@anthusai/papyrus 1.14.0 → 1.16.0

package/app/api/auth/prospectus/accounts/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusPublishingAccountCreation } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusPublishingAccountCreation(request);
+}

package/components/administration-delegations-panel.tsx

@@ -1,41 +1,22 @@
 "use client";
 
 import { useEffect, useRef, useState } from "react";
-import { fetchAuthSession } from "aws-amplify/auth";
-import { isLocalPreviewEnabled } from "../lib/local-preview";
 import {
-  DEFAULT_DELEGATION_HOURS,
-  MAXIMUM_DELEGATION_HOURS,
-  MINIMUM_DELEGATION_HOURS,
-  buildDelegatedCommandLine,
-  delegationExpiryText,
+  delegationStateText,
   describeDelegationError,
-  validateDelegationInput,
+  isPendingDelegation,
+  pendingCountdownText,
+  requestedHoursText,
   type CurationDelegationRecord,
 } from "../lib/curation-delegation-helpers";
-import { createCurationDelegation, listCurationDelegations, revokeCurationDelegation, type CreatedCurationDelegation } from "./curation-delegation-client";
+import { approveCurationDelegation, denyCurationDelegation, listCurationDelegations, revokeCurationDelegation } from "./curation-delegation-client";
 
-type IssuedToken = { agentLabel: string; token: string };
-
-async function readSignedInEmail(): Promise<string> {
-  if (isLocalPreviewEnabled()) return "ryan@example.com";
-  try {
-    const session = await fetchAuthSession();
-    const email = session.tokens?.idToken?.payload?.email;
-    return typeof email === "string" ? email : "";
-  } catch {
-    return "";
-  }
-}
+const REFRESH_MILLISECONDS = 10_000;
 
 export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean }) {
-  const [agentLabelText, setAgentLabelText] = useState("");
-  const [hoursText, setHoursText] = useState(String(DEFAULT_DELEGATION_HOURS));
+  const [busyCode, setBusyCode] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
-  const [issued, setIssued] = useState<IssuedToken | null>(null);
-  const [copied, setCopied] = useState<"token" | "command" | null>(null);
-  const [email, setEmail] = useState("");
   const [delegations, setDelegations] = useState<CurationDelegationRecord[]>([]);
   const [confirmingRevokeId, setConfirmingRevokeId] = useState<string | null>(null);
   const [nowMilliseconds, setNowMilliseconds] = useState(() => Date.now());
@@ -43,15 +24,13 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
 
   useEffect(() => {
     mounted.current = true;
-    void readSignedInEmail().then((value) => {
-      if (mounted.current) setEmail(value);
-    });
     void refreshDelegations();
-    const timer = window.setInterval(() => setNowMilliseconds(Date.now()), 30_000);
+    const refreshTimer = window.setInterval(() => void refreshDelegations(), REFRESH_MILLISECONDS);
+    const clockTimer = window.setInterval(() => setNowMilliseconds(Date.now()), 1_000);
     return () => {
       mounted.current = false;
-      window.clearInterval(timer);
-      setIssued(null);
+      window.clearInterval(refreshTimer);
+      window.clearInterval(clockTimer);
     };
   }, []);
 
@@ -64,25 +43,17 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
     }
   }
 
-  async function handleCreate() {
-    const validation = validateDelegationInput(agentLabelText, hoursText);
-    if (!validation.ok) {
-      setErrorMessage(validation.message);
-      return;
-    }
-    setBusy(true);
+  async function decide(userCode: string, decision: "approve" | "deny") {
+    setBusyCode(userCode);
     setErrorMessage(null);
     try {
-      const created: CreatedCurationDelegation = await createCurationDelegation(validation.agentLabel, validation.hours);
-      setIssued({ agentLabel: created.agentLabel, token: created.token });
-      setCopied(null);
+      await (decision === "approve" ? approveCurationDelegation(userCode) : denyCurationDelegation(userCode));
       await refreshDelegations();
-      setAgentLabelText("");
-      setNowMilliseconds(Date.now());
     } catch (error) {
       setErrorMessage(describeDelegationError(error));
+      await refreshDelegations();
     } finally {
-      setBusy(false);
+      setBusyCode(null);
     }
   }
 
@@ -100,81 +71,62 @@ export function AdministrationDelegationsPanel({ disabled }: { disabled: boolean
     }
   }
 
-  async function copyText(kind: "token" | "command", text: string) {
-    try {
-      await navigator.clipboard.writeText(text);
-      setCopied(kind);
-    } catch {
-      setErrorMessage("Copying was blocked by the browser. Select the text and copy it by hand.");
-    }
-  }
-
-  const commandLine = issued ? buildDelegatedCommandLine({ email, agentLabel: issued.agentLabel, token: issued.token }) : "";
+  const pending = delegations.filter((entry) => isPendingDelegation(entry, nowMilliseconds));
+  const others = delegations.filter((entry) => entry.state !== "pending");
 
   return (
     <div data-news-desk-admin-panel="delegations">
-      <article className="news-desk-doctrine-card">
+      <article className="news-desk-doctrine-card" data-delegation-pending-block>
         <div className="news-desk-doctrine-card__header">
           <div>
-            <h3>Agent delegations</h3>
-            <span>Let one agent approve or reject References for you, for a short time</span>
+            <h3>Pending requests</h3>
+            <span>An agent asked to record your decisions. Check the code matches what it showed you.</span>
           </div>
         </div>
-        <p className="news-desk-delegation-note">
-          A delegation is a token you hand to one named agent. While it lasts, that agent&apos;s approvals and rejections are recorded under your name and marked as relayed. You can revoke it at any moment.
-        </p>
+        {errorMessage ? <p className="news-desk-delegation-error" role="alert" data-delegation-error>{errorMessage}</p> : null}
+        {pending.length === 0 ? (
+          <p className="news-desk-delegation-note" data-delegation-pending-empty>No agent is waiting for approval. A request appears here as soon as an agent asks.</p>
+        ) : (
+          <ul className="news-desk-delegation-pending-list">
+            {pending.map((entry) => {
+              const userCode = entry.userCode ?? "";
+              const working = busyCode === userCode;
+              return (
+                <li key={entry.delegationId} data-delegation-pending={entry.delegationId}>
+                  <div>
+                    <strong>{entry.agentLabel}</strong>
+                    <span>{requestedHoursText(entry.requestedHours)}</span>
+                    <span className="news-desk-delegation-countdown" data-delegation-countdown>{pendingCountdownText(entry.pendingExpiresAt ?? entry.expiresAt, nowMilliseconds)}</span>
+                  </div>
+                  <code className="news-desk-delegation-code" data-delegation-user-code aria-label={`Code ${userCode.split("").join(" ")}`}>{userCode}</code>
+                  <span className="news-desk-delegation-decision">
+                    <button type="button" data-delegation-approve onClick={() => void decide(userCode, "approve")} disabled={disabled || working || busyCode !== null}>Approve</button>
+                    <button type="button" data-delegation-deny onClick={() => void decide(userCode, "deny")} disabled={disabled || working || busyCode !== null}>Deny</button>
+                  </span>
+                </li>
+              );
+            })}
+          </ul>
+        )}
         <p className="news-desk-delegation-note" data-delegation-words-note>
-          The agent must pass your actual words, in quotes, as the instruction on every approval or rejection. Papyrus keeps those words with the record. An agent that paraphrases or invents them is not following this delegation.
+          While a delegation lasts, that agent&apos;s approvals and rejections are recorded under your name and marked as relayed, with the words you gave it kept with each record. You can revoke it at any moment.
         </p>
-        <div className="news-desk-delegation-form">
-          <label className="news-desk-doctrine-card__field">
-            <span>Agent name</span>
-            <input value={agentLabelText} onChange={(event) => setAgentLabelText(event.target.value)} placeholder="curator-agent" autoComplete="off" disabled={disabled || busy} />
-          </label>
-          <label className="news-desk-doctrine-card__field">
-            <span>{`Hours (${MINIMUM_DELEGATION_HOURS} to ${MAXIMUM_DELEGATION_HOURS})`}</span>
-            <input value={hoursText} onChange={(event) => setHoursText(event.target.value)} inputMode="numeric" disabled={disabled || busy} />
-          </label>
-          <button type="button" className="news-desk-primary-action-button" data-delegation-create onClick={() => void handleCreate()} disabled={disabled || busy}>
-            {busy && !issued ? "Creating" : "Create delegation"}
-          </button>
-        </div>
-        {errorMessage ? <p className="news-desk-delegation-error" role="alert" data-delegation-error>{errorMessage}</p> : null}
       </article>
 
-      {issued ? (
-        <article className="news-desk-delegation-token" data-delegation-token-box aria-live="polite">
-          <h3>Copy this token now</h3>
-          <p>This token is shown once. Papyrus does not keep it, and it cannot be shown again. If you lose it, revoke the delegation and create a new one.</p>
-          <div className="news-desk-delegation-token__row">
-            <code data-delegation-token>{issued.token}</code>
-            <button type="button" onClick={() => void copyText("token", issued.token)}>{copied === "token" ? "Copied" : "Copy token"}</button>
-          </div>
-          <p className="story-label">Command line for {issued.agentLabel}</p>
-          <div className="news-desk-delegation-token__row">
-            <code data-delegation-command>{commandLine}</code>
-            <button type="button" onClick={() => void copyText("command", commandLine)}>{copied === "command" ? "Copied" : "Copy command"}</button>
-          </div>
-          <div className="news-desk-doctrine-card__actions">
-            <button type="button" className="news-desk-primary-action-button" data-delegation-done onClick={() => { setIssued(null); setCopied(null); }}>Done</button>
-          </div>
-        </article>
-      ) : null}
-
       <article className="news-desk-doctrine-card">
         <div className="news-desk-doctrine-card__header">
           <div>
             <h3>Delegations</h3>
-            <span>Granted by you, newest first</span>
+            <span>Decided requests, newest first</span>
           </div>
         </div>
-        {delegations.length === 0 ? (
+        {others.length === 0 ? (
           <p className="news-desk-delegation-note" data-delegation-empty>You have not granted any delegations.</p>
         ) : (
           <ul className="news-desk-delegation-list">
-            {delegations.map((entry) => {
-              const stateText = delegationExpiryText(entry.expiresAt, entry.revokedAt, nowMilliseconds);
-              const live = !entry.revokedAt && stateText !== "Expired";
+            {others.map((entry) => {
+              const stateText = delegationStateText(entry, nowMilliseconds);
+              const live = entry.state === "approved" && !entry.revokedAt && stateText !== "Expired";
               return (
                 <li key={entry.delegationId} data-delegation-row={entry.delegationId} data-delegation-live={live || undefined}>
                   <div>

package/components/curation-delegation-client.ts

@@ -7,20 +7,24 @@ import { configureAmplifyClient } from "./amplify-client-provider";
 
 const USER_POOL_AUTH_MODE = "userPool";
 
-export type CreatedCurationDelegation = CurationDelegationRecord & { token: string };
+const DELEGATION_FIELDS = "delegationId agentLabel grantorLabel expiresAt revokedAt state userCode requestedHours pendingExpiresAt approvedAt deniedAt";
 
-const CREATE_MUTATION = `
-  mutation CreateCurationDelegation($agentLabel: String!, $hours: Int) {
-    createCurationDelegation(agentLabel: $agentLabel, hours: $hours) {
-      delegationId token agentLabel grantorLabel expiresAt revokedAt
-    }
+const APPROVE_MUTATION = `
+  mutation ApproveCurationDelegation($userCode: String!) {
+    approveCurationDelegation(userCode: $userCode) { ${DELEGATION_FIELDS} }
+  }
+`;
+
+const DENY_MUTATION = `
+  mutation DenyCurationDelegation($userCode: String!) {
+    denyCurationDelegation(userCode: $userCode) { ${DELEGATION_FIELDS} }
   }
 `;
 
 const REVOKE_MUTATION = `
   mutation RevokeCurationDelegation($delegationId: ID!) {
     revokeCurationDelegation(delegationId: $delegationId) {
-      delegationId agentLabel grantorLabel expiresAt revokedAt
+      ${DELEGATION_FIELDS}
     }
   }
 `;
@@ -28,12 +32,24 @@ const REVOKE_MUTATION = `
 const LIST_QUERY = `
   query ListCurationDelegations {
     listCurationDelegations {
-      delegationId agentLabel grantorLabel expiresAt revokedAt
+      ${DELEGATION_FIELDS}
     }
   }
 `;
 
-const previewDelegations: CurationDelegationRecord[] = [];
+function previewPendingRequest(agentLabel: string, userCode: string, requestedHours: number, minutesLeft: number, id: string): CurationDelegationRecord {
+  const pendingExpiresAt = new Date(Date.now() + minutesLeft * 60_000).toISOString();
+  return { delegationId: id, agentLabel, grantorLabel: null, expiresAt: pendingExpiresAt, revokedAt: null, state: "pending", userCode, requestedHours, pendingExpiresAt, approvedAt: null, deniedAt: null };
+}
+
+const previewDelegations: CurationDelegationRecord[] = [
+  previewPendingRequest("e2e-check", "WDJB-MJHT", 1, 9.5, "curation-delegation-preview-pending-1"),
+  previewPendingRequest("section-curator", "KQPR-4XNZ", 8, 4, "curation-delegation-preview-pending-2"),
+];
+
+function normalizedCode(code: string): string {
+  return code.replace(/[^a-z0-9]/gi, "").toUpperCase();
+}
 
 async function runGraphql<T>(query: string, variables: Record<string, unknown>): Promise<T> {
   configureAmplifyClient();
@@ -46,21 +62,27 @@ async function runGraphql<T>(query: string, variables: Record<string, unknown>):
   return response.data;
 }
 
-export async function createCurationDelegation(agentLabel: string, hours: number): Promise<CreatedCurationDelegation> {
+export async function approveCurationDelegation(userCode: string): Promise<CurationDelegationRecord> {
   if (isLocalPreviewEnabled()) {
-    const delegationId = `curation-delegation-preview-${previewDelegations.length + 1}`;
-    const record: CurationDelegationRecord = {
-      delegationId,
-      agentLabel,
-      grantorLabel: "ryan@example.com",
-      expiresAt: new Date(Date.now() + hours * 3_600_000).toISOString(),
-      revokedAt: null,
-    };
-    previewDelegations.push(record);
-    return { ...record, token: `${delegationId}~preview-token-not-valid-anywhere` };
+    const record = previewDelegations.find((entry) => entry.state === "pending" && normalizedCode(entry.userCode ?? "") === normalizedCode(userCode));
+    if (!record) throw new Error("That code was not found, has expired, or was already decided.");
+    const now = Date.now();
+    Object.assign(record, { state: "approved", userCode: null, grantorLabel: "ryan@example.com", approvedAt: new Date(now).toISOString(), expiresAt: new Date(now + (record.requestedHours ?? 1) * 3_600_000).toISOString() });
+    return { ...record };
+  }
+  const data = await runGraphql<{ approveCurationDelegation: CurationDelegationRecord }>(APPROVE_MUTATION, { userCode });
+  return data.approveCurationDelegation;
+}
+
+export async function denyCurationDelegation(userCode: string): Promise<CurationDelegationRecord> {
+  if (isLocalPreviewEnabled()) {
+    const record = previewDelegations.find((entry) => entry.state === "pending" && normalizedCode(entry.userCode ?? "") === normalizedCode(userCode));
+    if (!record) throw new Error("That code was not found, has expired, or was already decided.");
+    Object.assign(record, { state: "denied", userCode: null, deniedAt: new Date().toISOString() });
+    return { ...record };
   }
-  const data = await runGraphql<{ createCurationDelegation: CreatedCurationDelegation }>(CREATE_MUTATION, { agentLabel, hours });
-  return data.createCurationDelegation;
+  const data = await runGraphql<{ denyCurationDelegation: CurationDelegationRecord }>(DENY_MUTATION, { userCode });
+  return data.denyCurationDelegation;
 }
 
 export async function revokeCurationDelegation(delegationId: string): Promise<CurationDelegationRecord> {
@@ -68,6 +90,7 @@ export async function revokeCurationDelegation(delegationId: string): Promise<Cu
     const record = previewDelegations.find((entry) => entry.delegationId === delegationId);
     if (!record) throw new Error("That delegation was not found.");
     record.revokedAt = record.revokedAt ?? new Date().toISOString();
+    record.state = "revoked";
     return { ...record };
   }
   const data = await runGraphql<{ revokeCurationDelegation: CurationDelegationRecord }>(REVOKE_MUTATION, { delegationId });
@@ -75,7 +98,7 @@ export async function revokeCurationDelegation(delegationId: string): Promise<Cu
 }
 
 export async function listCurationDelegations(): Promise<CurationDelegationRecord[]> {
-  if (isLocalPreviewEnabled()) return previewDelegations.map((entry) => ({ ...entry })).reverse();
+  if (isLocalPreviewEnabled()) return previewDelegations.map((entry) => ({ ...entry }));
   const data = await runGraphql<{ listCurationDelegations: CurationDelegationRecord[] }>(LIST_QUERY, {});
   return data.listCurationDelegations ?? [];
 }

package/components/newsroom-organizer.css

@@ -274,6 +274,14 @@ body:has(.newsroom-organizer)>[data-staging-banner]{flex-shrink:0}
 .organizer-account-chooser li button small,.organizer-account-chooser-note{font-size:12px;color:var(--org-ink);margin:0}
 .organizer-account-chooser-heading{margin:0;font:600 11px/1.4 Newsroom UI,system-ui,sans-serif;letter-spacing:.07em;text-transform:uppercase}
 .organizer-account-chooser-link{color:var(--org-ink);text-decoration:underline;text-underline-offset:3px}
+.organizer-account-create-start,.organizer-account-create button{background:none;border:1px solid var(--org-ink);border-radius:0;color:var(--org-ink);font:600 12px/1.4 Newsroom UI,system-ui,sans-serif;padding:4px 10px;cursor:pointer;text-underline-offset:3px}
+.organizer-account-create-start:hover,.organizer-account-create button:hover{text-decoration:underline}
+.organizer-account-create-start:focus-visible,.organizer-account-create button:focus-visible,.organizer-account-create input:focus-visible{outline:2px solid var(--org-ink);outline-offset:1px}
+.organizer-account-create button:disabled{cursor:default;text-decoration:line-through}
+.organizer-account-create{display:grid;gap:6px}
+.organizer-account-create label{display:grid;gap:2px;font:600 11px/1.4 Newsroom UI,system-ui,sans-serif;letter-spacing:.07em;text-transform:uppercase}
+.organizer-account-create input{background:transparent;border:0;border-bottom:2px solid var(--org-ink);border-radius:0;color:var(--org-ink);font:400 14px/1.4 Newsroom UI,system-ui,sans-serif;padding:4px 0;text-transform:none;letter-spacing:0}
+.organizer-account-create span{display:flex;gap:8px}
 [data-reference-cyclotron-status] .cyclotron-status[data-variant]{border-radius:0;background:transparent;border-top:1px solid var(--org-ink);border-bottom:1px solid var(--org-ink);padding-left:0;padding-right:0}
 [data-reference-cyclotron-status] :is(.cyclotron-status-note,.cyclotron-status-definition,.cyclotron-status-header p,.cyclotron-status-override){color:var(--org-ink)}
 [data-reference-cyclotron-status] .cyclotron-status[data-variant="strip"]>span+span::before{color:var(--org-ink)}
@@ -295,4 +303,17 @@ body:has(.newsroom-organizer)>[data-staging-banner]{flex-shrink:0}
 .news-desk-columns--administration .news-desk-delegation-list li[data-delegation-live=true] .news-desk-delegation-state{font-weight:700;text-decoration:underline;text-underline-offset:4px}
 .news-desk-columns--administration .news-desk-delegation-state{font:600 12px/1.4 Newsroom UI,system-ui,sans-serif;color:var(--administration-strong)}
 .news-desk-columns--administration .news-desk-delegation-confirm{display:flex;flex-wrap:wrap;gap:8px;align-items:center}
+.news-desk-columns--administration .news-desk-delegation-pending-list{list-style:none;margin:0;padding:0;display:grid}
+.news-desk-columns--administration .news-desk-delegation-pending-list li{display:grid;grid-template-columns:minmax(0,1fr) auto auto;gap:12px 24px;align-items:center;padding:16px 0 16px 12px;border-top:1px solid var(--org-line);border-left:3px solid var(--org-ink)}
+.news-desk-columns--administration .news-desk-delegation-pending-list li>div{display:grid;gap:2px}
+.news-desk-columns--administration .news-desk-delegation-pending-list li>div>strong{font:700 18px/1.2 Newsroom Display,Georgia,serif}
+.news-desk-columns--administration .news-desk-delegation-pending-list li>div>span{font:400 13px/1.4 Newsroom UI,system-ui,sans-serif}
+.news-desk-columns--administration .news-desk-delegation-countdown{font-weight:600!important;font-variant-numeric:tabular-nums}
+.news-desk-columns--administration .news-desk-delegation-code{font:700 34px/1.1 ui-monospace,Menlo,monospace;letter-spacing:.14em;color:var(--org-ink);padding:6px 0;border-top:2px solid var(--org-ink);border-bottom:2px solid var(--org-ink)}
+.news-desk-columns--administration .news-desk-delegation-decision{display:flex;gap:8px}
+.news-desk-columns--administration .news-desk-delegation-decision button{min-height:40px;padding:4px 18px;border:1px solid var(--org-ink);border-radius:0;background:transparent;color:var(--org-ink);font:700 12px/1.2 Newsroom UI,system-ui,sans-serif;letter-spacing:.07em;text-transform:uppercase;cursor:pointer}
+.news-desk-columns--administration .news-desk-delegation-decision button:hover:not(:disabled){text-decoration:underline;text-underline-offset:4px}
+.news-desk-columns--administration .news-desk-delegation-decision button:disabled{cursor:default;text-decoration:line-through}
+.news-desk-columns--administration .news-desk-delegation-decision button:focus-visible{outline:2px solid var(--org-ink);outline-offset:2px}
+@container (max-width:640px){.news-desk-columns--administration .news-desk-delegation-pending-list li{grid-template-columns:minmax(0,1fr)}.news-desk-columns--administration .news-desk-delegation-code{font-size:28px}}
 @container (max-width:640px){.news-desk-columns--administration .news-desk-delegation-form{grid-template-columns:minmax(0,1fr)}.news-desk-columns--administration .news-desk-delegation-list li{grid-template-columns:minmax(0,1fr)}}

package/components/prospectus-account-chooser.tsx

@@ -4,9 +4,15 @@ import { useEffect, useState } from "react";
 import { Check } from "lucide-react";
 import { isLocalPreviewEnabled } from "../lib/local-preview";
 import { LOCAL_PREVIEW_TENANTS, getLocalPreviewTenantId, setLocalPreviewTenantId } from "../lib/local-preview-tenant";
-import { loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
+import { createProspectusAccount, loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
+
+/** Local preview: add ?no-accounts=1 to the address to see a signed-in person with no publishing account. */
+function previewHasNoAccounts(): boolean {
+  return typeof window !== "undefined" && new URLSearchParams(window.location.search).has("no-accounts");
+}
 
 function previewAccountState(): ProspectusAccountState {
+  if (previewHasNoAccounts()) return { status: "signedIn", publishingAccounts: [], selectedAccountId: null, cyclotronLabAccess: false };
   return {
     status: "signedIn",
     publishingAccounts: LOCAL_PREVIEW_TENANTS.map(tenant => ({ accountId: tenant.accountId, name: tenant.name, role: tenant.role })),
@@ -50,6 +56,8 @@ export function ProspectusAccountChooser() {
   const [state, setState] = useState<ProspectusAccountState>({ status: "unavailable" });
   const [error, setError] = useState<string | null>(null);
   const [pending, setPending] = useState<string | null>(null);
+  const [creating, setCreating] = useState(false);
+  const [newName, setNewName] = useState("");
   useEffect(() => {
     let cancelled = false;
     const returnPath = `${window.location.pathname}${window.location.search}`;
@@ -76,6 +84,20 @@ export function ProspectusAccountChooser() {
     if ("error" in result) { setError(result.error); return; }
     window.location.reload();
   };
+  const create = async () => {
+    if (pending) return;
+    setPending("create"); setError(null);
+    if (isLocalPreviewEnabled()) {
+      const name = newName.trim() || "New publishing account";
+      setState({ status: "signedIn", publishingAccounts: [{ accountId: "preview-created-account", name, role: "owner" }], selectedAccountId: "preview-created-account", cyclotronLabAccess: false });
+      setPending(null); setCreating(false);
+      return;
+    }
+    const result = await createProspectusAccount(newName);
+    setPending(null);
+    if ("error" in result) { setError(result.error); return; }
+    window.location.reload();
+  };
   return <div className="organizer-account-chooser" data-prospectus-account-chooser="signed-in">
     <p className="organizer-account-chooser-heading">Publishing account</p>
     {state.publishingAccounts.length === 0
@@ -91,6 +113,17 @@ export function ProspectusAccountChooser() {
           </li>;
         })}
       </ul>}
+    {state.publishingAccounts.length === 0 ? (
+      creating
+        ? <form className="organizer-account-create" data-prospectus-create-account onSubmit={event => { event.preventDefault(); void create(); }}>
+          <label>Account name<input autoFocus disabled={pending !== null} maxLength={80} onChange={event => setNewName(event.target.value)} placeholder="Optional" type="text" value={newName} /></label>
+          <span>
+            <button data-prospectus-create-account-submit disabled={pending !== null} type="submit">{pending === "create" ? "Creating…" : "Create account"}</button>
+            <button disabled={pending !== null} onClick={() => setCreating(false)} type="button">Cancel</button>
+          </span>
+        </form>
+        : <button className="organizer-account-create-start" data-prospectus-create-account-start onClick={() => setCreating(true)} type="button">Create publishing account</button>
+    ) : null}
     {!state.selectedAccountId && state.publishingAccounts.length > 0 ? <p className="organizer-account-chooser-note">Choose the account you are working as.</p> : null}
     {state.cyclotronLabAccess ? <p className="organizer-account-chooser-note" data-cyclotron-lab-access>Cyclotron lab access is on for you.</p> : null}
     {error ? <p className="organizer-account-chooser-note" role="alert">{error}</p> : null}

package/infra/amplify-app-shell.js

@@ -43,11 +43,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config) {
+    if (config.repositoryAccessTokenSecretArn === undefined)
+        return {};
+    return {
+        repository: config.repository,
+        accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+    };
+}
 export class AmplifyAppShellStack extends Stack {
     cmsAppId;
     readerAppId;
@@ -114,7 +125,9 @@ export class AmplifyAppShellStack extends Stack {
                 resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
             }));
         }
+        const repositoryConnection = repositoryConnectionProperties(config);
         const cmsApp = new amplify.CfnApp(this, "App", {
+            ...repositoryConnection,
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
             platform: "WEB_COMPUTE",
@@ -332,6 +345,7 @@ export class AmplifyAppShellStack extends Stack {
             resources: ["arn:aws:s3:::amplify-*/media/*"],
         }));
         const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+            ...repositoryConnectionProperties(config),
             name: readerAppName,
             description: `Papyrus static reader for ${config.siteId} (WEB)`,
             platform: "WEB",

package/infra/amplify-app-shell.ts

@@ -46,11 +46,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config: AmplifyAppShellSiteConfig): { repository?: string; accessToken?: string } {
+  if (config.repositoryAccessTokenSecretArn === undefined) return {};
+  return {
+    repository: config.repository,
+    accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+  };
+}
+
 export class AmplifyAppShellStack extends Stack {
   public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
@@ -130,7 +141,10 @@ export class AmplifyAppShellStack extends Stack {
       );
     }
 
+    const repositoryConnection = repositoryConnectionProperties(config);
+
     const cmsApp = new amplify.CfnApp(this, "App", {
+      ...repositoryConnection,
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
       platform: "WEB_COMPUTE",
@@ -389,6 +403,7 @@ export class AmplifyAppShellStack extends Stack {
     );
 
     const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+      ...repositoryConnectionProperties(config),
       name: readerAppName,
       description: `Papyrus static reader for ${config.siteId} (WEB)`,
       platform: "WEB",

package/infra/site-config.js

@@ -5,6 +5,7 @@ export function hasCmsApp(config) {
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -297,9 +298,12 @@ function validateOauthRedirectUrls(config) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+    const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+        ? undefined
+        : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
     const brand = requireString(record.brand, "brand");
     const frontend = requireString(record.frontend, "frontend");
     if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -382,6 +386,7 @@ export function parseSiteConfig(raw) {
     const config = {
         siteId,
         repository,
+        repositoryAccessTokenSecretArn,
         brand,
         frontend,
         hostedZoneId,

package/infra/site-config.ts

@@ -47,6 +47,7 @@ export type CmsConfig = {
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
+  repositoryAccessTokenSecretArn?: string;
   brand: string;
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
@@ -85,6 +86,7 @@ export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -392,12 +394,15 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
     "site",
   );
 
   const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
   const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+  const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+    ? undefined
+    : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
   const brand = requireString(record.brand, "brand");
   const frontend = requireString(record.frontend, "frontend");
   if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -480,6 +485,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const config: AmplifyAppShellSiteConfig = {
     siteId,
     repository,
+    repositoryAccessTokenSecretArn,
     brand,
     frontend,
     hostedZoneId,