@anthusai/papyrus 1.0.0-next.63 → 1.0.0-next.65

package/amplify/auth/prospectus-google-client.js

@@ -0,0 +1,66 @@
+import { CfnOutput } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+export function prospectusSignInCallbackUrls(redirectUrls) {
+    const origins = [];
+    for (const redirectUrl of redirectUrls) {
+        try {
+            const origin = new URL(redirectUrl).origin;
+            if (origin !== "null" && !origins.includes(origin))
+                origins.push(origin);
+        }
+        catch {
+            continue;
+        }
+    }
+    return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+export function prospectusSignInLogoutUrls(redirectUrls) {
+    return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+export function addProspectusGoogleOnlyClient(authStack, userPool, redirectUrls) {
+    const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+    if (callbackUrls.length === 0)
+        throw new Error("The Prospectus Google-only client needs at least one site origin.");
+    const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+        userPoolId: userPool.userPoolId,
+        clientName: "prospectus-google-only",
+        generateSecret: false,
+        supportedIdentityProviders: ["Google"],
+        allowedOAuthFlowsUserPoolClient: true,
+        allowedOAuthFlows: ["code"],
+        allowedOAuthScopes: ["openid", "email", "profile"],
+        callbackUrLs: callbackUrls,
+        logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+        explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+        enableTokenRevocation: true,
+        preventUserExistenceErrors: "ENABLED",
+        accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+    });
+    const googleIdentityProviders = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+    for (const googleIdentityProvider of googleIdentityProviders)
+        googleOnlyClient.addDependency(googleIdentityProvider);
+    new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+        value: googleOnlyClient.ref,
+        description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+        value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+        description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    return googleOnlyClient;
+}

package/amplify/auth/prospectus-google-client.ts

@@ -0,0 +1,71 @@
+import { CfnOutput, type Stack } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider, type IUserPool } from "aws-cdk-lib/aws-cognito";
+
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+
+export function prospectusSignInCallbackUrls(redirectUrls: readonly string[]): string[] {
+  const origins: string[] = [];
+  for (const redirectUrl of redirectUrls) {
+    try {
+      const origin = new URL(redirectUrl).origin;
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch {
+      continue;
+    }
+  }
+  return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+
+export function prospectusSignInLogoutUrls(redirectUrls: readonly string[]): string[] {
+  return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+
+export function addProspectusGoogleOnlyClient(
+  authStack: Stack,
+  userPool: IUserPool,
+  redirectUrls: readonly string[],
+): CfnUserPoolClient {
+  const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+  if (callbackUrls.length === 0) throw new Error("The Prospectus Google-only client needs at least one site origin.");
+  const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+    userPoolId: userPool.userPoolId,
+    clientName: "prospectus-google-only",
+    generateSecret: false,
+    supportedIdentityProviders: ["Google"],
+    allowedOAuthFlowsUserPoolClient: true,
+    allowedOAuthFlows: ["code"],
+    allowedOAuthScopes: ["openid", "email", "profile"],
+    callbackUrLs: callbackUrls,
+    logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+    explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+    enableTokenRevocation: true,
+    preventUserExistenceErrors: "ENABLED",
+    accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+  });
+  const googleIdentityProviders = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolIdentityProvider => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+  for (const googleIdentityProvider of googleIdentityProviders) googleOnlyClient.addDependency(googleIdentityProvider);
+
+  new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+    value: googleOnlyClient.ref,
+    description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+    value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+    description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  return googleOnlyClient;
+}

package/amplify/auth/resource.js

@@ -32,8 +32,11 @@ export function authConfigFromEnv() {
         applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
+export function siteAuthRedirectUrls(config) {
+    return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
 export function defineSiteAuth(config) {
-    const authRedirectUrls = expandNewsroomRedirectUrls(config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS, config.newsroomBasePath);
+    const authRedirectUrls = expandNewsroomRedirectUrls(siteAuthRedirectUrls(config), config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
     return defineAuth({
         loginWith: {

package/amplify/auth/resource.ts

@@ -37,9 +37,13 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   };
 }
 
+export function siteAuthRedirectUrls(config: PapyrusAuthConfig): string[] {
+  return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
+
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = expandNewsroomRedirectUrls(
-    config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS,
+    siteAuthRedirectUrls(config),
     config.newsroomBasePath,
   );
   const disableGoogleOAuth = config.disableGoogleOAuth === true;

package/amplify/data/schema.js

@@ -815,7 +815,6 @@ const baseDefinitions = {
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-        allow.authenticated("identityPool").to(authoringOperations),
     ]),
     AssignmentEvent: modelWithoutSubscriptions({
         id: a.id().required(),
@@ -1395,7 +1394,6 @@ const baseDefinitions = {
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read", "create", "update"]),
-        allow.authenticated("identityPool").to(authoringOperations),
     ]),
     ModelAttachment: modelWithoutSubscriptions({
         id: a.id().required(),

package/amplify/data/schema.ts

@@ -886,7 +886,6 @@ const baseDefinitions = {
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.authenticated("identityPool").to(authoringOperations),
     ]),
 
   AssignmentEvent: modelWithoutSubscriptions({
@@ -1486,7 +1485,6 @@ const baseDefinitions = {
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read", "create", "update"]),
-      allow.authenticated("identityPool").to(authoringOperations),
     ]),
 
   ModelAttachment: modelWithoutSubscriptions({

package/amplify/functions/email-submission-processor/handler.py

@@ -30,8 +30,10 @@ def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
         event.get("corpusKey")
         or event.get("corpus_key")
         or os.environ.get("PAPYRUS_INBOUND_EMAIL_CORPUS_KEY")
-        or "AI-ML-research"
+        or ""
     ).strip()
+    if not corpus_key:
+        raise ValueError("corpusKey or PAPYRUS_INBOUND_EMAIL_CORPUS_KEY is required.")
 
     from papyrus_content.graphql_authoring import PapyrusGraphQLAuthoringClient
     from papyrus_newsroom.email_submissions import process_email_submission_message

package/amplify/functions/ses-inbound-receive/handler.ts

@@ -2,6 +2,13 @@ import { InvokeCommand, LambdaClient } from "@aws-sdk/client-lambda";
 import { GetObjectCommand, ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
 import {
   buildEmailSubmissionMessageInput,
+  isInboundSenderAuthenticated,
+  readInboundSenderAuthenticationFromRawMime,
+  readInboundScanVerdictsFromSesReceipt,
+  REJECTION_KIND_UNAUTHENTICATED_SENDER,
+  UNAUTHENTICATED_SENDER_RESPONSE_ERROR,
+  UNVERIFIED_SENDER_AUTHENTICATION,
+  type InboundSenderAuthentication,
   classifyInboundEmailIntake,
   countInboundAttachments,
   extractDirectCitations,
@@ -49,6 +56,7 @@ type InboundPayload = {
   attachmentCount: number;
   userComposedText: string;
   parentSubmissionMessageId: string | null;
+  senderAuthentication: InboundSenderAuthentication;
 };
 
 type ExistingMessage = {
@@ -123,7 +131,8 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
   const resolvedMessageId = messageId ?? `message-email-submission-${crypto.randomUUID().replace(/-/g, "").slice(0, 20)}`;
   const dataClient = await getLambdaDataClient();
   const profileId = await lookupRegisteredUserProfileId(dataClient, inbound.senderEmail);
-  const authorized = Boolean(profileId);
+  const senderAuthenticated = isInboundSenderAuthenticated(inbound.senderAuthentication, inbound.senderEmail);
+  const authorized = Boolean(profileId) && senderAuthenticated;
   const citations = authorized
     ? (inbound.citations.length > 0
       ? inbound.citations
@@ -143,7 +152,9 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
 
   let status = authorized ? "received" : "rejected";
   let responseStatus = authorized ? "PENDING" : "REJECTED";
-  let responseError: string | null = authorized ? null : UNREGISTERED_SENDER_RESPONSE_ERROR;
+  let responseError: string | null = authorized
+    ? null
+    : (senderAuthenticated ? UNREGISTERED_SENDER_RESPONSE_ERROR : UNAUTHENTICATED_SENDER_RESPONSE_ERROR);
 
   if (authorized && looksLikeResearchAssignmentRequest(inbound.bodyText, citations.length)) {
     status = "rejected";
@@ -173,7 +184,8 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
     s3Bucket: inbound.s3Bucket,
     s3Key: inbound.s3Key,
     authorized,
-    authorUserProfileId: profileId,
+    rejectionKind: senderAuthenticated ? undefined : REJECTION_KIND_UNAUTHENTICATED_SENDER,
+    authorUserProfileId: authorized ? profileId : null,
     authorLabel: inbound.senderEmail || "unknown-sender",
     citations,
     status,
@@ -205,7 +217,7 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
 
   if (authorized && responseStatus === "PENDING" && PROCESSOR_FUNCTION_NAME) {
     await invokeEmailProcessor(resolvedMessageId);
-  } else if (responseStatus === "REJECTED" && PROCESSOR_FUNCTION_NAME) {
+  } else if (responseStatus === "REJECTED" && senderAuthenticated && PROCESSOR_FUNCTION_NAME) {
     await invokeEmailProcessor(resolvedMessageId, { sendFeedbackOnly: true });
   }
 
@@ -390,6 +402,7 @@ async function resolveFromSesMail(
       senderEmail: loaded.senderEmail || senderEmail,
       recipients: loaded.recipients.length > 0 ? loaded.recipients : recipients,
       subject: loaded.subject !== "(no subject)" ? loaded.subject : subject,
+      senderAuthentication: mergeScanVerdicts(loaded.senderAuthentication, readInboundScanVerdictsFromSesReceipt(receipt)),
     };
   }
 
@@ -407,6 +420,7 @@ async function resolveFromSesMail(
     attachmentCount: 0,
     userComposedText: "",
     parentSubmissionMessageId: null,
+    senderAuthentication: { ...UNVERIFIED_SENDER_AUTHENTICATION, ...readInboundScanVerdictsFromSesReceipt(receipt) },
   });
 }
 
@@ -433,6 +447,7 @@ async function loadInboundFromS3Object(
     attachmentCount: countInboundAttachments(rawBytes),
     userComposedText: extractUserComposedReplyText(intake.bodyText),
     parentSubmissionMessageId: null,
+    senderAuthentication: readInboundSenderAuthenticationFromRawMime(rawBytes),
   });
 }
 
@@ -446,6 +461,19 @@ function enrichInboundPayload(payload: InboundPayload): InboundPayload {
   };
 }
 
+function mergeScanVerdicts(
+  authentication: InboundSenderAuthentication,
+  receiptVerdicts: Pick<InboundSenderAuthentication, "spamVerdict" | "virusVerdict">,
+): InboundSenderAuthentication {
+  const worst = (fromMime: string, fromReceipt: string) =>
+    fromMime === "fail" || fromReceipt === "fail" ? "fail" : fromMime !== "unknown" ? fromMime : fromReceipt;
+  return {
+    ...authentication,
+    spamVerdict: worst(authentication.spamVerdict, receiptVerdicts.spamVerdict),
+    virusVerdict: worst(authentication.virusVerdict, receiptVerdicts.virusVerdict),
+  };
+}
+
 function sesMessageIdFromObjectKey(key: string): string | null {
   const basename = key.split("/").pop() ?? "";
   const match = basename.match(/^[A-Za-z0-9_-]+$/);

package/amplify/functions/shared/email-submission.ts

@@ -11,6 +11,113 @@ export const REJECTION_KIND_UNREGISTERED_SENDER = "unregistered_sender";
 export const UNREGISTERED_SENDER_RESPONSE_ERROR =
   "This submission was not accepted because only registered Papyrus users may send reference submissions by email.";
 
+export const UNAUTHENTICATED_SENDER_RESPONSE_ERROR =
+  "This submission was not accepted because the sender could not be authenticated (SPF or DKIM must pass).";
+export const REJECTION_KIND_UNAUTHENTICATED_SENDER = "unauthenticated_sender";
+
+export type InboundSenderAuthentication = {
+  spfPassDomains: string[];
+  dkimPassDomains: string[];
+  spamVerdict: string;
+  virusVerdict: string;
+};
+
+const TRUSTED_AUTHENTICATION_RESULTS_SERVER_ID = "amazonses.com";
+
+export const UNVERIFIED_SENDER_AUTHENTICATION: InboundSenderAuthentication = {
+  spfPassDomains: [],
+  dkimPassDomains: [],
+  spamVerdict: "unknown",
+  virusVerdict: "unknown",
+};
+
+function domainOfAddress(address: string): string {
+  return normalizeEmailAddress(address).split("@")[1] ?? "";
+}
+
+function domainsAreAligned(authenticatedDomain: string, fromDomain: string): boolean {
+  if (!authenticatedDomain || !fromDomain) return false;
+  return authenticatedDomain === fromDomain
+    || fromDomain.endsWith(`.${authenticatedDomain}`)
+    || authenticatedDomain.endsWith(`.${fromDomain}`);
+}
+
+export function isInboundSenderAuthenticated(
+  authentication: InboundSenderAuthentication,
+  fromAddress: string,
+): boolean {
+  if (authentication.spamVerdict === "fail" || authentication.virusVerdict === "fail") return false;
+  const fromDomain = domainOfAddress(fromAddress);
+  return [...authentication.spfPassDomains, ...authentication.dkimPassDomains]
+    .some((domain) => domainsAreAligned(domain, fromDomain));
+}
+
+export function readInboundScanVerdictsFromSesReceipt(
+  receipt: Record<string, unknown> | undefined,
+): Pick<InboundSenderAuthentication, "spamVerdict" | "virusVerdict"> {
+  const verdictStatus = (key: string): string => {
+    const verdict = receipt?.[key];
+    const status = verdict && typeof verdict === "object" ? (verdict as { status?: unknown }).status : null;
+    return typeof status === "string" ? status.trim().toLowerCase() : "unknown";
+  };
+  return { spamVerdict: verdictStatus("spamVerdict"), virusVerdict: verdictStatus("virusVerdict") };
+}
+
+function readHeaderBlock(rawBytes: Uint8Array): string[] {
+  const raw = Buffer.from(rawBytes).toString("utf8");
+  const headerBlockEnd = raw.search(/\r?\n\r?\n/);
+  const headerBlock = headerBlockEnd === -1 ? raw : raw.slice(0, headerBlockEnd);
+  return headerBlock.replace(/\r?\n[ \t]+/g, " ").split(/\r?\n/);
+}
+
+function firstHeaderValue(headerLines: string[], name: string): string | null {
+  const prefix = new RegExp(`^${name}:\\s*`, "i");
+  const line = headerLines.find((entry) => prefix.test(entry));
+  return line ? line.replace(prefix, "") : null;
+}
+
+export function readInboundSenderAuthenticationFromRawMime(rawBytes: Uint8Array): InboundSenderAuthentication {
+  const headerLines = readHeaderBlock(rawBytes);
+  const verdictHeader = (name: string): string =>
+    (firstHeaderValue(headerLines, name) ?? "unknown").trim().toLowerCase();
+  const scanVerdicts = {
+    spamVerdict: verdictHeader("X-SES-Spam-Verdict"),
+    virusVerdict: verdictHeader("X-SES-Virus-Verdict"),
+  };
+  const topmostResults = firstHeaderValue(headerLines, "Authentication-Results");
+  if (!topmostResults) return { ...UNVERIFIED_SENDER_AUTHENTICATION, ...scanVerdicts };
+  const [serverId, ...parts] = topmostResults.replace(/\([^)]*\)/g, "").split(";").map((part) => part.trim());
+  if (serverId.toLowerCase() !== TRUSTED_AUTHENTICATION_RESULTS_SERVER_ID) {
+    return { ...UNVERIFIED_SENDER_AUTHENTICATION, ...scanVerdicts };
+  }
+
+  const spfPassDomains: string[] = [];
+  const dkimPassDomains: string[] = [];
+  let spfPassed = false;
+  let envelopeFromDomain = "";
+  let heloDomain = "";
+  for (const part of parts) {
+    const result = /^(spf|dkim)\s*=\s*([a-z]+)/i.exec(part);
+    if (result) {
+      const passed = result[2].toLowerCase() === "pass";
+      if (result[1].toLowerCase() === "spf") spfPassed = spfPassed || passed;
+      else if (passed) {
+        const signingDomain = /header\.(?:i|d)\s*=\s*@?([^\s;]+)/i.exec(part)?.[1];
+        if (signingDomain) dkimPassDomains.push(signingDomain.toLowerCase().replace(/^.*@/, ""));
+      }
+    }
+    const envelopeFrom = /^(?:envelope-from|smtp\.mailfrom)\s*=\s*(\S+)/i.exec(part)?.[1];
+    if (envelopeFrom) envelopeFromDomain = domainOfAddress(envelopeFrom.replace(/^<|>$/g, ""));
+    const helo = /^(?:helo|smtp\.helo)\s*=\s*(\S+)/i.exec(part)?.[1];
+    if (helo) heloDomain = helo.toLowerCase();
+  }
+  if (spfPassed) {
+    const spfDomain = envelopeFromDomain || heloDomain;
+    if (spfDomain) spfPassDomains.push(spfDomain);
+  }
+  return { spfPassDomains, dkimPassDomains, ...scanVerdicts };
+}
+
 const URL_PATTERN = /https?:\/\/[^\s<>"')\]]+/gi;
 const DOI_PATTERN = /\b10\.\d{4,9}\/[-._;()/:A-Z0-9]+/gi;
 const RESEARCH_ASSIGNMENT_PHRASES = [
@@ -337,6 +444,7 @@ export function buildEmailSubmissionMessageInput(input: {
   s3Bucket: string | null;
   s3Key: string | null;
   authorized: boolean;
+  rejectionKind?: string;
   authorUserProfileId: string | null;
   authorLabel: string;
   citations: Array<Record<string, unknown>>;
@@ -378,7 +486,7 @@ export function buildEmailSubmissionMessageInput(input: {
       ...(input.authorized
         ? {}
         : {
-            rejectionKind: REJECTION_KIND_UNREGISTERED_SENDER,
+            rejectionKind: input.rejectionKind ?? REJECTION_KIND_UNREGISTERED_SENDER,
           }),
       directCitationCount: input.citations.length,
       directCitations: input.citations,

package/amplify/site-backend.js

@@ -17,7 +17,8 @@ import { assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
@@ -107,6 +108,9 @@ export function defineSiteBackend(papyrusSite) {
         && authConfig.disableGoogleOAuth !== true) {
         applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
     }
+    const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+        ? undefined
+        : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
@@ -546,6 +550,9 @@ export function defineSiteBackend(papyrusSite) {
     }));
     backend.addOutput({
         custom: {
+            prospectusSignIn: prospectusGoogleOnlyClient
+                ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+                : null,
             inboundEmail: enableInboundEmail
                 ? {
                     domain: inboundEmailDomain,

package/amplify/site-backend.ts

@@ -24,7 +24,8 @@ import {
   validateRevalidateDistributionIds,
 } from "./revalidate-invalidation-settings";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
@@ -137,6 +138,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
   }
 
+  const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+    ? undefined
+    : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
@@ -682,6 +687,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   backend.addOutput({
     custom: {
+      prospectusSignIn: prospectusGoogleOnlyClient
+        ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+        : null,
       inboundEmail: enableInboundEmail
         ? {
             domain: inboundEmailDomain,

package/app/api/auth/prospectus/callback/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignInCallback } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSignInCallback(request);
+}

package/app/api/auth/prospectus/selection/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusAccountSelection } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusAccountSelection(request);
+}

package/app/api/auth/prospectus/session/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSessionRead } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSessionRead(request);
+}

package/app/api/auth/prospectus/sign-in/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignInStart } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSignInStart(request);
+}

package/app/api/auth/prospectus/sign-out/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignOut } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusSignOut(request);
+}

package/app/tailwind.css

@@ -3,14 +3,8 @@
 @source "../components/**/*.{ts,tsx}";
 @source "../app/**/*.{ts,tsx}";
 @source "../lib/**/*.{ts,tsx}";
-@source "../../../streamdown/dist/*.js";
-@source "../../../@streamdown/code/dist/*.js";
-@source "../../../@streamdown/cjk/dist/*.js";
-@source "../../../@streamdown/math/dist/*.js";
-@source "../../../@streamdown/mermaid/dist/*.js";
 @import "tw-animate-css";
 @import "shadcn/tailwind.css";
-@import "streamdown/styles.css";
 
 @custom-variant dark (&:is(.dark *));
 

package/components/topic-steering-workspace.tsx

@@ -263,7 +263,6 @@ type TopicProposalEditState = {
 };
 type AnalysisCommandPlanEntry = {
   label: string;
-  cwd: string;
   executable: string;
   args: string[];
   metadata?: Record<string, unknown>;
@@ -13607,7 +13606,6 @@ function buildAnalysisDestructivePreview({
 function analysisCommand(label: string, args: string[], mode: AnalysisReindexMode): AnalysisCommandPlanEntry {
   return {
     label,
-    cwd: "/Users/ryan/Projects/Biblicus",
     executable: "uv",
     args: ["run", "--extra", "topic-modeling", "biblicus", ...args],
     metadata: { mode },

package/infra/amplify-app-shell.js

@@ -1,6 +1,7 @@
 import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
 import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
@@ -86,9 +87,26 @@ export class AmplifyAppShellStack extends Stack {
             }));
         }
         const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-        const prospectusEnvironment = prospectusAccountsApiStageArn
-            ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+        const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
+            ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+                description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
+                generateSecretString: { passwordLength: 64, excludePunctuation: true },
+            })
+            : undefined;
+        const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+            ? {
+                PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
+                PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+                PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
+            }
             : {};
+        if (prospectusSessionSealingSecret) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "ReadProspectusSessionSealingSecret",
+                actions: ["secretsmanager:GetSecretValue"],
+                resources: [prospectusSessionSealingSecret.secretArn],
+            }));
+        }
         if (prospectusAccountsApiStageArn) {
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "InvokeProspectusAccountsAsRegisteredSite",