@anthusai/papyrus 1.0.0-next.62 → 1.0.0-next.64

package/infra/amplify-app-shell.ts

@@ -2,6 +2,7 @@ import { Construct } from "constructs";
 import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
 import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
@@ -97,9 +98,28 @@ export class AmplifyAppShellStack extends Stack {
     }
 
     const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-    const prospectusEnvironment = prospectusAccountsApiStageArn
-      ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+    const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
+      ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+        description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
+        generateSecretString: { passwordLength: 64, excludePunctuation: true },
+      })
+      : undefined;
+    const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+      ? {
+        PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
+        PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+        PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
+      }
       : {};
+    if (prospectusSessionSealingSecret) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "ReadProspectusSessionSealingSecret",
+          actions: ["secretsmanager:GetSecretValue"],
+          resources: [prospectusSessionSealingSecret.secretArn],
+        }),
+      );
+    }
     if (prospectusAccountsApiStageArn) {
       computeRole.addToPolicy(
         new iam.PolicyStatement({

package/infra/site-config.js

@@ -17,7 +17,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN", "PAPYRUS_PROSPECTUS_SITE_PRODUCT"];
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
     "GET/v1/identities/me",

package/infra/site-config.ts

@@ -97,7 +97,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN", "PAPYRUS_PROSPECTUS_SITE_PRODUCT"];
 
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [

package/lib/category-repository.ts

@@ -494,6 +494,7 @@ export type AssignmentRecord = {
   createdAt: string;
   updatedAt: string;
   newsroomFeedKey?: string | null;
+  itemLineageId?: string | null;
   metadata?: unknown;
 };
 

package/lib/content-item-lifecycle.ts

@@ -0,0 +1,55 @@
+/**
+ * One content item, one lifecycle: the stages an Item lineage moves through.
+ * Mirrors CONTENT_ITEM_STAGES in src/papyrus_content/content_item_lifecycle.py.
+ * See docs/content-item-lifecycle.md.
+ */
+export const CONTENT_ITEM_STAGES = [
+  "idea",
+  "assignment",
+  "research",
+  "report",
+  "editor_select",
+  "copywriting",
+  "published",
+] as const;
+
+export type ContentItemStage = (typeof CONTENT_ITEM_STAGES)[number];
+
+const CONTENT_ITEM_STAGE_LABELS: Record<ContentItemStage, string> = {
+  idea: "Idea",
+  assignment: "Assignment",
+  research: "Research",
+  report: "Report",
+  editor_select: "Editor select",
+  copywriting: "Copywriting",
+  published: "Published",
+};
+
+export function contentItemStageLabel(stage: string): string {
+  return (CONTENT_ITEM_STAGE_LABELS as Record<string, string>)[stage] ?? stage;
+}
+
+export type ContentItemVersionRecord = {
+  id: string;
+  lineageId: string;
+  versionNumber: number;
+  stage?: string | null;
+  type: string;
+  status: string;
+  title?: string | null;
+  headline?: string | null;
+  slug: string;
+  section?: string | null;
+  updatedAt?: string | null;
+};
+
+export function latestVersionPerContentItem(
+  versions: readonly ContentItemVersionRecord[],
+): ContentItemVersionRecord[] {
+  const latestByLineage = new Map<string, ContentItemVersionRecord>();
+  for (const version of versions) {
+    const current = latestByLineage.get(version.lineageId);
+    if (!current || version.versionNumber > current.versionNumber) latestByLineage.set(version.lineageId, version);
+  }
+  return [...latestByLineage.values()];
+}

package/lib/newsroom-board.ts

@@ -1,38 +1,67 @@
 import type { KanbanConfig, KanbanIssue } from "@kanbus/ui";
 import type { AssignmentRecord, ReferenceRecord } from "./category-repository";
-import type { NewsroomArticleRow } from "./newsroom-articles";
+import {
+  CONTENT_ITEM_STAGES,
+  contentItemStageLabel,
+  latestVersionPerContentItem,
+  type ContentItemVersionRecord,
+} from "./content-item-lifecycle";
+import { getContentItemName } from "./site-brand";
 
-export type NativeBoardKind = "article" | "reference" | "assignment";
+export type NativeBoardKind = "contentItem" | "reference" | "assignment";
 export interface NativeBoardIssue extends KanbanIssue {
-  type: NativeBoardKind;
+  kind: NativeBoardKind;
   nativeId: string;
   nativeStatus: string;
   href: string;
 }
 
-/** Native records keep their own identity, status and mutation authority. No Story linkage is inferred. */
+export function contentItemBoardType(): string {
+  return getContentItemName().singular.toLowerCase();
+}
+
+function boardTypeForKind(kind: NativeBoardKind): string {
+  return kind === "contentItem" ? contentItemBoardType() : kind;
+}
+
+/**
+ * One card per content item, in the column for its lifecycle stage. Assignments that are work on a content item
+ * are counted on that item's card rather than shown as separate cards. References and other work keep their own
+ * identity and native status.
+ */
 export function projectNewsroomBoard(records: {
-  articles?: readonly NewsroomArticleRow[];
+  contentItemVersions?: readonly ContentItemVersionRecord[];
   references?: readonly ReferenceRecord[];
   assignments?: readonly AssignmentRecord[];
 }): NativeBoardIssue[] {
+  const assignmentCountByContentItem = new Map<string, number>();
+  for (const assignment of records.assignments ?? []) {
+    if (assignment.itemLineageId) {
+      assignmentCountByContentItem.set(assignment.itemLineageId, (assignmentCountByContentItem.get(assignment.itemLineageId) ?? 0) + 1);
+    }
+  }
+  const contentItemType = contentItemBoardType();
   return [
-    ...(records.articles ?? []).map(row => ({
-      id: `article:${row.id}`, nativeId: row.id, type: "article" as const,
-      title: row.title, nativeStatus: row.status, status: `article/${row.status}`,
-      priority: 2, description: row.pending ? "Published copy has pending draft changes." : undefined,
-      updated_at: row.updatedAt, href: `/newsroom/articles/${encodeURIComponent(row.id)}`,
-    })),
+    ...latestVersionPerContentItem(records.contentItemVersions ?? []).map(version => {
+      const stage = version.stage ?? "idea";
+      const workCount = assignmentCountByContentItem.get(version.lineageId) ?? 0;
+      return {
+        id: `contentItem:${version.lineageId}`, nativeId: version.lineageId, kind: "contentItem" as const, type: contentItemType,
+        title: version.headline || version.title || version.slug, nativeStatus: stage, status: `${contentItemType}/${stage}`,
+        priority: 2, description: workCount ? `${workCount} assignment${workCount === 1 ? "" : "s"} on this ${contentItemType}.` : undefined,
+        updated_at: version.updatedAt ?? undefined, href: `/newsroom/articles/${encodeURIComponent(version.id)}`,
+      };
+    }),
     ...(records.references ?? []).filter(row => !row.versionState || row.versionState === "current").map(row => ({
-      id: `reference:${row.id}`, nativeId: row.id, type: "reference" as const,
+      id: `reference:${row.id}`, nativeId: row.id, kind: "reference" as const, type: "reference",
       title: row.title || row.externalItemId || row.id,
       nativeStatus: row.curationStatus || "pending", status: `reference/${row.curationStatus || "pending"}`,
       priority: 2, description: row.curationStatusReason || undefined,
       updated_at: row.updatedAt || row.importedAt || undefined,
       href: `/newsroom/references/${encodeURIComponent(row.lineageId || row.id)}`,
     })),
-    ...(records.assignments ?? []).map(row => ({
-      id: `assignment:${row.id}`, nativeId: row.id, type: "assignment" as const,
+    ...(records.assignments ?? []).filter(row => !row.itemLineageId).map(row => ({
+      id: `assignment:${row.id}`, nativeId: row.id, kind: "assignment" as const, type: "assignment",
       title: row.title, nativeStatus: row.status, status: `assignment/${row.status}`,
       priority: row.priority ?? 2, assignee: row.assigneeId || undefined,
       description: row.summary || row.brief || undefined,
@@ -42,16 +71,26 @@ export function projectNewsroomBoard(records: {
   ];
 }
 
-/** Unknown native statuses remain visible instead of being translated into invented stages. */
+/** Content items always show every lifecycle stage in order; unknown native statuses of other records stay visible. */
 export function newsroomBoardConfig(issues: readonly NativeBoardIssue[]): KanbanConfig {
-  const keys = [...new Set(issues.map(issue => issue.status))];
+  const contentItemType = contentItemBoardType();
+  const kinds: NativeBoardKind[] = ["contentItem", "reference", "assignment"];
+  const contentItemStatuses = [
+    ...CONTENT_ITEM_STAGES,
+    ...new Set(issues.filter(issue => issue.kind === "contentItem").map(issue => issue.nativeStatus)),
+  ].filter((stage, index, stages) => stages.indexOf(stage) === index)
+    .map(stage => ({ key: `${contentItemType}/${stage}`, name: contentItemStageLabel(stage), category: "native" }));
+  const otherStatuses = [...new Set(issues.filter(issue => issue.kind !== "contentItem").map(issue => issue.status))]
+    .map(key => ({ key, name: key.replace("/", " · "), category: "native" }));
+  const statuses = [...contentItemStatuses, ...otherStatuses];
   return {
-    hierarchy: [], types: ["article", "reference", "assignment"],
-    statuses: keys.map(key => ({ key, name: key.replace("/", " · "), category: "native" })),
+    hierarchy: [], types: kinds.map(boardTypeForKind),
+    statuses,
     categories: [{ name: "native" }], priorities: {}, type_colors: {},
-    workflows: Object.fromEntries(["article", "reference", "assignment"].map(kind => [kind,
-      Object.fromEntries(keys.filter(key => key.startsWith(`${kind}/`)).map(key => [key, []])),
-    ])),
+    workflows: Object.fromEntries(kinds.map(kind => {
+      const type = boardTypeForKind(kind);
+      return [type, Object.fromEntries(statuses.filter(status => status.key.startsWith(`${type}/`)).map(status => [status.key, []]))];
+    })),
   };
 }
 

package/lib/newsroom-nav.ts

@@ -1,4 +1,5 @@
 import { newsroomHref, toPublicNewsroomPath } from "./newsroom-base-path";
+import { getContentItemName } from "./site-brand";
 
 export type NewsroomNavTabId =
   | "overview"
@@ -23,7 +24,7 @@ export type NewsroomNavItem = {
 
 export const NEWSROOM_OPS_NAV: NewsroomNavItem[] = [
   { id: "overview", label: "Overview", detail: "Desk home", href: newsroomHref(), mobilePrimary: true },
-  { id: "articles", label: "Articles", detail: "Drafts & published", href: newsroomHref("articles"), mobilePrimary: true },
+  { id: "articles", label: getContentItemName().plural, detail: "Drafts & published", href: newsroomHref("articles"), mobilePrimary: true },
   { id: "assignments", label: "Assignments", detail: "Work queue", href: newsroomHref("assignments"), mobilePrimary: true },
   { id: "references", label: "References", detail: "Knowledge base", href: newsroomHref("references"), mobilePrimary: true },
   { id: "messages", label: "Messages", detail: "Forum", href: newsroomHref("messages") },

package/lib/newsroom-organizer-nav.ts

@@ -1,3 +1,6 @@
+import { getContentItemName } from "./site-brand";
+
+const contentItemPluralLowercase = getContentItemName().plural.toLowerCase();
 export type OrganizerDestination = {
   key: string; label: string; description: string; path: string;
   access?: "admin"; primary?: boolean; unavailable?: string;
@@ -5,8 +8,8 @@ export type OrganizerDestination = {
 export const ORGANIZER_NAV_GROUPS: readonly { title: string; items: readonly OrganizerDestination[] }[] = [
   { title: "Editorial work", items: [
     { key: "overview", label: "Overview", description: "See the desk and choose where to begin.", path: "/newsroom", primary: true },
-    { key: "board", label: "Board", description: "Follow articles, sources and assignments across their stages.", path: "/newsroom/work", primary: true },
-    { key: "articles", label: "Articles", description: "Write, revise and prepare copy for publication.", path: "/newsroom/articles" },
+    { key: "board", label: "Board", description: `Follow ${contentItemPluralLowercase}, sources and assignments across their stages.`, path: "/newsroom/work", primary: true },
+    { key: "articles", label: getContentItemName().plural, description: "Write, revise and prepare copy for publication.", path: "/newsroom/articles" },
     { key: "assignments", label: "Assignments", description: "Claim work and follow research and reporting progress.", path: "/newsroom/assignments" },
     { key: "messages", label: "Messages", description: "Read and reply to newsroom conversations.", path: "/newsroom/messages", primary: true },
     { key: "insights", label: "Insights", description: "Discuss findings and research threads.", path: "/newsroom/insights" },

package/lib/priming-proof-report.ts

@@ -41,6 +41,7 @@ export const primingProofReportSchema = z.object({
     acceptedExamples: z.number().int().min(0),
     excludedBecauseInHeldOut: z.number().int().min(0),
     fingerprint: z.string().nullable(),
+    source: z.string().min(1),
     order: z.string().min(1),
   }),
   conditions: z.object({

package/lib/prospectus-publication-access.ts

@@ -0,0 +1,53 @@
+import type { ProspectusDirectoryAccount, ProspectusRole } from "./prospectus-site-identity";
+
+/**
+ * What a person may do on this site's publications, decided by Papyrus from the
+ * role Prospectus gives them on an account, never more than that role allows.
+ * An account publishes on this site when its `papyrus-<siteId>` product is
+ * active. For now every member gets their role's capabilities on all of the
+ * account's publications (Ryan, 2026-10-17: role now, per-person grants later);
+ * src/papyrus_content/prospectus_publication_access.py applies the same table
+ * where the curation tools run.
+ */
+export type PublicationCapability = "read" | "review" | "decide" | "steer";
+
+export const PROSPECTUS_ROLE_PUBLICATION_CAPABILITIES: Record<ProspectusRole, readonly PublicationCapability[]> = {
+  viewer: ["read"],
+  member: ["read", "review", "decide"],
+  admin: ["read", "review", "decide", "steer"],
+  owner: ["read", "review", "decide", "steer"],
+};
+
+export const PROSPECTUS_SITE_PRODUCT_ENV = "PAPYRUS_PROSPECTUS_SITE_PRODUCT";
+
+export interface PublishingAccountAccess {
+  accountId: string;
+  accountName: string;
+  role: ProspectusRole;
+  publicationCapabilities: PublicationCapability[];
+}
+
+export function publicationCapabilitiesForProspectusRole(role: string): PublicationCapability[] {
+  return [...(PROSPECTUS_ROLE_PUBLICATION_CAPABILITIES[role as ProspectusRole] ?? [])];
+}
+
+export function prospectusSiteProduct(environment: Record<string, string | undefined> = process.env): string | null {
+  const siteProduct = environment[PROSPECTUS_SITE_PRODUCT_ENV]?.trim();
+  return siteProduct && siteProduct.startsWith("papyrus-") ? siteProduct : null;
+}
+
+export function publishingAccountsForSite(
+  accounts: readonly ProspectusDirectoryAccount[],
+  siteProduct: string | null,
+): PublishingAccountAccess[] {
+  if (!siteProduct) return [];
+  return accounts
+    .filter((account) => account.products.some((product) => product.product === siteProduct && product.status === "active"))
+    .map((account) => ({
+      accountId: account.id,
+      accountName: account.name,
+      role: account.role,
+      publicationCapabilities: publicationCapabilitiesForProspectusRole(account.role),
+    }))
+    .filter((access) => access.publicationCapabilities.length > 0);
+}

package/lib/prospectus-session.ts

@@ -0,0 +1,196 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
+import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+import {
+  ProspectusSiteAccounts,
+  signedProspectusTransport,
+  type GoogleOnlyCognitoClient,
+  type PendingProspectusSignIn,
+  type ProspectusTransport,
+} from "./prospectus-site-identity";
+
+/**
+ * Browser state for signing in through Prospectus, kept in two sealed cookies so
+ * the site holds no session table. The pending cookie carries one sign-in
+ * attempt (challenge, state, PKCE verifier) from the redirect to the callback;
+ * the session cookie carries the signed-in person and their Cognito access token
+ * until that token expires. Both are AES-256-GCM sealed with a per-cookie key
+ * derived from the site's generated sealing secret, and bound to the cookie name
+ * so one cannot be replayed as the other.
+ */
+export const PROSPECTUS_PENDING_SIGN_IN_COOKIE = "__Host-papyrus-prospectus-pending";
+export const PROSPECTUS_SESSION_COOKIE = "__Host-papyrus-prospectus-session";
+export const PROSPECTUS_ACCOUNTS_ENDPOINT_ENV = "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT";
+export const PROSPECTUS_SESSION_SECRET_ARN_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN";
+export const PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
+
+const SEALED_COOKIE_FORMAT_VERSION = "v1";
+const SEALED_COOKIE_KEY_DERIVATION_SALT = "papyrus-prospectus-cookie";
+const GCM_INITIALIZATION_VECTOR_BYTES = 12;
+const GCM_AUTHENTICATION_TAG_BYTES = 16;
+const MINIMUM_SEALING_SECRET_LENGTH = 32;
+
+export interface PendingProspectusSignInCookie extends PendingProspectusSignIn {
+  returnPath: string;
+}
+
+export interface ProspectusSignedInSession {
+  personId: string;
+  accessToken: string;
+  accessTokenExpiresAt: number;
+  selectedAccountId?: string;
+}
+
+function sealingKeyForCookie(sealingSecret: string, cookieName: string): Buffer {
+  if (sealingSecret.length < MINIMUM_SEALING_SECRET_LENGTH) throw new Error("The Prospectus session sealing secret is too short.");
+  return Buffer.from(hkdfSync("sha256", sealingSecret, SEALED_COOKIE_KEY_DERIVATION_SALT, cookieName, 32));
+}
+
+export function sealProspectusCookie(sealingSecret: string, cookieName: string, payload: object, expiresAtSeconds: number): string {
+  const initializationVector = randomBytes(GCM_INITIALIZATION_VECTOR_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", sealingKeyForCookie(sealingSecret, cookieName), initializationVector);
+  cipher.setAAD(Buffer.from(cookieName));
+  const ciphertext = Buffer.concat([cipher.update(JSON.stringify({ payload, expiresAtSeconds })), cipher.final()]);
+  return `${SEALED_COOKIE_FORMAT_VERSION}.${Buffer.concat([initializationVector, ciphertext, cipher.getAuthTag()]).toString("base64url")}`;
+}
+
+export function openProspectusCookie<Payload>(
+  sealingSecret: string,
+  cookieName: string,
+  sealedValue: string | undefined,
+  nowInSeconds: number = Math.floor(Date.now() / 1000),
+): Payload | null {
+  if (!sealedValue?.startsWith(`${SEALED_COOKIE_FORMAT_VERSION}.`)) return null;
+  const sealedBytes = Buffer.from(sealedValue.slice(SEALED_COOKIE_FORMAT_VERSION.length + 1), "base64url");
+  if (sealedBytes.length <= GCM_INITIALIZATION_VECTOR_BYTES + GCM_AUTHENTICATION_TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv(
+      "aes-256-gcm",
+      sealingKeyForCookie(sealingSecret, cookieName),
+      sealedBytes.subarray(0, GCM_INITIALIZATION_VECTOR_BYTES),
+    );
+    decipher.setAAD(Buffer.from(cookieName));
+    decipher.setAuthTag(sealedBytes.subarray(sealedBytes.length - GCM_AUTHENTICATION_TAG_BYTES));
+    const plaintext = Buffer.concat([
+      decipher.update(sealedBytes.subarray(GCM_INITIALIZATION_VECTOR_BYTES, sealedBytes.length - GCM_AUTHENTICATION_TAG_BYTES)),
+      decipher.final(),
+    ]).toString("utf8");
+    const { payload, expiresAtSeconds } = JSON.parse(plaintext) as { payload: Payload; expiresAtSeconds: number };
+    if (typeof expiresAtSeconds !== "number" || nowInSeconds >= expiresAtSeconds) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export function sealedCookieAttributes(expiresAtSeconds: number, nowInSeconds: number = Math.floor(Date.now() / 1000)) {
+  return {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax" as const,
+    path: "/",
+    maxAge: Math.max(0, expiresAtSeconds - nowInSeconds),
+  };
+}
+
+export function sameSiteReturnPath(requestedReturnPath: string | null | undefined): string {
+  if (!requestedReturnPath || !requestedReturnPath.startsWith("/") || requestedReturnPath.startsWith("//")) return "/";
+  if (/[\\\u0000-\u001f]/.test(requestedReturnPath)) return "/";
+  const parsed = new URL(requestedReturnPath, "https://papyrus.invalid");
+  if (parsed.origin !== "https://papyrus.invalid") return "/";
+  return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+}
+
+export type ProspectusSessionSecretReader = (secretArn: string) => Promise<string | null>;
+
+type CachedSealingSecret = { secretArn: string; value: string; expiresAt: number };
+
+let cachedSealingSecret: CachedSealingSecret | null = null;
+let defaultSecretsManagerClient: SecretsManagerClient | null = null;
+
+export function resetProspectusSessionSecretCache(): void {
+  cachedSealingSecret = null;
+}
+
+async function readSealingSecretFromSecretsManager(secretArn: string): Promise<string | null> {
+  defaultSecretsManagerClient ??= new SecretsManagerClient({});
+  const response = await defaultSecretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
+  return response.SecretString?.trim() || null;
+}
+
+export async function loadProspectusSessionSealingSecret(
+  options: { environment?: Record<string, string | undefined>; readSecret?: ProspectusSessionSecretReader; now?: number } = {},
+): Promise<string | null> {
+  const environment = options.environment ?? process.env;
+  const secretArn = environment[PROSPECTUS_SESSION_SECRET_ARN_ENV]?.trim();
+  if (!secretArn) return null;
+  const now = options.now ?? Date.now();
+  if (cachedSealingSecret && cachedSealingSecret.secretArn === secretArn && cachedSealingSecret.expiresAt > now) {
+    return cachedSealingSecret.value;
+  }
+  try {
+    const value = (await (options.readSecret ?? readSealingSecretFromSecretsManager)(secretArn))?.trim();
+    if (!value || value.length < MINIMUM_SEALING_SECRET_LENGTH) return null;
+    cachedSealingSecret = { secretArn, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
+    return value;
+  } catch (error) {
+    console.error(`Prospectus session sealing secret could not be read (${error instanceof Error ? error.name : "error"}).`);
+    return null;
+  }
+}
+
+export interface ProspectusSignInRuntime {
+  accounts: ProspectusSiteAccounts;
+  cognitoClient: GoogleOnlyCognitoClient;
+  sealingSecret: string;
+}
+
+interface AmplifyOutputsForProspectusSignIn {
+  auth?: { user_pool_id?: string; oauth?: { domain?: string } };
+  custom?: { prospectusSignIn?: { clientId?: string; callbackPath?: string } | null };
+}
+
+export function regionOfProspectusAccountsEndpoint(endpoint: string): string {
+  const match = /^[a-z0-9]+\.execute-api\.([a-z0-9-]+)\.amazonaws\.com$/.exec(new URL(endpoint).hostname);
+  if (!match) throw new Error("The Prospectus accounts endpoint is not an API Gateway execute-api host.");
+  return match[1];
+}
+
+export function googleOnlyCognitoClientFromOutputs(
+  amplifyOutputs: AmplifyOutputsForProspectusSignIn | null,
+  siteOrigin: string,
+): GoogleOnlyCognitoClient | null {
+  const userPoolId = amplifyOutputs?.auth?.user_pool_id;
+  const hostedUiDomain = amplifyOutputs?.auth?.oauth?.domain;
+  const prospectusSignIn = amplifyOutputs?.custom?.prospectusSignIn;
+  if (!userPoolId || !hostedUiDomain || !prospectusSignIn?.clientId || !prospectusSignIn.callbackPath) return null;
+  return {
+    hostedUiOrigin: `https://${hostedUiDomain}`,
+    userPoolId,
+    clientId: prospectusSignIn.clientId,
+    redirectUri: new URL(prospectusSignIn.callbackPath, siteOrigin).toString(),
+  };
+}
+
+export async function resolveProspectusSignInRuntime(
+  siteOrigin: string,
+  options: {
+    environment?: Record<string, string | undefined>;
+    amplifyOutputs?: AmplifyOutputsForProspectusSignIn | null;
+    readSecret?: ProspectusSessionSecretReader;
+    transport?: ProspectusTransport;
+  } = {},
+): Promise<ProspectusSignInRuntime | null> {
+  const environment = options.environment ?? process.env;
+  const endpoint = environment[PROSPECTUS_ACCOUNTS_ENDPOINT_ENV]?.trim();
+  if (!endpoint) return null;
+  const amplifyOutputs = options.amplifyOutputs !== undefined
+    ? options.amplifyOutputs
+    : (readAmplifyOutputsFile() as AmplifyOutputsForProspectusSignIn | null);
+  const cognitoClient = googleOnlyCognitoClientFromOutputs(amplifyOutputs, siteOrigin);
+  if (!cognitoClient) return null;
+  const sealingSecret = await loadProspectusSessionSealingSecret({ environment, readSecret: options.readSecret });
+  if (!sealingSecret) return null;
+  const transport = options.transport ?? signedProspectusTransport({ endpoint, region: regionOfProspectusAccountsEndpoint(endpoint) });
+  return { accounts: new ProspectusSiteAccounts(transport), cognitoClient, sealingSecret };
+}