@anthusai/papyrus 1.14.0 → 1.15.0

package/app/api/auth/prospectus/accounts/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusPublishingAccountCreation } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusPublishingAccountCreation(request);
+}

package/components/administration-delegations-panel.tsx

@@ -1,41 +1,22 @@
 "use client";
 
 import { useEffect, useRef, useState } from "react";
-import { fetchAuthSession } from "aws-amplify/auth";
-import { isLocalPreviewEnabled } from "../lib/local-preview";
 import {
-  DEFAULT_DELEGATION_HOURS,
-  MAXIMUM_DELEGATION_HOURS,
-  MINIMUM_DELEGATION_HOURS,
-  buildDelegatedCommandLine,
-  delegationExpiryText,
+  delegationStateText,
   describeDelegationError,
-  validateDelegationInput,
+  isPendingDelegation,
+  pendingCountdownText,
+  requestedHoursText,
   type CurationDelegationRecord,
 } from "../lib/curation-delegation-helpers";
-import { createCurationDelegation, listCurationDelegations, revokeCurationDelegation, type CreatedCurationDelegation } from "./curation-delegation-client";
+import { approveCurationDelegation, denyCurationDelegation, listCurationDelegations, revokeCurationDelegation } from "./curation-delegation-client";
 
-type IssuedToken = { agentLabel: string; token: string };
-
-async function readSignedInEmail(): Promise<string> {
-  if (isLocalPreviewEnabled()) return "ryan@example.com";
-  try {
-    const session = await fetchAuthSession();
-    const email = session.tokens?.idToken?.payload?.email;
-    return typeof email === "string" ? email : "";
-  } catch {
-    return "";
-  }
-}
+const REFRESH_MILLISECONDS = 10_000;
 
 export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean }) {
-  const [agentLabelText, setAgentLabelText] = useState("");
-  const [hoursText, setHoursText] = useState(String(DEFAULT_DELEGATION_HOURS));
+  const [busyCode, setBusyCode] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
-  const [issued, setIssued] = useState<IssuedToken | null>(null);
-  const [copied, setCopied] = useState<"token" | "command" | null>(null);
-  const [email, setEmail] = useState("");
   const [delegations, setDelegations] = useState<CurationDelegationRecord[]>([]);
   const [confirmingRevokeId, setConfirmingRevokeId] = useState<string | null>(null);
   const [nowMilliseconds, setNowMilliseconds] = useState(() => Date.now());
@@ -43,15 +24,13 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
 
   useEffect(() => {
     mounted.current = true;
-    void readSignedInEmail().then((value) => {
-      if (mounted.current) setEmail(value);
-    });
     void refreshDelegations();
-    const timer = window.setInterval(() => setNowMilliseconds(Date.now()), 30_000);
+    const refreshTimer = window.setInterval(() => void refreshDelegations(), REFRESH_MILLISECONDS);
+    const clockTimer = window.setInterval(() => setNowMilliseconds(Date.now()), 1_000);
     return () => {
       mounted.current = false;
-      window.clearInterval(timer);
-      setIssued(null);
+      window.clearInterval(refreshTimer);
+      window.clearInterval(clockTimer);
     };
   }, []);
 
@@ -64,25 +43,17 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
     }
   }
 
-  async function handleCreate() {
-    const validation = validateDelegationInput(agentLabelText, hoursText);
-    if (!validation.ok) {
-      setErrorMessage(validation.message);
-      return;
-    }
-    setBusy(true);
+  async function decide(userCode: string, decision: "approve" | "deny") {
+    setBusyCode(userCode);
     setErrorMessage(null);
     try {
-      const created: CreatedCurationDelegation = await createCurationDelegation(validation.agentLabel, validation.hours);
-      setIssued({ agentLabel: created.agentLabel, token: created.token });
-      setCopied(null);
+      await (decision === "approve" ? approveCurationDelegation(userCode) : denyCurationDelegation(userCode));
       await refreshDelegations();
-      setAgentLabelText("");
-      setNowMilliseconds(Date.now());
     } catch (error) {
       setErrorMessage(describeDelegationError(error));
+      await refreshDelegations();
     } finally {
-      setBusy(false);
+      setBusyCode(null);
     }
   }
 
@@ -100,81 +71,62 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
     }
   }
 
-  async function copyText(kind: "token" | "command", text: string) {
-    try {
-      await navigator.clipboard.writeText(text);
-      setCopied(kind);
-    } catch {
-      setErrorMessage("Copying was blocked by the browser. Select the text and copy it by hand.");
-    }
-  }
-
-  const commandLine = issued ? buildDelegatedCommandLine({ email, agentLabel: issued.agentLabel, token: issued.token }) : "";
+  const pending = delegations.filter((entry) => isPendingDelegation(entry, nowMilliseconds));
+  const others = delegations.filter((entry) => entry.state !== "pending");
 
   return (
     <div data-news-desk-admin-panel="delegations">
-      <article className="news-desk-doctrine-card">
+      <article className="news-desk-doctrine-card" data-delegation-pending-block>
         <div className="news-desk-doctrine-card__header">
           <div>
-            <h3>Agent delegations</h3>
-            <span>Let one agent approve or reject References for you, for a short time</span>
+            <h3>Pending requests</h3>
+            <span>An agent asked to record your decisions. Check the code matches what it showed you.</span>
           </div>
         </div>
-        <p className="news-desk-delegation-note">
-          A delegation is a token you hand to one named agent. While it lasts, that agent&apos;s approvals and rejections are recorded under your name and marked as relayed. You can revoke it at any moment.
-        </p>
+        {errorMessage ? <p className="news-desk-delegation-error" role="alert" data-delegation-error>{errorMessage}</p> : null}
+        {pending.length === 0 ? (
+          <p className="news-desk-delegation-note" data-delegation-pending-empty>No agent is waiting for approval. A request appears here as soon as an agent asks.</p>
+        ) : (
+          <ul className="news-desk-delegation-pending-list">
+            {pending.map((entry) => {
+              const userCode = entry.userCode ?? "";
+              const working = busyCode === userCode;
+              return (
+                <li key={entry.delegationId} data-delegation-pending={entry.delegationId}>
+                  <div>
+                    <strong>{entry.agentLabel}</strong>
+                    <span>{requestedHoursText(entry.requestedHours)}</span>
+                    <span className="news-desk-delegation-countdown" data-delegation-countdown>{pendingCountdownText(entry.pendingExpiresAt ?? entry.expiresAt, nowMilliseconds)}</span>
+                  </div>
+                  <code className="news-desk-delegation-code" data-delegation-user-code aria-label={`Code ${userCode.split("").join(" ")}`}>{userCode}</code>
+                  <span className="news-desk-delegation-decision">
+                    <button type="button" data-delegation-approve onClick={() => void decide(userCode, "approve")} disabled={disabled || working || busyCode !== null}>Approve</button>
+                    <button type="button" data-delegation-deny onClick={() => void decide(userCode, "deny")} disabled={disabled || working || busyCode !== null}>Deny</button>
+                  </span>
+                </li>
+              );
+            })}
+          </ul>
+        )}
         <p className="news-desk-delegation-note" data-delegation-words-note>
-          The agent must pass your actual words, in quotes, as the instruction on every approval or rejection. Papyrus keeps those words with the record. An agent that paraphrases or invents them is not following this delegation.
+          While a delegation lasts, that agent&apos;s approvals and rejections are recorded under your name and marked as relayed, with the words you gave it kept with each record. You can revoke it at any moment.
         </p>
-        <div className="news-desk-delegation-form">
-          <label className="news-desk-doctrine-card__field">
-            <span>Agent name</span>
-            <input value={agentLabelText} onChange={(event) => setAgentLabelText(event.target.value)} placeholder="curator-agent" autoComplete="off" disabled={disabled || busy} />
-          </label>
-          <label className="news-desk-doctrine-card__field">
-            <span>{`Hours (${MINIMUM_DELEGATION_HOURS} to ${MAXIMUM_DELEGATION_HOURS})`}</span>
-            <input value={hoursText} onChange={(event) => setHoursText(event.target.value)} inputMode="numeric" disabled={disabled || busy} />
-          </label>
-          <button type="button" className="news-desk-primary-action-button" data-delegation-create onClick={() => void handleCreate()} disabled={disabled || busy}>
-            {busy && !issued ? "Creating" : "Create delegation"}
-          </button>
-        </div>
-        {errorMessage ? <p className="news-desk-delegation-error" role="alert" data-delegation-error>{errorMessage}</p> : null}
       </article>
 
-      {issued ? (
-        <article className="news-desk-delegation-token" data-delegation-token-box aria-live="polite">
-          <h3>Copy this token now</h3>
-          <p>This token is shown once. Papyrus does not keep it, and it cannot be shown again. If you lose it, revoke the delegation and create a new one.</p>
-          <div className="news-desk-delegation-token__row">
-            <code data-delegation-token>{issued.token}</code>
-            <button type="button" onClick={() => void copyText("token", issued.token)}>{copied === "token" ? "Copied" : "Copy token"}</button>
-          </div>
-          <p className="story-label">Command line for {issued.agentLabel}</p>
-          <div className="news-desk-delegation-token__row">
-            <code data-delegation-command>{commandLine}</code>
-            <button type="button" onClick={() => void copyText("command", commandLine)}>{copied === "command" ? "Copied" : "Copy command"}</button>
-          </div>
-          <div className="news-desk-doctrine-card__actions">
-            <button type="button" className="news-desk-primary-action-button" data-delegation-done onClick={() => { setIssued(null); setCopied(null); }}>Done</button>
-          </div>
-        </article>
-      ) : null}
-
       <article className="news-desk-doctrine-card">
         <div className="news-desk-doctrine-card__header">
           <div>
             <h3>Delegations</h3>
-            <span>Granted by you, newest first</span>
+            <span>Decided requests, newest first</span>
           </div>
         </div>
-        {delegations.length === 0 ? (
+        {others.length === 0 ? (
           <p className="news-desk-delegation-note" data-delegation-empty>You have not granted any delegations.</p>
         ) : (
           <ul className="news-desk-delegation-list">
-            {delegations.map((entry) => {
-              const stateText = delegationExpiryText(entry.expiresAt, entry.revokedAt, nowMilliseconds);
-              const live = !entry.revokedAt && stateText !== "Expired";
+            {others.map((entry) => {
+              const stateText = delegationStateText(entry, nowMilliseconds);
+              const live = entry.state === "approved" && !entry.revokedAt && stateText !== "Expired";
               return (
                 <li key={entry.delegationId} data-delegation-row={entry.delegationId} data-delegation-live={live || undefined}>
                   <div>

package/components/curation-delegation-client.ts

@@ -7,20 +7,24 @@ import { configureAmplifyClient } from "./amplify-client-provider";
 
 const USER_POOL_AUTH_MODE = "userPool";
 
-export type CreatedCurationDelegation = CurationDelegationRecord & { token: string };
+const DELEGATION_FIELDS = "delegationId agentLabel grantorLabel expiresAt revokedAt state userCode requestedHours pendingExpiresAt approvedAt deniedAt";
 
-const CREATE_MUTATION = `
-  mutation CreateCurationDelegation($agentLabel: String!, $hours: Int) {
-    createCurationDelegation(agentLabel: $agentLabel, hours: $hours) {
-      delegationId token agentLabel grantorLabel expiresAt revokedAt
-    }
+const APPROVE_MUTATION = `
+  mutation ApproveCurationDelegation($userCode: String!) {
+    approveCurationDelegation(userCode: $userCode) { ${DELEGATION_FIELDS} }
+  }
+`;
+
+const DENY_MUTATION = `
+  mutation DenyCurationDelegation($userCode: String!) {
+    denyCurationDelegation(userCode: $userCode) { ${DELEGATION_FIELDS} }
   }
 `;
 
 const REVOKE_MUTATION = `
   mutation RevokeCurationDelegation($delegationId: ID!) {
     revokeCurationDelegation(delegationId: $delegationId) {
-      delegationId agentLabel grantorLabel expiresAt revokedAt
+      ${DELEGATION_FIELDS}
     }
   }
 `;
@@ -28,12 +32,24 @@ const REVOKE_MUTATION = `
 const LIST_QUERY = `
   query ListCurationDelegations {
     listCurationDelegations {
-      delegationId agentLabel grantorLabel expiresAt revokedAt
+      ${DELEGATION_FIELDS}
     }
   }
 `;
 
-const previewDelegations: CurationDelegationRecord[] = [];
+function previewPendingRequest(agentLabel: string, userCode: string, requestedHours: number, minutesLeft: number, id: string): CurationDelegationRecord {
+  const pendingExpiresAt = new Date(Date.now() + minutesLeft * 60_000).toISOString();
+  return { delegationId: id, agentLabel, grantorLabel: null, expiresAt: pendingExpiresAt, revokedAt: null, state: "pending", userCode, requestedHours, pendingExpiresAt, approvedAt: null, deniedAt: null };
+}
+
+const previewDelegations: CurationDelegationRecord[] = [
+  previewPendingRequest("e2e-check", "WDJB-MJHT", 1, 9.5, "curation-delegation-preview-pending-1"),
+  previewPendingRequest("section-curator", "KQPR-4XNZ", 8, 4, "curation-delegation-preview-pending-2"),
+];
+
+function normalizedCode(code: string): string {
+  return code.replace(/[^a-z0-9]/gi, "").toUpperCase();
+}
 
 async function runGraphql<T>(query: string, variables: Record<string, unknown>): Promise<T> {
   configureAmplifyClient();
@@ -46,21 +62,27 @@ async function runGraphql<T>(query: string, variables: Record<string, unknown>):
   return response.data;
 }
 
-export async function createCurationDelegation(agentLabel: string, hours: number): Promise<CreatedCurationDelegation> {
+export async function approveCurationDelegation(userCode: string): Promise<CurationDelegationRecord> {
   if (isLocalPreviewEnabled()) {
-    const delegationId = `curation-delegation-preview-${previewDelegations.length + 1}`;
-    const record: CurationDelegationRecord = {
-      delegationId,
-      agentLabel,
-      grantorLabel: "ryan@example.com",
-      expiresAt: new Date(Date.now() + hours * 3_600_000).toISOString(),
-      revokedAt: null,
-    };
-    previewDelegations.push(record);
-    return { ...record, token: `${delegationId}~preview-token-not-valid-anywhere` };
+    const record = previewDelegations.find((entry) => entry.state === "pending" && normalizedCode(entry.userCode ?? "") === normalizedCode(userCode));
+    if (!record) throw new Error("That code was not found, has expired, or was already decided.");
+    const now = Date.now();
+    Object.assign(record, { state: "approved", userCode: null, grantorLabel: "ryan@example.com", approvedAt: new Date(now).toISOString(), expiresAt: new Date(now + (record.requestedHours ?? 1) * 3_600_000).toISOString() });
+    return { ...record };
+  }
+  const data = await runGraphql<{ approveCurationDelegation: CurationDelegationRecord }>(APPROVE_MUTATION, { userCode });
+  return data.approveCurationDelegation;
+}
+
+export async function denyCurationDelegation(userCode: string): Promise<CurationDelegationRecord> {
+  if (isLocalPreviewEnabled()) {
+    const record = previewDelegations.find((entry) => entry.state === "pending" && normalizedCode(entry.userCode ?? "") === normalizedCode(userCode));
+    if (!record) throw new Error("That code was not found, has expired, or was already decided.");
+    Object.assign(record, { state: "denied", userCode: null, deniedAt: new Date().toISOString() });
+    return { ...record };
   }
-  const data = await runGraphql<{ createCurationDelegation: CreatedCurationDelegation }>(CREATE_MUTATION, { agentLabel, hours });
-  return data.createCurationDelegation;
+  const data = await runGraphql<{ denyCurationDelegation: CurationDelegationRecord }>(DENY_MUTATION, { userCode });
+  return data.denyCurationDelegation;
 }
 
 export async function revokeCurationDelegation(delegationId: string): Promise<CurationDelegationRecord> {
@@ -68,6 +90,7 @@ export async function revokeCurationDelegation(delegationId: string): Promise<Cu
     const record = previewDelegations.find((entry) => entry.delegationId === delegationId);
     if (!record) throw new Error("That delegation was not found.");
     record.revokedAt = record.revokedAt ?? new Date().toISOString();
+    record.state = "revoked";
     return { ...record };
   }
   const data = await runGraphql<{ revokeCurationDelegation: CurationDelegationRecord }>(REVOKE_MUTATION, { delegationId });
@@ -75,7 +98,7 @@ export async function revokeCurationDelegation(delegationId: string): Promise<Cu
 }
 
 export async function listCurationDelegations(): Promise<CurationDelegationRecord[]> {
-  if (isLocalPreviewEnabled()) return previewDelegations.map((entry) => ({ ...entry })).reverse();
+  if (isLocalPreviewEnabled()) return previewDelegations.map((entry) => ({ ...entry }));
   const data = await runGraphql<{ listCurationDelegations: CurationDelegationRecord[] }>(LIST_QUERY, {});
   return data.listCurationDelegations ?? [];
 }

package/components/newsroom-organizer.css

@@ -274,6 +274,14 @@ body:has(.newsroom-organizer)>[data-staging-banner]{flex-shrink:0}
 .organizer-account-chooser li button small,.organizer-account-chooser-note{font-size:12px;color:var(--org-ink);margin:0}
 .organizer-account-chooser-heading{margin:0;font:600 11px/1.4 Newsroom UI,system-ui,sans-serif;letter-spacing:.07em;text-transform:uppercase}
 .organizer-account-chooser-link{color:var(--org-ink);text-decoration:underline;text-underline-offset:3px}
+.organizer-account-create-start,.organizer-account-create button{background:none;border:1px solid var(--org-ink);border-radius:0;color:var(--org-ink);font:600 12px/1.4 Newsroom UI,system-ui,sans-serif;padding:4px 10px;cursor:pointer;text-underline-offset:3px}
+.organizer-account-create-start:hover,.organizer-account-create button:hover{text-decoration:underline}
+.organizer-account-create-start:focus-visible,.organizer-account-create button:focus-visible,.organizer-account-create input:focus-visible{outline:2px solid var(--org-ink);outline-offset:1px}
+.organizer-account-create button:disabled{cursor:default;text-decoration:line-through}
+.organizer-account-create{display:grid;gap:6px}
+.organizer-account-create label{display:grid;gap:2px;font:600 11px/1.4 Newsroom UI,system-ui,sans-serif;letter-spacing:.07em;text-transform:uppercase}
+.organizer-account-create input{background:transparent;border:0;border-bottom:2px solid var(--org-ink);border-radius:0;color:var(--org-ink);font:400 14px/1.4 Newsroom UI,system-ui,sans-serif;padding:4px 0;text-transform:none;letter-spacing:0}
+.organizer-account-create span{display:flex;gap:8px}
 [data-reference-cyclotron-status] .cyclotron-status[data-variant]{border-radius:0;background:transparent;border-top:1px solid var(--org-ink);border-bottom:1px solid var(--org-ink);padding-left:0;padding-right:0}
 [data-reference-cyclotron-status] :is(.cyclotron-status-note,.cyclotron-status-definition,.cyclotron-status-header p,.cyclotron-status-override){color:var(--org-ink)}
 [data-reference-cyclotron-status] .cyclotron-status[data-variant="strip"]>span+span::before{color:var(--org-ink)}
@@ -295,4 +303,17 @@ body:has(.newsroom-organizer)>[data-staging-banner]{flex-shrink:0}
 .news-desk-columns--administration .news-desk-delegation-list li[data-delegation-live=true] .news-desk-delegation-state{font-weight:700;text-decoration:underline;text-underline-offset:4px}
 .news-desk-columns--administration .news-desk-delegation-state{font:600 12px/1.4 Newsroom UI,system-ui,sans-serif;color:var(--administration-strong)}
 .news-desk-columns--administration .news-desk-delegation-confirm{display:flex;flex-wrap:wrap;gap:8px;align-items:center}
+.news-desk-columns--administration .news-desk-delegation-pending-list{list-style:none;margin:0;padding:0;display:grid}
+.news-desk-columns--administration .news-desk-delegation-pending-list li{display:grid;grid-template-columns:minmax(0,1fr) auto auto;gap:12px 24px;align-items:center;padding:16px 0 16px 12px;border-top:1px solid var(--org-line);border-left:3px solid var(--org-ink)}
+.news-desk-columns--administration .news-desk-delegation-pending-list li>div{display:grid;gap:2px}
+.news-desk-columns--administration .news-desk-delegation-pending-list li>div>strong{font:700 18px/1.2 Newsroom Display,Georgia,serif}
+.news-desk-columns--administration .news-desk-delegation-pending-list li>div>span{font:400 13px/1.4 Newsroom UI,system-ui,sans-serif}
+.news-desk-columns--administration .news-desk-delegation-countdown{font-weight:600!important;font-variant-numeric:tabular-nums}
+.news-desk-columns--administration .news-desk-delegation-code{font:700 34px/1.1 ui-monospace,Menlo,monospace;letter-spacing:.14em;color:var(--org-ink);padding:6px 0;border-top:2px solid var(--org-ink);border-bottom:2px solid var(--org-ink)}
+.news-desk-columns--administration .news-desk-delegation-decision{display:flex;gap:8px}
+.news-desk-columns--administration .news-desk-delegation-decision button{min-height:40px;padding:4px 18px;border:1px solid var(--org-ink);border-radius:0;background:transparent;color:var(--org-ink);font:700 12px/1.2 Newsroom UI,system-ui,sans-serif;letter-spacing:.07em;text-transform:uppercase;cursor:pointer}
+.news-desk-columns--administration .news-desk-delegation-decision button:hover:not(:disabled){text-decoration:underline;text-underline-offset:4px}
+.news-desk-columns--administration .news-desk-delegation-decision button:disabled{cursor:default;text-decoration:line-through}
+.news-desk-columns--administration .news-desk-delegation-decision button:focus-visible{outline:2px solid var(--org-ink);outline-offset:2px}
+@container (max-width:640px){.news-desk-columns--administration .news-desk-delegation-pending-list li{grid-template-columns:minmax(0,1fr)}.news-desk-columns--administration .news-desk-delegation-code{font-size:28px}}
 @container (max-width:640px){.news-desk-columns--administration .news-desk-delegation-form{grid-template-columns:minmax(0,1fr)}.news-desk-columns--administration .news-desk-delegation-list li{grid-template-columns:minmax(0,1fr)}}

package/components/prospectus-account-chooser.tsx

@@ -4,9 +4,15 @@ import { useEffect, useState } from "react";
 import { Check } from "lucide-react";
 import { isLocalPreviewEnabled } from "../lib/local-preview";
 import { LOCAL_PREVIEW_TENANTS, getLocalPreviewTenantId, setLocalPreviewTenantId } from "../lib/local-preview-tenant";
-import { loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
+import { createProspectusAccount, loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
+
+/** Local preview: add ?no-accounts=1 to the address to see a signed-in person with no publishing account. */
+function previewHasNoAccounts(): boolean {
+  return typeof window !== "undefined" && new URLSearchParams(window.location.search).has("no-accounts");
+}
 
 function previewAccountState(): ProspectusAccountState {
+  if (previewHasNoAccounts()) return { status: "signedIn", publishingAccounts: [], selectedAccountId: null, cyclotronLabAccess: false };
   return {
     status: "signedIn",
     publishingAccounts: LOCAL_PREVIEW_TENANTS.map(tenant => ({ accountId: tenant.accountId, name: tenant.name, role: tenant.role })),
@@ -50,6 +56,8 @@ export function ProspectusAccountChooser() {
   const [state, setState] = useState<ProspectusAccountState>({ status: "unavailable" });
   const [error, setError] = useState<string | null>(null);
   const [pending, setPending] = useState<string | null>(null);
+  const [creating, setCreating] = useState(false);
+  const [newName, setNewName] = useState("");
   useEffect(() => {
     let cancelled = false;
     const returnPath = `${window.location.pathname}${window.location.search}`;
@@ -76,6 +84,20 @@ export function ProspectusAccountChooser() {
     if ("error" in result) { setError(result.error); return; }
     window.location.reload();
   };
+  const create = async () => {
+    if (pending) return;
+    setPending("create"); setError(null);
+    if (isLocalPreviewEnabled()) {
+      const name = newName.trim() || "New publishing account";
+      setState({ status: "signedIn", publishingAccounts: [{ accountId: "preview-created-account", name, role: "owner" }], selectedAccountId: "preview-created-account", cyclotronLabAccess: false });
+      setPending(null); setCreating(false);
+      return;
+    }
+    const result = await createProspectusAccount(newName);
+    setPending(null);
+    if ("error" in result) { setError(result.error); return; }
+    window.location.reload();
+  };
   return <div className="organizer-account-chooser" data-prospectus-account-chooser="signed-in">
     <p className="organizer-account-chooser-heading">Publishing account</p>
     {state.publishingAccounts.length === 0
@@ -91,6 +113,17 @@ export function ProspectusAccountChooser() {
           </li>;
         })}
       </ul>}
+    {state.publishingAccounts.length === 0 ? (
+      creating
+        ? <form className="organizer-account-create" data-prospectus-create-account onSubmit={event => { event.preventDefault(); void create(); }}>
+          <label>Account name<input autoFocus disabled={pending !== null} maxLength={80} onChange={event => setNewName(event.target.value)} placeholder="Optional" type="text" value={newName} /></label>
+          <span>
+            <button data-prospectus-create-account-submit disabled={pending !== null} type="submit">{pending === "create" ? "Creating…" : "Create account"}</button>
+            <button disabled={pending !== null} onClick={() => setCreating(false)} type="button">Cancel</button>
+          </span>
+        </form>
+        : <button className="organizer-account-create-start" data-prospectus-create-account-start onClick={() => setCreating(true)} type="button">Create publishing account</button>
+    ) : null}
     {!state.selectedAccountId && state.publishingAccounts.length > 0 ? <p className="organizer-account-chooser-note">Choose the account you are working as.</p> : null}
     {state.cyclotronLabAccess ? <p className="organizer-account-chooser-note" data-cyclotron-lab-access>Cyclotron lab access is on for you.</p> : null}
     {error ? <p className="organizer-account-chooser-note" role="alert">{error}</p> : null}

package/lib/curation-delegation-helpers.ts

@@ -1,6 +1,4 @@
-export const DEFAULT_DELEGATION_HOURS = 8;
-export const MINIMUM_DELEGATION_HOURS = 1;
-export const MAXIMUM_DELEGATION_HOURS = 72;
+export type CurationDelegationState = "pending" | "approved" | "denied" | "expired" | "revoked";
 
 export type CurationDelegationRecord = {
   delegationId: string;
@@ -8,25 +6,15 @@ export type CurationDelegationRecord = {
   grantorLabel: string | null;
   expiresAt: string;
   revokedAt: string | null;
+  state?: CurationDelegationState | null;
+  /** XXXX-XXXX, present only while the request is pending. */
+  userCode?: string | null;
+  requestedHours?: number | null;
+  pendingExpiresAt?: string | null;
+  approvedAt?: string | null;
+  deniedAt?: string | null;
 };
 
-export type DelegationInputValidation =
-  | { ok: true; agentLabel: string; hours: number }
-  | { ok: false; message: string };
-
-export function validateDelegationInput(agentLabelText: string, hoursText: string): DelegationInputValidation {
-  const agentLabel = agentLabelText.trim();
-  if (!agentLabel) return { ok: false, message: "Enter the name of the agent you are trusting." };
-  if (/\s/.test(agentLabel)) return { ok: false, message: "The agent name cannot contain spaces. Use the name the agent passes as --agent." };
-  const trimmedHours = hoursText.trim();
-  if (!/^\d+$/.test(trimmedHours)) return { ok: false, message: `Enter a whole number of hours from ${MINIMUM_DELEGATION_HOURS} to ${MAXIMUM_DELEGATION_HOURS}.` };
-  const hours = Number(trimmedHours);
-  if (hours < MINIMUM_DELEGATION_HOURS || hours > MAXIMUM_DELEGATION_HOURS) {
-    return { ok: false, message: `A delegation lasts from ${MINIMUM_DELEGATION_HOURS} to ${MAXIMUM_DELEGATION_HOURS} hours.` };
-  }
-  return { ok: true, agentLabel, hours };
-}
-
 export function delegationExpiryText(expiresAt: string, revokedAt: string | null, nowMilliseconds: number): string {
   if (revokedAt) return "Revoked";
   const remaining = Date.parse(expiresAt) - nowMilliseconds;
@@ -41,11 +29,6 @@ export function isDelegationActive(record: CurationDelegationRecord, nowMillisec
   return !record.revokedAt && Date.parse(record.expiresAt) > nowMilliseconds;
 }
 
-export function buildDelegatedCommandLine(input: { email: string; agentLabel: string; token: string; action?: "approve" | "reject" }): string {
-  const email = input.email.trim() || "<your-email>";
-  return `papyrus references ${input.action ?? "approve"} <reference-id> --on-behalf-of ${email} --agent ${input.agentLabel} --instruction "<the person's own words>" --delegation-token ${input.token}`;
-}
-
 export function describeDelegationError(error: unknown): string {
   const raw = error instanceof Error ? error.message : typeof error === "string" ? error : "";
   const graphql = (error as { errors?: Array<{ message?: string }> } | null)?.errors?.[0]?.message ?? "";
@@ -57,3 +40,30 @@ export function describeDelegationError(error: unknown): string {
   const detail = (graphql || raw).trim();
   return detail ? `The server refused the request: ${detail}` : "Something went wrong. Nothing was changed.";
 }
+
+/** A pending request that an agent started and nobody has approved, denied or let lapse. */
+export function isPendingDelegation(record: CurationDelegationRecord, nowMilliseconds: number): boolean {
+  return record.state === "pending" && Boolean(record.userCode) && Date.parse(record.pendingExpiresAt ?? record.expiresAt) > nowMilliseconds;
+}
+
+/** "9:41 left" for a request that is still open, "Expired" once its window has passed. */
+export function pendingCountdownText(pendingExpiresAt: string | null | undefined, nowMilliseconds: number): string {
+  const remaining = Date.parse(pendingExpiresAt ?? "") - nowMilliseconds;
+  if (!Number.isFinite(remaining) || remaining <= 0) return "Expired";
+  const totalSeconds = Math.ceil(remaining / 1000);
+  const minutes = Math.floor(totalSeconds / 60);
+  const seconds = totalSeconds % 60;
+  return `${minutes}:${String(seconds).padStart(2, "0")} left`;
+}
+
+/** The state of a decided or lapsed delegation in words an editor reads in the list. */
+export function delegationStateText(record: CurationDelegationRecord, nowMilliseconds: number): string {
+  if (record.state === "denied") return "Denied";
+  if (record.state === "pending") return pendingCountdownText(record.pendingExpiresAt ?? record.expiresAt, nowMilliseconds) === "Expired" ? "Request expired" : "Waiting for a decision";
+  return delegationExpiryText(record.expiresAt, record.revokedAt, nowMilliseconds);
+}
+
+export function requestedHoursText(hours: number | null | undefined): string {
+  if (!hours || hours <= 0) return "Duration not stated";
+  return `Asks for ${hours} ${hours === 1 ? "hour" : "hours"}`;
+}

package/lib/prospectus-account-client.ts

@@ -18,6 +18,7 @@ type FetchImplementation = (input: string, init?: RequestInit) => Promise<Respon
 
 const SESSION_PATH = "/api/auth/prospectus/session";
 const SELECTION_PATH = "/api/auth/prospectus/selection";
+const ACCOUNTS_PATH = "/api/auth/prospectus/accounts";
 const SIGN_IN_PATH = "/api/auth/prospectus/sign-in";
 
 export function prospectusSignInUrl(returnPath: string): string {
@@ -62,3 +63,28 @@ export async function selectProspectusAccount(
   if (!response.ok || !body?.selectedAccountId) return { error: body?.message ?? "That account could not be selected." };
   return { selectedAccountId: body.selectedAccountId, role: body.role ?? "" };
 }
+
+/**
+ * Create a publishing account for the signed-in person and select it. Each call carries a fresh idempotency key,
+ * so a retried request after a dropped response cannot create a second account.
+ */
+export async function createProspectusAccount(
+  name: string,
+  fetchImplementation: FetchImplementation = fetch,
+  idempotencyKey: string = crypto.randomUUID(),
+): Promise<{ selectedAccountId: string; role: string } | { error: string }> {
+  let response: Response;
+  try {
+    response = await fetchImplementation(ACCOUNTS_PATH, {
+      method: "POST",
+      credentials: "same-origin",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ name: name.trim() || undefined, idempotencyKey }),
+    });
+  } catch {
+    return { error: "The publishing account could not be created. Check your connection and try again." };
+  }
+  const body = await response.json().catch(() => null) as { selectedAccountId?: string; role?: string; message?: string } | null;
+  if (!response.ok || !body?.selectedAccountId) return { error: body?.message ?? "The publishing account could not be created." };
+  return { selectedAccountId: body.selectedAccountId, role: body.role ?? "" };
+}

package/lib/prospectus-sign-in-routes.ts

@@ -282,3 +282,48 @@ export async function handleProspectusAccountSelection(request: NextRequest, opt
     return signInFailedResponse(503, "prospectus_unavailable", "Prospectus could not be reached.");
   }
 }
+
+const MAXIMUM_PUBLISHING_ACCOUNT_NAME_LENGTH = 150;
+const DEFAULT_PUBLISHING_ACCOUNT_NAME = "Publishing account";
+const IDEMPOTENCY_KEY_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export async function handleProspectusPublishingAccountCreation(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  if (request.headers.get("origin") !== request.nextUrl.origin) {
+    return signInFailedResponse(403, "cross_origin_creation", "Create an account from this site.");
+  }
+  const nowInSeconds = currentTimeInSeconds(options);
+  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
+  if (!session) return signInFailedResponse(401, "signed_out", "Sign in first.");
+  const body = await request.json().catch(() => null) as { name?: unknown; idempotencyKey?: unknown } | null;
+  const requestedName = typeof body?.name === "string" ? body.name.trim() : "";
+  const accountName = requestedName || DEFAULT_PUBLISHING_ACCOUNT_NAME;
+  if (accountName.length > MAXIMUM_PUBLISHING_ACCOUNT_NAME_LENGTH) {
+    return signInFailedResponse(400, "account_name_too_long", "Name the account in 150 characters or fewer.");
+  }
+  const idempotencyKey = typeof body?.idempotencyKey === "string" ? body.idempotencyKey : "";
+  if (!IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {
+    return signInFailedResponse(400, "idempotency_key_required", "Send a UUID idempotency key.");
+  }
+  try {
+    const created = await runtime.accounts.createAccount(session.accessToken, accountName, idempotencyKey);
+    const selection = await freshlyAuthorizedPublishingSelection(runtime, session, created.account.id, siteProductFor(options));
+    if (!selection) return signInFailedResponse(403, "not_a_publishing_account", "The new account does not grant publishing access on this site.");
+    const response = NextResponse.json(
+      { selectedAccountId: selection.accountId, role: selection.role, publicationCapabilities: selection.publicationCapabilities },
+      { status: 201, headers: NO_STORE_HEADERS },
+    );
+    const selectedSession: ProspectusSignedInSession = { ...session, selectedAccountId: selection.accountId };
+    response.cookies.set(
+      PROSPECTUS_SESSION_COOKIE,
+      sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, selectedSession, session.accessTokenExpiresAt),
+      sealedCookieAttributes(session.accessTokenExpiresAt, nowInSeconds),
+    );
+    return response;
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
+    console.error(`Prospectus account creation failed (${error instanceof Error ? error.name : "error"}).`);
+    return signInFailedResponse(503, "prospectus_unavailable", "Prospectus could not be reached.");
+  }
+}