@anthusai/papyrus 5.41.5 → 5.42.0-next.1

package/amplify/functions/monitoring-view/schema.js

@@ -20,12 +20,6 @@ export const monitoringViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(functionHandler("monitoringView", monitoringView)),
-    monitoringQueueEmailReference: a
-        .mutation()
-        .arguments({ input: a.json().required() })
-        .returns(a.json())
-        .authorization((allow) => [allow.groups(editors)])
-        .handler(functionHandler("monitoringView", monitoringView)),
     monitoringResolveEmailArticleLink: a
         .mutation()
         .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/monitoring-view/schema.ts

@@ -22,12 +22,6 @@ export const monitoringViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(functionHandler("monitoringView", monitoringView)),
-  monitoringQueueEmailReference: a
-    .mutation()
-    .arguments({ input: a.json().required() })
-    .returns(a.json())
-    .authorization((allow) => [allow.groups(editors)])
-    .handler(functionHandler("monitoringView", monitoringView)),
   monitoringResolveEmailArticleLink: a
     .mutation()
     .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/monitoring-view/wire.js

@@ -22,7 +22,6 @@ export function monitoringViewParameterArn(region, account) {
 export function wireMonitoringView(backend, emailMonitorId = "hn") {
     const lambda = backend.monitoringView.resources.lambda;
     const stack = Stack.of(lambda);
-    lambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${stack.region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
     lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
     lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);

package/amplify/functions/monitoring-view/wire.ts

@@ -28,7 +28,6 @@ export function monitoringViewParameterArn(region: string, account: string): str
 export function wireMonitoringView(backend: any, emailMonitorId = "hn"): void {
   const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
   const stack = Stack.of(lambda);
-  lambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${stack.region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
   lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
   lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);

package/amplify/plugins/reader-steering/function/handler.py

@@ -1015,6 +1015,26 @@ class DynamoReaderStore:
             raise
         return True
 
+    def list_story_drafts(self, limit: int) -> list[dict[str, Any]]:
+        """The story drafts of the table, only the fields ``listStoryDrafts`` may answer; at most ``limit`` (the newest if there are more)."""
+        fields = proposal_rules.STORY_DRAFT_FIELDS
+        names = {"#kind": "kind", **{f"#f{index}": field for index, field in enumerate(fields)}}
+        request: dict[str, Any] = {
+            "FilterExpression": "#kind = :kind",
+            "ProjectionExpression": ", ".join(f"#f{index}" for index in range(len(fields))) + ", #kind",
+            "ExpressionAttributeNames": names,
+            "ExpressionAttributeValues": {":kind": "story_draft"},
+        }
+        rows: list[dict[str, Any]] = []
+        while True:
+            page = self._table("proposal").scan(**request)
+            rows.extend(plain(item) for item in page.get("Items") or [])
+            if not page.get("LastEvaluatedKey"):
+                break
+            request["ExclusiveStartKey"] = page["LastEvaluatedKey"]
+        rows.sort(key=lambda row: (row.get("createdAt") or "", row.get("id") or ""), reverse=True)
+        return [{field: row.get(field) for field in fields} for row in rows[:limit]]
+
     def change_proposal(self, proposal_id: str, changes: dict[str, Any], expected_state: str, now_iso: str, *, expected_updated_at: str | None = None) -> bool:
         """Apply ``changes`` if the state (and, when given, ``updatedAt``) is still what the caller saw; a value of ``None`` removes the attribute."""
         names = {"#st": "state", "#u": "updatedAt", **{f"#c{index}": key for index, key in enumerate(changes)}}
@@ -1510,6 +1530,8 @@ def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSet
     """``moderateReader`` from AppSync: an editor or admin hides, approves, promotes, bans or undoes. Answers a receipt, never an exception."""
     if proposal_rules.event_field_name(event) in proposal_rules.MUTATIONS:
         return proposal_rules.handle_proposal_event(event, store, now_iso=iso(now_seconds), account_id=account_id)
+    if proposal_rules.event_field_name(event) in proposal_rules.QUERIES:
+        return proposal_rules.handle_proposal_query(event, store, account_id=account_id)
     identity = event.get("identity") or {}
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []

package/amplify/plugins/reader-steering/function/proposals.py

@@ -57,6 +57,11 @@ TARGET_COUNTS: dict[str, tuple[int, int]] = {
 TARGET_TYPES = ("concept", "entity", "column", "story", "cluster")
 
 MUTATIONS = ("fileProposal", "transitionProposal", "editProposal")
+#: The one read an operator has: ``listStoryDrafts`` answers the story drafts and nothing else of them (never the body, the evidence, the
+#: history, the proposer, a vote, the editor log or a reason), so an unattended run can avoid filing a near-duplicate of an earlier draft.
+QUERIES = ("listStoryDrafts",)
+STORY_DRAFT_FIELDS = ("id", "title", "summary", "targets", "state", "createdAt")
+MAXIMUM_STORY_DRAFTS = 500
 
 #: What ``editProposal`` does beyond moving the state. Editors and admins only: an operator is refused every one of them.
 PIN, UNPIN, HOLD, RELEASE, EXCLUDE_VOTES, UNDO_EXCLUSION = "pin", "unpin", "hold", "release", "exclude_votes", "undo_exclusion"
@@ -128,6 +133,8 @@ class ProposalStore(Protocol):
 
     def change_proposal(self, proposal_id: str, changes: dict[str, Any], expected_state: str, now_iso: str, *, expected_updated_at: str | None = None) -> bool: ...
 
+    def list_story_drafts(self, limit: int) -> list[dict[str, Any]]: ...
+
 
 def staff_subject(identity: dict[str, Any]) -> str | None:
     """The Cognito subject of an editor or admin, or ``None`` for anyone else."""
@@ -456,3 +463,25 @@ def handle_proposal_event(event: dict[str, Any], store: ProposalStore, *, now_is
         by=BY_OPERATOR if operator else BY_STAFF,
         allowed=OPERATOR_TRANSITIONS if operator else None,
     ).to_dict()
+
+
+def story_draft_summary(row: dict[str, Any]) -> dict[str, Any]:
+    """The six fields an operator may read of a story draft. ``targets`` stays the JSON text it is stored as."""
+    summary = {field: row.get(field) for field in STORY_DRAFT_FIELDS}
+    if summary["targets"] is not None and not isinstance(summary["targets"], str):
+        summary["targets"] = json.dumps(summary["targets"])
+    return summary
+
+
+def handle_proposal_query(event: dict[str, Any], store: ProposalStore, *, account_id: str | None = None) -> dict[str, Any]:
+    """``listStoryDrafts`` from AppSync: the story drafts, newest first, with only ``STORY_DRAFT_FIELDS``. Read only.
+
+    The same caller check as :func:`handle_proposal_event`: an editor or admin, or an IAM principal of ``account_id`` (the function's own
+    account) acting as an operator. An identity-pool user and a principal of any other account are refused. Answers a receipt-shaped
+    object, never an exception.
+    """
+    identity = event.get("identity") or {}
+    if staff_subject(identity) is None and operator_actor(identity, account_id) is None:
+        return {**refused("not_staff", "Only editors, admins and operators of this account can list story drafts.").to_dict(), "drafts": []}
+    rows = sorted(store.list_story_drafts(MAXIMUM_STORY_DRAFTS), key=lambda row: (row.get("createdAt") or "", row.get("id") or ""), reverse=True)
+    return {"status": "ok", "id": None, "error": None, "message": None, "drafts": [story_draft_summary(row) for row in rows[:MAXIMUM_STORY_DRAFTS]]}

package/amplify/plugins/reader-steering/papyrus.plugin.js

@@ -16,6 +16,7 @@ export const readerSteeringManifest = {
     contract: 1,
     models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction", "Proposal"],
     mutations: ["moderateReader", "fileProposal", "transitionProposal", "editProposal"],
+    queries: ["listStoryDrafts"],
     guest: { mutations: [] },
     newsroomPanels: [{ id: "moderation", label: "Moderation" }],
     staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],

package/amplify/plugins/reader-steering/papyrus.plugin.ts

@@ -23,6 +23,7 @@ export const readerSteeringManifest: PluginManifest = {
   contract: 1,
   models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction", "Proposal"],
   mutations: ["moderateReader", "fileProposal", "transitionProposal", "editProposal"],
+  queries: ["listStoryDrafts"],
   guest: { mutations: [] },
   newsroomPanels: [{ id: "moderation", label: "Moderation" }],
   staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],

package/amplify/plugins/reader-steering/schema.js

@@ -165,6 +165,22 @@ export function readerSteeringSchemaDefinitions() {
             error: a.string(),
             message: a.string(),
         }),
+        // What an operator may read of a story draft: these six fields and nothing else (no body, evidence, history, proposer, vote or log).
+        StoryDraftSummary: a.customType({
+            id: a.string().required(),
+            title: a.string().required(),
+            summary: a.string(),
+            targets: a.json(),
+            state: a.string().required(),
+            createdAt: a.string().required(),
+        }),
+        StoryDraftList: a.customType({
+            status: a.string().required(),
+            id: a.string(),
+            error: a.string(),
+            message: a.string(),
+            drafts: a.ref("StoryDraftSummary").array(),
+        }),
         // Editors and admins file as themselves. AppSync also admits an IAM principal whose own policy allows the field (the
         // schema accepts IAM callers for the functions that call it); the function files an AI proposal for an IAM principal
         // of its own account only, and refuses an identity-pool user and any other account. No IAM rule is declared here.
@@ -194,6 +210,13 @@ export function readerSteeringSchemaDefinitions() {
             .returns(a.ref("ProposalReceipt"))
             .authorization((allow) => [allow.group("editor"), allow.group("admin")])
             .handler(functionHandler("readerActions", readerActions)),
+        // Read only, and the same caller rule as fileProposal: editors and admins, or an IAM principal of the function's own account. The function
+        // answers the story drafts' id, title, summary, targets, state and createdAt so an unattended trend run can dedupe; nothing else.
+        listStoryDrafts: a
+            .query()
+            .returns(a.ref("StoryDraftList"))
+            .authorization((allow) => [allow.group("editor"), allow.group("admin")])
+            .handler(functionHandler("readerActions", readerActions)),
         // Editors and admins only, and the function refuses an IAM operator: pin, unpin, hold, release, exclude_votes and
         // undo_exclusion. `rule` is a batch rule for exclude_votes; `exclusionId` names the exclusion undo_exclusion reverses.
         editProposal: a

package/amplify/plugins/reader-steering/schema.ts

@@ -167,6 +167,22 @@ export function readerSteeringSchemaDefinitions() {
       error: a.string(),
       message: a.string(),
     }),
+    // What an operator may read of a story draft: these six fields and nothing else (no body, evidence, history, proposer, vote or log).
+    StoryDraftSummary: a.customType({
+      id: a.string().required(),
+      title: a.string().required(),
+      summary: a.string(),
+      targets: a.json(),
+      state: a.string().required(),
+      createdAt: a.string().required(),
+    }),
+    StoryDraftList: a.customType({
+      status: a.string().required(),
+      id: a.string(),
+      error: a.string(),
+      message: a.string(),
+      drafts: a.ref("StoryDraftSummary").array(),
+    }),
     // Editors and admins file as themselves. AppSync also admits an IAM principal whose own policy allows the field (the
     // schema accepts IAM callers for the functions that call it); the function files an AI proposal for an IAM principal
     // of its own account only, and refuses an identity-pool user and any other account. No IAM rule is declared here.
@@ -196,6 +212,13 @@ export function readerSteeringSchemaDefinitions() {
       .returns(a.ref("ProposalReceipt"))
       .authorization((allow) => [allow.group("editor"), allow.group("admin")])
       .handler(functionHandler("readerActions", readerActions)),
+    // Read only, and the same caller rule as fileProposal: editors and admins, or an IAM principal of the function's own account. The function
+    // answers the story drafts' id, title, summary, targets, state and createdAt so an unattended trend run can dedupe; nothing else.
+    listStoryDrafts: a
+      .query()
+      .returns(a.ref("StoryDraftList"))
+      .authorization((allow) => [allow.group("editor"), allow.group("admin")])
+      .handler(functionHandler("readerActions", readerActions)),
     // Editors and admins only, and the function refuses an IAM operator: pin, unpin, hold, release, exclude_votes and
     // undo_exclusion. `rule` is a batch rule for exclude_votes; `exclusionId` names the exclusion undo_exclusion reverses.
     editProposal: a

package/app/.well-known/papyrus-cli.json/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCliLoginDiscovery } from "../../../lib/cli-login-discovery";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleCliLoginDiscovery(request);
+}

package/components/monitoring-overview-view.tsx

@@ -97,8 +97,8 @@ function QueueItem({ item, ownId, demo }: { item: MonitoringItem; ownId: string
   );
 }
 
-export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates }: {
-  items: MonitoringEmailSummary[]; detail: MonitoringEmailDetails | null; onOpen?: (receiptId: string) => void;
+function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates }: {
+  items: MonitoringEmailSummary[]; detail: MonitoringEmailDetails | null; onOpen: (receiptId: string) => void;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
 }) {
@@ -181,7 +181,7 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
       if (result.error) {
         setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `${result.imported} of ${candidates.length} selected candidates were registered or matched. ${result.error}` }));
       } else {
-        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `${result.imported} selected candidates are available as References. Predictions are queued in the cloud; review them when ready. Import does not approve or publish them.` }));
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `${result.imported} selected candidates are available as References. Import does not approve or publish them.` }));
       }
     } catch {
       if (isCurrentEmailSubmissionAction(activeReceiptId.current, requestReceiptId)) {
@@ -207,7 +207,7 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
           <span>SES signals — SPF {item.verdicts.spf}, DKIM {item.verdicts.dkim}, DMARC {item.verdicts.dmarc}; spam {item.verdicts.spam}, virus {item.verdicts.virus}</span>
           {item.warnings.length ? <span>Warnings: {item.warnings.join(", ")}</span> : null}
           {item.errorCode ? <span>State: {item.status} ({item.errorCode})</span> : <span>State: {item.status}</span>}
-          {onOpen ? <button type="button" onClick={() => onOpen(item.receiptId)}>Read email and review candidate links</button> : null}
+          <button type="button" onClick={() => onOpen(item.receiptId)}>Read email and review candidate links</button>
         </li>)}
       </ul> : <p>No email submissions are available for this publication.</p>}
       {detail && "submission" in detail ? (
@@ -238,9 +238,7 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
             {busyImport ? "Adding References…" : "Add selected links to References"}
           </button>
           {notice ? <p role="status" data-email-import-result>{notice}</p> : null}
-          {importedReferences.length ? <ul>{importedReferences.map((reference, index) => (
-            <li key={`${reference.id}-${index}`}><Link href={getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(reference.lineageId)}`, false)}>Review imported Reference {index + 1}</Link></li>
-          ))}</ul> : null}
+          {importedReferences.length ? <p><Link href={getNewsroomNavHref("/newsroom/references", false)}>Review these References</Link></p> : null}
         </section>
       ) : detail && "error" in detail ? <p role="alert">You cannot read this submission.</p>
         : detail && "state" in detail ? <p role="alert">Submission details are unavailable.</p> : null}
@@ -338,7 +336,7 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
         <div className="news-desk-doctrine-card__header"><div><h3>Collected queue</h3><span>Newest first, with what the shared Cyclotron decided</span></div></div>
         {data.items.length ? (
           <ul className="news-desk-monitoring__queue">
-            {data.items.map((item) => <QueueItem key={`${item.sourceId}-${item.revision}`} item={item} ownId={data.scope.publicationId} demo={demo} />)}
+            {data.items.map((item) => <QueueItem key={`${item.monitorId ?? ""}-${item.sourceId}-${item.revision}`} item={item} ownId={data.scope.publicationId} demo={demo} />)}
           </ul>
         ) : <p>No items in the queue.</p>}
         {data.hiddenNotRelevant > 0 ? (
@@ -347,6 +345,14 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
           </p>
         ) : null}
       </article>
+
+      {data.otherMonitors?.length ? (
+        <details className="news-desk-delegation-note" data-monitoring-other-monitors>
+          <summary>Not routed to this site ({data.otherMonitors.length})</summary>
+          <p>These monitors collect items, but none of them is routed to this site, so their items are not shown here.</p>
+          <ul>{data.otherMonitors.map((id) => <li key={id} data-monitoring-other-monitor={id}>{id}</li>)}</ul>
+        </details>
+      ) : null}
     </>
   );
 }

package/components/monitoring-panel.tsx

@@ -1,7 +1,6 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import { useSearchParams } from "next/navigation";
 import {
   importMonitoringEmailCandidates,
   loadMonitoringEmailSubmission,
@@ -10,41 +9,12 @@ import {
 } from "../lib/monitoring-client";
 import { FIXTURE_ALL_PIPELINE_OVERVIEW, FIXTURE_MONITORING_OVERVIEW } from "../lib/monitoring-overview-fixture";
 import type { EmailReferenceImportItem, MonitoringEmailDetails, MonitoringResult } from "../lib/monitoring-overview";
-import { EmailSubmissions, MonitoringOverviewView, type MonitoringMode } from "./monitoring-overview-view";
+import { MonitoringOverviewView, type MonitoringMode } from "./monitoring-overview-view";
 
 const REFRESH_MILLISECONDS = 60_000;
 
-/** A receipt URL mounts only the single-submission reader, never the overview. */
-export function MonitoringPanel(props: { isAdmin: boolean; isDemo: boolean }) {
-  const searchParams = useSearchParams();
-  if (searchParams.has("receipt")) {
-    return <MonitoringEmailReceipt key={searchParams.get("receipt")} receiptId={searchParams.get("receipt") ?? ""} isDemo={props.isDemo} />;
-  }
-  return <MonitoringOverviewPanel {...props} />;
-}
-
-function MonitoringEmailReceipt({ receiptId, isDemo }: { receiptId: string; isDemo: boolean }) {
-  const [detail, setDetail] = useState<MonitoringEmailDetails | null>(null);
-  useEffect(() => {
-    if (!receiptId || isDemo) return;
-    let live = true;
-    void loadMonitoringEmailSubmission(receiptId).then(
-      (next) => { if (live) setDetail(next); },
-      () => { if (live) setDetail({ state: "unavailable" }); },
-    );
-    return () => { live = false; };
-  }, [receiptId, isDemo]);
-  if (!receiptId) return <p role="alert">A receipt is required to open a submission.</p>;
-  if (isDemo) return <p role="status">Single email submissions require an editor session.</p>;
-  return <div data-news-desk-admin-panel="monitoring">
-    {detail === null ? <p role="status">Loading email submission…</p> :
-      <EmailSubmissions items={"submission" in detail ? [detail.submission] : []} detail={detail}
-        onResolveArticleLink={resolveMonitoringEmailArticleLink} onImportCandidates={importMonitoringEmailCandidates} />}
-  </div>;
-}
-
-/** Overview refreshes apply only when no receipt was requested. */
-function MonitoringOverviewPanel({ isAdmin, isDemo }: { isAdmin: boolean; isDemo: boolean }) {
+/** Administration, Monitoring: loads the overview, refreshes it each minute, and lets an admin widen it to the whole pipeline. */
+export function MonitoringPanel({ isAdmin, isDemo }: { isAdmin: boolean; isDemo: boolean }) {
   const [mode, setMode] = useState<MonitoringMode>("publication");
   const [result, setResult] = useState<MonitoringResult | null>(null);
   const [emailDetail, setEmailDetail] = useState<MonitoringEmailDetails | null>(null);

package/lib/cli-login-discovery.ts

@@ -0,0 +1,78 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
+
+/**
+ * The public values `papyrus login <site>` needs, served at `/.well-known/papyrus-cli.json`.
+ * Every value is public (Cognito pool/client ids, hosted-UI domain, API URL). Nothing here is a
+ * secret, and the file only exists for a site whose web client registers the CLI callback.
+ */
+export const CLI_LOGIN_PATH = "/.well-known/papyrus-cli.json";
+
+export interface CliLoginDocument {
+  publication: string;
+  issuer: string;
+  client_id: string;
+  oauth_domain: string;
+  graphql_endpoint: string;
+  callback_uri: string;
+}
+
+export interface AmplifyOutputsForCliLogin {
+  auth?: {
+    user_pool_id?: string;
+    user_pool_client_id?: string;
+    aws_region?: string;
+    oauth?: { domain?: string; redirect_sign_in_uri?: string[] };
+  };
+  data?: { url?: string };
+}
+
+/**
+ * The CLI signs in through the site's existing public web app client, which every app-shell site
+ * registers with this callback (infra/amplify-app-shell/lib/site-config.ts). No separate client exists.
+ */
+export const CLI_CALLBACK_URI = "http://localhost:3001/";
+
+export function cliLoginDocumentFromOutputs(outputs: AmplifyOutputsForCliLogin | null, siteOrigin: string): CliLoginDocument | null {
+  const userPoolId = outputs?.auth?.user_pool_id;
+  const clientId = outputs?.auth?.user_pool_client_id;
+  const domain = outputs?.auth?.oauth?.domain;
+  const endpoint = outputs?.data?.url;
+  if (!userPoolId || !clientId || !domain || !endpoint || !endpoint.startsWith("https://")) return null;
+  // Only when the client really registers the callback; otherwise the sign-in could never complete.
+  if (!outputs?.auth?.oauth?.redirect_sign_in_uri?.includes(CLI_CALLBACK_URI)) return null;
+  const region = outputs?.auth?.aws_region ?? userPoolId.split("_")[0];
+  return {
+    publication: siteOrigin,
+    issuer: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,
+    client_id: clientId,
+    oauth_domain: `https://${domain}`,
+    graphql_endpoint: endpoint,
+    callback_uri: CLI_CALLBACK_URI,
+  };
+}
+
+export interface CliLoginDiscoveryOptions {
+  readOutputs?: () => AmplifyOutputsForCliLogin | null;
+  environment?: Record<string, string | undefined>;
+}
+
+export function handleCliLoginDiscovery(request: Pick<NextRequest, "nextUrl">, options: CliLoginDiscoveryOptions = {}): NextResponse {
+  let origin: string;
+  try {
+    origin = publicSiteOrigin(request, options.environment ?? process.env);
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
+  const outputs = (options.readOutputs ?? (() => readAmplifyOutputsFile() as AmplifyOutputsForCliLogin | null))();
+  const document = cliLoginDocumentFromOutputs(outputs, origin);
+  if (!document) {
+    return NextResponse.json(
+      { error: "cli_login_not_configured", message: "This site does not register the CLI sign-in callback." },
+      { status: 404, headers: { "cache-control": "public, max-age=60" } },
+    );
+  }
+  return NextResponse.json(document, { headers: { "cache-control": "public, max-age=300" } });
+}

package/lib/monitoring-client.ts

@@ -10,7 +10,7 @@ import type {
   MonitoringResult,
 } from "./monitoring-overview";
 
-type QueryField = "monitoringOverview" | "monitoringEmailSubmission" | "monitoringResolveEmailArticleLink" | "intakeEmailSubmissionReferences" | "monitoringQueueEmailReference";
+type QueryField = "monitoringOverview" | "monitoringEmailSubmission" | "monitoringResolveEmailArticleLink" | "intakeEmailSubmissionReferences";
 type GraphQLResult = { data?: Partial<Record<QueryField, unknown>>; errors?: { message?: string; errorType?: string }[] };
 
 async function query<T>(field: QueryField, queryText: string, variables: Record<string, string | number>): Promise<T | { error: "forbidden" } | { state: "unavailable" }> {
@@ -74,19 +74,10 @@ export async function importMonitoringEmailCandidates(
     } catch {
       return { imported: references.length, references, error: "The import response could not be read. Completed links are safe to retry." };
     }
-    if (!response?.ok || !Array.isArray(response.references) || response.references.length !== batch.length) {
+    if (!response?.ok || !Array.isArray(response.references)) {
       return { imported: references.length, references, error: "The import was not accepted. Check your editor access and retry." };
     }
     references.push(...response.references);
-    for (const [index, reference] of response.references.entries()) {
-      const queued = await query<{ queued: boolean }>("monitoringQueueEmailReference",
-        `mutation MonitoringQueueEmailReference($input: AWSJSON!) { monitoringQueueEmailReference(input: $input) }`,
-        { input: JSON.stringify({ receiptId, ...batch[index], referenceId: reference.id }) });
-      if (!("queued" in queued) || !queued.queued) {
-        return { imported: references.length, references,
-          error: "References were registered, but predictions could not be queued. Retry these selected links safely." };
-      }
-    }
   }
   return { imported: references.length, references };
 }

package/lib/monitoring-overview.ts

@@ -20,6 +20,7 @@ export type MonitoringRelevance = {
 };
 
 export type MonitoringItem = {
+  monitorId?: string;
   sourceId: string;
   revision: number;
   title: string;
@@ -128,6 +129,8 @@ export type MonitoringOverview = {
     historyComplete: boolean;
   } | null;
   items: MonitoringItem[];
+  /** Monitors that do not route to this site: named only, with no items. */
+  otherMonitors?: string[];
   emailSubmissions?: MonitoringEmailSummary[];
   hiddenNotRelevant: number;
 };

package/package.json

@@ -197,6 +197,7 @@
     "./lib/category-dashboard": "./lib/category-dashboard.ts",
     "./lib/category-repository": "./lib/category-repository.ts",
     "./lib/chrome-text": "./lib/chrome-text.ts",
+    "./lib/cli-login-discovery": "./lib/cli-login-discovery.ts",
     "./lib/console-chat-client": "./lib/console-chat-client.ts",
     "./lib/console-web-context": "./lib/console-web-context.ts",
     "./lib/content-actions-client": "./lib/content-actions-client.ts",
@@ -361,6 +362,7 @@
     "./renderers/pretext/rhythm-blog-presentation": "./renderers/pretext/rhythm-blog-presentation.tsx",
     "./renderers/pretext/rhythm-shell-style": "./renderers/pretext/rhythm-shell-style.ts",
     "./app/%5F_preview/[[...path]]/route": "./app/%5F_preview/[[...path]]/route.ts",
+    "./app/.well-known/papyrus-cli.json/route": "./app/.well-known/papyrus-cli.json/route.ts",
     "./app/[year]/[month]/[day]/[articleSlug]/page": "./app/[year]/[month]/[day]/[articleSlug]/page.tsx",
     "./app/[year]/[month]/[day]/page": "./app/[year]/[month]/[day]/page.tsx",
     "./app/[year]/[month]/[day]/page/[pageNumber]/page": "./app/[year]/[month]/[day]/page/[pageNumber]/page.tsx",
@@ -461,7 +463,7 @@
       "optional": true
     }
   },
-  "version": "5.41.5",
+  "version": "5.42.0-next.1",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.41.5",
+  "version": "5.42.0-next.1",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -11,6 +11,17 @@
         "dynamic": "\"force-dynamic\""
       }
     },
+    {
+      "file": "app/.well-known/papyrus-cli.json/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/[year]/[month]/[day]/[articleSlug]/page.tsx",
       "reader": true,

package/src/sync.mjs

@@ -37,6 +37,15 @@ function shimFor(route) {
   return lines.join("\n") + "\n";
 }
 
+/** Anchored .gitignore line for a literal path; escapes gitignore metacharacters (Next dynamic routes use [ ]). */
+export function gitignoreEntry(rel) {
+  const escaped = rel
+    .replace(/[\\[\]*?]/g, "\\$&")
+    .replace(/^[#!]/, "\\$&")
+    .replace(/ +$/, (m) => m.replace(/ /g, "\\ "));
+  return "/" + escaped;
+}
+
 export function middlewareShim(manifest) {
   const matcher = manifest.middleware.matcher ?? '["/((?!_next/static|_next/image|favicon.ico|icon).*)"]';
   return [
@@ -101,9 +110,9 @@ export function sync({ root = process.cwd(), log = console.log, manifest: manife
   // Keep generated shims out of git.
   const giFile = path.join(root, ".gitignore");
   const gi = fs.existsSync(giFile) ? fs.readFileSync(giFile, "utf8") : "";
-  const block = [GITIGNORE_BEGIN, ...generated.map((g) => "/" + g), "/.papyrus/", GITIGNORE_END].join("\n");
+  const block = [GITIGNORE_BEGIN, ...generated.map(gitignoreEntry), "/.papyrus/", GITIGNORE_END].join("\n");
   const re = new RegExp(`${GITIGNORE_BEGIN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${GITIGNORE_END}`);
-  fs.writeFileSync(giFile, re.test(gi) ? gi.replace(re, block) : `${gi}${gi.endsWith("\n") || !gi ? "" : "\n"}${block}\n`);
+  fs.writeFileSync(giFile, re.test(gi) ? gi.replace(re, () => block) : `${gi}${gi.endsWith("\n") || !gi ? "" : "\n"}${block}\n`);
 
   log(`papyrus-app sync: ${generated.length} shim(s) written, ${skipped.length} site-owned file(s) kept (${PKG}@${manifest.version})${readerBasePath ? `, reader mounted at ${readerBasePath}` : ""}`);
   for (const rel of skipped) log(`  site-owned: ${rel}`);

package/src/with-papyrus.d.mts

@@ -9,3 +9,4 @@ export function staticGenerationSettings(): {
   staticGenerationMaxConcurrency: number;
   staticGenerationRetryCount: number;
 };
+export function redirectChatticusZod(resource: { request: string; context?: string }): void;

package/src/with-papyrus.mjs

@@ -56,6 +56,18 @@ export function mergeTranspilePackages(existing = []) {
   return [...new Set([...existing, ...DEFAULT_TRANSPILE_PACKAGES])];
 }
 
+/**
+ * chatticus's prebuilt chat runtime is written against zod 4 (`z.looseObject`) and imports bare `zod`.
+ * Publication repos pin zod 3.25 through a root `overrides` entry (Amplify constructs need it), which
+ * also flattens chatticus's own zod 4 dependency, so the bundle then fails to build. zod 3.25 ships the
+ * zod 4 API at `zod/v4`; point only chatticus's `zod` imports there, leaving every other zod import alone.
+ */
+export const CHATTICUS_PACKAGE_PATH = /[\\/]node_modules[\\/]chatticus[\\/]/;
+
+export function redirectChatticusZod(resource) {
+  if (resource.request === "zod" && CHATTICUS_PACKAGE_PATH.test(resource.context ?? "")) resource.request = "zod/v4";
+}
+
 export const RUNTIME_TRACED_FILES = ["./corpora/**/*", "./amplify_outputs.json"];
 
 export function mergeOutputFileTracingIncludes(existing = {}) {
@@ -99,6 +111,10 @@ export function withPapyrus(nextConfig = {}, options = {}) {
     },
     webpack(config, context) {
       config.resolve.alias = { ...config.resolve.alias, ...aliases };
+      config.plugins = [
+        ...(config.plugins ?? []),
+        new context.webpack.NormalModuleReplacementPlugin(/^zod$/, redirectChatticusZod),
+      ];
       return typeof nextConfig.webpack === "function" ? nextConfig.webpack(config, context) : config;
     },
   };