@anthusai/papyrus 5.3.0 → 5.5.0

package/amplify/functions/shared/python-bundle.js

@@ -78,23 +78,29 @@ export function siteFilesContentHash(siteFiles) {
 function pipSpec() {
     return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
+/** What the first pip install gets: `papyrus-newsroom` with its dependencies, plus the function's own requirements. Empty means skip it. */
+export function firstPipRequirements(options) {
+    return [...(options.noDeps ? [] : [pipSpec()]), ...(options.requirements ?? [])];
+}
 function bundleFromPip(outputDir, options) {
     const extra = (process.env.PAPYRUS_PIP_EXTRA_ARGS ?? "").trim().split(/\s+/).filter(Boolean);
     const python = (process.env.PAPYRUS_PIP_PYTHON ?? "python3").trim();
-    execFileSync(python, [
-        "-m", "pip", "install",
-        "--target", outputDir,
-        "--no-cache-dir",
-        "--platform", "manylinux2014_aarch64",
-        "--implementation", "cp",
-        "--python-version", "3.12",
-        "--only-binary=:all:",
-        // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
-        "--ignore-requires-python",
-        ...extra,
-        ...(options.noDeps ? [] : [pipSpec()]),
-        ...(options.requirements ?? []),
-    ], { stdio: "inherit" });
+    const requirements = firstPipRequirements(options);
+    if (requirements.length > 0) {
+        execFileSync(python, [
+            "-m", "pip", "install",
+            "--target", outputDir,
+            "--no-cache-dir",
+            "--platform", "manylinux2014_aarch64",
+            "--implementation", "cp",
+            "--python-version", "3.12",
+            "--only-binary=:all:",
+            // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
+            "--ignore-requires-python",
+            ...extra,
+            ...requirements,
+        ], { stdio: "inherit" });
+    }
     if (options.noDeps) {
         execFileSync(python, [
             "-m", "pip", "install",

package/amplify/functions/shared/python-bundle.ts

@@ -102,27 +102,34 @@ function pipSpec(): string {
   return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
 
+/** What the first pip install gets: `papyrus-newsroom` with its dependencies, plus the function's own requirements. Empty means skip it. */
+export function firstPipRequirements(options: Pick<PythonBundleOptions, "noDeps" | "requirements">): string[] {
+  return [...(options.noDeps ? [] : [pipSpec()]), ...(options.requirements ?? [])];
+}
+
 function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
   const extra = (process.env.PAPYRUS_PIP_EXTRA_ARGS ?? "").trim().split(/\s+/).filter(Boolean);
   const python = (process.env.PAPYRUS_PIP_PYTHON ?? "python3").trim();
-  execFileSync(
-    python,
-    [
-      "-m", "pip", "install",
-      "--target", outputDir,
-      "--no-cache-dir",
-      "--platform", "manylinux2014_aarch64",
-      "--implementation", "cp",
-      "--python-version", "3.12",
-      "--only-binary=:all:",
-      // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
-      "--ignore-requires-python",
-      ...extra,
-      ...(options.noDeps ? [] : [pipSpec()]),
-      ...(options.requirements ?? []),
-    ],
-    { stdio: "inherit" },
-  );
+  const requirements = firstPipRequirements(options);
+  if (requirements.length > 0) {
+    execFileSync(
+      python,
+      [
+        "-m", "pip", "install",
+        "--target", outputDir,
+        "--no-cache-dir",
+        "--platform", "manylinux2014_aarch64",
+        "--implementation", "cp",
+        "--python-version", "3.12",
+        "--only-binary=:all:",
+        // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
+        "--ignore-requires-python",
+        ...extra,
+        ...requirements,
+      ],
+      { stdio: "inherit" },
+    );
+  }
   if (options.noDeps) {
     execFileSync(
       python,

package/amplify/publication/redirect-and-index.js

@@ -12,6 +12,9 @@ async function lookUpRedirectTarget(uri) {
 }
 
 function rewriteToIndexDocument(uri) {
+  if (uri === "/404") {
+    return "/404.html";
+  }
   if (uri.endsWith("/")) {
     return uri + "index.html";
   }

package/amplify/publication/redirect-rules.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
+/** Mirrors DIRECTORY_HTML_PATTERN and DIRECTORY_SLASH_PATTERN in standard/config.py. */
+const DIRECTORY_HTML_PATTERN = "^/(?!(?:.*/)?index\\.html$)(.+)\\.html$";
+const DIRECTORY_SLASH_PATTERN = "^/((?:[^/]+/)*[^/.]+)$";
 const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
 const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
 /**
@@ -14,7 +17,9 @@ export function edgeRulesFromSettings(settings) {
         x: rule.except ?? [],
     }));
     if (settings.urls?.style === "directory") {
-        rules.push({ p: "^/(.+)\\.html$", t: "/$1/", s: 301, x: ["/404.html"] });
+        // /x.html to /x/ (a directory index file such as /x/index.html is served as it is), then /x to /x/.
+        rules.push({ p: DIRECTORY_HTML_PATTERN, t: "/$1/", s: 301, x: ["/404.html"] });
+        rules.push({ p: DIRECTORY_SLASH_PATTERN, t: "/$1/", s: 301, x: ["/404"] });
     }
     return rules;
 }

package/amplify/publication/redirect-rules.ts

@@ -4,6 +4,10 @@ import { resolve } from "node:path";
 /** One pattern redirect as the edge function reads it: regex, target with $1..$9, status, excluded paths. */
 export type EdgeRedirectRule = { p: string; t: string; s: number; x: string[] };
 
+/** Mirrors DIRECTORY_HTML_PATTERN and DIRECTORY_SLASH_PATTERN in standard/config.py. */
+const DIRECTORY_HTML_PATTERN = "^/(?!(?:.*/)?index\\.html$)(.+)\\.html$";
+const DIRECTORY_SLASH_PATTERN = "^/((?:[^/]+/)*[^/.]+)$";
+
 const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
 const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
 
@@ -22,7 +26,9 @@ export function edgeRulesFromSettings(settings: ProjectionSettings): EdgeRedirec
     x: rule.except ?? [],
   }));
   if (settings.urls?.style === "directory") {
-    rules.push({ p: "^/(.+)\\.html$", t: "/$1/", s: 301, x: ["/404.html"] });
+    // /x.html to /x/ (a directory index file such as /x/index.html is served as it is), then /x to /x/.
+    rules.push({ p: DIRECTORY_HTML_PATTERN, t: "/$1/", s: 301, x: ["/404.html"] });
+    rules.push({ p: DIRECTORY_SLASH_PATTERN, t: "/$1/", s: 301, x: ["/404"] });
   }
   return rules;
 }

package/app/api/newsroom/curation/context/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCurationRoute } from "../../../../../lib/curation-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleCurationRoute(request, "context");
+}

package/app/api/newsroom/curation/priming/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCurationRoute } from "../../../../../lib/curation-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleCurationRoute(request, "priming");
+}

package/app/api/newsroom/curation/publication/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCurationRoute } from "../../../../../lib/curation-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleCurationRoute(request, "publication");
+}

package/bin/papyrus-infra.mjs

@@ -19,6 +19,7 @@ const USAGE = [
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
   "       papyrus-infra deploy-edge --stack NAME --template FILE [--adoption-template FILE --adopt-resources FILE] [--parameter KEY=VALUE]... [--delete-function NAME] [--only-branch main] [--only-app-id ID] [--region R]",
+  "       papyrus-infra compile-edge-function --static-dir web [--out FILE]",
   "       papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]",
 ].join("\n");
 
@@ -36,11 +37,29 @@ const resolveEnvironmentOrExit = () => {
   }
 };
 const command = args[0];
-if (command !== "synth" && command !== "print-buildspec" && command !== "deploy" && command !== "deploy-edge") {
+if (command !== "synth" && command !== "print-buildspec" && command !== "deploy" && command !== "deploy-edge" && command !== "compile-edge-function") {
   console.error(USAGE);
   process.exit(command ? 1 : 0);
 }
 
+if (command === "compile-edge-function") {
+  // The viewer-request CloudFront Function with the site's projection.json rules compiled in: for an edge stack that is
+  // not deployed by the CMS backend, so that no site writes its own redirect function.
+  const staticDir = opt("static-dir");
+  if (!staticDir) {
+    console.error(USAGE);
+    process.exit(1);
+  }
+  const { compileRedirectFunctionSource, readEdgeConfig } = await import("../amplify/publication/redirect-rules.js");
+  const functionSource = fs.readFileSync(new URL("../amplify/publication/redirect-and-index.js", import.meta.url), "utf8");
+  const config = readEdgeConfig(staticDir);
+  const compiled = compileRedirectFunctionSource(functionSource, config.rules, { negotiateMarkdown: config.negotiateMarkdown });
+  const out = opt("out");
+  if (out) fs.writeFileSync(path.resolve(out), compiled);
+  else process.stdout.write(compiled);
+  process.exit(0);
+}
+
 if (command === "deploy-edge") {
   const buildAppId = process.env.AWS_APP_ID;
   const buildBranch = process.env.AWS_BRANCH;

package/components/newsroom-curation-bootstrap.tsx

@@ -0,0 +1,45 @@
+'use client';
+
+import {useEffect,useState,type ReactNode} from 'react';
+import {loadProspectusAccountState} from '../lib/prospectus-account-client';
+import type {CurationBootstrap} from '../lib/curation-client';
+import {NewsroomCurationProvider} from './newsroom-curation-provider';
+
+type Fetcher=(input:string,init?:RequestInit)=>Promise<Response>;
+const CONTEXT_PATH='/api/newsroom/curation/context';
+
+function validBootstrap(value:unknown):value is CurationBootstrap{
+  const body=value as Partial<CurationBootstrap>|null;
+  const scope=body?.scope;
+  return !!scope&&[scope.accountId,scope.publicationId,scope.bindingRevision].every(item=>typeof item==='string'&&item.trim()!=='')
+    &&(body!.mode==='embedded'||body!.mode==='remote')&&Array.isArray(body!.capabilities);
+}
+
+/**
+ * Ask the server for the curation bootstrap, or null. Only a signed-in person with a selected
+ * account causes a context read; every other outcome (no Prospectus, signed out, no selection,
+ * any refusal or failure) is null, so the released CMS is unchanged.
+ */
+export async function loadCurationBootstrap(returnPath:string,fetcher:Fetcher=fetch):Promise<CurationBootstrap|null>{
+  try{
+    const account=await loadProspectusAccountState(returnPath,fetcher);
+    if(account.status!=='signedIn'||!account.selectedAccountId)return null;
+    const response=await fetcher(CONTEXT_PATH,{credentials:'same-origin',cache:'no-store'});
+    if(!response.ok)return null;
+    const body=await response.json().catch(()=>null);
+    if(!validBootstrap(body)||body.scope.accountId!==account.selectedAccountId)return null;
+    return body;
+  }catch{return null;}
+}
+
+/** Mounts the curation provider for the References tab. Fails closed to no provider content. */
+export function NewsroomCurationBootstrap({enabled=true,children}:{enabled?:boolean;children:ReactNode}){
+  const [bootstrap,setBootstrap]=useState<CurationBootstrap|null>(null);
+  useEffect(()=>{
+    if(!enabled)return;
+    let current=true;
+    void loadCurationBootstrap(window.location.pathname).then(value=>{if(current)setBootstrap(value);});
+    return()=>{current=false;setBootstrap(null);};
+  },[enabled]);
+  return <NewsroomCurationProvider bootstrap={bootstrap}>{children}</NewsroomCurationProvider>;
+}

package/components/topic-steering-workspace.tsx

@@ -90,6 +90,7 @@ import { ReferenceSourcePreview } from "./reference-source-preview";
 import type { ReaderAuthSnapshot } from "./reader-auth-state";
 import { NewsDeskAccessGate } from "./newsroom-access-gate";
 import { NewsroomOpsOverview } from "./newsroom-ops-overview";
+import { NewsroomCurationBootstrap } from "./newsroom-curation-bootstrap";
 import { NewsroomReferencesView } from "./newsroom-references-view";
 import { NewsroomAssignmentsView } from "./newsroom-assignments-view";
 import { NewsroomTopicsView } from "./newsroom-topics-view";
@@ -3116,6 +3117,7 @@ function NewsDeskDashboard({
           />
         ) : null}
         {activeTab === "references" ? (
+          <NewsroomCurationBootstrap enabled={!dashboard.isDemo}>
           <NewsroomReferencesView
             demo={Boolean(dashboard.isDemo)}
             disabled={controlsDisabled}
@@ -3153,6 +3155,7 @@ function NewsDeskDashboard({
             referenceAttachments={referenceAttachments}
             references={references}
           />
+          </NewsroomCurationBootstrap>
         ) : null}
         {activeTab === "messages" ? (
           <MessagesDeskView

package/lib/curation-routes.ts

@@ -0,0 +1,342 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { SITE_BRAND } from "./site-brand";
+import type { PublicationCapability } from "./prospectus-publication-access";
+import {
+  currentProspectusPublishingSelection,
+  signedInProspectusSession,
+  type ProspectusPublishingSelection,
+  type ProspectusSignInRouteOptions,
+} from "./prospectus-sign-in-routes";
+import { resolveProspectusSignInRuntime } from "./prospectus-session";
+
+/**
+ * Same-origin curation routes for the References tab. Each is an authenticated
+ * pass-through to the curation upstream (the central Cyclotron lab): this
+ * module decides who may call and what they may ask, the upstream repeats its
+ * own checks, and neither trusts the browser's pins as identity.
+ *
+ * Order, failing closed at each step: upstream configured, Origin and body,
+ * sealed session cookie, fresh Prospectus re-authorization, scope pins,
+ * capability, forward, then re-authorize again and verify the echoed scope
+ * before any byte of the answer reaches the browser.
+ */
+export const CURATION_UPSTREAM_URL_ENV = "PAPYRUS_CURATION_UPSTREAM_URL";
+export const CURATION_PUBLICATION_ID_ENV = "PAPYRUS_CURATION_PUBLICATION_ID";
+export const CURATION_MAXIMUM_REQUEST_BYTES = 4_000_000;
+export const CURATION_MAXIMUM_RESPONSE_BYTES = 8_000_000;
+export const CURATION_UPSTREAM_TIMEOUT_MILLISECONDS = 15_000;
+
+export type CurationRoute = "context" | "publication" | "priming";
+
+export interface CurationRouteOptions extends ProspectusSignInRouteOptions {
+  /** Overrides PAPYRUS_CURATION_UPSTREAM_URL. null means not configured. */
+  upstreamUrl?: string | null;
+  /** Overrides PAPYRUS_CURATION_PUBLICATION_ID, which defaults to the site brand id. */
+  publicationId?: string;
+  fetcher?: typeof fetch;
+  timeoutMilliseconds?: number;
+}
+
+const NO_STORE_HEADERS = { "cache-control": "no-store", "x-content-type-options": "nosniff" };
+const PIN_HEADERS = ["x-cyclotron-account", "x-papyrus-publication", "x-papyrus-binding"] as const;
+const PUBLICATION_OPERATION_CAPABILITIES: Record<string, PublicationCapability> = {
+  decide: "decide",
+  review: "review",
+  status: "read",
+  history: "read",
+  events: "read",
+  replay: "read",
+  steer: "steer",
+};
+const FORWARDED_UPSTREAM_REFUSALS = new Set([400, 401, 403, 409, 413, 415, 503]);
+
+/** Editor-facing wording for the refusal codes the curation upstream returns. Unknown codes get a generic line. */
+export const UPSTREAM_REFUSAL_MESSAGES: Record<string, string> = {
+  pins_required: "Your account or publication selection is incomplete. Refresh the page and try again.",
+  invalid_request: "That request could not be understood. Refresh the page and try again.",
+  json_required: "That request could not be understood. Refresh the page and try again.",
+  bearer_invalid: "Sign in again: your session expired. Your selection is preserved.",
+  access_refused: "Your account does not have access to this publication.",
+  outside_publication: "That item is outside the publication you selected.",
+  account_changed: "The selected account or publication changed. Refresh and try again.",
+  operation_unavailable: "This action is not available yet.",
+  firewall_overlap: "This example is also in material kept aside for checking results, so it cannot be added.",
+  auto_prime_failed: "Your example could not be fully applied. Check saved history before retrying.",
+  request_too_large: "That request is too large. Try something smaller.",
+  import_too_large: "That file is too large. Try a smaller file.",
+  storage_limit: "This publication has reached its storage limit for imported examples.",
+  authority_unavailable: "Account access could not be confirmed right now. Try again shortly.",
+  priming_not_configured: "Importing examples is not set up for this publication yet.",
+  status_unavailable: "Monitoring is not available right now. Try again shortly.",
+  live_disabled: "Live decisions are switched off for this publication.",
+  no_hosted_transformer: "Adding a reference from a web address is not available. Import a file instead.",
+};
+const GENERIC_UPSTREAM_REFUSAL = "The curation service refused the request. Check saved history before retrying.";
+
+class CurationRefusal extends Error {
+  constructor(readonly status: number, readonly code: string, message: string) {
+    super(message);
+  }
+}
+
+function refusal(status: number, code: string, message: string): CurationRefusal {
+  return new CurationRefusal(status, code, message);
+}
+
+function jsonResponse(body: unknown, status = 200, extraHeaders: Record<string, string> = {}): NextResponse {
+  return NextResponse.json(body, { status, headers: { ...NO_STORE_HEADERS, ...extraHeaders } });
+}
+
+function upstreamBase(options: CurationRouteOptions): URL | null {
+  const configured = options.upstreamUrl !== undefined ? options.upstreamUrl : process.env[CURATION_UPSTREAM_URL_ENV];
+  if (!configured?.trim()) return null;
+  try {
+    const url = new URL(configured.trim());
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if (url.protocol !== "https:" && !(loopback && url.protocol === "http:")) return null;
+    if (url.username || url.password) return null;
+    return url;
+  } catch {
+    return null;
+  }
+}
+
+function publicationIdFor(options: CurationRouteOptions): string {
+  return options.publicationId ?? (process.env[CURATION_PUBLICATION_ID_ENV]?.trim() || SITE_BRAND.id);
+}
+
+/** Which capability a priming GraphQL document needs. Any hint of a mutation requires review. */
+export function primingCapability(query: string): PublicationCapability {
+  return /\bmutation\b|\bprimingCommand\b/i.test(query) ? "review" : "read";
+}
+
+async function boundedText(request: NextRequest): Promise<string> {
+  const declared = Number(request.headers.get("content-length") ?? "0");
+  if (declared > CURATION_MAXIMUM_REQUEST_BYTES) throw refusal(413, "request_too_large", "Curation request exceeds the size limit.");
+  const text = await request.text();
+  if (Buffer.byteLength(text) > CURATION_MAXIMUM_REQUEST_BYTES) throw refusal(413, "request_too_large", "Curation request exceeds the size limit.");
+  return text;
+}
+
+async function boundedResponseText(response: Response): Promise<string> {
+  const declared = Number(response.headers.get("content-length") ?? "0");
+  if (declared > CURATION_MAXIMUM_RESPONSE_BYTES) throw refusal(502, "upstream_response_too_large", "The curation service answered too much.");
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > CURATION_MAXIMUM_RESPONSE_BYTES) {
+      await reader.cancel();
+      throw refusal(502, "upstream_response_too_large", "The curation service answered too much.");
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+function sameSelection(left: ProspectusPublishingSelection, right: ProspectusPublishingSelection | null): boolean {
+  return right !== null
+    && left.personId === right.personId
+    && left.accountId === right.accountId
+    && left.role === right.role
+    && left.publicationCapabilities.join() === right.publicationCapabilities.join();
+}
+
+interface ParsedRequest {
+  capability: PublicationCapability;
+  /** Raw body to forward; undefined for the context read. */
+  body?: string;
+}
+
+function parseRequest(route: CurationRoute, text: string | null): ParsedRequest {
+  if (route === "context") return { capability: "read" };
+  let value: unknown;
+  try {
+    value = JSON.parse(text ?? "");
+  } catch {
+    throw refusal(400, "invalid_request", "A JSON curation request is required.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw refusal(400, "invalid_request", "A JSON curation request is required.");
+  const body = value as Record<string, unknown>;
+  if (route === "publication") {
+    const keys = Object.keys(body).sort().join();
+    const operation = typeof body.operation === "string" ? body.operation : "";
+    if (keys !== "operation,payload" || !Object.hasOwn(PUBLICATION_OPERATION_CAPABILITIES, operation) || !body.payload || typeof body.payload !== "object" || Array.isArray(body.payload)) {
+      throw refusal(400, "invalid_request", "An explicit publication operation is required.");
+    }
+    return { capability: PUBLICATION_OPERATION_CAPABILITIES[operation], body: text! };
+  }
+  const variablesValid = body.variables === undefined || (body.variables !== null && typeof body.variables === "object" && !Array.isArray(body.variables));
+  if (typeof body.query !== "string" || !body.query.trim() || !variablesValid || Object.keys(body).some((key) => key !== "query" && key !== "variables")) {
+    throw refusal(400, "invalid_request", "An explicit priming query is required.");
+  }
+  return { capability: primingCapability(body.query), body: text! };
+}
+
+function requestPins(request: NextRequest, selection: ProspectusPublishingSelection, publicationId: string): Record<(typeof PIN_HEADERS)[number], string> {
+  const pins = Object.fromEntries(PIN_HEADERS.map((name) => [name, request.headers.get(name)?.trim() ?? ""])) as Record<(typeof PIN_HEADERS)[number], string>;
+  if (PIN_HEADERS.some((name) => !pins[name])) throw refusal(400, "pins_required", "Expected account, publication and binding pins are required.");
+  if (pins["x-cyclotron-account"] !== selection.accountId || pins["x-papyrus-publication"] !== publicationId) {
+    throw refusal(409, "account_changed", "The selected account or publication changed. Refresh and try again.");
+  }
+  return pins;
+}
+
+function authorizedCapabilities(selection: ProspectusPublishingSelection): PublicationCapability[] {
+  return selection.publicationCapabilities;
+}
+
+async function forward(
+  request: NextRequest,
+  route: CurationRoute,
+  base: URL,
+  options: CurationRouteOptions,
+  accessToken: string,
+  upstreamHeaders: Record<string, string>,
+  body: string | undefined,
+): Promise<Response> {
+  const target = new URL(`/api/newsroom/curation/${route}`, base);
+  const headers: Record<string, string> = {
+    ...upstreamHeaders,
+    authorization: `Bearer ${accessToken}`,
+    accept: "application/json",
+  };
+  if (body !== undefined) headers["content-type"] = "application/json";
+  const response = await (options.fetcher ?? fetch)(target, {
+    method: route === "context" ? "GET" : "POST",
+    headers,
+    body,
+    redirect: "manual",
+    cache: "no-store",
+    signal: AbortSignal.timeout(options.timeoutMilliseconds ?? CURATION_UPSTREAM_TIMEOUT_MILLISECONDS),
+  });
+  if (response.status >= 300 && response.status < 400) throw refusal(502, "upstream_redirect", "The curation service redirected, which is refused.");
+  return response;
+}
+
+function sanitizedUpstreamRefusal(status: number, text: string): CurationRefusal {
+  let code = "";
+  try {
+    const parsed = JSON.parse(text) as { code?: unknown };
+    code = typeof parsed.code === "string" ? parsed.code : "";
+  } catch {
+    code = "";
+  }
+  const known = Object.hasOwn(UPSTREAM_REFUSAL_MESSAGES, code);
+  return refusal(status, known ? code : "upstream_refused", known ? UPSTREAM_REFUSAL_MESSAGES[code] : GENERIC_UPSTREAM_REFUSAL);
+}
+
+function validPriming(value: unknown): Record<string, unknown> | null {
+  const priming = value as { listId?: unknown; classifiers?: unknown; transformers?: unknown } | null;
+  if (!priming || typeof priming.listId !== "string" || !priming.listId || !Array.isArray(priming.classifiers) || !priming.classifiers.length) return null;
+  return { listId: priming.listId, classifiers: priming.classifiers, transformers: Array.isArray(priming.transformers) ? priming.transformers : [] };
+}
+
+function contextBootstrap(value: unknown, selection: ProspectusPublishingSelection, publicationId: string): Record<string, unknown> {
+  const body = value as { scope?: Record<string, unknown>; mode?: unknown; priming?: unknown; capabilities?: unknown; bindingRef?: unknown } | null;
+  const scope = body?.scope;
+  if (!scope || scope.accountId !== selection.accountId || scope.publicationId !== publicationId
+    || typeof scope.bindingRevision !== "string" || !scope.bindingRevision
+    || (body!.mode !== "embedded" && body!.mode !== "remote") || !Array.isArray(body!.capabilities)) {
+    throw refusal(502, "upstream_scope_mismatch", "The curation service answered for a different scope.");
+  }
+  const granted = new Set<string>(authorizedCapabilities(selection));
+  return {
+    scope: { accountId: scope.accountId, publicationId: scope.publicationId, bindingRevision: scope.bindingRevision },
+    mode: body!.mode,
+    priming: validPriming(body!.priming),
+    capabilities: body!.capabilities.filter((capability): capability is string => typeof capability === "string" && granted.has(capability)),
+    bindingRef: body!.bindingRef ?? null,
+  };
+}
+
+function verifiedPublicationEnvelope(value: unknown, pins: Record<string, string>): void {
+  const envelope = value as Record<string, unknown> | null;
+  if (!envelope || envelope.contractVersion !== "cyclotron-publication/v1"
+    || envelope.accountId !== pins["x-cyclotron-account"]
+    || envelope.publicationId !== pins["x-papyrus-publication"]
+    || envelope.bindingRevision !== pins["x-papyrus-binding"]) {
+    throw refusal(502, "upstream_scope_mismatch", "The curation service answered for a different scope.");
+  }
+}
+
+export async function handleCurationRoute(request: NextRequest, route: CurationRoute, options: CurationRouteOptions = {}): Promise<NextResponse> {
+  try {
+    const base = upstreamBase(options);
+    if (!base) return jsonResponse({ error: "curation_not_configured", message: "Curation is not configured for this site." }, 503);
+
+    const origin = request.headers.get("origin");
+    if (route !== "context" ? origin !== request.nextUrl.origin : origin !== null && origin !== request.nextUrl.origin) {
+      throw refusal(403, "cross_origin", "Curation requests must come from this site.");
+    }
+    let text: string | null = null;
+    if (route !== "context") {
+      if (request.headers.get("content-type")?.split(";")[0].trim() !== "application/json") throw refusal(415, "json_required", "A JSON request is required.");
+      text = await boundedText(request);
+    }
+
+    const runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(request.nextUrl.origin);
+    if (!runtime) return jsonResponse({ error: "prospectus_sign_in_unavailable", message: "Sign-in through Prospectus is not configured for this site." }, 503);
+    const nowInSeconds = options.nowInSeconds?.();
+    const cookieSession = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
+    if (!cookieSession?.selectedAccountId) throw refusal(401, "signed_out", "Sign in and choose an account first.");
+
+    const selection = await currentProspectusPublishingSelection(request, options);
+    if (!selection || selection.accountId !== cookieSession.selectedAccountId) throw refusal(403, "not_authorized", "Your account no longer grants access.");
+
+    const publicationId = publicationIdFor(options);
+    const pins = route === "context" ? null : requestPins(request, selection, publicationId);
+    const parsed = parseRequest(route, text);
+    if (!authorizedCapabilities(selection).includes(parsed.capability)) throw refusal(403, "capability_refused", "Your role does not allow this curation action.");
+
+    // The token is read from the sealed cookie again for this call, never held across calls.
+    const fresh = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
+    if (!fresh || fresh.selectedAccountId !== selection.accountId) throw refusal(401, "signed_out", "Sign in and choose an account first.");
+    const upstreamHeaders = pins ?? { "x-cyclotron-account": selection.accountId, "x-papyrus-publication": publicationId };
+    const upstream = await forward(request, route, base, options, fresh.accessToken, upstreamHeaders, parsed.body);
+    const upstreamText = await boundedResponseText(upstream);
+    if (upstream.status !== 200) {
+      if (FORWARDED_UPSTREAM_REFUSALS.has(upstream.status)) throw sanitizedUpstreamRefusal(upstream.status, upstreamText);
+      throw refusal(502, "upstream_failed", "The curation service could not complete the request. Check saved history before retrying.");
+    }
+
+    // Post-upstream check: nothing is released if authority or scope moved while we waited.
+    if (!sameSelection(selection, await currentProspectusPublishingSelection(request, options))) {
+      throw refusal(409, "account_changed", "The selected account or access changed. Refresh and try again.");
+    }
+    let answer: unknown;
+    try {
+      answer = JSON.parse(upstreamText);
+    } catch {
+      throw refusal(502, "upstream_invalid", "The curation service answered with an invalid response.");
+    }
+    if (pins) {
+      if (PIN_HEADERS.some((name) => upstream.headers.get(name) !== pins[name])) {
+        throw refusal(502, "upstream_scope_mismatch", "The curation service answered for a different scope.");
+      }
+      if (route === "publication") verifiedPublicationEnvelope(answer, pins);
+      if (route === "priming" && (!answer || typeof answer !== "object" || Array.isArray(answer))) {
+        throw refusal(502, "upstream_invalid", "The curation service answered with an invalid response.");
+      }
+      return jsonResponse(answer, 200, pins);
+    }
+    const bootstrap = contextBootstrap(answer, selection, publicationId);
+    const bindingRevision = (bootstrap.scope as { bindingRevision: string }).bindingRevision;
+    if (upstream.headers.get("x-cyclotron-account") !== selection.accountId
+      || upstream.headers.get("x-papyrus-publication") !== publicationId
+      || upstream.headers.get("x-papyrus-binding") !== bindingRevision) {
+      throw refusal(502, "upstream_scope_mismatch", "The curation service answered for a different scope.");
+    }
+    return jsonResponse(bootstrap, 200, {
+      "x-cyclotron-account": selection.accountId, "x-papyrus-publication": publicationId, "x-papyrus-binding": bindingRevision,
+    });
+  } catch (error) {
+    if (error instanceof CurationRefusal) return jsonResponse({ error: error.message, code: error.code }, error.status);
+    console.error(`Curation route failed (${error instanceof Error ? error.name : "error"}).`);
+    return jsonResponse({ error: "Curation is unavailable. Check saved history before retrying.", code: "curation_unavailable" }, 503);
+  }
+}

package/package.json

@@ -98,6 +98,7 @@
     "./components/newsroom-assignments-view": "./components/newsroom-assignments-view.tsx",
     "./components/newsroom-board-view": "./components/newsroom-board-view.tsx",
     "./components/newsroom-client-shell": "./components/newsroom-client-shell.tsx",
+    "./components/newsroom-curation-bootstrap": "./components/newsroom-curation-bootstrap.tsx",
     "./components/newsroom-curation-provider": "./components/newsroom-curation-provider.tsx",
     "./components/newsroom-ops-overview": "./components/newsroom-ops-overview.tsx",
     "./components/newsroom-ops-shell": "./components/newsroom-ops-shell.tsx",
@@ -191,6 +192,7 @@
     "./lib/content-types": "./lib/content-types.ts",
     "./lib/curation-client": "./lib/curation-client.ts",
     "./lib/curation-delegation-helpers": "./lib/curation-delegation-helpers.ts",
+    "./lib/curation-routes": "./lib/curation-routes.ts",
     "./lib/cyclotron-suggestions": "./lib/cyclotron-suggestions.ts",
     "./lib/define-site": "./lib/define-site.ts",
     "./lib/demo-amplify-outputs": "./lib/demo-amplify-outputs.ts",
@@ -336,6 +338,9 @@
     "./app/api/local-preview/derive/route": "./app/api/local-preview/derive/route.ts",
     "./app/api/local-preview/media/route": "./app/api/local-preview/media/route.ts",
     "./app/api/media/[...path]/route": "./app/api/media/[...path]/route.ts",
+    "./app/api/newsroom/curation/context/route": "./app/api/newsroom/curation/context/route.ts",
+    "./app/api/newsroom/curation/priming/route": "./app/api/newsroom/curation/priming/route.ts",
+    "./app/api/newsroom/curation/publication/route": "./app/api/newsroom/curation/publication/route.ts",
     "./app/api/revalidate/route": "./app/api/revalidate/route.ts",
     "./app/archive/page": "./app/archive/page.tsx",
     "./app/articles/[slug]/page": "./app/articles/[slug]/page.tsx",
@@ -401,7 +406,7 @@
       "optional": true
     }
   },
-  "version": "5.3.0",
+  "version": "5.5.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.3.0",
+  "version": "5.5.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -170,6 +170,39 @@
         "dynamic": "\"force-dynamic\""
       }
     },
+    {
+      "file": "app/api/newsroom/curation/context/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/newsroom/curation/priming/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/newsroom/curation/publication/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/revalidate/route.ts",
       "hasDefault": false,