@anthusai/papyrus 5.41.4 → 5.41.6

package/amplify/functions/monitoring-view/schema.js

@@ -20,6 +20,12 @@ export const monitoringViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(functionHandler("monitoringView", monitoringView)),
+    monitoringQueueEmailReference: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
     monitoringResolveEmailArticleLink: a
         .mutation()
         .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/monitoring-view/schema.ts

@@ -22,6 +22,12 @@ export const monitoringViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(functionHandler("monitoringView", monitoringView)),
+  monitoringQueueEmailReference: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
   monitoringResolveEmailArticleLink: a
     .mutation()
     .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/monitoring-view/wire.js

@@ -22,6 +22,7 @@ export function monitoringViewParameterArn(region, account) {
 export function wireMonitoringView(backend, emailMonitorId = "hn") {
     const lambda = backend.monitoringView.resources.lambda;
     const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${stack.region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
     lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
     lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);

package/amplify/functions/monitoring-view/wire.ts

@@ -28,6 +28,7 @@ export function monitoringViewParameterArn(region: string, account: string): str
 export function wireMonitoringView(backend: any, emailMonitorId = "hn"): void {
   const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
   const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${stack.region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
   lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
   lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);

package/components/monitoring-overview-view.tsx

@@ -97,8 +97,8 @@ function QueueItem({ item, ownId, demo }: { item: MonitoringItem; ownId: string
   );
 }
 
-function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates }: {
-  items: MonitoringEmailSummary[]; detail: MonitoringEmailDetails | null; onOpen: (receiptId: string) => void;
+export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates }: {
+  items: MonitoringEmailSummary[]; detail: MonitoringEmailDetails | null; onOpen?: (receiptId: string) => void;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
 }) {
@@ -181,7 +181,7 @@ function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImpor
       if (result.error) {
         setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `${result.imported} of ${candidates.length} selected candidates were registered or matched. ${result.error}` }));
       } else {
-        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `${result.imported} selected candidates are available as References. Import does not approve or publish them.` }));
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `${result.imported} selected candidates are available as References. Predictions are queued in the cloud; review them when ready. Import does not approve or publish them.` }));
       }
     } catch {
       if (isCurrentEmailSubmissionAction(activeReceiptId.current, requestReceiptId)) {
@@ -207,7 +207,7 @@ function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImpor
           <span>SES signals — SPF {item.verdicts.spf}, DKIM {item.verdicts.dkim}, DMARC {item.verdicts.dmarc}; spam {item.verdicts.spam}, virus {item.verdicts.virus}</span>
           {item.warnings.length ? <span>Warnings: {item.warnings.join(", ")}</span> : null}
           {item.errorCode ? <span>State: {item.status} ({item.errorCode})</span> : <span>State: {item.status}</span>}
-          <button type="button" onClick={() => onOpen(item.receiptId)}>Read email and review candidate links</button>
+          {onOpen ? <button type="button" onClick={() => onOpen(item.receiptId)}>Read email and review candidate links</button> : null}
         </li>)}
       </ul> : <p>No email submissions are available for this publication.</p>}
       {detail && "submission" in detail ? (
@@ -238,7 +238,9 @@ function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImpor
             {busyImport ? "Adding References…" : "Add selected links to References"}
           </button>
           {notice ? <p role="status" data-email-import-result>{notice}</p> : null}
-          {importedReferences.length ? <p><Link href={getNewsroomNavHref("/newsroom/references", false)}>Review these References</Link></p> : null}
+          {importedReferences.length ? <ul>{importedReferences.map((reference, index) => (
+            <li key={`${reference.id}-${index}`}><Link href={getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(reference.lineageId)}`, false)}>Review imported Reference {index + 1}</Link></li>
+          ))}</ul> : null}
         </section>
       ) : detail && "error" in detail ? <p role="alert">You cannot read this submission.</p>
         : detail && "state" in detail ? <p role="alert">Submission details are unavailable.</p> : null}

package/components/monitoring-panel.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
+import { useSearchParams } from "next/navigation";
 import {
   importMonitoringEmailCandidates,
   loadMonitoringEmailSubmission,
@@ -9,12 +10,41 @@ import {
 } from "../lib/monitoring-client";
 import { FIXTURE_ALL_PIPELINE_OVERVIEW, FIXTURE_MONITORING_OVERVIEW } from "../lib/monitoring-overview-fixture";
 import type { EmailReferenceImportItem, MonitoringEmailDetails, MonitoringResult } from "../lib/monitoring-overview";
-import { MonitoringOverviewView, type MonitoringMode } from "./monitoring-overview-view";
+import { EmailSubmissions, MonitoringOverviewView, type MonitoringMode } from "./monitoring-overview-view";
 
 const REFRESH_MILLISECONDS = 60_000;
 
-/** Administration, Monitoring: loads the overview, refreshes it each minute, and lets an admin widen it to the whole pipeline. */
-export function MonitoringPanel({ isAdmin, isDemo }: { isAdmin: boolean; isDemo: boolean }) {
+/** A receipt URL mounts only the single-submission reader, never the overview. */
+export function MonitoringPanel(props: { isAdmin: boolean; isDemo: boolean }) {
+  const searchParams = useSearchParams();
+  if (searchParams.has("receipt")) {
+    return <MonitoringEmailReceipt key={searchParams.get("receipt")} receiptId={searchParams.get("receipt") ?? ""} isDemo={props.isDemo} />;
+  }
+  return <MonitoringOverviewPanel {...props} />;
+}
+
+function MonitoringEmailReceipt({ receiptId, isDemo }: { receiptId: string; isDemo: boolean }) {
+  const [detail, setDetail] = useState<MonitoringEmailDetails | null>(null);
+  useEffect(() => {
+    if (!receiptId || isDemo) return;
+    let live = true;
+    void loadMonitoringEmailSubmission(receiptId).then(
+      (next) => { if (live) setDetail(next); },
+      () => { if (live) setDetail({ state: "unavailable" }); },
+    );
+    return () => { live = false; };
+  }, [receiptId, isDemo]);
+  if (!receiptId) return <p role="alert">A receipt is required to open a submission.</p>;
+  if (isDemo) return <p role="status">Single email submissions require an editor session.</p>;
+  return <div data-news-desk-admin-panel="monitoring">
+    {detail === null ? <p role="status">Loading email submission…</p> :
+      <EmailSubmissions items={"submission" in detail ? [detail.submission] : []} detail={detail}
+        onResolveArticleLink={resolveMonitoringEmailArticleLink} onImportCandidates={importMonitoringEmailCandidates} />}
+  </div>;
+}
+
+/** Overview refreshes apply only when no receipt was requested. */
+function MonitoringOverviewPanel({ isAdmin, isDemo }: { isAdmin: boolean; isDemo: boolean }) {
   const [mode, setMode] = useState<MonitoringMode>("publication");
   const [result, setResult] = useState<MonitoringResult | null>(null);
   const [emailDetail, setEmailDetail] = useState<MonitoringEmailDetails | null>(null);

package/components/papyrus-private-chat-panel.tsx

@@ -1,8 +1,7 @@
 "use client";
 
+import { Hub } from "aws-amplify/utils";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { connectNewsroomChat } from "../lib/newsroom-chat-client";
-import { loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
 import { PapyrusConsoleConversation, type ConsoleConversationMessage } from "./papyrus-console-conversation";
 import {
   listPapyrusPrivateChatMessages,
@@ -30,9 +29,6 @@ function failureMessage(error: unknown): string {
 export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   const [channel, setChannel] = useState<PapyrusPrivateChatChannel | null>(null);
   const [messages, setMessages] = useState<PapyrusPrivateChatMessage[]>([]);
-  const [accountState, setAccountState] = useState<ProspectusAccountState | null>(null);
-  const [connecting, setConnecting] = useState(false);
-  const [connectionNotice, setConnectionNotice] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
   const [sending, setSending] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -55,18 +51,13 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   const handleFailure = useCallback(async (nextError: unknown) => {
     const failure = failureMessage(nextError);
     setError(failure);
-    if (["sign_in_required", "chat_identity_connection_required", "publishing_account_required", "chat_account_access_denied"].includes(failure)) {
-      const generation = ++identityGeneration.current;
+    if (["sign_in_required", "chat_account_access_denied"].includes(failure)) {
+      ++identityGeneration.current;
       setChannel(null);
       setMessages([]);
-      setAccountState(null);
       retryAttempt.current = null;
       setSending(false);
       setLoading(false);
-      if (failure === "publishing_account_required") {
-        const state = await loadProspectusAccountState(window.location.pathname);
-        if (generation === identityGeneration.current) setAccountState(state);
-      }
     }
   }, []);
 
@@ -81,6 +72,8 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     setError(null);
     setChannel(null);
     setMessages([]);
+    retryAttempt.current = null;
+    setSending(false);
     try {
       const nextChannel = await openPapyrusPrivateChat();
       if (generation !== identityGeneration.current) return;
@@ -94,14 +87,18 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   }, [handleFailure, refreshMessages]);
 
   useEffect(() => {
-    const code = new URLSearchParams(window.location.search).get("sign_in_error");
-    if (code) setConnectionNotice(code === "newsroom_identity_mismatch"
-      ? "The selected Google account did not match your newsroom session. Connect again with the same account."
-      : "The publishing-account connection did not complete. You can safely try again.");
     void openConversation();
     return () => { identityGeneration.current += 1; };
   }, [openConversation]);
 
+  useEffect(() => Hub.listen("auth", ({ payload }) => {
+    if (payload.event === "tokenRefresh") {
+      void openConversation();
+    } else if (["signedOut", "signedIn", "tokenRefresh_failure"].includes(payload.event)) {
+      void handleFailure(new Error("sign_in_required"));
+    }
+  }), [handleFailure, openConversation]);
+
   useEffect(() => {
     if (!channel || !isWaitingForReply) return;
     let active = true;
@@ -146,54 +143,16 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     }
   }, [channel, handleFailure, sending]);
 
-  const connect = async () => {
-    setConnecting(true);
-    try {
-      const returnUrl = new URL(window.location.href);
-      returnUrl.searchParams.delete("sign_in_error");
-      const target = await connectNewsroomChat(`${returnUrl.pathname}${returnUrl.search}${returnUrl.hash}`);
-      window.location.assign(target);
-    } catch (nextError) {
-      setError(failureMessage(nextError));
-      setConnecting(false);
-    }
-  };
-  const chooseAccount = async (accountId: string) => {
-    setConnecting(true);
-    try {
-      const result = await selectProspectusAccount(accountId);
-      if ("error" in result) { setError(result.error); return; }
-      setAccountState(null);
-      await openConversation();
-    } catch (nextError) { setError(failureMessage(nextError)); }
-    finally { setConnecting(false); }
-  };
-
   return <div className="papyrus-console__panel">
     <header className="papyrus-console__header">
       <p className="papyrus-console__header-label">Private chat</p>
       <button className="papyrus-console__close" onClick={onClose} type="button" aria-label="Close console">×</button>
     </header>
-    {channel ? <p className="papyrus-console__empty" role="status">Private conversation for your selected Account.</p> : null}
+    {channel ? <p className="papyrus-console__empty" role="status">Private conversation for this newsroom.</p> : null}
     {!channel && !loading ? <div className="papyrus-console__access" role="alert">
-      {error === "chat_identity_connection_required" ? <>
-        <strong>Connect your publishing account</strong>
-        {connectionNotice ? <span>{connectionNotice}</span> : null}
-        <span>Continue with the same Google account you use in the newsroom, then choose the Account for this private conversation.</span>
-        <button className="papyrus-console__new-session" disabled={connecting} onClick={() => void connect()} type="button">{connecting ? "Connecting…" : "Connect publishing account"}</button>
-      </> : accountState?.status === "signedIn" ? <>
-        <strong>{accountState.publishingAccounts.length === 0 ? "Chat access is unavailable" : "Choose your publishing Account"}</strong>
-        {accountState.publishingAccounts.length === 0 ? <>
-          <span>None of your Accounts is enabled for this publication. Publication setup must be resolved before you can chat.</span>
-          <span>You can return to the newsroom while this is resolved. Check again after access has been corrected.</span>
-          <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Check again</button>
-        </> : accountState.publishingAccounts.map(account => <button className="papyrus-console__new-session" disabled={connecting} key={account.accountId} onClick={() => void chooseAccount(account.accountId)} type="button">{account.name ?? account.accountId}</button>)}
-        {error !== "publishing_account_required" ? <span>{error}</span> : null}
-      </> : <>
-        <strong>Private chat could not be opened.</strong>
-        <span>{error === "sign_in_required" ? "Your newsroom session has expired. Return to the newsroom and sign in from the account menu, then retry." : error === "chat_account_access_denied" ? "Your access to this conversation has changed. Retry to check your current access." : error === "publishing_account_required" ? "Publishing Account access could not be checked. Retry when your connection is available." : error}</span>
-        <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
-      </>}
+      <strong>Private chat could not be opened.</strong>
+      <span>{error === "sign_in_required" ? "Your newsroom session has expired. Return to the newsroom and sign in from the account menu, then retry." : error === "chat_account_access_denied" ? "Your access to this conversation has changed. Retry to check your current access." : error}</span>
+      <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
       <button className="papyrus-console__new-session" onClick={onClose} type="button">Back to newsroom</button>
     </div> : <PapyrusConsoleConversation
       messages={conversationMessages}
@@ -202,7 +161,7 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
       onSendMessage={sendMessage}
       error={error}
       emptyState={loading ? <p className="papyrus-console__empty">Opening private conversation…</p> : (
-        <p className="papyrus-console__empty">This conversation is private to your selected Account and editor session.</p>
+        <p className="papyrus-console__empty">This conversation is private to you in this newsroom.</p>
       )}
     />}
   </div>;

package/lib/monitoring-client.ts

@@ -10,7 +10,7 @@ import type {
   MonitoringResult,
 } from "./monitoring-overview";
 
-type QueryField = "monitoringOverview" | "monitoringEmailSubmission" | "monitoringResolveEmailArticleLink" | "intakeEmailSubmissionReferences";
+type QueryField = "monitoringOverview" | "monitoringEmailSubmission" | "monitoringResolveEmailArticleLink" | "intakeEmailSubmissionReferences" | "monitoringQueueEmailReference";
 type GraphQLResult = { data?: Partial<Record<QueryField, unknown>>; errors?: { message?: string; errorType?: string }[] };
 
 async function query<T>(field: QueryField, queryText: string, variables: Record<string, string | number>): Promise<T | { error: "forbidden" } | { state: "unavailable" }> {
@@ -74,10 +74,19 @@ export async function importMonitoringEmailCandidates(
     } catch {
       return { imported: references.length, references, error: "The import response could not be read. Completed links are safe to retry." };
     }
-    if (!response?.ok || !Array.isArray(response.references)) {
+    if (!response?.ok || !Array.isArray(response.references) || response.references.length !== batch.length) {
       return { imported: references.length, references, error: "The import was not accepted. Check your editor access and retry." };
     }
     references.push(...response.references);
+    for (const [index, reference] of response.references.entries()) {
+      const queued = await query<{ queued: boolean }>("monitoringQueueEmailReference",
+        `mutation MonitoringQueueEmailReference($input: AWSJSON!) { monitoringQueueEmailReference(input: $input) }`,
+        { input: JSON.stringify({ receiptId, ...batch[index], referenceId: reference.id }) });
+      if (!("queued" in queued) || !queued.queued) {
+        return { imported: references.length, references,
+          error: "References were registered, but predictions could not be queued. Retry these selected links safely." };
+      }
+    }
   }
   return { imported: references.length, references };
 }

package/lib/newsroom-chat-identity.ts

@@ -3,7 +3,7 @@ import type { JwksCache } from "aws-jwt-verify/jwk";
 import type { NextRequest } from "next/server";
 import { readAmplifyOutputsFile } from "./amplify-outputs-path";
 
-export type NewsroomChatIdentity = { subject: string };
+export type NewsroomChatIdentity = { subject: string; issuer: string; clientId: string; expiresAt: number };
 export type NewsroomChatIdentityResolver = (request: NextRequest) => Promise<NewsroomChatIdentity | null>;
 
 export function newsroomChatIdentityResolver(
@@ -21,7 +21,7 @@ export function newsroomChatIdentityResolver(
     if (!token) return null;
     try {
       const claims = await verifier.verify(token);
-      return { subject: claims.sub };
+      return { subject: claims.sub, issuer: claims.iss, clientId: auth.user_pool_client_id, expiresAt: claims.exp };
     } catch {
       return null;
     }

package/lib/papyrus-hosted-chat.ts

@@ -2,52 +2,35 @@ import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "
 import { createHash } from "node:crypto";
 import type { EmbeddedChatAppDependencies } from "chatticus/chat-server";
 import type { NextRequest } from "next/server";
-import {
-  ProspectusAccountsError,
-  authorizeSignedInPersonForAccount,
-} from "./prospectus-site-identity";
-import {
-  resolveProspectusSignInRuntime,
-  signedInProspectusSession,
-  type ProspectusSignInRuntime,
-} from "./prospectus-session";
-import { prospectusSiteProduct, publishingAccountsForSite } from "./prospectus-publication-access";
 import { publicSiteOrigin } from "./site-origin-value";
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
 
 export interface PapyrusChatScope {
-  siteProduct: string;
-  accountId: string;
-  personId: string;
   tenantId: string;
   editorId: string;
 }
 
 export interface PapyrusHostedChatOptions {
   resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
-  resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
   resolvePrivateDependencies?: () => Promise<EmbeddedChatAppDependencies | null>;
   privateChatEnabled?: boolean;
-  siteProduct?: string | null;
   environment?: Record<string, string | undefined>;
   nowInSeconds?: () => number;
 }
 
-function siteAndAccountKey(siteProduct: string, accountId: string): string {
-  return createHash("sha256").update(JSON.stringify([siteProduct, accountId])).digest("hex");
+/** A new namespace: never aliases Account-scoped or legacy transcripts. */
+export function derivePapyrusChatScope(publicationNamespace: string, issuer: string, subject: string): PapyrusChatScope {
+  const tenantHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer])).digest("hex");
+  const editorHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer, subject])).digest("hex");
+  return { tenantId: `papyrus-newsroom-v1-${tenantHash.slice(0, 40)}`, editorId: `papyrus-newsroom-editor-v1-${editorHash.slice(0, 40)}` };
 }
 
-export function derivePapyrusChatScope(siteProduct: string, accountId: string, personId: string): PapyrusChatScope {
-  const tenantHash = siteAndAccountKey(siteProduct, accountId);
-  const editorHash = createHash("sha256").update(JSON.stringify([siteProduct, accountId, personId])).digest("hex");
-  return {
-    siteProduct,
-    personId,
-    accountId,
-    tenantId: `papyrus-${tenantHash.slice(0, 40)}`,
-    editorId: `papyrus-editor-${editorHash.slice(0, 40)}`,
-  };
+/** Existing server storage resources bind the publication, independently of request hosts or claims. */
+function publicationNamespace(environment: Record<string, string | undefined>, clientId: string): string | null {
+  const bucket = environment.PAPYRUS_CHAT_SESSION_BUCKET?.trim();
+  const table = environment.PAPYRUS_CHAT_MESSAGING_TABLE?.trim();
+  return bucket && table ? JSON.stringify([bucket, table, clientId]) : null;
 }
 
 type ResolvedPapyrusPrincipal = {
@@ -61,71 +44,24 @@ type ResolvedPapyrusPrincipal = {
 
 async function principalForRequest(
   request: NextRequest,
-  operation: "console:read" | "console:write",
   options: PapyrusHostedChatOptions,
-): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; error?: string }> {
-  const environment = options.environment ?? process.env;
-  const siteProduct = options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct(environment);
-  if (!siteProduct) return { principal: null, status: 503 };
-
-  let runtime: ProspectusSignInRuntime | null;
-  try {
-    runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(publicSiteOrigin(request, environment));
-  } catch {
-    return { principal: null, status: 503 };
-  }
-  if (!runtime) return { principal: null, status: 503 };
-
-  let newsroomIdentity;
+): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; expiresAt?: number }> {
+  let identity;
   try {
-    newsroomIdentity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
+    identity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
   } catch {
     return { principal: null, status: 503 };
   }
-  if (!newsroomIdentity) return { principal: null, status: 401 };
-  const nowInSeconds = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
-  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
-  if (!session || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
-    return { principal: null, status: 409, error: "chat_identity_connection_required" };
-  }
-  if (session.newsroomSubject !== newsroomIdentity.subject) {
-    return { principal: null, status: 409, error: "chat_identity_connection_required" };
-  }
-  if (!session.selectedAccountId) return { principal: null, status: 409, error: "publishing_account_required" };
-
-  try {
-    const directory = await runtime.accounts.accountDirectory(session.accessToken);
-    if (directory.person?.id !== session.personId) return { principal: null, status: 401 };
-    if (!publishingAccountsForSite(directory.accounts, siteProduct).some((account) => account.accountId === session.selectedAccountId)) {
-      return { principal: null, status: 403 };
-    }
-    const authorization = await authorizeSignedInPersonForAccount(
-      runtime.accounts,
-      session.accessToken,
-      session.selectedAccountId,
-      operation,
-    );
-    if (authorization.personId !== session.personId || authorization.accountId !== session.selectedAccountId || authorization.operation !== operation) {
-      return { principal: null, status: 403 };
-    }
-    const scope = derivePapyrusChatScope(siteProduct, session.selectedAccountId, session.personId);
-    return {
-      principal: {
-        kind: "user",
-        tenantId: scope.tenantId,
-        userId: scope.editorId,
-        workerId: null,
-        organizationStatus: "enabled",
-        role: "member",
-      },
-      status: 200,
-    };
-  } catch (error) {
-    if (error instanceof ProspectusAccountsError && (error.status === 401 || error.status === 403)) {
-      return { principal: null, status: error.status };
-    }
-    return { principal: null, status: 503 };
-  }
+  const now = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
+  if (!identity || !identity.subject || !identity.issuer || !identity.clientId || !Number.isFinite(identity.expiresAt) || identity.expiresAt <= now) return { principal: null, status: 401 };
+  const namespace = publicationNamespace(options.environment ?? process.env, identity.clientId);
+  if (!namespace) return { principal: null, status: 503 };
+  const scope = derivePapyrusChatScope(namespace, identity.issuer, identity.subject);
+  return {
+    principal: { kind: "user", tenantId: scope.tenantId, userId: scope.editorId, workerId: null, organizationStatus: "enabled", role: "member" },
+    status: 200,
+    expiresAt: identity.expiresAt,
+  };
 }
 
 function jsonFailure(status: number, error: string): Response {
@@ -175,8 +111,8 @@ export async function handlePapyrusHostedChatRequest(
   const privateChatEnabled = options.privateChatEnabled ?? environment.PAPYRUS_PRIVATE_CHAT_ENABLED === "true";
   if (!privateChatEnabled) return jsonFailure(404, "private_chat_disabled");
 
-  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
-  if (!authorization.principal) return jsonFailure(authorization.status, authorization.error ?? (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
+  const authorization = await principalForRequest(request, options);
+  if (!authorization.principal) return jsonFailure(authorization.status, (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
 
   let dependencies: EmbeddedChatAppDependencies | null;
   try {
@@ -226,5 +162,38 @@ export async function handlePapyrusHostedChatRequest(
     ...dependencies,
     resolvePrincipal: async () => authorization.principal,
   });
-  return app.fetch(forwarded);
+  const response = await app.fetch(forwarded);
+  if (path[0] !== "turns" || path[2] !== "stream" || !response.ok || !response.body) return response;
+  const remaining = (authorization.expiresAt! - (options.nowInSeconds?.() ?? Date.now() / 1000)) * 1000;
+  return expireChatStream(response, remaining);
+}
+
+/** End an established stream at JWT expiry; reconnect must pass current authorization again. */
+export function expireChatStream(response: Response, remainingMilliseconds: number): Response {
+  if (!response.body) return response;
+  const reader = response.body.getReader();
+  let closed = false;
+  let timer: ReturnType<typeof setTimeout>;
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      timer = setTimeout(() => {
+        if (closed) return;
+        closed = true;
+        controller.close();
+        void reader.cancel().catch(() => {});
+      }, Math.max(0, Math.min(remainingMilliseconds, 2_147_483_647)));
+    },
+    async pull(controller) {
+      try {
+        const next = await reader.read();
+        if (closed) return;
+        if (next.done) { closed = true; clearTimeout(timer); controller.close(); }
+        else controller.enqueue(next.value);
+      } catch (error) {
+        if (!closed) { closed = true; clearTimeout(timer); controller.error(error); }
+      }
+    },
+    async cancel(reason) { closed = true; clearTimeout(timer); await reader.cancel(reason); },
+  });
+  return new Response(body, { status: response.status, headers: response.headers });
 }

package/lib/papyrus-private-chat-client.ts

@@ -31,6 +31,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   });
   const payload = await response.json().catch(() => null) as Record<string, unknown> | null;
   if (!response.ok) {
+    if (response.status === 401) throw new Error("sign_in_required");
+    if (response.status === 403) throw new Error("chat_account_access_denied");
     const error = typeof payload?.error === "string" ? payload.error
       : typeof payload?.detail === "string" ? payload.detail
         : `Private chat request failed (${response.status}).`;
@@ -40,7 +42,7 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   return payload as T;
 }
 
-/** Open the current editor's server-derived private channel using the verified newsroom identity and connected account session. */
+/** Open the current editor's server-derived private channel using the verified publication-local newsroom identity. */
 export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = newsroomChatFetch): Promise<PapyrusPrivateChatChannel> {
   const result = await requestJson<PapyrusPrivateChatChannel>("private-channel", { method: "POST" }, fetcher);
   if (!result.channel_id?.trim() || !Array.isArray(result.participants)) {

package/package.json

@@ -461,7 +461,7 @@
       "optional": true
     }
   },
-  "version": "5.41.4",
+  "version": "5.41.6",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.41.4",
+  "version": "5.41.6",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",