@anthusai/papyrus 1.4.0-next.5 → 1.4.0-next.6

package/amplify/data/resource.js

@@ -1018,6 +1018,7 @@ const schema = a.schema({
     NewsroomSection: a
         .model({
         id: a.id().required(),
+        tenantId: a.string(),
         title: a.string().required(),
         type: a.string().required(),
         editorialMission: a.string().required(),
@@ -1036,6 +1037,7 @@ const schema = a.schema({
     })
         .secondaryIndexes((index) => [
         index("sortOrder").sortKeys(["id"]).queryField("listNewsroomSectionsBySortOrder"),
+        index("tenantId").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTenantAndSortOrder"),
         index("type").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTypeAndSortOrder"),
         index("enabledStatus").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByEnabledStatusAndSortOrder"),
     ])
@@ -1624,6 +1626,7 @@ const schema = a.schema({
         .model({
         id: a.id().required(),
         lineageId: a.id().required(),
+        tenantId: a.string(),
         versionNumber: a.integer().required(),
         previousVersionId: a.id(),
         versionState: a.string().required(),
@@ -1636,6 +1639,7 @@ const schema = a.schema({
         typeStatus: a.string().required(),
         stage: a.string(),
         slug: a.string().required(),
+        tenantSlug: a.string(),
         shortSlug: a.string(),
         section: a.string(),
         sectionStatus: a.string(),
@@ -1663,6 +1667,7 @@ const schema = a.schema({
         .secondaryIndexes((index) => [
         index("lineageId").sortKeys(["versionNumber"]).queryField("listItemsByLineageAndVersion"),
         index("slug").queryField("itemBySlug"),
+        index("tenantSlug").queryField("itemByTenantSlug"),
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
         index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
@@ -1710,6 +1715,7 @@ const schema = a.schema({
         .model({
         id: a.id().required(),
         itemId: a.id().required(),
+        tenantId: a.string(),
         type: a.string().required(),
         role: a.string().required(),
         sortKey: a.string().required(),
@@ -1822,11 +1828,13 @@ const schema = a.schema({
         id: a.id().required(),
         sourceItemId: a.id().required(),
         itemLineageId: a.id().required(),
+        tenantId: a.string(),
         versionNumber: a.integer().required(),
         type: a.string().required(),
         status: a.string().required(),
         typeStatus: a.string().required(),
         slug: a.string().required(),
+        tenantSlug: a.string(),
         shortSlug: a.string(),
         section: a.string(),
         sectionStatus: a.string(),
@@ -1849,6 +1857,7 @@ const schema = a.schema({
     })
         .secondaryIndexes((index) => [
         index("slug").queryField("publishedItemBySlug"),
+        index("tenantSlug").queryField("publishedItemByTenantSlug"),
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsBySectionStatusAndPublishedAt"),
         index("itemLineageId").sortKeys(["versionNumber"]).queryField("listPublishedItemsByLineageAndVersion"),
@@ -1861,6 +1870,7 @@ const schema = a.schema({
         .model({
         id: a.id().required(),
         sourceMediaAssetId: a.id().required(),
+        tenantId: a.string(),
         publishedItemId: a.id().required(),
         sourceItemId: a.id().required(),
         itemLineageId: a.id().required(),

package/amplify/data/resource.ts

@@ -1100,6 +1100,7 @@ const schema = a.schema({
   NewsroomSection: a
     .model({
       id: a.id().required(),
+      tenantId: a.string(),
       title: a.string().required(),
       type: a.string().required(),
       editorialMission: a.string().required(),
@@ -1118,6 +1119,7 @@ const schema = a.schema({
     })
     .secondaryIndexes((index) => [
       index("sortOrder").sortKeys(["id"]).queryField("listNewsroomSectionsBySortOrder"),
+      index("tenantId").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTenantAndSortOrder"),
       index("type").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTypeAndSortOrder"),
       index("enabledStatus").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByEnabledStatusAndSortOrder"),
     ])
@@ -1725,6 +1727,7 @@ const schema = a.schema({
     .model({
       id: a.id().required(),
       lineageId: a.id().required(),
+      tenantId: a.string(),
       versionNumber: a.integer().required(),
       previousVersionId: a.id(),
       versionState: a.string().required(),
@@ -1737,6 +1740,7 @@ const schema = a.schema({
       typeStatus: a.string().required(),
       stage: a.string(),
       slug: a.string().required(),
+      tenantSlug: a.string(),
       shortSlug: a.string(),
       section: a.string(),
       sectionStatus: a.string(),
@@ -1764,6 +1768,7 @@ const schema = a.schema({
     .secondaryIndexes((index) => [
       index("lineageId").sortKeys(["versionNumber"]).queryField("listItemsByLineageAndVersion"),
       index("slug").queryField("itemBySlug"),
+      index("tenantSlug").queryField("itemByTenantSlug"),
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
       index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
@@ -1814,6 +1819,7 @@ const schema = a.schema({
     .model({
       id: a.id().required(),
       itemId: a.id().required(),
+      tenantId: a.string(),
       type: a.string().required(),
       role: a.string().required(),
       sortKey: a.string().required(),
@@ -1930,11 +1936,13 @@ const schema = a.schema({
       id: a.id().required(),
       sourceItemId: a.id().required(),
       itemLineageId: a.id().required(),
+      tenantId: a.string(),
       versionNumber: a.integer().required(),
       type: a.string().required(),
       status: a.string().required(),
       typeStatus: a.string().required(),
       slug: a.string().required(),
+      tenantSlug: a.string(),
       shortSlug: a.string(),
       section: a.string(),
       sectionStatus: a.string(),
@@ -1957,6 +1965,7 @@ const schema = a.schema({
     })
     .secondaryIndexes((index) => [
       index("slug").queryField("publishedItemBySlug"),
+      index("tenantSlug").queryField("publishedItemByTenantSlug"),
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsBySectionStatusAndPublishedAt"),
       index("itemLineageId").sortKeys(["versionNumber"]).queryField("listPublishedItemsByLineageAndVersion"),
@@ -1970,6 +1979,7 @@ const schema = a.schema({
     .model({
       id: a.id().required(),
       sourceMediaAssetId: a.id().required(),
+      tenantId: a.string(),
       publishedItemId: a.id().required(),
       sourceItemId: a.id().required(),
       itemLineageId: a.id().required(),

package/amplify/data/schema.js

@@ -918,6 +918,7 @@ const baseDefinitions = {
     ]),
     NewsroomSection: modelWithoutSubscriptions({
         id: a.id().required(),
+        tenantId: a.string(),
         title: a.string().required(),
         type: a.string().required(),
         editorialMission: a.string().required(),
@@ -936,6 +937,7 @@ const baseDefinitions = {
     })
         .secondaryIndexes((index) => [
         index("sortOrder").sortKeys(["id"]).queryField("listNewsroomSectionsBySortOrder"),
+        index("tenantId").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTenantAndSortOrder"),
         index("type").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTypeAndSortOrder"),
         index("enabledStatus").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByEnabledStatusAndSortOrder"),
     ])
@@ -1503,6 +1505,7 @@ const baseDefinitions = {
     Item: modelWithoutSubscriptions({
         id: a.id().required(),
         lineageId: a.id().required(),
+        tenantId: a.string(),
         versionNumber: a.integer().required(),
         previousVersionId: a.id(),
         versionState: a.string().required(),
@@ -1515,6 +1518,7 @@ const baseDefinitions = {
         status: a.string().required(),
         typeStatus: a.string().required(),
         slug: a.string().required(),
+        tenantSlug: a.string(),
         shortSlug: a.string(),
         section: a.string(),
         sectionStatus: a.string(),
@@ -1542,6 +1546,7 @@ const baseDefinitions = {
         .secondaryIndexes((index) => [
         index("lineageId").sortKeys(["versionNumber"]).queryField("listItemsByLineageAndVersion"),
         index("slug").queryField("itemBySlug"),
+        index("tenantSlug").queryField("itemByTenantSlug"),
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
         index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
@@ -1586,6 +1591,7 @@ const baseDefinitions = {
     MediaAsset: modelWithoutSubscriptions({
         id: a.id().required(),
         itemId: a.id().required(),
+        tenantId: a.string(),
         type: a.string().required(),
         role: a.string().required(),
         sortKey: a.string().required(),
@@ -1669,11 +1675,13 @@ const baseDefinitions = {
         id: a.id().required(),
         sourceItemId: a.id().required(),
         itemLineageId: a.id().required(),
+        tenantId: a.string(),
         versionNumber: a.integer().required(),
         type: a.string().required(),
         status: a.string().required(),
         typeStatus: a.string().required(),
         slug: a.string().required(),
+        tenantSlug: a.string(),
         shortSlug: a.string(),
         section: a.string(),
         sectionStatus: a.string(),
@@ -1696,6 +1704,7 @@ const baseDefinitions = {
     })
         .secondaryIndexes((index) => [
         index("slug").queryField("publishedItemBySlug"),
+        index("tenantSlug").queryField("publishedItemByTenantSlug"),
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsBySectionStatusAndPublishedAt"),
         index("itemLineageId").sortKeys(["versionNumber"]).queryField("listPublishedItemsByLineageAndVersion"),
@@ -1707,6 +1716,7 @@ const baseDefinitions = {
     PublishedMediaAsset: modelWithoutSubscriptions({
         id: a.id().required(),
         sourceMediaAssetId: a.id().required(),
+        tenantId: a.string(),
         publishedItemId: a.id().required(),
         sourceItemId: a.id().required(),
         itemLineageId: a.id().required(),

package/amplify/data/schema.ts

@@ -994,6 +994,7 @@ const baseDefinitions = {
 
   NewsroomSection: modelWithoutSubscriptions({
       id: a.id().required(),
+      tenantId: a.string(),
       title: a.string().required(),
       type: a.string().required(),
       editorialMission: a.string().required(),
@@ -1012,6 +1013,7 @@ const baseDefinitions = {
     })
     .secondaryIndexes((index) => [
       index("sortOrder").sortKeys(["id"]).queryField("listNewsroomSectionsBySortOrder"),
+      index("tenantId").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTenantAndSortOrder"),
       index("type").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByTypeAndSortOrder"),
       index("enabledStatus").sortKeys(["sortOrder"]).queryField("listNewsroomSectionsByEnabledStatusAndSortOrder"),
     ])
@@ -1598,6 +1600,7 @@ const baseDefinitions = {
   Item: modelWithoutSubscriptions({
       id: a.id().required(),
       lineageId: a.id().required(),
+      tenantId: a.string(),
       versionNumber: a.integer().required(),
       previousVersionId: a.id(),
       versionState: a.string().required(),
@@ -1610,6 +1613,7 @@ const baseDefinitions = {
       status: a.string().required(),
       typeStatus: a.string().required(),
       slug: a.string().required(),
+      tenantSlug: a.string(),
       shortSlug: a.string(),
       section: a.string(),
       sectionStatus: a.string(),
@@ -1637,6 +1641,7 @@ const baseDefinitions = {
     .secondaryIndexes((index) => [
       index("lineageId").sortKeys(["versionNumber"]).queryField("listItemsByLineageAndVersion"),
       index("slug").queryField("itemBySlug"),
+      index("tenantSlug").queryField("itemByTenantSlug"),
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
       index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
@@ -1684,6 +1689,7 @@ const baseDefinitions = {
   MediaAsset: modelWithoutSubscriptions({
       id: a.id().required(),
       itemId: a.id().required(),
+      tenantId: a.string(),
       type: a.string().required(),
       role: a.string().required(),
       sortKey: a.string().required(),
@@ -1770,11 +1776,13 @@ const baseDefinitions = {
       id: a.id().required(),
       sourceItemId: a.id().required(),
       itemLineageId: a.id().required(),
+      tenantId: a.string(),
       versionNumber: a.integer().required(),
       type: a.string().required(),
       status: a.string().required(),
       typeStatus: a.string().required(),
       slug: a.string().required(),
+      tenantSlug: a.string(),
       shortSlug: a.string(),
       section: a.string(),
       sectionStatus: a.string(),
@@ -1797,6 +1805,7 @@ const baseDefinitions = {
     })
     .secondaryIndexes((index) => [
       index("slug").queryField("publishedItemBySlug"),
+      index("tenantSlug").queryField("publishedItemByTenantSlug"),
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listPublishedItemsBySectionStatusAndPublishedAt"),
       index("itemLineageId").sortKeys(["versionNumber"]).queryField("listPublishedItemsByLineageAndVersion"),
@@ -1809,6 +1818,7 @@ const baseDefinitions = {
   PublishedMediaAsset: modelWithoutSubscriptions({
       id: a.id().required(),
       sourceMediaAssetId: a.id().required(),
+      tenantId: a.string(),
       publishedItemId: a.id().required(),
       sourceItemId: a.id().required(),
       itemLineageId: a.id().required(),

package/amplify/functions/category-action/handler.ts

@@ -4,7 +4,7 @@ import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
 import { putJsonModelPayload, putTextModelPayload, readJsonModelPayload } from "../shared/model-payloads";
-import { referenceCurationMetadata } from "../shared/reference-curation-metadata";
+import { curationActorKind, referenceCurationMetadata } from "../shared/reference-curation-metadata";
 
 type ReviewHandler = Schema["reviewSteeringProposal"]["functionHandler"];
 type ReferenceCurationHandler = Schema["reviewReferenceCuration"]["functionHandler"];
@@ -234,6 +234,7 @@ async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandle
       referenceLineageId,
       decisionRelationId: normalizeOptionalString(event.arguments.decisionRelationId),
       shareable: event.arguments.shareable ?? null,
+      actorKind: curationActorKind(event.identity),
     }),
     { filename: "metadata.json", now },
   );

package/amplify/functions/content-actions/requirements.txt

@@ -1,5 +1,5 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
-anthus-markus==0.5.1
+anthus-markus==0.7.0
 Pillow>=11.3,<12
 awscrt>=0.23,<1

package/amplify/functions/content-actions/resource.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/functions/content-actions/resource.ts

@@ -10,7 +10,7 @@ import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");

package/amplify/functions/renditions/requirements.txt

@@ -1,4 +1,4 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
-anthus-markus==0.5.1
+anthus-markus==0.7.0
 Pillow>=11.3,<12

package/amplify/functions/shared/reference-curation-metadata.ts

@@ -12,6 +12,20 @@ export type ReferenceCurationMetadataInput = {
   referenceLineageId: string
   decisionRelationId?: string | null
   shareable?: boolean | null
+  actorKind?: CurationActorKind | null
+}
+
+export type CurationActorKind = "human" | "service"
+
+/**
+ * A curation is human only when the caller signed in through the user pool, so
+ * AppSync supplied a verified subject claim. Request arguments never decide it;
+ * IAM-signed service callers and agents have no such claim.
+ */
+export function curationActorKind(identity: unknown): CurationActorKind {
+  const claims = (identity as {claims?: Record<string, unknown>} | null | undefined)?.claims
+  const subject = claims?.sub
+  return typeof subject === "string" && subject.trim() !== "" ? "human" : "service"
 }
 
 export function referenceCurationMetadata(input: ReferenceCurationMetadataInput): Record<string, unknown> {
@@ -23,6 +37,7 @@ export function referenceCurationMetadata(input: ReferenceCurationMetadataInput)
     curationReasonCode: input.reasonCode,
     referenceId: input.referenceId,
     referenceLineageId: input.referenceLineageId,
+    ...(input.actorKind ? {actorKind: input.actorKind} : {}),
     ...(decisionRelationId ? {decisionRelationId} : {}),
     ...(decisionRelationId ? {shareable: input.shareable === true} : {}),
   }

package/amplify/publication/renditions-function.js

@@ -11,7 +11,7 @@ import { pythonLambdaCode } from "../functions/shared/python-bundle.js";
 import { RENDITIONS_EPHEMERAL_STORAGE_MB, RENDITIONS_MEDIA_PREFIX, RENDITIONS_MEMORY_MB, RENDITIONS_TIMEOUT_SECONDS, renditionsEnvironment, renditionsEventPattern, } from "./renditions-settings.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../..");
-export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/publication/renditions-function.ts

@@ -22,7 +22,7 @@ import {
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../..");
 
-export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12"];
 
 export type RenditionsFunctionProps = {
   siteBucket: s3.IBucket;

package/components/board-card-excerpts.tsx

@@ -9,7 +9,7 @@ function CardExcerpt({ text }: { text: string }) {
   const [expanded, setExpanded] = useState(false);
   return <div className="board-card-excerpt" data-board-card-excerpt data-expanded={expanded}>
     <p>{text}</p>
-    {text.length > 90 && <button aria-expanded={expanded} onClick={event => { event.stopPropagation(); setExpanded(open => !open); }} onKeyDown={event => event.stopPropagation()} type="button">{expanded ? "Less" : "More"}</button>}
+    {text.length > 130 && <button aria-expanded={expanded} onClick={event => { event.stopPropagation(); setExpanded(open => !open); }} onKeyDown={event => event.stopPropagation()} type="button">{expanded ? "Less" : "More"}</button>}
   </div>;
 }
 

package/components/newsroom-newsprint-board.css

@@ -51,6 +51,6 @@
 .papyrus-newsprint-board .issue-card .issue-accent-bar { height: auto !important; margin: 0 !important; width: 100% !important; padding: 0 !important; min-height: 0; }
 .papyrus-newsprint-board .issue-card .issue-card-content { padding-top: 2px !important; gap: 4px; }
 .papyrus-newsprint-board .issue-card h3 { margin: 0; }
-.board-card-excerpt p { margin: 0; font-size: 13px; line-height: 1.4; color: var(--org-ink); display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; }
+.board-card-excerpt p { margin: 0; font-size: 13px; line-height: 1.4; color: var(--org-ink); display: -webkit-box; -webkit-line-clamp: 3; -webkit-box-orient: vertical; overflow: hidden; }
 .board-card-excerpt[data-expanded="true"] p { display: block; -webkit-line-clamp: unset; }
 .board-card-excerpt button { background: none; border: 0; padding: 0; font: inherit; font-size: 12px; text-decoration: underline; text-underline-offset: 3px; color: var(--org-ink); cursor: pointer; }

package/components/newsroom-organizer-shell.tsx

@@ -10,6 +10,7 @@ import { getNewsroomNavHref } from "../lib/newsroom-nav";
 import { SITE_BRAND } from "../lib/site-brand";
 import { useOptionalNewsDeskClient } from "./news-desk-client-provider";
 import { ReaderAuthControl } from "./reader-auth-control";
+import { ProspectusAccountChooser, useProspectusAccountSummary } from "./prospectus-account-chooser";
 import { Sheet, SheetContent, SheetHeader, SheetTitle, SheetDescription, SheetTrigger } from "./ui/sheet";
 import { DropdownMenu, DropdownMenuTrigger, DropdownMenuContent, DropdownMenuGroup, DropdownMenuLabel, DropdownMenuItem, DropdownMenuSeparator } from "./ui/dropdown-menu";
 import type { NewsroomOpsShellProps } from "./newsroom-ops-shell";
@@ -54,6 +55,7 @@ function Account({ placement }: { placement: "sidebar" | "header" }) {
   const session = useOptionalNewsDeskClient();
   const auth = session?.shell.auth ?? { status: "loading" as const, label: "Checking sign-in" };
   const [open, setOpen] = useState(false);
+  const accountSummary = useProspectusAccountSummary();
   useEffect(() => {
     const media = matchMedia("(max-width: 900px)");
     const close = () => setOpen(false);
@@ -62,11 +64,12 @@ function Account({ placement }: { placement: "sidebar" | "header" }) {
   }, []);
   return <DropdownMenu open={open} onOpenChange={setOpen}>
     <DropdownMenuTrigger id={`organizer-account-trigger-${placement}`} className={`organizer-account organizer-account-${placement}`} aria-label="Account menu" title="Account menu">
-      <UserRound size={18} aria-hidden="true" /><span><strong>{auth.label}</strong><small>{auth.status === "signedIn" ? "Account & preferences" : auth.status === "signedOut" ? "Not signed in" : "Checking session"}</small></span>
+      <UserRound size={18} aria-hidden="true" /><span><strong>{auth.label}</strong><small>{accountSummary ?? (auth.status === "signedIn" ? "Account & preferences" : auth.status === "signedOut" ? "Not signed in" : "Checking session")}</small></span>
     </DropdownMenuTrigger>
     <DropdownMenuContent className="organizer-account-popup" side={placement === "sidebar" ? "top" : "bottom"} align="end">
       <DropdownMenuGroup>
         <DropdownMenuLabel>{auth.label}</DropdownMenuLabel><DropdownMenuSeparator />
+        <ProspectusAccountChooser />
         <DropdownMenuItem render={<Link href={getNewsroomNavHref(ORGANIZER_SETTINGS_DESTINATION.path)} />}><Settings aria-hidden="true" />{ORGANIZER_SETTINGS_DESTINATION.label}</DropdownMenuItem>
         <ReaderAuthControl authState={auth} renderAction={({ disabled, onClick, signedIn }) => <DropdownMenuItem disabled={disabled} closeOnClick={false} onClick={onClick}>
           {signedIn ? <LogOut aria-hidden="true" /> : <LogIn aria-hidden="true" />}{signedIn ? "Sign out" : "Sign in"}

package/components/newsroom-organizer.css

@@ -265,3 +265,12 @@ body:has(.newsroom-organizer)>[data-staging-banner]{flex-shrink:0}
 .news-desk-columns--taxonomy .category-steering-category-card button{display:inline-flex;align-items:center;justify-content:center;min-height:36px;padding:4px 12px;border:2px solid var(--org-ink);border-radius:0;background:transparent;color:var(--org-ink);font:700 12px/1.2 Newsroom UI,system-ui,sans-serif;letter-spacing:.05em;text-transform:uppercase;cursor:pointer}
 .news-desk-columns--taxonomy .category-steering-category-card button:disabled{border-color:var(--org-line);opacity:.6;cursor:default}
 .news-desk-columns--taxonomy .news-desk-rail-column .category-steering-section__header{border-bottom:0;padding-bottom:4px}
+.organizer-account-chooser{padding:8px 12px;border-bottom:1px solid var(--org-line);display:grid;gap:6px}
+.organizer-account-chooser ul{list-style:none;margin:0;padding:0;display:grid}
+.organizer-account-chooser li button{display:flex;align-items:center;justify-content:space-between;gap:12px;width:100%;text-align:left;background:none;border:0;border-left:3px solid transparent;padding:6px 8px;font:inherit;color:var(--org-ink);cursor:pointer}
+.organizer-account-chooser li button[data-selected]{border-left-color:var(--org-ink);font-weight:700}
+.organizer-account-chooser li button:disabled{opacity:.6;cursor:default}
+.organizer-account-chooser li button span{display:grid;gap:1px}
+.organizer-account-chooser li button small,.organizer-account-chooser-note{font-size:12px;color:var(--org-ink);margin:0}
+.organizer-account-chooser-heading{margin:0;font:600 11px/1.4 Newsroom UI,system-ui,sans-serif;letter-spacing:.07em;text-transform:uppercase}
+.organizer-account-chooser-link{color:var(--org-ink);text-decoration:underline;text-underline-offset:3px}

package/components/prospectus-account-chooser.tsx

@@ -0,0 +1,98 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { Check } from "lucide-react";
+import { isLocalPreviewEnabled } from "../lib/local-preview";
+import { LOCAL_PREVIEW_TENANTS, getLocalPreviewTenantId, setLocalPreviewTenantId } from "../lib/local-preview-tenant";
+import { loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
+
+function previewAccountState(): ProspectusAccountState {
+  return {
+    status: "signedIn",
+    publishingAccounts: LOCAL_PREVIEW_TENANTS.map(tenant => ({ accountId: tenant.accountId, name: tenant.name, role: tenant.role })),
+    selectedAccountId: getLocalPreviewTenantId(),
+    cyclotronLabAccess: true,
+  };
+}
+
+const ACCOUNT_STATE_EVENT = "papyrus:prospectus-account-state";
+
+function summaryOf(state: ProspectusAccountState): string | null {
+  if (state.status !== "signedIn") return null;
+  const selected = state.publishingAccounts.find(account => account.accountId === state.selectedAccountId);
+  return selected ? `${selected.name ?? selected.accountId} · ${roleLabel(selected.role)}` : "Choose an account";
+}
+
+const roleLabel = (role: string) => role.replace(/_/g, " ");
+
+/** The signed-in person's current publishing account as "Name · role", or null when the site has no Prospectus accounts. */
+export function useProspectusAccountSummary(): string | null {
+  const [summary, setSummary] = useState<string | null>(null);
+  useEffect(() => {
+    let cancelled = false;
+    const returnPath = `${window.location.pathname}${window.location.search}`;
+    (isLocalPreviewEnabled() ? Promise.resolve(previewAccountState()) : loadProspectusAccountState(returnPath)).then(loaded => {
+      if (!cancelled) setSummary(summaryOf(loaded));
+    });
+    const onChange = (event: Event) => setSummary(summaryOf((event as CustomEvent<ProspectusAccountState>).detail));
+    window.addEventListener(ACCOUNT_STATE_EVENT, onChange);
+    return () => { cancelled = true; window.removeEventListener(ACCOUNT_STATE_EVENT, onChange); };
+  }, []);
+  return summary;
+}
+
+/**
+ * The publishing account the signed-in person is acting as. It appears only on sites that have Prospectus
+ * accounts configured; a site with its own user pool never shows it. Choosing an account records the choice
+ * in the sign-in session and reloads so every page reads the new account.
+ */
+export function ProspectusAccountChooser() {
+  const [state, setState] = useState<ProspectusAccountState>({ status: "unavailable" });
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<string | null>(null);
+  useEffect(() => {
+    let cancelled = false;
+    const returnPath = `${window.location.pathname}${window.location.search}`;
+    (isLocalPreviewEnabled() ? Promise.resolve(previewAccountState()) : loadProspectusAccountState(returnPath))
+      .then(loaded => { if (!cancelled) setState(loaded); });
+    return () => { cancelled = true; };
+  }, []);
+  if (state.status === "unavailable") return null;
+  if (state.status === "signedOut") {
+    return <div className="organizer-account-chooser" data-prospectus-account-chooser="signed-out">
+      <a className="organizer-account-chooser-link" href={state.signInUrl}>Sign in with Prospectus</a>
+    </div>;
+  }
+  const choose = async (accountId: string) => {
+    if (accountId === state.selectedAccountId || pending) return;
+    setPending(accountId); setError(null);
+    if (isLocalPreviewEnabled()) {
+      setLocalPreviewTenantId(accountId);
+      window.location.reload();
+      return;
+    }
+    const result = await selectProspectusAccount(accountId);
+    setPending(null);
+    if ("error" in result) { setError(result.error); return; }
+    window.location.reload();
+  };
+  return <div className="organizer-account-chooser" data-prospectus-account-chooser="signed-in">
+    <p className="organizer-account-chooser-heading">Publishing account</p>
+    {state.publishingAccounts.length === 0
+      ? <p className="organizer-account-chooser-note">No publishing accounts yet.</p>
+      : <ul role="listbox" aria-label="Publishing account">
+        {state.publishingAccounts.map(account => {
+          const selected = account.accountId === state.selectedAccountId;
+          return <li key={account.accountId} role="presentation">
+            <button aria-selected={selected} data-selected={selected || undefined} disabled={pending !== null} onClick={() => { void choose(account.accountId); }} role="option" type="button">
+              <span><strong>{account.name ?? account.accountId}</strong><small>{roleLabel(account.role)}</small></span>
+              {selected ? <Check size={14} aria-label="Selected" /> : null}
+            </button>
+          </li>;
+        })}
+      </ul>}
+    {!state.selectedAccountId && state.publishingAccounts.length > 0 ? <p className="organizer-account-chooser-note">Choose the account you are working as.</p> : null}
+    {state.cyclotronLabAccess ? <p className="organizer-account-chooser-note" data-cyclotron-lab-access>Cyclotron lab access is on for you.</p> : null}
+    {error ? <p className="organizer-account-chooser-note" role="alert">{error}</p> : null}
+  </div>;
+}

package/lib/content-source-context.ts

@@ -1,10 +1,13 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getContentSource, type ContentSource } from "./site-env";
+import { tenantIdFromEnvironment } from "./tenant-keys";
 
 export type ContentSourceContext = {
   source: ContentSource;
   /** Request-scoped data client (drafts mode: carries the visitor's session cookies). */
   client?: unknown;
+  /** Tenant of the selected Prospectus account; falls back to PAPYRUS_TENANT_ID. */
+  tenantId?: string;
 };
 
 const contentSourceStorage = new AsyncLocalStorage<ContentSourceContext>();
@@ -13,8 +16,13 @@ export function runWithContentSource<T>(
   source: ContentSource,
   operation: () => Promise<T>,
   client?: unknown,
+  tenantId?: string,
 ): Promise<T> {
-  return contentSourceStorage.run({ source, client }, operation);
+  return contentSourceStorage.run({ source, client, tenantId }, operation);
+}
+
+export function currentTenantId(): string | undefined {
+  return contentSourceStorage.getStore()?.tenantId ?? tenantIdFromEnvironment();
 }
 
 export function currentRequestClient<T>(): T | undefined {

package/lib/graphql-content-repository.ts

@@ -20,7 +20,9 @@ import { BodyIrError, matchBodyImages, projectBodyIr, type BodyProjection, type
 import { SITE_BRAND } from "./site-brand";
 import { shouldFetchVideoScripts } from "./video-mode";
 import { collectVideoScriptTargets, parseVideoScriptRef, videomlItemSlug, type VideoScriptRef } from "./video-script";
-import { currentContentSource, currentRequestClient, runWithContentSource } from "./content-source-context";
+import { selectedTenantIdFromCookies } from "./prospectus-tenant";
+import { currentContentSource, currentRequestClient, currentTenantId, runWithContentSource } from "./content-source-context";
+import { rowBelongsToTenant, tenantScopedValue } from "./tenant-keys";
 import { withRateLimitRetry } from "./rate-limit-retry";
 import { getContentSource } from "./site-env";
 
@@ -70,6 +72,7 @@ type GraphQLEditionItem = {
 
 type GraphQLItem = {
   id: string;
+  tenantId?: string | null;
   versionNumber?: number | null;
   type: string;
   status: string;
@@ -152,9 +155,10 @@ async function withReaderGraphQLContext<T>(operation: () => Promise<T>): Promise
     // Drafts are read as the signed-in visitor: the client reads the session from the request cookies, and it is
     // kept in the request's async context (never a module global) so one visitor's session cannot serve another.
     const { cookies } = await import("next/headers");
-    await cookies();
+    const cookieStore = await cookies();
     const client = generateServerClientUsingCookies<Schema>({ config, cookies, authMode: "userPool" });
-    return runWithContentSource(source, operation, client);
+    const selectedTenantId = await selectedTenantIdFromCookies(cookieStore);
+    return runWithContentSource(source, operation, client, selectedTenantId);
   }
   return withRateLimitRetry(() =>
     runWithGuestAmplifyContext(() =>
@@ -587,6 +591,10 @@ type ItemSourceModel = {
   listPublishedItemsByTypeStatusAndPublishedAt: (input: { typeStatus: string }, options: ListOptions) => ListResponse<GraphQLItem>;
 };
 
+type TenantSlugSourceModel = {
+  publishedItemByTenantSlug: (input: { tenantSlug: string }, options: ListOptions) => ListResponse<GraphQLItem>;
+};
+
 type MediaAssetSourceModel = {
   listPublishedMediaAssetsByItemAndSortKey: (
     input: { publishedItemId: string },
@@ -671,20 +679,33 @@ function getPublishedEditionItemModel(): EditionItemSourceModel {
   return model as unknown as EditionItemSourceModel;
 }
 
+async function getItemWithinTenant(
+  tenantId: string | undefined,
+  lookup: Promise<GraphQLGetResponse<GraphQLItem>>,
+): Promise<GraphQLGetResponse<GraphQLItem>> {
+  const response = await lookup;
+  return rowBelongsToTenant(tenantId, response.data) ? response : { ...response, data: null };
+}
+
 function getPublishedItemModel(): ItemSourceModel {
+  const tenantId = currentTenantId();
   if (currentContentSource() === "drafts") {
     const model = getClient().models.Item;
     if (!model) throw missingProjectionModelError("Item");
     return {
-      get: (input, options) => model.get(input, options) as Promise<GraphQLGetResponse<GraphQLItem>>,
-      publishedItemBySlug: (input, options) => model.itemBySlug(input, options) as ListResponse<GraphQLItem>,
+      get: (input, options) =>
+        getItemWithinTenant(tenantId, model.get(input, options) as Promise<GraphQLGetResponse<GraphQLItem>>),
+      publishedItemBySlug: ({ slug }, options) =>
+        (tenantId
+          ? model.itemByTenantSlug({ tenantSlug: tenantScopedValue(tenantId, slug) }, options)
+          : model.itemBySlug({ slug }, options)) as ListResponse<GraphQLItem>,
       listPublishedItemsByTypeStatusAndPublishedAt: ({ typeStatus }, options) => {
         const itemType = typeStatus.split("#")[0];
         return listMergedAcrossStatuses<GraphQLItem>(
           [DRAFT_STATUS, PUBLISHED_STATUS],
           (status, pageOptions) =>
             model.listItemsByTypeStatusAndPublishedAt(
-              { typeStatus: `${itemType}#${status}` },
+              { typeStatus: tenantScopedValue(tenantId, `${itemType}#${status}`) },
               pageOptions,
             ) as ListResponse<GraphQLItem>,
           (item) => item.publishedAt ?? "",
@@ -695,7 +716,21 @@ function getPublishedItemModel(): ItemSourceModel {
   }
   const model = getClient().models.PublishedItem;
   if (!model) throw missingProjectionModelError("PublishedItem");
-  return model as unknown as ItemSourceModel;
+  const publishedModel = model as unknown as ItemSourceModel;
+  if (!tenantId) return publishedModel;
+  return {
+    get: (input, options) => getItemWithinTenant(tenantId, publishedModel.get(input, options)),
+    publishedItemBySlug: ({ slug }, options) =>
+      (model as unknown as TenantSlugSourceModel).publishedItemByTenantSlug(
+        { tenantSlug: tenantScopedValue(tenantId, slug) },
+        options,
+      ),
+    listPublishedItemsByTypeStatusAndPublishedAt: ({ typeStatus }, options) =>
+      publishedModel.listPublishedItemsByTypeStatusAndPublishedAt(
+        { typeStatus: tenantScopedValue(tenantId, typeStatus) },
+        options,
+      ),
+  };
 }
 
 function getPublishedMediaAssetModel(): MediaAssetSourceModel {

package/lib/local-preview-seed.ts

@@ -4,11 +4,12 @@ import type { MediaAssetRecord } from "./newsroom-media";
 import { EMPTY_STORY_REPORTING_TRAIL, type StoryReportingTrail, type TrailVersion } from "./story-reporting-trail";
 import { contentItemStageKeys, type ContentItemVersionRecord } from "./content-item-lifecycle";
 import { getContentItemStageDefinitions } from "./site-brand";
+import { LOCAL_PREVIEW_TENANTS, getLocalPreviewTenantId } from "./local-preview-tenant";
 
 const SEED_TIMESTAMP_BASE = Date.parse("2026-10-01T12:00:00.000Z");
 const ONE_HOUR_IN_MILLISECONDS = 60 * 60 * 1000;
 
-const SEED_CONTENT_ITEM_HEADLINES_BY_POSITION: readonly (readonly string[])[] = [
+const SEED_CONTENT_ITEM_HEADLINES_BY_POSITION_FOR_TENANT_ZERO: readonly (readonly string[])[] = [
   ["Three sources confirm the zoning reversal", "Reporting packet: school board redistricting"],
   ["Draft in progress: the last ferry crossing", "Draft in progress: neighborhood bakery profile"],
   ["Illustration brief: flooded streets, aerial view", "Illustration brief: the market at dawn"],
@@ -18,6 +19,24 @@ const SEED_CONTENT_ITEM_HEADLINES_BY_POSITION: readonly (readonly string[])[] =
   ["Spiked: the unconfirmed council rumor", "Spiked: the recycled press release"],
 ];
 
+const SEED_CONTENT_ITEM_HEADLINES_BY_POSITION_FOR_TENANT_ONE: readonly (readonly string[])[] = [
+  ["Field note: spore dispersal on a damp morning", "Field note: the dung beetle census"],
+  ["Draft in progress: why fungi throw their caps", "Draft in progress: the compost experiment"],
+  ["Illustration brief: a cap in flight, close up", "Illustration brief: the mycelium network"],
+  ["Layout pass: the monthly field guide", "Layout pass: the reader mailbag"],
+  ["Published: a season of mushroom sightings", "Published: how the forest floor recycles"],
+  ["Held for spring: the truffle hunt", "Evergreen: a beginner's guide to identification"],
+  ["Spiked: the unverified foraging claim", "Spiked: the duplicate field report"],
+];
+
+const SEED_CONTENT_ITEM_HEADLINES_BY_TENANT = [SEED_CONTENT_ITEM_HEADLINES_BY_POSITION_FOR_TENANT_ZERO, SEED_CONTENT_ITEM_HEADLINES_BY_POSITION_FOR_TENANT_ONE] as const;
+
+function headlinesForSelectedTenant(): readonly (readonly string[])[] {
+  const tenantId = getLocalPreviewTenantId();
+  const tenant = LOCAL_PREVIEW_TENANTS.find(candidate => candidate.accountId === tenantId) ?? LOCAL_PREVIEW_TENANTS[0];
+  return SEED_CONTENT_ITEM_HEADLINES_BY_TENANT[tenant.fixtureHeadlineSet] ?? SEED_CONTENT_ITEM_HEADLINES_BY_TENANT[0];
+}
+
 function isoTimestampHoursBeforeBase(hours: number): string {
   return new Date(SEED_TIMESTAMP_BASE - hours * ONE_HOUR_IN_MILLISECONDS).toISOString();
 }
@@ -29,7 +48,8 @@ function slugFromHeadline(headline: string): string {
 export function createLocalPreviewContentItemVersions(): ContentItemVersionRecord[] {
   const stageKeys = contentItemStageKeys(getContentItemStageDefinitions());
   return stageKeys.flatMap((stageKey, stageIndex) => {
-    const headlines = SEED_CONTENT_ITEM_HEADLINES_BY_POSITION[stageIndex % SEED_CONTENT_ITEM_HEADLINES_BY_POSITION.length];
+    const tenantHeadlines = headlinesForSelectedTenant();
+    const headlines = tenantHeadlines[stageIndex % tenantHeadlines.length];
     return headlines.map((headline, headlineIndex) => {
       const slug = slugFromHeadline(headline);
       return {

package/lib/local-preview-tenant.ts

@@ -0,0 +1,27 @@
+/**
+ * The local preview stands in for the multi-tenant newsroom: choosing a publishing account in the account menu
+ * switches which publication's content the preview shows. The choice is a cookie so server and browser agree.
+ */
+export const LOCAL_PREVIEW_TENANT_COOKIE = "papyrus-preview-tenant";
+export const LOCAL_PREVIEW_DEFAULT_TENANT_ID = "preview-papyrus";
+
+export type LocalPreviewTenant = { accountId: string; name: string; role: string; fixtureHeadlineSet: number };
+
+export const LOCAL_PREVIEW_TENANTS: readonly LocalPreviewTenant[] = [
+  { accountId: LOCAL_PREVIEW_DEFAULT_TENANT_ID, name: "Papyrus", role: "publisher", fixtureHeadlineSet: 0 },
+  { accountId: "preview-pilobolus", name: "Pilobolus", role: "editor", fixtureHeadlineSet: 1 },
+];
+
+export function previewTenantIdFromCookieHeader(cookieHeader: string | null | undefined): string {
+  const match = cookieHeader?.split(";").map(part => part.trim()).find(part => part.startsWith(`${LOCAL_PREVIEW_TENANT_COOKIE}=`));
+  const value = match ? decodeURIComponent(match.slice(LOCAL_PREVIEW_TENANT_COOKIE.length + 1)) : "";
+  return LOCAL_PREVIEW_TENANTS.some(tenant => tenant.accountId === value) ? value : LOCAL_PREVIEW_DEFAULT_TENANT_ID;
+}
+
+export function getLocalPreviewTenantId(): string {
+  return typeof document === "undefined" ? LOCAL_PREVIEW_DEFAULT_TENANT_ID : previewTenantIdFromCookieHeader(document.cookie);
+}
+
+export function setLocalPreviewTenantId(accountId: string): void {
+  document.cookie = `${LOCAL_PREVIEW_TENANT_COOKIE}=${encodeURIComponent(accountId)}; path=/; max-age=31536000; samesite=lax`;
+}

package/lib/prospectus-tenant.ts

@@ -0,0 +1,22 @@
+import {
+  PROSPECTUS_SESSION_COOKIE,
+  loadProspectusSessionSealingSecret,
+  openProspectusCookie,
+  type ProspectusSignedInSession,
+} from "./prospectus-session";
+import { tenantIdForProspectusAccount } from "./tenant-keys";
+
+type CookieReader = { get(name: string): { value: string } | undefined };
+
+/**
+ * The tenant of the publishing account the signed-in person selected, read from the sealed Prospectus session
+ * cookie. Returns undefined on a site without Prospectus, with no session, or with no account selected, so the
+ * caller falls back to the site's own tenant (PAPYRUS_TENANT_ID).
+ */
+export async function selectedTenantIdFromCookies(cookies: CookieReader, loadSecret: () => Promise<string | null> = loadProspectusSessionSealingSecret): Promise<string | undefined> {
+  const sealingSecret = await loadSecret();
+  if (!sealingSecret) return undefined;
+  const session = openProspectusCookie<ProspectusSignedInSession>(sealingSecret, PROSPECTUS_SESSION_COOKIE, cookies.get(PROSPECTUS_SESSION_COOKIE)?.value);
+  if (!session || session.accessTokenExpiresAt * 1000 <= Date.now()) return undefined;
+  return tenantIdForProspectusAccount(session.selectedAccountId);
+}

package/lib/tenant-keys.ts

@@ -0,0 +1,32 @@
+export const TENANT_ID_ENVIRONMENT_VARIABLE = "PAPYRUS_TENANT_ID";
+const TENANT_KEY_SEPARATOR = "#";
+const TENANT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+
+export function validateTenantId(tenantId: string): string {
+  if (!TENANT_ID_PATTERN.test(tenantId)) {
+    throw new Error(`Tenant id "${tenantId}" must be lowercase letters, digits and hyphens, starting with a letter or digit.`);
+  }
+  return tenantId;
+}
+
+export function tenantIdFromEnvironment(environment: NodeJS.ProcessEnv = process.env): string | undefined {
+  const configured = environment[TENANT_ID_ENVIRONMENT_VARIABLE]?.trim();
+  return configured ? validateTenantId(configured) : undefined;
+}
+
+export function tenantScopedValue(tenantId: string | undefined, value: string): string {
+  if (!tenantId) return value;
+  const prefix = `${tenantId}${TENANT_KEY_SEPARATOR}`;
+  return value.startsWith(prefix) ? value : `${prefix}${value}`;
+}
+
+export function rowBelongsToTenant(tenantId: string | undefined, row: { tenantId?: string | null } | null | undefined): boolean {
+  if (!tenantId || !row) return true;
+  return row.tenantId === tenantId;
+}
+
+/** The tenant a Prospectus publishing account maps to: its id as lowercase letters, digits and hyphens. */
+export function tenantIdForProspectusAccount(accountId: string | null | undefined): string | undefined {
+  const normalized = (accountId ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+  return normalized ? validateTenantId(normalized) : undefined;
+}

package/package.json

@@ -101,6 +101,7 @@
     "./components/presentation-header": "./components/presentation-header.tsx",
     "./components/presentation-rhythm-hrule": "./components/presentation-rhythm-hrule.tsx",
     "./components/priming-proof-page": "./components/priming-proof-page.tsx",
+    "./components/prospectus-account-chooser": "./components/prospectus-account-chooser.tsx",
     "./components/publication-cyclotron-panel": "./components/publication-cyclotron-panel.tsx",
     "./components/reader-auth-control": "./components/reader-auth-control.tsx",
     "./components/reader-auth-state": "./components/reader-auth-state.ts",
@@ -191,6 +192,7 @@
     "./lib/layout-types": "./lib/layout-types.ts",
     "./lib/layout-warnings": "./lib/layout-warnings.ts",
     "./lib/local-preview-seed": "./lib/local-preview-seed.ts",
+    "./lib/local-preview-tenant": "./lib/local-preview-tenant.ts",
     "./lib/local-preview": "./lib/local-preview.ts",
     "./lib/markus-body": "./lib/markus-body.ts",
     "./lib/markus-ir": "./lib/markus-ir.ts",
@@ -233,6 +235,7 @@
     "./lib/prospectus-session": "./lib/prospectus-session.ts",
     "./lib/prospectus-sign-in-routes": "./lib/prospectus-sign-in-routes.ts",
     "./lib/prospectus-site-identity": "./lib/prospectus-site-identity.ts",
+    "./lib/prospectus-tenant": "./lib/prospectus-tenant.ts",
     "./lib/public-placeholder-config": "./lib/public-placeholder-config.ts",
     "./lib/publication-cyclotron": "./lib/publication-cyclotron.ts",
     "./lib/publication-items": "./lib/publication-items.ts",
@@ -266,6 +269,7 @@
     "./lib/staging-gated-path": "./lib/staging-gated-path.ts",
     "./lib/staging-preview-object": "./lib/staging-preview-object.ts",
     "./lib/story-reporting-trail": "./lib/story-reporting-trail.ts",
+    "./lib/tenant-keys": "./lib/tenant-keys.ts",
     "./lib/test-editor-override": "./lib/test-editor-override.ts",
     "./lib/text-columns": "./lib/text-columns.ts",
     "./lib/themed-image": "./lib/themed-image.ts",
@@ -364,7 +368,7 @@
       "optional": true
     }
   },
-  "version": "1.4.0-next.5",
+  "version": "1.4.0-next.6",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.4.0-next.5",
+  "version": "1.4.0-next.6",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",