@anthusai/papyrus 1.11.0 → 1.12.0

package/amplify/functions/category-action/handler.ts

@@ -4,10 +4,23 @@ import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
 import { putJsonModelPayload, putTextModelPayload, readJsonModelPayload } from "../shared/model-payloads";
-import { referenceCurationMetadata } from "../shared/reference-curation-metadata";
+import { curationActorKind, referenceCurationMetadata } from "../shared/reference-curation-metadata";
+import {
+  CURATION_DELEGATION_OWNER_TYPE,
+  CURATION_DELEGATION_PAYLOAD_KIND,
+  delegationExpiry,
+  delegationRefusalMessage,
+  delegationVerdict,
+  newDelegationToken,
+  type CurationDelegation,
+} from "../shared/curation-delegation";
 
 type ReviewHandler = Schema["reviewSteeringProposal"]["functionHandler"];
 type ReferenceCurationHandler = Schema["reviewReferenceCuration"]["functionHandler"];
+type CreateCurationDelegationHandler = Schema["createCurationDelegation"]["functionHandler"];
+type RevokeCurationDelegationHandler = Schema["revokeCurationDelegation"]["functionHandler"];
+type ListCurationDelegationsHandler = Schema["listCurationDelegations"]["functionHandler"];
+type RecordDelegatedCurationHandler = Schema["recordDelegatedCuration"]["functionHandler"];
 type ReferenceQualityHandler = Schema["setReferenceQualityRating"]["functionHandler"];
 type ReferenceNoteHandler = Schema["createReferenceNote"]["functionHandler"];
 type MoveReferenceCorpusHandler = Schema["moveReferenceCorpus"]["functionHandler"];
@@ -23,6 +36,10 @@ type ReviewReferenceTopicLabelHandler = Schema["reviewReferenceTopicLabel"]["fun
 type CategoryActionEvent =
   | Parameters<ReviewHandler>[0]
   | Parameters<ReferenceCurationHandler>[0]
+  | Parameters<CreateCurationDelegationHandler>[0]
+  | Parameters<RevokeCurationDelegationHandler>[0]
+  | Parameters<ListCurationDelegationsHandler>[0]
+  | Parameters<RecordDelegatedCurationHandler>[0]
   | Parameters<ReferenceQualityHandler>[0]
   | Parameters<ReferenceNoteHandler>[0]
   | Parameters<MoveReferenceCorpusHandler>[0]
@@ -88,6 +105,10 @@ export const handler = async (event: CategoryActionEvent) => {
   }
   if (fieldName === "reviewSteeringProposal") return reviewSteeringProposal(event as Parameters<ReviewHandler>[0]);
   if (fieldName === "reviewReferenceCuration") return reviewReferenceCuration(event as Parameters<ReferenceCurationHandler>[0]);
+  if (fieldName === "createCurationDelegation") return createCurationDelegation(event as Parameters<CreateCurationDelegationHandler>[0]);
+  if (fieldName === "revokeCurationDelegation") return revokeCurationDelegation(event as Parameters<RevokeCurationDelegationHandler>[0]);
+  if (fieldName === "listCurationDelegations") return listCurationDelegations(event as Parameters<ListCurationDelegationsHandler>[0]);
+  if (fieldName === "recordDelegatedCuration") return recordDelegatedCuration(event as Parameters<RecordDelegatedCurationHandler>[0]);
   if (fieldName === "setReferenceQualityRating") return setReferenceQualityRating(event as Parameters<ReferenceQualityHandler>[0]);
   if (fieldName === "createReferenceNote") return createReferenceNote(event as Parameters<ReferenceNoteHandler>[0]);
   if (fieldName === "moveReferenceCorpus") return moveReferenceCorpus(event as Parameters<MoveReferenceCorpusHandler>[0]);
@@ -162,7 +183,10 @@ async function reviewSteeringProposal(event: Parameters<ReviewHandler>[0]) {
   };
 }
 
-async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandler>[0]) {
+async function reviewReferenceCuration(
+  event: Parameters<ReferenceCurationHandler>[0],
+  delegation: { delegationId: string; relayedBy: string; instruction: string } | null = null,
+) {
   const client = await getDataClient();
   const referenceId = normalizeRequiredString(event.arguments.referenceId, "referenceId");
   const action = normalizeReferenceCurationAction(event.arguments.action);
@@ -234,6 +258,8 @@ async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandle
       referenceLineageId,
       decisionRelationId: normalizeOptionalString(event.arguments.decisionRelationId),
       shareable: event.arguments.shareable ?? null,
+      actorKind: delegation ? "human" : curationActorKind(event.identity),
+      delegation,
     }),
     { filename: "metadata.json", now },
   );
@@ -300,6 +326,150 @@ async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandle
   };
 }
 
+function requireSignedInPerson(event: { identity?: unknown }): { sub: string; label: string; isAdmin: boolean } {
+  if (curationActorKind(event.identity) !== "human") {
+    throw new Error("Only a person signed in to the Newsroom can manage curation delegations.");
+  }
+  const identity = event.identity as { sub?: unknown; claims?: Record<string, unknown> };
+  const claims = identity.claims ?? {};
+  const groups = Array.isArray(claims["cognito:groups"]) ? (claims["cognito:groups"] as unknown[]) : [];
+  return {
+    sub: normalizeRequiredString(claims.sub ?? identity.sub, "identity.sub"),
+    label: normalizeOptionalString(claims.email) ?? normalizeOptionalString(claims.name) ?? "Newsroom editor",
+    isAdmin: groups.includes("admin"),
+  };
+}
+
+async function readCurationDelegation(client: DataClient, delegationId: string): Promise<CurationDelegation | null> {
+  const stored = await readJsonModelPayload(client as any, "knowledgeRawPayload", delegationId, "raw_payload", CURATION_DELEGATION_PAYLOAD_KIND);
+  return stored ? (stored as unknown as CurationDelegation) : null;
+}
+
+async function writeCurationDelegation(client: DataClient, delegation: CurationDelegation, now: string, created: boolean) {
+  const input = {
+    id: delegation.delegationId,
+    ownerType: CURATION_DELEGATION_OWNER_TYPE,
+    ownerId: delegation.grantorSub,
+    payloadKind: CURATION_DELEGATION_PAYLOAD_KIND,
+    createdAt: delegation.createdAt,
+    updatedAt: now,
+  };
+  if (created) {
+    await requireDataResult(client.models.KnowledgeRawPayload.create(input), "create curation delegation");
+  } else {
+    await requireDataResult(client.models.KnowledgeRawPayload.update(input), "update curation delegation");
+  }
+  await putJsonModelPayload(
+    client as any,
+    { ownerKind: "knowledgeRawPayload", ownerId: delegation.delegationId },
+    "raw_payload",
+    CURATION_DELEGATION_PAYLOAD_KIND,
+    delegation as unknown as Record<string, unknown>,
+    { filename: "curation-delegation.json", now },
+  );
+}
+
+function delegationResult(delegation: CurationDelegation, token: string | null) {
+  return {
+    ok: true,
+    delegationId: delegation.delegationId,
+    token,
+    agentLabel: delegation.agentLabel,
+    grantorLabel: delegation.grantorLabel,
+    expiresAt: delegation.expiresAt,
+    revokedAt: delegation.revokedAt,
+  };
+}
+
+async function createCurationDelegation(event: Parameters<CreateCurationDelegationHandler>[0]) {
+  const person = requireSignedInPerson(event);
+  const client = await getDataClient();
+  const now = new Date().toISOString();
+  const delegationId = `curation-delegation-${randomUUID()}`;
+  const { token, tokenHash } = newDelegationToken(delegationId);
+  const delegation: CurationDelegation = {
+    delegationId,
+    tokenHash,
+    grantorSub: person.sub,
+    grantorLabel: person.label,
+    agentLabel: normalizeRequiredString(event.arguments.agentLabel, "agentLabel"),
+    createdAt: now,
+    expiresAt: delegationExpiry(now, event.arguments.hours),
+    revokedAt: null,
+  };
+  await writeCurationDelegation(client, delegation, now, true);
+  return delegationResult(delegation, token);
+}
+
+async function revokeCurationDelegation(event: Parameters<RevokeCurationDelegationHandler>[0]) {
+  const person = requireSignedInPerson(event);
+  const client = await getDataClient();
+  const delegation = await readCurationDelegation(client, normalizeRequiredString(event.arguments.delegationId, "delegationId"));
+  if (!delegation) throw new Error("That delegation was not found.");
+  if (delegation.grantorSub !== person.sub && !person.isAdmin) throw new Error("Only the person who granted a delegation can revoke it.");
+  const now = new Date().toISOString();
+  const revoked = { ...delegation, revokedAt: delegation.revokedAt ?? now };
+  await writeCurationDelegation(client, revoked, now, false);
+  return delegationResult(revoked, null);
+}
+
+async function listCurationDelegations(event: Parameters<ListCurationDelegationsHandler>[0]) {
+  const person = requireSignedInPerson(event);
+  const client = await getDataClient();
+  const delegations: CurationDelegation[] = [];
+  let nextToken: string | null | undefined;
+  do {
+    const page: any = await (client.models.KnowledgeRawPayload as any).listKnowledgeRawPayloadsByOwnerAndKind(
+      { ownerId: person.sub, payloadKind: { eq: CURATION_DELEGATION_PAYLOAD_KIND } },
+      { nextToken },
+    );
+    assertNoDataErrors(page.errors, "list curation delegations");
+    for (const payload of page.data ?? []) {
+      const delegation = await readCurationDelegation(client, payload.id);
+      if (delegation) delegations.push(delegation);
+    }
+    nextToken = page.nextToken;
+  } while (nextToken);
+  return delegations
+    .sort((first, second) => second.createdAt.localeCompare(first.createdAt))
+    .map((delegation) => delegationResult(delegation, null));
+}
+
+async function recordDelegatedCuration(event: Parameters<RecordDelegatedCurationHandler>[0]) {
+  const client = await getDataClient();
+  const now = new Date().toISOString();
+  const delegationId = normalizeRequiredString(event.arguments.delegationId, "delegationId");
+  const agentLabel = normalizeRequiredString(event.arguments.agentLabel, "agentLabel");
+  const delegation = await readCurationDelegation(client, delegationId);
+  const verdict = delegationVerdict(delegation, {
+    token: normalizeRequiredString(event.arguments.delegationToken, "delegationToken"),
+    agentLabel,
+    now,
+  });
+  if (!verdict.ok || !delegation) {
+    throw new Error(delegationRefusalMessage(verdict.ok ? "unknown-token" : verdict.reason));
+  }
+  const instruction = normalizeRequiredString(event.arguments.instruction, "instruction").slice(0, 2000);
+  const namedPerson = normalizeRequiredString(event.arguments.onBehalfOf, "onBehalfOf");
+  if (namedPerson.toLowerCase() !== delegation.grantorLabel.toLowerCase()) {
+    throw new Error(`That delegation was granted by ${delegation.grantorLabel}, not ${namedPerson}.`);
+  }
+  const onBehalfOfPerson = {
+    ...event,
+    arguments: {
+      referenceId: event.arguments.referenceId,
+      action: event.arguments.action,
+      note: event.arguments.note,
+      reasonCode: event.arguments.reasonCode,
+      decisionRelationId: event.arguments.decisionRelationId,
+      shareable: event.arguments.shareable,
+      actorSub: delegation.grantorSub,
+      actorLabel: delegation.grantorLabel,
+    },
+  } as unknown as Parameters<ReferenceCurationHandler>[0];
+  return reviewReferenceCuration(onBehalfOfPerson, { delegationId, relayedBy: agentLabel, instruction });
+}
+
 async function setReferenceQualityRating(event: Parameters<ReferenceQualityHandler>[0]) {
   const client = await getDataClient();
   const referenceId = normalizeRequiredString(event.arguments.referenceId, "referenceId");

package/amplify/functions/content-actions/requirements.txt

@@ -1,5 +1,5 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
-anthus-markus==0.6.0
+anthus-markus==0.7.0
 Pillow>=11.3,<12
 awscrt>=0.23,<1

package/amplify/functions/content-actions/resource.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.6.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/functions/content-actions/resource.ts

@@ -10,7 +10,7 @@ import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.6.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");

package/amplify/functions/renditions/requirements.txt

@@ -1,4 +1,4 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
-anthus-markus==0.6.0
+anthus-markus==0.7.0
 Pillow>=11.3,<12

package/amplify/functions/shared/curation-delegation.ts

@@ -0,0 +1,67 @@
+import { createHash, randomBytes } from "node:crypto"
+
+export const CURATION_DELEGATION_PAYLOAD_KIND = "curation-delegation"
+export const CURATION_DELEGATION_OWNER_TYPE = "curationDelegation"
+export const DEFAULT_DELEGATION_HOURS = 8
+export const MAXIMUM_DELEGATION_HOURS = 72
+
+export type CurationDelegation = {
+  delegationId: string
+  tokenHash: string
+  grantorSub: string
+  grantorLabel: string
+  agentLabel: string
+  createdAt: string
+  expiresAt: string
+  revokedAt: string | null
+}
+
+export type DelegationVerdict =
+  | { ok: true }
+  | { ok: false; reason: "unknown-token" | "wrong-agent" | "revoked" | "expired" }
+
+export function hashDelegationToken(token: string): string {
+  return createHash("sha256").update(token, "utf8").digest("hex")
+}
+
+export function newDelegationToken(delegationId: string): { token: string; tokenHash: string } {
+  const token = `${delegationId}~${randomBytes(24).toString("base64url")}`
+  return { token, tokenHash: hashDelegationToken(token) }
+}
+
+export function delegationIdFromToken(token: string): string | null {
+  const separator = token.indexOf("~")
+  return separator > 0 ? token.slice(0, separator) : null
+}
+
+export function delegationExpiry(now: string, hours: number | null | undefined): string {
+  const requested = hours ?? DEFAULT_DELEGATION_HOURS
+  if (!Number.isFinite(requested) || requested <= 0 || requested > MAXIMUM_DELEGATION_HOURS) {
+    throw new Error(`A delegation lasts between 1 and ${MAXIMUM_DELEGATION_HOURS} hours.`)
+  }
+  return new Date(Date.parse(now) + requested * 3_600_000).toISOString()
+}
+
+export function delegationVerdict(
+  delegation: CurationDelegation | null,
+  presented: { token: string; agentLabel: string; now: string },
+): DelegationVerdict {
+  if (!delegation || delegation.tokenHash !== hashDelegationToken(presented.token)) {
+    return { ok: false, reason: "unknown-token" }
+  }
+  if (delegation.agentLabel.trim().toLowerCase() !== presented.agentLabel.trim().toLowerCase()) {
+    return { ok: false, reason: "wrong-agent" }
+  }
+  if (delegation.revokedAt) return { ok: false, reason: "revoked" }
+  if (Date.parse(delegation.expiresAt) <= Date.parse(presented.now)) return { ok: false, reason: "expired" }
+  return { ok: true }
+}
+
+export function delegationRefusalMessage(reason: Exclude<DelegationVerdict, { ok: true }>["reason"]): string {
+  return {
+    "unknown-token": "That delegation token is not recognized.",
+    "wrong-agent": "That delegation was granted to a different agent.",
+    "revoked": "That delegation was revoked.",
+    "expired": "That delegation has expired. Ask the person for a new one.",
+  }[reason]
+}

package/amplify/functions/shared/reference-curation-metadata.ts

@@ -12,6 +12,21 @@ export type ReferenceCurationMetadataInput = {
   referenceLineageId: string
   decisionRelationId?: string | null
   shareable?: boolean | null
+  actorKind?: CurationActorKind | null
+  delegation?: { delegationId: string; relayedBy: string; instruction: string } | null
+}
+
+export type CurationActorKind = "human" | "service"
+
+/**
+ * A curation is human only when the caller signed in through the user pool, so
+ * AppSync supplied a verified subject claim. Request arguments never decide it;
+ * IAM-signed service callers and agents have no such claim.
+ */
+export function curationActorKind(identity: unknown): CurationActorKind {
+  const claims = (identity as {claims?: Record<string, unknown>} | null | undefined)?.claims
+  const subject = claims?.sub
+  return typeof subject === "string" && subject.trim() !== "" ? "human" : "service"
 }
 
 export function referenceCurationMetadata(input: ReferenceCurationMetadataInput): Record<string, unknown> {
@@ -23,6 +38,11 @@ export function referenceCurationMetadata(input: ReferenceCurationMetadataInput)
     curationReasonCode: input.reasonCode,
     referenceId: input.referenceId,
     referenceLineageId: input.referenceLineageId,
+    ...(input.actorKind ? {actorKind: input.actorKind} : {}),
+    ...(input.delegation
+      ? {attestation: "delegated", relayedBy: input.delegation.relayedBy, delegationId: input.delegation.delegationId,
+         instruction: input.delegation.instruction}
+      : {}),
     ...(decisionRelationId ? {decisionRelationId} : {}),
     ...(decisionRelationId ? {shareable: input.shareable === true} : {}),
   }

package/amplify/publication/renditions-function.js

@@ -11,7 +11,7 @@ import { pythonLambdaCode } from "../functions/shared/python-bundle.js";
 import { RENDITIONS_EPHEMERAL_STORAGE_MB, RENDITIONS_MEDIA_PREFIX, RENDITIONS_MEMORY_MB, RENDITIONS_TIMEOUT_SECONDS, renditionsEnvironment, renditionsEventPattern, } from "./renditions-settings.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../..");
-export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.6.0", "Pillow>=11.3,<12"];
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/publication/renditions-function.ts

@@ -22,7 +22,7 @@ import {
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../..");
 
-export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.6.0", "Pillow>=11.3,<12"];
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12"];
 
 export type RenditionsFunctionProps = {
   siteBucket: s3.IBucket;

package/components/administration-delegations-panel.tsx

@@ -0,0 +1,204 @@
+"use client";
+
+import { useEffect, useRef, useState } from "react";
+import { fetchAuthSession } from "aws-amplify/auth";
+import { isLocalPreviewEnabled } from "../lib/local-preview";
+import {
+  DEFAULT_DELEGATION_HOURS,
+  MAXIMUM_DELEGATION_HOURS,
+  MINIMUM_DELEGATION_HOURS,
+  buildDelegatedCommandLine,
+  delegationExpiryText,
+  describeDelegationError,
+  validateDelegationInput,
+  type CurationDelegationRecord,
+} from "../lib/curation-delegation-helpers";
+import { createCurationDelegation, listCurationDelegations, revokeCurationDelegation, type CreatedCurationDelegation } from "./curation-delegation-client";
+
+type IssuedToken = { agentLabel: string; token: string };
+
+async function readSignedInEmail(): Promise<string> {
+  if (isLocalPreviewEnabled()) return "ryan@example.com";
+  try {
+    const session = await fetchAuthSession();
+    const email = session.tokens?.idToken?.payload?.email;
+    return typeof email === "string" ? email : "";
+  } catch {
+    return "";
+  }
+}
+
+export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean }) {
+  const [agentLabelText, setAgentLabelText] = useState("");
+  const [hoursText, setHoursText] = useState(String(DEFAULT_DELEGATION_HOURS));
+  const [busy, setBusy] = useState(false);
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+  const [issued, setIssued] = useState<IssuedToken | null>(null);
+  const [copied, setCopied] = useState<"token" | "command" | null>(null);
+  const [email, setEmail] = useState("");
+  const [delegations, setDelegations] = useState<CurationDelegationRecord[]>([]);
+  const [confirmingRevokeId, setConfirmingRevokeId] = useState<string | null>(null);
+  const [nowMilliseconds, setNowMilliseconds] = useState(() => Date.now());
+  const mounted = useRef(true);
+
+  useEffect(() => {
+    mounted.current = true;
+    void readSignedInEmail().then((value) => {
+      if (mounted.current) setEmail(value);
+    });
+    void refreshDelegations();
+    const timer = window.setInterval(() => setNowMilliseconds(Date.now()), 30_000);
+    return () => {
+      mounted.current = false;
+      window.clearInterval(timer);
+      setIssued(null);
+    };
+  }, []);
+
+  async function refreshDelegations() {
+    try {
+      const listed = await listCurationDelegations();
+      if (mounted.current) setDelegations(listed);
+    } catch (error) {
+      if (mounted.current) setErrorMessage(describeDelegationError(error));
+    }
+  }
+
+  async function handleCreate() {
+    const validation = validateDelegationInput(agentLabelText, hoursText);
+    if (!validation.ok) {
+      setErrorMessage(validation.message);
+      return;
+    }
+    setBusy(true);
+    setErrorMessage(null);
+    try {
+      const created: CreatedCurationDelegation = await createCurationDelegation(validation.agentLabel, validation.hours);
+      setIssued({ agentLabel: created.agentLabel, token: created.token });
+      setCopied(null);
+      await refreshDelegations();
+      setAgentLabelText("");
+      setNowMilliseconds(Date.now());
+    } catch (error) {
+      setErrorMessage(describeDelegationError(error));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function handleRevoke(delegationId: string) {
+    setBusy(true);
+    setErrorMessage(null);
+    try {
+      await revokeCurationDelegation(delegationId);
+      await refreshDelegations();
+      setConfirmingRevokeId(null);
+    } catch (error) {
+      setErrorMessage(describeDelegationError(error));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function copyText(kind: "token" | "command", text: string) {
+    try {
+      await navigator.clipboard.writeText(text);
+      setCopied(kind);
+    } catch {
+      setErrorMessage("Copying was blocked by the browser. Select the text and copy it by hand.");
+    }
+  }
+
+  const commandLine = issued ? buildDelegatedCommandLine({ email, agentLabel: issued.agentLabel, token: issued.token }) : "";
+
+  return (
+    <div data-news-desk-admin-panel="delegations">
+      <article className="news-desk-doctrine-card">
+        <div className="news-desk-doctrine-card__header">
+          <div>
+            <h3>Agent delegations</h3>
+            <span>Let one agent approve or reject References for you, for a short time</span>
+          </div>
+        </div>
+        <p className="news-desk-delegation-note">
+          A delegation is a token you hand to one named agent. While it lasts, that agent&apos;s approvals and rejections are recorded under your name and marked as relayed. You can revoke it at any moment.
+        </p>
+        <p className="news-desk-delegation-note" data-delegation-words-note>
+          The agent must pass your actual words, in quotes, as the instruction on every approval or rejection. Papyrus keeps those words with the record. An agent that paraphrases or invents them is not following this delegation.
+        </p>
+        <div className="news-desk-delegation-form">
+          <label className="news-desk-doctrine-card__field">
+            <span>Agent name</span>
+            <input value={agentLabelText} onChange={(event) => setAgentLabelText(event.target.value)} placeholder="curator-agent" autoComplete="off" disabled={disabled || busy} />
+          </label>
+          <label className="news-desk-doctrine-card__field">
+            <span>{`Hours (${MINIMUM_DELEGATION_HOURS} to ${MAXIMUM_DELEGATION_HOURS})`}</span>
+            <input value={hoursText} onChange={(event) => setHoursText(event.target.value)} inputMode="numeric" disabled={disabled || busy} />
+          </label>
+          <button type="button" className="news-desk-primary-action-button" data-delegation-create onClick={() => void handleCreate()} disabled={disabled || busy}>
+            {busy && !issued ? "Creating" : "Create delegation"}
+          </button>
+        </div>
+        {errorMessage ? <p className="news-desk-delegation-error" role="alert" data-delegation-error>{errorMessage}</p> : null}
+      </article>
+
+      {issued ? (
+        <article className="news-desk-delegation-token" data-delegation-token-box aria-live="polite">
+          <h3>Copy this token now</h3>
+          <p>This token is shown once. Papyrus does not keep it, and it cannot be shown again. If you lose it, revoke the delegation and create a new one.</p>
+          <div className="news-desk-delegation-token__row">
+            <code data-delegation-token>{issued.token}</code>
+            <button type="button" onClick={() => void copyText("token", issued.token)}>{copied === "token" ? "Copied" : "Copy token"}</button>
+          </div>
+          <p className="story-label">Command line for {issued.agentLabel}</p>
+          <div className="news-desk-delegation-token__row">
+            <code data-delegation-command>{commandLine}</code>
+            <button type="button" onClick={() => void copyText("command", commandLine)}>{copied === "command" ? "Copied" : "Copy command"}</button>
+          </div>
+          <div className="news-desk-doctrine-card__actions">
+            <button type="button" className="news-desk-primary-action-button" data-delegation-done onClick={() => { setIssued(null); setCopied(null); }}>Done</button>
+          </div>
+        </article>
+      ) : null}
+
+      <article className="news-desk-doctrine-card">
+        <div className="news-desk-doctrine-card__header">
+          <div>
+            <h3>Delegations</h3>
+            <span>Granted by you, newest first</span>
+          </div>
+        </div>
+        {delegations.length === 0 ? (
+          <p className="news-desk-delegation-note" data-delegation-empty>You have not granted any delegations.</p>
+        ) : (
+          <ul className="news-desk-delegation-list">
+            {delegations.map((entry) => {
+              const stateText = delegationExpiryText(entry.expiresAt, entry.revokedAt, nowMilliseconds);
+              const live = !entry.revokedAt && stateText !== "Expired";
+              return (
+                <li key={entry.delegationId} data-delegation-row={entry.delegationId} data-delegation-live={live || undefined}>
+                  <div>
+                    <strong>{entry.agentLabel}</strong>
+                    <span>{`Granted by ${entry.grantorLabel ?? "you"}`}</span>
+                  </div>
+                  <span className="news-desk-delegation-state">{stateText}</span>
+                  {live ? (
+                    confirmingRevokeId === entry.delegationId ? (
+                      <span className="news-desk-delegation-confirm">
+                        <span>{`Stop ${entry.agentLabel} from curating for you?`}</span>
+                        <button type="button" data-delegation-revoke-confirm onClick={() => void handleRevoke(entry.delegationId)} disabled={busy}>Revoke now</button>
+                        <button type="button" onClick={() => setConfirmingRevokeId(null)} disabled={busy}>Keep</button>
+                      </span>
+                    ) : (
+                      <button type="button" data-delegation-revoke onClick={() => setConfirmingRevokeId(entry.delegationId)} disabled={disabled || busy}>Revoke</button>
+                    )
+                  ) : null}
+                </li>
+              );
+            })}
+          </ul>
+        )}
+      </article>
+    </div>
+  );
+}

package/components/curation-delegation-client.ts

@@ -0,0 +1,81 @@
+"use client";
+
+import { generateClient } from "aws-amplify/data";
+import { isLocalPreviewEnabled } from "../lib/local-preview";
+import type { CurationDelegationRecord } from "../lib/curation-delegation-helpers";
+import { configureAmplifyClient } from "./amplify-client-provider";
+
+const USER_POOL_AUTH_MODE = "userPool";
+
+export type CreatedCurationDelegation = CurationDelegationRecord & { token: string };
+
+const CREATE_MUTATION = `
+  mutation CreateCurationDelegation($agentLabel: String!, $hours: Int) {
+    createCurationDelegation(agentLabel: $agentLabel, hours: $hours) {
+      delegationId token agentLabel grantorLabel expiresAt revokedAt
+    }
+  }
+`;
+
+const REVOKE_MUTATION = `
+  mutation RevokeCurationDelegation($delegationId: ID!) {
+    revokeCurationDelegation(delegationId: $delegationId) {
+      delegationId agentLabel grantorLabel expiresAt revokedAt
+    }
+  }
+`;
+
+const LIST_QUERY = `
+  query ListCurationDelegations {
+    listCurationDelegations {
+      delegationId agentLabel grantorLabel expiresAt revokedAt
+    }
+  }
+`;
+
+const previewDelegations: CurationDelegationRecord[] = [];
+
+async function runGraphql<T>(query: string, variables: Record<string, unknown>): Promise<T> {
+  configureAmplifyClient();
+  const client = generateClient() as unknown as {
+    graphql: (options: Record<string, unknown>) => Promise<{ data?: T | null; errors?: Array<{ message?: string }> | null }>;
+  };
+  const response = await client.graphql({ query, variables, authMode: USER_POOL_AUTH_MODE });
+  if (response.errors?.length) throw Object.assign(new Error(response.errors[0]?.message ?? "Request failed."), { errors: response.errors });
+  if (!response.data) throw new Error("The server returned no result.");
+  return response.data;
+}
+
+export async function createCurationDelegation(agentLabel: string, hours: number): Promise<CreatedCurationDelegation> {
+  if (isLocalPreviewEnabled()) {
+    const delegationId = `curation-delegation-preview-${previewDelegations.length + 1}`;
+    const record: CurationDelegationRecord = {
+      delegationId,
+      agentLabel,
+      grantorLabel: "ryan@example.com",
+      expiresAt: new Date(Date.now() + hours * 3_600_000).toISOString(),
+      revokedAt: null,
+    };
+    previewDelegations.push(record);
+    return { ...record, token: `${delegationId}~preview-token-not-valid-anywhere` };
+  }
+  const data = await runGraphql<{ createCurationDelegation: CreatedCurationDelegation }>(CREATE_MUTATION, { agentLabel, hours });
+  return data.createCurationDelegation;
+}
+
+export async function revokeCurationDelegation(delegationId: string): Promise<CurationDelegationRecord> {
+  if (isLocalPreviewEnabled()) {
+    const record = previewDelegations.find((entry) => entry.delegationId === delegationId);
+    if (!record) throw new Error("That delegation was not found.");
+    record.revokedAt = record.revokedAt ?? new Date().toISOString();
+    return { ...record };
+  }
+  const data = await runGraphql<{ revokeCurationDelegation: CurationDelegationRecord }>(REVOKE_MUTATION, { delegationId });
+  return data.revokeCurationDelegation;
+}
+
+export async function listCurationDelegations(): Promise<CurationDelegationRecord[]> {
+  if (isLocalPreviewEnabled()) return previewDelegations.map((entry) => ({ ...entry })).reverse();
+  const data = await runGraphql<{ listCurationDelegations: CurationDelegationRecord[] }>(LIST_QUERY, {});
+  return data.listCurationDelegations ?? [];
+}