@anthusai/papyrus 5.33.2 → 5.34.0

package/amplify/site-backend-config.ts

@@ -166,7 +166,7 @@ export type PapyrusSiteBackendConfig = {
   /**
    * SES receipt options for a site that is not the legacy p.apyr.us backend.
    * By default the site gets its own brand-named rule set that is never
-   * activated by CloudFormation (SES allows one active rule set per region).
+   * activated by CloudFormation (SES allows one active rule set per account/region).
    */
   inboundEmailSes?: {
     /** Add this site's rule to a rule set another stack owns instead of creating one. */

package/amplify/site-backend-names.js

@@ -68,8 +68,10 @@ export function deriveStorageBackupVaultName(identity, explicitName) {
 /**
  * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
  * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
- * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
- * its own brand-named rule set and never activates it from CloudFormation.
+ * SES allows one ACTIVE receipt rule set per account and region. A non-legacy
+ * site creates its own brand-named rule set and never activates it from
+ * CloudFormation. SES accounts that receive the same domain process their
+ * matching rules independently; the limit does not span accounts.
  */
 export function deriveReceiptRuleSetName(identity, inboundEmailDomain) {
     const name = isLegacyProductionApp(identity)

package/amplify/site-backend-names.ts

@@ -109,8 +109,10 @@ export function deriveStorageBackupVaultName(identity: SiteBackendIdentity, expl
 /**
  * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
  * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
- * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
- * its own brand-named rule set and never activates it from CloudFormation.
+ * SES allows one ACTIVE receipt rule set per account and region. A non-legacy
+ * site creates its own brand-named rule set and never activates it from
+ * CloudFormation. SES accounts that receive the same domain process their
+ * matching rules independently; the limit does not span accounts.
  */
 export function deriveReceiptRuleSetName(identity: SiteBackendIdentity, inboundEmailDomain: string): string {
   const name = isLegacyProductionApp(identity)

package/amplify/site-backend.js

@@ -469,7 +469,7 @@ export function defineSiteBackend(papyrusSite) {
             resources: ["*"],
         }));
         const inboundEventStack = Stack.of(receiveLambda);
-        // SES allows one active receipt rule set per region, so a non-legacy site
+        // SES allows one active receipt rule set per account and region, so a non-legacy site
         // creates its own brand-named rule set and never activates it here.
         const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
         if (inboundSesPlan.createReceiptRules) {

package/amplify/site-backend.ts

@@ -601,7 +601,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
     const inboundEventStack = Stack.of(receiveLambda);
 
-    // SES allows one active receipt rule set per region, so a non-legacy site
+    // SES allows one active receipt rule set per account and region, so a non-legacy site
     // creates its own brand-named rule set and never activates it here.
     const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
     if (inboundSesPlan.createReceiptRules) {

package/components/news-desk-client-provider.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { Hub } from "aws-amplify/utils";
+import { isUnauthenticatedError } from "./reader-auth-state";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import type { DevSandboxEditorAuth } from "../lib/dev-sandbox-editor-auth";
 import type { CategorySteeringDashboard } from "../lib/category-repository";
@@ -14,9 +15,10 @@ import {
 } from "./news-desk-taxonomy-client";
 import {
   beginAccessCheck,
-  beginAuthenticatedDeskHydration,
+  beginDeskLoad,
   createInitialNewsDeskShellState,
   patchDashboard,
+  resolveAccessFailure,
   resolveDashboardFailure,
   resolveDashboardReady,
   resolveForbidden,
@@ -94,11 +96,11 @@ export function NewsDeskClientProvider({
       return;
     }
     if (access.status === "error") {
-      setShell((current) => resolveDashboardFailure(current, access.auth, access.error));
+      setShell((current) => resolveAccessFailure(current, access.error));
       return;
     }
 
-    setShell((current) => beginAuthenticatedDeskHydration(current, access.auth, { canManageUsers: access.isAdmin }));
+    setShell((current) => beginDeskLoad(current, access.auth));
 
     try {
       const dashboard = await loadEditorNewsDeskDashboard({ isAdmin: access.isAdmin });
@@ -106,6 +108,10 @@ export function NewsDeskClientProvider({
       setShell((current) => resolveDashboardReady(current, dashboard, access.auth, new Date().toISOString()));
     } catch (error) {
       if (bootstrapSequenceRef.current !== sequence) return;
+      if (isUnauthenticatedError(error)) {
+        setShell((current) => resolveSignedOut(current, { status: "signedOut", label: "Signed out" }));
+        return;
+      }
       if (isAuthorizationError(error)) {
         setShell((current) => resolveForbidden(current, access.auth));
         return;
@@ -132,11 +138,7 @@ export function NewsDeskClientProvider({
       ));
     } catch (error) {
       const auth = shellRef.current.auth;
-      setShell((current) => resolveDashboardFailure(
-        current,
-        auth,
-        error instanceof Error ? error.message : "Could not refresh assignments.",
-      ));
+      setShell((current) => resolvePrivateReadFailure(current, auth, error, "Could not refresh assignments."));
     }
   }, []);
 
@@ -153,11 +155,7 @@ export function NewsDeskClientProvider({
       ));
     } catch (error) {
       const auth = shellRef.current.auth;
-      setShell((current) => resolveDashboardFailure(
-        current,
-        auth,
-        error instanceof Error ? error.message : "Could not refresh doctrine records.",
-      ));
+      setShell((current) => resolvePrivateReadFailure(current, auth, error, "Could not refresh doctrine records."));
     }
   }, []);
 
@@ -175,11 +173,7 @@ export function NewsDeskClientProvider({
       ));
     } catch (error) {
       const auth = shellRef.current.auth;
-      setShell((current) => resolveDashboardFailure(
-        current,
-        auth,
-        error instanceof Error ? error.message : "Could not refresh the user directory.",
-      ));
+      setShell((current) => resolvePrivateReadFailure(current, auth, error, "Could not refresh the user directory."));
     }
   }, []);
 
@@ -221,6 +215,12 @@ function isAuthorizationError(error: unknown): boolean {
   return /not authorized|unauthorized|access denied|forbidden/i.test(message);
 }
 
+function resolvePrivateReadFailure(state: NewsDeskShellState, auth: NewsDeskShellState["auth"], error: unknown, fallback: string): NewsDeskShellState {
+  if (isUnauthenticatedError(error)) return resolveSignedOut(state, { status: "signedOut", label: "Signed out" });
+  if (isAuthorizationError(error)) return resolveForbidden(state, auth);
+  return resolveDashboardFailure(state, auth, error instanceof Error ? error.message : fallback);
+}
+
 export function useOptionalNewsDeskClient() {
   return useContext(NewsDeskClientContext);
 }

package/components/news-desk-taxonomy-client.ts

@@ -832,10 +832,8 @@ export async function loadEditorResolvedAccessState(): Promise<EditorAccessState
     };
   }
   try {
-    const snapshot = await loadReaderSessionSnapshot();
-    if (!snapshot.hasSession || snapshot.auth.status === "signedOut") {
-      return { status: "signedOut", isEditor: false, isAdmin: false, auth: snapshot.auth, error: null };
-    }
+    // One refreshed session supplies both identity and current group claims.
+    // A second, sequential session read only extends the blocking access check.
     const refreshed = await loadReaderSessionSnapshot({ forceRefresh: true });
     if (!refreshed.hasSession || refreshed.auth.status === "signedOut") {
       return { status: "signedOut", isEditor: false, isAdmin: false, auth: refreshed.auth, error: null };
@@ -883,9 +881,8 @@ export async function loadEditorNewsDeskDashboard({ isAdmin }: { isAdmin: boolea
     isAdmin ? loadUserDirectory() : Promise.resolve([]),
   ]);
   const summaryError = summaryResult.status === "rejected" ? summaryResult.reason : null;
-  if (summaryError && isUnauthenticatedError(summaryError)) {
-    throw summaryError;
-  }
+  if (summaryError) throw summaryError;
+  if (userDirectoryResult.status === "rejected") throw userDirectoryResult.reason;
   const summary = summaryResult.status === "fulfilled" ? summaryResult.value : null;
   const userDirectory = userDirectoryResult.status === "fulfilled" ? userDirectoryResult.value : [];
 

package/components/newsroom-access-gate.tsx

@@ -6,11 +6,13 @@ import { SITE_BRAND } from "../lib/site-brand";
 import type { NewsDeskShellState } from "../lib/news-desk-session";
 import { cn } from "../lib/utils";
 import { NewsroomOpsShell } from "./newsroom-ops-shell";
+import { NewsroomOverviewSkeleton } from "./newsroom-overview-skeleton";
 import { ReaderAuthControl } from "./reader-auth-control";
 import { buttonVariants } from "./ui/button";
 
 export function NewsDeskAccessGate({ shell, showSectionTabs = false }: { shell: NewsDeskShellState | null; showSectionTabs?: boolean }) {
   const accessPhase = shell?.phase ?? "checkingAccess";
+  const pending = accessPhase === "checkingAccess" || accessPhase === "loadingDesk";
 
   return (
     <NewsroomOpsShell
@@ -21,9 +23,20 @@ export function NewsDeskAccessGate({ shell, showSectionTabs = false }: { shell:
       headerActions={(
         <Link className={cn(buttonVariants({ variant: "ghost", size: "sm" }))} href="/settings">Settings</Link>
       )}
-      pageTitle="Newsroom"
+      pageTitle={showSectionTabs ? "Notification Center" : "Newsroom"}
       showNavigation={showSectionTabs}
     >
+      {pending ? (showSectionTabs ? <NewsroomOverviewSkeleton /> : (
+        <div aria-label="Loading newsroom" className="space-y-4" data-newsroom-page-skeleton role="status">
+          <div className="h-6 w-48 rounded bg-muted" />
+          <div className="h-4 w-3/4 rounded bg-muted" />
+          <div className="grid gap-3 sm:grid-cols-2">
+            {Array.from({ length: 4 }, (_, index) => <div className="h-32 rounded-xl border bg-card p-4" key={index}>
+              <div className="h-4 w-2/3 rounded bg-muted" /><div className="mt-4 h-3 w-1/2 rounded bg-muted" />
+            </div>)}
+          </div>
+        </div>
+      )) : (
       <section aria-live="polite" data-news-desk-access={accessPhase} data-news-desk-access-phase={accessPhase}>
         <div className="space-y-3 rounded-xl border border-border bg-card p-6">
           <p className="m-0 text-[0.7rem] font-semibold uppercase tracking-[0.08em] text-muted-foreground">Access</p>
@@ -38,6 +51,7 @@ export function NewsDeskAccessGate({ shell, showSectionTabs = false }: { shell:
           ) : null}
         </div>
       </section>
+      )}
     </NewsroomOpsShell>
   );
 }

package/components/newsroom-article-editor.tsx

@@ -513,8 +513,10 @@ export function NewsroomArticleEditor({ articleId, demo, embedded = false }: { a
     }
     if (!editor) {
       return (
-        <div className="flex items-center gap-2 text-sm text-muted-foreground">
-          <Spinner /> Loading article…
+        <div aria-label="Loading article" className="space-y-5" role="status">
+          <div className="h-8 w-2/3 rounded bg-muted" />
+          <div className="grid gap-4 sm:grid-cols-2"><div className="h-12 rounded bg-muted" /><div className="h-12 rounded bg-muted" /></div>
+          <div className="h-64 rounded-xl border bg-card p-4"><div className="h-4 w-5/6 rounded bg-muted" /><div className="mt-3 h-4 w-3/4 rounded bg-muted" /></div>
         </div>
       );
     }

package/components/newsroom-articles-view.tsx

@@ -5,7 +5,6 @@ import Link from "next/link";
 import { useEffect, useMemo, useState } from "react";
 import { Badge } from "./ui/badge";
 import { buttonVariants } from "./ui/button";
-import { Spinner } from "./ui/spinner";
 import { Tabs, TabsList, TabsTrigger } from "./ui/tabs";
 import { SITE_BRAND } from "../lib/site-brand";
 import { getNewsroomNavHref } from "../lib/newsroom-nav";
@@ -89,15 +88,16 @@ export function NewsroomArticlesView({ demo }: { demo: boolean }) {
           </TabsList>
         </Tabs>
         {loadError ? <NewsroomOpsStatusBanner tone="error">{loadError}</NewsroomOpsStatusBanner> : null}
-        {rows === null && !loadError ? (
-          <div className="flex items-center gap-2 text-sm text-muted-foreground">
-            <Spinner /> Loading articles…
-          </div>
-        ) : null}
         {rows !== null && visibleRows.length === 0 ? (
           <p className="text-sm text-muted-foreground">Nothing here yet.</p>
         ) : null}
         <ul className="divide-y divide-border rounded-xl border border-border bg-card" data-newsroom-articles-list>
+          {rows === null && !loadError ? Array.from({ length: 5 }, (_, index) => (
+            <li aria-hidden="true" className="flex items-center justify-between px-4 py-3" key={index}>
+              <span className="w-2/3"><span className="block h-4 w-3/4 rounded bg-muted" /><span className="mt-2 block h-3 w-1/2 rounded bg-muted" /></span>
+              <span className="h-5 w-16 rounded bg-muted" />
+            </li>
+          )) : null}
           {visibleRows.map((row) => (
             <li key={row.id}>
               <Link

package/components/newsroom-board-view.tsx

@@ -160,7 +160,7 @@ export function NewsroomBoardView({ subject, deskId }: { subject: NewsroomBoardS
   if (!allowed) return <NewsDeskAccessGate shell={session?.shell ?? null} />;
   return <NewsroomOpsShell activeTab={subject === "contentItem" ? "articles" : subject === "desk" ? "desks" : "assignments"} appTitle={SITE_BRAND.appTitle} backLabel={SITE_BRAND.backToHomeLabel} pageTitle={pageTitle}
     headerActions={<>
-      <span role="status" className="organizer-board-note">{loading ? "Loading records…" : `${issues.length} records loaded.`}</span>
+      {!loading ? <span role="status" className="organizer-board-note">{issues.length} records loaded.</span> : null}
       <div role="group" aria-label="Record presentation" className="organizer-board-view-toggle"><button type="button" className="organizer-header-button" aria-pressed={view === "board"} onClick={() => setView("board")}>Board</button><button type="button" className="organizer-header-button" aria-pressed={view === "list"} onClick={() => setView("list")}>List</button></div>
       {showsContentItems && (
         <Link className="organizer-header-button" data-newsroom-article-new href={getNewsroomNavHref(newsroomHref("articles", "new"))}>
@@ -174,11 +174,16 @@ export function NewsroomBoardView({ subject, deskId }: { subject: NewsroomBoardS
       {error && <NewsroomOpsStatusBanner tone="error">{error}</NewsroomOpsStatusBanner>}
       {subject === "desk" && <IssueTypeFilter config={config} value={typeFilter} onChange={setTypeFilter} name="Record type" className="organizer-board-type-filter" />}
       <div className="organizer-board-body" data-detail-open={Boolean(issue)} ref={boardBodyRef} onScrollCapture={handleBoardScroll}>
-        <IssueCollection issues={issues} config={config} query={{ type: subject === "desk" ? issueTypeFromFilter(typeFilter) : boardType }} view={view}
+        {loading && !issues.length ? <div aria-label="Loading board records" className="grid w-full grid-cols-1 gap-3 sm:grid-cols-3" role="status">
+          {Array.from({ length: 3 }, (_, column) => <div className="min-h-64 space-y-3 rounded-xl border bg-card p-4" key={column}>
+            <div className="h-4 w-1/2 rounded bg-muted" />
+            {Array.from({ length: 2 }, (_, row) => <div className="h-24 rounded-lg border bg-background p-3" key={row}><div className="h-4 w-3/4 rounded bg-muted" /><div className="mt-3 h-3 w-1/2 rounded bg-muted" /></div>)}
+          </div>)}
+        </div> : <IssueCollection issues={issues} config={config} query={{ type: subject === "desk" ? issueTypeFromFilter(typeFilter) : boardType }} view={view}
           motion={lowMotion ? STATIC_MOTION : undefined}
           collapsedColumns={columnState.collapsedColumns} onToggleCollapse={columnState.toggleColumn} initialScroll="start"
           selectedIssueId={selected} detailOpen={Boolean(issue)} onSelectIssue={item => setSelected(item.id)} ariaLabel={pageTitle}
-          emptyMessage={loading ? "Loading records…" : error ? "Records could not be loaded." : "No records in this selection."} />
+          emptyMessage={error ? "Records could not be loaded." : "No records in this selection."} />}
         {issue && <IssueDetailPanel issue={issue} onClose={() => setSelected(null)} fields={[]}>
           {issue.kind === "contentItem"
             ? <>

package/components/newsroom-ops-overview.tsx

@@ -1,24 +1,13 @@
 "use client";
 
-import {
-  BookOpenIcon,
-  ClipboardListIcon,
-  FileTextIcon,
-  LayersIcon,
-  MessageSquareIcon,
-  NetworkIcon,
-  SearchIcon,
-  SettingsIcon,
-} from "lucide-react";
 import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { useMemo } from "react";
 import { Badge } from "./ui/badge";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card";
-import type { AssignmentRecord, MessageRecord, NewsroomSectionRecord, ReferenceRecord } from "../lib/category-repository";
-import { getNewsroomNavHref, NEWSROOM_OPS_NAV, type NewsroomNavTabId } from "../lib/newsroom-nav";
+import type { AssignmentRecord, NewsroomSectionRecord, ReferenceRecord } from "../lib/category-repository";
+import { getNewsroomNavHref } from "../lib/newsroom-nav";
 import {
-  countReferencesByStatus,
   filterReferencesByStatus,
   formatReferenceListDate,
   referenceDisplayTitle,
@@ -42,7 +31,6 @@ type NewsroomOpsOverviewProps = {
   decisions?: ReadonlyMap<string, RelevanceDecisionView>;
   demo?: boolean;
   humanCuratedReferenceLineageIds?: ReadonlySet<string>;
-  messages: MessageRecord[];
   newsroomSections: NewsroomSectionRecord[];
   references: ReferenceRecord[];
 };
@@ -50,51 +38,17 @@ type NewsroomOpsOverviewProps = {
 const NO_DECISIONS: ReadonlyMap<string, RelevanceDecisionView> = new Map();
 const NO_IDS: ReadonlySet<string> = new Set();
 
-type DestinationKey = Exclude<NewsroomNavTabId, "overview" | "desks">;
-
-const DESTINATION_ICONS: Record<DestinationKey, typeof BookOpenIcon> = {
-  articles: FileTextIcon,
-  assignments: ClipboardListIcon,
-  references: BookOpenIcon,
-  messages: MessageSquareIcon,
-  topics: LayersIcon,
-  concepts: NetworkIcon,
-  administration: SettingsIcon,
-  search: SearchIcon,
-};
-
-const DESTINATIONS = NEWSROOM_OPS_NAV.filter((item) => item.id !== "overview").map((item) => ({
-  key: item.id as DestinationKey,
-  label: item.label,
-  detail: item.detail,
-  href: item.href,
-  icon: DESTINATION_ICONS[item.id as DestinationKey],
-}));
-
-function openAssignmentCount(assignments: AssignmentRecord[]): number {
-  return assignments.filter((assignment) => {
-    const status = assignment.status?.trim().toLowerCase() ?? "";
-    return status === "open" || status === "claimed" || status === "pending";
-  }).length;
-}
-
-function recentMessageCount(messages: MessageRecord[]): number {
-  return messages.filter((message) => message.status !== "archived").length;
-}
-
 export function NewsroomOpsOverview({
   actorLabel = "",
   assignments,
   decisions = NO_DECISIONS,
   demo = false,
   humanCuratedReferenceLineageIds = NO_IDS,
-  messages,
   newsroomSections,
   references,
 }: NewsroomOpsOverviewProps) {
   const pathname = usePathname();
   const canonicalReferences = useMemo(() => selectCanonicalReferenceRecords(references), [references]);
-  const referenceCounts = useMemo(() => countReferencesByStatus(canonicalReferences), [canonicalReferences]);
   const pendingReferences = useMemo(
     () => filterReferencesByStatus(canonicalReferences, "pending").slice(0, 5),
     [canonicalReferences],
@@ -115,12 +69,6 @@ export function NewsroomOpsOverview({
   const coreDesks = useMemo(() => desks.filter(desk => newsroomDeskKind(desk) === "core"), [desks]);
   const rotatingDesks = useMemo(() => desks.filter(desk => newsroomDeskKind(desk) === "rotating"), [desks]);
 
-  const destinationCounts: Partial<Record<DestinationKey, number | null>> = {
-    references: referenceCounts.pending ?? 0,
-    assignments: openAssignmentCount(assignments),
-    messages: recentMessageCount(messages),
-  };
-
   return (
     <div
       className="space-y-8 font-sans"
@@ -128,51 +76,15 @@ export function NewsroomOpsOverview({
       data-newsroom-ops-home="true"
     >
       <div className="space-y-8" data-newsroom-overview-feeds>
-        <NotificationCenter
-          actorLabel={actorLabel}
-          decisions={decisions}
-          demo={demo}
-          humanCuratedReferenceLineageIds={humanCuratedReferenceLineageIds}
-          references={canonicalReferences}
-        />
-        <section aria-label="Destinations" className="space-y-3">
-          <h2 className="text-sm font-medium text-muted-foreground">Go to</h2>
-          <div className="grid grid-cols-2 gap-3 sm:grid-cols-4">
-            {DESTINATIONS.map((meta) => {
-              const key = meta.key;
-              const Icon = meta.icon;
-              const count = destinationCounts[key];
-              const href = getNewsroomNavHref(meta.href, demo);
-              return (
-                <Link
-                  className="group block rounded-xl focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-                  data-newsroom-ops-destination={key}
-                  data-newsroom-overview-section={key}
-                  href={href}
-                  key={key}
-                >
-                  <Card className="h-full transition-colors group-hover:border-primary/40">
-                    <CardHeader className="space-y-3 p-4">
-                      <div className="flex items-center justify-between gap-2">
-                        <span className="flex size-9 items-center justify-center rounded-lg bg-primary/10 text-primary">
-                          <Icon className="size-4" aria-hidden="true" />
-                        </span>
-                        {count != null && count > 0 ? (
-                          <Badge variant="default">{count}</Badge>
-                        ) : null}
-                      </div>
-                      <div className="space-y-0.5">
-                        <CardTitle className="text-base font-semibold">{meta.label}</CardTitle>
-                        <CardDescription>{meta.detail}</CardDescription>
-                      </div>
-                    </CardHeader>
-                  </Card>
-                </Link>
-              );
-            })}
-          </div>
-        </section>
-
+        <div aria-label="Notification Center feed" className="newsroom-overview-feed-frame overflow-y-auto rounded-xl border bg-card p-4 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring" data-newsroom-overview-notifications role="region" tabIndex={0}>
+          <NotificationCenter
+            actorLabel={actorLabel}
+            decisions={decisions}
+            demo={demo}
+            humanCuratedReferenceLineageIds={humanCuratedReferenceLineageIds}
+            references={canonicalReferences}
+          />
+        </div>
         <section aria-label="Needs attention" className="space-y-3">
           <h2 className="text-sm font-medium text-muted-foreground">Needs attention</h2>
           {pendingReferences.length || attentionAssignments.length ? (
@@ -226,7 +138,7 @@ export function NewsroomOpsOverview({
           ) : (
             <Card>
               <CardContent className="p-4 text-sm text-muted-foreground">
-                Nothing needs attention right now. Check References for new intake or open Assignments from the destinations above.
+                No pending references or open assignments. Check those destinations for other work.
               </CardContent>
             </Card>
           )}

package/components/newsroom-ops-shell.tsx

@@ -8,7 +8,7 @@ import { cn } from "../lib/utils";
 import { useEffect, useId, useState, type ReactNode } from "react";
 import Link from "next/link";
 import { usePathname, useRouter, useSearchParams } from "next/navigation";
-import { BookOpen, ClipboardList, Menu, Search, MessagesSquare, PanelLeftClose, PanelLeftOpen, Settings, UserRound, LogIn, LogOut } from "lucide-react";
+import { BookOpen, ClipboardList, House, Menu, Search, MessagesSquare, PanelLeftClose, PanelLeftOpen, Settings, UserRound, LogIn, LogOut } from "lucide-react";
 import { ORGANIZER_NAV_GROUPS, ORGANIZER_PRIMARY_NAV, ORGANIZER_SETTINGS_DESTINATION } from "../lib/newsroom-organizer-nav";
 import { browserPathToInternalNewsroomPath } from "../lib/newsroom-base-path";
 import { getNewsroomNavHref } from "../lib/newsroom-nav";
@@ -55,7 +55,7 @@ function OrganizerSearch({ demo }: { demo: boolean }) {
   </form>;
 }
 
-const ICONS = { articles: ClipboardList, references: BookOpen, messages: MessagesSquare };
+const ICONS = { overview: House, articles: ClipboardList, references: BookOpen, messages: MessagesSquare };
 
 /** Navigation is a presentation layer; existing route and server authorization still own access. */
 function Navigation({ activePath, demo, admin, surface, onNavigate }: { activePath: string; demo: boolean; admin: boolean; surface: string; onNavigate?: () => void }) {

package/components/newsroom-organizer.css

@@ -23,6 +23,8 @@ body:has(.newsroom-organizer)>[data-staging-banner]{flex-shrink:0}
 .organizer-sidebar-head{display:flex;align-items:flex-start;justify-content:space-between;gap:8px}.organizer-sidebar-head .organizer-brand{flex:1;min-width:0}
 .organizer-header-actions{display:flex;align-items:center;gap:8px;min-width:0;max-width:45%;overflow-x:auto}
 .organizer-main{min-width:0;min-height:0;overflow:auto;overscroll-behavior:contain;flex:1;padding:16px 0}
+.newsroom-overview-feed-frame{height:32rem}
+@media(min-width:640px){.newsroom-overview-feed-frame{height:38rem}}
 .organizer-main>[data-category-steering]{min-height:0}.organizer-demo-notice{font-size:11px;color:var(--org-muted);margin-bottom:12px}
 .organizer-account{display:flex;align-items:center;gap:10px;min-height:44px;flex-shrink:0;border:1px solid var(--org-line);padding:8px;text-align:left;border-radius:3px}
 .organizer-account span{min-width:0}.organizer-account strong{display:block;font:600 11px var(--kb-theme-ui-font);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.organizer-account small{display:block;font-size:9px;color:var(--org-muted);margin-top:2px}

package/components/newsroom-overview-skeleton.tsx

@@ -0,0 +1,25 @@
+"use client";
+
+import * as React from "react";
+
+/** Placeholder geometry for the overview while private records or access are unresolved. */
+export function NewsroomOverviewSkeleton() {
+  return (
+    <div aria-label="Loading newsroom overview" className="space-y-8 font-sans" data-newsroom-overview-skeleton role="status">
+      <section className="newsroom-overview-feed-frame space-y-4 overflow-hidden rounded-xl border bg-card p-4" aria-label="Notification Center">
+        <div className="h-6 w-48 rounded bg-muted" />
+        <div className="h-4 w-3/4 max-w-xl rounded bg-muted" />
+        <div className="h-4 w-2/3 max-w-lg rounded bg-muted" />
+        <div className="grid gap-3 sm:grid-cols-2">
+          {Array.from({ length: 4 }, (_, index) => <div className="h-28 rounded-xl border bg-card p-4" key={index}>
+            <div className="h-4 w-2/3 rounded bg-muted" /><div className="mt-4 h-3 w-1/2 rounded bg-muted" />
+          </div>)}
+        </div>
+      </section>
+      <section aria-label="Needs attention" className="space-y-3">
+        <div className="h-4 w-32 rounded bg-muted" />
+        <div className="h-16 rounded-xl border bg-card p-4"><div className="h-4 w-1/2 rounded bg-muted" /><div className="mt-2 h-3 w-1/3 rounded bg-muted" /></div>
+      </section>
+    </div>
+  );
+}

package/components/notification-center.tsx

@@ -131,9 +131,20 @@ export function NotificationCenterView({ loadState, requests, readIds, held, aut
   const entry = (request: ReviewRequest) => (
     <Entry busy={busyId === request.id} demo={demo} key={request.id} onAnswer={onAnswer} onMarkRead={onMarkRead} request={request} unread={isUnread(request, readIds)} />
   );
-  if (loadState === "loading") return <div role="status" data-notification-state="loading"><strong>Loading the Notification Center</strong></div>;
+  if (loadState === "loading") return (
+    <section aria-label="Loading Notification Center" className="space-y-4" data-notification-state="loading" role="status">
+      <div className="h-6 w-48 rounded bg-muted" />
+      <div className="h-4 w-3/4 max-w-xl rounded bg-muted" />
+      <div className="h-4 w-2/3 max-w-lg rounded bg-muted" />
+      <div className="grid gap-3 sm:grid-cols-2">
+        {Array.from({ length: 4 }, (_, index) => <div className="h-28 rounded-xl border bg-card p-4" key={index}>
+          <div className="h-4 w-2/3 rounded bg-muted" /><div className="mt-4 h-3 w-1/2 rounded bg-muted" />
+        </div>)}
+      </div>
+    </section>
+  );
   if (loadState === "forbidden") return <div role="alert" data-notification-state="forbidden"><strong>The Notification Center is for editors and admins</strong></div>;
-  if (loadState === "unavailable") return <div role="alert" data-notification-state="unavailable"><strong>Review requests could not be read right now</strong><p>Try again in a minute. Nothing waiting on a person has changed.</p></div>;
+  if (loadState === "unavailable") return <div role="alert" data-notification-state="unavailable"><strong>Review requests could not be read right now</strong><p>Try again in a minute. The current request state is unknown.</p></div>;
   return (
     <div className="space-y-6" data-notification-center>
       <header className="space-y-1">

package/components/reader-auth-state.ts

@@ -61,7 +61,7 @@ export async function loadReaderSessionSnapshot(options?: { forceRefresh?: boole
 
 export function isUnauthenticatedError(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error);
-  return /unauth|not authenticated|no current user|not signed in/i.test(message);
+  return /unauth|not.?authorized|not authenticated|no current user|not signed in|session expired|token expired|invalid.*token|\b401\b/i.test(message);
 }
 
 function readIdentityLabel(claims: {

package/components/topic-steering-workspace.tsx

@@ -674,7 +674,7 @@ export function NewsDeskWorkspace({
     );
   }
 
-  if (session && sessionDashboard) {
+  if (session && sessionDashboard && session.shell.phase !== "loadingDesk") {
     return (
       <NewsDeskDashboard
         analysisProfiles={analysisProfiles}
@@ -3081,7 +3081,6 @@ function NewsDeskDashboard({
             decisions={relevanceDecisions}
             demo={Boolean(dashboard.isDemo)}
             humanCuratedReferenceLineageIds={humanCuratedReferenceLineageIds}
-            messages={messages}
             newsroomSections={newsroomSections}
             references={references}
           />

package/infra/amplify-app-shell.js

@@ -2,6 +2,8 @@ import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter.js";
+import { addCloudEmail } from "./cloud-email.js";
+import { parseCloudEmail } from "./cloud-email-config.js";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
 import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
@@ -74,6 +76,7 @@ export class AmplifyAppShellStack extends Stack {
             return;
         }
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+        const emailEnvironment = addCloudEmail(this, parseCloudEmail(config.email, true, config.siteId));
         const stagingEnabled = isStagingEnabled(config);
         const stagingDomainName = resolveStagingDomainName(config);
         const cmsHostName = resolveCmsHostName(config);
@@ -195,6 +198,7 @@ export class AmplifyAppShellStack extends Stack {
             enablePerformanceMode: false,
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
+                ...emailEnvironment,
                 PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
                 ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,

package/infra/amplify-app-shell.ts

@@ -3,6 +3,8 @@ import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-l
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter";
+import { addCloudEmail } from "./cloud-email";
+import { parseCloudEmail } from "./cloud-email-config";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
 import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
@@ -79,6 +81,7 @@ export class AmplifyAppShellStack extends Stack {
     }
 
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+    const emailEnvironment = addCloudEmail(this, parseCloudEmail(config.email, true, config.siteId)!);
     const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
     const cmsHostName = resolveCmsHostName(config);
@@ -217,6 +220,7 @@ export class AmplifyAppShellStack extends Stack {
       enablePerformanceMode: false,
       environmentVariables: environmentVariables({
         ...config.cms.environment,
+        ...emailEnvironment,
         PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
         ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
         PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,

package/infra/cloud-email-config.js

@@ -0,0 +1,32 @@
+export function parseCloudEmail(raw, cloud, siteId) {
+    if (!cloud) {
+        if (raw !== undefined)
+            throw new Error("site.json: email requires a cloud cms; static-only sites do not need email resources");
+        return undefined;
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error("site.json: email is required for cloud sites; configure mode managed or existing and an explicit sendingDomain (see docs/email-reference-intake.md)");
+    }
+    const value = raw;
+    for (const key of Object.keys(value)) {
+        if (!["mode", "sendingDomain", "senderLocalPart", "configurationSet", "eventTopicName"].includes(key)) {
+            throw new Error(`site.json: email.${key} is not a known field`);
+        }
+    }
+    if (value.mode !== "managed" && value.mode !== "existing")
+        throw new Error("site.json: email.mode must be managed or existing");
+    const string = (key, pattern, fallback) => {
+        const result = value[key] ?? fallback;
+        if (typeof result !== "string" || !pattern.test(result))
+            throw new Error(`site.json: email.${key} is required and must be valid`);
+        return result;
+    };
+    return {
+        mode: value.mode,
+        sendingDomain: string("sendingDomain", /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/),
+        senderLocalPart: string("senderLocalPart", /^[a-z0-9][a-z0-9._+-]{0,63}$/, "notifications"),
+        configurationSet: string("configurationSet", /^[A-Za-z0-9_-]{1,64}$/, value.mode === "managed" ? `papyrus-${siteId}` : undefined),
+        // Preserve the newsletter consumer's historical default; the topic now also serves notifications.
+        eventTopicName: string("eventTopicName", /^[A-Za-z0-9_-]{1,256}$/, value.mode === "managed" ? `papyrus-newsletter-events-${siteId}` : undefined),
+    };
+}

package/infra/cloud-email-config.ts

@@ -0,0 +1,39 @@
+/** Email belongs to a cloud site, independently of any newsletter plugin. */
+export type CloudEmailConfig = {
+  mode: "managed" | "existing";
+  sendingDomain: string;
+  senderLocalPart: string;
+  configurationSet: string;
+  eventTopicName: string;
+};
+
+export function parseCloudEmail(raw: unknown, cloud: boolean, siteId: string): CloudEmailConfig | undefined {
+  if (!cloud) {
+    if (raw !== undefined) throw new Error("site.json: email requires a cloud cms; static-only sites do not need email resources");
+    return undefined;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("site.json: email is required for cloud sites; configure mode managed or existing and an explicit sendingDomain (see docs/email-reference-intake.md)");
+  }
+  const value = raw as Record<string, unknown>;
+  for (const key of Object.keys(value)) {
+    if (!["mode", "sendingDomain", "senderLocalPart", "configurationSet", "eventTopicName"].includes(key)) {
+      throw new Error(`site.json: email.${key} is not a known field`);
+    }
+  }
+  if (value.mode !== "managed" && value.mode !== "existing") throw new Error("site.json: email.mode must be managed or existing");
+  const string = (key: string, pattern: RegExp, fallback?: string) => {
+    const result = value[key] ?? fallback;
+    if (typeof result !== "string" || !pattern.test(result)) throw new Error(`site.json: email.${key} is required and must be valid`);
+    return result;
+  };
+  return {
+    mode: value.mode,
+    sendingDomain: string("sendingDomain", /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/),
+    senderLocalPart: string("senderLocalPart", /^[a-z0-9][a-z0-9._+-]{0,63}$/, "notifications"),
+    configurationSet: string("configurationSet", /^[A-Za-z0-9_-]{1,64}$/, value.mode === "managed" ? `papyrus-${siteId}` : undefined),
+    // Preserve the newsletter consumer's historical default; the topic now also serves notifications.
+    eventTopicName: string("eventTopicName", /^[A-Za-z0-9_-]{1,256}$/, value.mode === "managed" ? `papyrus-newsletter-events-${siteId}` : undefined),
+  };
+}
+

package/infra/cloud-email.js

@@ -0,0 +1,57 @@
+import { ArnFormat, CfnOutput, RemovalPolicy } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sns from "aws-cdk-lib/aws-sns";
+/** No DNS mutation, sending grant or receipt activation. Existing identities remain with their owner. */
+export function addCloudEmail(stack, config) {
+    if (config.mode === "managed") {
+        const configurationSet = new ses.CfnConfigurationSet(stack, "CloudEmailConfigurationSet", {
+            name: config.configurationSet,
+            reputationOptions: { reputationMetricsEnabled: true },
+            suppressionOptions: { suppressedReasons: ["BOUNCE", "COMPLAINT"] },
+            sendingOptions: { sendingEnabled: true },
+        });
+        configurationSet.applyRemovalPolicy(RemovalPolicy.RETAIN);
+        const identity = new ses.CfnEmailIdentity(stack, "CloudEmailIdentity", {
+            emailIdentity: config.sendingDomain,
+            dkimSigningAttributes: { nextSigningKeyLength: "RSA_2048_BIT" },
+            configurationSetAttributes: { configurationSetName: configurationSet.ref },
+        });
+        identity.applyRemovalPolicy(RemovalPolicy.RETAIN);
+        const topic = new sns.Topic(stack, "CloudEmailEvents", { topicName: config.eventTopicName });
+        topic.applyRemovalPolicy(RemovalPolicy.RETAIN);
+        topic.addToResourcePolicy(new iam.PolicyStatement({
+            principals: [new iam.ServicePrincipal("ses.amazonaws.com")], actions: ["sns:Publish"],
+            resources: [topic.topicArn], conditions: { StringEquals: { "aws:SourceAccount": stack.account } },
+        }));
+        const events = new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailEventDestination", {
+            configurationSetName: configurationSet.ref,
+            eventDestination: { name: "delivery-events", enabled: true,
+                matchingEventTypes: ["SEND", "DELIVERY", "BOUNCE", "COMPLAINT", "REJECT", "RENDERING_FAILURE", "DELIVERY_DELAY"],
+                snsDestination: { topicArn: topic.topicArn } },
+        });
+        events.node.addDependency(topic);
+        // These dimensions also feed the newsletter consumer's existing bounce/complaint alarms.
+        new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailMetrics", {
+            configurationSetName: configurationSet.ref,
+            eventDestination: { name: "cloudwatch-metrics", enabled: true,
+                matchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+                cloudWatchDestination: { dimensionConfigurations: [{ dimensionName: "ses:configuration-set",
+                            dimensionValueSource: "MESSAGE_TAG", defaultDimensionValue: config.configurationSet }] } },
+        });
+        const records = [[identity.attrDkimDnsTokenName1, identity.attrDkimDnsTokenValue1],
+            [identity.attrDkimDnsTokenName2, identity.attrDkimDnsTokenValue2],
+            [identity.attrDkimDnsTokenName3, identity.attrDkimDnsTokenValue3]];
+        records.forEach(([name, value], index) => {
+            new CfnOutput(stack, `EmailDkimRecord${index + 1}Name`, { value: name, description: "CNAME name; DNS change requires separate approval" });
+            new CfnOutput(stack, `EmailDkimRecord${index + 1}Value`, { value });
+        });
+    }
+    const identityArn = stack.formatArn({ service: "ses", resource: "identity", resourceName: config.sendingDomain, arnFormat: ArnFormat.SLASH_RESOURCE_NAME });
+    new CfnOutput(stack, "EmailIdentityArn", { value: identityArn });
+    new CfnOutput(stack, "EmailConfigurationSetName", { value: config.configurationSet });
+    new CfnOutput(stack, "EmailEventTopicName", { value: config.eventTopicName });
+    return { PAPYRUS_EMAIL_FROM_ADDRESS: `${config.senderLocalPart}@${config.sendingDomain}`,
+        PAPYRUS_EMAIL_IDENTITY_ARN: identityArn, PAPYRUS_EMAIL_CONFIGURATION_SET: config.configurationSet,
+        PAPYRUS_EMAIL_EVENT_TOPIC_NAME: config.eventTopicName };
+}

package/infra/cloud-email.test.js

@@ -0,0 +1,69 @@
+import assert from "node:assert/strict";
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { AmplifyAppShellStack } from "./amplify-app-shell.js";
+import { parseSiteConfig } from "./site-config.js";
+const base = () => ({
+    siteId: "example", repository: "https://github.com/example/publication", brand: "example",
+    frontend: "markus-static", papyrusVersion: "5.32.0", autoDeploy: false,
+    cms: { cognitoDomainPrefix: "example-cms", staging: false,
+        environment: { PAPYRUS_OAUTH_REDIRECT_URLS: "http://localhost:3001/" } },
+});
+function synth(raw) {
+    const app = new App();
+    return Template.fromStack(new AmplifyAppShellStack(app, "EmailTest", parseSiteConfig(raw), {
+        env: { account: "123456789012", region: "us-east-1" },
+    }));
+}
+const checks = {
+    managed() {
+        const template = synth({ ...base(), email: { mode: "managed", sendingDomain: "news.example.test" } });
+        template.resourceCountIs("AWS::SES::EmailIdentity", 1);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 1);
+        template.resourceCountIs("AWS::Route53::RecordSet", 0);
+        template.resourceCountIs("AWS::SES::ReceiptRuleSet", 0);
+        template.hasResourceProperties("AWS::SES::EmailIdentity", { EmailIdentity: "news.example.test" });
+        template.hasResourceProperties("AWS::SNS::Topic", { TopicName: "papyrus-newsletter-events-example" });
+        template.hasResourceProperties("AWS::SES::ConfigurationSetEventDestination", {
+            EventDestination: { Name: "cloudwatch-metrics", MatchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+                CloudWatchDestination: { DimensionConfigurations: [{ DimensionName: "ses:configuration-set",
+                            DimensionValueSource: "MESSAGE_TAG", DefaultDimensionValue: "papyrus-example" }] } },
+        });
+        const text = JSON.stringify(template.toJSON());
+        assert.ok(text.includes("PAPYRUS_EMAIL_FROM_ADDRESS"));
+        assert.ok(text.includes("notifications@news.example.test"));
+        assert.ok(text.includes("EmailDkimRecord1Name"));
+        assert.ok(!text.includes("ses:SendEmail"), "identity setup does not grant unsolicited sending authority");
+    },
+    existing() {
+        const template = synth({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test",
+                configurationSet: "already-owned", eventTopicName: "already-owned-events" } });
+        template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+        template.resourceCountIs("AWS::SNS::Topic", 0);
+        assert.ok(JSON.stringify(template.toJSON()).includes("already-owned"));
+    },
+    static() {
+        const raw = { ...base(), reader: { buildCommand: "make site", baseDirectory: "dist" } };
+        delete raw.cms;
+        const template = synth(raw);
+        template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+        template.resourceCountIs("AWS::SES::ReceiptRule", 0);
+    },
+    missing() {
+        assert.throws(() => parseSiteConfig(base()), /email.*required.*cloud/i);
+        assert.throws(() => parseSiteConfig({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test" } }), /email.configurationSet/);
+    },
+};
+export function runCloudEmailTests(selected) {
+    if (selected) {
+        assert.ok(checks[selected], selected);
+        checks[selected]();
+    }
+    else
+        for (const check of Object.values(checks))
+            check();
+    console.log("cloud email infrastructure: ok");
+}
+runCloudEmailTests(process.argv[2]);

package/infra/cloud-email.test.ts

@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { AmplifyAppShellStack } from "./amplify-app-shell";
+import { parseSiteConfig } from "./site-config";
+
+const base = () => ({
+  siteId: "example", repository: "https://github.com/example/publication", brand: "example",
+  frontend: "markus-static", papyrusVersion: "5.32.0", autoDeploy: false,
+  cms: { cognitoDomainPrefix: "example-cms", staging: false,
+    environment: { PAPYRUS_OAUTH_REDIRECT_URLS: "http://localhost:3001/" } },
+});
+function synth(raw: unknown) {
+  const app = new App();
+  return Template.fromStack(new AmplifyAppShellStack(app, "EmailTest", parseSiteConfig(raw), {
+    env: { account: "123456789012", region: "us-east-1" },
+  }));
+}
+const checks: Record<string, () => void> = {
+  managed() {
+    const template = synth({ ...base(), email: { mode: "managed", sendingDomain: "news.example.test" } });
+    template.resourceCountIs("AWS::SES::EmailIdentity", 1);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 1);
+    template.resourceCountIs("AWS::Route53::RecordSet", 0);
+    template.resourceCountIs("AWS::SES::ReceiptRuleSet", 0);
+    template.hasResourceProperties("AWS::SES::EmailIdentity", { EmailIdentity: "news.example.test" });
+    template.hasResourceProperties("AWS::SNS::Topic", { TopicName: "papyrus-newsletter-events-example" });
+    template.hasResourceProperties("AWS::SES::ConfigurationSetEventDestination", {
+      EventDestination: { Name: "cloudwatch-metrics", MatchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+        CloudWatchDestination: { DimensionConfigurations: [{ DimensionName: "ses:configuration-set",
+          DimensionValueSource: "MESSAGE_TAG", DefaultDimensionValue: "papyrus-example" }] } },
+    });
+    const text = JSON.stringify(template.toJSON());
+    assert.ok(text.includes("PAPYRUS_EMAIL_FROM_ADDRESS"));
+    assert.ok(text.includes("notifications@news.example.test"));
+    assert.ok(text.includes("EmailDkimRecord1Name"));
+    assert.ok(!text.includes("ses:SendEmail"), "identity setup does not grant unsolicited sending authority");
+  },
+  existing() {
+    const template = synth({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test",
+      configurationSet: "already-owned", eventTopicName: "already-owned-events" } });
+    template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+    template.resourceCountIs("AWS::SNS::Topic", 0);
+    assert.ok(JSON.stringify(template.toJSON()).includes("already-owned"));
+  },
+  static() {
+    const raw: Record<string, unknown> = { ...base(), reader: { buildCommand: "make site", baseDirectory: "dist" } };
+    delete raw.cms;
+    const template = synth(raw);
+    template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+    template.resourceCountIs("AWS::SES::ReceiptRule", 0);
+  },
+  missing() {
+    assert.throws(() => parseSiteConfig(base()), /email.*required.*cloud/i);
+    assert.throws(() => parseSiteConfig({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test" } }), /email.configurationSet/);
+  },
+};
+export function runCloudEmailTests(selected?: string): void {
+  if (selected) { assert.ok(checks[selected], selected); checks[selected](); }
+  else for (const check of Object.values(checks)) check();
+  console.log("cloud email infrastructure: ok");
+}
+
+runCloudEmailTests(process.argv[2]);

package/infra/cloud-email.ts

@@ -0,0 +1,60 @@
+import { ArnFormat, CfnOutput, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sns from "aws-cdk-lib/aws-sns";
+
+import type { CloudEmailConfig } from "./cloud-email-config";
+
+/** No DNS mutation, sending grant or receipt activation. Existing identities remain with their owner. */
+export function addCloudEmail(stack: Stack, config: CloudEmailConfig): Record<string, string> {
+  if (config.mode === "managed") {
+    const configurationSet = new ses.CfnConfigurationSet(stack, "CloudEmailConfigurationSet", {
+      name: config.configurationSet,
+      reputationOptions: { reputationMetricsEnabled: true },
+      suppressionOptions: { suppressedReasons: ["BOUNCE", "COMPLAINT"] },
+      sendingOptions: { sendingEnabled: true },
+    });
+    configurationSet.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    const identity = new ses.CfnEmailIdentity(stack, "CloudEmailIdentity", {
+      emailIdentity: config.sendingDomain,
+      dkimSigningAttributes: { nextSigningKeyLength: "RSA_2048_BIT" },
+      configurationSetAttributes: { configurationSetName: configurationSet.ref },
+    });
+    identity.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    const topic = new sns.Topic(stack, "CloudEmailEvents", { topicName: config.eventTopicName });
+    topic.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    topic.addToResourcePolicy(new iam.PolicyStatement({
+      principals: [new iam.ServicePrincipal("ses.amazonaws.com")], actions: ["sns:Publish"],
+      resources: [topic.topicArn], conditions: { StringEquals: { "aws:SourceAccount": stack.account } },
+    }));
+    const events = new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailEventDestination", {
+      configurationSetName: configurationSet.ref,
+      eventDestination: { name: "delivery-events", enabled: true,
+        matchingEventTypes: ["SEND", "DELIVERY", "BOUNCE", "COMPLAINT", "REJECT", "RENDERING_FAILURE", "DELIVERY_DELAY"],
+        snsDestination: { topicArn: topic.topicArn } },
+    });
+    events.node.addDependency(topic);
+    // These dimensions also feed the newsletter consumer's existing bounce/complaint alarms.
+    new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailMetrics", {
+      configurationSetName: configurationSet.ref,
+      eventDestination: { name: "cloudwatch-metrics", enabled: true,
+        matchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+        cloudWatchDestination: { dimensionConfigurations: [{ dimensionName: "ses:configuration-set",
+          dimensionValueSource: "MESSAGE_TAG", defaultDimensionValue: config.configurationSet }] } },
+    });
+    const records = [[identity.attrDkimDnsTokenName1, identity.attrDkimDnsTokenValue1],
+      [identity.attrDkimDnsTokenName2, identity.attrDkimDnsTokenValue2],
+      [identity.attrDkimDnsTokenName3, identity.attrDkimDnsTokenValue3]];
+    records.forEach(([name, value], index) => {
+      new CfnOutput(stack, `EmailDkimRecord${index + 1}Name`, { value: name, description: "CNAME name; DNS change requires separate approval" });
+      new CfnOutput(stack, `EmailDkimRecord${index + 1}Value`, { value });
+    });
+  }
+  const identityArn = stack.formatArn({ service: "ses", resource: "identity", resourceName: config.sendingDomain, arnFormat: ArnFormat.SLASH_RESOURCE_NAME });
+  new CfnOutput(stack, "EmailIdentityArn", { value: identityArn });
+  new CfnOutput(stack, "EmailConfigurationSetName", { value: config.configurationSet });
+  new CfnOutput(stack, "EmailEventTopicName", { value: config.eventTopicName });
+  return { PAPYRUS_EMAIL_FROM_ADDRESS: `${config.senderLocalPart}@${config.sendingDomain}`,
+    PAPYRUS_EMAIL_IDENTITY_ARN: identityArn, PAPYRUS_EMAIL_CONFIGURATION_SET: config.configurationSet,
+    PAPYRUS_EMAIL_EVENT_TOPIC_NAME: config.eventTopicName };
+}

package/infra/site-config.js

@@ -1,3 +1,4 @@
+import { parseCloudEmail } from "./cloud-email-config.js";
 export const READER_REDIRECT_STATUSES = ["301", "302", "200", "404", "404-200"];
 export function hasCmsApp(config) {
     return config.cms !== undefined;
@@ -35,7 +36,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_EMAIL_FROM_ADDRESS", "PAPYRUS_EMAIL_IDENTITY_ARN", "PAPYRUS_EMAIL_CONFIGURATION_SET", "PAPYRUS_EMAIL_EVENT_TOPIC_NAME", "PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
     "GET/v1/identities/me",
@@ -350,7 +351,7 @@ function parseAws(value) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "email", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
@@ -460,6 +461,7 @@ export function parseSiteConfig(raw) {
         stackName,
         aws,
         cms,
+        email: parseCloudEmail(record.email, cms !== undefined, siteId),
         reader,
         papyrusVersion,
         storagePreviewPrefix,

package/infra/site-config.ts

@@ -1,3 +1,5 @@
+import { parseCloudEmail, type CloudEmailConfig } from "./cloud-email-config";
+
 export type CmsRedirect = {
   source: string;
   status: 301 | 302;
@@ -63,6 +65,8 @@ export type AmplifyAppShellSiteConfig = {
   stackName?: string;
   aws?: SiteAwsConfig;
   cms?: CmsConfig;
+  /** Required for cloud CMS sites; independent of newsletter feature enablement. */
+  email?: CloudEmailConfig;
   reader?: {
     appName?: string;
     domainName?: string;
@@ -157,7 +161,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_EMAIL_FROM_ADDRESS", "PAPYRUS_EMAIL_IDENTITY_ARN", "PAPYRUS_EMAIL_CONFIGURATION_SET", "PAPYRUS_EMAIL_EVENT_TOPIC_NAME", "PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
 
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
@@ -490,7 +494,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "email", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"],
     "site",
   );
 
@@ -600,6 +604,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     stackName,
     aws,
     cms,
+    email: parseCloudEmail(record.email, cms !== undefined, siteId),
     reader,
     papyrusVersion,
     storagePreviewPrefix,

package/lib/news-desk-session.ts

@@ -1,5 +1,4 @@
 import type { CategorySteeringDashboard } from "./category-repository";
-import { createEmptyCategorySteeringDashboard } from "./category-dashboard";
 import type { ReaderAuthSnapshot } from "../components/reader-auth-state";
 
 export type NewsDeskShellPhase =
@@ -59,26 +58,6 @@ export function beginDeskLoad(state: NewsDeskShellState, auth: ReaderAuthSnapsho
   };
 }
 
-export function beginAuthenticatedDeskHydration(
-  state: NewsDeskShellState,
-  auth: ReaderAuthSnapshot,
-  options: { canManageUsers: boolean },
-): NewsDeskShellState {
-  const dashboard = state.dashboard ?? {
-    ...createEmptyCategorySteeringDashboard(),
-    isPublicSkeleton: false,
-    canManageUsers: options.canManageUsers,
-  };
-  return {
-    ...state,
-    phase: state.dashboard ? "refreshing" : "loadingDesk",
-    auth,
-    dashboard,
-    stale: false,
-    error: null,
-  };
-}
-
 export function resolveSignedOut(state: NewsDeskShellState, auth: ReaderAuthSnapshot): NewsDeskShellState {
   return {
     ...state,
@@ -143,6 +122,18 @@ export function resolveDashboardFailure(
   };
 }
 
+/** An unverified session must never leave private records on screen. */
+export function resolveAccessFailure(state: NewsDeskShellState, error: string): NewsDeskShellState {
+  return {
+    ...state,
+    phase: "error",
+    auth: { status: "signedOut", label: "Signed out" },
+    dashboard: null,
+    stale: false,
+    error,
+  };
+}
+
 export function patchDashboard(
   state: NewsDeskShellState,
   patch: (dashboard: CategorySteeringDashboard) => CategorySteeringDashboard,

package/lib/newsroom-organizer-nav.ts

@@ -8,6 +8,7 @@ export type OrganizerDestination = {
 };
 export const ORGANIZER_NAV_GROUPS: readonly { title: string; items: readonly OrganizerDestination[] }[] = [
   { title: "Editorial work", items: [
+    { key: "overview", label: "Overview", description: "See notifications and work needing attention.", path: "/newsroom", primary: true },
     { key: "articles", label: getContentItemName().plural, description: `Follow ${contentItemPluralLowercase} across their stages and open one to write or revise it.`, path: `/newsroom/${contentItemBoardPathSegment()}`, alsoActiveOnPaths: ["/newsroom/articles"], primary: true },
     { key: "assignments", label: "Assignments", description: "Follow research and reporting work across its statuses and claim it.", path: "/newsroom/assignments" },
     { key: "messages", label: "Messages", description: "Read and reply to newsroom conversations.", path: "/newsroom/messages", primary: true },
@@ -23,7 +24,7 @@ export const ORGANIZER_NAV_GROUPS: readonly { title: string; items: readonly Org
   ] },
 ];
 const all = ORGANIZER_NAV_GROUPS.flatMap(group => group.items);
-export const ORGANIZER_PRIMARY_NAV = ["articles", "references", "messages"].map(key => all.find(item => item.key === key)!);
+export const ORGANIZER_PRIMARY_NAV = ["overview", "articles", "references", "messages"].map(key => all.find(item => item.key === key)!);
 
 export const ORGANIZER_SETTINGS_DESTINATION = {
   label: "Settings", path: "/newsroom/settings", description: "Theme, motion and interface preferences.",

package/package.json

@@ -108,6 +108,7 @@
     "./components/newsroom-curation-provider": "./components/newsroom-curation-provider.tsx",
     "./components/newsroom-ops-overview": "./components/newsroom-ops-overview.tsx",
     "./components/newsroom-ops-shell": "./components/newsroom-ops-shell.tsx",
+    "./components/newsroom-overview-skeleton": "./components/newsroom-overview-skeleton.tsx",
     "./components/newsroom-references-view": "./components/newsroom-references-view.tsx",
     "./components/newsroom-theme-fonts/broadsheet-green": "./components/newsroom-theme-fonts/broadsheet-green.tsx",
     "./components/newsroom-theme-fonts/newspaper-gothic": "./components/newsroom-theme-fonts/newspaper-gothic.tsx",
@@ -447,7 +448,7 @@
       "optional": true
     }
   },
-  "version": "5.33.2",
+  "version": "5.34.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.33.2",
+  "version": "5.34.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",