>
+        </div>
         <label className="flex flex-col gap-1">
-          <span className="text-xs text-muted-foreground">Include or exclude</span>
-          <select aria-label="Include or exclude" onChange={(event) => setLabel(event.target.value)} value={label}>
-            {labels.map((choice) => (
-              <option key={choice} value={choice}>{choice}</option>
-            ))}
-          </select>
-        </label>
-        <label className="flex min-w-48 flex-1 flex-col gap-1">
-          <span className="text-xs text-muted-foreground">Why (optional)</span>
-          <input aria-label="Reason" onChange={(event) => setExplanation(event.target.value)} type="text" value={explanation} />
+          <span className="text-sm font-medium">Why?</span>
+          <textarea
+            aria-label="Reason"
+            className="w-full"
+            onChange={(event) => setExplanation(event.target.value)}
+            placeholder="Why? A sentence or two helps Papyrus learn what you want."
+            rows={4}
+            value={explanation}
+          />
+          <span className="text-xs text-muted-foreground">Optional, but a short reason helps Papyrus learn what you want.</span>
         </label>
-        <button className="cyclotron-review-secondary" type="submit">Add reference</button>
-        {message ? <p className="basis-full text-xs" role="status">{message}</p> : null}
+        <div>
+          <button className="cyclotron-review-secondary" type="submit">Add reference</button>
+        </div>
+        {message ? <p className="text-xs" role="status">{message}</p> : null}
       </form>
       {requests.length ? (
         <ul aria-label="Added references" className="space-y-1 text-xs text-muted-foreground">

package/components/topic-steering-workspace.tsx

@@ -15,6 +15,7 @@ import { useCallback, useEffect, useId, useLayoutEffect, useMemo, useRef, useSta
 import amplifyOutputs from "papyrus-amplify-outputs";
 import { EditorialChecksAdminPanel } from "./editorial-checks-admin-panel";
 import { MonitoringPanel } from "./monitoring-panel";
+import { ModerationPanel } from "./moderation-panel";
 import { SignupEntriesPanel } from "./signup-entries-panel";
 import { pluginSettings, type PluginOutputs } from "../lib/plugin-settings";
 import { generateClient } from "aws-amplify/data";
@@ -249,7 +250,7 @@ type AssignmentAction = "claim" | "release" | "complete" | "cancel" | "reopen" |
 type ReportingPacketReviewDecision = "select" | "merge" | "brief" | "hold" | "kill";
 type AssignmentDeskViewMode = "queue" | "budget";
 type UserRoleAction = "grant" | "revoke";
-type AdministrationPanel = "users" | "policies" | "sections" | "procedures" | "delegations" | "signups" | "editorial-checks" | "monitoring";
+type AdministrationPanel = "users" | "policies" | "sections" | "procedures" | "delegations" | "signups" | "moderation" | "editorial-checks" | "monitoring";
 export type NewsDeskTab = "overview" | "desks" | "topics" | "concepts" | "references" | "messages" | "assignments" | "administration" | "search";
 type LexicalRuleScope = "publication" | "corpus" | "classifier" | "category";
 type AnalysisReindexMode = "online-update" | "classifier-retrain" | "scoped-topic-rebuild" | "entity-graph-rebuild" | "generated-analysis-rebuild";
@@ -4351,9 +4352,21 @@ function AdministrationDeskView({
                   <span>Addresses from the site&apos;s signup forms</span>
                 </Link>
               ) : null}
+              {readerPluginEnabled() ? (
+                <Link
+                  href={administrationPanelHref("moderation", isDemo)}
+                  data-news-desk-admin-nav="moderation"
+                  data-active={administrationPanel === "moderation" || undefined}
+                  onClick={() => onPanelChange("moderation")}
+                >
+                  <strong>Moderation</strong>
+                  <span>Reader submissions and comments</span>
+                </Link>
+              ) : null}
             </nav>}
             <div className="news-desk-settings-panel">
               {administrationPanel === "signups" ? <SignupEntriesPanel /> : null}
+              {administrationPanel === "moderation" ? <ModerationPanel /> : null}
               {administrationPanel === "editorial-checks" ? <EditorialChecksAdminPanel /> : null}
               {administrationPanel === "monitoring" ? <MonitoringPanel isAdmin={canManageUsers} isDemo={isDemo} /> : null}
               {administrationPanel === "delegations" ? <AdministrationDelegationsPanel disabled={disabled} /> : null}
@@ -12819,9 +12832,14 @@ function signupPluginEnabled(): boolean {
   return pluginSettings(amplifyOutputs as PluginOutputs, "signup") !== null;
 }
 
+function readerPluginEnabled(): boolean {
+  return pluginSettings(amplifyOutputs as PluginOutputs, "reader-steering") !== null;
+}
+
 function normalizeAdministrationPanel(value: string | null | undefined): AdministrationPanel {
   if (value === "policies" || value === "sections" || value === "procedures" || value === "delegations" || value === "editorial-checks" || value === "monitoring") return value;
   if (value === "signups" && signupPluginEnabled()) return value;
+  if (value === "moderation" && readerPluginEnabled()) return value;
   return "users";
 }
 

package/infra/amplify-app-shell.js

@@ -4,7 +4,7 @@ import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter.js";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -123,6 +123,20 @@ export class AmplifyAppShellStack extends Stack {
                 resources: [prospectusSessionSealing.parameterArn],
             }));
         }
+        if (prospectusAccountsApiStageArn && config.cms.readerRetirementPoll) {
+            // Prospectus admits one caller per site, this compute role, so the scheduled snapshot run reaches the retired-subject
+            // route through the CMS route /api/reader/retired, which it authenticates with this secret.
+            const readerPollSecret = new SecureStringParameter(this, "ReaderPollSecretParameter", {
+                parameterName: resolveReaderPollSecretParameterName(config),
+                description: `Authorizes the scheduled reader snapshot run to call the retired-subject route of ${cmsAppName}`,
+            });
+            prospectusEnvironment.PAPYRUS_READER_POLL_SECRET_PARAMETER = readerPollSecret.parameterName;
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "ReadReaderPollSecret",
+                actions: ["ssm:GetParameter"],
+                resources: [readerPollSecret.parameterArn],
+            }));
+        }
         if (prospectusAccountsApiStageArn) {
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "InvokeProspectusAccountsAsRegisteredSite",

package/infra/amplify-app-shell.ts

@@ -5,7 +5,7 @@ import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -136,6 +136,22 @@ export class AmplifyAppShellStack extends Stack {
         }),
       );
     }
+    if (prospectusAccountsApiStageArn && config.cms.readerRetirementPoll) {
+      // Prospectus admits one caller per site, this compute role, so the scheduled snapshot run reaches the retired-subject
+      // route through the CMS route /api/reader/retired, which it authenticates with this secret.
+      const readerPollSecret = new SecureStringParameter(this, "ReaderPollSecretParameter", {
+        parameterName: resolveReaderPollSecretParameterName(config),
+        description: `Authorizes the scheduled reader snapshot run to call the retired-subject route of ${cmsAppName}`,
+      });
+      prospectusEnvironment.PAPYRUS_READER_POLL_SECRET_PARAMETER = readerPollSecret.parameterName;
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "ReadReaderPollSecret",
+          actions: ["ssm:GetParameter"],
+          resources: [readerPollSecret.parameterArn],
+        }),
+      );
+    }
     if (prospectusAccountsApiStageArn) {
       computeRole.addToPolicy(
         new iam.PolicyStatement({

package/infra/site-config.js

@@ -35,7 +35,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_SITE_ORIGIN"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
     "GET/v1/identities/me",
@@ -63,6 +63,9 @@ function originOfRedirectUrl(value) {
 export function resolveProspectusSessionSealingParameterName(config) {
     return `/papyrus/${config.siteId}/prospectus-session-sealing`;
 }
+export function resolveReaderPollSecretParameterName(config) {
+    return `/papyrus/${config.siteId}/reader-poll-secret`;
+}
 export function resolveRevalidateSecretParameterName(config) {
     return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -222,7 +225,7 @@ function parseStagingPreview(value) {
 }
 function parseCms(value) {
     const cmsRecord = requireObject(value, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "siteOrigin", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "siteOrigin", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "readerRetirementPoll", "deployStackInBuild"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -233,6 +236,12 @@ function parseCms(value) {
     if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
         fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
     }
+    if (cmsRecord.readerRetirementPoll !== undefined && typeof cmsRecord.readerRetirementPoll !== "boolean") {
+        fail("cms.readerRetirementPoll", `must be a boolean, got ${JSON.stringify(cmsRecord.readerRetirementPoll)}`);
+    }
+    if (cmsRecord.readerRetirementPoll === true && cmsRecord.prospectusAccountsApiStageArn === undefined) {
+        fail("cms.readerRetirementPoll", "requires cms.prospectusAccountsApiStageArn: the poll calls Prospectus as the site");
+    }
     if (cmsRecord.deployStackInBuild !== undefined && typeof cmsRecord.deployStackInBuild !== "boolean") {
         fail("cms.deployStackInBuild", `must be a boolean, got ${JSON.stringify(cmsRecord.deployStackInBuild)}`);
     }
@@ -250,6 +259,7 @@ function parseCms(value) {
         stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
         redirects: parseRedirects(cmsRecord.redirects),
         deployStackInBuild: cmsRecord.deployStackInBuild,
+        readerRetirementPoll: cmsRecord.readerRetirementPoll,
         stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
         prospectusAccountsApiStageArn: optionalString(cmsRecord.prospectusAccountsApiStageArn, "cms.prospectusAccountsApiStageArn", PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN, "arn:aws:execute-api:<region>:<account>:<api id>/api"),
     };

package/infra/site-config.ts

@@ -44,6 +44,12 @@ export type CmsConfig = {
   stagingDomainPrefix?: string;
   redirects?: CmsRedirect[];
   prospectusAccountsApiStageArn?: string;
+  /**
+   * The site is a public-reader site that polls Prospectus for retired reader subjects. The template then generates a
+   * shared secret that the scheduled snapshot run presents to the CMS route `/api/reader/retired` (requires
+   * `prospectusAccountsApiStageArn`; docs/reader-steering.md).
+   */
+  readerRetirementPoll?: boolean;
   deployStackInBuild?: boolean;
 };
 
@@ -146,7 +152,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_SITE_ORIGIN"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
 
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
@@ -177,6 +183,10 @@ export function resolveProspectusSessionSealingParameterName(config: Pick<Amplif
   return `/papyrus/${config.siteId}/prospectus-session-sealing`;
 }
 
+export function resolveReaderPollSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
+  return `/papyrus/${config.siteId}/reader-poll-secret`;
+}
+
 export function resolveRevalidateSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
   return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -336,7 +346,7 @@ function parseStagingPreview(value: unknown): StagingPreviewConfig | undefined {
 
 function parseCms(value: unknown): CmsConfig {
   const cmsRecord = requireObject(value, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "siteOrigin", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "siteOrigin", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "readerRetirementPoll", "deployStackInBuild"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -347,6 +357,12 @@ function parseCms(value: unknown): CmsConfig {
   if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
     fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
   }
+  if (cmsRecord.readerRetirementPoll !== undefined && typeof cmsRecord.readerRetirementPoll !== "boolean") {
+    fail("cms.readerRetirementPoll", `must be a boolean, got ${JSON.stringify(cmsRecord.readerRetirementPoll)}`);
+  }
+  if (cmsRecord.readerRetirementPoll === true && cmsRecord.prospectusAccountsApiStageArn === undefined) {
+    fail("cms.readerRetirementPoll", "requires cms.prospectusAccountsApiStageArn: the poll calls Prospectus as the site");
+  }
   if (cmsRecord.deployStackInBuild !== undefined && typeof cmsRecord.deployStackInBuild !== "boolean") {
     fail("cms.deployStackInBuild", `must be a boolean, got ${JSON.stringify(cmsRecord.deployStackInBuild)}`);
   }
@@ -369,6 +385,7 @@ function parseCms(value: unknown): CmsConfig {
     stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
     redirects: parseRedirects(cmsRecord.redirects),
     deployStackInBuild: cmsRecord.deployStackInBuild as boolean | undefined,
+    readerRetirementPoll: cmsRecord.readerRetirementPoll as boolean | undefined,
     stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
     prospectusAccountsApiStageArn: optionalString(
       cmsRecord.prospectusAccountsApiStageArn,