@anthusai/papyrus 2.0.0-next.67 → 2.0.0-next.68

package/amplify/plugins/reader-steering/config.js

@@ -5,8 +5,9 @@ export const MODERATION_MODES = ["off", "human", "ai"];
 export const AI_KEY_PARAMETER = /^\/papyrus\/[a-z0-9][a-z0-9-]{0,62}\/openai-api-key$/;
 export const AI_MODEL_NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/;
 export const SUBMISSION_KIND_NAME = /^[a-z][a-z0-9-]{0,23}$/;
+export const SUBJECT_TYPES = ["item", "submission", "story", "proposal", "concept"];
 export const COMPUTE_ROLE_ARN = /^arn:aws:iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
 function object(raw, label, known) {
     if (raw === undefined)
         return {};
@@ -111,6 +112,11 @@ export function resolveReaderSteeringConfig(request) {
             throw new Error(`reader-steering plugin moderation.ai.model must be a model name matching ${AI_MODEL_NAME}`);
         }
     }
+    const subjects = object(raw.subjects, "subjects", ["types"]);
+    const subjectTypes = subjects.types === undefined ? ["item", "submission"] : subjects.types;
+    if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => SUBJECT_TYPES.includes(type))) {
+        throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
+    }
     const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
     const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
     const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -154,6 +160,7 @@ export function resolveReaderSteeringConfig(request) {
             itemType: lowercaseName(submissions.itemType, "submissions.itemType", "brief"),
             section: lowercaseName(submissions.section, "submissions.section", "unsectioned"),
         },
+        subjects: { types: [...new Set(subjectTypes)] },
         moderation: {
             mode: mode,
             preModeration,

package/amplify/plugins/reader-steering/config.ts

@@ -7,6 +7,7 @@ export const MODERATION_MODES = ["off", "human", "ai"] as const;
 export const AI_KEY_PARAMETER = /^\/papyrus\/[a-z0-9][a-z0-9-]{0,62}\/openai-api-key$/;
 export const AI_MODEL_NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/;
 export const SUBMISSION_KIND_NAME = /^[a-z][a-z0-9-]{0,23}$/;
+export const SUBJECT_TYPES = ["item", "submission", "story", "proposal", "concept"] as const;
 export const COMPUTE_ROLE_ARN = /^arn:aws:iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
 
 export type ReaderSteeringConfig = {
@@ -63,6 +64,11 @@ export type ReaderSteeringConfig = {
     /** The section of that draft. */
     section: string;
   };
+  /**
+   * The kinds of subject a signed-in reader may vote on and flag, by `{type, id}`. Default: items and submissions, which is
+   * what readers could vote on before subject types existed. `story`, `proposal` and `concept` are opt-in.
+   */
+  subjects: { types: (typeof SUBJECT_TYPES)[number][] };
   moderation: {
     /**
      * `human`: new submissions and comments are public at once and wait in the Administration queue (the default for a pilot).
@@ -109,7 +115,7 @@ export type ReaderSteeringConfig = {
   retirementPoll: boolean;
 };
 
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
 
 function object(raw: unknown, label: string, known: string[]): Record<string, unknown> {
   if (raw === undefined) return {};
@@ -206,6 +212,11 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
       throw new Error(`reader-steering plugin moderation.ai.model must be a model name matching ${AI_MODEL_NAME}`);
     }
   }
+  const subjects = object(raw.subjects, "subjects", ["types"]);
+  const subjectTypes = subjects.types === undefined ? ["item", "submission"] : subjects.types;
+  if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => (SUBJECT_TYPES as readonly unknown[]).includes(type))) {
+    throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
+  }
   const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
   const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
   const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -249,6 +260,7 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
       itemType: lowercaseName(submissions.itemType, "submissions.itemType", "brief"),
       section: lowercaseName(submissions.section, "submissions.section", "unsectioned"),
     },
+    subjects: { types: [...new Set(subjectTypes)] as (typeof SUBJECT_TYPES)[number][] },
     moderation: {
       mode: mode as (typeof MODERATION_MODES)[number],
       preModeration,

package/amplify/plugins/reader-steering/function/handler.py

@@ -54,6 +54,21 @@ ACTION_RATING = "rating"
 ACTION_SUBMIT = "submit"
 ACTION_COMMENT = "comment"
 ACTION_REPORT = "report"
+ACTION_FLAG = "flag"
+SUBJECT_TYPE_ITEM = "item"
+SUBJECT_TYPE_SUBMISSION = "submission"
+SUBJECT_TYPES = (SUBJECT_TYPE_ITEM, SUBJECT_TYPE_SUBMISSION, "story", "proposal", "concept")
+DEFAULT_SUBJECT_TYPES = (SUBJECT_TYPE_ITEM, SUBJECT_TYPE_SUBMISSION)
+SUBJECT_ID = re.compile(r"[A-Za-z0-9._:-]{1,190}")
+VOTE_DIMENSION = "up"
+VOTE_PAYLOAD_KEYS = frozenset({"subject", "value"})
+FLAG_WRONG = "wrong"
+FLAG_BELONGS_UNDER = "belongs_under"
+FLAG_BETTER_NAME = "better_name"
+FLAG_KINDS = (FLAG_WRONG, FLAG_BELONGS_UNDER, FLAG_BETTER_NAME)
+FLAG_PAYLOAD_KEYS = frozenset({"subject", "kind", "reason", "target", "name"})
+MAXIMUM_FLAG_REASON = 500
+MAXIMUM_SUGGESTED_NAME = 120
 RATE_BUCKET_REPORT = "report"
 REPORT_ID_PREFIX = "rep-"
 MAXIMUM_REPORT_REASON = 500
@@ -127,6 +142,7 @@ class ReaderSettings:
     promote_section: str = "unsectioned"
     ai_model: str = ai_moderation.DEFAULT_MODEL
     ai_key_parameter: str = ""
+    subject_types: tuple[str, ...] = DEFAULT_SUBJECT_TYPES
 
 
 def settings_from_environment(environment: dict[str, str] | None = None) -> ReaderSettings:
@@ -154,6 +170,7 @@ def settings_from_environment(environment: dict[str, str] | None = None) -> Read
         reports_per_day=int((raw.get("moderation") or {}).get("reportsPerDay", defaults.reports_per_day)),
         ai_model=str(((raw.get("moderation") or {}).get("ai") or {}).get("model", defaults.ai_model)),
         ai_key_parameter=str(((raw.get("moderation") or {}).get("ai") or {}).get("apiKeyParameter", defaults.ai_key_parameter)),
+        subject_types=tuple((raw.get("subjects") or {}).get("types") or defaults.subject_types),
         promote_item_type=str((raw.get("submissions") or {}).get("itemType", defaults.promote_item_type)),
         promote_section=str((raw.get("submissions") or {}).get("section", defaults.promote_section)),
     )
@@ -172,6 +189,8 @@ class ReaderStore(Protocol):
 
     def delete_vote(self, vote_id: str) -> None: ...
 
+    def put_flag(self, flag: dict[str, Any], now_iso: str) -> None: ...
+
     def is_published(self, subject_key: str) -> bool: ...
 
     def get_submission(self, submission_id: str) -> dict[str, Any] | None: ...
@@ -229,6 +248,30 @@ def vote_id(subject_key: str, reader_id: str, dimension: str) -> str:
     return f"{subject_key}#{reader_id}#{dimension}"
 
 
+def subject_key(subject_type: str, subject_id: str) -> str:
+    """The key a vote is stored under: items and submissions keep their bare id (so every vote written before subject types stays valid); other types are prefixed."""
+    return subject_id if subject_type in (SUBJECT_TYPE_ITEM, SUBJECT_TYPE_SUBMISSION) else f"{subject_type}:{subject_id}"
+
+
+def legacy_subject_type(key: str) -> str:
+    """The type of a bare subject key: a submission id, otherwise an item."""
+    return SUBJECT_TYPE_SUBMISSION if SUBMISSION_ID.fullmatch(key) else SUBJECT_TYPE_ITEM
+
+
+def parse_subject(raw: Any, settings: ReaderSettings) -> tuple[tuple[str, str] | None, dict[str, Any] | None]:
+    """``({type, id}) -> (type, id)``, or a refusal. A bare string is a subject written before subject types: its type is read from its shape."""
+    if isinstance(raw, str):
+        raw = {"type": legacy_subject_type(raw), "id": raw}
+    if not isinstance(raw, dict) or set(raw) != {"type", "id"} or not isinstance(raw["type"], str) or not isinstance(raw["id"], str):
+        return None, refusal(422, "invalid_subject", "Send the subject as {type, id}.")
+    subject_type, subject_id = raw["type"], raw["id"]
+    if subject_type not in SUBJECT_TYPES or subject_type not in settings.subject_types:
+        return None, refusal(422, "unknown_subject_type", "That kind of subject cannot be voted on here.")
+    if not SUBJECT_ID.fullmatch(subject_id):
+        return None, refusal(422, "invalid_subject", "Send the id of the subject.")
+    return (subject_type, subject_id), None
+
+
 def valid_site_subject(value: Any, settings: ReaderSettings) -> bool:
     if not isinstance(value, str):
         return False
@@ -321,13 +364,18 @@ def public_profile(profile: dict[str, Any]) -> dict[str, Any]:
 
 
 def my_state(store: ReaderStore, profile: dict[str, Any], payload: dict[str, Any], settings: ReaderSettings) -> dict[str, Any]:
-    subjects = payload.get("subjects", [])
-    if (
-        not isinstance(subjects, list)
-        or len(subjects) > MAXIMUM_SUBJECTS
-        or not all(isinstance(subject, str) and SUBJECT_KEY.fullmatch(subject) for subject in subjects)
-    ):
-        return refusal(422, "invalid_subjects", f"Send at most {MAXIMUM_SUBJECTS} item keys.")
+    raw_subjects = payload.get("subjects", [])
+    if not isinstance(raw_subjects, list) or len(raw_subjects) > MAXIMUM_SUBJECTS:
+        return refusal(422, "invalid_subjects", f"Send at most {MAXIMUM_SUBJECTS} subjects.")
+    subjects: list[str] = []
+    for raw in raw_subjects:
+        if isinstance(raw, str) and SUBJECT_KEY.fullmatch(raw):
+            subjects.append(raw)
+            continue
+        parsed, _ = parse_subject(raw, settings) if isinstance(raw, dict) else (None, None)
+        if parsed is None:
+            return refusal(422, "invalid_subjects", f"Send at most {MAXIMUM_SUBJECTS} subject keys or {{type, id}} subjects.")
+        subjects.append(subject_key(*parsed))
     dimensions = [*TOGGLE_DIMENSIONS, *settings.dimensions]
     wanted = {vote_id(subject, profile["readerId"], dimension): (subject, dimension) for subject in subjects for dimension in dimensions}
     found = store.get_vote_values(list(wanted))
@@ -375,8 +423,11 @@ def react(
     now_seconds: float,
     schedule_snapshot: Callable[[], None],
 ) -> dict[str, Any]:
-    if not isinstance(subject, str) or not SUBJECT_KEY.fullmatch(subject):
-        return refusal(422, "invalid_subject", "Send the key of a published item.")
+    parsed, refused = parse_subject(subject, settings)
+    if refused:
+        return refused
+    subject_type, subject_id = parsed
+    subject = subject_key(subject_type, subject_id)
     if not isinstance(dimension, str) or dimension not in allowed_dimensions:
         return refusal(422, "invalid_dimension", "That dimension is not available.")
     if profile.get("state") == STATE_BANNED:
@@ -386,7 +437,7 @@ def react(
     limited = within_rate_limit(store, profile, RATE_BUCKET_REACTIONS, action_limit(profile, settings, now_seconds), now_seconds)
     if limited:
         return limited
-    if not subject_is_open(store, subject):
+    if not subject_is_open(store, subject_type, subject_id):
         return refusal(404, "unknown_subject", "That item is not published.")
     stored_id = vote_id(subject, profile["readerId"], dimension)
     if value is None:
@@ -396,6 +447,7 @@ def react(
             {
                 "id": stored_id,
                 "subjectKey": subject,
+                "subjectType": subject_type,
                 "readerId": profile["readerId"],
                 "dimension": dimension,
                 "value": value,
@@ -407,12 +459,17 @@ def react(
     return reply(200, {"subject": subject, "dimension": dimension, "value": value})
 
 
-def subject_is_open(store: ReaderStore, subject: str) -> bool:
-    """A published item, or a submission that is visible (pending or promoted); hidden submissions cannot be voted on."""
-    if SUBMISSION_ID.fullmatch(subject):
-        submission = store.get_submission(subject)
+def subject_is_open(store: ReaderStore, subject_type: str, subject_id: str) -> bool:
+    """A published item, or a submission that is visible (pending or promoted); hidden submissions cannot be voted on.
+
+    The other subject types have no record in this plugin (stories, proposals and concepts live in the site's own data), so any well-formed id is open.
+    """
+    if subject_type == SUBJECT_TYPE_SUBMISSION:
+        submission = store.get_submission(subject_id)
         return submission is not None and submission.get("state") in VISIBLE_SUBMISSION_STATES
-    return store.is_published(subject)
+    if subject_type == SUBJECT_TYPE_ITEM:
+        return store.is_published(subject_id)
+    return True
 
 
 def clean_text(value: Any, label: str, maximum: int, *, required: bool) -> tuple[str | None, dict[str, Any] | None]:
@@ -606,7 +663,7 @@ def comment_action(
     limited = within_rate_limit(store, profile, RATE_BUCKET_COMMENT, new_account_limit(profile, settings, now_seconds, settings.comments_per_hour), now_seconds)
     if limited:
         return limited
-    if not subject_is_open(store, subject):
+    if not subject_is_open(store, legacy_subject_type(subject), subject):
         return refusal(404, "unknown_subject", "That item is not published.")
     if parent_id is not None:
         parent = store.get_comment(parent_id)
@@ -677,6 +734,75 @@ def report_action(
     return reply(200, {"reported": True})
 
 
+def flag_action(
+    store: ReaderStore,
+    profile: dict[str, Any],
+    payload: dict[str, Any],
+    settings: ReaderSettings,
+    is_staff: bool,
+    now_seconds: float,
+    schedule_snapshot: Callable[[], None],
+) -> dict[str, Any]:
+    """A reader flags a subject as wrong, as belonging under another subject, or as needing a better name; a reason is required.
+
+    One flag per reader, subject and kind: flagging again replaces the reason. Flags are stored apart from votes and reach the
+    snapshot as counts only. The stored row holds the readerId, never a siteSubject.
+    """
+    if set(payload) - FLAG_PAYLOAD_KEYS:
+        return refusal(422, "invalid_flag", "Send subject, kind, reason, and target or name for the kind.")
+    kind = payload.get("kind")
+    if kind not in FLAG_KINDS:
+        return refusal(422, "invalid_flag_kind", f"Send kind as one of {', '.join(FLAG_KINDS)}.")
+    parsed, refused = parse_subject(payload.get("subject"), settings)
+    if refused:
+        return refused
+    reason = payload.get("reason")
+    if not isinstance(reason, str) or not reason.strip() or len(reason.strip()) > MAXIMUM_FLAG_REASON or CONTROL_CHARACTERS.search(reason):
+        return refusal(422, "invalid_reason", f"Give a reason in plain text of at most {MAXIMUM_FLAG_REASON} characters.")
+    if EMAIL_ADDRESS.search(reason):
+        return refusal(422, "invalid_reason", "A reason cannot contain an email address.")
+    target_key: str | None = None
+    suggested: str | None = None
+    if kind == FLAG_BELONGS_UNDER:
+        target, refused = parse_subject(payload.get("target"), settings) if isinstance(payload.get("target"), dict) else (None, True)
+        if refused or "name" in payload:
+            return refusal(422, "invalid_target", "Send target as {type, id} for belongs_under.")
+        target_key = subject_key(*target)
+        if target_key == subject_key(*parsed):
+            return refusal(422, "invalid_target", "A subject cannot belong under itself.")
+    elif kind == FLAG_BETTER_NAME:
+        suggested, refused = clean_text(payload.get("name"), "name", MAXIMUM_SUGGESTED_NAME, required=True)
+        if refused or "target" in payload:
+            return refused or refusal(422, "invalid_name", "Send name for better_name.")
+    elif "target" in payload or "name" in payload:
+        return refusal(422, "invalid_flag", "wrong takes only a reason.")
+    if profile.get("state") == STATE_LIMITED:
+        return refusal(403, "reader_limited", "This reader cannot flag right now.")
+    limited = within_rate_limit(store, profile, RATE_BUCKET_REACTIONS, action_limit(profile, settings, now_seconds), now_seconds)
+    if limited:
+        return limited
+    subject_type, subject_id = parsed
+    if not subject_is_open(store, subject_type, subject_id):
+        return refusal(404, "unknown_subject", "That subject cannot be flagged.")
+    key = subject_key(subject_type, subject_id)
+    store.put_flag(
+        {
+            "id": f"{key}#{profile['readerId']}#{kind}",
+            "subjectKey": key,
+            "subjectType": subject_type,
+            "readerId": profile["readerId"],
+            "kind": kind,
+            "reason": reason.strip(),
+            "targetKey": target_key,
+            "suggestedName": suggested,
+            "voterRole": ROLE_EDITOR if is_staff else ROLE_READER,
+        },
+        iso(now_seconds),
+    )
+    schedule_snapshot()
+    return reply(200, {"subject": payload["subject"], "kind": kind})
+
+
 def own_comment(store: ReaderStore, profile: dict[str, Any], payload: dict[str, Any], allowed: frozenset[str]) -> tuple[dict[str, Any] | None, dict[str, Any] | None]:
     if set(payload) - allowed:
         return None, refusal(422, "invalid_comment", "Send only " + ", ".join(sorted(allowed)) + ".")
@@ -740,7 +866,23 @@ def delete_comment_action(
     return reply(200, {"id": comment["id"], "state": COMMENT_DELETED})
 
 
+def typed_vote_action(store, profile, payload, settings, is_staff, now_seconds, schedule_snapshot):
+    """``{subject: {type, id}, value: 1 | -1 | null}``: an up or down vote on any enabled subject type; ``null`` removes the reader's vote."""
+    value = payload.get("value")
+    if set(payload) - VOTE_PAYLOAD_KEYS or isinstance(value, bool) or value not in (1, -1, None):
+        return refusal(422, "invalid_vote", "Send only subject and value, and value as 1, -1 or null.")
+    answer = react(
+        store, profile, subject=payload.get("subject"), dimension=VOTE_DIMENSION, allowed_dimensions=(VOTE_DIMENSION,),
+        value=value, is_staff=is_staff, settings=settings, now_seconds=now_seconds, schedule_snapshot=schedule_snapshot,
+    )
+    if answer["statusCode"] == 200:
+        answer = reply(200, {"subject": payload["subject"], "value": value})
+    return answer
+
+
 def vote_action(store, profile, payload, settings, is_staff, now_seconds, schedule_snapshot):
+    if isinstance(payload.get("subject"), dict):
+        return typed_vote_action(store, profile, payload, settings, is_staff, now_seconds, schedule_snapshot)
     on = payload.get("on")
     if not isinstance(on, bool):
         return refusal(422, "invalid_vote", "Send on as true or false.")
@@ -794,6 +936,8 @@ def handle_event(
         return delete_comment_action(store, profile, payload, settings, now_seconds, schedule_snapshot)
     if action == ACTION_REPORT:
         return report_action(store, profile, payload, settings, now_seconds, schedule_snapshot)
+    if action == ACTION_FLAG:
+        return flag_action(store, profile, payload, settings, event["isStaff"], now_seconds, schedule_snapshot)
     return refusal(400, "unknown_action", "Unknown action.")
 
 
@@ -832,6 +976,7 @@ class DynamoReaderStore:
         report_table: str = "",
         action_table: str = "",
         item_table: str = "",
+        flag_table: str = "",
     ) -> None:
         self._resource = resource
         self._names = {
@@ -845,6 +990,7 @@ class DynamoReaderStore:
             "report": report_table,
             "action": action_table,
             "item": item_table,
+            "flag": flag_table,
         }
 
     def _table(self, key: str) -> Any:
@@ -914,13 +1060,14 @@ class DynamoReaderStore:
         self._table("vote").update_item(
             Key={"id": vote["id"]},
             UpdateExpression=(
-                "SET #t = :t, subjectKey = :s, readerId = :r, #d = :d, #v = :v, voterRole = :role, "
+                "SET #t = :t, subjectKey = :s, subjectType = :st, readerId = :r, #d = :d, #v = :v, voterRole = :role, "
                 "createdAt = if_not_exists(createdAt, :now), updatedAt = :now"
             ),
             ExpressionAttributeNames={"#t": "__typename", "#d": "dimension", "#v": "value"},
             ExpressionAttributeValues={
                 ":t": "ReaderVote",
                 ":s": vote["subjectKey"],
+                ":st": vote.get("subjectType") or legacy_subject_type(vote["subjectKey"]),
                 ":r": vote["readerId"],
                 ":d": vote["dimension"],
                 ":v": vote["value"],
@@ -932,6 +1079,9 @@ class DynamoReaderStore:
     def delete_vote(self, vote_id_: str) -> None:
         self._table("vote").delete_item(Key={"id": vote_id_})
 
+    def put_flag(self, flag: dict[str, Any], now_iso: str) -> None:
+        self._table("flag").put_item(Item=_without_none({**flag, "__typename": "ReaderFlag", "createdAt": now_iso, "updatedAt": now_iso}))
+
     def is_published(self, subject_key: str) -> bool:
         item = self._table("published").get_item(Key={"id": PUBLISHED_ID_PREFIX + subject_key}, ProjectionExpression="#s", ExpressionAttributeNames={"#s": "status"}).get("Item")
         return bool(item) and item.get("status") == "published"
@@ -1259,6 +1409,7 @@ def store_from_environment(environment: dict[str, str] | None = None) -> DynamoR
         report_table=environment.get("PAPYRUS_READER_REPORT_TABLE", ""),
         action_table=environment.get("PAPYRUS_READER_ACTION_TABLE", ""),
         item_table=environment.get("PAPYRUS_READER_ITEM_TABLE", ""),
+        flag_table=environment.get("PAPYRUS_READER_FLAG_TABLE", ""),
     )
 
 

package/amplify/plugins/reader-steering/papyrus.plugin.js

@@ -14,7 +14,7 @@ export const READER_POLL_SECRET_PARAMETER_ENV = "PAPYRUS_READER_POLL_SECRET_PARA
 export const readerSteeringManifest = {
     name: "reader-steering",
     contract: 1,
-    models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction"],
+    models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction"],
     mutations: ["moderateReader"],
     guest: { mutations: [] },
     newsroomPanels: [{ id: "moderation", label: "Moderation" }],
@@ -26,6 +26,7 @@ export function readerActionsSettings(config, allowInterimSubjects) {
         dimensions: config.dimensions,
         limits: config.limits,
         submissions: config.submissions,
+        subjects: config.subjects,
         comments: config.comments,
         moderation: config.moderation,
         reservedHandles: config.reservedHandles,
@@ -38,6 +39,7 @@ export function readerSnapshotSettings(config) {
     return {
         dimensions: config.dimensions,
         submissions: config.submissions,
+        subjects: config.subjects,
         karma: config.karma,
         ranking: config.ranking,
         limits: { newAccountHours: config.limits.newAccountHours },
@@ -110,6 +112,7 @@ export const readerSteeringPlugin = {
             ["PAPYRUS_READER_PROFILE_TABLE", "ReaderProfile"],
             ["PAPYRUS_READER_HANDLE_TABLE", "ReaderHandle"],
             ["PAPYRUS_READER_VOTE_TABLE", "ReaderVote"],
+            ["PAPYRUS_READER_FLAG_TABLE", "ReaderFlag"],
             ["PAPYRUS_READER_SUBMISSION_TABLE", "ReaderSubmission"],
             ["PAPYRUS_READER_COMMENT_TABLE", "ReaderComment"],
             ["PAPYRUS_READER_REPORT_TABLE", "ReaderReport"],
@@ -125,6 +128,7 @@ export const readerSteeringPlugin = {
         tables.PublishedItem.grantReadData(lambda);
         lambda.addEnvironment("PAPYRUS_READER_PUBLISHED_ITEM_TABLE", tables.PublishedItem.tableName);
         tables.ReaderVote.grantReadData(contentActions);
+        tables.ReaderFlag.grantReadData(contentActions);
         tables.ReaderProfile.grantReadWriteData(contentActions);
         // The snapshot reads submissions, and the review step writes their signals and moderation state.
         tables.ReaderSubmission.grantReadWriteData(contentActions);

package/amplify/plugins/reader-steering/papyrus.plugin.ts

@@ -21,7 +21,7 @@ export const READER_POLL_SECRET_PARAMETER_ENV = "PAPYRUS_READER_POLL_SECRET_PARA
 export const readerSteeringManifest: PluginManifest = {
   name: "reader-steering",
   contract: 1,
-  models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction"],
+  models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction"],
   mutations: ["moderateReader"],
   guest: { mutations: [] },
   newsroomPanels: [{ id: "moderation", label: "Moderation" }],
@@ -34,6 +34,7 @@ export function readerActionsSettings(config: ReaderSteeringConfig, allowInterim
     dimensions: config.dimensions,
     limits: config.limits,
     submissions: config.submissions,
+    subjects: config.subjects,
     comments: config.comments,
     moderation: config.moderation,
     reservedHandles: config.reservedHandles,
@@ -47,6 +48,7 @@ export function readerSnapshotSettings(config: ReaderSteeringConfig) {
   return {
     dimensions: config.dimensions,
     submissions: config.submissions,
+    subjects: config.subjects,
     karma: config.karma,
     ranking: config.ranking,
     limits: { newAccountHours: config.limits.newAccountHours },
@@ -129,6 +131,7 @@ export const readerSteeringPlugin: PapyrusPlugin<ReaderSteeringConfig, { readerA
       ["PAPYRUS_READER_PROFILE_TABLE", "ReaderProfile"],
       ["PAPYRUS_READER_HANDLE_TABLE", "ReaderHandle"],
       ["PAPYRUS_READER_VOTE_TABLE", "ReaderVote"],
+      ["PAPYRUS_READER_FLAG_TABLE", "ReaderFlag"],
       ["PAPYRUS_READER_SUBMISSION_TABLE", "ReaderSubmission"],
       ["PAPYRUS_READER_COMMENT_TABLE", "ReaderComment"],
       ["PAPYRUS_READER_REPORT_TABLE", "ReaderReport"],
@@ -144,6 +147,7 @@ export const readerSteeringPlugin: PapyrusPlugin<ReaderSteeringConfig, { readerA
     tables.PublishedItem.grantReadData(lambda);
     lambda.addEnvironment("PAPYRUS_READER_PUBLISHED_ITEM_TABLE", tables.PublishedItem.tableName);
     tables.ReaderVote.grantReadData(contentActions);
+    tables.ReaderFlag.grantReadData(contentActions);
     tables.ReaderProfile.grantReadWriteData(contentActions);
     // The snapshot reads submissions, and the review step writes their signals and moderation state.
     tables.ReaderSubmission.grantReadWriteData(contentActions);

package/amplify/plugins/reader-steering/schema.js

@@ -3,7 +3,7 @@ import { readerActions } from "./function/resource.js";
 /**
  * Staff and IAM only: no guest, API key or reader rule on any model. The reader-actions function writes the
  * tables directly with its own role, and editors may list them; admins may delete. `id` is the lookup key:
- * the siteSubject for a profile, the lowercase handle for a claim, `subjectKey#readerId#dimension` for a vote and
+ * the siteSubject for a profile, the lowercase handle for a claim, `subjectKey#readerId#dimension` for a vote (`subjectKey#readerId#kind` for a flag; the key is the bare id for items and submissions and `type:id` for the rest) and
  * `sub-<sha256 of the canonical URL>` for a submission (so a canonical URL is one submission).
  */
 const staffOnly = (allow) => [allow.group("editor").to(["read"]), allow.group("admin").to(["read", "delete"])];
@@ -32,6 +32,7 @@ export function readerSteeringSchemaDefinitions() {
             .model({
             id: a.id().required(),
             subjectKey: a.string().required(),
+            subjectType: a.string(),
             readerId: a.string().required(),
             dimension: a.string().required(),
             value: a.integer().required(),
@@ -39,6 +40,21 @@ export function readerSteeringSchemaDefinitions() {
         })
             .disableOperations(["subscriptions"])
             .authorization(staffOnly),
+        ReaderFlag: a
+            .model({
+            id: a.id().required(),
+            subjectKey: a.string().required(),
+            subjectType: a.string().required(),
+            readerId: a.string().required(),
+            kind: a.string().required(),
+            reason: a.string().required(),
+            targetKey: a.string(),
+            suggestedName: a.string(),
+            voterRole: a.string().required(),
+            createdAt: a.datetime().required(),
+        })
+            .disableOperations(["subscriptions"])
+            .authorization(staffOnly),
         ReaderComment: a
             .model({
             id: a.id().required(),

package/amplify/plugins/reader-steering/schema.ts

@@ -4,7 +4,7 @@ import { readerActions } from "./function/resource";
 /**
  * Staff and IAM only: no guest, API key or reader rule on any model. The reader-actions function writes the
  * tables directly with its own role, and editors may list them; admins may delete. `id` is the lookup key:
- * the siteSubject for a profile, the lowercase handle for a claim, `subjectKey#readerId#dimension` for a vote and
+ * the siteSubject for a profile, the lowercase handle for a claim, `subjectKey#readerId#dimension` for a vote (`subjectKey#readerId#kind` for a flag; the key is the bare id for items and submissions and `type:id` for the rest) and
  * `sub-<sha256 of the canonical URL>` for a submission (so a canonical URL is one submission).
  */
 const staffOnly = (allow: any) => [allow.group("editor").to(["read"]), allow.group("admin").to(["read", "delete"])];
@@ -34,6 +34,7 @@ export function readerSteeringSchemaDefinitions() {
       .model({
         id: a.id().required(),
         subjectKey: a.string().required(),
+        subjectType: a.string(),
         readerId: a.string().required(),
         dimension: a.string().required(),
         value: a.integer().required(),
@@ -41,6 +42,21 @@ export function readerSteeringSchemaDefinitions() {
       })
       .disableOperations(["subscriptions"])
       .authorization(staffOnly),
+    ReaderFlag: a
+      .model({
+        id: a.id().required(),
+        subjectKey: a.string().required(),
+        subjectType: a.string().required(),
+        readerId: a.string().required(),
+        kind: a.string().required(),
+        reason: a.string().required(),
+        targetKey: a.string(),
+        suggestedName: a.string(),
+        voterRole: a.string().required(),
+        createdAt: a.datetime().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .authorization(staffOnly),
     ReaderComment: a
       .model({
         id: a.id().required(),

package/app/api/reader/flag/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "flag");
+}

package/lib/reader-api.ts

@@ -12,7 +12,7 @@ export const READER_BODY_BYTES_BY_ACTION: Partial<Record<ReaderAction, number>>
 export const READER_MAXIMUM_SUBJECTS = 50;
 export const READER_SUBJECT_KEY = /^[A-Za-z0-9._:-]{1,200}$/;
 
-export type ReaderAction = "me" | "handle" | "vote" | "rating" | "submit" | "comment" | "comment-edit" | "comment-delete" | "report";
+export type ReaderAction = "me" | "handle" | "vote" | "rating" | "submit" | "comment" | "comment-edit" | "comment-delete" | "report" | "flag";
 
 export interface ReaderActionEvent {
   publication: string;

package/package.json

@@ -361,6 +361,7 @@
     "./app/api/reader/comment/delete/route": "./app/api/reader/comment/delete/route.ts",
     "./app/api/reader/comment/edit/route": "./app/api/reader/comment/edit/route.ts",
     "./app/api/reader/comment/route": "./app/api/reader/comment/route.ts",
+    "./app/api/reader/flag/route": "./app/api/reader/flag/route.ts",
     "./app/api/reader/handle/route": "./app/api/reader/handle/route.ts",
     "./app/api/reader/me/route": "./app/api/reader/me/route.ts",
     "./app/api/reader/rating/route": "./app/api/reader/rating/route.ts",
@@ -433,7 +434,7 @@
       "optional": true
     }
   },
-  "version": "2.0.0-next.67",
+  "version": "2.0.0-next.68",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.0-next.67",
+  "version": "2.0.0-next.68",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -295,6 +295,17 @@
         "runtime": "\"nodejs\""
       }
     },
+    {
+      "file": "app/api/reader/flag/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/reader/handle/route.ts",
       "hasDefault": false,