@anthusai/papyrus 1.0.0-next.9 → 1.1.0

package/lib/plugin-settings.ts

@@ -0,0 +1,11 @@
+export type PluginOutputs = { custom?: { papyrusPlugins?: Record<string, Record<string, unknown>> } };
+
+/** The settings a deployed plugin published in `amplify_outputs.json`, or null when the site did not enable it. */
+export function pluginSettings(outputs: PluginOutputs | null | undefined, name: string): Record<string, unknown> | null {
+  return outputs?.custom?.papyrusPlugins?.[name] ?? null;
+}
+
+export function signupForms(outputs: PluginOutputs | null | undefined): string[] {
+  const forms = pluginSettings(outputs, "signup")?.forms;
+  return Array.isArray(forms) ? forms.filter((form): form is string => typeof form === "string") : [];
+}

package/lib/presentation-footer.ts

@@ -1,6 +1,7 @@
 import { getEditionSectionItems } from "./edition-sections";
 import type { EditionContent } from "./content-types";
 import type { PublicationItem } from "./publication-items";
+import { toPublicReaderPath } from "./reader-base-path";
 
 export type PresentationFooterEntry = {
   section: string;
@@ -43,9 +44,9 @@ export type PresentationFooterGeometry = {
 };
 
 export const PRESENTATION_FOOTER_UTILITIES: PresentationFooterUtilityEntry[] = [
-  { id: "archive", label: "Archive", href: "/archive", disabled: false },
+  { id: "archive", label: "Archive", href: toPublicReaderPath("/archive"), disabled: false },
   { id: "newsDesk", label: "Newsroom", href: "/newsroom", disabled: false },
-  { id: "settings", label: "Settings", href: "/settings", disabled: false },
+  { id: "settings", label: "Settings", href: toPublicReaderPath("/settings"), disabled: false },
   { id: "login", label: "LOGIN", disabled: true },
 ];
 

package/lib/pretext-layout.ts

@@ -1,4 +1,5 @@
 import {
+  clearCache,
   layoutNextLine,
   prepareWithSegments,
   type LayoutCursor,
@@ -78,14 +79,18 @@ export function layoutAllTextLines({
   linePaintHeight,
   fontSize,
   fontFamily,
-}: Omit<LayoutTextLinesOptions, "cursor" | "maxHeight" | "obstacles">): TextLine[] {
+  obstacles = [],
+}: Omit<LayoutTextLinesOptions, "cursor" | "maxHeight" | "obstacles"> & { obstacles?: TextObstacle[] }): TextLine[] {
   const lines: TextLine[] = [];
   let cursor: LayoutCursor = { segmentIndex: 0, graphemeIndex: 0 };
 
   for (let lineIndex = 0; lineIndex < 2000; lineIndex += 1) {
-    const line = layoutNextLine(prepared, cursor, maxWidth);
+    const y = lineIndex * lineHeight;
+    const slot = getAvailableSlot(maxWidth, y, linePaintHeight, obstacles);
+    if (!slot) continue;
+    const line = layoutNextLine(prepared, cursor, slot.width);
     if (!line) return lines;
-    lines.push(toTextLine(line, 0, lineIndex * lineHeight, fontSize, fontFamily, lineHeight, linePaintHeight));
+    lines.push(toTextLine(line, slot.x, y, fontSize, fontFamily, lineHeight, linePaintHeight));
     cursor = line.end;
   }
 
@@ -177,3 +182,7 @@ function toTextLine(line: LayoutLine, x: number, y: number, fontSize: number, fo
 function clamp(value: number, min: number, max: number): number {
   return Math.max(min, Math.min(max, value));
 }
+
+export function clearPretextMeasurementCache(): void {
+  clearCache();
+}

package/lib/priming-proof-report.ts

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { APPROVED_PRIMING_PROOF_REPORTS } from "./approved-priming-proof-reports";
+
+export const PRIMING_PROOF_REPORT_VERSION = "cyclotron-priming-proof/v1";
+
+const nullableRatio = z.number().min(0).max(1).nullable();
+
+const primingProofPointSchema = z.object({
+  labels: z.number().int().min(0),
+  labelsByClass: z.record(z.string(), z.number().int().min(0)),
+  decided: z.number().int().min(0),
+  agreement: nullableRatio,
+  precision: nullableRatio,
+  recall: nullableRatio,
+  confusion: z.object({
+    truePositives: z.number().int().min(0),
+    falsePositives: z.number().int().min(0),
+    trueNegatives: z.number().int().min(0),
+    falseNegatives: z.number().int().min(0),
+  }),
+});
+
+export const primingProofReportSchema = z.object({
+  version: z.literal(PRIMING_PROOF_REPORT_VERSION),
+  proofId: z.string().min(1),
+  publication: z.string().min(1),
+  cyclotronId: z.string().min(1),
+  question: z.string().min(1),
+  labels: z.array(z.string().min(1)).length(2),
+  positiveLabel: z.string().min(1),
+  decisionModel: z.string().nullable(),
+  ranAt: z.string().min(1),
+  heldOut: z.object({
+    size: z.number().int().min(1),
+    byLabel: z.record(z.string(), z.number().int().min(0)),
+    fingerprint: z.string().min(1),
+    frozenAt: z.string().min(1),
+    source: z.string().min(1),
+  }),
+  priming: z.object({
+    acceptedExamples: z.number().int().min(0),
+    excludedBecauseInHeldOut: z.number().int().min(0),
+    fingerprint: z.string().nullable(),
+    source: z.string().min(1),
+    order: z.string().min(1),
+  }),
+  conditions: z.object({
+    freshStorePerPoint: z.boolean(),
+    rubric: z.string().min(1),
+    optimizer: z.boolean(),
+    reviewProgram: z.boolean(),
+  }),
+  points: z.array(primingProofPointSchema).min(1),
+});
+
+export type PrimingProofReport = z.infer<typeof primingProofReportSchema>;
+export type PrimingProofPoint = z.infer<typeof primingProofPointSchema>;
+
+export type PrimingProofHeadline = {
+  baseline: PrimingProofPoint;
+  latest: PrimingProofPoint;
+  agreementChangeInPoints: number | null;
+};
+
+export function parsePrimingProofReport(value: unknown): PrimingProofReport {
+  const report = primingProofReportSchema.parse(value);
+  if (report.points[0].labels !== 0) {
+    throw new Error("A priming proof report must start with the zero-label baseline.");
+  }
+  return report;
+}
+
+export function approvedPrimingProofReport(brandId: string): PrimingProofReport | null {
+  const approvedReport = APPROVED_PRIMING_PROOF_REPORTS[brandId];
+  return approvedReport === undefined ? null : parsePrimingProofReport(approvedReport);
+}
+
+export function primingProofHeadline(report: PrimingProofReport): PrimingProofHeadline {
+  const baseline = report.points[0];
+  const latest = report.points[report.points.length - 1];
+  const agreementChangeInPoints =
+    baseline.agreement === null || latest.agreement === null
+      ? null
+      : Math.round((latest.agreement - baseline.agreement) * 1000) / 10;
+  return { baseline, latest, agreementChangeInPoints };
+}
+
+export function formatProofPercentage(ratio: number | null): string {
+  return ratio === null ? "n/a" : `${Math.round(ratio * 1000) / 10}%`;
+}

package/lib/prospectus-publication-access.ts

@@ -0,0 +1,53 @@
+import type { ProspectusDirectoryAccount, ProspectusRole } from "./prospectus-site-identity";
+
+/**
+ * What a person may do on this site's publications, decided by Papyrus from the
+ * role Prospectus gives them on an account, never more than that role allows.
+ * An account publishes on this site when its `papyrus-<siteId>` product is
+ * active. For now every member gets their role's capabilities on all of the
+ * account's publications (Ryan, 2026-10-17: role now, per-person grants later);
+ * src/papyrus_content/prospectus_publication_access.py applies the same table
+ * where the curation tools run.
+ */
+export type PublicationCapability = "read" | "review" | "decide" | "steer";
+
+export const PROSPECTUS_ROLE_PUBLICATION_CAPABILITIES: Record<ProspectusRole, readonly PublicationCapability[]> = {
+  viewer: ["read"],
+  member: ["read", "review", "decide"],
+  admin: ["read", "review", "decide", "steer"],
+  owner: ["read", "review", "decide", "steer"],
+};
+
+export const PROSPECTUS_SITE_PRODUCT_ENV = "PAPYRUS_PROSPECTUS_SITE_PRODUCT";
+
+export interface PublishingAccountAccess {
+  accountId: string;
+  accountName: string;
+  role: ProspectusRole;
+  publicationCapabilities: PublicationCapability[];
+}
+
+export function publicationCapabilitiesForProspectusRole(role: string): PublicationCapability[] {
+  return [...(PROSPECTUS_ROLE_PUBLICATION_CAPABILITIES[role as ProspectusRole] ?? [])];
+}
+
+export function prospectusSiteProduct(environment: Record<string, string | undefined> = process.env): string | null {
+  const siteProduct = environment[PROSPECTUS_SITE_PRODUCT_ENV]?.trim();
+  return siteProduct && siteProduct.startsWith("papyrus-") ? siteProduct : null;
+}
+
+export function publishingAccountsForSite(
+  accounts: readonly ProspectusDirectoryAccount[],
+  siteProduct: string | null,
+): PublishingAccountAccess[] {
+  if (!siteProduct) return [];
+  return accounts
+    .filter((account) => account.products.some((product) => product.product === siteProduct && product.status === "active"))
+    .map((account) => ({
+      accountId: account.id,
+      accountName: account.name,
+      role: account.role,
+      publicationCapabilities: publicationCapabilitiesForProspectusRole(account.role),
+    }))
+    .filter((access) => access.publicationCapabilities.length > 0);
+}

package/lib/prospectus-session.ts

@@ -0,0 +1,196 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
+import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+import {
+  ProspectusSiteAccounts,
+  signedProspectusTransport,
+  type GoogleOnlyCognitoClient,
+  type PendingProspectusSignIn,
+  type ProspectusTransport,
+} from "./prospectus-site-identity";
+
+/**
+ * Browser state for signing in through Prospectus, kept in two sealed cookies so
+ * the site holds no session table. The pending cookie carries one sign-in
+ * attempt (challenge, state, PKCE verifier) from the redirect to the callback;
+ * the session cookie carries the signed-in person and their Cognito access token
+ * until that token expires. Both are AES-256-GCM sealed with a per-cookie key
+ * derived from the site's generated sealing secret, and bound to the cookie name
+ * so one cannot be replayed as the other.
+ */
+export const PROSPECTUS_PENDING_SIGN_IN_COOKIE = "__Host-papyrus-prospectus-pending";
+export const PROSPECTUS_SESSION_COOKIE = "__Host-papyrus-prospectus-session";
+export const PROSPECTUS_ACCOUNTS_ENDPOINT_ENV = "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT";
+export const PROSPECTUS_SESSION_SECRET_ARN_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN";
+export const PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
+
+const SEALED_COOKIE_FORMAT_VERSION = "v1";
+const SEALED_COOKIE_KEY_DERIVATION_SALT = "papyrus-prospectus-cookie";
+const GCM_INITIALIZATION_VECTOR_BYTES = 12;
+const GCM_AUTHENTICATION_TAG_BYTES = 16;
+const MINIMUM_SEALING_SECRET_LENGTH = 32;
+
+export interface PendingProspectusSignInCookie extends PendingProspectusSignIn {
+  returnPath: string;
+}
+
+export interface ProspectusSignedInSession {
+  personId: string;
+  accessToken: string;
+  accessTokenExpiresAt: number;
+  selectedAccountId?: string;
+}
+
+function sealingKeyForCookie(sealingSecret: string, cookieName: string): Buffer {
+  if (sealingSecret.length < MINIMUM_SEALING_SECRET_LENGTH) throw new Error("The Prospectus session sealing secret is too short.");
+  return Buffer.from(hkdfSync("sha256", sealingSecret, SEALED_COOKIE_KEY_DERIVATION_SALT, cookieName, 32));
+}
+
+export function sealProspectusCookie(sealingSecret: string, cookieName: string, payload: object, expiresAtSeconds: number): string {
+  const initializationVector = randomBytes(GCM_INITIALIZATION_VECTOR_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", sealingKeyForCookie(sealingSecret, cookieName), initializationVector);
+  cipher.setAAD(Buffer.from(cookieName));
+  const ciphertext = Buffer.concat([cipher.update(JSON.stringify({ payload, expiresAtSeconds })), cipher.final()]);
+  return `${SEALED_COOKIE_FORMAT_VERSION}.${Buffer.concat([initializationVector, ciphertext, cipher.getAuthTag()]).toString("base64url")}`;
+}
+
+export function openProspectusCookie<Payload>(
+  sealingSecret: string,
+  cookieName: string,
+  sealedValue: string | undefined,
+  nowInSeconds: number = Math.floor(Date.now() / 1000),
+): Payload | null {
+  if (!sealedValue?.startsWith(`${SEALED_COOKIE_FORMAT_VERSION}.`)) return null;
+  const sealedBytes = Buffer.from(sealedValue.slice(SEALED_COOKIE_FORMAT_VERSION.length + 1), "base64url");
+  if (sealedBytes.length <= GCM_INITIALIZATION_VECTOR_BYTES + GCM_AUTHENTICATION_TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv(
+      "aes-256-gcm",
+      sealingKeyForCookie(sealingSecret, cookieName),
+      sealedBytes.subarray(0, GCM_INITIALIZATION_VECTOR_BYTES),
+    );
+    decipher.setAAD(Buffer.from(cookieName));
+    decipher.setAuthTag(sealedBytes.subarray(sealedBytes.length - GCM_AUTHENTICATION_TAG_BYTES));
+    const plaintext = Buffer.concat([
+      decipher.update(sealedBytes.subarray(GCM_INITIALIZATION_VECTOR_BYTES, sealedBytes.length - GCM_AUTHENTICATION_TAG_BYTES)),
+      decipher.final(),
+    ]).toString("utf8");
+    const { payload, expiresAtSeconds } = JSON.parse(plaintext) as { payload: Payload; expiresAtSeconds: number };
+    if (typeof expiresAtSeconds !== "number" || nowInSeconds >= expiresAtSeconds) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export function sealedCookieAttributes(expiresAtSeconds: number, nowInSeconds: number = Math.floor(Date.now() / 1000)) {
+  return {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax" as const,
+    path: "/",
+    maxAge: Math.max(0, expiresAtSeconds - nowInSeconds),
+  };
+}
+
+export function sameSiteReturnPath(requestedReturnPath: string | null | undefined): string {
+  if (!requestedReturnPath || !requestedReturnPath.startsWith("/") || requestedReturnPath.startsWith("//")) return "/";
+  if (/[\\\u0000-\u001f]/.test(requestedReturnPath)) return "/";
+  const parsed = new URL(requestedReturnPath, "https://papyrus.invalid");
+  if (parsed.origin !== "https://papyrus.invalid") return "/";
+  return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+}
+
+export type ProspectusSessionSecretReader = (secretArn: string) => Promise<string | null>;
+
+type CachedSealingSecret = { secretArn: string; value: string; expiresAt: number };
+
+let cachedSealingSecret: CachedSealingSecret | null = null;
+let defaultSecretsManagerClient: SecretsManagerClient | null = null;
+
+export function resetProspectusSessionSecretCache(): void {
+  cachedSealingSecret = null;
+}
+
+async function readSealingSecretFromSecretsManager(secretArn: string): Promise<string | null> {
+  defaultSecretsManagerClient ??= new SecretsManagerClient({});
+  const response = await defaultSecretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
+  return response.SecretString?.trim() || null;
+}
+
+export async function loadProspectusSessionSealingSecret(
+  options: { environment?: Record<string, string | undefined>; readSecret?: ProspectusSessionSecretReader; now?: number } = {},
+): Promise<string | null> {
+  const environment = options.environment ?? process.env;
+  const secretArn = environment[PROSPECTUS_SESSION_SECRET_ARN_ENV]?.trim();
+  if (!secretArn) return null;
+  const now = options.now ?? Date.now();
+  if (cachedSealingSecret && cachedSealingSecret.secretArn === secretArn && cachedSealingSecret.expiresAt > now) {
+    return cachedSealingSecret.value;
+  }
+  try {
+    const value = (await (options.readSecret ?? readSealingSecretFromSecretsManager)(secretArn))?.trim();
+    if (!value || value.length < MINIMUM_SEALING_SECRET_LENGTH) return null;
+    cachedSealingSecret = { secretArn, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
+    return value;
+  } catch (error) {
+    console.error(`Prospectus session sealing secret could not be read (${error instanceof Error ? error.name : "error"}).`);
+    return null;
+  }
+}
+
+export interface ProspectusSignInRuntime {
+  accounts: ProspectusSiteAccounts;
+  cognitoClient: GoogleOnlyCognitoClient;
+  sealingSecret: string;
+}
+
+interface AmplifyOutputsForProspectusSignIn {
+  auth?: { user_pool_id?: string; oauth?: { domain?: string } };
+  custom?: { prospectusSignIn?: { clientId?: string; callbackPath?: string } | null };
+}
+
+export function regionOfProspectusAccountsEndpoint(endpoint: string): string {
+  const match = /^[a-z0-9]+\.execute-api\.([a-z0-9-]+)\.amazonaws\.com$/.exec(new URL(endpoint).hostname);
+  if (!match) throw new Error("The Prospectus accounts endpoint is not an API Gateway execute-api host.");
+  return match[1];
+}
+
+export function googleOnlyCognitoClientFromOutputs(
+  amplifyOutputs: AmplifyOutputsForProspectusSignIn | null,
+  siteOrigin: string,
+): GoogleOnlyCognitoClient | null {
+  const userPoolId = amplifyOutputs?.auth?.user_pool_id;
+  const hostedUiDomain = amplifyOutputs?.auth?.oauth?.domain;
+  const prospectusSignIn = amplifyOutputs?.custom?.prospectusSignIn;
+  if (!userPoolId || !hostedUiDomain || !prospectusSignIn?.clientId || !prospectusSignIn.callbackPath) return null;
+  return {
+    hostedUiOrigin: `https://${hostedUiDomain}`,
+    userPoolId,
+    clientId: prospectusSignIn.clientId,
+    redirectUri: new URL(prospectusSignIn.callbackPath, siteOrigin).toString(),
+  };
+}
+
+export async function resolveProspectusSignInRuntime(
+  siteOrigin: string,
+  options: {
+    environment?: Record<string, string | undefined>;
+    amplifyOutputs?: AmplifyOutputsForProspectusSignIn | null;
+    readSecret?: ProspectusSessionSecretReader;
+    transport?: ProspectusTransport;
+  } = {},
+): Promise<ProspectusSignInRuntime | null> {
+  const environment = options.environment ?? process.env;
+  const endpoint = environment[PROSPECTUS_ACCOUNTS_ENDPOINT_ENV]?.trim();
+  if (!endpoint) return null;
+  const amplifyOutputs = options.amplifyOutputs !== undefined
+    ? options.amplifyOutputs
+    : (readAmplifyOutputsFile() as AmplifyOutputsForProspectusSignIn | null);
+  const cognitoClient = googleOnlyCognitoClientFromOutputs(amplifyOutputs, siteOrigin);
+  if (!cognitoClient) return null;
+  const sealingSecret = await loadProspectusSessionSealingSecret({ environment, readSecret: options.readSecret });
+  if (!sealingSecret) return null;
+  const transport = options.transport ?? signedProspectusTransport({ endpoint, region: regionOfProspectusAccountsEndpoint(endpoint) });
+  return { accounts: new ProspectusSiteAccounts(transport), cognitoClient, sealingSecret };
+}