@anthusai/papyrus 1.13.0 → 1.15.0

package/amplify/functions/shared/curation-delegation-flow.ts

@@ -0,0 +1,147 @@
+import {
+  EXPIRED_REQUEST_GRANTOR_SUB,
+  MAXIMUM_PENDING_DELEGATION_REQUESTS,
+  PENDING_DELEGATION_MINUTES,
+  PENDING_REQUEST_GRANTOR_SUB,
+  delegationExpiry,
+  delegationState,
+  formatUserCode,
+  newUserCode,
+  normalizeUserCode,
+  type CurationDelegation,
+} from "./curation-delegation"
+
+export type DelegationStore = {
+  read(delegationId: string): Promise<CurationDelegation | null>
+  write(delegation: CurationDelegation, now: string, created: boolean): Promise<void>
+  listPending(): Promise<CurationDelegation[]>
+}
+
+export type SignedInPerson = { sub: string; label: string; isAdmin: boolean }
+
+const DELEGATION_ID_PATTERN = /^curation-delegation-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+const TOKEN_HASH_PATTERN = /^[0-9a-f]{64}$/
+const MAXIMUM_AGENT_LABEL_LENGTH = 80
+const USER_CODE_ATTEMPTS = 50
+
+export function delegationResult(delegation: CurationDelegation, now: string) {
+  const state = delegationState(delegation, now)
+  return {
+    ok: true,
+    delegationId: delegation.delegationId,
+    token: null,
+    agentLabel: delegation.agentLabel,
+    grantorLabel: delegation.grantorLabel || null,
+    expiresAt: delegation.expiresAt,
+    revokedAt: delegation.revokedAt,
+    state,
+    userCode: state === "pending" && delegation.userCode ? formatUserCode(delegation.userCode) : null,
+    requestedHours: delegation.requestedHours ?? null,
+    pendingExpiresAt: delegation.pendingExpiresAt ?? null,
+    approvedAt: delegation.approvedAt ?? null,
+    deniedAt: delegation.deniedAt ?? null,
+  }
+}
+
+export async function livePendingRequests(store: DelegationStore, now: string): Promise<CurationDelegation[]> {
+  const live: CurationDelegation[] = []
+  for (const candidate of await store.listPending()) {
+    if (delegationState(candidate, now) === "pending") {
+      live.push(candidate)
+    } else if (candidate.grantorSub === PENDING_REQUEST_GRANTOR_SUB) {
+      await store.write({ ...candidate, grantorSub: EXPIRED_REQUEST_GRANTOR_SUB }, now, false)
+    }
+  }
+  return live
+}
+
+export async function requestDelegation(
+  store: DelegationStore,
+  input: { delegationId: string; tokenHash: string; agentLabel: string; hours: number | null | undefined },
+  now: string,
+) {
+  if (!DELEGATION_ID_PATTERN.test(input.delegationId)) {
+    throw new Error("The delegation id must look like curation-delegation-<uuid>.")
+  }
+  if (!TOKEN_HASH_PATTERN.test(input.tokenHash)) throw new Error("The token hash must be 64 lowercase hexadecimal characters.")
+  const agentLabel = input.agentLabel.trim()
+  if (!agentLabel) throw new Error("Name the agent asking for the delegation.")
+  if (agentLabel.length > MAXIMUM_AGENT_LABEL_LENGTH) throw new Error("The agent name is too long.")
+  const requestedHours = input.hours ?? 8
+  delegationExpiry(now, requestedHours)
+  if (await store.read(input.delegationId)) throw new Error("That delegation id is already in use.")
+  const live = await livePendingRequests(store, now)
+  if (live.length >= MAXIMUM_PENDING_DELEGATION_REQUESTS) {
+    throw new Error("Too many delegation requests are waiting for approval. Try again later.")
+  }
+  const takenCodes = new Set(live.map((request) => request.userCode))
+  let userCode = newUserCode()
+  for (let attempt = 0; takenCodes.has(userCode); attempt += 1) {
+    if (attempt >= USER_CODE_ATTEMPTS) throw new Error("Could not allocate a unique approval code. Try again.")
+    userCode = newUserCode()
+  }
+  const pendingExpiresAt = new Date(Date.parse(now) + PENDING_DELEGATION_MINUTES * 60_000).toISOString()
+  const delegation: CurationDelegation = {
+    delegationId: input.delegationId,
+    tokenHash: input.tokenHash,
+    grantorSub: PENDING_REQUEST_GRANTOR_SUB,
+    grantorLabel: "",
+    agentLabel,
+    createdAt: now,
+    expiresAt: pendingExpiresAt,
+    revokedAt: null,
+    userCode,
+    requestedHours,
+    pendingExpiresAt,
+    approvedAt: null,
+    deniedAt: null,
+  }
+  await store.write(delegation, now, true)
+  return {
+    ok: true,
+    delegationId: delegation.delegationId,
+    userCode: formatUserCode(userCode),
+    pendingExpiresAt,
+    requestedHours,
+  }
+}
+
+async function findLivePendingByCode(store: DelegationStore, typedCode: string, now: string): Promise<CurationDelegation> {
+  const code = normalizeUserCode(typedCode)
+  const found = code ? (await livePendingRequests(store, now)).find((request) => request.userCode === code) : undefined
+  if (!found) throw new Error("No pending delegation request has that code. It may have expired or already been decided.")
+  return found
+}
+
+export async function approveDelegation(store: DelegationStore, person: SignedInPerson, typedCode: string, now: string) {
+  const pending = await findLivePendingByCode(store, typedCode, now)
+  const approved: CurationDelegation = {
+    ...pending,
+    grantorSub: person.sub,
+    grantorLabel: person.label,
+    createdAt: now,
+    expiresAt: delegationExpiry(now, pending.requestedHours),
+    approvedAt: now,
+    userCode: null,
+  }
+  await store.write(approved, now, false)
+  return delegationResult(approved, now)
+}
+
+export async function denyDelegation(store: DelegationStore, person: SignedInPerson, typedCode: string, now: string) {
+  const pending = await findLivePendingByCode(store, typedCode, now)
+  const denied: CurationDelegation = { ...pending, grantorSub: person.sub, grantorLabel: person.label, deniedAt: now, userCode: null }
+  await store.write(denied, now, false)
+  return delegationResult(denied, now)
+}
+
+export async function delegationStatus(store: DelegationStore, delegationId: string, now: string) {
+  const delegation = await store.read(delegationId)
+  if (!delegation) throw new Error("That delegation was not found.")
+  return {
+    delegationId: delegation.delegationId,
+    state: delegationState(delegation, now),
+    expiresAt: delegation.expiresAt,
+    grantorLabel: delegation.grantorLabel || null,
+  }
+}

package/amplify/functions/shared/curation-delegation.ts

@@ -1,4 +1,4 @@
-import { createHash, randomBytes } from "node:crypto"
+import { createHash, randomBytes, randomInt } from "node:crypto"
 
 export const CURATION_DELEGATION_PAYLOAD_KIND = "curation-delegation"
 export const CURATION_DELEGATION_OWNER_TYPE = "curationDelegation"
@@ -14,11 +14,18 @@ export type CurationDelegation = {
   createdAt: string
   expiresAt: string
   revokedAt: string | null
+  userCode?: string | null
+  requestedHours?: number | null
+  pendingExpiresAt?: string | null
+  approvedAt?: string | null
+  deniedAt?: string | null
 }
 
+export type DelegationState = "pending" | "approved" | "denied" | "expired" | "revoked"
+
 export type DelegationVerdict =
   | { ok: true }
-  | { ok: false; reason: "unknown-token" | "wrong-agent" | "revoked" | "expired" }
+  | { ok: false; reason: "unknown-token" | "wrong-agent" | "revoked" | "not-approved" | "expired" }
 
 export function hashDelegationToken(token: string): string {
   return createHash("sha256").update(token, "utf8").digest("hex")
@@ -53,6 +60,10 @@ export function delegationVerdict(
     return { ok: false, reason: "wrong-agent" }
   }
   if (delegation.revokedAt) return { ok: false, reason: "revoked" }
+  const state = delegationState(delegation, presented.now)
+  if (state === "pending" || state === "denied" || (state === "expired" && delegation.userCode && !delegation.approvedAt)) {
+    return { ok: false, reason: "not-approved" }
+  }
   if (Date.parse(delegation.expiresAt) <= Date.parse(presented.now)) return { ok: false, reason: "expired" }
   return { ok: true }
 }
@@ -62,6 +73,43 @@ export function delegationRefusalMessage(reason: Exclude<DelegationVerdict, { ok
     "unknown-token": "That delegation token is not recognized.",
     "wrong-agent": "That delegation was granted to a different agent.",
     "revoked": "That delegation was revoked.",
+    "not-approved": "That delegation has not been approved by a person. Ask them to approve the code in the Newsroom.",
     "expired": "That delegation has expired. Ask the person for a new one.",
   }[reason]
 }
+
+export const PENDING_DELEGATION_MINUTES = 10
+export const MAXIMUM_PENDING_DELEGATION_REQUESTS = 5
+export const PENDING_REQUEST_GRANTOR_SUB = "pending-device-authorization"
+export const EXPIRED_REQUEST_GRANTOR_SUB = "expired-device-authorization"
+export const USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789"
+export const USER_CODE_LENGTH = 8
+
+export function newUserCode(): string {
+  let code = ""
+  for (let position = 0; position < USER_CODE_LENGTH; position += 1) {
+    code += USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)]
+  }
+  return code
+}
+
+export function formatUserCode(code: string): string {
+  return `${code.slice(0, 4)}-${code.slice(4)}`
+}
+
+export function normalizeUserCode(typed: string | null | undefined): string | null {
+  const stripped = (typed ?? "").toUpperCase().replace(/[\s-]/g, "")
+  if (stripped.length !== USER_CODE_LENGTH) return null
+  for (const character of stripped) if (!USER_CODE_ALPHABET.includes(character)) return null
+  return stripped
+}
+
+export function delegationState(delegation: CurationDelegation, now: string): DelegationState {
+  if (delegation.revokedAt) return "revoked"
+  if (delegation.deniedAt) return "denied"
+  if (delegation.userCode && !delegation.approvedAt) {
+    const pendingEnd = delegation.pendingExpiresAt ?? delegation.expiresAt
+    return Date.parse(pendingEnd) <= Date.parse(now) ? "expired" : "pending"
+  }
+  return Date.parse(delegation.expiresAt) <= Date.parse(now) ? "expired" : "approved"
+}

package/amplify/functions/shared/reference-curation-metadata.ts

@@ -13,6 +13,7 @@ export type ReferenceCurationMetadataInput = {
   decisionRelationId?: string | null
   shareable?: boolean | null
   actorKind?: CurationActorKind | null
+  sectionId?: string | null
   delegation?: { delegationId: string; relayedBy: string; instruction: string } | null
 }
 
@@ -39,6 +40,7 @@ export function referenceCurationMetadata(input: ReferenceCurationMetadataInput)
     referenceId: input.referenceId,
     referenceLineageId: input.referenceLineageId,
     ...(input.actorKind ? {actorKind: input.actorKind} : {}),
+    ...(input.sectionId?.trim() ? {sectionId: input.sectionId.trim()} : {}),
     ...(input.delegation
       ? {attestation: "delegated", relayedBy: input.delegation.relayedBy, delegationId: input.delegation.delegationId,
          instruction: input.delegation.instruction}
@@ -47,3 +49,32 @@ export function referenceCurationMetadata(input: ReferenceCurationMetadataInput)
     ...(decisionRelationId ? {shareable: input.shareable === true} : {}),
   }
 }
+
+export type CurationSectionCandidate = {
+  id?: string | null
+  enabled?: boolean | null
+  enabledStatus?: string | null
+} | null | undefined
+
+/**
+ * A curation may name the newsroom Section the Reference belongs in, but only
+ * when it accepts the Reference and the Section exists and is enabled.
+ */
+export function validatedCurationSectionId(
+  requestedSectionId: string | null | undefined,
+  action: string,
+  section: CurationSectionCandidate,
+): string | null {
+  const sectionId = requestedSectionId?.trim() || null
+  if (!sectionId) return null
+  if (action !== "accept") {
+    throw new Error("A section can be recorded only when accepting a reference.")
+  }
+  if (!section || section.id !== sectionId) {
+    throw new Error(`Newsroom section ${sectionId} was not found.`)
+  }
+  if (section.enabled === false || section.enabledStatus === "disabled") {
+    throw new Error(`Newsroom section ${sectionId} is disabled.`)
+  }
+  return sectionId
+}

package/app/api/auth/prospectus/accounts/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusPublishingAccountCreation } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusPublishingAccountCreation(request);
+}

package/components/administration-delegations-panel.tsx

@@ -1,41 +1,22 @@
 "use client";
 
 import { useEffect, useRef, useState } from "react";
-import { fetchAuthSession } from "aws-amplify/auth";
-import { isLocalPreviewEnabled } from "../lib/local-preview";
 import {
-  DEFAULT_DELEGATION_HOURS,
-  MAXIMUM_DELEGATION_HOURS,
-  MINIMUM_DELEGATION_HOURS,
-  buildDelegatedCommandLine,
-  delegationExpiryText,
+  delegationStateText,
   describeDelegationError,
-  validateDelegationInput,
+  isPendingDelegation,
+  pendingCountdownText,
+  requestedHoursText,
   type CurationDelegationRecord,
 } from "../lib/curation-delegation-helpers";
-import { createCurationDelegation, listCurationDelegations, revokeCurationDelegation, type CreatedCurationDelegation } from "./curation-delegation-client";
+import { approveCurationDelegation, denyCurationDelegation, listCurationDelegations, revokeCurationDelegation } from "./curation-delegation-client";
 
-type IssuedToken = { agentLabel: string; token: string };
-
-async function readSignedInEmail(): Promise<string> {
-  if (isLocalPreviewEnabled()) return "ryan@example.com";
-  try {
-    const session = await fetchAuthSession();
-    const email = session.tokens?.idToken?.payload?.email;
-    return typeof email === "string" ? email : "";
-  } catch {
-    return "";
-  }
-}
+const REFRESH_MILLISECONDS = 10_000;
 
 export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean }) {
-  const [agentLabelText, setAgentLabelText] = useState("");
-  const [hoursText, setHoursText] = useState(String(DEFAULT_DELEGATION_HOURS));
+  const [busyCode, setBusyCode] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
-  const [issued, setIssued] = useState<IssuedToken | null>(null);
-  const [copied, setCopied] = useState<"token" | "command" | null>(null);
-  const [email, setEmail] = useState("");
   const [delegations, setDelegations] = useState<CurationDelegationRecord[]>([]);
   const [confirmingRevokeId, setConfirmingRevokeId] = useState<string | null>(null);
   const [nowMilliseconds, setNowMilliseconds] = useState(() => Date.now());
@@ -43,15 +24,13 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
 
   useEffect(() => {
     mounted.current = true;
-    void readSignedInEmail().then((value) => {
-      if (mounted.current) setEmail(value);
-    });
     void refreshDelegations();
-    const timer = window.setInterval(() => setNowMilliseconds(Date.now()), 30_000);
+    const refreshTimer = window.setInterval(() => void refreshDelegations(), REFRESH_MILLISECONDS);
+    const clockTimer = window.setInterval(() => setNowMilliseconds(Date.now()), 1_000);
     return () => {
       mounted.current = false;
-      window.clearInterval(timer);
-      setIssued(null);
+      window.clearInterval(refreshTimer);
+      window.clearInterval(clockTimer);
     };
   }, []);
 
@@ -64,25 +43,17 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
     }
   }
 
-  async function handleCreate() {
-    const validation = validateDelegationInput(agentLabelText, hoursText);
-    if (!validation.ok) {
-      setErrorMessage(validation.message);
-      return;
-    }
-    setBusy(true);
+  async function decide(userCode: string, decision: "approve" | "deny") {
+    setBusyCode(userCode);
     setErrorMessage(null);
     try {
-      const created: CreatedCurationDelegation = await createCurationDelegation(validation.agentLabel, validation.hours);
-      setIssued({ agentLabel: created.agentLabel, token: created.token });
-      setCopied(null);
+      await (decision === "approve" ? approveCurationDelegation(userCode) : denyCurationDelegation(userCode));
       await refreshDelegations();
-      setAgentLabelText("");
-      setNowMilliseconds(Date.now());
     } catch (error) {
       setErrorMessage(describeDelegationError(error));
+      await refreshDelegations();
     } finally {
-      setBusy(false);
+      setBusyCode(null);
     }
   }
 
@@ -100,81 +71,62 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
     }
   }
 
-  async function copyText(kind: "token" | "command", text: string) {
-    try {
-      await navigator.clipboard.writeText(text);
-      setCopied(kind);
-    } catch {
-      setErrorMessage("Copying was blocked by the browser. Select the text and copy it by hand.");
-    }
-  }
-
-  const commandLine = issued ? buildDelegatedCommandLine({ email, agentLabel: issued.agentLabel, token: issued.token }) : "";
+  const pending = delegations.filter((entry) => isPendingDelegation(entry, nowMilliseconds));
+  const others = delegations.filter((entry) => entry.state !== "pending");
 
   return (
     <div data-news-desk-admin-panel="delegations">
-      <article className="news-desk-doctrine-card">
+      <article className="news-desk-doctrine-card" data-delegation-pending-block>
         <div className="news-desk-doctrine-card__header">
           <div>
-            <h3>Agent delegations</h3>
-            <span>Let one agent approve or reject References for you, for a short time</span>
+            <h3>Pending requests</h3>
+            <span>An agent asked to record your decisions. Check the code matches what it showed you.</span>
           </div>
         </div>
-        <p className="news-desk-delegation-note">
-          A delegation is a token you hand to one named agent. While it lasts, that agent&apos;s approvals and rejections are recorded under your name and marked as relayed. You can revoke it at any moment.
-        </p>
+        {errorMessage ? <p className="news-desk-delegation-error" role="alert" data-delegation-error>{errorMessage}</p> : null}
+        {pending.length === 0 ? (
+          <p className="news-desk-delegation-note" data-delegation-pending-empty>No agent is waiting for approval. A request appears here as soon as an agent asks.</p>
+        ) : (
+          <ul className="news-desk-delegation-pending-list">
+            {pending.map((entry) => {
+              const userCode = entry.userCode ?? "";
+              const working = busyCode === userCode;
+              return (
+                <li key={entry.delegationId} data-delegation-pending={entry.delegationId}>
+                  <div>
+                    <strong>{entry.agentLabel}</strong>
+                    <span>{requestedHoursText(entry.requestedHours)}</span>
+                    <span className="news-desk-delegation-countdown" data-delegation-countdown>{pendingCountdownText(entry.pendingExpiresAt ?? entry.expiresAt, nowMilliseconds)}</span>
+                  </div>
+                  <code className="news-desk-delegation-code" data-delegation-user-code aria-label={`Code ${userCode.split("").join(" ")}`}>{userCode}</code>
+                  <span className="news-desk-delegation-decision">
+                    <button type="button" data-delegation-approve onClick={() => void decide(userCode, "approve")} disabled={disabled || working || busyCode !== null}>Approve</button>
+                    <button type="button" data-delegation-deny onClick={() => void decide(userCode, "deny")} disabled={disabled || working || busyCode !== null}>Deny</button>
+                  </span>
+                </li>
+              );
+            })}
+          </ul>
+        )}
         <p className="news-desk-delegation-note" data-delegation-words-note>
-          The agent must pass your actual words, in quotes, as the instruction on every approval or rejection. Papyrus keeps those words with the record. An agent that paraphrases or invents them is not following this delegation.
+          While a delegation lasts, that agent&apos;s approvals and rejections are recorded under your name and marked as relayed, with the words you gave it kept with each record. You can revoke it at any moment.
         </p>
-        <div className="news-desk-delegation-form">
-          <label className="news-desk-doctrine-card__field">
-            <span>Agent name</span>
-            <input value={agentLabelText} onChange={(event) => setAgentLabelText(event.target.value)} placeholder="curator-agent" autoComplete="off" disabled={disabled || busy} />
-          </label>
-          <label className="news-desk-doctrine-card__field">
-            <span>{`Hours (${MINIMUM_DELEGATION_HOURS} to ${MAXIMUM_DELEGATION_HOURS})`}</span>
-            <input value={hoursText} onChange={(event) => setHoursText(event.target.value)} inputMode="numeric" disabled={disabled || busy} />
-          </label>
-          <button type="button" className="news-desk-primary-action-button" data-delegation-create onClick={() => void handleCreate()} disabled={disabled || busy}>
-            {busy && !issued ? "Creating" : "Create delegation"}
-          </button>
-        </div>
-        {errorMessage ? <p className="news-desk-delegation-error" role="alert" data-delegation-error>{errorMessage}</p> : null}
       </article>
 
-      {issued ? (
-        <article className="news-desk-delegation-token" data-delegation-token-box aria-live="polite">
-          <h3>Copy this token now</h3>
-          <p>This token is shown once. Papyrus does not keep it, and it cannot be shown again. If you lose it, revoke the delegation and create a new one.</p>
-          <div className="news-desk-delegation-token__row">
-            <code data-delegation-token>{issued.token}</code>
-            <button type="button" onClick={() => void copyText("token", issued.token)}>{copied === "token" ? "Copied" : "Copy token"}</button>
-          </div>
-          <p className="story-label">Command line for {issued.agentLabel}</p>
-          <div className="news-desk-delegation-token__row">
-            <code data-delegation-command>{commandLine}</code>
-            <button type="button" onClick={() => void copyText("command", commandLine)}>{copied === "command" ? "Copied" : "Copy command"}</button>
-          </div>
-          <div className="news-desk-doctrine-card__actions">
-            <button type="button" className="news-desk-primary-action-button" data-delegation-done onClick={() => { setIssued(null); setCopied(null); }}>Done</button>
-          </div>
-        </article>
-      ) : null}
-
       <article className="news-desk-doctrine-card">
         <div className="news-desk-doctrine-card__header">
           <div>
             <h3>Delegations</h3>
-            <span>Granted by you, newest first</span>
+            <span>Decided requests, newest first</span>
           </div>
         </div>
-        {delegations.length === 0 ? (
+        {others.length === 0 ? (
           <p className="news-desk-delegation-note" data-delegation-empty>You have not granted any delegations.</p>
         ) : (
           <ul className="news-desk-delegation-list">
-            {delegations.map((entry) => {
-              const stateText = delegationExpiryText(entry.expiresAt, entry.revokedAt, nowMilliseconds);
-              const live = !entry.revokedAt && stateText !== "Expired";
+            {others.map((entry) => {
+              const stateText = delegationStateText(entry, nowMilliseconds);
+              const live = entry.state === "approved" && !entry.revokedAt && stateText !== "Expired";
               return (
                 <li key={entry.delegationId} data-delegation-row={entry.delegationId} data-delegation-live={live || undefined}>
                   <div>

package/components/curation-delegation-client.ts

@@ -7,20 +7,24 @@ import { configureAmplifyClient } from "./amplify-client-provider";
 
 const USER_POOL_AUTH_MODE = "userPool";
 
-export type CreatedCurationDelegation = CurationDelegationRecord & { token: string };
+const DELEGATION_FIELDS = "delegationId agentLabel grantorLabel expiresAt revokedAt state userCode requestedHours pendingExpiresAt approvedAt deniedAt";
 
-const CREATE_MUTATION = `
-  mutation CreateCurationDelegation($agentLabel: String!, $hours: Int) {
-    createCurationDelegation(agentLabel: $agentLabel, hours: $hours) {
-      delegationId token agentLabel grantorLabel expiresAt revokedAt
-    }
+const APPROVE_MUTATION = `
+  mutation ApproveCurationDelegation($userCode: String!) {
+    approveCurationDelegation(userCode: $userCode) { ${DELEGATION_FIELDS} }
+  }
+`;
+
+const DENY_MUTATION = `
+  mutation DenyCurationDelegation($userCode: String!) {
+    denyCurationDelegation(userCode: $userCode) { ${DELEGATION_FIELDS} }
   }
 `;
 
 const REVOKE_MUTATION = `
   mutation RevokeCurationDelegation($delegationId: ID!) {
     revokeCurationDelegation(delegationId: $delegationId) {
-      delegationId agentLabel grantorLabel expiresAt revokedAt
+      ${DELEGATION_FIELDS}
     }
   }
 `;
@@ -28,12 +32,24 @@ const REVOKE_MUTATION = `
 const LIST_QUERY = `
   query ListCurationDelegations {
     listCurationDelegations {
-      delegationId agentLabel grantorLabel expiresAt revokedAt
+      ${DELEGATION_FIELDS}
     }
   }
 `;
 
-const previewDelegations: CurationDelegationRecord[] = [];
+function previewPendingRequest(agentLabel: string, userCode: string, requestedHours: number, minutesLeft: number, id: string): CurationDelegationRecord {
+  const pendingExpiresAt = new Date(Date.now() + minutesLeft * 60_000).toISOString();
+  return { delegationId: id, agentLabel, grantorLabel: null, expiresAt: pendingExpiresAt, revokedAt: null, state: "pending", userCode, requestedHours, pendingExpiresAt, approvedAt: null, deniedAt: null };
+}
+
+const previewDelegations: CurationDelegationRecord[] = [
+  previewPendingRequest("e2e-check", "WDJB-MJHT", 1, 9.5, "curation-delegation-preview-pending-1"),
+  previewPendingRequest("section-curator", "KQPR-4XNZ", 8, 4, "curation-delegation-preview-pending-2"),
+];
+
+function normalizedCode(code: string): string {
+  return code.replace(/[^a-z0-9]/gi, "").toUpperCase();
+}
 
 async function runGraphql<T>(query: string, variables: Record<string, unknown>): Promise<T> {
   configureAmplifyClient();
@@ -46,21 +62,27 @@ async function runGraphql<T>(query: string, variables: Record<string, unknown>):
   return response.data;
 }
 
-export async function createCurationDelegation(agentLabel: string, hours: number): Promise<CreatedCurationDelegation> {
+export async function approveCurationDelegation(userCode: string): Promise<CurationDelegationRecord> {
   if (isLocalPreviewEnabled()) {
-    const delegationId = `curation-delegation-preview-${previewDelegations.length + 1}`;
-    const record: CurationDelegationRecord = {
-      delegationId,
-      agentLabel,
-      grantorLabel: "ryan@example.com",
-      expiresAt: new Date(Date.now() + hours * 3_600_000).toISOString(),
-      revokedAt: null,
-    };
-    previewDelegations.push(record);
-    return { ...record, token: `${delegationId}~preview-token-not-valid-anywhere` };
+    const record = previewDelegations.find((entry) => entry.state === "pending" && normalizedCode(entry.userCode ?? "") === normalizedCode(userCode));
+    if (!record) throw new Error("That code was not found, has expired, or was already decided.");
+    const now = Date.now();
+    Object.assign(record, { state: "approved", userCode: null, grantorLabel: "ryan@example.com", approvedAt: new Date(now).toISOString(), expiresAt: new Date(now + (record.requestedHours ?? 1) * 3_600_000).toISOString() });
+    return { ...record };
+  }
+  const data = await runGraphql<{ approveCurationDelegation: CurationDelegationRecord }>(APPROVE_MUTATION, { userCode });
+  return data.approveCurationDelegation;
+}
+
+export async function denyCurationDelegation(userCode: string): Promise<CurationDelegationRecord> {
+  if (isLocalPreviewEnabled()) {
+    const record = previewDelegations.find((entry) => entry.state === "pending" && normalizedCode(entry.userCode ?? "") === normalizedCode(userCode));
+    if (!record) throw new Error("That code was not found, has expired, or was already decided.");
+    Object.assign(record, { state: "denied", userCode: null, deniedAt: new Date().toISOString() });
+    return { ...record };
   }
-  const data = await runGraphql<{ createCurationDelegation: CreatedCurationDelegation }>(CREATE_MUTATION, { agentLabel, hours });
-  return data.createCurationDelegation;
+  const data = await runGraphql<{ denyCurationDelegation: CurationDelegationRecord }>(DENY_MUTATION, { userCode });
+  return data.denyCurationDelegation;
 }
 
 export async function revokeCurationDelegation(delegationId: string): Promise<CurationDelegationRecord> {
@@ -68,6 +90,7 @@ export async function revokeCurationDelegation(delegationId: string): Promise<Cu
     const record = previewDelegations.find((entry) => entry.delegationId === delegationId);
     if (!record) throw new Error("That delegation was not found.");
     record.revokedAt = record.revokedAt ?? new Date().toISOString();
+    record.state = "revoked";
     return { ...record };
   }
   const data = await runGraphql<{ revokeCurationDelegation: CurationDelegationRecord }>(REVOKE_MUTATION, { delegationId });
@@ -75,7 +98,7 @@ export async function revokeCurationDelegation(delegationId: string): Promise<Cu
 }
 
 export async function listCurationDelegations(): Promise<CurationDelegationRecord[]> {
-  if (isLocalPreviewEnabled()) return previewDelegations.map((entry) => ({ ...entry })).reverse();
+  if (isLocalPreviewEnabled()) return previewDelegations.map((entry) => ({ ...entry }));
   const data = await runGraphql<{ listCurationDelegations: CurationDelegationRecord[] }>(LIST_QUERY, {});
   return data.listCurationDelegations ?? [];
 }

package/components/news-desk-taxonomy-client.ts

@@ -3628,6 +3628,18 @@ export async function loadCyclotronShadowAgreement(cyclotronId: string): Promise
   return latestShadowAgreement(payloads.map((payload) => ({ json: payload.json, updatedAt: payload.attachment.updatedAt })));
 }
 
+/** The site cyclotron's latest per-Section agreement payload, as the Section sweep recorded it. */
+export async function loadSiteSectionAgreement(cyclotronId: string): Promise<import("../lib/site-section-suggestions").SiteSectionAgreement | null> {
+  const { shadowAgreementPayloadId } = await import("../lib/cyclotron-suggestions");
+  const { parseSiteSectionAgreement } = await import("../lib/site-section-suggestions");
+  const payloads = await loadModelPayloadsForOwner("knowledgeRawPayload", shadowAgreementPayloadId(cyclotronId), ["raw_payload"]);
+  const parsed = payloads
+    .map((payload) => ({ agreement: parseSiteSectionAgreement(payload.json), updatedAt: payload.attachment.updatedAt }))
+    .filter((entry) => entry.agreement !== null)
+    .sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")));
+  return parsed.length ? parsed[0].agreement : null;
+}
+
 /** Ask the next decide-relevance sweep to set or clear a manual review rate. */
 export async function requestCyclotronReviewRate(
   cyclotronId: string,