@anthusai/papyrus 2.0.0-next.8 → 2.0.0-next.81

package/lib/reader-api.ts

@@ -0,0 +1,145 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+import { loadProspectusSessionSealingSecret, type ProspectusSignedInSession } from "./prospectus-session";
+import { signedInProspectusSession } from "./prospectus-sign-in-routes";
+import { readerIsStaff, readerSubject } from "./reader-subject";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
+
+export const READER_ACTIONS_FUNCTION_ENV = "PAPYRUS_READER_ACTIONS_FUNCTION";
+export const READER_MAXIMUM_BODY_BYTES = 4096;
+/** Larger bodies for actions that carry reader text: a URL, a title and a note; a comment of 2,000 characters. */
+export const READER_BODY_BYTES_BY_ACTION: Partial<Record<ReaderAction, number>> = { submit: 8192, comment: 12288, "comment-edit": 12288 };
+export const READER_MAXIMUM_SUBJECTS = 50;
+export const READER_SUBJECT_KEY = /^[A-Za-z0-9._:-]{1,200}$/;
+
+export type ReaderAction = "me" | "handle" | "vote" | "rating" | "submit" | "comment" | "comment-edit" | "comment-delete" | "report" | "flag";
+
+export interface ReaderActionEvent {
+  publication: string;
+  siteSubject: string;
+  isStaff: boolean;
+  action: ReaderAction;
+  payload: Record<string, unknown>;
+}
+
+export interface ReaderActionResult {
+  statusCode: number;
+  body: Record<string, unknown>;
+}
+
+export type ReaderActionInvoker = (functionName: string, event: ReaderActionEvent) => Promise<ReaderActionResult>;
+
+export interface ReaderApiOptions {
+  environment?: Record<string, string | undefined>;
+  invoke?: ReaderActionInvoker;
+  actionsFunctionName?: string | null;
+  loadSealingSecret?: () => Promise<string | null>;
+  nowInSeconds?: number;
+}
+
+const NO_STORE_HEADERS = { "cache-control": "no-store" };
+
+function failure(status: number, error: string, message: string, extra: Record<string, unknown> = {}, headers: Record<string, string> = {}): NextResponse {
+  return NextResponse.json({ error, message, ...extra }, { status, headers: { ...NO_STORE_HEADERS, ...headers } });
+}
+
+export function identityUnavailableResponse(): NextResponse {
+  return failure(503, "reader_identity_unavailable", "Reader sign-in is not open yet.");
+}
+
+function actionsFunctionNameFrom(options: ReaderApiOptions, environment: Record<string, string | undefined>): string | null {
+  if (options.actionsFunctionName !== undefined) return options.actionsFunctionName;
+  const fromEnvironment = (environment[READER_ACTIONS_FUNCTION_ENV] ?? "").trim();
+  if (fromEnvironment) return fromEnvironment;
+  const outputs = readAmplifyOutputsFile() as { custom?: { readerSteering?: { actionsFunction?: unknown } | null } } | null;
+  const fromOutputs = outputs?.custom?.readerSteering?.actionsFunction;
+  return typeof fromOutputs === "string" && fromOutputs.trim() ? fromOutputs.trim() : null;
+}
+
+export async function invokeReaderActionsLambda(functionName: string, event: ReaderActionEvent): Promise<ReaderActionResult> {
+  const { InvokeCommand, LambdaClient } = await import("@aws-sdk/client-lambda");
+  const response = await new LambdaClient({}).send(
+    new InvokeCommand({ FunctionName: functionName, InvocationType: "RequestResponse", Payload: Buffer.from(JSON.stringify(event)) }),
+  );
+  if (response.FunctionError || !response.Payload) throw new Error("reader-actions failed");
+  const result = JSON.parse(Buffer.from(response.Payload).toString("utf8")) as Partial<ReaderActionResult>;
+  if (typeof result.statusCode !== "number" || typeof result.body !== "object" || result.body === null) throw new Error("reader-actions returned an unexpected shape");
+  return { statusCode: result.statusCode, body: result.body as Record<string, unknown> };
+}
+
+async function readJsonBody(request: NextRequest, maximumBytes: number): Promise<{ payload: Record<string, unknown> } | { response: NextResponse }> {
+  const contentType = (request.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+  if (contentType !== "application/json") return { response: failure(415, "unsupported_media_type", "Send application/json.") };
+  const declared = Number(request.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declared) && declared > maximumBytes) return { response: failure(413, "payload_too_large", "The request body is too large.") };
+  const text = await request.text();
+  if (Buffer.byteLength(text, "utf8") > maximumBytes) return { response: failure(413, "payload_too_large", "The request body is too large.") };
+  try {
+    const parsed = JSON.parse(text) as unknown;
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not an object");
+    return { payload: parsed as Record<string, unknown> };
+  } catch {
+    return { response: failure(400, "invalid_json", "The request body is not a JSON object.") };
+  }
+}
+
+function subjectsFromQuery(request: NextRequest): { payload: Record<string, unknown> } | { response: NextResponse } {
+  const raw = request.nextUrl.searchParams.get("subjects") ?? "";
+  const subjects = raw === "" ? [] : raw.split(",");
+  if (subjects.length > READER_MAXIMUM_SUBJECTS || !subjects.every((subject) => READER_SUBJECT_KEY.test(subject))) {
+    return { response: failure(400, "invalid_subjects", `Send at most ${READER_MAXIMUM_SUBJECTS} comma separated item keys.`) };
+  }
+  return { payload: { subjects } };
+}
+
+async function signedInReaderSession(request: NextRequest, options: ReaderApiOptions): Promise<ProspectusSignedInSession | null | "unavailable"> {
+  const sealingSecret = await (options.loadSealingSecret ?? (() => loadProspectusSessionSealingSecret({ environment: options.environment })))();
+  if (!sealingSecret) return "unavailable";
+  return signedInProspectusSession(request, sealingSecret, options.nowInSeconds);
+}
+
+/**
+ * One reader route: session, readerSubject (503 while Prospectus has no siteSubject), Origin, JSON size, then the
+ * reader-actions function. The siteSubject only travels to the function and never into a response.
+ */
+export async function handleReaderRequest(request: NextRequest, action: ReaderAction, options: ReaderApiOptions = {}): Promise<NextResponse> {
+  const environment = options.environment ?? process.env;
+  let origin: string;
+  try {
+    origin = publicSiteOrigin(request, environment);
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
+  const session = await signedInReaderSession(request, options);
+  if (session === "unavailable") return identityUnavailableResponse();
+  if (!session) return failure(401, "signed_out", "Sign in to continue.");
+  const siteSubject = readerSubject(session, environment);
+  if (siteSubject === null) return identityUnavailableResponse();
+
+  let parsed: { payload: Record<string, unknown> } | { response: NextResponse };
+  if (action === "me") {
+    parsed = subjectsFromQuery(request);
+  } else {
+    if (request.headers.get("origin") !== origin) return failure(403, "origin_mismatch", "This request did not come from this site.");
+    parsed = await readJsonBody(request, READER_BODY_BYTES_BY_ACTION[action] ?? READER_MAXIMUM_BODY_BYTES);
+  }
+  if ("response" in parsed) return parsed.response;
+
+  const functionName = actionsFunctionNameFrom(options, environment);
+  if (!functionName) return failure(503, "reader_actions_unavailable", "Reader features are not enabled for this site.");
+  try {
+    const result = await (options.invoke ?? invokeReaderActionsLambda)(functionName, {
+      publication: new URL(origin).host,
+      siteSubject,
+      isStaff: readerIsStaff(session),
+      action,
+      payload: parsed.payload,
+    });
+    const retryAfter: Record<string, string> = typeof result.body.retryAfter === "number" ? { "retry-after": String(result.body.retryAfter) } : {};
+    return NextResponse.json(result.body, { status: result.statusCode, headers: { ...NO_STORE_HEADERS, ...retryAfter } });
+  } catch (error) {
+    console.error(`Reader action ${action} failed (${error instanceof Error ? error.name : "error"}).`);
+    return failure(502, "reader_actions_failed", "Reader features could not be reached.");
+  }
+}

package/lib/reader-moderation.ts

@@ -0,0 +1,220 @@
+/**
+ * The data side of the Administration "Moderation" panel for the reader-steering plugin: rows from the staff-readable
+ * models, shaped into a queue, a hidden list and the recent action log. Pure functions, no network: the panel loads the
+ * rows and calls the `moderateReader` mutation; everything it shows is decided here so it can be tested.
+ */
+
+export type ModerationTarget = "submission" | "comment" | "reader";
+export type ModerationActionName = "approve" | "hide" | "unhide" | "ban" | "unban" | "limit" | "promote" | "undo";
+
+export type SubmissionRow = {
+  id: string;
+  canonicalUrl: string;
+  domain: string;
+  title: string;
+  kind?: string | null;
+  note?: string | null;
+  readerId: string;
+  state: string;
+  moderation?: string | null;
+  reportCount?: number | null;
+  signals?: unknown;
+  itemId?: string | null;
+  createdAt: string;
+};
+
+export type CommentRow = {
+  id: string;
+  subjectKey: string;
+  readerId: string;
+  body: string;
+  parentId?: string | null;
+  state: string;
+  moderation?: string | null;
+  reportCount?: number | null;
+  signals?: unknown;
+  createdAt: string;
+};
+
+export type ReportRow = { id: string; targetType: string; target: string; reporterReaderId: string; reason: string; state: string; createdAt: string };
+
+export type ActionRow = {
+  id: string;
+  by: string;
+  actorSub: string;
+  action: string;
+  targetType: string;
+  target: string;
+  reason?: string | null;
+  fromState: string;
+  toState: string;
+  undoOf?: string | null;
+  undoneBy?: string | null;
+  at: string;
+};
+
+export type Signal = { source: string; policy: string; detector: string; severity: string; excerpt: string };
+
+export type ModerationRow = {
+  kind: "submission" | "comment";
+  id: string;
+  readerId: string;
+  handle: string | null;
+  createdAt: string;
+  state: string;
+  title: string;
+  url: string | null;
+  text: string;
+  subject: string | null;
+  reports: ReportRow[];
+  signals: Signal[];
+  canPromote: boolean;
+};
+
+export type ActionEntry = ActionRow & { label: string; undoable: boolean; byLabel: string };
+
+const SEVERITY_ORDER: Record<string, number> = { error: 0, warn: 1, info: 2 };
+
+export function parseSignals(value: unknown): Signal[] {
+  let parsed: unknown = value;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return [];
+    }
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed
+    .filter((entry): entry is Record<string, unknown> => typeof entry === "object" && entry !== null)
+    .map((entry) => ({
+      source: String(entry.source ?? ""),
+      policy: String(entry.policy ?? ""),
+      detector: String(entry.detector ?? ""),
+      severity: String(entry.severity ?? "info"),
+      excerpt: String(entry.excerpt ?? ""),
+    }))
+    .sort((left, right) => (SEVERITY_ORDER[left.severity] ?? 3) - (SEVERITY_ORDER[right.severity] ?? 3));
+}
+
+/** An address a moderator may follow: http or https only, never `javascript:` or `data:`. */
+export function safeHttpUrl(value: string | null | undefined): string | null {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+
+function newestFirst<T extends { createdAt: string; id: string }>(rows: T[]): T[] {
+  return [...rows].sort((left, right) => (left.createdAt === right.createdAt ? right.id.localeCompare(left.id) : right.createdAt.localeCompare(left.createdAt)));
+}
+
+function reportsByTarget(reports: ReportRow[]): Map<string, ReportRow[]> {
+  const grouped = new Map<string, ReportRow[]>();
+  for (const report of reports) {
+    if (report.state !== "open") continue;
+    grouped.set(report.target, [...(grouped.get(report.target) ?? []), report]);
+  }
+  return grouped;
+}
+
+export function submissionRow(row: SubmissionRow, handles: Record<string, string>, reports: Map<string, ReportRow[]>): ModerationRow {
+  return {
+    kind: "submission",
+    id: row.id,
+    readerId: row.readerId,
+    handle: handles[row.readerId] ?? null,
+    createdAt: row.createdAt,
+    state: row.state,
+    title: row.title,
+    url: safeHttpUrl(row.canonicalUrl),
+    text: row.note ?? "",
+    subject: row.itemId ?? row.id,
+    reports: reports.get(row.id) ?? [],
+    signals: parseSignals(row.signals),
+    canPromote: row.state === "pending",
+  };
+}
+
+export function commentRow(row: CommentRow, handles: Record<string, string>, reports: Map<string, ReportRow[]>): ModerationRow {
+  return {
+    kind: "comment",
+    id: row.id,
+    readerId: row.readerId,
+    handle: handles[row.readerId] ?? null,
+    createdAt: row.createdAt,
+    state: row.state,
+    title: "",
+    url: null,
+    text: row.body,
+    subject: row.subjectKey,
+    reports: reports.get(row.id) ?? [],
+    signals: parseSignals(row.signals),
+    canPromote: false,
+  };
+}
+
+/** Everything waiting for a decision: new items and reported ones, newest first. Deleted comments are the author's own and are not in it. */
+export function buildQueue(input: { submissions: SubmissionRow[]; comments: CommentRow[]; reports: ReportRow[]; handles: Record<string, string> }): ModerationRow[] {
+  const reports = reportsByTarget(input.reports);
+  const rows = [
+    ...input.submissions.filter((row) => (row.moderation ?? "new") === "new").map((row) => submissionRow(row, input.handles, reports)),
+    ...input.comments.filter((row) => (row.moderation ?? "new") === "new" && row.state !== "deleted").map((row) => commentRow(row, input.handles, reports)),
+  ];
+  return newestFirst(rows);
+}
+
+/** Items a moderator or a pre-moderation hold keeps out of the public files, newest first, so they can be brought back. */
+export function buildHidden(input: { submissions: SubmissionRow[]; comments: CommentRow[]; reports: ReportRow[]; handles: Record<string, string> }): ModerationRow[] {
+  const reports = reportsByTarget(input.reports);
+  return newestFirst([
+    ...input.submissions.filter((row) => row.state === "hidden").map((row) => submissionRow(row, input.handles, reports)),
+    ...input.comments.filter((row) => row.state === "hidden").map((row) => commentRow(row, input.handles, reports)),
+  ]);
+}
+
+const ACTION_LABELS: Record<string, string> = {
+  approve: "Approved",
+  hide: "Hidden",
+  unhide: "Shown again",
+  ban: "Banned",
+  unban: "Unbanned",
+  limit: "Limited",
+  promote: "Promoted to a draft",
+  undo: "Undid an action",
+};
+
+/** The recent log, newest first. An action can be undone while nothing has undone it, and a promotion never. */
+export function buildActionLog(actions: ActionRow[], limit = 50): ActionEntry[] {
+  return [...actions]
+    .sort((left, right) => (left.at === right.at ? right.id.localeCompare(left.id) : right.at.localeCompare(left.at)))
+    .slice(0, limit)
+    .map((entry) => ({
+      ...entry,
+      label: ACTION_LABELS[entry.action] ?? entry.action,
+      byLabel: entry.by === "ai" ? "AI moderator" : "A moderator",
+      undoable: !entry.undoneBy && entry.action !== "promote",
+    }));
+}
+
+export type Receipt = { status?: string | null; id?: string | null; error?: string | null; message?: string | null };
+
+export function receiptMessage(receipt: Receipt | null | undefined): string {
+  if (!receipt) return "The action did not answer. Reload and check.";
+  if (receipt.status === "ok") return "Done.";
+  return receipt.message || "The action was refused.";
+}
+
+export function moderationModeText(mode: unknown): string {
+  if (mode === "off") return "Moderation is off for this site: nothing waits in a queue. You can still hide content and ban readers.";
+  if (mode === "human") return "New submissions and comments are public at once and wait here for a decision, unless this site holds them until approved.";
+  if (mode === "ai") return "An AI moderator reads each new submission and comment and allows or hides it, with a reason in the log. Its decisions are public. You can undo any of them, and what you decide it never judges again.";
+  return "Moderation is on.";
+}
+
+export function shortReader(readerId: string, handle: string | null): string {
+  return handle ? `${handle} (${readerId.slice(0, 8)})` : `reader ${readerId.slice(0, 8)}`;
+}

package/lib/reader-retirement-route.ts

@@ -0,0 +1,89 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
+import { resolveProspectusSignInRuntime, type ProspectusSignInRuntime } from "./prospectus-session";
+import { ProspectusAccountsError } from "./prospectus-site-identity";
+import { secretsMatch } from "./revalidate-secret";
+
+export const READER_POLL_SECRET_PARAMETER_ENV = "PAPYRUS_READER_POLL_SECRET_PARAMETER";
+export const READER_POLL_SECRET_HEADER = "x-papyrus-reader-poll-secret";
+export const READER_POLL_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
+const CURSOR_PATTERN = /^[A-Za-z0-9._~=+/-]{1,512}$/;
+const NO_STORE_HEADERS = { "cache-control": "no-store" };
+
+export interface ReaderRetirementRouteOptions {
+  environment?: Record<string, string | undefined>;
+  readSecret?: (parameterName: string) => Promise<string | null>;
+  resolveRuntime?: (siteOrigin: string) => Promise<Pick<ProspectusSignInRuntime, "accounts"> | null>;
+  now?: number;
+}
+
+type CachedSecret = { parameterName: string; value: string; expiresAt: number };
+let cachedSecret: CachedSecret | null = null;
+let defaultSsmClient: SSMClient | null = null;
+
+export function resetReaderPollSecretCache(): void {
+  cachedSecret = null;
+}
+
+async function readSecretFromSsm(parameterName: string): Promise<string | null> {
+  defaultSsmClient ??= new SSMClient({});
+  const response = await defaultSsmClient.send(new GetParameterCommand({ Name: parameterName, WithDecryption: true }));
+  return response.Parameter?.Value?.trim() || null;
+}
+
+async function loadReaderPollSecret(options: ReaderRetirementRouteOptions, environment: Record<string, string | undefined>): Promise<string | null> {
+  const parameterName = environment[READER_POLL_SECRET_PARAMETER_ENV]?.trim();
+  if (!parameterName) return null;
+  const now = options.now ?? Date.now();
+  if (cachedSecret && cachedSecret.parameterName === parameterName && cachedSecret.expiresAt > now) return cachedSecret.value;
+  try {
+    const value = (await (options.readSecret ?? readSecretFromSsm)(parameterName))?.trim();
+    if (!value) return null;
+    cachedSecret = { parameterName, value, expiresAt: now + READER_POLL_SECRET_CACHE_MILLISECONDS };
+    return value;
+  } catch (error) {
+    console.error(`Reader poll secret could not be read (${error instanceof Error ? error.name : "error"}).`);
+    return null;
+  }
+}
+
+function failure(status: number, error: string, message: string): NextResponse {
+  return NextResponse.json({ error, message }, { status, headers: NO_STORE_HEADERS });
+}
+
+/**
+ * The scheduled snapshot run's way to Prospectus's retired-subject route. Prospectus admits one caller per site, this
+ * app's compute role, so the run cannot call it directly: it calls this route with a shared secret from SSM, and the route
+ * calls Prospectus as the compute role and passes the answer through. Anyone without the secret gets 401, and a site
+ * without the secret parameter gets 503, so this is never open.
+ */
+export async function handleReaderRetiredSubjects(request: NextRequest, options: ReaderRetirementRouteOptions = {}): Promise<NextResponse> {
+  const environment = options.environment ?? process.env;
+  const expected = await loadReaderPollSecret(options, environment);
+  if (!expected) return failure(503, "reader_poll_unavailable", "The retirement poll is not configured for this site.");
+  if (!secretsMatch(request.headers.get(READER_POLL_SECRET_HEADER), expected)) return failure(401, "unauthorized", "Missing or wrong poll secret.");
+
+  const since = request.nextUrl.searchParams.get("since") ?? undefined;
+  const unknownParameters = [...request.nextUrl.searchParams.keys()].filter((key) => key !== "since");
+  if (unknownParameters.length > 0 || (since !== undefined && !CURSOR_PATTERN.test(since))) {
+    return failure(400, "invalid_since", "Send only a since cursor.");
+  }
+  let siteOrigin: string;
+  try {
+    siteOrigin = publicSiteOrigin(request, environment);
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
+  const runtime = await (options.resolveRuntime ?? ((origin) => resolveProspectusSignInRuntime(origin, { environment })))(siteOrigin);
+  if (!runtime) return failure(503, "prospectus_sign_in_unavailable", "Prospectus is not configured for this site.");
+  try {
+    const page = await runtime.accounts.retiredSiteSubjects(since);
+    return NextResponse.json({ retired: page.retired, cursor: page.cursor, more: page.more }, { headers: NO_STORE_HEADERS });
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return failure(error.status === 400 ? 400 : 502, error.code, error.message);
+    console.error(`Prospectus retired subjects failed (${error instanceof Error ? error.name : "error"}).`);
+    return failure(502, "prospectus_unavailable", "Prospectus could not be reached.");
+  }
+}

package/lib/reader-subject.md

@@ -0,0 +1,29 @@
+# Reader subject
+
+`readerSubject(session)` in `reader-subject.ts` is the only place a reader's identity for the reader API is
+decided. It returns the per-site pairwise `siteSubject` (`ss1_` plus 43 base64url characters) that Prospectus
+puts on `person.siteSubject`, or `null`.
+
+## Production
+
+Only the `siteSubject` the sealed session cookie carries counts. While Prospectus does not return one, the
+accessor returns `null`, every reader route answers `503 reader_identity_unavailable`, and the reader features
+stay off. There is no other flag. The global Prospectus person id is never used as a reader key.
+
+## Development and test only
+
+When `SITE_ENV` is `development` or `test`, `NODE_ENV` is not `production` and `PAPYRUS_READER_DEV_SECRET`
+holds at least 16 characters, a session without a `siteSubject` gets the interim value
+`ssdev_` plus `base64url(HMAC-SHA-256(devSecret, personId))`.
+
+That path never runs in production. No remap from `ssdev_` values to `ss1_` values is ever needed: production
+reader writes stay closed until `siteSubject` is live, so no production row is ever keyed on an interim value.
+The `reader-actions` function also refuses `ssdev_` subjects unless the site was synthesized with a
+development or test `SITE_ENV`.
+
+## Staff
+
+`readerIsStaff(session)` reads the `cognito:groups` claim from the access token inside the sealed session
+cookie (`editor` or `admin`). The cookie is written by the site's own callback route, so the token is trusted
+the way the rest of the session is. The reader API passes the result to the function as `isStaff`; clients never
+send it.

package/lib/reader-subject.ts

@@ -0,0 +1,53 @@
+import { createHmac } from "node:crypto";
+import type { ProspectusSignedInSession } from "./prospectus-session";
+
+export const SITE_SUBJECT_PATTERN = /^ss1_[A-Za-z0-9_-]{43}$/;
+export const INTERIM_SUBJECT_PATTERN = /^ssdev_[A-Za-z0-9_-]{43}$/;
+export const READER_DEV_SECRET_ENV = "PAPYRUS_READER_DEV_SECRET";
+export const READER_STAFF_GROUPS = ["editor", "admin"] as const;
+
+const MINIMUM_DEV_SECRET_LENGTH = 16;
+const INTERIM_SUBJECT_PREFIX = "ssdev_";
+const INTERIM_ENVIRONMENTS = ["development", "test"];
+
+type EnvironmentVariables = Record<string, string | undefined>;
+
+export function interimSubjectsAllowed(environment: EnvironmentVariables = process.env): boolean {
+  if (environment.NODE_ENV === "production") return false;
+  const siteEnvironment = (environment.SITE_ENV ?? "").trim();
+  if (!INTERIM_ENVIRONMENTS.includes(siteEnvironment)) return false;
+  return (environment[READER_DEV_SECRET_ENV] ?? "").length >= MINIMUM_DEV_SECRET_LENGTH;
+}
+
+export function interimSubject(personId: string, devSecret: string): string {
+  return INTERIM_SUBJECT_PREFIX + createHmac("sha256", devSecret).update(personId).digest("base64url");
+}
+
+/**
+ * The reader's per-site pairwise id, or null. Production reads only the siteSubject Prospectus returned;
+ * the interim `ssdev_` value exists in development and test only (lib/reader-subject.md).
+ */
+export function readerSubject(
+  session: Pick<ProspectusSignedInSession, "personId" | "siteSubject"> | null | undefined,
+  environment: EnvironmentVariables = process.env,
+): string | null {
+  if (!session) return null;
+  if (typeof session.siteSubject === "string" && SITE_SUBJECT_PATTERN.test(session.siteSubject)) return session.siteSubject;
+  if (!interimSubjectsAllowed(environment) || !session.personId) return null;
+  return interimSubject(session.personId, environment[READER_DEV_SECRET_ENV] as string);
+}
+
+/** Staff membership from the Cognito groups claim of the access token that the sealed session cookie carries. */
+export function readerIsStaff(session: Pick<ProspectusSignedInSession, "accessToken"> | null | undefined): boolean {
+  const token = session?.accessToken;
+  if (typeof token !== "string") return false;
+  const payload = token.split(".")[1];
+  if (!payload) return false;
+  try {
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as { "cognito:groups"?: unknown };
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) && groups.some((group) => (READER_STAFF_GROUPS as readonly unknown[]).includes(group));
+  } catch {
+    return false;
+  }
+}

package/lib/reference-review-details.ts

@@ -0,0 +1,71 @@
+import type { HydratedModelPayload, MessageRecord, SemanticRelationRecord } from "./category-repository";
+import { normalizeReferenceRejectionReasonCode, type ReferenceRejectionReasonCode } from "./reference-policy";
+
+function metadataRecord(value: unknown): Record<string, unknown> {
+  if (typeof value === "string") {
+    try { return metadataRecord(JSON.parse(value)); } catch { return {}; }
+  }
+  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+/** The selected Reference's index is authoritative even when the global feed is truncated. */
+export async function loadReferenceReviewDetails(lineageId: string, read: {
+  relations: (direction: "incoming" | "outgoing") => Promise<SemanticRelationRecord[]>;
+  message: (id: string) => Promise<MessageRecord | null>;
+  payloads: (id: string) => Promise<HydratedModelPayload[]>;
+}): Promise<{ relations: SemanticRelationRecord[]; messages: MessageRecord[] }> {
+  const [outgoing, incoming] = await Promise.all([read.relations("outgoing"), read.relations("incoming")]);
+  const relations = outgoing.filter((relation) => relation.subjectKind === "reference" && relation.subjectLineageId === lineageId);
+  const latest = incoming.filter((relation) => relation.predicate === "comment" && relation.relationState === "current"
+    && relation.subjectKind === "message" && relation.objectKind === "reference" && relation.objectLineageId === lineageId
+    && metadataRecord(relation.metadata).messageKind === "reference_curation")
+    .sort((a, b) => String(b.createdAt ?? b.importedAt ?? "").localeCompare(String(a.createdAt ?? a.importedAt ?? "")))[0];
+  if (!latest) return { relations, messages: [] };
+  const message = await read.message(latest.subjectId);
+  if (!message || message.messageKind !== "reference_curation") throw new Error("The latest reference review could not be loaded.");
+  const payload = (await read.payloads(message.id))
+    .filter((entry) => entry.attachment.role === "metadata" && entry.attachment.ownerKind === "message" && entry.attachment.ownerId === message.id)
+    .sort((a, b) => String(b.attachment.updatedAt ?? "").localeCompare(String(a.attachment.updatedAt ?? "")))[0];
+  if (!payload) throw new Error("The latest reference review metadata could not be loaded.");
+  if (payload.error) throw new Error(payload.error);
+  if (!payload.json || typeof payload.json !== "object" || Array.isArray(payload.json)) {
+    throw new Error("The latest reference review metadata is invalid.");
+  }
+  const hydrated = { ...message, metadata: payload.json };
+  const recordedLineage = metadataRecord(hydrated.metadata).referenceLineageId;
+  if (recordedLineage !== lineageId) throw new Error("The latest review metadata does not match this reference lineage.");
+  return { relations, messages: [hydrated] };
+}
+
+function latestReferenceReviews(messages: MessageRecord[]): Map<string, MessageRecord> {
+  const latest = new Map<string, MessageRecord>();
+  for (const message of messages) {
+    if (message.messageKind !== "reference_curation") continue;
+    const lineage = metadataRecord(message.metadata).referenceLineageId;
+    if (typeof lineage !== "string" || !lineage) continue;
+    if (!latest.has(lineage) || String(message.createdAt).localeCompare(String(latest.get(lineage)!.createdAt)) > 0) latest.set(lineage, message);
+  }
+  return latest;
+}
+
+/** A later acceptance or archive clears any earlier rejection reason. */
+export function latestReferenceReviewReasons(messages: MessageRecord[]): Map<string, ReferenceRejectionReasonCode> {
+  const reasons = new Map<string, ReferenceRejectionReasonCode>();
+  for (const [lineage, message] of latestReferenceReviews(messages)) {
+    const metadata = metadataRecord(message.metadata);
+    const reason = metadata.action === "reject" ? normalizeReferenceRejectionReasonCode(metadata.reasonCode) : null;
+    if (reason) reasons.set(lineage, reason);
+  }
+  return reasons;
+}
+
+/** Preserve only a Section explicitly recorded on the newest acceptance, never a prediction. */
+export function latestReferenceReviewSections(messages: MessageRecord[]): Map<string, string> {
+  const sections = new Map<string, string>();
+  for (const [lineage, message] of latestReferenceReviews(messages)) {
+    const metadata = metadataRecord(message.metadata);
+    const sectionId = metadata.action === "accept" && typeof metadata.sectionId === "string" ? metadata.sectionId.trim() : "";
+    if (sectionId) sections.set(lineage, sectionId);
+  }
+  return sections;
+}

package/lib/reference-review-request.ts

@@ -0,0 +1,14 @@
+/** Hold the lock before invoking a save, including before React can rerender. */
+export function runReferenceReviewRequest(
+  pending: Map<string, Promise<void>>,
+  lineageId: string,
+  save: () => Promise<void>,
+): Promise<void> {
+  const existing = pending.get(lineageId);
+  if (existing) return existing;
+  const request = Promise.resolve().then(save).finally(() => {
+    if (pending.get(lineageId) === request) pending.delete(lineageId);
+  });
+  pending.set(lineageId, request);
+  return request;
+}