@anthusai/papyrus 2.0.0-next.7 → 2.0.0-next.70

package/lib/reader-retirement-route.ts

@@ -0,0 +1,89 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
+import { resolveProspectusSignInRuntime, type ProspectusSignInRuntime } from "./prospectus-session";
+import { ProspectusAccountsError } from "./prospectus-site-identity";
+import { secretsMatch } from "./revalidate-secret";
+
+export const READER_POLL_SECRET_PARAMETER_ENV = "PAPYRUS_READER_POLL_SECRET_PARAMETER";
+export const READER_POLL_SECRET_HEADER = "x-papyrus-reader-poll-secret";
+export const READER_POLL_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
+const CURSOR_PATTERN = /^[A-Za-z0-9._~=+/-]{1,512}$/;
+const NO_STORE_HEADERS = { "cache-control": "no-store" };
+
+export interface ReaderRetirementRouteOptions {
+  environment?: Record<string, string | undefined>;
+  readSecret?: (parameterName: string) => Promise<string | null>;
+  resolveRuntime?: (siteOrigin: string) => Promise<Pick<ProspectusSignInRuntime, "accounts"> | null>;
+  now?: number;
+}
+
+type CachedSecret = { parameterName: string; value: string; expiresAt: number };
+let cachedSecret: CachedSecret | null = null;
+let defaultSsmClient: SSMClient | null = null;
+
+export function resetReaderPollSecretCache(): void {
+  cachedSecret = null;
+}
+
+async function readSecretFromSsm(parameterName: string): Promise<string | null> {
+  defaultSsmClient ??= new SSMClient({});
+  const response = await defaultSsmClient.send(new GetParameterCommand({ Name: parameterName, WithDecryption: true }));
+  return response.Parameter?.Value?.trim() || null;
+}
+
+async function loadReaderPollSecret(options: ReaderRetirementRouteOptions, environment: Record<string, string | undefined>): Promise<string | null> {
+  const parameterName = environment[READER_POLL_SECRET_PARAMETER_ENV]?.trim();
+  if (!parameterName) return null;
+  const now = options.now ?? Date.now();
+  if (cachedSecret && cachedSecret.parameterName === parameterName && cachedSecret.expiresAt > now) return cachedSecret.value;
+  try {
+    const value = (await (options.readSecret ?? readSecretFromSsm)(parameterName))?.trim();
+    if (!value) return null;
+    cachedSecret = { parameterName, value, expiresAt: now + READER_POLL_SECRET_CACHE_MILLISECONDS };
+    return value;
+  } catch (error) {
+    console.error(`Reader poll secret could not be read (${error instanceof Error ? error.name : "error"}).`);
+    return null;
+  }
+}
+
+function failure(status: number, error: string, message: string): NextResponse {
+  return NextResponse.json({ error, message }, { status, headers: NO_STORE_HEADERS });
+}
+
+/**
+ * The scheduled snapshot run's way to Prospectus's retired-subject route. Prospectus admits one caller per site, this
+ * app's compute role, so the run cannot call it directly: it calls this route with a shared secret from SSM, and the route
+ * calls Prospectus as the compute role and passes the answer through. Anyone without the secret gets 401, and a site
+ * without the secret parameter gets 503, so this is never open.
+ */
+export async function handleReaderRetiredSubjects(request: NextRequest, options: ReaderRetirementRouteOptions = {}): Promise<NextResponse> {
+  const environment = options.environment ?? process.env;
+  const expected = await loadReaderPollSecret(options, environment);
+  if (!expected) return failure(503, "reader_poll_unavailable", "The retirement poll is not configured for this site.");
+  if (!secretsMatch(request.headers.get(READER_POLL_SECRET_HEADER), expected)) return failure(401, "unauthorized", "Missing or wrong poll secret.");
+
+  const since = request.nextUrl.searchParams.get("since") ?? undefined;
+  const unknownParameters = [...request.nextUrl.searchParams.keys()].filter((key) => key !== "since");
+  if (unknownParameters.length > 0 || (since !== undefined && !CURSOR_PATTERN.test(since))) {
+    return failure(400, "invalid_since", "Send only a since cursor.");
+  }
+  let siteOrigin: string;
+  try {
+    siteOrigin = publicSiteOrigin(request, environment);
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
+  const runtime = await (options.resolveRuntime ?? ((origin) => resolveProspectusSignInRuntime(origin, { environment })))(siteOrigin);
+  if (!runtime) return failure(503, "prospectus_sign_in_unavailable", "Prospectus is not configured for this site.");
+  try {
+    const page = await runtime.accounts.retiredSiteSubjects(since);
+    return NextResponse.json({ retired: page.retired, cursor: page.cursor, more: page.more }, { headers: NO_STORE_HEADERS });
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return failure(error.status === 400 ? 400 : 502, error.code, error.message);
+    console.error(`Prospectus retired subjects failed (${error instanceof Error ? error.name : "error"}).`);
+    return failure(502, "prospectus_unavailable", "Prospectus could not be reached.");
+  }
+}

package/lib/reader-subject.md

@@ -0,0 +1,29 @@
+# Reader subject
+
+`readerSubject(session)` in `reader-subject.ts` is the only place a reader's identity for the reader API is
+decided. It returns the per-site pairwise `siteSubject` (`ss1_` plus 43 base64url characters) that Prospectus
+puts on `person.siteSubject`, or `null`.
+
+## Production
+
+Only the `siteSubject` the sealed session cookie carries counts. While Prospectus does not return one, the
+accessor returns `null`, every reader route answers `503 reader_identity_unavailable`, and the reader features
+stay off. There is no other flag. The global Prospectus person id is never used as a reader key.
+
+## Development and test only
+
+When `SITE_ENV` is `development` or `test`, `NODE_ENV` is not `production` and `PAPYRUS_READER_DEV_SECRET`
+holds at least 16 characters, a session without a `siteSubject` gets the interim value
+`ssdev_` plus `base64url(HMAC-SHA-256(devSecret, personId))`.
+
+That path never runs in production. No remap from `ssdev_` values to `ss1_` values is ever needed: production
+reader writes stay closed until `siteSubject` is live, so no production row is ever keyed on an interim value.
+The `reader-actions` function also refuses `ssdev_` subjects unless the site was synthesized with a
+development or test `SITE_ENV`.
+
+## Staff
+
+`readerIsStaff(session)` reads the `cognito:groups` claim from the access token inside the sealed session
+cookie (`editor` or `admin`). The cookie is written by the site's own callback route, so the token is trusted
+the way the rest of the session is. The reader API passes the result to the function as `isStaff`; clients never
+send it.

package/lib/reader-subject.ts

@@ -0,0 +1,53 @@
+import { createHmac } from "node:crypto";
+import type { ProspectusSignedInSession } from "./prospectus-session";
+
+export const SITE_SUBJECT_PATTERN = /^ss1_[A-Za-z0-9_-]{43}$/;
+export const INTERIM_SUBJECT_PATTERN = /^ssdev_[A-Za-z0-9_-]{43}$/;
+export const READER_DEV_SECRET_ENV = "PAPYRUS_READER_DEV_SECRET";
+export const READER_STAFF_GROUPS = ["editor", "admin"] as const;
+
+const MINIMUM_DEV_SECRET_LENGTH = 16;
+const INTERIM_SUBJECT_PREFIX = "ssdev_";
+const INTERIM_ENVIRONMENTS = ["development", "test"];
+
+type EnvironmentVariables = Record<string, string | undefined>;
+
+export function interimSubjectsAllowed(environment: EnvironmentVariables = process.env): boolean {
+  if (environment.NODE_ENV === "production") return false;
+  const siteEnvironment = (environment.SITE_ENV ?? "").trim();
+  if (!INTERIM_ENVIRONMENTS.includes(siteEnvironment)) return false;
+  return (environment[READER_DEV_SECRET_ENV] ?? "").length >= MINIMUM_DEV_SECRET_LENGTH;
+}
+
+export function interimSubject(personId: string, devSecret: string): string {
+  return INTERIM_SUBJECT_PREFIX + createHmac("sha256", devSecret).update(personId).digest("base64url");
+}
+
+/**
+ * The reader's per-site pairwise id, or null. Production reads only the siteSubject Prospectus returned;
+ * the interim `ssdev_` value exists in development and test only (lib/reader-subject.md).
+ */
+export function readerSubject(
+  session: Pick<ProspectusSignedInSession, "personId" | "siteSubject"> | null | undefined,
+  environment: EnvironmentVariables = process.env,
+): string | null {
+  if (!session) return null;
+  if (typeof session.siteSubject === "string" && SITE_SUBJECT_PATTERN.test(session.siteSubject)) return session.siteSubject;
+  if (!interimSubjectsAllowed(environment) || !session.personId) return null;
+  return interimSubject(session.personId, environment[READER_DEV_SECRET_ENV] as string);
+}
+
+/** Staff membership from the Cognito groups claim of the access token that the sealed session cookie carries. */
+export function readerIsStaff(session: Pick<ProspectusSignedInSession, "accessToken"> | null | undefined): boolean {
+  const token = session?.accessToken;
+  if (typeof token !== "string") return false;
+  const payload = token.split(".")[1];
+  if (!payload) return false;
+  try {
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as { "cognito:groups"?: unknown };
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) && groups.some((group) => (READER_STAFF_GROUPS as readonly unknown[]).includes(group));
+  } catch {
+    return false;
+  }
+}

package/lib/relevance-status.ts

@@ -52,10 +52,10 @@ export const DEMO_CYCLOTRON_STATUS: CyclotronStatus = {
   },
   calibration: { saysSure: null, isRight: null, gapPoints: null, curve: [] },
   reviewRate: {
-    state: "onboarding", rate: 1, reason: "Onboarding: every decision is reviewed until the cyclotron earns a lower rate.",
+    state: "onboarding", rate: 1, reason: "Getting started: every suggestion is reviewed until suggestions earn a lower review rate.",
     auditFloor: 0.05, confidenceThreshold: 0.7, override: null,
     nextCheckAfterDecisions: 99,
-    nextStep: "Steps down to 50% after 2 more windows of 100 decisions with accuracy on confident decisions of at least 85% (at least 20 reviewed) and a calibration gap under 5 points. Next check in 99 decisions.",
+    nextStep: "Steps down to 50% after 2 more windows of 100 decisions with accuracy on confident decisions of at least 85% (at least 20 reviewed) and a gap under 5 points between how sure suggestions say they are and how often they are right. Next check in 99 decisions.",
     expectedReviewsPerWeek: 1,
   },
   lastChange: null,

package/lib/semantic-graph.ts

@@ -57,6 +57,7 @@ export type SemanticPredicateId =
   | "related_to"
   | "broader_than"
   | "narrower_than"
+  | "member_of"
   | "supports"
   | "contradicts";
 
@@ -96,6 +97,7 @@ export const SEMANTIC_PREDICATES: SemanticPredicateDefinition[] = [
   { id: "related_to", label: "related to", group: "generic", inverseLabel: "related from" },
   { id: "broader_than", label: "broader than", group: "ontology", inverseLabel: "narrower concept" },
   { id: "narrower_than", label: "narrower than", group: "ontology", inverseLabel: "broader concept" },
+  { id: "member_of", label: "member of", group: "ontology", inverseLabel: "members" },
   { id: "supports", label: "supports", group: "evidence", inverseLabel: "supported by" },
   { id: "contradicts", label: "contradicts", group: "evidence", inverseLabel: "contradicted by" },
 ];

package/lib/site-brand-tenant.ts

@@ -9,14 +9,19 @@ export function resolveBrandConfigPath(relativePath: string): string {
   return path.isAbsolute(relativePath) ? relativePath : path.join(process.cwd(), relativePath);
 }
 
-export function getBrandSteeringConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string {
-  return resolveBrandConfigPath(brand.steeringConfigPath);
+/** Optional repo files a brand may still name; undefined means the site keeps that configuration as backend data and nothing is looked up. */
+function optionalBrandConfigPath(relativePath: string | undefined): string | undefined {
+  return relativePath ? resolveBrandConfigPath(relativePath) : undefined;
 }
 
-export function getBrandNewsroomSectionsConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string {
-  return resolveBrandConfigPath(brand.newsroomSectionsConfigPath);
+export function getBrandSteeringConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string | undefined {
+  return optionalBrandConfigPath(brand.steeringConfigPath);
 }
 
-export function getBrandAnalysisProfilesPath(brand: SiteBrand = resolveActiveSiteBrand()): string {
-  return resolveBrandConfigPath(brand.analysisProfilesPath);
+export function getBrandNewsroomSectionsConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string | undefined {
+  return optionalBrandConfigPath(brand.newsroomSectionsConfigPath);
+}
+
+export function getBrandAnalysisProfilesPath(brand: SiteBrand = resolveActiveSiteBrand()): string | undefined {
+  return optionalBrandConfigPath(brand.analysisProfilesPath);
 }

package/lib/site-brand.ts

@@ -142,9 +142,12 @@ export type SiteBrand = {
   readerBasePath?: string;
   opsChrome: OpsChrome;
   corpusKey: string;
-  steeringConfigPath: string;
-  newsroomSectionsConfigPath: string;
-  analysisProfilesPath: string;
+  /** Optional repo file for topic steering. Editorial and steering configuration is backend data; a data-driven site sets none and nothing is looked up. */
+  steeringConfigPath?: string;
+  /** Optional repo file for the local-preview demo sections only. Sections live in the backend. */
+  newsroomSectionsConfigPath?: string;
+  /** Optional repo file listing analysis profiles. */
+  analysisProfilesPath?: string;
   publicationName: string;
   components?: SiteBrandComponents;
   /**

package/lib/site-origin.ts

@@ -0,0 +1,67 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { getSiteEnv } from "./site-env";
+
+type EnvironmentVariables = Record<string, string | undefined>;
+
+export const SITE_ORIGIN_ENV = "PAPYRUS_SITE_ORIGIN";
+
+/**
+ * The site's public origin cannot be read from the request on Amplify SSR (WEB_COMPUTE):
+ * there `request.nextUrl.origin` is the compute adapter's internal https://localhost:3000.
+ * It also must never be derived from Host or X-Forwarded-* headers, which a client can set.
+ * The one trusted source is PAPYRUS_SITE_ORIGIN, set by the app shell from the site's host.
+ */
+export class SiteOriginNotConfiguredError extends Error {
+  readonly status = 503;
+  readonly code = "site_origin_not_configured";
+}
+
+export function siteOriginNotConfiguredResponse(error: SiteOriginNotConfiguredError): NextResponse {
+  return NextResponse.json({ error: error.code, message: error.message }, { status: error.status, headers: { "cache-control": "no-store" } });
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+
+function configuredOrigin(value: string): string {
+  const invalid = () => new SiteOriginNotConfiguredError(`${SITE_ORIGIN_ENV} must be an https origin such as https://example.com with no path.`);
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw invalid();
+  }
+  if (parsed.protocol !== "https:" || parsed.origin !== value) throw invalid();
+  return parsed.origin;
+}
+
+function siteEnvOrNull(environment: EnvironmentVariables): string | null {
+  try {
+    return getSiteEnv(environment);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The site's public origin, from trusted configuration.
+ * - PAPYRUS_SITE_ORIGIN set: it must be an https origin with no path; it is used as is.
+ * - Unset: `request.nextUrl.origin` only when it is loopback, SITE_ENV resolves to development
+ *   and NODE_ENV is not production (a local `next dev` server). Anything else, production and staging included, throws
+ *   SiteOriginNotConfiguredError so routes answer 503 instead of redirecting to localhost.
+ */
+export function publicSiteOrigin(request: Pick<NextRequest, "nextUrl">, environment: EnvironmentVariables = process.env): string {
+  const configured = (environment[SITE_ORIGIN_ENV] ?? "").trim();
+  if (configured) return configuredOrigin(configured);
+  const { hostname, origin } = request.nextUrl;
+  // SITE_ENV defaults to development when a runtime never received it, so NODE_ENV=production also closes the fallback.
+  const developing = siteEnvOrNull(environment) === "development" && environment.NODE_ENV !== "production";
+  if (isLoopbackHostname(hostname) && developing) return origin;
+  throw new SiteOriginNotConfiguredError(`${SITE_ORIGIN_ENV} is not set; this site cannot tell its public origin.`);
+}
+
+/** An absolute URL on the site's public origin, for redirects. Fails closed like publicSiteOrigin. */
+export function publicSiteUrl(path: string, request: Pick<NextRequest, "nextUrl">, environment: EnvironmentVariables = process.env): URL {
+  return new URL(path, publicSiteOrigin(request, environment));
+}

package/middleware.ts

@@ -5,6 +5,7 @@ import { newsroomHref } from "./lib/newsroom-base-path";
 import { getReaderBasePath } from "./lib/reader-base-path";
 import { isStagingGatedPath, isStaticOrApiPath } from "./lib/staging-gated-path";
 import { getSiteEnv, isIndexable } from "./lib/site-env";
+import { SiteOriginNotConfiguredError, publicSiteUrl, siteOriginNotConfiguredResponse } from "./lib/site-origin";
 import { getStagingAccess } from "./lib/staging-gate";
 import {
   isPreviewGatedPath,
@@ -38,11 +39,11 @@ function routeRequest(request: NextRequest): NextResponse {
   }
 
   if (pathname === "/newsroom" || pathname === "/newsroom/") {
-    return NextResponse.redirect(new URL(`/${request.nextUrl.search}`, request.url));
+    return NextResponse.redirect(publicSiteUrl(`/${request.nextUrl.search}`, request));
   }
   if (pathname.startsWith("/newsroom/")) {
     const target = pathname.slice("/newsroom".length) || "/";
-    return NextResponse.redirect(new URL(`${target}${request.nextUrl.search}`, request.url));
+    return NextResponse.redirect(publicSiteUrl(`${target}${request.nextUrl.search}`, request));
   }
 
   if (pathname === "/" || pathname === "") {
@@ -59,6 +60,16 @@ function routeRequest(request: NextRequest): NextResponse {
 }
 
 export async function middleware(request: NextRequest): Promise<NextResponse> {
+  try {
+    return await handleRequest(request);
+  } catch (error) {
+    // Redirects name the site's public origin (request.url is localhost on Amplify); without it, fail closed.
+    if (error instanceof SiteOriginNotConfiguredError) return withRobotsHeader(siteOriginNotConfiguredResponse(error));
+    throw error;
+  }
+}
+
+async function handleRequest(request: NextRequest): Promise<NextResponse> {
   let sessionResponse: NextResponse | null = null;
   const { pathname } = request.nextUrl;
   const gated = isStaticPreviewEnabled()
@@ -68,7 +79,7 @@ export async function middleware(request: NextRequest): Promise<NextResponse> {
     sessionResponse = NextResponse.next();
     const access = await getStagingAccess(request, sessionResponse);
     if (access === "anonymous") {
-      return withRobotsHeader(NextResponse.redirect(new URL(newsroomHref(), request.url)));
+      return withRobotsHeader(NextResponse.redirect(publicSiteUrl(newsroomHref(), request)));
     }
     if (access === "forbidden") {
       return withRobotsHeader(new NextResponse("Staging is limited to editors and admins.", { status: 403 }));

package/package.json

@@ -85,9 +85,14 @@
     "./components/item-stream-view": "./components/item-stream-view.tsx",
     "./components/markus-body-editor": "./components/markus-body-editor.tsx",
     "./components/markus-ir-preview": "./components/markus-ir-preview.tsx",
+    "./components/moderation-panel": "./components/moderation-panel.tsx",
+    "./components/monitoring-overview-view": "./components/monitoring-overview-view.tsx",
+    "./components/monitoring-panel": "./components/monitoring-panel.tsx",
     "./components/news-desk-client-provider": "./components/news-desk-client-provider.tsx",
     "./components/news-desk-page": "./components/news-desk-page.tsx",
     "./components/news-desk-taxonomy-client": "./components/news-desk-taxonomy-client.ts",
+    "./components/newsletter-panel": "./components/newsletter-panel.tsx",
+    "./components/newsletter-sections": "./components/newsletter-sections.tsx",
     "./components/newspaper": "./components/newspaper.tsx",
     "./components/newsroom-access-gate": "./components/newsroom-access-gate.tsx",
     "./components/newsroom-article-editor": "./components/newsroom-article-editor.tsx",
@@ -96,6 +101,7 @@
     "./components/newsroom-assignments-view": "./components/newsroom-assignments-view.tsx",
     "./components/newsroom-board-view": "./components/newsroom-board-view.tsx",
     "./components/newsroom-client-shell": "./components/newsroom-client-shell.tsx",
+    "./components/newsroom-curation-bootstrap": "./components/newsroom-curation-bootstrap.tsx",
     "./components/newsroom-curation-provider": "./components/newsroom-curation-provider.tsx",
     "./components/newsroom-ops-overview": "./components/newsroom-ops-overview.tsx",
     "./components/newsroom-ops-shell": "./components/newsroom-ops-shell.tsx",
@@ -118,6 +124,7 @@
     "./components/reader-auth-state": "./components/reader-auth-state.ts",
     "./components/reader-settings": "./components/reader-settings.ts",
     "./components/reader-theme-control": "./components/reader-theme-control.tsx",
+    "./components/reference-add-entry": "./components/reference-add-entry.tsx",
     "./components/reference-curation-controls": "./components/reference-curation-controls.tsx",
     "./components/reference-cyclotron-priming": "./components/reference-cyclotron-priming.tsx",
     "./components/reference-cyclotron-status": "./components/reference-cyclotron-status.tsx",
@@ -188,6 +195,7 @@
     "./lib/content-types": "./lib/content-types.ts",
     "./lib/curation-client": "./lib/curation-client.ts",
     "./lib/curation-delegation-helpers": "./lib/curation-delegation-helpers.ts",
+    "./lib/curation-routes": "./lib/curation-routes.ts",
     "./lib/cyclotron-suggestions": "./lib/cyclotron-suggestions.ts",
     "./lib/define-site": "./lib/define-site.ts",
     "./lib/demo-amplify-outputs": "./lib/demo-amplify-outputs.ts",
@@ -224,7 +232,14 @@
     "./lib/markus-projection": "./lib/markus-projection.ts",
     "./lib/markus-to-article": "./lib/markus-to-article.ts",
     "./lib/media-route-response": "./lib/media-route-response.ts",
+    "./lib/monitoring-client": "./lib/monitoring-client.ts",
+    "./lib/monitoring-overview-fixture": "./lib/monitoring-overview-fixture.ts",
+    "./lib/monitoring-overview": "./lib/monitoring-overview.ts",
     "./lib/news-desk-session": "./lib/news-desk-session.ts",
+    "./lib/newsletter-api": "./lib/newsletter-api.ts",
+    "./lib/newsletter-client": "./lib/newsletter-client.ts",
+    "./lib/newsletter-fixture": "./lib/newsletter-fixture.ts",
+    "./lib/newsletter-model": "./lib/newsletter-model.ts",
     "./lib/newspaper-layout": "./lib/newspaper-layout.ts",
     "./lib/newsroom-articles": "./lib/newsroom-articles.ts",
     "./lib/newsroom-assignments": "./lib/newsroom-assignments.ts",
@@ -265,11 +280,15 @@
     "./lib/publication-cyclotron": "./lib/publication-cyclotron.ts",
     "./lib/publication-items": "./lib/publication-items.ts",
     "./lib/rate-limit-retry": "./lib/rate-limit-retry.ts",
+    "./lib/reader-api": "./lib/reader-api.ts",
     "./lib/reader-base-path": "./lib/reader-base-path.ts",
     "./lib/reader-cache-lifetime": "./lib/reader-cache-lifetime.ts",
+    "./lib/reader-moderation": "./lib/reader-moderation.ts",
+    "./lib/reader-retirement-route": "./lib/reader-retirement-route.ts",
     "./lib/reader-route-config": "./lib/reader-route-config.ts",
     "./lib/reader-static-params": "./lib/reader-static-params.ts",
     "./lib/reader-storage-url": "./lib/reader-storage-url.ts",
+    "./lib/reader-subject": "./lib/reader-subject.ts",
     "./lib/reference-display": "./lib/reference-display.ts",
     "./lib/reference-policy": "./lib/reference-policy.ts",
     "./lib/reference-source-preview": "./lib/reference-source-preview.ts",
@@ -288,6 +307,7 @@
     "./lib/site-brand-tenant": "./lib/site-brand-tenant.ts",
     "./lib/site-brand": "./lib/site-brand.ts",
     "./lib/site-env": "./lib/site-env.ts",
+    "./lib/site-origin": "./lib/site-origin.ts",
     "./lib/site-renderer": "./lib/site-renderer.ts",
     "./lib/site-section-suggestions": "./lib/site-section-suggestions.ts",
     "./lib/site-stack": "./lib/site-stack.ts",
@@ -330,6 +350,25 @@
     "./app/api/local-preview/derive/route": "./app/api/local-preview/derive/route.ts",
     "./app/api/local-preview/media/route": "./app/api/local-preview/media/route.ts",
     "./app/api/media/[...path]/route": "./app/api/media/[...path]/route.ts",
+    "./app/api/newsletter/confirm/route": "./app/api/newsletter/confirm/route.ts",
+    "./app/api/newsletter/preferences/route": "./app/api/newsletter/preferences/route.ts",
+    "./app/api/newsletter/state/route": "./app/api/newsletter/state/route.ts",
+    "./app/api/newsletter/subscribe/route": "./app/api/newsletter/subscribe/route.ts",
+    "./app/api/newsletter/unsubscribe/route": "./app/api/newsletter/unsubscribe/route.ts",
+    "./app/api/newsroom/curation/context/route": "./app/api/newsroom/curation/context/route.ts",
+    "./app/api/newsroom/curation/priming/route": "./app/api/newsroom/curation/priming/route.ts",
+    "./app/api/newsroom/curation/publication/route": "./app/api/newsroom/curation/publication/route.ts",
+    "./app/api/reader/comment/delete/route": "./app/api/reader/comment/delete/route.ts",
+    "./app/api/reader/comment/edit/route": "./app/api/reader/comment/edit/route.ts",
+    "./app/api/reader/comment/route": "./app/api/reader/comment/route.ts",
+    "./app/api/reader/flag/route": "./app/api/reader/flag/route.ts",
+    "./app/api/reader/handle/route": "./app/api/reader/handle/route.ts",
+    "./app/api/reader/me/route": "./app/api/reader/me/route.ts",
+    "./app/api/reader/rating/route": "./app/api/reader/rating/route.ts",
+    "./app/api/reader/report/route": "./app/api/reader/report/route.ts",
+    "./app/api/reader/retired/route": "./app/api/reader/retired/route.ts",
+    "./app/api/reader/submit/route": "./app/api/reader/submit/route.ts",
+    "./app/api/reader/vote/route": "./app/api/reader/vote/route.ts",
     "./app/api/revalidate/route": "./app/api/revalidate/route.ts",
     "./app/archive/page": "./app/archive/page.tsx",
     "./app/articles/[slug]/page": "./app/articles/[slug]/page.tsx",
@@ -395,14 +434,14 @@
       "optional": true
     }
   },
-  "version": "2.0.0-next.7",
+  "version": "2.0.0-next.70",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",
+    "@aws-sdk/client-dynamodb": "^3.1045.0",
     "@aws-sdk/client-lambda": "^3.1045.0",
     "@aws-sdk/client-s3": "^3.1045.0",
-    "@aws-sdk/client-secrets-manager": "3.1045.0",
     "@aws-sdk/client-ssm": "^3.1045.0",
     "@aws-sdk/credential-provider-node": "3.972.84",
     "@aws-sdk/s3-request-presigner": "^3.1045.0",
@@ -435,7 +474,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "cyclotron": "https://github.com/AnthusAI/Cyclotron/releases/download/ui-v0.2.2/cyclotron-0.2.2.tgz",
+    "cyclotron": "https://github.com/AnthusAI/Cyclotron/releases/download/ui-v0.2.3/cyclotron-0.2.3.tgz",
     "d3": "^7.9.0",
     "esbuild": "^0.28.2",
     "framer-motion": "^14.3.0",