@anthusai/papyrus 1.0.0-next.61 → 1.0.0-next.63

package/lib/content-item-lifecycle.ts

@@ -0,0 +1,55 @@
+/**
+ * One content item, one lifecycle: the stages an Item lineage moves through.
+ * Mirrors CONTENT_ITEM_STAGES in src/papyrus_content/content_item_lifecycle.py.
+ * See docs/content-item-lifecycle.md.
+ */
+export const CONTENT_ITEM_STAGES = [
+  "idea",
+  "assignment",
+  "research",
+  "report",
+  "editor_select",
+  "copywriting",
+  "published",
+] as const;
+
+export type ContentItemStage = (typeof CONTENT_ITEM_STAGES)[number];
+
+const CONTENT_ITEM_STAGE_LABELS: Record<ContentItemStage, string> = {
+  idea: "Idea",
+  assignment: "Assignment",
+  research: "Research",
+  report: "Report",
+  editor_select: "Editor select",
+  copywriting: "Copywriting",
+  published: "Published",
+};
+
+export function contentItemStageLabel(stage: string): string {
+  return (CONTENT_ITEM_STAGE_LABELS as Record<string, string>)[stage] ?? stage;
+}
+
+export type ContentItemVersionRecord = {
+  id: string;
+  lineageId: string;
+  versionNumber: number;
+  stage?: string | null;
+  type: string;
+  status: string;
+  title?: string | null;
+  headline?: string | null;
+  slug: string;
+  section?: string | null;
+  updatedAt?: string | null;
+};
+
+export function latestVersionPerContentItem(
+  versions: readonly ContentItemVersionRecord[],
+): ContentItemVersionRecord[] {
+  const latestByLineage = new Map<string, ContentItemVersionRecord>();
+  for (const version of versions) {
+    const current = latestByLineage.get(version.lineageId);
+    if (!current || version.versionNumber > current.versionNumber) latestByLineage.set(version.lineageId, version);
+  }
+  return [...latestByLineage.values()];
+}

package/lib/newsroom-board.ts

@@ -1,38 +1,67 @@
 import type { KanbanConfig, KanbanIssue } from "@kanbus/ui";
 import type { AssignmentRecord, ReferenceRecord } from "./category-repository";
-import type { NewsroomArticleRow } from "./newsroom-articles";
+import {
+  CONTENT_ITEM_STAGES,
+  contentItemStageLabel,
+  latestVersionPerContentItem,
+  type ContentItemVersionRecord,
+} from "./content-item-lifecycle";
+import { getContentItemName } from "./site-brand";
 
-export type NativeBoardKind = "article" | "reference" | "assignment";
+export type NativeBoardKind = "contentItem" | "reference" | "assignment";
 export interface NativeBoardIssue extends KanbanIssue {
-  type: NativeBoardKind;
+  kind: NativeBoardKind;
   nativeId: string;
   nativeStatus: string;
   href: string;
 }
 
-/** Native records keep their own identity, status and mutation authority. No Story linkage is inferred. */
+export function contentItemBoardType(): string {
+  return getContentItemName().singular.toLowerCase();
+}
+
+function boardTypeForKind(kind: NativeBoardKind): string {
+  return kind === "contentItem" ? contentItemBoardType() : kind;
+}
+
+/**
+ * One card per content item, in the column for its lifecycle stage. Assignments that are work on a content item
+ * are counted on that item's card rather than shown as separate cards. References and other work keep their own
+ * identity and native status.
+ */
 export function projectNewsroomBoard(records: {
-  articles?: readonly NewsroomArticleRow[];
+  contentItemVersions?: readonly ContentItemVersionRecord[];
   references?: readonly ReferenceRecord[];
   assignments?: readonly AssignmentRecord[];
 }): NativeBoardIssue[] {
+  const assignmentCountByContentItem = new Map<string, number>();
+  for (const assignment of records.assignments ?? []) {
+    if (assignment.itemLineageId) {
+      assignmentCountByContentItem.set(assignment.itemLineageId, (assignmentCountByContentItem.get(assignment.itemLineageId) ?? 0) + 1);
+    }
+  }
+  const contentItemType = contentItemBoardType();
   return [
-    ...(records.articles ?? []).map(row => ({
-      id: `article:${row.id}`, nativeId: row.id, type: "article" as const,
-      title: row.title, nativeStatus: row.status, status: `article/${row.status}`,
-      priority: 2, description: row.pending ? "Published copy has pending draft changes." : undefined,
-      updated_at: row.updatedAt, href: `/newsroom/articles/${encodeURIComponent(row.id)}`,
-    })),
+    ...latestVersionPerContentItem(records.contentItemVersions ?? []).map(version => {
+      const stage = version.stage ?? "idea";
+      const workCount = assignmentCountByContentItem.get(version.lineageId) ?? 0;
+      return {
+        id: `contentItem:${version.lineageId}`, nativeId: version.lineageId, kind: "contentItem" as const, type: contentItemType,
+        title: version.headline || version.title || version.slug, nativeStatus: stage, status: `${contentItemType}/${stage}`,
+        priority: 2, description: workCount ? `${workCount} assignment${workCount === 1 ? "" : "s"} on this ${contentItemType}.` : undefined,
+        updated_at: version.updatedAt ?? undefined, href: `/newsroom/articles/${encodeURIComponent(version.id)}`,
+      };
+    }),
     ...(records.references ?? []).filter(row => !row.versionState || row.versionState === "current").map(row => ({
-      id: `reference:${row.id}`, nativeId: row.id, type: "reference" as const,
+      id: `reference:${row.id}`, nativeId: row.id, kind: "reference" as const, type: "reference",
       title: row.title || row.externalItemId || row.id,
       nativeStatus: row.curationStatus || "pending", status: `reference/${row.curationStatus || "pending"}`,
       priority: 2, description: row.curationStatusReason || undefined,
       updated_at: row.updatedAt || row.importedAt || undefined,
       href: `/newsroom/references/${encodeURIComponent(row.lineageId || row.id)}`,
     })),
-    ...(records.assignments ?? []).map(row => ({
-      id: `assignment:${row.id}`, nativeId: row.id, type: "assignment" as const,
+    ...(records.assignments ?? []).filter(row => !row.itemLineageId).map(row => ({
+      id: `assignment:${row.id}`, nativeId: row.id, kind: "assignment" as const, type: "assignment",
       title: row.title, nativeStatus: row.status, status: `assignment/${row.status}`,
       priority: row.priority ?? 2, assignee: row.assigneeId || undefined,
       description: row.summary || row.brief || undefined,
@@ -42,16 +71,26 @@ export function projectNewsroomBoard(records: {
   ];
 }
 
-/** Unknown native statuses remain visible instead of being translated into invented stages. */
+/** Content items always show every lifecycle stage in order; unknown native statuses of other records stay visible. */
 export function newsroomBoardConfig(issues: readonly NativeBoardIssue[]): KanbanConfig {
-  const keys = [...new Set(issues.map(issue => issue.status))];
+  const contentItemType = contentItemBoardType();
+  const kinds: NativeBoardKind[] = ["contentItem", "reference", "assignment"];
+  const contentItemStatuses = [
+    ...CONTENT_ITEM_STAGES,
+    ...new Set(issues.filter(issue => issue.kind === "contentItem").map(issue => issue.nativeStatus)),
+  ].filter((stage, index, stages) => stages.indexOf(stage) === index)
+    .map(stage => ({ key: `${contentItemType}/${stage}`, name: contentItemStageLabel(stage), category: "native" }));
+  const otherStatuses = [...new Set(issues.filter(issue => issue.kind !== "contentItem").map(issue => issue.status))]
+    .map(key => ({ key, name: key.replace("/", " · "), category: "native" }));
+  const statuses = [...contentItemStatuses, ...otherStatuses];
   return {
-    hierarchy: [], types: ["article", "reference", "assignment"],
-    statuses: keys.map(key => ({ key, name: key.replace("/", " · "), category: "native" })),
+    hierarchy: [], types: kinds.map(boardTypeForKind),
+    statuses,
     categories: [{ name: "native" }], priorities: {}, type_colors: {},
-    workflows: Object.fromEntries(["article", "reference", "assignment"].map(kind => [kind,
-      Object.fromEntries(keys.filter(key => key.startsWith(`${kind}/`)).map(key => [key, []])),
-    ])),
+    workflows: Object.fromEntries(kinds.map(kind => {
+      const type = boardTypeForKind(kind);
+      return [type, Object.fromEntries(statuses.filter(status => status.key.startsWith(`${type}/`)).map(status => [status.key, []]))];
+    })),
   };
 }
 

package/lib/newsroom-nav.ts

@@ -1,4 +1,5 @@
 import { newsroomHref, toPublicNewsroomPath } from "./newsroom-base-path";
+import { getContentItemName } from "./site-brand";
 
 export type NewsroomNavTabId =
   | "overview"
@@ -23,7 +24,7 @@ export type NewsroomNavItem = {
 
 export const NEWSROOM_OPS_NAV: NewsroomNavItem[] = [
   { id: "overview", label: "Overview", detail: "Desk home", href: newsroomHref(), mobilePrimary: true },
-  { id: "articles", label: "Articles", detail: "Drafts & published", href: newsroomHref("articles"), mobilePrimary: true },
+  { id: "articles", label: getContentItemName().plural, detail: "Drafts & published", href: newsroomHref("articles"), mobilePrimary: true },
   { id: "assignments", label: "Assignments", detail: "Work queue", href: newsroomHref("assignments"), mobilePrimary: true },
   { id: "references", label: "References", detail: "Knowledge base", href: newsroomHref("references"), mobilePrimary: true },
   { id: "messages", label: "Messages", detail: "Forum", href: newsroomHref("messages") },

package/lib/newsroom-organizer-nav.ts

@@ -1,3 +1,6 @@
+import { getContentItemName } from "./site-brand";
+
+const contentItemPluralLowercase = getContentItemName().plural.toLowerCase();
 export type OrganizerDestination = {
   key: string; label: string; description: string; path: string;
   access?: "admin"; primary?: boolean; unavailable?: string;
@@ -5,8 +8,8 @@ export type OrganizerDestination = {
 export const ORGANIZER_NAV_GROUPS: readonly { title: string; items: readonly OrganizerDestination[] }[] = [
   { title: "Editorial work", items: [
     { key: "overview", label: "Overview", description: "See the desk and choose where to begin.", path: "/newsroom", primary: true },
-    { key: "board", label: "Board", description: "Follow articles, sources and assignments across their stages.", path: "/newsroom/work", primary: true },
-    { key: "articles", label: "Articles", description: "Write, revise and prepare copy for publication.", path: "/newsroom/articles" },
+    { key: "board", label: "Board", description: `Follow ${contentItemPluralLowercase}, sources and assignments across their stages.`, path: "/newsroom/work", primary: true },
+    { key: "articles", label: getContentItemName().plural, description: "Write, revise and prepare copy for publication.", path: "/newsroom/articles" },
     { key: "assignments", label: "Assignments", description: "Claim work and follow research and reporting progress.", path: "/newsroom/assignments" },
     { key: "messages", label: "Messages", description: "Read and reply to newsroom conversations.", path: "/newsroom/messages", primary: true },
     { key: "insights", label: "Insights", description: "Discuss findings and research threads.", path: "/newsroom/insights" },

package/lib/priming-proof-report.ts

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { APPROVED_PRIMING_PROOF_REPORTS } from "./approved-priming-proof-reports";
+
+export const PRIMING_PROOF_REPORT_VERSION = "cyclotron-priming-proof/v1";
+
+const nullableRatio = z.number().min(0).max(1).nullable();
+
+const primingProofPointSchema = z.object({
+  labels: z.number().int().min(0),
+  labelsByClass: z.record(z.string(), z.number().int().min(0)),
+  decided: z.number().int().min(0),
+  agreement: nullableRatio,
+  precision: nullableRatio,
+  recall: nullableRatio,
+  confusion: z.object({
+    truePositives: z.number().int().min(0),
+    falsePositives: z.number().int().min(0),
+    trueNegatives: z.number().int().min(0),
+    falseNegatives: z.number().int().min(0),
+  }),
+});
+
+export const primingProofReportSchema = z.object({
+  version: z.literal(PRIMING_PROOF_REPORT_VERSION),
+  proofId: z.string().min(1),
+  publication: z.string().min(1),
+  cyclotronId: z.string().min(1),
+  question: z.string().min(1),
+  labels: z.array(z.string().min(1)).length(2),
+  positiveLabel: z.string().min(1),
+  decisionModel: z.string().nullable(),
+  ranAt: z.string().min(1),
+  heldOut: z.object({
+    size: z.number().int().min(1),
+    byLabel: z.record(z.string(), z.number().int().min(0)),
+    fingerprint: z.string().min(1),
+    frozenAt: z.string().min(1),
+    source: z.string().min(1),
+  }),
+  priming: z.object({
+    acceptedExamples: z.number().int().min(0),
+    excludedBecauseInHeldOut: z.number().int().min(0),
+    fingerprint: z.string().nullable(),
+    source: z.string().min(1),
+    order: z.string().min(1),
+  }),
+  conditions: z.object({
+    freshStorePerPoint: z.boolean(),
+    rubric: z.string().min(1),
+    optimizer: z.boolean(),
+    reviewProgram: z.boolean(),
+  }),
+  points: z.array(primingProofPointSchema).min(1),
+});
+
+export type PrimingProofReport = z.infer<typeof primingProofReportSchema>;
+export type PrimingProofPoint = z.infer<typeof primingProofPointSchema>;
+
+export type PrimingProofHeadline = {
+  baseline: PrimingProofPoint;
+  latest: PrimingProofPoint;
+  agreementChangeInPoints: number | null;
+};
+
+export function parsePrimingProofReport(value: unknown): PrimingProofReport {
+  const report = primingProofReportSchema.parse(value);
+  if (report.points[0].labels !== 0) {
+    throw new Error("A priming proof report must start with the zero-label baseline.");
+  }
+  return report;
+}
+
+export function approvedPrimingProofReport(brandId: string): PrimingProofReport | null {
+  const approvedReport = APPROVED_PRIMING_PROOF_REPORTS[brandId];
+  return approvedReport === undefined ? null : parsePrimingProofReport(approvedReport);
+}
+
+export function primingProofHeadline(report: PrimingProofReport): PrimingProofHeadline {
+  const baseline = report.points[0];
+  const latest = report.points[report.points.length - 1];
+  const agreementChangeInPoints =
+    baseline.agreement === null || latest.agreement === null
+      ? null
+      : Math.round((latest.agreement - baseline.agreement) * 1000) / 10;
+  return { baseline, latest, agreementChangeInPoints };
+}
+
+export function formatProofPercentage(ratio: number | null): string {
+  return ratio === null ? "n/a" : `${Math.round(ratio * 1000) / 10}%`;
+}

package/lib/prospectus-site-identity.ts

@@ -0,0 +1,303 @@
+
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { defaultProvider } from "@aws-sdk/credential-provider-node";
+import { SignatureV4 } from "@smithy/signature-v4";
+import { HttpRequest } from "@smithy/protocol-http";
+import { Sha256 } from "@aws-crypto/sha256-js";
+import { CognitoJwtVerifier } from "aws-jwt-verify";
+import type { JwksCache } from "aws-jwt-verify/jwk";
+
+/**
+ * A Papyrus site's server-side view of Prospectus, the single account service.
+ *
+ * The site signs requests with its own runtime role (the Amplify SSR compute role
+ * registered in Prospectus). People sign in through the site's Google-only Cognito
+ * client; Prospectus binds that sign-in to a canonical person through a one-time
+ * challenge nonce. Papyrus keeps no account or membership tables: every answer here
+ * comes from Prospectus, and publication-level grants are never inferred from an
+ * account role.
+ */
+
+export type ProspectusRole = "owner" | "admin" | "member" | "viewer";
+export type ProspectusOperation = "console:read" | "console:write" | "members:read" | "members:write";
+
+export interface ProspectusPerson {
+  id: string;
+  createdAt: string;
+}
+
+export interface ProspectusAccountAuthorization {
+  allowed: true;
+  accountId: string;
+  personId: string;
+  product: string;
+  role: ProspectusRole;
+  operation: ProspectusOperation;
+  revision: number;
+}
+
+export interface ProspectusDirectoryAccount {
+  id: string;
+  name: string;
+  role: ProspectusRole;
+  products: Array<{ product: string; status: "active" | "disabled" }>;
+}
+
+export interface ProspectusRequest {
+  path: string;
+  method: "GET" | "POST";
+  body?: unknown;
+  humanAccessToken?: string;
+  identityToken?: string;
+}
+
+export type ProspectusTransport = (request: ProspectusRequest) => Promise<unknown>;
+
+export class ProspectusAccountsError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export interface TemporaryRuntimeCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  expiration?: Date;
+}
+
+export interface SignedProspectusTransportOptions {
+  endpoint: string;
+  region: string;
+  runtimeCredentials?: () => Promise<TemporaryRuntimeCredentials>;
+  fetcher?: typeof fetch;
+}
+
+export function signedProspectusTransport(options: SignedProspectusTransportOptions): ProspectusTransport {
+  const endpoint = new URL(options.endpoint);
+  if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+    throw new Error("Use an HTTPS Prospectus accounts endpoint.");
+  }
+  const runtimeCredentials = options.runtimeCredentials ?? defaultProvider();
+  const fetcher = options.fetcher ?? fetch;
+  return async ({ path, method, body, humanAccessToken, identityToken }) => {
+    const credentials = await runtimeCredentials();
+    if (!credentials.sessionToken || (credentials.expiration && credentials.expiration.getTime() <= Date.now())) {
+      throw new Error("Prospectus calls require the site's temporary runtime credentials; static access keys are refused.");
+    }
+    const url = new URL(`${endpoint.toString().replace(/\/$/, "")}${path}`);
+    const payload = body === undefined ? undefined : JSON.stringify(body);
+    const headers: Record<string, string> = {
+      host: url.host,
+      ...(humanAccessToken ? { "x-prospectus-human-token": humanAccessToken } : {}),
+      ...(identityToken ? { "x-prospectus-identity-token": identityToken } : {}),
+      ...(payload ? { "content-type": "application/json" } : {}),
+    };
+    const signer = new SignatureV4({ service: "execute-api", region: options.region, credentials, sha256: Sha256 });
+    const signed = await signer.sign(
+      new HttpRequest({ protocol: url.protocol, hostname: url.hostname, path: url.pathname, method, headers, body: payload }),
+    );
+    const response = await fetcher(url, { method, headers: signed.headers, body: payload, cache: "no-store", redirect: "error" });
+    const responseBody = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      throw new ProspectusAccountsError(response.status, responseBody.error ?? "request_failed", responseBody.message ?? "Prospectus request failed.");
+    }
+    return responseBody;
+  };
+}
+
+export class ProspectusSiteAccounts {
+  constructor(private readonly transport: ProspectusTransport) {}
+
+  requestGoogleSignInChallenge(): Promise<{ challengeId: string; nonce: string; expiresAt: number }> {
+    return this.transport({ path: "/v1/identities/google/challenge", method: "POST", body: {} }) as Promise<{
+      challengeId: string;
+      nonce: string;
+      expiresAt: number;
+    }>;
+  }
+
+  resolveGoogleSignIn(challengeId: string, humanAccessToken: string, identityToken: string): Promise<{ person: ProspectusPerson }> {
+    return this.transport({
+      path: "/v1/identities/google/resolve",
+      method: "POST",
+      body: { challengeId },
+      humanAccessToken,
+      identityToken,
+    }) as Promise<{ person: ProspectusPerson }>;
+  }
+
+  currentPerson(humanAccessToken: string): Promise<{ person: ProspectusPerson | null }> {
+    return this.transport({ path: "/v1/identities/me", method: "GET", humanAccessToken }) as Promise<{ person: ProspectusPerson | null }>;
+  }
+
+  authorizeAccountOperation(humanAccessToken: string, accountId: string, operation: ProspectusOperation): Promise<ProspectusAccountAuthorization> {
+    return this.transport({
+      path: `/v1/accounts/${encodeURIComponent(accountId)}/authorize`,
+      method: "POST",
+      body: { operation },
+      humanAccessToken,
+    }) as Promise<ProspectusAccountAuthorization>;
+  }
+
+  accountDirectory(humanAccessToken: string): Promise<{ person: ProspectusPerson | null; accounts: ProspectusDirectoryAccount[] }> {
+    return this.transport({ path: "/v1/account-directory", method: "GET", humanAccessToken }) as Promise<{
+      person: ProspectusPerson | null;
+      accounts: ProspectusDirectoryAccount[];
+    }>;
+  }
+}
+
+export interface GoogleOnlyCognitoClient {
+  hostedUiOrigin: string;
+  userPoolId: string;
+  clientId: string;
+  redirectUri: string;
+}
+
+export interface PendingProspectusSignIn {
+  challengeId: string;
+  nonce: string;
+  state: string;
+  codeVerifier: string;
+  expiresAt: number;
+}
+
+export interface CognitoTokens {
+  accessToken: string;
+  idToken: string;
+  refreshToken?: string;
+  expiresInSeconds: number;
+}
+
+export type CognitoTokenVerifier = (tokens: CognitoTokens, expectedNonce: string) => Promise<void>;
+
+function base64UrlRandom(byteLength: number): string {
+  return randomBytes(byteLength).toString("base64url");
+}
+
+function constantTimeEquals(left: string, right: string): boolean {
+  const leftBytes = Buffer.from(left);
+  const rightBytes = Buffer.from(right);
+  return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+
+export async function beginProspectusGoogleSignIn(
+  accounts: ProspectusSiteAccounts,
+  cognitoClient: GoogleOnlyCognitoClient,
+): Promise<{ authorizationUrl: string; pendingSignIn: PendingProspectusSignIn }> {
+  const challenge = await accounts.requestGoogleSignInChallenge();
+  const state = base64UrlRandom(32);
+  const codeVerifier = base64UrlRandom(48);
+  const authorizationUrl = new URL("/oauth2/authorize", cognitoClient.hostedUiOrigin);
+  authorizationUrl.search = new URLSearchParams({
+    response_type: "code",
+    client_id: cognitoClient.clientId,
+    redirect_uri: cognitoClient.redirectUri,
+    scope: "openid email profile",
+    identity_provider: "Google",
+    state,
+    nonce: challenge.nonce,
+    code_challenge: createHash("sha256").update(codeVerifier).digest("base64url"),
+    code_challenge_method: "S256",
+  }).toString();
+  return {
+    authorizationUrl: authorizationUrl.toString(),
+    pendingSignIn: { challengeId: challenge.challengeId, nonce: challenge.nonce, state, codeVerifier, expiresAt: challenge.expiresAt },
+  };
+}
+
+export function cognitoTokenVerifier(cognitoClient: GoogleOnlyCognitoClient, signingKeyCache?: JwksCache): CognitoTokenVerifier {
+  const verifierOptions = signingKeyCache ? { jwksCache: signingKeyCache } : undefined;
+  const accessTokenVerifier = CognitoJwtVerifier.create({ userPoolId: cognitoClient.userPoolId, tokenUse: "access", clientId: cognitoClient.clientId }, verifierOptions);
+  const identityTokenVerifier = CognitoJwtVerifier.create({ userPoolId: cognitoClient.userPoolId, tokenUse: "id", clientId: cognitoClient.clientId }, verifierOptions);
+  return async (tokens, expectedNonce) => {
+    const accessClaims = await accessTokenVerifier.verify(tokens.accessToken);
+    const identityClaims = await identityTokenVerifier.verify(tokens.idToken);
+    if (identityClaims.nonce !== expectedNonce) throw new ProspectusAccountsError(401, "nonce_mismatch", "Sign-in did not carry this site's Prospectus challenge.");
+    if (identityClaims.sub !== accessClaims.sub) throw new ProspectusAccountsError(401, "token_pair_mismatch", "Access and identity tokens describe different people.");
+  };
+}
+
+export interface CompleteProspectusGoogleSignInInput {
+  accounts: ProspectusSiteAccounts;
+  cognitoClient: GoogleOnlyCognitoClient;
+  pendingSignIn: PendingProspectusSignIn;
+  returnedState: string;
+  authorizationCode: string;
+  verifyCognitoTokens?: CognitoTokenVerifier;
+  fetcher?: typeof fetch;
+  nowInSeconds?: number;
+}
+
+export async function completeProspectusGoogleSignIn(
+  input: CompleteProspectusGoogleSignInInput,
+): Promise<{ person: ProspectusPerson; accessToken: string; refreshToken?: string; accessTokenExpiresAt: number }> {
+  const nowInSeconds = input.nowInSeconds ?? Math.floor(Date.now() / 1000);
+  if (nowInSeconds >= input.pendingSignIn.expiresAt) {
+    throw new ProspectusAccountsError(401, "sign_in_expired", "Sign-in took too long. Start again.");
+  }
+  if (!constantTimeEquals(input.returnedState, input.pendingSignIn.state)) {
+    throw new ProspectusAccountsError(401, "state_mismatch", "Sign-in response does not belong to this browser's sign-in.");
+  }
+  const tokenResponse = await (input.fetcher ?? fetch)(new URL("/oauth2/token", input.cognitoClient.hostedUiOrigin), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: input.cognitoClient.clientId,
+      code: input.authorizationCode,
+      redirect_uri: input.cognitoClient.redirectUri,
+      code_verifier: input.pendingSignIn.codeVerifier,
+    }).toString(),
+    cache: "no-store",
+    redirect: "error",
+  });
+  const tokenBody = await tokenResponse.json().catch(() => ({}));
+  if (!tokenResponse.ok || typeof tokenBody.access_token !== "string" || typeof tokenBody.id_token !== "string") {
+    throw new ProspectusAccountsError(401, "code_exchange_failed", "Cognito did not complete the sign-in.");
+  }
+  const tokens: CognitoTokens = {
+    accessToken: tokenBody.access_token,
+    idToken: tokenBody.id_token,
+    refreshToken: typeof tokenBody.refresh_token === "string" ? tokenBody.refresh_token : undefined,
+    expiresInSeconds: Number(tokenBody.expires_in) || 0,
+  };
+  await (input.verifyCognitoTokens ?? cognitoTokenVerifier(input.cognitoClient))(tokens, input.pendingSignIn.nonce);
+  const { person } = await input.accounts.resolveGoogleSignIn(input.pendingSignIn.challengeId, tokens.accessToken, tokens.idToken);
+  return {
+    person,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    accessTokenExpiresAt: nowInSeconds + tokens.expiresInSeconds,
+  };
+}
+
+export async function authorizeSignedInPersonForAccount(
+  accounts: ProspectusSiteAccounts,
+  humanAccessToken: string,
+  accountId: string,
+  operation: ProspectusOperation,
+): Promise<ProspectusAccountAuthorization> {
+  const { person } = await accounts.currentPerson(humanAccessToken);
+  if (!person) throw new ProspectusAccountsError(401, "unknown_person", "Sign in again: Prospectus does not recognize this session.");
+  const authorization = await accounts.authorizeAccountOperation(humanAccessToken, accountId, operation);
+  if (authorization.allowed !== true || authorization.personId !== person.id || authorization.accountId !== accountId || authorization.operation !== operation) {
+    throw new ProspectusAccountsError(403, "not_authorized", "Prospectus did not authorize this account operation.");
+  }
+  return authorization;
+}
+
+export const CYCLOTRON_LAB_PRODUCT = "cyclotron";
+
+export async function signedInPersonHasCyclotronLabAccess(accounts: ProspectusSiteAccounts, humanAccessToken: string): Promise<boolean> {
+  const directory = await accounts.accountDirectory(humanAccessToken);
+  if (!directory.person) return false;
+  return directory.accounts.some((account) =>
+    account.products.some((product) => product.product === CYCLOTRON_LAB_PRODUCT && product.status === "active"),
+  );
+}

package/lib/site-brand.ts

@@ -64,6 +64,19 @@ export type SiteBrandVideo = {
   rhythm?: Record<string, unknown>;
 };
 
+/**
+ * The publication's name for its one content item. A content item keeps one
+ * identity and one lifecycle from idea through research, reporting,
+ * copywriting and publication; only the word editors see changes per
+ * publication (for example Story, Article or Post).
+ */
+export type ContentItemName = {
+  singular: string;
+  plural: string;
+};
+
+export const DEFAULT_CONTENT_ITEM_NAME: ContentItemName = { singular: "Story", plural: "Stories" };
+
 export type SiteBrand = {
   id: SiteBrandId;
   appTitle: string;
@@ -77,6 +90,8 @@ export type SiteBrand = {
   mastheadTaglineLines?: SiteBrandTaglineLine[];
   backToHomeLabel: string;
   articleTitleSuffix: string;
+  /** Defaults to Story / Stories, the newsroom term. */
+  contentItemName?: ContentItemName;
   placeholderByline: string;
   defaultPresentation: EditionPresentationFormat;
   forcedPresentation?: EditionPresentationFormat;
@@ -204,6 +219,10 @@ export function getSiteBrand(id: SiteBrandId = resolveSiteBrandId()): SiteBrand
 
 export const SITE_BRAND = getSiteBrand();
 
+export function getContentItemName(brand: SiteBrand = SITE_BRAND): ContentItemName {
+  return brand.contentItemName ?? DEFAULT_CONTENT_ITEM_NAME;
+}
+
 /** Root-route config for a brand, defaulting to `{ kind: "reader" }`. */
 export function getRootRoute(brand: SiteBrand = SITE_BRAND): RootRouteConfig {
   return brand.rootRoute ?? { kind: "reader" };