@anthusai/papyrus 5.41.2 → 5.42.1

package/amplify/plugins/reader-steering/function/handler.py

@@ -1015,6 +1015,26 @@ class DynamoReaderStore:
             raise
         return True
 
+    def list_story_drafts(self, limit: int) -> list[dict[str, Any]]:
+        """The story drafts of the table, only the fields ``listStoryDrafts`` may answer; at most ``limit`` (the newest if there are more)."""
+        fields = proposal_rules.STORY_DRAFT_FIELDS
+        names = {"#kind": "kind", **{f"#f{index}": field for index, field in enumerate(fields)}}
+        request: dict[str, Any] = {
+            "FilterExpression": "#kind = :kind",
+            "ProjectionExpression": ", ".join(f"#f{index}" for index in range(len(fields))) + ", #kind",
+            "ExpressionAttributeNames": names,
+            "ExpressionAttributeValues": {":kind": "story_draft"},
+        }
+        rows: list[dict[str, Any]] = []
+        while True:
+            page = self._table("proposal").scan(**request)
+            rows.extend(plain(item) for item in page.get("Items") or [])
+            if not page.get("LastEvaluatedKey"):
+                break
+            request["ExclusiveStartKey"] = page["LastEvaluatedKey"]
+        rows.sort(key=lambda row: (row.get("createdAt") or "", row.get("id") or ""), reverse=True)
+        return [{field: row.get(field) for field in fields} for row in rows[:limit]]
+
     def change_proposal(self, proposal_id: str, changes: dict[str, Any], expected_state: str, now_iso: str, *, expected_updated_at: str | None = None) -> bool:
         """Apply ``changes`` if the state (and, when given, ``updatedAt``) is still what the caller saw; a value of ``None`` removes the attribute."""
         names = {"#st": "state", "#u": "updatedAt", **{f"#c{index}": key for index, key in enumerate(changes)}}
@@ -1510,6 +1530,8 @@ def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSet
     """``moderateReader`` from AppSync: an editor or admin hides, approves, promotes, bans or undoes. Answers a receipt, never an exception."""
     if proposal_rules.event_field_name(event) in proposal_rules.MUTATIONS:
         return proposal_rules.handle_proposal_event(event, store, now_iso=iso(now_seconds), account_id=account_id)
+    if proposal_rules.event_field_name(event) in proposal_rules.QUERIES:
+        return proposal_rules.handle_proposal_query(event, store, account_id=account_id)
     identity = event.get("identity") or {}
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []

package/amplify/plugins/reader-steering/function/proposals.py

@@ -57,6 +57,11 @@ TARGET_COUNTS: dict[str, tuple[int, int]] = {
 TARGET_TYPES = ("concept", "entity", "column", "story", "cluster")
 
 MUTATIONS = ("fileProposal", "transitionProposal", "editProposal")
+#: The one read an operator has: ``listStoryDrafts`` answers the story drafts and nothing else of them (never the body, the evidence, the
+#: history, the proposer, a vote, the editor log or a reason), so an unattended run can avoid filing a near-duplicate of an earlier draft.
+QUERIES = ("listStoryDrafts",)
+STORY_DRAFT_FIELDS = ("id", "title", "summary", "targets", "state", "createdAt")
+MAXIMUM_STORY_DRAFTS = 500
 
 #: What ``editProposal`` does beyond moving the state. Editors and admins only: an operator is refused every one of them.
 PIN, UNPIN, HOLD, RELEASE, EXCLUDE_VOTES, UNDO_EXCLUSION = "pin", "unpin", "hold", "release", "exclude_votes", "undo_exclusion"
@@ -128,6 +133,8 @@ class ProposalStore(Protocol):
 
     def change_proposal(self, proposal_id: str, changes: dict[str, Any], expected_state: str, now_iso: str, *, expected_updated_at: str | None = None) -> bool: ...
 
+    def list_story_drafts(self, limit: int) -> list[dict[str, Any]]: ...
+
 
 def staff_subject(identity: dict[str, Any]) -> str | None:
     """The Cognito subject of an editor or admin, or ``None`` for anyone else."""
@@ -456,3 +463,25 @@ def handle_proposal_event(event: dict[str, Any], store: ProposalStore, *, now_is
         by=BY_OPERATOR if operator else BY_STAFF,
         allowed=OPERATOR_TRANSITIONS if operator else None,
     ).to_dict()
+
+
+def story_draft_summary(row: dict[str, Any]) -> dict[str, Any]:
+    """The six fields an operator may read of a story draft. ``targets`` stays the JSON text it is stored as."""
+    summary = {field: row.get(field) for field in STORY_DRAFT_FIELDS}
+    if summary["targets"] is not None and not isinstance(summary["targets"], str):
+        summary["targets"] = json.dumps(summary["targets"])
+    return summary
+
+
+def handle_proposal_query(event: dict[str, Any], store: ProposalStore, *, account_id: str | None = None) -> dict[str, Any]:
+    """``listStoryDrafts`` from AppSync: the story drafts, newest first, with only ``STORY_DRAFT_FIELDS``. Read only.
+
+    The same caller check as :func:`handle_proposal_event`: an editor or admin, or an IAM principal of ``account_id`` (the function's own
+    account) acting as an operator. An identity-pool user and a principal of any other account are refused. Answers a receipt-shaped
+    object, never an exception.
+    """
+    identity = event.get("identity") or {}
+    if staff_subject(identity) is None and operator_actor(identity, account_id) is None:
+        return {**refused("not_staff", "Only editors, admins and operators of this account can list story drafts.").to_dict(), "drafts": []}
+    rows = sorted(store.list_story_drafts(MAXIMUM_STORY_DRAFTS), key=lambda row: (row.get("createdAt") or "", row.get("id") or ""), reverse=True)
+    return {"status": "ok", "id": None, "error": None, "message": None, "drafts": [story_draft_summary(row) for row in rows[:MAXIMUM_STORY_DRAFTS]]}

package/amplify/plugins/reader-steering/papyrus.plugin.js

@@ -16,6 +16,7 @@ export const readerSteeringManifest = {
     contract: 1,
     models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction", "Proposal"],
     mutations: ["moderateReader", "fileProposal", "transitionProposal", "editProposal"],
+    queries: ["listStoryDrafts"],
     guest: { mutations: [] },
     newsroomPanels: [{ id: "moderation", label: "Moderation" }],
     staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],

package/amplify/plugins/reader-steering/papyrus.plugin.ts

@@ -23,6 +23,7 @@ export const readerSteeringManifest: PluginManifest = {
   contract: 1,
   models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction", "Proposal"],
   mutations: ["moderateReader", "fileProposal", "transitionProposal", "editProposal"],
+  queries: ["listStoryDrafts"],
   guest: { mutations: [] },
   newsroomPanels: [{ id: "moderation", label: "Moderation" }],
   staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],

package/amplify/plugins/reader-steering/schema.js

@@ -165,6 +165,22 @@ export function readerSteeringSchemaDefinitions() {
             error: a.string(),
             message: a.string(),
         }),
+        // What an operator may read of a story draft: these six fields and nothing else (no body, evidence, history, proposer, vote or log).
+        StoryDraftSummary: a.customType({
+            id: a.string().required(),
+            title: a.string().required(),
+            summary: a.string(),
+            targets: a.json(),
+            state: a.string().required(),
+            createdAt: a.string().required(),
+        }),
+        StoryDraftList: a.customType({
+            status: a.string().required(),
+            id: a.string(),
+            error: a.string(),
+            message: a.string(),
+            drafts: a.ref("StoryDraftSummary").array(),
+        }),
         // Editors and admins file as themselves. AppSync also admits an IAM principal whose own policy allows the field (the
         // schema accepts IAM callers for the functions that call it); the function files an AI proposal for an IAM principal
         // of its own account only, and refuses an identity-pool user and any other account. No IAM rule is declared here.
@@ -194,6 +210,13 @@ export function readerSteeringSchemaDefinitions() {
             .returns(a.ref("ProposalReceipt"))
             .authorization((allow) => [allow.group("editor"), allow.group("admin")])
             .handler(functionHandler("readerActions", readerActions)),
+        // Read only, and the same caller rule as fileProposal: editors and admins, or an IAM principal of the function's own account. The function
+        // answers the story drafts' id, title, summary, targets, state and createdAt so an unattended trend run can dedupe; nothing else.
+        listStoryDrafts: a
+            .query()
+            .returns(a.ref("StoryDraftList"))
+            .authorization((allow) => [allow.group("editor"), allow.group("admin")])
+            .handler(functionHandler("readerActions", readerActions)),
         // Editors and admins only, and the function refuses an IAM operator: pin, unpin, hold, release, exclude_votes and
         // undo_exclusion. `rule` is a batch rule for exclude_votes; `exclusionId` names the exclusion undo_exclusion reverses.
         editProposal: a

package/amplify/plugins/reader-steering/schema.ts

@@ -167,6 +167,22 @@ export function readerSteeringSchemaDefinitions() {
       error: a.string(),
       message: a.string(),
     }),
+    // What an operator may read of a story draft: these six fields and nothing else (no body, evidence, history, proposer, vote or log).
+    StoryDraftSummary: a.customType({
+      id: a.string().required(),
+      title: a.string().required(),
+      summary: a.string(),
+      targets: a.json(),
+      state: a.string().required(),
+      createdAt: a.string().required(),
+    }),
+    StoryDraftList: a.customType({
+      status: a.string().required(),
+      id: a.string(),
+      error: a.string(),
+      message: a.string(),
+      drafts: a.ref("StoryDraftSummary").array(),
+    }),
     // Editors and admins file as themselves. AppSync also admits an IAM principal whose own policy allows the field (the
     // schema accepts IAM callers for the functions that call it); the function files an AI proposal for an IAM principal
     // of its own account only, and refuses an identity-pool user and any other account. No IAM rule is declared here.
@@ -196,6 +212,13 @@ export function readerSteeringSchemaDefinitions() {
       .returns(a.ref("ProposalReceipt"))
       .authorization((allow) => [allow.group("editor"), allow.group("admin")])
       .handler(functionHandler("readerActions", readerActions)),
+    // Read only, and the same caller rule as fileProposal: editors and admins, or an IAM principal of the function's own account. The function
+    // answers the story drafts' id, title, summary, targets, state and createdAt so an unattended trend run can dedupe; nothing else.
+    listStoryDrafts: a
+      .query()
+      .returns(a.ref("StoryDraftList"))
+      .authorization((allow) => [allow.group("editor"), allow.group("admin")])
+      .handler(functionHandler("readerActions", readerActions)),
     // Editors and admins only, and the function refuses an IAM operator: pin, unpin, hold, release, exclude_votes and
     // undo_exclusion. `rule` is a batch rule for exclude_votes; `exclusionId` names the exclusion undo_exclusion reverses.
     editProposal: a

package/components/monitoring-overview-view.tsx

@@ -336,7 +336,7 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
         <div className="news-desk-doctrine-card__header"><div><h3>Collected queue</h3><span>Newest first, with what the shared Cyclotron decided</span></div></div>
         {data.items.length ? (
           <ul className="news-desk-monitoring__queue">
-            {data.items.map((item) => <QueueItem key={`${item.sourceId}-${item.revision}`} item={item} ownId={data.scope.publicationId} demo={demo} />)}
+            {data.items.map((item) => <QueueItem key={`${item.monitorId ?? ""}-${item.sourceId}-${item.revision}`} item={item} ownId={data.scope.publicationId} demo={demo} />)}
           </ul>
         ) : <p>No items in the queue.</p>}
         {data.hiddenNotRelevant > 0 ? (
@@ -345,6 +345,14 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
           </p>
         ) : null}
       </article>
+
+      {data.otherMonitors?.length ? (
+        <details className="news-desk-delegation-note" data-monitoring-other-monitors>
+          <summary>Not routed to this site ({data.otherMonitors.length})</summary>
+          <p>These monitors collect items, but none of them is routed to this site, so their items are not shown here.</p>
+          <ul>{data.otherMonitors.map((id) => <li key={id} data-monitoring-other-monitor={id}>{id}</li>)}</ul>
+        </details>
+      ) : null}
     </>
   );
 }

package/components/papyrus-private-chat-panel.tsx

@@ -1,8 +1,6 @@
 "use client";
 
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { connectNewsroomChat } from "../lib/newsroom-chat-client";
-import { loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
 import { PapyrusConsoleConversation, type ConsoleConversationMessage } from "./papyrus-console-conversation";
 import {
   listPapyrusPrivateChatMessages,
@@ -30,13 +28,9 @@ function failureMessage(error: unknown): string {
 export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   const [channel, setChannel] = useState<PapyrusPrivateChatChannel | null>(null);
   const [messages, setMessages] = useState<PapyrusPrivateChatMessage[]>([]);
-  const [accountState, setAccountState] = useState<ProspectusAccountState | null>(null);
-  const [connecting, setConnecting] = useState(false);
-  const [connectionNotice, setConnectionNotice] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
   const [sending, setSending] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const identityGeneration = useRef(0);
   const retryAttempt = useRef<{ text: string; key: string } | null>(null);
   const isWaitingForReply = messages.length > 0 && messages[messages.length - 1].author_kind === "human" &&
     messages[messages.length - 1].addressed_to_bot_id !== null;
@@ -52,66 +46,38 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     }];
   }, [isWaitingForReply, messages]);
 
-  const handleFailure = useCallback(async (nextError: unknown) => {
-    const failure = failureMessage(nextError);
-    setError(failure);
-    if (["sign_in_required", "chat_identity_connection_required", "publishing_account_required", "chat_account_access_denied"].includes(failure)) {
-      const generation = ++identityGeneration.current;
-      setChannel(null);
-      setMessages([]);
-      setAccountState(null);
-      retryAttempt.current = null;
-      setSending(false);
-      setLoading(false);
-      if (failure === "publishing_account_required") {
-        const state = await loadProspectusAccountState(window.location.pathname);
-        if (generation === identityGeneration.current) setAccountState(state);
-      }
-    }
-  }, []);
-
-  const refreshMessages = useCallback(async (channelId: string, generation: number) => {
+  const refreshMessages = useCallback(async (channelId: string) => {
     const next = await listPapyrusPrivateChatMessages(channelId);
-    if (generation === identityGeneration.current) setMessages(next);
+    setMessages(next);
   }, []);
 
   const openConversation = useCallback(async () => {
-    const generation = ++identityGeneration.current;
     setLoading(true);
     setError(null);
-    setChannel(null);
-    setMessages([]);
     try {
       const nextChannel = await openPapyrusPrivateChat();
-      if (generation !== identityGeneration.current) return;
       setChannel(nextChannel);
-      await refreshMessages(nextChannel.channel_id, generation);
+      await refreshMessages(nextChannel.channel_id);
     } catch (nextError) {
-      if (generation === identityGeneration.current) await handleFailure(nextError);
+      setError(failureMessage(nextError));
     } finally {
-      if (generation === identityGeneration.current) setLoading(false);
+      setLoading(false);
     }
-  }, [handleFailure, refreshMessages]);
+  }, [refreshMessages]);
 
   useEffect(() => {
-    const code = new URLSearchParams(window.location.search).get("sign_in_error");
-    if (code) setConnectionNotice(code === "newsroom_identity_mismatch"
-      ? "The selected Google account did not match your newsroom session. Connect again with the same account."
-      : "The publishing-account connection did not complete. You can safely try again.");
     void openConversation();
-    return () => { identityGeneration.current += 1; };
   }, [openConversation]);
 
   useEffect(() => {
     if (!channel || !isWaitingForReply) return;
     let active = true;
-    const generation = identityGeneration.current;
     let timer: ReturnType<typeof setTimeout> | null = null;
     const poll = async () => {
       try {
-        await refreshMessages(channel.channel_id, generation);
+        await refreshMessages(channel.channel_id);
       } catch (nextError) {
-        if (active && generation === identityGeneration.current) await handleFailure(nextError);
+        if (active) setError(failureMessage(nextError));
         return;
       }
       if (active) timer = setTimeout(poll, REFRESH_MS);
@@ -121,11 +87,10 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
       active = false;
       if (timer) clearTimeout(timer);
     };
-  }, [channel, handleFailure, isWaitingForReply, refreshMessages]);
+  }, [channel, isWaitingForReply, refreshMessages]);
 
   const sendMessage = useCallback(async (text: string) => {
     if (!channel || !text.trim() || sending) return;
-    const generation = identityGeneration.current;
     const attempt = retryAttempt.current?.text === text
       ? retryAttempt.current
       : { text, key: globalThis.crypto.randomUUID() };
@@ -134,40 +99,16 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     setError(null);
     try {
       const result = await sendPapyrusPrivateChatMessage(channel.channel_id, text, attempt.key);
-      if (generation !== identityGeneration.current) return;
       setMessages((current) => current.some((message) => message.message_id === result.message.message_id)
         ? current
         : [...current, result.message]);
       retryAttempt.current = null;
-    } catch (nextError) {
-      if (generation === identityGeneration.current) await handleFailure(nextError);
-    } finally {
-      if (generation === identityGeneration.current) setSending(false);
-    }
-  }, [channel, handleFailure, sending]);
-
-  const connect = async () => {
-    setConnecting(true);
-    try {
-      const returnUrl = new URL(window.location.href);
-      returnUrl.searchParams.delete("sign_in_error");
-      const target = await connectNewsroomChat(`${returnUrl.pathname}${returnUrl.search}${returnUrl.hash}`);
-      window.location.assign(target);
     } catch (nextError) {
       setError(failureMessage(nextError));
-      setConnecting(false);
+    } finally {
+      setSending(false);
     }
-  };
-  const chooseAccount = async (accountId: string) => {
-    setConnecting(true);
-    try {
-      const result = await selectProspectusAccount(accountId);
-      if ("error" in result) { setError(result.error); return; }
-      setAccountState(null);
-      await openConversation();
-    } catch (nextError) { setError(failureMessage(nextError)); }
-    finally { setConnecting(false); }
-  };
+  }, [channel, sending]);
 
   return <div className="papyrus-console__panel">
     <header className="papyrus-console__header">
@@ -176,20 +117,9 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     </header>
     {channel ? <p className="papyrus-console__empty" role="status">Private conversation for your selected Account.</p> : null}
     {!channel && !loading ? <div className="papyrus-console__empty" role="alert">
-      {error === "chat_identity_connection_required" ? <>
-        <strong>Connect your publishing account</strong>
-        {connectionNotice ? <span>{connectionNotice}</span> : null}
-        <span>Continue with the same Google account you use in the newsroom, then choose the Account for this private conversation.</span>
-        <button className="papyrus-console__new-session" disabled={connecting} onClick={() => void connect()} type="button">{connecting ? "Connecting…" : "Connect publishing account"}</button>
-      </> : accountState?.status === "signedIn" ? <>
-        <strong>Choose your publishing Account</strong>
-        {accountState.publishingAccounts.length === 0 ? <span>This identity has no publishing Account for this site. Ask the Account owner to confirm your existing access.</span> : accountState.publishingAccounts.map(account => <button className="papyrus-console__new-session" disabled={connecting} key={account.accountId} onClick={() => void chooseAccount(account.accountId)} type="button">{account.name ?? account.accountId}</button>)}
-        {error !== "publishing_account_required" ? <span>{error}</span> : null}
-      </> : <>
-        <strong>Private chat could not be opened.</strong>
-        <span>{error === "sign_in_required" ? "Your newsroom session has expired. Sign in from the account menu, then retry." : error}</span>
-        <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
-      </>}
+      <strong>Private chat could not be opened.</strong>
+      <span>{error}</span>
+      <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
     </div> : <PapyrusConsoleConversation
       messages={conversationMessages}
       isSending={sending || loading || !channel}

package/lib/monitoring-overview.ts

@@ -20,6 +20,7 @@ export type MonitoringRelevance = {
 };
 
 export type MonitoringItem = {
+  monitorId?: string;
   sourceId: string;
   revision: number;
   title: string;
@@ -128,6 +129,8 @@ export type MonitoringOverview = {
     historyComplete: boolean;
   } | null;
   items: MonitoringItem[];
+  /** Monitors that do not route to this site: named only, with no items. */
+  otherMonitors?: string[];
   emailSubmissions?: MonitoringEmailSummary[];
   hiddenNotRelevant: number;
 };

package/lib/papyrus-hosted-chat.ts

@@ -1,4 +1,3 @@
-import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "./newsroom-chat-identity";
 import { createHash } from "node:crypto";
 import type { EmbeddedChatAppDependencies } from "chatticus/chat-server";
 import type { NextRequest } from "next/server";
@@ -25,7 +24,6 @@ export interface PapyrusChatScope {
 }
 
 export interface PapyrusHostedChatOptions {
-  resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
   resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
   resolvePrivateDependencies?: () => Promise<EmbeddedChatAppDependencies | null>;
   privateChatEnabled?: boolean;
@@ -63,7 +61,7 @@ async function principalForRequest(
   request: NextRequest,
   operation: "console:read" | "console:write",
   options: PapyrusHostedChatOptions,
-): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; error?: string }> {
+): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number }> {
   const environment = options.environment ?? process.env;
   const siteProduct = options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct(environment);
   if (!siteProduct) return { principal: null, status: 503 };
@@ -76,22 +74,11 @@ async function principalForRequest(
   }
   if (!runtime) return { principal: null, status: 503 };
 
-  let newsroomIdentity;
-  try {
-    newsroomIdentity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
-  } catch {
-    return { principal: null, status: 503 };
-  }
-  if (!newsroomIdentity) return { principal: null, status: 401 };
   const nowInSeconds = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
   const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
-  if (!session || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
-    return { principal: null, status: 409, error: "chat_identity_connection_required" };
-  }
-  if (session.newsroomSubject !== newsroomIdentity.subject) {
-    return { principal: null, status: 409, error: "chat_identity_connection_required" };
+  if (!session || !session.selectedAccountId || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
+    return { principal: null, status: 401 };
   }
-  if (!session.selectedAccountId) return { principal: null, status: 409, error: "publishing_account_required" };
 
   try {
     const directory = await runtime.accounts.accountDirectory(session.accessToken);
@@ -175,9 +162,6 @@ export async function handlePapyrusHostedChatRequest(
   const privateChatEnabled = options.privateChatEnabled ?? environment.PAPYRUS_PRIVATE_CHAT_ENABLED === "true";
   if (!privateChatEnabled) return jsonFailure(404, "private_chat_disabled");
 
-  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
-  if (!authorization.principal) return jsonFailure(authorization.status, authorization.error ?? (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
-
   let dependencies: EmbeddedChatAppDependencies | null;
   try {
     if (options.resolvePrivateDependencies) {
@@ -194,6 +178,9 @@ export async function handlePapyrusHostedChatRequest(
   }
   if (!dependencies) return jsonFailure(503, "private_chat_storage_unavailable");
 
+  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
+  if (!authorization.principal) return jsonFailure(authorization.status, authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable");
+
   const headers = new Headers({ accept: request.headers.get("accept") ?? "application/json" });
   let body: string | undefined;
   if (request.method === "POST" && isMessageRoute) {

package/lib/papyrus-private-chat-client.ts

@@ -1,4 +1,3 @@
-import { newsroomChatFetch } from "./newsroom-chat-client";
 export type PapyrusPrivateChatChannel = {
   channel_id: string;
   participants: Array<{ kind: string; actor_id: string }>;
@@ -40,8 +39,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   return payload as T;
 }
 
-/** Open the current editor's server-derived private channel using the verified newsroom identity and connected account session. */
-export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = newsroomChatFetch): Promise<PapyrusPrivateChatChannel> {
+/** Open the current editor's server-derived private channel using the signed same-origin session cookie. */
+export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = globalThis.fetch): Promise<PapyrusPrivateChatChannel> {
   const result = await requestJson<PapyrusPrivateChatChannel>("private-channel", { method: "POST" }, fetcher);
   if (!result.channel_id?.trim() || !Array.isArray(result.participants)) {
     throw new Error("Private chat returned an invalid channel.");
@@ -52,7 +51,7 @@ export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch =
 /** Read only the private channel returned by the host's authenticated open request. */
 export async function listPapyrusPrivateChatMessages(
   channelId: string,
-  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
+  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
 ): Promise<PapyrusPrivateChatMessage[]> {
   if (!channelId.trim()) throw new Error("A private chat channel is required.");
   const result = await requestJson<{ messages?: unknown }>(`channels/${encodeURIComponent(channelId)}/messages`, { method: "GET" }, fetcher);
@@ -65,7 +64,7 @@ export async function sendPapyrusPrivateChatMessage(
   channelId: string,
   body: string,
   idempotencyKey: string,
-  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
+  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
 ): Promise<PapyrusPrivateChatSendResult> {
   if (!channelId.trim() || !body.trim() || !idempotencyKey.trim()) {
     throw new Error("A channel, message and idempotency key are required.");

package/lib/prospectus-session.ts

@@ -33,7 +33,6 @@ const MINIMUM_SEALING_SECRET_LENGTH = 32;
 
 export interface PendingProspectusSignInCookie extends PendingProspectusSignIn {
   returnPath: string;
-  newsroomSubject?: string;
 }
 
 export interface ProspectusSignedInSession {
@@ -41,7 +40,6 @@ export interface ProspectusSignedInSession {
   accessToken: string;
   accessTokenExpiresAt: number;
   selectedAccountId?: string;
-  newsroomSubject?: string;
   siteSubject?: string;
 }
 

package/lib/prospectus-sign-in-routes.ts

@@ -1,4 +1,3 @@
-import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "./newsroom-chat-identity";
 import { NextResponse, type NextRequest } from "next/server";
 import {
   CYCLOTRON_LAB_PRODUCT,
@@ -37,7 +36,6 @@ import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfigured
  * unregistered deployment never half-signs anyone in.
  */
 export interface ProspectusSignInRouteOptions {
-  resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
   resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
   siteProduct?: string | null;
   completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
@@ -139,25 +137,12 @@ export function handleProspectusSignInStart(request: NextRequest, options: Prosp
 async function handleProspectusSignInStartRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
-  const newsroomConnection = request.nextUrl.searchParams.get("newsroomChat") === "true";
-  let newsroomSubject: string | undefined;
-  if (newsroomConnection) {
-    if (request.method !== "POST" || request.headers.get("origin") !== siteOriginFor(request, options)) {
-      return signInFailedResponse(403, "same_origin_required", "Connect chat from this newsroom.");
-    }
-    const identity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request).catch(() => null);
-    if (!identity) return signInFailedResponse(401, "sign_in_required", "An authenticated newsroom editor is required.");
-    newsroomSubject = identity.subject;
-  }
   const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
   const pendingSignInCookie: PendingProspectusSignInCookie = {
     ...pendingSignIn,
-    ...(newsroomSubject ? { newsroomSubject } : {}),
-    returnPath: sameSiteReturnPath(newsroomConnection ? request.nextUrl.searchParams.get("returnTo") : await requestedReturnPath(request)),
+    returnPath: sameSiteReturnPath(await requestedReturnPath(request)),
   };
-  const response = newsroomConnection
-    ? NextResponse.json({ authorizationUrl }, { headers: NO_STORE_HEADERS })
-    : NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
+  const response = NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
   response.cookies.set(
     PROSPECTUS_PENDING_SIGN_IN_COOKIE,
     sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_PENDING_SIGN_IN_COOKIE, pendingSignInCookie, pendingSignIn.expiresAt),
@@ -209,13 +194,11 @@ async function completeCallback(
       pendingSignIn,
       returnedState,
       authorizationCode,
-      expectedNewsroomSubject: pendingSignIn.newsroomSubject,
       nowInSeconds,
       ...options.completionOverrides,
     });
     const session: ProspectusSignedInSession = {
       personId: signedIn.person.id,
-      ...(pendingSignIn.newsroomSubject ? { newsroomSubject: pendingSignIn.newsroomSubject } : {}),
       accessToken: signedIn.accessToken,
       accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
       ...(signedIn.person.siteSubject ? { siteSubject: signedIn.person.siteSubject } : {}),

package/lib/prospectus-site-identity.ts

@@ -281,7 +281,6 @@ export interface CompleteProspectusGoogleSignInInput {
   pendingSignIn: PendingProspectusSignIn;
   returnedState: string;
   authorizationCode: string;
-  expectedNewsroomSubject?: string;
   verifyCognitoTokens?: CognitoTokenVerifier;
   fetcher?: typeof fetch;
   nowInSeconds?: number;
@@ -321,12 +320,6 @@ export async function completeProspectusGoogleSignIn(
     expiresInSeconds: Number(tokenBody.expires_in) || 0,
   };
   await (input.verifyCognitoTokens ?? cognitoTokenVerifier(input.cognitoClient))(tokens, input.pendingSignIn.nonce);
-  if (input.expectedNewsroomSubject) {
-    const claims = JSON.parse(Buffer.from(tokens.accessToken.split(".")[1], "base64url").toString("utf8")) as { sub?: string };
-    if (claims.sub !== input.expectedNewsroomSubject) {
-      throw new ProspectusAccountsError(403, "newsroom_identity_mismatch", "Continue with the same Google account as your newsroom session.");
-    }
-  }
   const { person } = await input.accounts.resolveGoogleSignIn(input.pendingSignIn, tokens.accessToken, tokens.idToken);
   return {
     person,

package/package.json

@@ -257,8 +257,6 @@
     "./lib/newsroom-board": "./lib/newsroom-board.ts",
     "./lib/newsroom-card-layout": "./lib/newsroom-card-layout.ts",
     "./lib/newsroom-category-drilldown": "./lib/newsroom-category-drilldown.ts",
-    "./lib/newsroom-chat-client": "./lib/newsroom-chat-client.ts",
-    "./lib/newsroom-chat-identity": "./lib/newsroom-chat-identity.ts",
     "./lib/newsroom-demo-articles": "./lib/newsroom-demo-articles.ts",
     "./lib/newsroom-demo-dashboard": "./lib/newsroom-demo-dashboard.ts",
     "./lib/newsroom-demo-profile": "./lib/newsroom-demo-profile.ts",
@@ -458,7 +456,7 @@
       "optional": true
     }
   },
-  "version": "5.41.2",
+  "version": "5.42.1",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.41.2",
+  "version": "5.42.1",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",

package/src/with-papyrus.d.mts

@@ -9,3 +9,4 @@ export function staticGenerationSettings(): {
   staticGenerationMaxConcurrency: number;
   staticGenerationRetryCount: number;
 };
+export function redirectChatticusZod(resource: { request: string; context?: string }): void;

package/src/with-papyrus.mjs

@@ -56,6 +56,18 @@ export function mergeTranspilePackages(existing = []) {
   return [...new Set([...existing, ...DEFAULT_TRANSPILE_PACKAGES])];
 }
 
+/**
+ * chatticus's prebuilt chat runtime is written against zod 4 (`z.looseObject`) and imports bare `zod`.
+ * Publication repos pin zod 3.25 through a root `overrides` entry (Amplify constructs need it), which
+ * also flattens chatticus's own zod 4 dependency, so the bundle then fails to build. zod 3.25 ships the
+ * zod 4 API at `zod/v4`; point only chatticus's `zod` imports there, leaving every other zod import alone.
+ */
+export const CHATTICUS_PACKAGE_PATH = /[\\/]node_modules[\\/]chatticus[\\/]/;
+
+export function redirectChatticusZod(resource) {
+  if (resource.request === "zod" && CHATTICUS_PACKAGE_PATH.test(resource.context ?? "")) resource.request = "zod/v4";
+}
+
 export const RUNTIME_TRACED_FILES = ["./corpora/**/*", "./amplify_outputs.json"];
 
 export function mergeOutputFileTracingIncludes(existing = {}) {
@@ -99,6 +111,10 @@ export function withPapyrus(nextConfig = {}, options = {}) {
     },
     webpack(config, context) {
       config.resolve.alias = { ...config.resolve.alias, ...aliases };
+      config.plugins = [
+        ...(config.plugins ?? []),
+        new context.webpack.NormalModuleReplacementPlugin(/^zod$/, redirectChatticusZod),
+      ];
       return typeof nextConfig.webpack === "function" ? nextConfig.webpack(config, context) : config;
     },
   };

package/lib/newsroom-chat-client.ts

@@ -1,30 +0,0 @@
-export type NewsroomChatFetch = typeof fetch;
-
-export function createNewsroomChatFetch(
-  accessToken: () => Promise<string | null>,
-  fetcher: NewsroomChatFetch,
-): NewsroomChatFetch {
-  return async (input, init) => {
-    if (typeof input !== "string" || (!input.startsWith("/api/newsroom/chat/") && !input.startsWith("/api/auth/prospectus/"))) {
-      throw new Error("Newsroom credentials can only be sent to this site's chat identity routes.");
-    }
-    const token = await accessToken();
-    if (!token) throw new Error("sign_in_required");
-    const headers = new Headers(init?.headers);
-    headers.set("authorization", `Bearer ${token}`);
-    return fetcher(input, { ...init, headers, credentials: "same-origin", cache: "no-store" });
-  };
-}
-
-export const newsroomChatFetch: NewsroomChatFetch = createNewsroomChatFetch(async () => {
-  const { fetchAuthSession } = await import("aws-amplify/auth");
-  const session = await fetchAuthSession();
-  return session.tokens?.accessToken?.toString() ?? null;
-}, (input, init) => globalThis.fetch(input, init));
-
-export async function connectNewsroomChat(returnPath: string, fetcher: NewsroomChatFetch = newsroomChatFetch): Promise<string> {
-  const response = await fetcher(`/api/auth/prospectus/sign-in?newsroomChat=true&returnTo=${encodeURIComponent(returnPath)}`, { method: "POST" });
-  const body = await response.json() as { authorizationUrl?: string; message?: string };
-  if (!response.ok || !body.authorizationUrl) throw new Error(body.message ?? "Private chat could not connect to your publishing account.");
-  return body.authorizationUrl;
-}

package/lib/newsroom-chat-identity.ts

@@ -1,39 +0,0 @@
-import { CognitoJwtVerifier } from "aws-jwt-verify";
-import type { JwksCache } from "aws-jwt-verify/jwk";
-import type { NextRequest } from "next/server";
-import { readAmplifyOutputsFile } from "./amplify-outputs-path";
-
-export type NewsroomChatIdentity = { subject: string };
-export type NewsroomChatIdentityResolver = (request: NextRequest) => Promise<NewsroomChatIdentity | null>;
-
-export function newsroomChatIdentityResolver(
-  auth: { user_pool_id: string; user_pool_client_id: string },
-  jwksCache?: JwksCache,
-): NewsroomChatIdentityResolver {
-  const verifier = CognitoJwtVerifier.create({
-    userPoolId: auth.user_pool_id,
-    clientId: auth.user_pool_client_id,
-    tokenUse: "access",
-    groups: ["editor", "admin"],
-  }, jwksCache ? { jwksCache } : undefined);
-  return async (request) => {
-    const token = request.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1];
-    if (!token) return null;
-    try {
-      const claims = await verifier.verify(token);
-      return { subject: claims.sub };
-    } catch {
-      return null;
-    }
-  };
-}
-
-let configuredResolver: { key: string; resolve: NewsroomChatIdentityResolver } | undefined;
-
-export async function resolveNewsroomChatIdentity(request: NextRequest): Promise<NewsroomChatIdentity | null> {
-  const auth = readAmplifyOutputsFile()?.auth as { user_pool_id?: string; user_pool_client_id?: string } | undefined;
-  if (!auth?.user_pool_id || !auth.user_pool_client_id) throw new Error("Newsroom identity configuration is unavailable");
-  const key = `${auth.user_pool_id}:${auth.user_pool_client_id}`;
-  if (configuredResolver?.key !== key) configuredResolver = { key, resolve: newsroomChatIdentityResolver({ user_pool_id: auth.user_pool_id, user_pool_client_id: auth.user_pool_client_id }) };
-  return configuredResolver.resolve(request);
-}