@anthusai/papyrus 5.33.2 → 5.35.0

package/components/notification-center.tsx

@@ -131,9 +131,20 @@ export function NotificationCenterView({ loadState, requests, readIds, held, aut
   const entry = (request: ReviewRequest) => (
     <Entry busy={busyId === request.id} demo={demo} key={request.id} onAnswer={onAnswer} onMarkRead={onMarkRead} request={request} unread={isUnread(request, readIds)} />
   );
-  if (loadState === "loading") return <div role="status" data-notification-state="loading"><strong>Loading the Notification Center</strong></div>;
+  if (loadState === "loading") return (
+    <section aria-label="Loading Notification Center" className="space-y-4" data-notification-state="loading" role="status">
+      <div className="h-6 w-48 rounded bg-muted" />
+      <div className="h-4 w-3/4 max-w-xl rounded bg-muted" />
+      <div className="h-4 w-2/3 max-w-lg rounded bg-muted" />
+      <div className="grid gap-3 sm:grid-cols-2">
+        {Array.from({ length: 4 }, (_, index) => <div className="h-28 rounded-xl border bg-card p-4" key={index}>
+          <div className="h-4 w-2/3 rounded bg-muted" /><div className="mt-4 h-3 w-1/2 rounded bg-muted" />
+        </div>)}
+      </div>
+    </section>
+  );
   if (loadState === "forbidden") return <div role="alert" data-notification-state="forbidden"><strong>The Notification Center is for editors and admins</strong></div>;
-  if (loadState === "unavailable") return <div role="alert" data-notification-state="unavailable"><strong>Review requests could not be read right now</strong><p>Try again in a minute. Nothing waiting on a person has changed.</p></div>;
+  if (loadState === "unavailable") return <div role="alert" data-notification-state="unavailable"><strong>Review requests could not be read right now</strong><p>Try again in a minute. The current request state is unknown.</p></div>;
   return (
     <div className="space-y-6" data-notification-center>
       <header className="space-y-1">

package/components/reader-auth-state.ts

@@ -61,7 +61,7 @@ export async function loadReaderSessionSnapshot(options?: { forceRefresh?: boole
 
 export function isUnauthenticatedError(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error);
-  return /unauth|not authenticated|no current user|not signed in/i.test(message);
+  return /unauth|not.?authorized|not authenticated|no current user|not signed in|session expired|token expired|invalid.*token|\b401\b/i.test(message);
 }
 
 function readIdentityLabel(claims: {

package/components/topic-steering-workspace.tsx

@@ -674,7 +674,7 @@ export function NewsDeskWorkspace({
     );
   }
 
-  if (session && sessionDashboard) {
+  if (session && sessionDashboard && session.shell.phase !== "loadingDesk") {
     return (
       <NewsDeskDashboard
         analysisProfiles={analysisProfiles}
@@ -3081,7 +3081,6 @@ function NewsDeskDashboard({
             decisions={relevanceDecisions}
             demo={Boolean(dashboard.isDemo)}
             humanCuratedReferenceLineageIds={humanCuratedReferenceLineageIds}
-            messages={messages}
             newsroomSections={newsroomSections}
             references={references}
           />

package/infra/amplify-app-shell.js

@@ -2,6 +2,8 @@ import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter.js";
+import { addCloudEmail } from "./cloud-email.js";
+import { parseCloudEmail } from "./cloud-email-config.js";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
 import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
@@ -74,6 +76,7 @@ export class AmplifyAppShellStack extends Stack {
             return;
         }
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+        const emailEnvironment = addCloudEmail(this, parseCloudEmail(config.email, true, config.siteId));
         const stagingEnabled = isStagingEnabled(config);
         const stagingDomainName = resolveStagingDomainName(config);
         const cmsHostName = resolveCmsHostName(config);
@@ -195,6 +198,7 @@ export class AmplifyAppShellStack extends Stack {
             enablePerformanceMode: false,
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
+                ...emailEnvironment,
                 PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
                 ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,

package/infra/amplify-app-shell.ts

@@ -3,6 +3,8 @@ import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-l
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter";
+import { addCloudEmail } from "./cloud-email";
+import { parseCloudEmail } from "./cloud-email-config";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
 import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
@@ -79,6 +81,7 @@ export class AmplifyAppShellStack extends Stack {
     }
 
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+    const emailEnvironment = addCloudEmail(this, parseCloudEmail(config.email, true, config.siteId)!);
     const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
     const cmsHostName = resolveCmsHostName(config);
@@ -217,6 +220,7 @@ export class AmplifyAppShellStack extends Stack {
       enablePerformanceMode: false,
       environmentVariables: environmentVariables({
         ...config.cms.environment,
+        ...emailEnvironment,
         PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
         ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
         PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,

package/infra/cloud-email-config.js

@@ -0,0 +1,32 @@
+export function parseCloudEmail(raw, cloud, siteId) {
+    if (!cloud) {
+        if (raw !== undefined)
+            throw new Error("site.json: email requires a cloud cms; static-only sites do not need email resources");
+        return undefined;
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error("site.json: email is required for cloud sites; configure mode managed or existing and an explicit sendingDomain (see docs/email-reference-intake.md)");
+    }
+    const value = raw;
+    for (const key of Object.keys(value)) {
+        if (!["mode", "sendingDomain", "senderLocalPart", "configurationSet", "eventTopicName"].includes(key)) {
+            throw new Error(`site.json: email.${key} is not a known field`);
+        }
+    }
+    if (value.mode !== "managed" && value.mode !== "existing")
+        throw new Error("site.json: email.mode must be managed or existing");
+    const string = (key, pattern, fallback) => {
+        const result = value[key] ?? fallback;
+        if (typeof result !== "string" || !pattern.test(result))
+            throw new Error(`site.json: email.${key} is required and must be valid`);
+        return result;
+    };
+    return {
+        mode: value.mode,
+        sendingDomain: string("sendingDomain", /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/),
+        senderLocalPart: string("senderLocalPart", /^[a-z0-9][a-z0-9._+-]{0,63}$/, "notifications"),
+        configurationSet: string("configurationSet", /^[A-Za-z0-9_-]{1,64}$/, value.mode === "managed" ? `papyrus-${siteId}` : undefined),
+        // Preserve the newsletter consumer's historical default; the topic now also serves notifications.
+        eventTopicName: string("eventTopicName", /^[A-Za-z0-9_-]{1,256}$/, value.mode === "managed" ? `papyrus-newsletter-events-${siteId}` : undefined),
+    };
+}

package/infra/cloud-email-config.ts

@@ -0,0 +1,39 @@
+/** Email belongs to a cloud site, independently of any newsletter plugin. */
+export type CloudEmailConfig = {
+  mode: "managed" | "existing";
+  sendingDomain: string;
+  senderLocalPart: string;
+  configurationSet: string;
+  eventTopicName: string;
+};
+
+export function parseCloudEmail(raw: unknown, cloud: boolean, siteId: string): CloudEmailConfig | undefined {
+  if (!cloud) {
+    if (raw !== undefined) throw new Error("site.json: email requires a cloud cms; static-only sites do not need email resources");
+    return undefined;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("site.json: email is required for cloud sites; configure mode managed or existing and an explicit sendingDomain (see docs/email-reference-intake.md)");
+  }
+  const value = raw as Record<string, unknown>;
+  for (const key of Object.keys(value)) {
+    if (!["mode", "sendingDomain", "senderLocalPart", "configurationSet", "eventTopicName"].includes(key)) {
+      throw new Error(`site.json: email.${key} is not a known field`);
+    }
+  }
+  if (value.mode !== "managed" && value.mode !== "existing") throw new Error("site.json: email.mode must be managed or existing");
+  const string = (key: string, pattern: RegExp, fallback?: string) => {
+    const result = value[key] ?? fallback;
+    if (typeof result !== "string" || !pattern.test(result)) throw new Error(`site.json: email.${key} is required and must be valid`);
+    return result;
+  };
+  return {
+    mode: value.mode,
+    sendingDomain: string("sendingDomain", /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/),
+    senderLocalPart: string("senderLocalPart", /^[a-z0-9][a-z0-9._+-]{0,63}$/, "notifications"),
+    configurationSet: string("configurationSet", /^[A-Za-z0-9_-]{1,64}$/, value.mode === "managed" ? `papyrus-${siteId}` : undefined),
+    // Preserve the newsletter consumer's historical default; the topic now also serves notifications.
+    eventTopicName: string("eventTopicName", /^[A-Za-z0-9_-]{1,256}$/, value.mode === "managed" ? `papyrus-newsletter-events-${siteId}` : undefined),
+  };
+}
+

package/infra/cloud-email.js

@@ -0,0 +1,57 @@
+import { ArnFormat, CfnOutput, RemovalPolicy } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sns from "aws-cdk-lib/aws-sns";
+/** No DNS mutation, sending grant or receipt activation. Existing identities remain with their owner. */
+export function addCloudEmail(stack, config) {
+    if (config.mode === "managed") {
+        const configurationSet = new ses.CfnConfigurationSet(stack, "CloudEmailConfigurationSet", {
+            name: config.configurationSet,
+            reputationOptions: { reputationMetricsEnabled: true },
+            suppressionOptions: { suppressedReasons: ["BOUNCE", "COMPLAINT"] },
+            sendingOptions: { sendingEnabled: true },
+        });
+        configurationSet.applyRemovalPolicy(RemovalPolicy.RETAIN);
+        const identity = new ses.CfnEmailIdentity(stack, "CloudEmailIdentity", {
+            emailIdentity: config.sendingDomain,
+            dkimSigningAttributes: { nextSigningKeyLength: "RSA_2048_BIT" },
+            configurationSetAttributes: { configurationSetName: configurationSet.ref },
+        });
+        identity.applyRemovalPolicy(RemovalPolicy.RETAIN);
+        const topic = new sns.Topic(stack, "CloudEmailEvents", { topicName: config.eventTopicName });
+        topic.applyRemovalPolicy(RemovalPolicy.RETAIN);
+        topic.addToResourcePolicy(new iam.PolicyStatement({
+            principals: [new iam.ServicePrincipal("ses.amazonaws.com")], actions: ["sns:Publish"],
+            resources: [topic.topicArn], conditions: { StringEquals: { "aws:SourceAccount": stack.account } },
+        }));
+        const events = new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailEventDestination", {
+            configurationSetName: configurationSet.ref,
+            eventDestination: { name: "delivery-events", enabled: true,
+                matchingEventTypes: ["SEND", "DELIVERY", "BOUNCE", "COMPLAINT", "REJECT", "RENDERING_FAILURE", "DELIVERY_DELAY"],
+                snsDestination: { topicArn: topic.topicArn } },
+        });
+        events.node.addDependency(topic);
+        // These dimensions also feed the newsletter consumer's existing bounce/complaint alarms.
+        new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailMetrics", {
+            configurationSetName: configurationSet.ref,
+            eventDestination: { name: "cloudwatch-metrics", enabled: true,
+                matchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+                cloudWatchDestination: { dimensionConfigurations: [{ dimensionName: "ses:configuration-set",
+                            dimensionValueSource: "MESSAGE_TAG", defaultDimensionValue: config.configurationSet }] } },
+        });
+        const records = [[identity.attrDkimDnsTokenName1, identity.attrDkimDnsTokenValue1],
+            [identity.attrDkimDnsTokenName2, identity.attrDkimDnsTokenValue2],
+            [identity.attrDkimDnsTokenName3, identity.attrDkimDnsTokenValue3]];
+        records.forEach(([name, value], index) => {
+            new CfnOutput(stack, `EmailDkimRecord${index + 1}Name`, { value: name, description: "CNAME name; DNS change requires separate approval" });
+            new CfnOutput(stack, `EmailDkimRecord${index + 1}Value`, { value });
+        });
+    }
+    const identityArn = stack.formatArn({ service: "ses", resource: "identity", resourceName: config.sendingDomain, arnFormat: ArnFormat.SLASH_RESOURCE_NAME });
+    new CfnOutput(stack, "EmailIdentityArn", { value: identityArn });
+    new CfnOutput(stack, "EmailConfigurationSetName", { value: config.configurationSet });
+    new CfnOutput(stack, "EmailEventTopicName", { value: config.eventTopicName });
+    return { PAPYRUS_EMAIL_FROM_ADDRESS: `${config.senderLocalPart}@${config.sendingDomain}`,
+        PAPYRUS_EMAIL_IDENTITY_ARN: identityArn, PAPYRUS_EMAIL_CONFIGURATION_SET: config.configurationSet,
+        PAPYRUS_EMAIL_EVENT_TOPIC_NAME: config.eventTopicName };
+}

package/infra/cloud-email.test.js

@@ -0,0 +1,69 @@
+import assert from "node:assert/strict";
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { AmplifyAppShellStack } from "./amplify-app-shell.js";
+import { parseSiteConfig } from "./site-config.js";
+const base = () => ({
+    siteId: "example", repository: "https://github.com/example/publication", brand: "example",
+    frontend: "markus-static", papyrusVersion: "5.32.0", autoDeploy: false,
+    cms: { cognitoDomainPrefix: "example-cms", staging: false,
+        environment: { PAPYRUS_OAUTH_REDIRECT_URLS: "http://localhost:3001/" } },
+});
+function synth(raw) {
+    const app = new App();
+    return Template.fromStack(new AmplifyAppShellStack(app, "EmailTest", parseSiteConfig(raw), {
+        env: { account: "123456789012", region: "us-east-1" },
+    }));
+}
+const checks = {
+    managed() {
+        const template = synth({ ...base(), email: { mode: "managed", sendingDomain: "news.example.test" } });
+        template.resourceCountIs("AWS::SES::EmailIdentity", 1);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 1);
+        template.resourceCountIs("AWS::Route53::RecordSet", 0);
+        template.resourceCountIs("AWS::SES::ReceiptRuleSet", 0);
+        template.hasResourceProperties("AWS::SES::EmailIdentity", { EmailIdentity: "news.example.test" });
+        template.hasResourceProperties("AWS::SNS::Topic", { TopicName: "papyrus-newsletter-events-example" });
+        template.hasResourceProperties("AWS::SES::ConfigurationSetEventDestination", {
+            EventDestination: { Name: "cloudwatch-metrics", MatchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+                CloudWatchDestination: { DimensionConfigurations: [{ DimensionName: "ses:configuration-set",
+                            DimensionValueSource: "MESSAGE_TAG", DefaultDimensionValue: "papyrus-example" }] } },
+        });
+        const text = JSON.stringify(template.toJSON());
+        assert.ok(text.includes("PAPYRUS_EMAIL_FROM_ADDRESS"));
+        assert.ok(text.includes("notifications@news.example.test"));
+        assert.ok(text.includes("EmailDkimRecord1Name"));
+        assert.ok(!text.includes("ses:SendEmail"), "identity setup does not grant unsolicited sending authority");
+    },
+    existing() {
+        const template = synth({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test",
+                configurationSet: "already-owned", eventTopicName: "already-owned-events" } });
+        template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+        template.resourceCountIs("AWS::SNS::Topic", 0);
+        assert.ok(JSON.stringify(template.toJSON()).includes("already-owned"));
+    },
+    static() {
+        const raw = { ...base(), reader: { buildCommand: "make site", baseDirectory: "dist" } };
+        delete raw.cms;
+        const template = synth(raw);
+        template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+        template.resourceCountIs("AWS::SES::ReceiptRule", 0);
+    },
+    missing() {
+        assert.throws(() => parseSiteConfig(base()), /email.*required.*cloud/i);
+        assert.throws(() => parseSiteConfig({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test" } }), /email.configurationSet/);
+    },
+};
+export function runCloudEmailTests(selected) {
+    if (selected) {
+        assert.ok(checks[selected], selected);
+        checks[selected]();
+    }
+    else
+        for (const check of Object.values(checks))
+            check();
+    console.log("cloud email infrastructure: ok");
+}
+runCloudEmailTests(process.argv[2]);

package/infra/cloud-email.test.ts

@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { AmplifyAppShellStack } from "./amplify-app-shell";
+import { parseSiteConfig } from "./site-config";
+
+const base = () => ({
+  siteId: "example", repository: "https://github.com/example/publication", brand: "example",
+  frontend: "markus-static", papyrusVersion: "5.32.0", autoDeploy: false,
+  cms: { cognitoDomainPrefix: "example-cms", staging: false,
+    environment: { PAPYRUS_OAUTH_REDIRECT_URLS: "http://localhost:3001/" } },
+});
+function synth(raw: unknown) {
+  const app = new App();
+  return Template.fromStack(new AmplifyAppShellStack(app, "EmailTest", parseSiteConfig(raw), {
+    env: { account: "123456789012", region: "us-east-1" },
+  }));
+}
+const checks: Record<string, () => void> = {
+  managed() {
+    const template = synth({ ...base(), email: { mode: "managed", sendingDomain: "news.example.test" } });
+    template.resourceCountIs("AWS::SES::EmailIdentity", 1);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 1);
+    template.resourceCountIs("AWS::Route53::RecordSet", 0);
+    template.resourceCountIs("AWS::SES::ReceiptRuleSet", 0);
+    template.hasResourceProperties("AWS::SES::EmailIdentity", { EmailIdentity: "news.example.test" });
+    template.hasResourceProperties("AWS::SNS::Topic", { TopicName: "papyrus-newsletter-events-example" });
+    template.hasResourceProperties("AWS::SES::ConfigurationSetEventDestination", {
+      EventDestination: { Name: "cloudwatch-metrics", MatchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+        CloudWatchDestination: { DimensionConfigurations: [{ DimensionName: "ses:configuration-set",
+          DimensionValueSource: "MESSAGE_TAG", DefaultDimensionValue: "papyrus-example" }] } },
+    });
+    const text = JSON.stringify(template.toJSON());
+    assert.ok(text.includes("PAPYRUS_EMAIL_FROM_ADDRESS"));
+    assert.ok(text.includes("notifications@news.example.test"));
+    assert.ok(text.includes("EmailDkimRecord1Name"));
+    assert.ok(!text.includes("ses:SendEmail"), "identity setup does not grant unsolicited sending authority");
+  },
+  existing() {
+    const template = synth({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test",
+      configurationSet: "already-owned", eventTopicName: "already-owned-events" } });
+    template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+    template.resourceCountIs("AWS::SNS::Topic", 0);
+    assert.ok(JSON.stringify(template.toJSON()).includes("already-owned"));
+  },
+  static() {
+    const raw: Record<string, unknown> = { ...base(), reader: { buildCommand: "make site", baseDirectory: "dist" } };
+    delete raw.cms;
+    const template = synth(raw);
+    template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+    template.resourceCountIs("AWS::SES::ReceiptRule", 0);
+  },
+  missing() {
+    assert.throws(() => parseSiteConfig(base()), /email.*required.*cloud/i);
+    assert.throws(() => parseSiteConfig({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test" } }), /email.configurationSet/);
+  },
+};
+export function runCloudEmailTests(selected?: string): void {
+  if (selected) { assert.ok(checks[selected], selected); checks[selected](); }
+  else for (const check of Object.values(checks)) check();
+  console.log("cloud email infrastructure: ok");
+}
+
+runCloudEmailTests(process.argv[2]);

package/infra/cloud-email.ts

@@ -0,0 +1,60 @@
+import { ArnFormat, CfnOutput, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sns from "aws-cdk-lib/aws-sns";
+
+import type { CloudEmailConfig } from "./cloud-email-config";
+
+/** No DNS mutation, sending grant or receipt activation. Existing identities remain with their owner. */
+export function addCloudEmail(stack: Stack, config: CloudEmailConfig): Record<string, string> {
+  if (config.mode === "managed") {
+    const configurationSet = new ses.CfnConfigurationSet(stack, "CloudEmailConfigurationSet", {
+      name: config.configurationSet,
+      reputationOptions: { reputationMetricsEnabled: true },
+      suppressionOptions: { suppressedReasons: ["BOUNCE", "COMPLAINT"] },
+      sendingOptions: { sendingEnabled: true },
+    });
+    configurationSet.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    const identity = new ses.CfnEmailIdentity(stack, "CloudEmailIdentity", {
+      emailIdentity: config.sendingDomain,
+      dkimSigningAttributes: { nextSigningKeyLength: "RSA_2048_BIT" },
+      configurationSetAttributes: { configurationSetName: configurationSet.ref },
+    });
+    identity.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    const topic = new sns.Topic(stack, "CloudEmailEvents", { topicName: config.eventTopicName });
+    topic.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    topic.addToResourcePolicy(new iam.PolicyStatement({
+      principals: [new iam.ServicePrincipal("ses.amazonaws.com")], actions: ["sns:Publish"],
+      resources: [topic.topicArn], conditions: { StringEquals: { "aws:SourceAccount": stack.account } },
+    }));
+    const events = new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailEventDestination", {
+      configurationSetName: configurationSet.ref,
+      eventDestination: { name: "delivery-events", enabled: true,
+        matchingEventTypes: ["SEND", "DELIVERY", "BOUNCE", "COMPLAINT", "REJECT", "RENDERING_FAILURE", "DELIVERY_DELAY"],
+        snsDestination: { topicArn: topic.topicArn } },
+    });
+    events.node.addDependency(topic);
+    // These dimensions also feed the newsletter consumer's existing bounce/complaint alarms.
+    new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailMetrics", {
+      configurationSetName: configurationSet.ref,
+      eventDestination: { name: "cloudwatch-metrics", enabled: true,
+        matchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+        cloudWatchDestination: { dimensionConfigurations: [{ dimensionName: "ses:configuration-set",
+          dimensionValueSource: "MESSAGE_TAG", defaultDimensionValue: config.configurationSet }] } },
+    });
+    const records = [[identity.attrDkimDnsTokenName1, identity.attrDkimDnsTokenValue1],
+      [identity.attrDkimDnsTokenName2, identity.attrDkimDnsTokenValue2],
+      [identity.attrDkimDnsTokenName3, identity.attrDkimDnsTokenValue3]];
+    records.forEach(([name, value], index) => {
+      new CfnOutput(stack, `EmailDkimRecord${index + 1}Name`, { value: name, description: "CNAME name; DNS change requires separate approval" });
+      new CfnOutput(stack, `EmailDkimRecord${index + 1}Value`, { value });
+    });
+  }
+  const identityArn = stack.formatArn({ service: "ses", resource: "identity", resourceName: config.sendingDomain, arnFormat: ArnFormat.SLASH_RESOURCE_NAME });
+  new CfnOutput(stack, "EmailIdentityArn", { value: identityArn });
+  new CfnOutput(stack, "EmailConfigurationSetName", { value: config.configurationSet });
+  new CfnOutput(stack, "EmailEventTopicName", { value: config.eventTopicName });
+  return { PAPYRUS_EMAIL_FROM_ADDRESS: `${config.senderLocalPart}@${config.sendingDomain}`,
+    PAPYRUS_EMAIL_IDENTITY_ARN: identityArn, PAPYRUS_EMAIL_CONFIGURATION_SET: config.configurationSet,
+    PAPYRUS_EMAIL_EVENT_TOPIC_NAME: config.eventTopicName };
+}

package/infra/site-config.js

@@ -1,3 +1,4 @@
+import { parseCloudEmail } from "./cloud-email-config.js";
 export const READER_REDIRECT_STATUSES = ["301", "302", "200", "404", "404-200"];
 export function hasCmsApp(config) {
     return config.cms !== undefined;
@@ -35,7 +36,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_EMAIL_FROM_ADDRESS", "PAPYRUS_EMAIL_IDENTITY_ARN", "PAPYRUS_EMAIL_CONFIGURATION_SET", "PAPYRUS_EMAIL_EVENT_TOPIC_NAME", "PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
     "GET/v1/identities/me",
@@ -350,7 +351,7 @@ function parseAws(value) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "email", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
@@ -460,6 +461,7 @@ export function parseSiteConfig(raw) {
         stackName,
         aws,
         cms,
+        email: parseCloudEmail(record.email, cms !== undefined, siteId),
         reader,
         papyrusVersion,
         storagePreviewPrefix,

package/infra/site-config.ts

@@ -1,3 +1,5 @@
+import { parseCloudEmail, type CloudEmailConfig } from "./cloud-email-config";
+
 export type CmsRedirect = {
   source: string;
   status: 301 | 302;
@@ -63,6 +65,8 @@ export type AmplifyAppShellSiteConfig = {
   stackName?: string;
   aws?: SiteAwsConfig;
   cms?: CmsConfig;
+  /** Required for cloud CMS sites; independent of newsletter feature enablement. */
+  email?: CloudEmailConfig;
   reader?: {
     appName?: string;
     domainName?: string;
@@ -157,7 +161,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_EMAIL_FROM_ADDRESS", "PAPYRUS_EMAIL_IDENTITY_ARN", "PAPYRUS_EMAIL_CONFIGURATION_SET", "PAPYRUS_EMAIL_EVENT_TOPIC_NAME", "PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_READER_POLL_SECRET_PARAMETER", "PAPYRUS_SITE_ORIGIN"];
 
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
@@ -490,7 +494,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "email", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"],
     "site",
   );
 
@@ -600,6 +604,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     stackName,
     aws,
     cms,
+    email: parseCloudEmail(record.email, cms !== undefined, siteId),
     reader,
     papyrusVersion,
     storagePreviewPrefix,

package/lib/news-desk-session.ts

@@ -1,5 +1,4 @@
 import type { CategorySteeringDashboard } from "./category-repository";
-import { createEmptyCategorySteeringDashboard } from "./category-dashboard";
 import type { ReaderAuthSnapshot } from "../components/reader-auth-state";
 
 export type NewsDeskShellPhase =
@@ -59,26 +58,6 @@ export function beginDeskLoad(state: NewsDeskShellState, auth: ReaderAuthSnapsho
   };
 }
 
-export function beginAuthenticatedDeskHydration(
-  state: NewsDeskShellState,
-  auth: ReaderAuthSnapshot,
-  options: { canManageUsers: boolean },
-): NewsDeskShellState {
-  const dashboard = state.dashboard ?? {
-    ...createEmptyCategorySteeringDashboard(),
-    isPublicSkeleton: false,
-    canManageUsers: options.canManageUsers,
-  };
-  return {
-    ...state,
-    phase: state.dashboard ? "refreshing" : "loadingDesk",
-    auth,
-    dashboard,
-    stale: false,
-    error: null,
-  };
-}
-
 export function resolveSignedOut(state: NewsDeskShellState, auth: ReaderAuthSnapshot): NewsDeskShellState {
   return {
     ...state,
@@ -143,6 +122,18 @@ export function resolveDashboardFailure(
   };
 }
 
+/** An unverified session must never leave private records on screen. */
+export function resolveAccessFailure(state: NewsDeskShellState, error: string): NewsDeskShellState {
+  return {
+    ...state,
+    phase: "error",
+    auth: { status: "signedOut", label: "Signed out" },
+    dashboard: null,
+    stale: false,
+    error,
+  };
+}
+
 export function patchDashboard(
   state: NewsDeskShellState,
   patch: (dashboard: CategorySteeringDashboard) => CategorySteeringDashboard,

package/lib/newsroom-organizer-nav.ts

@@ -8,6 +8,7 @@ export type OrganizerDestination = {
 };
 export const ORGANIZER_NAV_GROUPS: readonly { title: string; items: readonly OrganizerDestination[] }[] = [
   { title: "Editorial work", items: [
+    { key: "overview", label: "Overview", description: "See notifications and work needing attention.", path: "/newsroom", primary: true },
     { key: "articles", label: getContentItemName().plural, description: `Follow ${contentItemPluralLowercase} across their stages and open one to write or revise it.`, path: `/newsroom/${contentItemBoardPathSegment()}`, alsoActiveOnPaths: ["/newsroom/articles"], primary: true },
     { key: "assignments", label: "Assignments", description: "Follow research and reporting work across its statuses and claim it.", path: "/newsroom/assignments" },
     { key: "messages", label: "Messages", description: "Read and reply to newsroom conversations.", path: "/newsroom/messages", primary: true },
@@ -23,7 +24,7 @@ export const ORGANIZER_NAV_GROUPS: readonly { title: string; items: readonly Org
   ] },
 ];
 const all = ORGANIZER_NAV_GROUPS.flatMap(group => group.items);
-export const ORGANIZER_PRIMARY_NAV = ["articles", "references", "messages"].map(key => all.find(item => item.key === key)!);
+export const ORGANIZER_PRIMARY_NAV = ["overview", "articles", "references", "messages"].map(key => all.find(item => item.key === key)!);
 
 export const ORGANIZER_SETTINGS_DESTINATION = {
   label: "Settings", path: "/newsroom/settings", description: "Theme, motion and interface preferences.",

package/package.json

@@ -108,6 +108,7 @@
     "./components/newsroom-curation-provider": "./components/newsroom-curation-provider.tsx",
     "./components/newsroom-ops-overview": "./components/newsroom-ops-overview.tsx",
     "./components/newsroom-ops-shell": "./components/newsroom-ops-shell.tsx",
+    "./components/newsroom-overview-skeleton": "./components/newsroom-overview-skeleton.tsx",
     "./components/newsroom-references-view": "./components/newsroom-references-view.tsx",
     "./components/newsroom-theme-fonts/broadsheet-green": "./components/newsroom-theme-fonts/broadsheet-green.tsx",
     "./components/newsroom-theme-fonts/newspaper-gothic": "./components/newsroom-theme-fonts/newspaper-gothic.tsx",
@@ -447,7 +448,7 @@
       "optional": true
     }
   },
-  "version": "5.33.2",
+  "version": "5.35.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.33.2",
+  "version": "5.35.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",