@anthusai/papyrus 2.0.0-next.4 → 2.0.0-next.40

package/lib/monitoring-overview.ts

@@ -0,0 +1,145 @@
+/** Shapes and wording for the newsroom Monitoring page. The function in src/papyrus_content/monitoring_view.py produces them. */
+import { getNewsroomNavHref } from "./newsroom-nav";
+
+export type MonitoringDeliveryState = "delivered" | "failed" | "pending" | "not_applicable" | null;
+
+export type MonitoringRelevance = {
+  publicationId: string;
+  site: string | null;
+  relevant: boolean | null;
+  label: string | null;
+  confidence: number | null;
+  delivery: {
+    state: MonitoringDeliveryState;
+    referenceId?: string | null;
+    referenceLineageId?: string | null;
+    deliveredAt?: string | null;
+    error?: string | null;
+    attempts?: number | null;
+  };
+};
+
+export type MonitoringItem = {
+  sourceId: string;
+  revision: number;
+  title: string;
+  url: string | null;
+  discussionUrl: string | null;
+  observedAt: string | null;
+  routing: string;
+  routingNote: string | null;
+  decidedAt: string | null;
+  relevance: MonitoringRelevance[];
+};
+
+export type MonitoringRun = {
+  runId: string;
+  startedAt: string;
+  status: string;
+  new: number;
+  revised: number;
+  unchanged: number;
+  itemCount: number | null;
+  errorCount: number;
+  errors: (string | null)[];
+};
+
+export type MonitoringRouterRun = {
+  runId: string;
+  startedAt: string;
+  mode: string;
+  status: string;
+  stoppedBy: string | null;
+  waitingForClassifier?: string[];
+  counts: Record<string, number>;
+  errorCount: number;
+};
+
+export type MonitoringFeed = {
+  id: string;
+  sourceUrl: string | null;
+  intervalSeconds: number | null;
+  limit: number | null;
+  enabled: boolean;
+  lastStatus: string | null;
+  lastFinishedAt: string | null;
+  nextDueAt: string | null;
+};
+
+export type MonitoringOverview = {
+  state: "ready" | "empty";
+  asOf: string;
+  notice?: "publication_not_routed";
+  scope: { mode: "publication" | "all"; publicationId: string | null; site: string | null; canViewAll: boolean };
+  feeds: MonitoringFeed[];
+  runs: MonitoringRun[];
+  routerRuns: MonitoringRouterRun[];
+  router: { mode: string; feedback: boolean; enabled: boolean; maxItemsPerRun: number | null } | null;
+  usage: {
+    day: string;
+    decisionsToday: number;
+    decisionsTotal: number;
+    ceilings: { decisionsTotal?: number; decisionsPerDay?: number; items?: number } | null;
+  } | null;
+  items: MonitoringItem[];
+  hiddenNotRelevant: number;
+};
+
+export type MonitoringResult =
+  | MonitoringOverview
+  | { state: "not_configured" }
+  | { state: "unavailable" }
+  | { error: "forbidden" | "bad_request" };
+
+const ROUTING_WORDS: Record<string, string> = {
+  collected: "Collected, waiting for the router",
+  "dry-run-validated": "Checked in a dry run, not sent",
+  decided: "Judged, delivery not finished",
+  routed: "Routed",
+  refused: "Refused by the shared Cyclotron",
+  uncertain: "Uncertain, needs a person",
+  error: "Error",
+};
+
+export function routingLabel(routing: string): string {
+  return ROUTING_WORDS[routing] ?? routing;
+}
+
+/** Fixed-format UTC time so the page reads the same everywhere. */
+export function formatUtc(iso: string | null | undefined): string {
+  if (!iso) return "never";
+  const match = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2})/.exec(iso);
+  return match ? `${match[1]} ${match[2]} UTC` : iso;
+}
+
+export function confidenceText(confidence: number | null): string {
+  return confidence === null ? "confidence not reported" : `${Math.round(confidence * 100)}% confidence`;
+}
+
+export function usageText(used: number, ceiling: number | undefined): string {
+  return ceiling === undefined ? `${used} used, no ceiling set` : `${used} of ${ceiling}`;
+}
+
+export function everyText(seconds: number | null): string {
+  if (!seconds) return "on a schedule";
+  return seconds % 3600 === 0 ? `every ${seconds / 3600} h` : seconds % 60 === 0 ? `every ${seconds / 60} min` : `every ${seconds} s`;
+}
+
+export function referenceHref(lineageId: string, demo?: boolean): string {
+  return getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(lineageId)}`, demo);
+}
+
+export function describeRelevance(entry: MonitoringRelevance): string {
+  if (entry.relevant === null) return "Not judged yet";
+  return entry.relevant ? "Relevant" : "Not relevant";
+}
+
+export function describeDelivery(entry: MonitoringRelevance): string {
+  switch (entry.delivery.state) {
+    case "delivered": return "In the References queue";
+    case "failed": return "Not in the References queue: delivery failed";
+    case "pending": return "Not in the References queue yet";
+    case "not_applicable": return "Nothing to deliver";
+    default: return "";
+  }
+}

package/lib/newsroom-board.ts

@@ -21,6 +21,31 @@ export interface NativeBoardIssue extends KanbanIssue {
   href: string;
   /** A few lines to show under the headline: the blurb, else the subtitle. */
   excerpt?: string;
+  /** The quiet path shown where a board would print the ID, e.g. `articles/my-slug` or `assignments/write-it`. */
+  displayId: string;
+}
+
+function slugify(text: string): string {
+  return text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+
+/** Section and slug for a content item, falling back to the publication's board path segment. */
+export function contentItemDisplayId(version: { section?: string | null; slug?: string | null; lineageId: string }): string {
+  const section = slugify(version.section ?? "") || contentItemBoardPathSegment();
+  return `${section}/${slugify(version.slug ?? "") || version.lineageId.slice(0, 8)}`;
+}
+
+/** Assignments have no slug: use the title as one, else a short id. */
+export function assignmentDisplayId(assignment: { id: string; title?: string | null }): string {
+  const titleSlug = slugify(assignment.title ?? "").slice(0, 48).replace(/-+$/g, "");
+  return `assignments/${titleSlug || assignment.id.slice(0, 8)}`;
+}
+
+/** `formatIssueId` for the Kanbus UI: the host-provided path, never the raw `kind:id` prefix. */
+export function formatNativeIssueId(issue: KanbanIssue): string {
+  const displayId = (issue as Partial<NativeBoardIssue>).displayId;
+  if (displayId) return displayId;
+  return issue.id.replace(/^[A-Za-z]+:/, "").slice(0, 12);
 }
 
 export function contentItemBoardPathSegment(): string {
@@ -60,7 +85,7 @@ export function projectContentItemBoard(records: {
       title: version.headline || version.title || version.slug, nativeStatus: stage, status: `${contentItemType}/${stage}`,
       priority: 2, description: workCount ? `${workCount} assignment${workCount === 1 ? "" : "s"} on this ${contentItemType}.` : undefined,
       updated_at: version.updatedAt ?? undefined, href: `/newsroom/articles/${encodeURIComponent(version.id)}`,
-      excerpt: contentItemExcerpt(version),
+      excerpt: contentItemExcerpt(version), displayId: contentItemDisplayId(version),
     };
   });
 }
@@ -73,7 +98,7 @@ export function projectAssignmentBoard(assignments: readonly AssignmentRecord[])
     priority: row.priority ?? 2, assignee: row.assigneeId || undefined,
     description: row.summary || row.brief || undefined,
     created_at: row.createdAt, updated_at: row.updatedAt,
-    href: `/newsroom/assignments/${encodeURIComponent(row.id)}`,
+    href: `/newsroom/assignments/${encodeURIComponent(row.id)}`, displayId: assignmentDisplayId(row),
   }));
 }
 

package/lib/prospectus-session.ts

@@ -1,5 +1,5 @@
 import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
-import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { readAmplifyOutputsFile } from "./amplify-outputs-path";
 import {
   ProspectusSiteAccounts,
@@ -21,7 +21,7 @@ import {
 export const PROSPECTUS_PENDING_SIGN_IN_COOKIE = "__Host-papyrus-prospectus-pending";
 export const PROSPECTUS_SESSION_COOKIE = "__Host-papyrus-prospectus-session";
 export const PROSPECTUS_ACCOUNTS_ENDPOINT_ENV = "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT";
-export const PROSPECTUS_SESSION_SECRET_ARN_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN";
+export const PROSPECTUS_SESSION_SECRET_PARAMETER_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER";
 export const PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
 
 const SEALED_COOKIE_FORMAT_VERSION = "v1";
@@ -101,37 +101,37 @@ export function sameSiteReturnPath(requestedReturnPath: string | null | undefine
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
 
-export type ProspectusSessionSecretReader = (secretArn: string) => Promise<string | null>;
+export type ProspectusSessionSecretReader = (parameterName: string) => Promise<string | null>;
 
-type CachedSealingSecret = { secretArn: string; value: string; expiresAt: number };
+type CachedSealingSecret = { parameterName: string; value: string; expiresAt: number };
 
 let cachedSealingSecret: CachedSealingSecret | null = null;
-let defaultSecretsManagerClient: SecretsManagerClient | null = null;
+let defaultSsmClient: SSMClient | null = null;
 
 export function resetProspectusSessionSecretCache(): void {
   cachedSealingSecret = null;
 }
 
-async function readSealingSecretFromSecretsManager(secretArn: string): Promise<string | null> {
-  defaultSecretsManagerClient ??= new SecretsManagerClient({});
-  const response = await defaultSecretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
-  return response.SecretString?.trim() || null;
+export async function readSealingSecretFromSsm(parameterName: string, client?: Pick<SSMClient, "send">): Promise<string | null> {
+  defaultSsmClient ??= new SSMClient({});
+  const response = await (client ?? defaultSsmClient).send(new GetParameterCommand({ Name: parameterName, WithDecryption: true }));
+  return response.Parameter?.Value?.trim() || null;
 }
 
 export async function loadProspectusSessionSealingSecret(
   options: { environment?: Record<string, string | undefined>; readSecret?: ProspectusSessionSecretReader; now?: number } = {},
 ): Promise<string | null> {
   const environment = options.environment ?? process.env;
-  const secretArn = environment[PROSPECTUS_SESSION_SECRET_ARN_ENV]?.trim();
-  if (!secretArn) return null;
+  const parameterName = environment[PROSPECTUS_SESSION_SECRET_PARAMETER_ENV]?.trim();
+  if (!parameterName) return null;
   const now = options.now ?? Date.now();
-  if (cachedSealingSecret && cachedSealingSecret.secretArn === secretArn && cachedSealingSecret.expiresAt > now) {
+  if (cachedSealingSecret && cachedSealingSecret.parameterName === parameterName && cachedSealingSecret.expiresAt > now) {
     return cachedSealingSecret.value;
   }
   try {
-    const value = (await (options.readSecret ?? readSealingSecretFromSecretsManager)(secretArn))?.trim();
+    const value = (await (options.readSecret ?? readSealingSecretFromSsm)(parameterName))?.trim();
     if (!value || value.length < MINIMUM_SEALING_SECRET_LENGTH) return null;
-    cachedSealingSecret = { secretArn, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
+    cachedSealingSecret = { parameterName, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
     return value;
   } catch (error) {
     console.error(`Prospectus session sealing secret could not be read (${error instanceof Error ? error.name : "error"}).`);

package/lib/prospectus-sign-in-routes.ts

@@ -25,6 +25,7 @@ import {
   publishingAccountsForSite,
   type PublicationCapability,
 } from "./prospectus-publication-access";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
 
 /**
  * The site's sign-in routes for Prospectus accounts: start (challenge, then the
@@ -38,6 +39,8 @@ export interface ProspectusSignInRouteOptions {
   siteProduct?: string | null;
   completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
   nowInSeconds?: () => number;
+  /** Trusted configuration the public site origin is read from; defaults to process.env. */
+  environment?: Record<string, string | undefined>;
 }
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
@@ -50,8 +53,22 @@ function currentTimeInSeconds(options: ProspectusSignInRouteOptions): number {
   return options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
 }
 
+function siteOriginFor(request: NextRequest, options: ProspectusSignInRouteOptions): string {
+  return publicSiteOrigin(request, options.environment);
+}
+
 async function signInRuntimeFor(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<ProspectusSignInRuntime | null> {
-  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(request.nextUrl.origin);
+  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(siteOriginFor(request, options));
+}
+
+/** Runs a route and answers a missing site origin with 503 site_origin_not_configured, never a localhost redirect. */
+async function failingClosedWithoutSiteOrigin(route: () => Promise<NextResponse>): Promise<NextResponse> {
+  try {
+    return await route();
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
 }
 
 function signInUnavailableResponse(): NextResponse {
@@ -82,7 +99,11 @@ export function signedInProspectusSession(
   );
 }
 
-export async function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignInStartRoute(request, options));
+}
+
+async function handleProspectusSignInStartRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
@@ -99,7 +120,11 @@ export async function handleProspectusSignInStart(request: NextRequest, options:
   return response;
 }
 
-export async function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignInCallbackRoute(request, options));
+}
+
+async function handleProspectusSignInCallbackRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const nowInSeconds = currentTimeInSeconds(options);
@@ -142,7 +167,7 @@ async function completeCallback(
       accessToken: signedIn.accessToken,
       accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
     };
-    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, request.nextUrl.origin), { status: 303, headers: NO_STORE_HEADERS });
+    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, siteOriginFor(request, options)), { status: 303, headers: NO_STORE_HEADERS });
     response.cookies.set(
       PROSPECTUS_SESSION_COOKIE,
       sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, session, session.accessTokenExpiresAt),
@@ -156,7 +181,11 @@ async function completeCallback(
   }
 }
 
-export async function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSessionReadRoute(request, options));
+}
+
+async function handleProspectusSessionReadRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const session = signedInProspectusSession(request, runtime.sealingSecret, currentTimeInSeconds(options));
@@ -196,9 +225,13 @@ export async function handleProspectusSessionRead(request: NextRequest, options:
   }
 }
 
-export async function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignOutRoute(request, options));
+}
+
+async function handleProspectusSignOutRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
-  const signedOutDestination = new URL("/", request.nextUrl.origin);
+  const signedOutDestination = new URL("/", siteOriginFor(request, options));
   const destination = runtime
     ? new URL(
       `/logout?${new URLSearchParams({ client_id: runtime.cognitoClient.clientId, logout_uri: signedOutDestination.toString() })}`,
@@ -250,10 +283,14 @@ export async function currentProspectusPublishingSelection(
   }
 }
 
-export async function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusAccountSelectionRoute(request, options));
+}
+
+async function handleProspectusAccountSelectionRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
-  if (request.headers.get("origin") !== request.nextUrl.origin) {
+  if (request.headers.get("origin") !== siteOriginFor(request, options)) {
     return signInFailedResponse(403, "cross_origin_selection", "Choose an account from this site.");
   }
   const nowInSeconds = currentTimeInSeconds(options);
@@ -287,10 +324,14 @@ const MAXIMUM_PUBLISHING_ACCOUNT_NAME_LENGTH = 150;
 const DEFAULT_PUBLISHING_ACCOUNT_NAME = "Publishing account";
 const IDEMPOTENCY_KEY_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
-export async function handleProspectusPublishingAccountCreation(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusPublishingAccountCreation(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusPublishingAccountCreationRoute(request, options));
+}
+
+async function handleProspectusPublishingAccountCreationRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
-  if (request.headers.get("origin") !== request.nextUrl.origin) {
+  if (request.headers.get("origin") !== siteOriginFor(request, options)) {
     return signInFailedResponse(403, "cross_origin_creation", "Create an account from this site.");
   }
   const nowInSeconds = currentTimeInSeconds(options);

package/lib/relevance-status.ts

@@ -52,10 +52,10 @@ export const DEMO_CYCLOTRON_STATUS: CyclotronStatus = {
   },
   calibration: { saysSure: null, isRight: null, gapPoints: null, curve: [] },
   reviewRate: {
-    state: "onboarding", rate: 1, reason: "Onboarding: every decision is reviewed until the cyclotron earns a lower rate.",
+    state: "onboarding", rate: 1, reason: "Getting started: every suggestion is reviewed until suggestions earn a lower review rate.",
     auditFloor: 0.05, confidenceThreshold: 0.7, override: null,
     nextCheckAfterDecisions: 99,
-    nextStep: "Steps down to 50% after 2 more windows of 100 decisions with accuracy on confident decisions of at least 85% (at least 20 reviewed) and a calibration gap under 5 points. Next check in 99 decisions.",
+    nextStep: "Steps down to 50% after 2 more windows of 100 decisions with accuracy on confident decisions of at least 85% (at least 20 reviewed) and a gap under 5 points between how sure suggestions say they are and how often they are right. Next check in 99 decisions.",
     expectedReviewsPerWeek: 1,
   },
   lastChange: null,

package/lib/site-brand-tenant.ts

@@ -9,14 +9,19 @@ export function resolveBrandConfigPath(relativePath: string): string {
   return path.isAbsolute(relativePath) ? relativePath : path.join(process.cwd(), relativePath);
 }
 
-export function getBrandSteeringConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string {
-  return resolveBrandConfigPath(brand.steeringConfigPath);
+/** Optional repo files a brand may still name; undefined means the site keeps that configuration as backend data and nothing is looked up. */
+function optionalBrandConfigPath(relativePath: string | undefined): string | undefined {
+  return relativePath ? resolveBrandConfigPath(relativePath) : undefined;
 }
 
-export function getBrandNewsroomSectionsConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string {
-  return resolveBrandConfigPath(brand.newsroomSectionsConfigPath);
+export function getBrandSteeringConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string | undefined {
+  return optionalBrandConfigPath(brand.steeringConfigPath);
 }
 
-export function getBrandAnalysisProfilesPath(brand: SiteBrand = resolveActiveSiteBrand()): string {
-  return resolveBrandConfigPath(brand.analysisProfilesPath);
+export function getBrandNewsroomSectionsConfigPath(brand: SiteBrand = resolveActiveSiteBrand()): string | undefined {
+  return optionalBrandConfigPath(brand.newsroomSectionsConfigPath);
+}
+
+export function getBrandAnalysisProfilesPath(brand: SiteBrand = resolveActiveSiteBrand()): string | undefined {
+  return optionalBrandConfigPath(brand.analysisProfilesPath);
 }

package/lib/site-brand.ts

@@ -3,6 +3,7 @@ import type { ComponentType } from "react";
 import type { EditionPresentationFormat } from "./content-types";
 import type { Article, ArticleVideoAsset } from "./articles";
 import type { BlogPageBackgroundProps } from "../components/blog-page-background";
+import type { KanbusThemeId } from "@kanbus/ui";
 import type { SiteBrandFont } from "./brand-fonts";
 import type { PictogramFigureProps } from "../components/pictogram-figure";
 import papyrusSite from "papyrus-site";
@@ -118,6 +119,13 @@ export type SiteBrand = {
   defaultVideoCredit?: string;
   themePack: ThemePackId;
   themeTokens: ThemePackTokens;
+  /**
+   * The Kanbus editorial theme the whole newsroom (sidebar, toolbar, boards,
+   * detail panel) renders in. Hard-coded per publication: editors cannot
+   * change it. Per-publication tweaks are `--kb-theme-*` overrides in the
+   * publication's `theme.css`, scoped to `[data-kanbus-theme]`.
+   */
+  kanbusTheme: KanbusThemeId;
   renderer: RendererConfig;
   hosting: HostingConfig;
   /** Static reader app when it is not co-hosted with this Papyrus checkout. */
@@ -134,9 +142,12 @@ export type SiteBrand = {
   readerBasePath?: string;
   opsChrome: OpsChrome;
   corpusKey: string;
-  steeringConfigPath: string;
-  newsroomSectionsConfigPath: string;
-  analysisProfilesPath: string;
+  /** Optional repo file for topic steering. Editorial and steering configuration is backend data; a data-driven site sets none and nothing is looked up. */
+  steeringConfigPath?: string;
+  /** Optional repo file for the local-preview demo sections only. Sections live in the backend. */
+  newsroomSectionsConfigPath?: string;
+  /** Optional repo file listing analysis profiles. */
+  analysisProfilesPath?: string;
   publicationName: string;
   components?: SiteBrandComponents;
   /**
@@ -182,6 +193,7 @@ const REFERENCE_SITE_BRANDS: Record<SiteBrandId, SiteBrand> = {
     sectionLinkStrategy: "route",
     themePack: "papyrus",
     themeTokens: DEFAULT_THEME_PACK_TOKENS,
+    kanbusTheme: "broadsheet-green",
     renderer: { kind: "pretext" },
     hosting: { kind: "amplify-ssr" },
     opsChrome: "app",
@@ -237,6 +249,14 @@ export function getSiteBrand(id: SiteBrandId = resolveSiteBrandId()): SiteBrand
 
 export const SITE_BRAND = getSiteBrand();
 
+/** Mirrors `DEFAULT_KANBUS_THEME` from `@kanbus/ui` (a test keeps the two equal) without a runtime import. */
+export const FALLBACK_KANBUS_THEME: KanbusThemeId = "newspaper-gothic";
+
+/** The newsroom theme for a brand; a brand that predates the field falls back to the default theme. */
+export function getKanbusTheme(brand: Pick<SiteBrand, "kanbusTheme"> = SITE_BRAND): KanbusThemeId {
+  return brand.kanbusTheme ?? FALLBACK_KANBUS_THEME;
+}
+
 export function getContentItemName(brand: SiteBrand = SITE_BRAND): ContentItemName {
   return brand.contentItemName ?? DEFAULT_CONTENT_ITEM_NAME;
 }

package/lib/site-origin.ts

@@ -0,0 +1,67 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { getSiteEnv } from "./site-env";
+
+type EnvironmentVariables = Record<string, string | undefined>;
+
+export const SITE_ORIGIN_ENV = "PAPYRUS_SITE_ORIGIN";
+
+/**
+ * The site's public origin cannot be read from the request on Amplify SSR (WEB_COMPUTE):
+ * there `request.nextUrl.origin` is the compute adapter's internal https://localhost:3000.
+ * It also must never be derived from Host or X-Forwarded-* headers, which a client can set.
+ * The one trusted source is PAPYRUS_SITE_ORIGIN, set by the app shell from the site's host.
+ */
+export class SiteOriginNotConfiguredError extends Error {
+  readonly status = 503;
+  readonly code = "site_origin_not_configured";
+}
+
+export function siteOriginNotConfiguredResponse(error: SiteOriginNotConfiguredError): NextResponse {
+  return NextResponse.json({ error: error.code, message: error.message }, { status: error.status, headers: { "cache-control": "no-store" } });
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+
+function configuredOrigin(value: string): string {
+  const invalid = () => new SiteOriginNotConfiguredError(`${SITE_ORIGIN_ENV} must be an https origin such as https://example.com with no path.`);
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw invalid();
+  }
+  if (parsed.protocol !== "https:" || parsed.origin !== value) throw invalid();
+  return parsed.origin;
+}
+
+function siteEnvOrNull(environment: EnvironmentVariables): string | null {
+  try {
+    return getSiteEnv(environment);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The site's public origin, from trusted configuration.
+ * - PAPYRUS_SITE_ORIGIN set: it must be an https origin with no path; it is used as is.
+ * - Unset: `request.nextUrl.origin` only when it is loopback, SITE_ENV resolves to development
+ *   and NODE_ENV is not production (a local `next dev` server). Anything else, production and staging included, throws
+ *   SiteOriginNotConfiguredError so routes answer 503 instead of redirecting to localhost.
+ */
+export function publicSiteOrigin(request: Pick<NextRequest, "nextUrl">, environment: EnvironmentVariables = process.env): string {
+  const configured = (environment[SITE_ORIGIN_ENV] ?? "").trim();
+  if (configured) return configuredOrigin(configured);
+  const { hostname, origin } = request.nextUrl;
+  // SITE_ENV defaults to development when a runtime never received it, so NODE_ENV=production also closes the fallback.
+  const developing = siteEnvOrNull(environment) === "development" && environment.NODE_ENV !== "production";
+  if (isLoopbackHostname(hostname) && developing) return origin;
+  throw new SiteOriginNotConfiguredError(`${SITE_ORIGIN_ENV} is not set; this site cannot tell its public origin.`);
+}
+
+/** An absolute URL on the site's public origin, for redirects. Fails closed like publicSiteOrigin. */
+export function publicSiteUrl(path: string, request: Pick<NextRequest, "nextUrl">, environment: EnvironmentVariables = process.env): URL {
+  return new URL(path, publicSiteOrigin(request, environment));
+}

package/middleware.ts

@@ -5,6 +5,7 @@ import { newsroomHref } from "./lib/newsroom-base-path";
 import { getReaderBasePath } from "./lib/reader-base-path";
 import { isStagingGatedPath, isStaticOrApiPath } from "./lib/staging-gated-path";
 import { getSiteEnv, isIndexable } from "./lib/site-env";
+import { SiteOriginNotConfiguredError, publicSiteUrl, siteOriginNotConfiguredResponse } from "./lib/site-origin";
 import { getStagingAccess } from "./lib/staging-gate";
 import {
   isPreviewGatedPath,
@@ -38,11 +39,11 @@ function routeRequest(request: NextRequest): NextResponse {
   }
 
   if (pathname === "/newsroom" || pathname === "/newsroom/") {
-    return NextResponse.redirect(new URL(`/${request.nextUrl.search}`, request.url));
+    return NextResponse.redirect(publicSiteUrl(`/${request.nextUrl.search}`, request));
   }
   if (pathname.startsWith("/newsroom/")) {
     const target = pathname.slice("/newsroom".length) || "/";
-    return NextResponse.redirect(new URL(`${target}${request.nextUrl.search}`, request.url));
+    return NextResponse.redirect(publicSiteUrl(`${target}${request.nextUrl.search}`, request));
   }
 
   if (pathname === "/" || pathname === "") {
@@ -59,6 +60,16 @@ function routeRequest(request: NextRequest): NextResponse {
 }
 
 export async function middleware(request: NextRequest): Promise<NextResponse> {
+  try {
+    return await handleRequest(request);
+  } catch (error) {
+    // Redirects name the site's public origin (request.url is localhost on Amplify); without it, fail closed.
+    if (error instanceof SiteOriginNotConfiguredError) return withRobotsHeader(siteOriginNotConfiguredResponse(error));
+    throw error;
+  }
+}
+
+async function handleRequest(request: NextRequest): Promise<NextResponse> {
   let sessionResponse: NextResponse | null = null;
   const { pathname } = request.nextUrl;
   const gated = isStaticPreviewEnabled()
@@ -68,7 +79,7 @@ export async function middleware(request: NextRequest): Promise<NextResponse> {
     sessionResponse = NextResponse.next();
     const access = await getStagingAccess(request, sessionResponse);
     if (access === "anonymous") {
-      return withRobotsHeader(NextResponse.redirect(new URL(newsroomHref(), request.url)));
+      return withRobotsHeader(NextResponse.redirect(publicSiteUrl(newsroomHref(), request)));
     }
     if (access === "forbidden") {
       return withRobotsHeader(new NextResponse("Staging is limited to editors and admins.", { status: 403 }));