@anthusai/papyrus 1.0.0-next.62 → 1.0.0-next.64

package/amplify/auth/prospectus-google-client.js

@@ -0,0 +1,66 @@
+import { CfnOutput } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+export function prospectusSignInCallbackUrls(redirectUrls) {
+    const origins = [];
+    for (const redirectUrl of redirectUrls) {
+        try {
+            const origin = new URL(redirectUrl).origin;
+            if (origin !== "null" && !origins.includes(origin))
+                origins.push(origin);
+        }
+        catch {
+            continue;
+        }
+    }
+    return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+export function prospectusSignInLogoutUrls(redirectUrls) {
+    return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+export function addProspectusGoogleOnlyClient(authStack, userPool, redirectUrls) {
+    const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+    if (callbackUrls.length === 0)
+        throw new Error("The Prospectus Google-only client needs at least one site origin.");
+    const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+        userPoolId: userPool.userPoolId,
+        clientName: "prospectus-google-only",
+        generateSecret: false,
+        supportedIdentityProviders: ["Google"],
+        allowedOAuthFlowsUserPoolClient: true,
+        allowedOAuthFlows: ["code"],
+        allowedOAuthScopes: ["openid", "email", "profile"],
+        callbackUrLs: callbackUrls,
+        logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+        explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+        enableTokenRevocation: true,
+        preventUserExistenceErrors: "ENABLED",
+        accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+    });
+    const googleIdentityProviders = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+    for (const googleIdentityProvider of googleIdentityProviders)
+        googleOnlyClient.addDependency(googleIdentityProvider);
+    new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+        value: googleOnlyClient.ref,
+        description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+        value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+        description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    return googleOnlyClient;
+}

package/amplify/auth/prospectus-google-client.ts

@@ -0,0 +1,71 @@
+import { CfnOutput, type Stack } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider, type IUserPool } from "aws-cdk-lib/aws-cognito";
+
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+
+export function prospectusSignInCallbackUrls(redirectUrls: readonly string[]): string[] {
+  const origins: string[] = [];
+  for (const redirectUrl of redirectUrls) {
+    try {
+      const origin = new URL(redirectUrl).origin;
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch {
+      continue;
+    }
+  }
+  return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+
+export function prospectusSignInLogoutUrls(redirectUrls: readonly string[]): string[] {
+  return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+
+export function addProspectusGoogleOnlyClient(
+  authStack: Stack,
+  userPool: IUserPool,
+  redirectUrls: readonly string[],
+): CfnUserPoolClient {
+  const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+  if (callbackUrls.length === 0) throw new Error("The Prospectus Google-only client needs at least one site origin.");
+  const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+    userPoolId: userPool.userPoolId,
+    clientName: "prospectus-google-only",
+    generateSecret: false,
+    supportedIdentityProviders: ["Google"],
+    allowedOAuthFlowsUserPoolClient: true,
+    allowedOAuthFlows: ["code"],
+    allowedOAuthScopes: ["openid", "email", "profile"],
+    callbackUrLs: callbackUrls,
+    logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+    explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+    enableTokenRevocation: true,
+    preventUserExistenceErrors: "ENABLED",
+    accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+  });
+  const googleIdentityProviders = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolIdentityProvider => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+  for (const googleIdentityProvider of googleIdentityProviders) googleOnlyClient.addDependency(googleIdentityProvider);
+
+  new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+    value: googleOnlyClient.ref,
+    description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+    value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+    description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  return googleOnlyClient;
+}

package/amplify/auth/resource.js

@@ -32,8 +32,11 @@ export function authConfigFromEnv() {
         applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
+export function siteAuthRedirectUrls(config) {
+    return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
 export function defineSiteAuth(config) {
-    const authRedirectUrls = expandNewsroomRedirectUrls(config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS, config.newsroomBasePath);
+    const authRedirectUrls = expandNewsroomRedirectUrls(siteAuthRedirectUrls(config), config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
     return defineAuth({
         loginWith: {

package/amplify/auth/resource.ts

@@ -37,9 +37,13 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   };
 }
 
+export function siteAuthRedirectUrls(config: PapyrusAuthConfig): string[] {
+  return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
+
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = expandNewsroomRedirectUrls(
-    config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS,
+    siteAuthRedirectUrls(config),
     config.newsroomBasePath,
   );
   const disableGoogleOAuth = config.disableGoogleOAuth === true;

package/amplify/data/resource.js

@@ -893,9 +893,11 @@ const schema = a.schema({
         createdAt: a.datetime().required(),
         updatedAt: a.datetime().required(),
         newsroomFeedKey: a.string(),
+        itemLineageId: a.id(),
     })
         .secondaryIndexes((index) => [
         index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+        index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
         index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
         index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
         index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1632,6 +1634,7 @@ const schema = a.schema({
         type: a.string().required(),
         status: a.string().required(),
         typeStatus: a.string().required(),
+        stage: a.string(),
         slug: a.string().required(),
         shortSlug: a.string(),
         section: a.string(),
@@ -1663,6 +1666,7 @@ const schema = a.schema({
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
         index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+        index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),

package/amplify/data/resource.ts

@@ -970,9 +970,11 @@ const schema = a.schema({
       createdAt: a.datetime().required(),
       updatedAt: a.datetime().required(),
       newsroomFeedKey: a.string(),
+      itemLineageId: a.id(),
     })
     .secondaryIndexes((index) => [
       index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+      index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
       index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
       index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
       index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1733,6 +1735,7 @@ const schema = a.schema({
       type: a.string().required(),
       status: a.string().required(),
       typeStatus: a.string().required(),
+      stage: a.string(),
       slug: a.string().required(),
       shortSlug: a.string(),
       section: a.string(),
@@ -1764,6 +1767,7 @@ const schema = a.schema({
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
       index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+      index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),

package/amplify/data/schema.js

@@ -799,9 +799,11 @@ const baseDefinitions = {
         createdAt: a.datetime().required(),
         updatedAt: a.datetime().required(),
         newsroomFeedKey: a.string(),
+        itemLineageId: a.id(),
     })
         .secondaryIndexes((index) => [
         index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+        index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
         index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
         index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
         index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1511,6 +1513,7 @@ const baseDefinitions = {
         changeReason: a.string(),
         contentHash: a.string(),
         type: a.string().required(),
+        stage: a.string(),
         status: a.string().required(),
         typeStatus: a.string().required(),
         slug: a.string().required(),
@@ -1544,6 +1547,7 @@ const baseDefinitions = {
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
         index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+        index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),

package/amplify/data/schema.ts

@@ -870,9 +870,11 @@ const baseDefinitions = {
       createdAt: a.datetime().required(),
       updatedAt: a.datetime().required(),
       newsroomFeedKey: a.string(),
+      itemLineageId: a.id(),
     })
     .secondaryIndexes((index) => [
       index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+      index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
       index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
       index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
       index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1606,6 +1608,7 @@ const baseDefinitions = {
       changeReason: a.string(),
       contentHash: a.string(),
       type: a.string().required(),
+      stage: a.string(),
       status: a.string().required(),
       typeStatus: a.string().required(),
       slug: a.string().required(),
@@ -1639,6 +1642,7 @@ const baseDefinitions = {
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
       index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+      index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),

package/amplify/site-backend.js

@@ -17,7 +17,8 @@ import { assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
@@ -107,6 +108,9 @@ export function defineSiteBackend(papyrusSite) {
         && authConfig.disableGoogleOAuth !== true) {
         applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
     }
+    const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+        ? undefined
+        : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
@@ -546,6 +550,9 @@ export function defineSiteBackend(papyrusSite) {
     }));
     backend.addOutput({
         custom: {
+            prospectusSignIn: prospectusGoogleOnlyClient
+                ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+                : null,
             inboundEmail: enableInboundEmail
                 ? {
                     domain: inboundEmailDomain,

package/amplify/site-backend.ts

@@ -24,7 +24,8 @@ import {
   validateRevalidateDistributionIds,
 } from "./revalidate-invalidation-settings";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
@@ -137,6 +138,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
   }
 
+  const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+    ? undefined
+    : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
@@ -682,6 +687,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   backend.addOutput({
     custom: {
+      prospectusSignIn: prospectusGoogleOnlyClient
+        ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+        : null,
       inboundEmail: enableInboundEmail
         ? {
             domain: inboundEmailDomain,

package/app/api/auth/prospectus/callback/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignInCallback } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSignInCallback(request);
+}

package/app/api/auth/prospectus/selection/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusAccountSelection } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusAccountSelection(request);
+}

package/app/api/auth/prospectus/session/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSessionRead } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSessionRead(request);
+}

package/app/api/auth/prospectus/sign-in/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignInStart } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSignInStart(request);
+}

package/app/api/auth/prospectus/sign-out/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignOut } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusSignOut(request);
+}

package/components/news-desk-taxonomy-client.ts

@@ -39,6 +39,7 @@ import type {
   UserDirectoryEntry,
 } from "../lib/category-repository";
 import { relationTypeKey } from "../lib/semantic-graph";
+import { CONTENT_ITEM_STAGES, type ContentItemVersionRecord } from "../lib/content-item-lifecycle";
 import { DOCTRINE_DEFINITIONS, getCategoryDoctrineDefinitions, type DoctrineCategory } from "../lib/doctrine";
 import { configureAmplifyClient } from "./amplify-client-provider";
 import { isUnauthenticatedError, loadReaderSessionSnapshot, type ReaderAuthSnapshot } from "./reader-auth-state";
@@ -253,7 +254,7 @@ const UPDATE_MESSAGE_MUTATION = `
 const NEWSROOM_ASSIGNMENT_FEED_QUERY = `
   query ListAssignmentsByNewsroomFeedAndCreatedAt($newsroomFeedKey: String!, $sortDirection: ModelSortDirection, $limit: Int, $nextToken: String, $filter: ModelAssignmentFilterInput) {
     listAssignmentsByNewsroomFeedAndCreatedAt(newsroomFeedKey: $newsroomFeedKey, sortDirection: $sortDirection, limit: $limit, nextToken: $nextToken, filter: $filter) {
-      items { id assignmentTypeKey queueKey queueStatusKey status priority title summary assigneeType assigneeId assigneeKey claimedAt claimExpiresAt completedAt canceledAt corpusId categorySetId classifierId sectionId sectionKey sectionType sectionStatusKey sectionQueueStatusKey primaryFocusCategoryKey topicScopeCategoryKeys sourceSnapshotId importRunId createdBy createdAt updatedAt newsroomFeedKey }
+      items { id assignmentTypeKey queueKey queueStatusKey status priority title summary assigneeType assigneeId assigneeKey claimedAt claimExpiresAt completedAt canceledAt corpusId categorySetId classifierId sectionId sectionKey sectionType sectionStatusKey sectionQueueStatusKey primaryFocusCategoryKey topicScopeCategoryKeys sourceSnapshotId importRunId createdBy createdAt updatedAt newsroomFeedKey itemLineageId }
       nextToken
     }
   }
@@ -2157,6 +2158,41 @@ export async function loadNewsroomAssignmentPage(options: NewsroomAssignmentPage
   });
 }
 
+const CONTENT_ITEMS_BY_STAGE_QUERY = `
+  query ListItemsByStageAndUpdatedAt($stage: String!, $sortDirection: ModelSortDirection, $limit: Int, $nextToken: String) {
+    listItemsByStageAndUpdatedAt(stage: $stage, sortDirection: $sortDirection, limit: $limit, nextToken: $nextToken) {
+      items { id lineageId versionNumber stage type status title headline slug section updatedAt }
+      nextToken
+    }
+  }
+`;
+
+export async function loadNewsroomContentItemVersions(): Promise<ContentItemVersionRecord[]> {
+  configureAmplifyClient();
+  const client = generateClient<Schema>() as unknown as {
+    graphql: (options: Record<string, unknown>) => Promise<GraphQLConnectionResponse<ContentItemVersionRecord>>;
+  };
+  const field = "listItemsByStageAndUpdatedAt";
+  const versionsPerStage = await Promise.all(CONTENT_ITEM_STAGES.map(async (stage) => {
+    const versions: ContentItemVersionRecord[] = [];
+    let nextToken: string | null = null;
+    do {
+      const response: GraphQLConnectionResponse<ContentItemVersionRecord> = await client.graphql({
+        query: CONTENT_ITEMS_BY_STAGE_QUERY,
+        variables: { stage, sortDirection: "DESC", limit: NEWSROOM_PAGE_LIMIT, nextToken },
+        authMode: USER_POOL_AUTH_MODE,
+      });
+      assertNoGraphQLErrors(response.errors);
+      const connection = response.data?.[field];
+      if (!connection) throw new Error(`Missing GraphQL connection payload for ${field}.`);
+      versions.push(...((connection.items ?? []).filter(Boolean) as ContentItemVersionRecord[]));
+      nextToken = connection.nextToken ?? null;
+    } while (nextToken);
+    return versions;
+  }));
+  return versionsPerStage.flat();
+}
+
 export async function loadModelPayloadsForOwner(
   ownerKind: string,
   ownerId: string,

package/components/newsroom-board-view.tsx

@@ -6,10 +6,9 @@ import { IssueCollection, IssueDetailPanel, IssueTypeFilter, issueTypeFromFilter
 import "@kanbus/ui/styles/kanban.css";
 import "./newsroom-newsprint-board.css";
 import { canReadNewsroomBoard, newsroomBoardConfig, projectNewsroomBoard, type NativeBoardIssue } from "../lib/newsroom-board";
-import { resolveArticlesBackend } from "../lib/newsroom-articles";
-import { SITE_BRAND } from "../lib/site-brand";
+import { getContentItemName, SITE_BRAND } from "../lib/site-brand";
 import { getNewsroomNavHref } from "../lib/newsroom-nav";
-import { loadNewsroomAssignmentPage, loadNewsroomReferencePage } from "./news-desk-taxonomy-client";
+import { loadNewsroomAssignmentPage, loadNewsroomContentItemVersions, loadNewsroomReferencePage } from "./news-desk-taxonomy-client";
 import { useOptionalNewsDeskClient } from "./news-desk-client-provider";
 import { NewsDeskAccessGate } from "./newsroom-access-gate";
 import { NewsroomOpsShell, NewsroomOpsStatusBanner } from "./newsroom-ops-shell";
@@ -45,12 +44,12 @@ export function NewsroomBoardView() {
     if (!allowed) { setLoading(false); return; }
     setLoading(true); busy.current = true;
     Promise.all([
-      resolveArticlesBackend(false).listRows(),
+      loadNewsroomContentItemVersions(),
       loadNewsroomReferencePage({ limit: 50 }),
       loadNewsroomAssignmentPage({ limit: 50 }),
-    ]).then(([articles, references, assignments]) => {
+    ]).then(([contentItemVersions, references, assignments]) => {
       if (generation.current !== request) return;
-      setIssues(projectNewsroomBoard({ articles, references: references.items, assignments: assignments.items }));
+      setIssues(projectNewsroomBoard({ contentItemVersions, references: references.items, assignments: assignments.items }));
       setTokens({ reference: references.nextToken, assignment: assignments.nextToken });
     }).catch((reason: unknown) => {
       if (generation.current === request) setError(reason instanceof Error ? reason.message : "Could not load newsroom records.");
@@ -81,7 +80,7 @@ export function NewsroomBoardView() {
         <IssueTypeFilter config={config} value={filter} onChange={value => { setFilter(value); setSelected(null); }} name="Record type" />
         <div role="group" aria-label="Record presentation"><button type="button" aria-pressed={view === "board"} onClick={() => setView("board")}>Board</button><button type="button" aria-pressed={view === "list"} onClick={() => setView("list")}>List</button><button type="button" disabled={loading} onClick={() => setRevision(current => current + 1)}>Refresh records</button></div>
       </div>
-      <p className="organizer-board-note">Native CMS records and statuses. Open a record to use its existing editor or workflow controls. Story linking is not configured.</p>
+      <p className="organizer-board-note">{`Each ${getContentItemName().singular.toLowerCase()} appears once, in the column for its stage. Open a record to use its existing editor or workflow controls.`}</p>
       {error && <NewsroomOpsStatusBanner tone="error">{error}</NewsroomOpsStatusBanner>}
       <p role="status" className="organizer-board-note">{loading ? "Loading records…" : `${issues.length} records loaded. References and assignments load in pages.`}</p>
       <div className="organizer-board-body" data-detail-open={Boolean(issue)}>
@@ -91,7 +90,7 @@ export function NewsroomBoardView() {
           selectedIssueId={selected} detailOpen={Boolean(issue)} onSelectIssue={item => setSelected(item.id)} ariaLabel="Newsroom records"
           emptyMessage={loading ? "Loading records…" : error ? "Records could not be loaded." : "No records in this selection."} />
         {issue && <IssueDetailPanel issue={issue} onClose={() => setSelected(null)} fields={[{ label: "CMS record ID", value: issue.nativeId }, { label: "Status", value: issue.nativeStatus }]}>
-          <Link href={getNewsroomNavHref(issue.href)}>Open {issue.type} workspace</Link>
+          <Link href={getNewsroomNavHref(issue.href)}>Open {issue.type}</Link>
         </IssueDetailPanel>}
       </div>
       <div className="organizer-board-pages">{tokens.reference && <button disabled={loading} type="button" onClick={() => void loadMore("reference")}>Load more references</button>}{tokens.assignment && <button disabled={loading} type="button" onClick={() => void loadMore("assignment")}>Load more assignments</button>}</div>

package/components/priming-proof-page.tsx

@@ -4,7 +4,7 @@ import {
   type PrimingProofReport,
 } from "../lib/priming-proof-report";
 
-function ProofMethod({ heldOutSize }: { heldOutSize: number | null }) {
+function ProofMethod({ heldOutSize, teachingSource }: { heldOutSize: number | null; teachingSource: string | null }) {
   return (
     <section aria-labelledby="priming-proof-method" className="space-y-2 text-sm leading-relaxed">
       <h2 id="priming-proof-method" className="text-base font-semibold uppercase tracking-wide">How the number is made</h2>
@@ -14,8 +14,10 @@ function ProofMethod({ heldOutSize }: { heldOutSize: number | null }) {
         for teaching. A classifier that always gives the same answer agrees on half of it.
       </p>
       <p>
-        Editors teach the classifier by pasting a source URL, reviewing what Papyrus extracted, and choosing publish or
-        reject. Each point below starts a fresh classifier that sees only the first N of those labels, then decides
+        Editors teach the classifier with labels: their other reviews of candidate sources, and sources they paste,
+        check after Papyrus extracts them, and mark publish or reject.
+        {teachingSource === null ? "" : ` This run taught from ${teachingSource}.`} Each point below starts a fresh
+        classifier that sees only the first N of those labels, then decides
         every held-out source once. Nothing else changes between points: the same decision model, the publication&apos;s
         mission and policies as the only rubric, and no automatic rubric rewriting.
       </p>
@@ -31,7 +33,7 @@ export function PrimingProofPage({ report }: { report: PrimingProofReport | null
           <h1 className="text-3xl font-bold">Does teaching the classifier work?</h1>
           <p className="text-muted-foreground">No approved proof run has been published for this publication yet.</p>
         </header>
-        <ProofMethod heldOutSize={null} />
+        <ProofMethod heldOutSize={null} teachingSource={null} />
       </main>
     );
   }
@@ -82,7 +84,7 @@ export function PrimingProofPage({ report }: { report: PrimingProofReport | null
           </table>
         </div>
       </section>
-      <ProofMethod heldOutSize={report.heldOut.size} />
+      <ProofMethod heldOutSize={report.heldOut.size} teachingSource={report.priming.source} />
       <p className="break-all text-xs text-muted-foreground">
         Held-out fingerprint {report.heldOut.fingerprint}
         {report.priming.fingerprint ? ` · labels fingerprint ${report.priming.fingerprint}` : ""}

package/components/topic-steering-workspace.tsx

@@ -15042,6 +15042,9 @@ function buildUiCopywritingAssignment({ actorLabel, assignment, decision, messag
   message: MessageRecord;
   now: string;
 }): AssignmentRecord {
+  if (!assignment.itemLineageId) {
+    throw new Error(`Assignment ${assignment.id} has no content item lineage; copywriting must continue the same content item.`);
+  }
   const type = decision === "brief" ? "brief" : "article";
   const assignmentTypeKey = type === "brief" ? "copywriting.brief-draft" : "copywriting.article-draft";
   const section = assignment.sectionKey ?? assignment.sectionId ?? "unsectioned";
@@ -15094,6 +15097,7 @@ function buildUiCopywritingAssignment({ actorLabel, assignment, decision, messag
     createdAt: now,
     updatedAt: now,
     newsroomFeedKey: "assignment#open",
+    itemLineageId: assignment.itemLineageId,
     metadata,
   };
 }

package/infra/amplify-app-shell.js

@@ -1,6 +1,7 @@
 import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
 import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
@@ -86,9 +87,26 @@ export class AmplifyAppShellStack extends Stack {
             }));
         }
         const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-        const prospectusEnvironment = prospectusAccountsApiStageArn
-            ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+        const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
+            ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+                description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
+                generateSecretString: { passwordLength: 64, excludePunctuation: true },
+            })
+            : undefined;
+        const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+            ? {
+                PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
+                PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+                PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
+            }
             : {};
+        if (prospectusSessionSealingSecret) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "ReadProspectusSessionSealingSecret",
+                actions: ["secretsmanager:GetSecretValue"],
+                resources: [prospectusSessionSealingSecret.secretArn],
+            }));
+        }
         if (prospectusAccountsApiStageArn) {
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "InvokeProspectusAccountsAsRegisteredSite",