@anthusai/papyrus 5.20.0 → 5.22.0

package/lib/reader-api.ts

@@ -7,10 +7,12 @@ import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfigured
 
 export const READER_ACTIONS_FUNCTION_ENV = "PAPYRUS_READER_ACTIONS_FUNCTION";
 export const READER_MAXIMUM_BODY_BYTES = 4096;
+/** Larger bodies for actions that carry reader text: a URL, a title and a note; a comment of 2,000 characters. */
+export const READER_BODY_BYTES_BY_ACTION: Partial<Record<ReaderAction, number>> = { submit: 8192, comment: 12288, "comment-edit": 12288 };
 export const READER_MAXIMUM_SUBJECTS = 50;
 export const READER_SUBJECT_KEY = /^[A-Za-z0-9._:-]{1,200}$/;
 
-export type ReaderAction = "me" | "handle" | "vote" | "rating";
+export type ReaderAction = "me" | "handle" | "vote" | "rating" | "submit" | "comment" | "comment-edit" | "comment-delete" | "report";
 
 export interface ReaderActionEvent {
   publication: string;
@@ -65,13 +67,13 @@ export async function invokeReaderActionsLambda(functionName: string, event: Rea
   return { statusCode: result.statusCode, body: result.body as Record<string, unknown> };
 }
 
-async function readJsonBody(request: NextRequest): Promise<{ payload: Record<string, unknown> } | { response: NextResponse }> {
+async function readJsonBody(request: NextRequest, maximumBytes: number): Promise<{ payload: Record<string, unknown> } | { response: NextResponse }> {
   const contentType = (request.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
   if (contentType !== "application/json") return { response: failure(415, "unsupported_media_type", "Send application/json.") };
   const declared = Number(request.headers.get("content-length") ?? "0");
-  if (Number.isFinite(declared) && declared > READER_MAXIMUM_BODY_BYTES) return { response: failure(413, "payload_too_large", "The request body is too large.") };
+  if (Number.isFinite(declared) && declared > maximumBytes) return { response: failure(413, "payload_too_large", "The request body is too large.") };
   const text = await request.text();
-  if (Buffer.byteLength(text, "utf8") > READER_MAXIMUM_BODY_BYTES) return { response: failure(413, "payload_too_large", "The request body is too large.") };
+  if (Buffer.byteLength(text, "utf8") > maximumBytes) return { response: failure(413, "payload_too_large", "The request body is too large.") };
   try {
     const parsed = JSON.parse(text) as unknown;
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not an object");
@@ -120,7 +122,7 @@ export async function handleReaderRequest(request: NextRequest, action: ReaderAc
     parsed = subjectsFromQuery(request);
   } else {
     if (request.headers.get("origin") !== origin) return failure(403, "origin_mismatch", "This request did not come from this site.");
-    parsed = await readJsonBody(request);
+    parsed = await readJsonBody(request, READER_BODY_BYTES_BY_ACTION[action] ?? READER_MAXIMUM_BODY_BYTES);
   }
   if ("response" in parsed) return parsed.response;
 

package/lib/reader-moderation.ts

@@ -0,0 +1,220 @@
+/**
+ * The data side of the Administration "Moderation" panel for the reader-steering plugin: rows from the staff-readable
+ * models, shaped into a queue, a hidden list and the recent action log. Pure functions, no network: the panel loads the
+ * rows and calls the `moderateReader` mutation; everything it shows is decided here so it can be tested.
+ */
+
+export type ModerationTarget = "submission" | "comment" | "reader";
+export type ModerationActionName = "approve" | "hide" | "unhide" | "ban" | "unban" | "limit" | "promote" | "undo";
+
+export type SubmissionRow = {
+  id: string;
+  canonicalUrl: string;
+  domain: string;
+  title: string;
+  kind?: string | null;
+  note?: string | null;
+  readerId: string;
+  state: string;
+  moderation?: string | null;
+  reportCount?: number | null;
+  signals?: unknown;
+  itemId?: string | null;
+  createdAt: string;
+};
+
+export type CommentRow = {
+  id: string;
+  subjectKey: string;
+  readerId: string;
+  body: string;
+  parentId?: string | null;
+  state: string;
+  moderation?: string | null;
+  reportCount?: number | null;
+  signals?: unknown;
+  createdAt: string;
+};
+
+export type ReportRow = { id: string; targetType: string; target: string; reporterReaderId: string; reason: string; state: string; createdAt: string };
+
+export type ActionRow = {
+  id: string;
+  by: string;
+  actorSub: string;
+  action: string;
+  targetType: string;
+  target: string;
+  reason?: string | null;
+  fromState: string;
+  toState: string;
+  undoOf?: string | null;
+  undoneBy?: string | null;
+  at: string;
+};
+
+export type Signal = { source: string; policy: string; detector: string; severity: string; excerpt: string };
+
+export type ModerationRow = {
+  kind: "submission" | "comment";
+  id: string;
+  readerId: string;
+  handle: string | null;
+  createdAt: string;
+  state: string;
+  title: string;
+  url: string | null;
+  text: string;
+  subject: string | null;
+  reports: ReportRow[];
+  signals: Signal[];
+  canPromote: boolean;
+};
+
+export type ActionEntry = ActionRow & { label: string; undoable: boolean; byLabel: string };
+
+const SEVERITY_ORDER: Record<string, number> = { error: 0, warn: 1, info: 2 };
+
+export function parseSignals(value: unknown): Signal[] {
+  let parsed: unknown = value;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return [];
+    }
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed
+    .filter((entry): entry is Record<string, unknown> => typeof entry === "object" && entry !== null)
+    .map((entry) => ({
+      source: String(entry.source ?? ""),
+      policy: String(entry.policy ?? ""),
+      detector: String(entry.detector ?? ""),
+      severity: String(entry.severity ?? "info"),
+      excerpt: String(entry.excerpt ?? ""),
+    }))
+    .sort((left, right) => (SEVERITY_ORDER[left.severity] ?? 3) - (SEVERITY_ORDER[right.severity] ?? 3));
+}
+
+/** An address a moderator may follow: http or https only, never `javascript:` or `data:`. */
+export function safeHttpUrl(value: string | null | undefined): string | null {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+
+function newestFirst<T extends { createdAt: string; id: string }>(rows: T[]): T[] {
+  return [...rows].sort((left, right) => (left.createdAt === right.createdAt ? right.id.localeCompare(left.id) : right.createdAt.localeCompare(left.createdAt)));
+}
+
+function reportsByTarget(reports: ReportRow[]): Map<string, ReportRow[]> {
+  const grouped = new Map<string, ReportRow[]>();
+  for (const report of reports) {
+    if (report.state !== "open") continue;
+    grouped.set(report.target, [...(grouped.get(report.target) ?? []), report]);
+  }
+  return grouped;
+}
+
+export function submissionRow(row: SubmissionRow, handles: Record<string, string>, reports: Map<string, ReportRow[]>): ModerationRow {
+  return {
+    kind: "submission",
+    id: row.id,
+    readerId: row.readerId,
+    handle: handles[row.readerId] ?? null,
+    createdAt: row.createdAt,
+    state: row.state,
+    title: row.title,
+    url: safeHttpUrl(row.canonicalUrl),
+    text: row.note ?? "",
+    subject: row.itemId ?? row.id,
+    reports: reports.get(row.id) ?? [],
+    signals: parseSignals(row.signals),
+    canPromote: row.state === "pending",
+  };
+}
+
+export function commentRow(row: CommentRow, handles: Record<string, string>, reports: Map<string, ReportRow[]>): ModerationRow {
+  return {
+    kind: "comment",
+    id: row.id,
+    readerId: row.readerId,
+    handle: handles[row.readerId] ?? null,
+    createdAt: row.createdAt,
+    state: row.state,
+    title: "",
+    url: null,
+    text: row.body,
+    subject: row.subjectKey,
+    reports: reports.get(row.id) ?? [],
+    signals: parseSignals(row.signals),
+    canPromote: false,
+  };
+}
+
+/** Everything waiting for a decision: new items and reported ones, newest first. Deleted comments are the author's own and are not in it. */
+export function buildQueue(input: { submissions: SubmissionRow[]; comments: CommentRow[]; reports: ReportRow[]; handles: Record<string, string> }): ModerationRow[] {
+  const reports = reportsByTarget(input.reports);
+  const rows = [
+    ...input.submissions.filter((row) => (row.moderation ?? "new") === "new").map((row) => submissionRow(row, input.handles, reports)),
+    ...input.comments.filter((row) => (row.moderation ?? "new") === "new" && row.state !== "deleted").map((row) => commentRow(row, input.handles, reports)),
+  ];
+  return newestFirst(rows);
+}
+
+/** Items a moderator or a pre-moderation hold keeps out of the public files, newest first, so they can be brought back. */
+export function buildHidden(input: { submissions: SubmissionRow[]; comments: CommentRow[]; reports: ReportRow[]; handles: Record<string, string> }): ModerationRow[] {
+  const reports = reportsByTarget(input.reports);
+  return newestFirst([
+    ...input.submissions.filter((row) => row.state === "hidden").map((row) => submissionRow(row, input.handles, reports)),
+    ...input.comments.filter((row) => row.state === "hidden").map((row) => commentRow(row, input.handles, reports)),
+  ]);
+}
+
+const ACTION_LABELS: Record<string, string> = {
+  approve: "Approved",
+  hide: "Hidden",
+  unhide: "Shown again",
+  ban: "Banned",
+  unban: "Unbanned",
+  limit: "Limited",
+  promote: "Promoted to a draft",
+  undo: "Undid an action",
+};
+
+/** The recent log, newest first. An action can be undone while nothing has undone it, and a promotion never. */
+export function buildActionLog(actions: ActionRow[], limit = 50): ActionEntry[] {
+  return [...actions]
+    .sort((left, right) => (left.at === right.at ? right.id.localeCompare(left.id) : right.at.localeCompare(left.at)))
+    .slice(0, limit)
+    .map((entry) => ({
+      ...entry,
+      label: ACTION_LABELS[entry.action] ?? entry.action,
+      byLabel: entry.by === "ai" ? "AI moderator" : "A moderator",
+      undoable: !entry.undoneBy && entry.action !== "promote",
+    }));
+}
+
+export type Receipt = { status?: string | null; id?: string | null; error?: string | null; message?: string | null };
+
+export function receiptMessage(receipt: Receipt | null | undefined): string {
+  if (!receipt) return "The action did not answer. Reload and check.";
+  if (receipt.status === "ok") return "Done.";
+  return receipt.message || "The action was refused.";
+}
+
+export function moderationModeText(mode: unknown): string {
+  if (mode === "off") return "Moderation is off for this site: nothing waits in a queue. You can still hide content and ban readers.";
+  if (mode === "human") return "New submissions and comments are public at once and wait here for a decision, unless this site holds them until approved.";
+  if (mode === "ai") return "An AI moderator reads each new submission and comment and allows or hides it, with a reason in the log. Its decisions are public. You can undo any of them, and what you decide it never judges again.";
+  return "Moderation is on.";
+}
+
+export function shortReader(readerId: string, handle: string | null): string {
+  return handle ? `${handle} (${readerId.slice(0, 8)})` : `reader ${readerId.slice(0, 8)}`;
+}

package/package.json

@@ -85,11 +85,14 @@
     "./components/item-stream-view": "./components/item-stream-view.tsx",
     "./components/markus-body-editor": "./components/markus-body-editor.tsx",
     "./components/markus-ir-preview": "./components/markus-ir-preview.tsx",
+    "./components/moderation-panel": "./components/moderation-panel.tsx",
     "./components/monitoring-overview-view": "./components/monitoring-overview-view.tsx",
     "./components/monitoring-panel": "./components/monitoring-panel.tsx",
     "./components/news-desk-client-provider": "./components/news-desk-client-provider.tsx",
     "./components/news-desk-page": "./components/news-desk-page.tsx",
     "./components/news-desk-taxonomy-client": "./components/news-desk-taxonomy-client.ts",
+    "./components/newsletter-panel": "./components/newsletter-panel.tsx",
+    "./components/newsletter-sections": "./components/newsletter-sections.tsx",
     "./components/newspaper": "./components/newspaper.tsx",
     "./components/newsroom-access-gate": "./components/newsroom-access-gate.tsx",
     "./components/newsroom-article-editor": "./components/newsroom-article-editor.tsx",
@@ -233,6 +236,11 @@
     "./lib/monitoring-overview-fixture": "./lib/monitoring-overview-fixture.ts",
     "./lib/monitoring-overview": "./lib/monitoring-overview.ts",
     "./lib/news-desk-session": "./lib/news-desk-session.ts",
+    "./lib/newsletter-api": "./lib/newsletter-api.ts",
+    "./lib/newsletter-client": "./lib/newsletter-client.ts",
+    "./lib/newsletter-fixture": "./lib/newsletter-fixture.ts",
+    "./lib/newsletter-model": "./lib/newsletter-model.ts",
+    "./lib/newsletter-pages": "./lib/newsletter-pages.ts",
     "./lib/newspaper-layout": "./lib/newspaper-layout.ts",
     "./lib/newsroom-articles": "./lib/newsroom-articles.ts",
     "./lib/newsroom-assignments": "./lib/newsroom-assignments.ts",
@@ -276,6 +284,7 @@
     "./lib/reader-api": "./lib/reader-api.ts",
     "./lib/reader-base-path": "./lib/reader-base-path.ts",
     "./lib/reader-cache-lifetime": "./lib/reader-cache-lifetime.ts",
+    "./lib/reader-moderation": "./lib/reader-moderation.ts",
     "./lib/reader-retirement-route": "./lib/reader-retirement-route.ts",
     "./lib/reader-route-config": "./lib/reader-route-config.ts",
     "./lib/reader-static-params": "./lib/reader-static-params.ts",
@@ -342,13 +351,22 @@
     "./app/api/local-preview/derive/route": "./app/api/local-preview/derive/route.ts",
     "./app/api/local-preview/media/route": "./app/api/local-preview/media/route.ts",
     "./app/api/media/[...path]/route": "./app/api/media/[...path]/route.ts",
+    "./app/api/newsletter/confirm/route": "./app/api/newsletter/confirm/route.ts",
+    "./app/api/newsletter/preferences/route": "./app/api/newsletter/preferences/route.ts",
+    "./app/api/newsletter/subscribe/route": "./app/api/newsletter/subscribe/route.ts",
+    "./app/api/newsletter/unsubscribe/route": "./app/api/newsletter/unsubscribe/route.ts",
     "./app/api/newsroom/curation/context/route": "./app/api/newsroom/curation/context/route.ts",
     "./app/api/newsroom/curation/priming/route": "./app/api/newsroom/curation/priming/route.ts",
     "./app/api/newsroom/curation/publication/route": "./app/api/newsroom/curation/publication/route.ts",
+    "./app/api/reader/comment/delete/route": "./app/api/reader/comment/delete/route.ts",
+    "./app/api/reader/comment/edit/route": "./app/api/reader/comment/edit/route.ts",
+    "./app/api/reader/comment/route": "./app/api/reader/comment/route.ts",
     "./app/api/reader/handle/route": "./app/api/reader/handle/route.ts",
     "./app/api/reader/me/route": "./app/api/reader/me/route.ts",
     "./app/api/reader/rating/route": "./app/api/reader/rating/route.ts",
+    "./app/api/reader/report/route": "./app/api/reader/report/route.ts",
     "./app/api/reader/retired/route": "./app/api/reader/retired/route.ts",
+    "./app/api/reader/submit/route": "./app/api/reader/submit/route.ts",
     "./app/api/reader/vote/route": "./app/api/reader/vote/route.ts",
     "./app/api/revalidate/route": "./app/api/revalidate/route.ts",
     "./app/archive/page": "./app/archive/page.tsx",
@@ -415,7 +433,7 @@
       "optional": true
     }
   },
-  "version": "5.20.0",
+  "version": "5.22.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.20.0",
+  "version": "5.22.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -170,6 +170,53 @@
         "dynamic": "\"force-dynamic\""
       }
     },
+    {
+      "file": "app/api/newsletter/confirm/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET",
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/newsletter/preferences/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET",
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/newsletter/subscribe/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/newsletter/unsubscribe/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET",
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/newsroom/curation/context/route.ts",
       "hasDefault": false,
@@ -203,6 +250,39 @@
         "runtime": "\"nodejs\""
       }
     },
+    {
+      "file": "app/api/reader/comment/delete/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/reader/comment/edit/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/reader/comment/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/reader/handle/route.ts",
       "hasDefault": false,
@@ -236,6 +316,17 @@
         "runtime": "\"nodejs\""
       }
     },
+    {
+      "file": "app/api/reader/report/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/reader/retired/route.ts",
       "hasDefault": false,
@@ -247,6 +338,17 @@
         "runtime": "\"nodejs\""
       }
     },
+    {
+      "file": "app/api/reader/submit/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/reader/vote/route.ts",
       "hasDefault": false,