@anthusai/papyrus 1.15.0 → 1.17.0

package/amplify/functions/console-chat-responder/src/main.rs

@@ -2190,7 +2190,7 @@ fn build_openai_messages(
 ) -> Vec<Value> {
     let mut messages = vec![json!({
         "role": "system",
-        "content": "You are Papyrus, an editorial assistant for an autonomous newsroom. Be concise, accurate, and concrete. Raw console chat turns are working memory and are excluded from default semantic searches unless explicitly requested. When a chat produces durable note, recommend creating a note Message instead of making every chat turn canonical knowledge. Use execute_tactus for Papyrus runtime work. Distinguish references from assignments: Reference.* is for scholarly sources; Assignment.* is for newsroom work items (research, curation, intake). When the user provides a URL and asks to add, register, or file a reference, immediately call Reference.create{ url = \"<url>\", title = \"<optional>\", apply = true }—do not use Reference.register, papyrus.reference.create, or Assignment.create unless they asked for research work. For \"most recent references\" or similar, immediately call Reference.list{ limit = <count>, order = \"newest\" } and summarize. For \"last/latest/most recent research assignment\" (or \"research assignment\" without a specific id), immediately call Assignment.list{ type = \"research\", limit = 1 } (includes research.edition-candidate, research.tavily-deep, and other research.* types), then Assignment.get{ id = \"<that id>\" } if the user wants detail—do not use Reference.list and do not list all assignment types (curation.reference-intake is not a research assignment). To create research work, use Assignment.create{ type = \"research\", title = \"...\", apply = true }."
+        "content": "You are Papyrus, an editorial assistant for an autonomous newsroom. Be concise, accurate, and concrete. Raw console chat turns are working memory and are excluded from default semantic searches unless explicitly requested. When a chat produces durable note, recommend creating a note Message instead of making every chat turn canonical knowledge. Use execute_tactus for Papyrus runtime work. Distinguish references from assignments: Reference.* is for scholarly sources; Assignment.* is for newsroom work items (research, curation, intake). When the user provides a URL and asks to add, register, or file a reference, immediately call Reference.create{ url = \"<url>\", title = \"<optional>\", apply = true }—do not use Reference.register, papyrus.reference.create, or Assignment.create unless they asked for research work. For \"most recent references\" or similar, immediately call Reference.list{ limit = <count>, order = \"newest\" } and summarize. For \"last/latest/most recent research assignment\" (or \"research assignment\" without a specific id), immediately call Assignment.list{ type = \"research\", limit = 1 } (includes research.candidate, research.tavily-deep, and other research.* types), then Assignment.get{ id = \"<that id>\" } if the user wants detail—do not use Reference.list and do not list all assignment types (curation.reference-intake is not a research assignment). To create research work, use Assignment.create{ type = \"research\", title = \"...\", apply = true }."
     })];
     if !static_prompt.publication_mission.trim().is_empty() {
         messages.push(json!({

package/app/[year]/[month]/[day]/[articleSlug]/page.tsx

@@ -3,7 +3,7 @@ import { getSiteRenderer } from "../../../../../lib/site-renderer";
 import { getCachedEditionItem, loadCachedEditionContent } from "../../../../../lib/cached-content-repository";
 import { getEditionDatePath, parseEditionArticleRoute } from "../../../../../lib/edition-routes";
 import { buildPresentationFooterEntries } from "../../../../../lib/presentation-footer";
-import { SITE_BRAND } from "../../../../../lib/site-brand";
+import { SITE_BRAND, editionsEnabled } from "../../../../../lib/site-brand";
 import { generateEditionItemStaticParams } from "../../../../../lib/reader-static-params";
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
 export const revalidate = 60;
@@ -39,6 +39,7 @@ export async function generateMetadata({ params }: DateScopedArticlePageProps) {
 }
 
 export default async function DateScopedArticlePage({ params }: DateScopedArticlePageProps) {
+  if (!editionsEnabled()) notFound();
   const { year, month, day, articleSlug } = await params;
   const route = parseEditionArticleRoute({ year, month, day, articleSlug });
   if (!route) notFound();

package/app/[year]/[month]/[day]/edition-route-page.tsx

@@ -1,4 +1,5 @@
 import { notFound, redirect } from "next/navigation";
+import { editionsEnabled } from "../../../../lib/site-brand";
 import { siteServesNextReaderRoutes } from "../../../../lib/reader-static-params";
 import { getSiteRenderer } from "../../../../lib/site-renderer";
 import type { PresentationTarget } from "../../../../renderers/pretext";
@@ -23,7 +24,7 @@ export async function EditionRoutePage({
   lockedPresentation,
   target = { kind: "edition" },
 }: EditionRoutePageProps) {
-  if (!siteServesNextReaderRoutes()) notFound();
+  if (!editionsEnabled() || !siteServesNextReaderRoutes()) notFound();
   const route = parseEditionDateRoute({ year, month, day });
   if (!route) notFound();
   if (!route.isCanonical) redirect(route.canonicalPath);

package/app/[year]/[month]/[day]/page/[pageNumber]/page.tsx

@@ -1,7 +1,7 @@
 import { notFound, redirect } from "next/navigation";
 import { EditionRoutePage } from "../../edition-route-page";
 import { parseEditionPageRoute } from "../../../../../../lib/edition-routes";
-import { getDefaultPretextLayout, getForcedPresentation } from "../../../../../../lib/site-brand";
+import { editionsEnabled, getDefaultPretextLayout, getForcedPresentation } from "../../../../../../lib/site-brand";
 import { generateEditionPageStaticParams } from "../../../../../../lib/reader-static-params";
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
 export const revalidate = 60;
@@ -20,6 +20,7 @@ type EditionPageRouteProps = {
 };
 
 export default async function EditionPageRoute({ params }: EditionPageRouteProps) {
+  if (!editionsEnabled()) notFound();
   const { year, month, day, pageNumber } = await params;
   const route = parseEditionPageRoute({ year, month, day, pageNumber });
   if (!route) notFound();

package/app/[year]/[month]/[day]/page.tsx

@@ -1,3 +1,5 @@
+import { notFound } from "next/navigation";
+import { editionsEnabled } from "../../../../lib/site-brand";
 import { EditionRoutePage } from "./edition-route-page";
 import { generateEditionDateStaticParams } from "../../../../lib/reader-static-params";
 
@@ -17,6 +19,7 @@ type DateEditionPageProps = {
 };
 
 export default async function DateEditionPage({ params }: DateEditionPageProps) {
+  if (!editionsEnabled()) notFound();
   const { year, month, day } = await params;
   return <EditionRoutePage day={day} month={month} year={year} />;
 }

package/app/[year]/[month]/[day]/section/[sectionKey]/page.tsx

@@ -2,6 +2,7 @@ import { notFound, redirect } from "next/navigation";
 import { EditionRoutePage } from "../../edition-route-page";
 import { createSectionKey } from "../../../../../../lib/edition-sections";
 import { parseEditionSectionRoute } from "../../../../../../lib/edition-routes";
+import { editionsEnabled } from "../../../../../../lib/site-brand";
 import { generateEditionSectionStaticParams } from "../../../../../../lib/reader-static-params";
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
 export const revalidate = 60;
@@ -20,6 +21,7 @@ type EditionSectionRouteProps = {
 };
 
 export default async function EditionSectionRoute({ params }: EditionSectionRouteProps) {
+  if (!editionsEnabled()) notFound();
   const { year, month, day, sectionKey } = await params;
   const normalizedSectionKey = createSectionKey(sectionKey);
   const route = parseEditionSectionRoute({ year, month, day, sectionKey: normalizedSectionKey });

package/app/api/archive/editions/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { editionsEnabled } from "../../../../lib/site-brand";
 import { loadArchiveEditionPreviews, clampArchiveLimit } from "../../../../lib/archive-data";
 import { ARCHIVE_BATCH_SIZE } from "../../../../lib/archive-types";
 
@@ -6,6 +7,7 @@ import { ARCHIVE_BATCH_SIZE } from "../../../../lib/archive-types";
 export const revalidate = 60;
 
 export async function GET(request: Request) {
+  if (!editionsEnabled()) return new NextResponse(null, { status: 404 });
   const url = new URL(request.url);
   const cursor = url.searchParams.get("cursor");
   const requestedLimit = Number(url.searchParams.get("limit") ?? ARCHIVE_BATCH_SIZE);

package/app/archive/page.tsx

@@ -1,3 +1,5 @@
+import { notFound } from "next/navigation";
+import { editionsEnabled } from "../../lib/site-brand";
 import { ArchiveShell } from "../../components/archive-shell";
 import { ArchiveGrid } from "../../components/archive-grid";
 import { loadArchiveEditionPreviews } from "../../lib/archive-data";
@@ -7,6 +9,7 @@ import { ARCHIVE_BATCH_SIZE } from "../../lib/archive-types";
 export const revalidate = 60;
 
 export default async function ArchivePage() {
+  if (!editionsEnabled()) notFound();
   const initialBatch = await loadArchiveEditionPreviews({ limit: ARCHIVE_BATCH_SIZE });
 
   return (

package/app/page.tsx

@@ -15,7 +15,10 @@ import {
   type PublicPlaceholderTopic,
 } from "../lib/public-placeholder-config";
 import type { PublicationItem } from "../lib/publication-items";
-import { SITE_BRAND, rootRoute } from "../lib/site-brand";
+import { SITE_BRAND, editionsEnabled, rootRoute } from "../lib/site-brand";
+import { ItemStreamView } from "../components/item-stream-view";
+import { ITEM_STREAM_RECENT_EDITION_COUNT, buildItemStream, selectNewestStreamItems } from "../lib/item-stream";
+import { listCachedPublishedEditions } from "../lib/cached-content-repository";
 import { notFound, redirect } from "next/navigation";
 import { getReaderBasePath } from "../lib/reader-base-path";
 import { buildRootRedirectTarget } from "../lib/root-route-redirect";
@@ -27,6 +30,7 @@ export const dynamic = "force-dynamic";
 type HomePageProps = {
   searchParams?: Promise<{
     scenario?: string | string[];
+    section?: string | string[];
     code?: string | string[];
     state?: string | string[];
     error?: string | string[];
@@ -59,6 +63,13 @@ export default async function Home({ searchParams }: HomePageProps) {
     notFound();
   }
 
+  if (!editionsEnabled()) {
+    const sectionParam = resolvedSearchParams?.section;
+    const sectionKey = Array.isArray(sectionParam) ? sectionParam[0] : sectionParam;
+    const items = await loadNewestStreamItemsOrNone();
+    return <ItemStreamView stream={buildItemStream(items, sectionKey)} />;
+  }
+
   // Resolved only on the reader path: Markus brands (renderer "markus") have
   // no Next.js reader and getSiteRenderer() throws for them, but they can
   // still serve the newsroom at the root via rootRoute above.
@@ -88,6 +99,24 @@ export default async function Home({ searchParams }: HomePageProps) {
   return <siteRenderer.renderEdition content={content} />;
 }
 
+async function loadNewestStreamItemsOrNone() {
+  try {
+    return await loadNewestStreamItems();
+  } catch (error) {
+    if (!isMissingReaderBackendError(error)) throw error;
+    return [];
+  }
+}
+
+async function loadNewestStreamItems() {
+  const { editions } = await listCachedPublishedEditions({ limit: ITEM_STREAM_RECENT_EDITION_COUNT });
+  const newestFirst = [...editions].sort((left, right) => right.editionDate.localeCompare(left.editionDate));
+  const contents = await Promise.all(
+    newestFirst.map((edition) => loadCachedEditionContent({ editionDate: edition.editionDate })),
+  );
+  return selectNewestStreamItems(contents);
+}
+
 async function loadLatestGraphQLEdition(): Promise<EditionContent | null> {
   const latestEdition = await getCachedLatestPublishedEdition();
   if (!latestEdition) return null;

package/components/item-stream-view.tsx

@@ -0,0 +1,63 @@
+import Link from "next/link";
+import type { ItemStream } from "../lib/item-stream";
+import { toPublicReaderPath } from "../lib/reader-base-path";
+import { SITE_BRAND } from "../lib/site-brand";
+
+/** The home of a publication without editions: a masthead, section filters and the newest items. */
+export function ItemStreamView({ stream }: { stream: ItemStream }) {
+  const homePath = toPublicReaderPath("/");
+  const tagline = SITE_BRAND.mastheadTagline ?? null;
+
+  return (
+    <main className="presentation-page presentation-page--blog" data-presentation-engine="item-stream">
+      <header className="presentation-header">
+        <div className="presentation-header__copy-stack">
+          <h1>
+            <Link href={homePath}>{SITE_BRAND.mastheadTitle}</Link>
+          </h1>
+          <div className="presentation-header__meta">
+            <span className="presentation-header__subtitle">{SITE_BRAND.mastheadSubtitle}</span>
+          </div>
+          {tagline ? <span className="presentation-header__tagline">{tagline}</span> : null}
+        </div>
+      </header>
+      {stream.sections.length > 1 ? (
+        <nav className="presentation-section-nav" aria-label="Sections">
+          <Link href={homePath} aria-current={stream.activeSectionKey === null ? "page" : undefined}>
+            All
+          </Link>
+          {stream.sections.map((section) => (
+            <Link
+              aria-current={stream.activeSectionKey === section.key ? "page" : undefined}
+              href={`${homePath}?section=${encodeURIComponent(section.key)}`}
+              key={section.key}
+            >
+              {section.label}
+            </Link>
+          ))}
+        </nav>
+      ) : null}
+      {stream.items.length === 0 ? (
+        <section className="item-stream-empty" data-item-stream-empty="true">
+          <p>Nothing published yet</p>
+        </section>
+      ) : (
+        <div className="blog-sections">
+          {stream.items.map((item) => (
+            <article className="presentation-item presentation-item--blog" data-item-id={item.slug} key={item.slug}>
+              <div className="presentation-item__copy">
+                <header className="presentation-item__header">
+                  <p>{item.section ?? "General"}</p>
+                  <h2>
+                    <Link href={toPublicReaderPath(`/articles/${encodeURIComponent(item.slug)}`)}>{item.headline}</Link>
+                  </h2>
+                  {item.deck ? <span>{item.deck}</span> : null}
+                </header>
+              </div>
+            </article>
+          ))}
+        </div>
+      )}
+    </main>
+  );
+}

package/components/newsroom-assignments-view.tsx

@@ -117,7 +117,7 @@ function AssignmentDetailPanel({
   detailExtras?: ReactNode;
 }) {
   const terminal = assignment.status === "completed" || assignment.status === "canceled";
-  const isReporting = assignment.assignmentTypeKey === "reporting.edition-candidate";
+  const isReporting = assignment.assignmentTypeKey === "reporting.candidate";
 
   return (
     <div

package/components/topic-steering-workspace.tsx

@@ -12368,7 +12368,7 @@ function ReportingStoryBudgetBoard({
           section={section}
           selectedAssignmentId={selectedAssignmentId}
         />
-      )) : <EmptyRow label="No reporting edition-candidate assignments found" />}
+      )) : <EmptyRow label="No reporting candidate assignments found" />}
     </div>
   );
 }
@@ -14568,7 +14568,7 @@ function buildUiReportingPacketReviewPlan({
   event: AssignmentEventRecord;
   relations: SemanticRelationRecord[];
 } {
-  if (assignment.assignmentTypeKey !== "reporting.edition-candidate") throw new Error("Only reporting edition-candidate assignments can review reporting packets.");
+  if (assignment.assignmentTypeKey !== "reporting.candidate") throw new Error("Only reporting candidate assignments can review reporting packets.");
   if (message.messageKind !== "reporting_context_packet") throw new Error("Only reporting context packets can be reviewed.");
   if (decision === "merge" && !targetItem?.id && !targetItemId.trim()) throw new Error("Merge Packet requires a target Item ID.");
   const resolvedTargetItem = targetItem ?? (targetItemId.trim() ? { id: targetItemId.trim(), lineageId: targetItemId.trim(), versionNumber: null } : null);

package/infra/amplify-app-shell.js

@@ -43,11 +43,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config) {
+    if (config.repositoryAccessTokenSecretArn === undefined)
+        return {};
+    return {
+        repository: config.repository,
+        accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+    };
+}
 export class AmplifyAppShellStack extends Stack {
     cmsAppId;
     readerAppId;
@@ -114,7 +125,9 @@ export class AmplifyAppShellStack extends Stack {
                 resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
             }));
         }
+        const repositoryConnection = repositoryConnectionProperties(config);
         const cmsApp = new amplify.CfnApp(this, "App", {
+            ...repositoryConnection,
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
             platform: "WEB_COMPUTE",
@@ -332,6 +345,7 @@ export class AmplifyAppShellStack extends Stack {
             resources: ["arn:aws:s3:::amplify-*/media/*"],
         }));
         const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+            ...repositoryConnectionProperties(config),
             name: readerAppName,
             description: `Papyrus static reader for ${config.siteId} (WEB)`,
             platform: "WEB",

package/infra/amplify-app-shell.ts

@@ -46,11 +46,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config: AmplifyAppShellSiteConfig): { repository?: string; accessToken?: string } {
+  if (config.repositoryAccessTokenSecretArn === undefined) return {};
+  return {
+    repository: config.repository,
+    accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+  };
+}
+
 export class AmplifyAppShellStack extends Stack {
   public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
@@ -130,7 +141,10 @@ export class AmplifyAppShellStack extends Stack {
       );
     }
 
+    const repositoryConnection = repositoryConnectionProperties(config);
+
     const cmsApp = new amplify.CfnApp(this, "App", {
+      ...repositoryConnection,
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
       platform: "WEB_COMPUTE",
@@ -389,6 +403,7 @@ export class AmplifyAppShellStack extends Stack {
     );
 
     const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+      ...repositoryConnectionProperties(config),
       name: readerAppName,
       description: `Papyrus static reader for ${config.siteId} (WEB)`,
       platform: "WEB",

package/infra/site-config.js

@@ -5,6 +5,7 @@ export function hasCmsApp(config) {
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -297,9 +298,12 @@ function validateOauthRedirectUrls(config) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+    const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+        ? undefined
+        : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
     const brand = requireString(record.brand, "brand");
     const frontend = requireString(record.frontend, "frontend");
     if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -382,6 +386,7 @@ export function parseSiteConfig(raw) {
     const config = {
         siteId,
         repository,
+        repositoryAccessTokenSecretArn,
         brand,
         frontend,
         hostedZoneId,

package/infra/site-config.ts

@@ -47,6 +47,7 @@ export type CmsConfig = {
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
+  repositoryAccessTokenSecretArn?: string;
   brand: string;
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
@@ -85,6 +86,7 @@ export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -392,12 +394,15 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
     "site",
   );
 
   const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
   const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+  const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+    ? undefined
+    : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
   const brand = requireString(record.brand, "brand");
   const frontend = requireString(record.frontend, "frontend");
   if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -480,6 +485,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const config: AmplifyAppShellSiteConfig = {
     siteId,
     repository,
+    repositoryAccessTokenSecretArn,
     brand,
     frontend,
     hostedZoneId,

package/lib/category-repository.ts

@@ -1510,7 +1510,7 @@ export function createDemoCategorySteeringDashboard(
     assignments: [
       {
         id: assignmentReportingId,
-        assignmentTypeKey: "reporting.edition-candidate",
+        assignmentTypeKey: "reporting.candidate",
         queueKey: "edition:edition-demo:section:news:lane:reporting",
         queueStatusKey: "edition:edition-demo:section:news:lane:reporting#open",
         status: "open",

package/lib/item-stream.ts

@@ -0,0 +1,47 @@
+import type { EditionContent, EditionSection } from "./content-types";
+import { createEditionSectionPlan, createSectionKey } from "./edition-sections";
+import { getArticlePublicationItems, type ArticlePublicationItem } from "./publication-items";
+
+export const ITEM_STREAM_RECENT_EDITION_COUNT = 10;
+export const ITEM_STREAM_ITEM_LIMIT = 50;
+
+export type ItemStream = {
+  items: ArticlePublicationItem[];
+  sections: EditionSection[];
+  activeSectionKey: string | null;
+};
+
+/**
+ * Flattens published content into one newest-first stream of articles. The
+ * input is ordered newest first; a slug that appears twice keeps its newest entry.
+ */
+export function selectNewestStreamItems(
+  newestFirstContents: EditionContent[],
+  limit: number = ITEM_STREAM_ITEM_LIMIT,
+): ArticlePublicationItem[] {
+  const seenSlugs = new Set<string>();
+  const selected: ArticlePublicationItem[] = [];
+  for (const content of newestFirstContents) {
+    for (const item of getArticlePublicationItems(content.items)) {
+      if (seenSlugs.has(item.slug)) continue;
+      seenSlugs.add(item.slug);
+      selected.push(item);
+      if (selected.length >= limit) return selected;
+    }
+  }
+  return selected;
+}
+
+/** Builds the stream view: the sections found in the items, and the items filtered by an optional section key. */
+export function buildItemStream(items: ArticlePublicationItem[], sectionKey?: string | null): ItemStream {
+  const sections = createEditionSectionPlan(items);
+  const activeSectionKey = sectionKey ? createSectionKey(sectionKey) : null;
+  const activeSection = activeSectionKey ? sections.find((section) => section.key === activeSectionKey) : undefined;
+  if (!activeSection) return { items, sections, activeSectionKey: null };
+  const itemIds = new Set(activeSection.itemIds);
+  return {
+    items: items.filter((item) => itemIds.has(item.slug)),
+    sections,
+    activeSectionKey: activeSection.key,
+  };
+}

package/lib/newsroom-assignments.ts

@@ -41,7 +41,7 @@ export function formatAssignmentTypeLabel(typeKey: string | null | undefined): s
   if (key === "analysis.reindex") return "Analysis re-index";
   if (key === "newsroom.research" || key === "research") return "Research";
   if (key === "curation.reference-intake") return "Reference intake";
-  if (key === "reporting.edition-candidate") return "Reporting candidate";
+  if (key === "reporting.candidate") return "Reporting candidate";
   return key
     .split(/[.:_-]+/)
     .filter(Boolean)

package/lib/newsroom-demo-dashboard.ts

@@ -194,7 +194,7 @@ export function applyPilobolusDemoDashboardContent(
   });
 
   localized.assignments = localized.assignments.map((assignment, index) => {
-    if (assignment.assignmentTypeKey === "reporting.edition-candidate") {
+    if (assignment.assignmentTypeKey === "reporting.candidate") {
       return {
         ...assignment,
         title: "Field-notes reporting candidate 1: Strangler-fig control-loop shift",

package/lib/reader-static-params.ts

@@ -1,6 +1,6 @@
 import type { ContentRepository, EditionContent } from "./content-types";
 import { graphqlContentRepository } from "./graphql-content-repository";
-import { SITE_BRAND } from "./site-brand";
+import { SITE_BRAND, editionsEnabled } from "./site-brand";
 import { getContentSource } from "./site-env";
 import type { RendererConfig } from "./renderer-config";
 
@@ -40,6 +40,7 @@ const RESERVED_DATE_CHILD_SEGMENTS = new Set(["page", "section"]);
 type EnumerationRepository = Pick<ContentRepository, "listPublishedEditions" | "loadEditionContent">;
 
 function shouldEnumerateAtBuild(): boolean {
+  if (!editionsEnabled()) return false;
   if (process.env.NODE_ENV === "development") return false;
   return siteEnumeratesReaderRoutesAtBuild();
 }

package/lib/reporting-story-budget.ts

@@ -106,7 +106,7 @@ export type ReportingStoryBudgetInput = {
   messagePayloads?: Record<string, unknown>;
 };
 
-const REPORTING_ASSIGNMENT_TYPE = "reporting.edition-candidate";
+const REPORTING_ASSIGNMENT_TYPE = "reporting.candidate";
 const REPORTING_PACKET_KIND = "reporting_context_packet";
 const RESEARCH_PACKET_KIND = "research_packet";
 
@@ -331,7 +331,7 @@ function buildResearchPacketIdsByReportingAssignment(assignments: AssignmentReco
     if (relation.subjectKind === "assignment" && relation.objectKind === "assignment") {
       const reporting = assignmentById.get(relation.subjectId);
       const research = assignmentById.get(relation.objectId);
-      if (reporting?.assignmentTypeKey !== REPORTING_ASSIGNMENT_TYPE || research?.assignmentTypeKey !== "research.edition-candidate") continue;
+      if (reporting?.assignmentTypeKey !== REPORTING_ASSIGNMENT_TYPE || research?.assignmentTypeKey !== "research.candidate") continue;
       for (const packetId of producedResearchPacketsByAssignment.get(research.id) ?? []) {
         result.set(reporting.id, addToSet(result.get(reporting.id), packetId));
       }

package/lib/site-brand.ts

@@ -1,4 +1,5 @@
 import { isLocalPreviewEnabled } from "./local-preview";
+import { areEditionsEnabled } from "./site-env";
 import type { ComponentType } from "react";
 import type { EditionPresentationFormat } from "./content-types";
 import type { Article, ArticleVideoAsset } from "./articles";
@@ -157,6 +158,11 @@ export type SiteBrand = {
   fonts?: SiteBrandFont[];
   demoEdition?: SiteBrandDemoEdition;
   video?: SiteBrandVideo;
+  /**
+   * Editions are an optional setting, off unless `{ enabled: true }`. When off the
+   * publication is a plain stream of items: no edition date routes, archive or masthead date.
+   */
+  editions?: { enabled: boolean };
 };
 
 const SERIF_TEXT_FONT = 'Georgia, "Times New Roman", serif';
@@ -253,6 +259,11 @@ export function getRootRoute(brand: SiteBrand = SITE_BRAND): RootRouteConfig {
 
 export const rootRoute = getRootRoute();
 
+/** The brand setting wins when present; otherwise the PAPYRUS_EDITIONS_ENABLED switch decides. */
+export function editionsEnabled(brand: Pick<SiteBrand, "editions"> = SITE_BRAND): boolean {
+  return brand.editions?.enabled ?? areEditionsEnabled();
+}
+
 export function enforcePresentation(presentation: EditionPresentationFormat): EditionPresentationFormat {
   return SITE_BRAND.forcedPresentation ?? presentation;
 }

package/lib/site-env.ts

@@ -20,6 +20,11 @@ export function getSiteEnv(environment: EnvironmentVariables = process.env): Sit
   return configured as SiteEnv;
 }
 
+export function areEditionsEnabled(environment: EnvironmentVariables = process.env): boolean {
+  const configured = (environment.PAPYRUS_EDITIONS_ENABLED ?? "").trim().toLowerCase();
+  return configured === "true" || configured === "1" || configured === "yes" || configured === "on";
+}
+
 export function getContentSource(environment: EnvironmentVariables = process.env): ContentSource {
   const configured = (environment.PAPYRUS_CONTENT_SOURCE ?? "").trim();
   if (!configured) return "published";

package/package.json

@@ -78,6 +78,7 @@
     "./components/blog-page-background": "./components/blog-page-background.tsx",
     "./components/curation-delegation-client": "./components/curation-delegation-client.ts",
     "./components/dev-sandbox-editor-sign-in": "./components/dev-sandbox-editor-sign-in.tsx",
+    "./components/item-stream-view": "./components/item-stream-view.tsx",
     "./components/markus-ir-preview": "./components/markus-ir-preview.tsx",
     "./components/news-desk-client-provider": "./components/news-desk-client-provider.tsx",
     "./components/news-desk-page": "./components/news-desk-page.tsx",
@@ -191,6 +192,7 @@
     "./lib/furniture": "./lib/furniture.ts",
     "./lib/graphql-content-repository": "./lib/graphql-content-repository.ts",
     "./lib/image-url": "./lib/image-url.ts",
+    "./lib/item-stream": "./lib/item-stream.ts",
     "./lib/labels": "./lib/labels.ts",
     "./lib/layout-config": "./lib/layout-config.ts",
     "./lib/layout-plan": "./lib/layout-plan.ts",
@@ -377,7 +379,7 @@
       "optional": true
     }
   },
-  "version": "1.15.0",
+  "version": "1.17.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.15.0",
+  "version": "1.17.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",