@anthusai/papyrus 1.3.0 → 1.4.0-next.10

package/components/ui/sheet.tsx

@@ -11,9 +11,9 @@ type SheetSide = "bottom" | "left" | "right";
 
 const sideClasses: Record<SheetSide, string> = {
   bottom:
-    "inset-x-0 bottom-0 top-auto max-h-[85dvh] w-full rounded-t-2xl border-t data-open:slide-in-from-bottom data-closed:slide-out-to-bottom",
-  left: "inset-y-0 left-0 h-full w-[min(100vw,20rem)] rounded-r-2xl border-r data-open:slide-in-from-left data-closed:slide-out-to-left",
-  right: "inset-y-0 right-0 h-full w-[min(100vw,20rem)] rounded-l-2xl border-l data-open:slide-in-from-right data-closed:slide-out-to-right",
+    "inset-x-0 bottom-0 top-auto max-h-[85dvh] w-full border-t data-open:slide-in-from-bottom data-closed:slide-out-to-bottom",
+  left: "inset-y-0 left-0 h-full w-[min(100vw,20rem)] border-r data-open:slide-in-from-left data-closed:slide-out-to-left",
+  right: "inset-y-0 right-0 h-full w-[min(100vw,20rem)] border-l data-open:slide-in-from-right data-closed:slide-out-to-right",
 };
 
 function Sheet({ ...props }: DialogPrimitive.Root.Props) {
@@ -31,17 +31,23 @@ function SheetClose({ ...props }: DialogPrimitive.Close.Props) {
 function SheetContent({
   children,
   className,
+  backdropClassName,
   showCloseButton = true,
   side = "bottom",
   ...props
 }: DialogPrimitive.Popup.Props & {
+  backdropClassName?: string;
   showCloseButton?: boolean;
   side?: SheetSide;
 }) {
   return (
     <DialogPrimitive.Portal>
       <DialogPrimitive.Backdrop
-        className="fixed inset-0 z-50 bg-black/40 data-open:animate-in data-open:fade-in-0 data-closed:animate-out data-closed:fade-out-0"
+        className={cn(
+          "fixed inset-0 z-50 bg-black/40 data-open:animate-in data-open:fade-in-0 data-closed:animate-out data-closed:fade-out-0",
+          typeof className === "string" && className.includes("md:hidden") && "md:hidden",
+          backdropClassName,
+        )}
       />
       <DialogPrimitive.Popup
         className={cn(

package/components/use-paged-content-item-versions.ts

@@ -0,0 +1,151 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import {
+  canonicalContentItemStage,
+  legacyStageKeysToLoad,
+  type ContentItemVersionRecord,
+} from "../lib/content-item-lifecycle";
+import { getContentItemStageDefinitions } from "../lib/site-brand";
+import { loadNewsroomContentItemStagePage } from "./news-desk-taxonomy-client";
+
+const REFRESH_INTERVAL_MILLISECONDS = 30_000;
+
+type StageBucket = {
+  versions: ContentItemVersionRecord[];
+  nextToken: string | null;
+  pagesLoaded: number;
+};
+
+export type PagedContentItemVersions = {
+  versions: ContentItemVersionRecord[];
+  loading: boolean;
+  error: string | null;
+  stageHasMore: (canonicalStage: string) => boolean;
+  loadMoreForStage: (canonicalStage: string) => void;
+};
+
+function mergeFreshFirstPage(existing: StageBucket | undefined, fresh: StageBucket): StageBucket {
+  if (!existing || existing.pagesLoaded <= 1) return fresh;
+  const freshIds = new Set(fresh.versions.map(version => version.id));
+  return {
+    versions: [...fresh.versions, ...existing.versions.filter(version => !freshIds.has(version.id))],
+    nextToken: existing.nextToken,
+    pagesLoaded: existing.pagesLoaded,
+  };
+}
+
+/**
+ * Newest-updated content items per stage, one page per stage to start, more pages on demand.
+ * The periodic refresh re-fetches only first pages and keeps whatever later pages were already loaded.
+ */
+export function usePagedContentItemVersions(options: {
+  enabled: boolean;
+  openedCollapsedUntilOpenedStages: readonly string[];
+}): PagedContentItemVersions {
+  const { enabled, openedCollapsedUntilOpenedStages } = options;
+  const [buckets, setBuckets] = useState<Record<string, StageBucket>>({});
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const bucketsRef = useRef(buckets);
+  const stageKeysBeingExtendedRef = useRef(new Set<string>());
+  const generationRef = useRef(0);
+
+  const openedStagesSignature = openedCollapsedUntilOpenedStages.join(",");
+  const stageKeysToLoad = useMemo(() => {
+    const stageDefinitions = getContentItemStageDefinitions();
+    return [
+      ...stageDefinitions
+        .filter(definition => !definition.collapsedUntilOpened || openedStagesSignature.split(",").includes(definition.key))
+        .map(definition => definition.key),
+      ...legacyStageKeysToLoad(stageDefinitions),
+    ];
+  }, [openedStagesSignature]);
+  const stageKeysToLoadRef = useRef(stageKeysToLoad);
+  stageKeysToLoadRef.current = stageKeysToLoad;
+
+  const storeBuckets = useCallback((update: (previous: Record<string, StageBucket>) => Record<string, StageBucket>) => {
+    const next = update(bucketsRef.current);
+    bucketsRef.current = next;
+    setBuckets(next);
+  }, []);
+
+  const refreshFirstPages = useCallback(async (request: number, isInitial: boolean, stageKeys: readonly string[]) => {
+    if (isInitial) setLoading(true);
+    try {
+      const freshBuckets = await Promise.all(stageKeys.map(async stageKey => {
+        const page = await loadNewsroomContentItemStagePage(stageKey);
+        return [stageKey, { versions: page.versions, nextToken: page.nextToken, pagesLoaded: 1 }] as const;
+      }));
+      if (generationRef.current !== request) return;
+      storeBuckets(previous => {
+        const next = { ...previous };
+        for (const [stageKey, fresh] of freshBuckets) next[stageKey] = mergeFreshFirstPage(previous[stageKey], fresh);
+        return next;
+      });
+      setError(null);
+    } catch (reason: unknown) {
+      if (generationRef.current === request && isInitial) setError(reason instanceof Error ? reason.message : "Could not load newsroom records.");
+    } finally {
+      if (generationRef.current === request && isInitial) setLoading(false);
+    }
+  }, [storeBuckets]);
+
+  useEffect(() => {
+    const request = ++generationRef.current;
+    bucketsRef.current = {};
+    setBuckets({});
+    setError(null);
+    if (!enabled) { setLoading(false); return; }
+    void refreshFirstPages(request, true, stageKeysToLoadRef.current);
+    const refreshWhenVisible = () => {
+      if (document.visibilityState === "visible") void refreshFirstPages(request, false, stageKeysToLoadRef.current);
+    };
+    const interval = window.setInterval(refreshWhenVisible, REFRESH_INTERVAL_MILLISECONDS);
+    document.addEventListener("visibilitychange", refreshWhenVisible);
+    return () => {
+      generationRef.current = request + 1;
+      window.clearInterval(interval);
+      document.removeEventListener("visibilitychange", refreshWhenVisible);
+    };
+  }, [enabled, refreshFirstPages]);
+
+  useEffect(() => {
+    if (!enabled) return;
+    const stageKeysNotLoadedYet = stageKeysToLoad.filter(stageKey => !(stageKey in bucketsRef.current));
+    if (stageKeysNotLoadedYet.length) void refreshFirstPages(generationRef.current, false, stageKeysNotLoadedYet);
+  }, [enabled, refreshFirstPages, stageKeysToLoad]);
+
+  const stageKeysInCanonicalStage = useCallback((canonicalStage: string) => Object.keys(bucketsRef.current)
+    .filter(stageKey => canonicalContentItemStage(stageKey, getContentItemStageDefinitions()) === canonicalStage), []);
+
+  const loadMoreForStage = useCallback((canonicalStage: string) => {
+    const request = generationRef.current;
+    for (const stageKey of stageKeysInCanonicalStage(canonicalStage)) {
+      const bucket = bucketsRef.current[stageKey];
+      if (!bucket?.nextToken || stageKeysBeingExtendedRef.current.has(stageKey)) continue;
+      stageKeysBeingExtendedRef.current.add(stageKey);
+      loadNewsroomContentItemStagePage(stageKey, bucket.nextToken).then(page => {
+        if (generationRef.current !== request) return;
+        storeBuckets(previous => {
+          const current = previous[stageKey] ?? bucket;
+          const knownIds = new Set(current.versions.map(version => version.id));
+          return {
+            ...previous,
+            [stageKey]: {
+              versions: [...current.versions, ...page.versions.filter(version => !knownIds.has(version.id))],
+              nextToken: page.nextToken,
+              pagesLoaded: current.pagesLoaded + 1,
+            },
+          };
+        });
+      }).catch(() => undefined).finally(() => { stageKeysBeingExtendedRef.current.delete(stageKey); });
+    }
+  }, [stageKeysInCanonicalStage, storeBuckets]);
+
+  const stageHasMore = useCallback((canonicalStage: string) => stageKeysInCanonicalStage(canonicalStage)
+    .some(stageKey => Boolean(bucketsRef.current[stageKey]?.nextToken)), [stageKeysInCanonicalStage]);
+
+  const versions = useMemo(() => Object.values(buckets).flatMap(bucket => bucket.versions), [buckets]);
+  return { versions, loading, error, stageHasMore, loadMoreForStage };
+}

package/components/wiki-concepts-view.tsx

@@ -0,0 +1,153 @@
+"use client";
+
+import Link from "next/link";
+import { useEffect, useMemo, useState, type ReactNode } from "react";
+import type { SemanticNodeRecord } from "../lib/category-repository";
+import { isLocalPreviewEnabled } from "../lib/local-preview";
+import { getNewsroomNavHref } from "../lib/newsroom-nav";
+import type { createSemanticGraphSnapshot } from "../lib/semantic-graph";
+import {
+  conceptEditedAt, conceptId, conceptTitle, conceptWikiPath, conceptsByTitle, recentlyEditedConcepts, resolveConceptLink,
+} from "../lib/wiki";
+import { MarkusIrPreview } from "./markus-ir-preview";
+import { createWikiIndexPage, loadWikiIndexPage, type WikiIndexPage } from "./wiki-index-client";
+
+type SemanticGraph = ReturnType<typeof createSemanticGraphSnapshot>;
+
+const editedFormat = new Intl.DateTimeFormat(undefined, { dateStyle: "medium" });
+
+function formatEdited(value: string): string {
+  const parsed = new Date(value);
+  return value && !Number.isNaN(parsed.getTime()) ? editedFormat.format(parsed) : "";
+}
+
+function kindLabel(kind: string): string {
+  return kind.replace(/_/g, " ");
+}
+
+function ConceptLink({ children, demo, node, onOpen }: { children?: ReactNode; demo: boolean; node: SemanticNodeRecord; onOpen: (lineageId: string) => void }) {
+  return <a className="wiki-link" data-wiki-concept-link={conceptId(node)} href={getNewsroomNavHref(conceptWikiPath(node), demo)} onClick={event => { if (event.metaKey || event.ctrlKey || event.shiftKey) return; event.preventDefault(); onOpen(conceptId(node)); }}>{children ?? conceptTitle(node)}</a>;
+}
+
+function ConceptRows({ demo, nodes, onOpen, showEdited }: { demo: boolean; nodes: SemanticNodeRecord[]; onOpen: (lineageId: string) => void; showEdited?: boolean }) {
+  if (!nodes.length) return <p className="wiki-empty">No concepts to show.</p>;
+  return <ul className="wiki-concept-list">
+    {nodes.map(node => <li key={conceptId(node)}>
+      <ConceptLink demo={demo} node={node} onOpen={onOpen} />
+      <span className="wiki-chip">{kindLabel(node.nodeKind)}</span>
+      {showEdited && conceptEditedAt(node) && <span className="wiki-meta">edited {formatEdited(conceptEditedAt(node))}</span>}
+    </li>)}
+  </ul>;
+}
+
+function WikiIndexPageView({ demo, nodes, onOpen }: { demo: boolean; nodes: SemanticNodeRecord[]; onOpen: (lineageId: string) => void }) {
+  const [page, setPage] = useState<WikiIndexPage | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [saving, setSaving] = useState(false);
+  useEffect(() => {
+    let cancelled = false;
+    loadWikiIndexPage(demo || isLocalPreviewEnabled()).then(loaded => { if (!cancelled) setPage(loaded); }).catch((reason: unknown) => { if (!cancelled) setError(reason instanceof Error ? reason.message : "Could not load the wiki index."); });
+    return () => { cancelled = true; };
+  }, [demo]);
+  const dynamicDirectives = useMemo(() => ({
+    "recent-concepts": (attributes: Record<string, unknown>) => <ConceptRows demo={demo} nodes={recentlyEditedConcepts(nodes, { kind: typeof attributes.kind === "string" ? attributes.kind : null, limit: Number(attributes.limit) || 10 })} onOpen={onOpen} showEdited />,
+    "concept-list": (attributes: Record<string, unknown>) => <ConceptRows demo={demo} nodes={conceptsByTitle(nodes, { kind: typeof attributes.kind === "string" ? attributes.kind : null, limit: Number(attributes.limit) || null })} onOpen={onOpen} />,
+    "concept-count": (attributes: Record<string, unknown>) => <strong>{nodes.filter(node => !attributes.kind || node.nodeKind === attributes.kind).length}</strong>,
+  }), [demo, nodes, onOpen]);
+  const renderLink = (href: string, children: ReactNode) => {
+    const node = resolveConceptLink(href, nodes);
+    return node ? <ConceptLink demo={demo} node={node} onOpen={onOpen}>{children}</ConceptLink> : null;
+  };
+  if (error) return <p className="wiki-empty" role="alert">{error}</p>;
+  if (!page) return <p className="wiki-empty">Loading the wiki…</p>;
+  return <article className="wiki-page" data-wiki-index>
+    <div className="wiki-page-tools">
+      {page.itemId
+        ? <Link className="wiki-tool-link" href={getNewsroomNavHref(`/newsroom/articles/${encodeURIComponent(page.itemId)}`, demo)}>Edit this page</Link>
+        : <button className="wiki-tool-link" disabled={saving} onClick={() => { setSaving(true); createWikiIndexPage(demo || isLocalPreviewEnabled()).then(setPage).catch((reason: unknown) => setError(reason instanceof Error ? reason.message : "Could not save the index.")).finally(() => setSaving(false)); }} type="button">{saving ? "Saving…" : "Save this page so it can be edited"}</button>}
+    </div>
+    <MarkusIrPreview bodyIr={page.bodyIr} dynamicDirectives={dynamicDirectives} renderLink={renderLink} />
+  </article>;
+}
+
+function ConceptPageView({ demo, graph, node, nodes, onOpen }: { demo: boolean; graph: SemanticGraph; node: SemanticNodeRecord; nodes: SemanticNodeRecord[]; onOpen: (lineageId: string) => void }) {
+  const lineage = conceptId(node);
+  const groups = graph.neighbors("semanticNode", lineage);
+  const references = graph.referencesForSemanticNode(lineage);
+  const byLineage = new Map(nodes.map(candidate => [conceptId(candidate), candidate]));
+  const aliases = (node.aliases ?? []).filter(Boolean) as string[];
+  return <article className="wiki-page" data-wiki-concept={lineage}>
+    <h1>{conceptTitle(node)}</h1>
+    <p className="wiki-meta"><span className="wiki-chip">{kindLabel(node.nodeKind)}</span> {node.status !== "current" && <span className="wiki-chip">{node.status}</span>} {conceptEditedAt(node) && <>Last edited {formatEdited(conceptEditedAt(node))}</>}{node.versionCreatedBy ? ` by ${node.versionCreatedBy}` : ""}</p>
+    {aliases.length > 0 && <p className="wiki-meta">Also known as {aliases.join(", ")}</p>}
+    {node.description ? node.description.split(/\n{2,}/).map((paragraph, index) => <p key={index}>{paragraph}</p>) : <p className="wiki-empty">This concept has no description yet.</p>}
+    <section data-wiki-section="connections">
+      <h2>Connections</h2>
+      {groups.length ? groups.map(group => <div className="wiki-connection-group" key={`${group.direction}-${group.predicate}`}>
+        <h3>{group.label}</h3>
+        <ul className="wiki-concept-list">
+          {group.objects.map(object => {
+            const target = object.kind === "semanticNode" ? byLineage.get(object.lineageId) : undefined;
+            return <li key={`${object.kind}-${object.lineageId}`}>{target ? <ConceptLink demo={demo} node={target} onOpen={onOpen} /> : <span>{object.label}</span>}<span className="wiki-chip">{target ? kindLabel(target.nodeKind) : object.kind}</span></li>;
+          })}
+        </ul>
+      </div>) : <p className="wiki-empty">No connections recorded.</p>}
+    </section>
+    <section data-wiki-section="references">
+      <h2>References</h2>
+      {references.length ? <ul className="wiki-concept-list">
+        {references.map(reference => <li key={reference.lineageId}><Link href={getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(reference.lineageId)}`, demo)}>{reference.label}</Link></li>)}
+      </ul> : <p className="wiki-empty">No references recorded.</p>}
+    </section>
+  </article>;
+}
+
+/**
+ * The concept wiki: the front page is a content item whose Markus body can hold live components
+ * (recently edited concepts, concept lists), and every concept in the knowledge graph is a page
+ * linked to the concepts and references it connects to.
+ */
+export function WikiConceptsView({ demo = false, graph, initialNodeLineageId, nodes }: { demo?: boolean; graph: SemanticGraph; initialNodeLineageId?: string | null; nodes: SemanticNodeRecord[] }) {
+  const [selected, setSelected] = useState<string | null>(initialNodeLineageId ?? null);
+  const [search, setSearch] = useState("");
+  const [kind, setKind] = useState("");
+  useEffect(() => { setSelected(initialNodeLineageId ?? null); }, [initialNodeLineageId]);
+  useEffect(() => {
+    const onPop = () => {
+      const match = window.location.pathname.match(/\/concepts\/([^/?#]+)/);
+      setSelected(match ? decodeURIComponent(match[1]) : null);
+    };
+    window.addEventListener("popstate", onPop);
+    return () => window.removeEventListener("popstate", onPop);
+  }, []);
+  const open = (lineageId: string | null) => {
+    setSelected(lineageId);
+    const target = getNewsroomNavHref(lineageId ? `/newsroom/concepts/${encodeURIComponent(lineageId)}` : "/newsroom/concepts", demo);
+    if (`${window.location.pathname}${window.location.search}` !== target) window.history.pushState(null, "", target);
+  };
+  const node = selected ? nodes.find(candidate => conceptId(candidate) === selected || candidate.id === selected) ?? null : null;
+  const kinds = useMemo(() => Array.from(new Set(nodes.map(candidate => candidate.nodeKind))).sort(), [nodes]);
+  const matches = useMemo(() => {
+    const needle = search.trim().toLowerCase();
+    return conceptsByTitle(nodes, { kind: kind || null }).filter(candidate => !needle || conceptTitle(candidate).toLowerCase().includes(needle) || (candidate.aliases ?? []).some(alias => alias?.toLowerCase().includes(needle)));
+  }, [kind, nodes, search]);
+  return <div className="wiki" data-wiki>
+    <nav aria-label="Wiki" className="wiki-sidebar">
+      <button className="wiki-home" data-wiki-home aria-current={node ? undefined : "page"} onClick={() => open(null)} type="button">Wiki home</button>
+      <input aria-label="Search concepts" className="wiki-search" onChange={event => setSearch(event.target.value)} placeholder="Search concepts" value={search} />
+      {kinds.length > 1 && <select aria-label="Concept kind" className="wiki-kind" onChange={event => setKind(event.target.value)} value={kind}>
+        <option value="">All kinds</option>
+        {kinds.map(option => <option key={option} value={option}>{kindLabel(option)}</option>)}
+      </select>}
+      <ul className="wiki-sidebar-list">
+        {matches.map(candidate => <li key={conceptId(candidate)}><a aria-current={node && conceptId(node) === conceptId(candidate) ? "page" : undefined} href={getNewsroomNavHref(conceptWikiPath(candidate), demo)} onClick={event => { if (event.metaKey || event.ctrlKey || event.shiftKey) return; event.preventDefault(); open(conceptId(candidate)); }}>{conceptTitle(candidate)}</a></li>)}
+      </ul>
+    </nav>
+    <div className="wiki-main">
+      {node
+        ? <ConceptPageView demo={demo} graph={graph} node={node} nodes={nodes} onOpen={open} />
+        : selected ? <p className="wiki-empty" role="alert">That concept page was not found.</p>
+        : <WikiIndexPageView demo={demo} nodes={nodes} onOpen={open} />}
+    </div>
+  </div>;
+}

package/components/wiki-index-client.ts

@@ -0,0 +1,51 @@
+"use client";
+
+import { generateClient } from "aws-amplify/data";
+import type { Schema } from "../amplify/data/resource";
+import { resolveArticlesBackend } from "../lib/newsroom-articles";
+import { isLocalPreviewEnabled } from "../lib/local-preview";
+import { DEFAULT_WIKI_INDEX_MARKUS, WIKI_INDEX_SLUG, WIKI_PAGE_ITEM_TYPE } from "../lib/wiki";
+import { configureAmplifyClient } from "./amplify-client-provider";
+
+export type WikiIndexPage = {
+  /** The id of the stored content item, or null while the wiki still shows the built-in starter content. */
+  itemId: string | null;
+  bodyMarkus: string;
+  bodyIr: unknown;
+};
+
+type GraphqlResponse = { data?: { itemBySlug?: { items?: Record<string, unknown>[] | null } | null } | null; errors?: { message?: string }[] | null };
+
+async function storedIndexRow(preview: boolean): Promise<Record<string, unknown> | null> {
+  if (preview || isLocalPreviewEnabled()) return null;
+  configureAmplifyClient();
+  const client = generateClient<Schema>() as unknown as { graphql: (options: Record<string, unknown>) => Promise<GraphqlResponse> };
+  const response = await client.graphql({
+    query: "query ($slug: String!) { itemBySlug(slug: $slug) { items { id versionNumber versionState bodyMarkus bodyIr } } }",
+    variables: { slug: WIKI_INDEX_SLUG },
+    authMode: "userPool",
+  });
+  if (response.errors?.length) throw new Error(response.errors.map(error => error.message ?? "GraphQL error").join("; "));
+  const rows = (response.data?.itemBySlug?.items ?? []).filter(Boolean) as Record<string, unknown>[];
+  const ranked = rows.sort((left, right) => Number(right.versionNumber ?? 0) - Number(left.versionNumber ?? 0));
+  return ranked.find(row => row.versionState === "current") ?? ranked[0] ?? null;
+}
+
+async function derive(bodyMarkus: string, preview: boolean): Promise<unknown> {
+  const result = await resolveArticlesBackend(preview).actions.deriveMarkus({ frontMatterYaml: null, bodyMarkus, includeIr: true });
+  return result.bodyIr ?? null;
+}
+
+/** Loads the wiki's front page content item, falling back to the starter content until one is saved. */
+export async function loadWikiIndexPage(preview: boolean): Promise<WikiIndexPage> {
+  const row = await storedIndexRow(preview);
+  const bodyMarkus = typeof row?.bodyMarkus === "string" && row.bodyMarkus.trim() ? row.bodyMarkus : DEFAULT_WIKI_INDEX_MARKUS;
+  const storedIr = row?.bodyIr;
+  return { itemId: row ? String(row.id) : null, bodyMarkus, bodyIr: storedIr ?? await derive(bodyMarkus, preview) };
+}
+
+/** Saves the starter index as the wiki-index content item so editors can change it like any other page. */
+export async function createWikiIndexPage(preview: boolean): Promise<WikiIndexPage> {
+  const saved = await resolveArticlesBackend(preview).actions.saveItemDraft({ id: null, type: WIKI_PAGE_ITEM_TYPE, slug: WIKI_INDEX_SLUG, section: null, frontMatterYaml: `title: Concept wiki\n`, bodyMarkus: DEFAULT_WIKI_INDEX_MARKUS, aliases: [], expectedContentHash: null });
+  return { itemId: saved.item.id, bodyMarkus: DEFAULT_WIKI_INDEX_MARKUS, bodyIr: await derive(DEFAULT_WIKI_INDEX_MARKUS, preview) };
+}

package/infra/amplify-app-shell.js

@@ -43,11 +43,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config) {
+    if (config.repositoryAccessTokenSecretArn === undefined)
+        return {};
+    return {
+        repository: config.repository,
+        accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+    };
+}
 export class AmplifyAppShellStack extends Stack {
     cmsAppId;
     readerAppId;
@@ -114,7 +125,9 @@ export class AmplifyAppShellStack extends Stack {
                 resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
             }));
         }
+        const repositoryConnection = repositoryConnectionProperties(config);
         const cmsApp = new amplify.CfnApp(this, "App", {
+            ...repositoryConnection,
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
             platform: "WEB_COMPUTE",
@@ -332,6 +345,7 @@ export class AmplifyAppShellStack extends Stack {
             resources: ["arn:aws:s3:::amplify-*/media/*"],
         }));
         const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+            ...repositoryConnectionProperties(config),
             name: readerAppName,
             description: `Papyrus static reader for ${config.siteId} (WEB)`,
             platform: "WEB",

package/infra/amplify-app-shell.ts

@@ -46,11 +46,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config: AmplifyAppShellSiteConfig): { repository?: string; accessToken?: string } {
+  if (config.repositoryAccessTokenSecretArn === undefined) return {};
+  return {
+    repository: config.repository,
+    accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+  };
+}
+
 export class AmplifyAppShellStack extends Stack {
   public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
@@ -130,7 +141,10 @@ export class AmplifyAppShellStack extends Stack {
       );
     }
 
+    const repositoryConnection = repositoryConnectionProperties(config);
+
     const cmsApp = new amplify.CfnApp(this, "App", {
+      ...repositoryConnection,
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
       platform: "WEB_COMPUTE",
@@ -389,6 +403,7 @@ export class AmplifyAppShellStack extends Stack {
     );
 
     const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+      ...repositoryConnectionProperties(config),
       name: readerAppName,
       description: `Papyrus static reader for ${config.siteId} (WEB)`,
       platform: "WEB",

package/infra/site-config.js

@@ -5,6 +5,7 @@ export function hasCmsApp(config) {
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -297,9 +298,12 @@ function validateOauthRedirectUrls(config) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+    const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+        ? undefined
+        : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
     const brand = requireString(record.brand, "brand");
     const frontend = requireString(record.frontend, "frontend");
     if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -382,6 +386,7 @@ export function parseSiteConfig(raw) {
     const config = {
         siteId,
         repository,
+        repositoryAccessTokenSecretArn,
         brand,
         frontend,
         hostedZoneId,

package/infra/site-config.ts

@@ -47,6 +47,7 @@ export type CmsConfig = {
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
+  repositoryAccessTokenSecretArn?: string;
   brand: string;
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
@@ -85,6 +86,7 @@ export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -392,12 +394,15 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
     "site",
   );
 
   const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
   const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+  const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+    ? undefined
+    : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
   const brand = requireString(record.brand, "brand");
   const frontend = requireString(record.frontend, "frontend");
   if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -480,6 +485,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const config: AmplifyAppShellSiteConfig = {
     siteId,
     repository,
+    repositoryAccessTokenSecretArn,
     brand,
     frontend,
     hostedZoneId,

package/lib/approved-priming-proof-reports.ts

@@ -1,6 +1,9 @@
+import approvedReport0 from "./approved-priming-proofs/papyrus.json";
+
 /**
  * Priming proof reports a publication owner approved for visitors, keyed by site brand id.
- * A report reaches this map only through a reviewed commit of its
- * `publications/priming-proofs/<brand id>.json` file; see docs/cyclotron-priming.md.
+ * A report reaches this map only through a reviewed commit made by scripts/approve-priming-proof-report.ts.
  */
-export const APPROVED_PRIMING_PROOF_REPORTS: Record<string, unknown> = {};
+export const APPROVED_PRIMING_PROOF_REPORTS: Record<string, unknown> = {
+  "papyrus": approvedReport0,
+};