@anthusai/papyrus 5.42.1 → 5.43.0-next.10

package/lib/monitoring-overview.ts

@@ -37,9 +37,39 @@ export type MonitoringEmailSummary = {
   receiptId: string; observedAt: string | null; status: string; subject: string | null;
   envelopeSender: string | null; headerFrom: string | null; warnings: string[];
   verdicts: Record<string, string>; linkCount: number; processedCount: number; unresolvedLinkCount: number;
-  reviewRequired: boolean; errorCode: string | null;
+  reviewRequired: boolean; errorCode: string | null; quarantine: EmailQuarantine | null;
 };
 
+/** Where a held email submission stands. `null` means it never needed review. */
+export type EmailQuarantineState =
+  | "quarantined" | "release_requested" | "released" | "discard_requested" | "discarded"
+  | "expired" | "decision_failed" | "release_failed";
+export type EmailQuarantine = {
+  state: EmailQuarantineState;
+  decision: { action: "accept" | "reject"; by: string; at: string | null; reason: string } | null;
+  failure: string | null;
+};
+export type EmailDecisionResult =
+  | { ok: true; already: boolean; quarantine: EmailQuarantine }
+  | { error: "forbidden" | "bad_request" | "already_decided" | "not_quarantined" | "expired"; quarantine?: EmailQuarantine }
+  | { state: "unavailable" | "not_configured" };
+
+export const QUARANTINE_LABELS: Record<EmailQuarantineState, string> = {
+  quarantined: "Held for review",
+  release_requested: "Accepted, being queued",
+  released: "Accepted",
+  discard_requested: "Rejected, being closed",
+  discarded: "Rejected",
+  expired: "Expired",
+  decision_failed: "Decision could not be applied",
+  release_failed: "Accepted, retrying",
+};
+
+/** Links and import are available only once a message is accepted (or never needed review). */
+export function emailSubmissionAccepted(quarantine: EmailQuarantine | null): boolean {
+  return quarantine === null || quarantine.state === "released";
+}
+
 export type MonitoringEmailDetails = {
   submission: MonitoringEmailSummary & { corpusId: string | null }; safeBodyText: string;
   candidateLinks: { url: string; title: string; resolutionStatus?: "unresolved" }[]; sourceMaterialIsUntrusted: true;
@@ -47,6 +77,8 @@ export type MonitoringEmailDetails = {
 
 export type MonitoringEmailArticleResolution = {
   url: string; title: string; resolved: true;
+  /** Present when the original link could not be followed and the destination was found by searching the headline. */
+  foundVia?: "search"; search?: { query: string; matchScore: number; provider: string; matchedTitle?: string };
 } | { error: "forbidden" | "bad_request" | "not_resolvable" | "resolution_failed"; reason?: string } | { state: "unavailable" };
 
 export type EmailReferenceImportItem = { candidateIndex: number; source_uri: string };
@@ -106,13 +138,23 @@ export type MonitoringFeed = {
   id: string;
   sourceUrl: string | null;
   intervalSeconds: number | null;
-  limit: number | null;
   enabled: boolean;
   lastStatus: string | null;
   lastFinishedAt: string | null;
   nextDueAt: string | null;
 };
 
+/** The lists on the page that are paged. Page sizes are the server's; there is no total. */
+export type MonitoringListName = "runs" | "routerRuns" | "items" | "emailSubmissions";
+export type MonitoringCursors = Partial<Record<MonitoringListName, string | null>>;
+export type MonitoringListRows = {
+  runs: MonitoringRun; routerRuns: MonitoringRouterRun; items: MonitoringItem; emailSubmissions: MonitoringEmailSummary;
+};
+/** One more page of one list. `cursor` is null when the list has ended. */
+export type MonitoringPage<L extends MonitoringListName = MonitoringListName> =
+  | { list: L; rows: MonitoringListRows[L][]; cursor: string | null; hiddenNotRelevant?: number }
+  | { error: "forbidden" | "bad_request" } | { state: "unavailable" | "not_configured" };
+
 export type MonitoringOverview = {
   state: "ready" | "empty";
   asOf: string;
@@ -121,7 +163,7 @@ export type MonitoringOverview = {
   feeds: MonitoringFeed[];
   runs: MonitoringRun[];
   routerRuns: MonitoringRouterRun[];
-  router: { mode: string; feedback: boolean; enabled: boolean; maxItemsPerRun: number | null } | null;
+  router: { mode: string; feedback: boolean; enabled: boolean } | null;
   usage: {
     day: string;
     decisionsToday: number;
@@ -133,6 +175,8 @@ export type MonitoringOverview = {
   otherMonitors?: string[];
   emailSubmissions?: MonitoringEmailSummary[];
   hiddenNotRelevant: number;
+  /** Where each list continues; null or missing when it has no more rows. */
+  cursors?: MonitoringCursors;
 };
 
 export type MonitoringResult =

package/lib/monitoring-paging.ts

@@ -0,0 +1,58 @@
+/** Merging loaded pages into the Monitoring lists. Kept free of other imports so the panel's tests can load it alone. */
+import type {
+  MonitoringCursors,
+  MonitoringItem,
+  MonitoringListName,
+  MonitoringListRows,
+  MonitoringOverview,
+} from "./monitoring-overview";
+
+/** Rows the editor has loaded beyond the first page of each list, and where each list continues. */
+export type MonitoringLoadedPages = Partial<{ [L in MonitoringListName]: { rows: MonitoringListRows[L][]; cursor: string | null } }>;
+
+const ROW_KEYS: { [L in MonitoringListName]: (row: MonitoringListRows[L]) => string } = {
+  runs: (row) => `${row.runId}`,
+  routerRuns: (row) => `${row.runId}`,
+  items: (row) => `${row.monitorId ?? ""}|${row.sourceId}`,
+  emailSubmissions: (row) => row.receiptId,
+};
+
+/**
+ * The first page followed by loaded pages, with a row seen twice kept once. The refresh re-reads the first page, so
+ * a row that moved onto it from a later page must not be listed again; for items the highest revision wins.
+ */
+export function mergeListPages<L extends MonitoringListName>(list: L, first: MonitoringListRows[L][], loaded: MonitoringListRows[L][]): MonitoringListRows[L][] {
+  const keyOf = ROW_KEYS[list] as (row: MonitoringListRows[L]) => string;
+  const seen = new Map<string, number>();
+  const merged: MonitoringListRows[L][] = [];
+  for (const row of [...first, ...loaded]) {
+    const key = keyOf(row);
+    const at = seen.get(key);
+    if (at === undefined) {
+      seen.set(key, merged.length);
+      merged.push(row);
+    } else if (list === "items" && (row as MonitoringItem).revision > (merged[at] as MonitoringItem).revision) {
+      merged[at] = row;
+    }
+  }
+  return merged;
+}
+
+/**
+ * What the page shows: the refreshed first page of every list plus whatever the editor loaded, with each list's
+ * cursor. With `held` the email list is replaced by the held-for-review list (its own pages).
+ */
+export function withLoadedPages(overview: MonitoringOverview, loaded: MonitoringLoadedPages, held: MonitoringLoadedPages["emailSubmissions"] | null): MonitoringOverview {
+  const cursors: MonitoringCursors = {};
+  const lists: Partial<Record<MonitoringListName, unknown[]>> = {};
+  for (const list of ["runs", "routerRuns", "items", "emailSubmissions"] as const) {
+    const extra = loaded[list];
+    lists[list] = mergeListPages(list, (overview[list] ?? []) as never[], (extra?.rows ?? []) as never[]) as unknown[];
+    cursors[list] = extra ? extra.cursor : overview.cursors?.[list] ?? null;
+  }
+  if (held) {
+    lists.emailSubmissions = held.rows;
+    cursors.emailSubmissions = held.cursor;
+  }
+  return { ...overview, ...(lists as Pick<MonitoringOverview, MonitoringListName>), cursors };
+}

package/lib/newsroom-chat-client.ts

@@ -0,0 +1,30 @@
+export type NewsroomChatFetch = typeof fetch;
+
+export function createNewsroomChatFetch(
+  accessToken: () => Promise<string | null>,
+  fetcher: NewsroomChatFetch,
+): NewsroomChatFetch {
+  return async (input, init) => {
+    if (typeof input !== "string" || (!input.startsWith("/api/newsroom/chat/") && !input.startsWith("/api/auth/prospectus/"))) {
+      throw new Error("Newsroom credentials can only be sent to this site's chat identity routes.");
+    }
+    const token = await accessToken();
+    if (!token) throw new Error("sign_in_required");
+    const headers = new Headers(init?.headers);
+    headers.set("authorization", `Bearer ${token}`);
+    return fetcher(input, { ...init, headers, credentials: "same-origin", cache: "no-store" });
+  };
+}
+
+export const newsroomChatFetch: NewsroomChatFetch = createNewsroomChatFetch(async () => {
+  const { fetchAuthSession } = await import("aws-amplify/auth");
+  const session = await fetchAuthSession();
+  return session.tokens?.accessToken?.toString() ?? null;
+}, (input, init) => globalThis.fetch(input, init));
+
+export async function connectNewsroomChat(returnPath: string, fetcher: NewsroomChatFetch = newsroomChatFetch): Promise<string> {
+  const response = await fetcher(`/api/auth/prospectus/sign-in?newsroomChat=true&returnTo=${encodeURIComponent(returnPath)}`, { method: "POST" });
+  const body = await response.json() as { authorizationUrl?: string; message?: string };
+  if (!response.ok || !body.authorizationUrl) throw new Error(body.message ?? "Private chat could not connect to your publishing account.");
+  return body.authorizationUrl;
+}

package/lib/newsroom-chat-identity.ts

@@ -0,0 +1,40 @@
+import { CognitoJwtVerifier } from "aws-jwt-verify";
+import type { JwksCache } from "aws-jwt-verify/jwk";
+import type { NextRequest } from "next/server";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+import { STAFF_GROUPS } from "./staff-groups";
+
+export type NewsroomChatIdentity = { subject: string; issuer: string; clientId: string; expiresAt: number };
+export type NewsroomChatIdentityResolver = (request: NextRequest) => Promise<NewsroomChatIdentity | null>;
+
+export function newsroomChatIdentityResolver(
+  auth: { user_pool_id: string; user_pool_client_id: string },
+  jwksCache?: JwksCache,
+): NewsroomChatIdentityResolver {
+  const verifier = CognitoJwtVerifier.create({
+    userPoolId: auth.user_pool_id,
+    clientId: auth.user_pool_client_id,
+    tokenUse: "access",
+    groups: [...STAFF_GROUPS],
+  }, jwksCache ? { jwksCache } : undefined);
+  return async (request) => {
+    const token = request.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1];
+    if (!token) return null;
+    try {
+      const claims = await verifier.verify(token);
+      return { subject: claims.sub, issuer: claims.iss, clientId: auth.user_pool_client_id, expiresAt: claims.exp };
+    } catch {
+      return null;
+    }
+  };
+}
+
+let configuredResolver: { key: string; resolve: NewsroomChatIdentityResolver } | undefined;
+
+export async function resolveNewsroomChatIdentity(request: NextRequest): Promise<NewsroomChatIdentity | null> {
+  const auth = readAmplifyOutputsFile()?.auth as { user_pool_id?: string; user_pool_client_id?: string } | undefined;
+  if (!auth?.user_pool_id || !auth.user_pool_client_id) throw new Error("Newsroom identity configuration is unavailable");
+  const key = `${auth.user_pool_id}:${auth.user_pool_client_id}`;
+  if (configuredResolver?.key !== key) configuredResolver = { key, resolve: newsroomChatIdentityResolver({ user_pool_id: auth.user_pool_id, user_pool_client_id: auth.user_pool_client_id }) };
+  return configuredResolver.resolve(request);
+}

package/lib/newsroom-organizer-nav.ts

@@ -11,6 +11,7 @@ export const ORGANIZER_NAV_GROUPS: readonly { title: string; items: readonly Org
     { key: "overview", label: "Overview", description: "See notifications and work needing attention.", path: "/newsroom", primary: true },
     { key: "articles", label: getContentItemName().plural, description: `Follow ${contentItemPluralLowercase} across their stages and open one to write or revise it.`, path: `/newsroom/${contentItemBoardPathSegment()}`, alsoActiveOnPaths: ["/newsroom/articles"], primary: true },
     { key: "assignments", label: "Assignments", description: "Follow research and reporting work across its statuses and claim it.", path: "/newsroom/assignments" },
+    { key: "drafts", label: "Drafts", description: "Read the story drafts that AI proposes, then accept or reject them.", path: "/newsroom/administration/proposals" },
     { key: "messages", label: "Messages", description: "Read and reply to newsroom conversations.", path: "/newsroom/messages", primary: true },
   ] },
   { title: "Research & knowledge", items: [

package/lib/papyrus-hosted-chat.ts

@@ -1,51 +1,36 @@
+import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "./newsroom-chat-identity";
 import { createHash } from "node:crypto";
 import type { EmbeddedChatAppDependencies } from "chatticus/chat-server";
 import type { NextRequest } from "next/server";
-import {
-  ProspectusAccountsError,
-  authorizeSignedInPersonForAccount,
-} from "./prospectus-site-identity";
-import {
-  resolveProspectusSignInRuntime,
-  signedInProspectusSession,
-  type ProspectusSignInRuntime,
-} from "./prospectus-session";
-import { prospectusSiteProduct, publishingAccountsForSite } from "./prospectus-publication-access";
 import { publicSiteOrigin } from "./site-origin-value";
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
 
 export interface PapyrusChatScope {
-  siteProduct: string;
-  accountId: string;
-  personId: string;
   tenantId: string;
   editorId: string;
 }
 
 export interface PapyrusHostedChatOptions {
-  resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
+  resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
   resolvePrivateDependencies?: () => Promise<EmbeddedChatAppDependencies | null>;
   privateChatEnabled?: boolean;
-  siteProduct?: string | null;
   environment?: Record<string, string | undefined>;
   nowInSeconds?: () => number;
 }
 
-function siteAndAccountKey(siteProduct: string, accountId: string): string {
-  return createHash("sha256").update(JSON.stringify([siteProduct, accountId])).digest("hex");
+/** A new namespace: never aliases Account-scoped or legacy transcripts. */
+export function derivePapyrusChatScope(publicationNamespace: string, issuer: string, subject: string): PapyrusChatScope {
+  const tenantHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer])).digest("hex");
+  const editorHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer, subject])).digest("hex");
+  return { tenantId: `papyrus-newsroom-v1-${tenantHash.slice(0, 40)}`, editorId: `papyrus-newsroom-editor-v1-${editorHash.slice(0, 40)}` };
 }
 
-export function derivePapyrusChatScope(siteProduct: string, accountId: string, personId: string): PapyrusChatScope {
-  const tenantHash = siteAndAccountKey(siteProduct, accountId);
-  const editorHash = createHash("sha256").update(JSON.stringify([siteProduct, accountId, personId])).digest("hex");
-  return {
-    siteProduct,
-    personId,
-    accountId,
-    tenantId: `papyrus-${tenantHash.slice(0, 40)}`,
-    editorId: `papyrus-editor-${editorHash.slice(0, 40)}`,
-  };
+/** Existing server storage resources bind the publication, independently of request hosts or claims. */
+function publicationNamespace(environment: Record<string, string | undefined>, clientId: string): string | null {
+  const bucket = environment.PAPYRUS_CHAT_SESSION_BUCKET?.trim();
+  const table = environment.PAPYRUS_CHAT_MESSAGING_TABLE?.trim();
+  return bucket && table ? JSON.stringify([bucket, table, clientId]) : null;
 }
 
 type ResolvedPapyrusPrincipal = {
@@ -59,60 +44,24 @@ type ResolvedPapyrusPrincipal = {
 
 async function principalForRequest(
   request: NextRequest,
-  operation: "console:read" | "console:write",
   options: PapyrusHostedChatOptions,
-): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number }> {
-  const environment = options.environment ?? process.env;
-  const siteProduct = options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct(environment);
-  if (!siteProduct) return { principal: null, status: 503 };
-
-  let runtime: ProspectusSignInRuntime | null;
+): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; expiresAt?: number }> {
+  let identity;
   try {
-    runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(publicSiteOrigin(request, environment));
+    identity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
   } catch {
     return { principal: null, status: 503 };
   }
-  if (!runtime) return { principal: null, status: 503 };
-
-  const nowInSeconds = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
-  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
-  if (!session || !session.selectedAccountId || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
-    return { principal: null, status: 401 };
-  }
-
-  try {
-    const directory = await runtime.accounts.accountDirectory(session.accessToken);
-    if (directory.person?.id !== session.personId) return { principal: null, status: 401 };
-    if (!publishingAccountsForSite(directory.accounts, siteProduct).some((account) => account.accountId === session.selectedAccountId)) {
-      return { principal: null, status: 403 };
-    }
-    const authorization = await authorizeSignedInPersonForAccount(
-      runtime.accounts,
-      session.accessToken,
-      session.selectedAccountId,
-      operation,
-    );
-    if (authorization.personId !== session.personId || authorization.accountId !== session.selectedAccountId || authorization.operation !== operation) {
-      return { principal: null, status: 403 };
-    }
-    const scope = derivePapyrusChatScope(siteProduct, session.selectedAccountId, session.personId);
-    return {
-      principal: {
-        kind: "user",
-        tenantId: scope.tenantId,
-        userId: scope.editorId,
-        workerId: null,
-        organizationStatus: "enabled",
-        role: "member",
-      },
-      status: 200,
-    };
-  } catch (error) {
-    if (error instanceof ProspectusAccountsError && (error.status === 401 || error.status === 403)) {
-      return { principal: null, status: error.status };
-    }
-    return { principal: null, status: 503 };
-  }
+  const now = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
+  if (!identity || !identity.subject || !identity.issuer || !identity.clientId || !Number.isFinite(identity.expiresAt) || identity.expiresAt <= now) return { principal: null, status: 401 };
+  const namespace = publicationNamespace(options.environment ?? process.env, identity.clientId);
+  if (!namespace) return { principal: null, status: 503 };
+  const scope = derivePapyrusChatScope(namespace, identity.issuer, identity.subject);
+  return {
+    principal: { kind: "user", tenantId: scope.tenantId, userId: scope.editorId, workerId: null, organizationStatus: "enabled", role: "member" },
+    status: 200,
+    expiresAt: identity.expiresAt,
+  };
 }
 
 function jsonFailure(status: number, error: string): Response {
@@ -162,6 +111,9 @@ export async function handlePapyrusHostedChatRequest(
   const privateChatEnabled = options.privateChatEnabled ?? environment.PAPYRUS_PRIVATE_CHAT_ENABLED === "true";
   if (!privateChatEnabled) return jsonFailure(404, "private_chat_disabled");
 
+  const authorization = await principalForRequest(request, options);
+  if (!authorization.principal) return jsonFailure(authorization.status, (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
+
   let dependencies: EmbeddedChatAppDependencies | null;
   try {
     if (options.resolvePrivateDependencies) {
@@ -178,9 +130,6 @@ export async function handlePapyrusHostedChatRequest(
   }
   if (!dependencies) return jsonFailure(503, "private_chat_storage_unavailable");
 
-  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
-  if (!authorization.principal) return jsonFailure(authorization.status, authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable");
-
   const headers = new Headers({ accept: request.headers.get("accept") ?? "application/json" });
   let body: string | undefined;
   if (request.method === "POST" && isMessageRoute) {
@@ -213,5 +162,38 @@ export async function handlePapyrusHostedChatRequest(
     ...dependencies,
     resolvePrincipal: async () => authorization.principal,
   });
-  return app.fetch(forwarded);
+  const response = await app.fetch(forwarded);
+  if (path[0] !== "turns" || path[2] !== "stream" || !response.ok || !response.body) return response;
+  const remaining = (authorization.expiresAt! - (options.nowInSeconds?.() ?? Date.now() / 1000)) * 1000;
+  return expireChatStream(response, remaining);
+}
+
+/** End an established stream at JWT expiry; reconnect must pass current authorization again. */
+export function expireChatStream(response: Response, remainingMilliseconds: number): Response {
+  if (!response.body) return response;
+  const reader = response.body.getReader();
+  let closed = false;
+  let timer: ReturnType<typeof setTimeout>;
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      timer = setTimeout(() => {
+        if (closed) return;
+        closed = true;
+        controller.close();
+        void reader.cancel().catch(() => {});
+      }, Math.max(0, Math.min(remainingMilliseconds, 2_147_483_647)));
+    },
+    async pull(controller) {
+      try {
+        const next = await reader.read();
+        if (closed) return;
+        if (next.done) { closed = true; clearTimeout(timer); controller.close(); }
+        else controller.enqueue(next.value);
+      } catch (error) {
+        if (!closed) { closed = true; clearTimeout(timer); controller.error(error); }
+      }
+    },
+    async cancel(reason) { closed = true; clearTimeout(timer); await reader.cancel(reason); },
+  });
+  return new Response(body, { status: response.status, headers: response.headers });
 }

package/lib/papyrus-private-chat-client.ts

@@ -1,3 +1,4 @@
+import { newsroomChatFetch } from "./newsroom-chat-client";
 export type PapyrusPrivateChatChannel = {
   channel_id: string;
   participants: Array<{ kind: string; actor_id: string }>;
@@ -30,6 +31,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   });
   const payload = await response.json().catch(() => null) as Record<string, unknown> | null;
   if (!response.ok) {
+    if (response.status === 401) throw new Error("sign_in_required");
+    if (response.status === 403) throw new Error("chat_account_access_denied");
     const error = typeof payload?.error === "string" ? payload.error
       : typeof payload?.detail === "string" ? payload.detail
         : `Private chat request failed (${response.status}).`;
@@ -39,8 +42,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   return payload as T;
 }
 
-/** Open the current editor's server-derived private channel using the signed same-origin session cookie. */
-export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = globalThis.fetch): Promise<PapyrusPrivateChatChannel> {
+/** Open the current editor's server-derived private channel using the verified publication-local newsroom identity. */
+export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = newsroomChatFetch): Promise<PapyrusPrivateChatChannel> {
   const result = await requestJson<PapyrusPrivateChatChannel>("private-channel", { method: "POST" }, fetcher);
   if (!result.channel_id?.trim() || !Array.isArray(result.participants)) {
     throw new Error("Private chat returned an invalid channel.");
@@ -51,7 +54,7 @@ export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch =
 /** Read only the private channel returned by the host's authenticated open request. */
 export async function listPapyrusPrivateChatMessages(
   channelId: string,
-  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
 ): Promise<PapyrusPrivateChatMessage[]> {
   if (!channelId.trim()) throw new Error("A private chat channel is required.");
   const result = await requestJson<{ messages?: unknown }>(`channels/${encodeURIComponent(channelId)}/messages`, { method: "GET" }, fetcher);
@@ -64,7 +67,7 @@ export async function sendPapyrusPrivateChatMessage(
   channelId: string,
   body: string,
   idempotencyKey: string,
-  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
 ): Promise<PapyrusPrivateChatSendResult> {
   if (!channelId.trim() || !body.trim() || !idempotencyKey.trim()) {
     throw new Error("A channel, message and idempotency key are required.");

package/lib/proposals-admin.ts

@@ -0,0 +1,115 @@
+/**
+ * The data side of the Administration "Proposals" panel, which every site has (the queue is core; the reader-steering
+ * plugin only adds reader votes). Rows come from the staff-readable `Proposal` model; an editor moves one with the
+ * `transitionProposal` mutation. Pure functions, no network, so the rules the panel shows can be tested.
+ */
+
+export type ProposalRow = {
+  id: string;
+  kind: string;
+  title: string;
+  summary?: string | null;
+  body?: string | null;
+  state: string;
+  proposer?: string | null;
+  held?: boolean | null;
+  pinned?: boolean | null;
+  createdAt: string;
+};
+
+export type ProposalFilter = "open" | "draft" | "in_steering" | "editor_review" | "decided";
+/** A button: the states it moves through in order (one call each) or, for pin and hold, the `editProposal` action it runs. */
+export type ProposalMove = { label: string; path?: string[]; edit?: "pin" | "unpin" | "hold" | "release"; state?: string };
+
+const STATE_LABELS: Record<string, string> = {
+  draft: "Draft",
+  in_steering: "In steering",
+  editor_review: "Editor review",
+  approved: "Approved",
+  declined: "Declined",
+  overridden_by_editor: "Decided by an editor",
+};
+
+const KIND_LABELS: Record<string, string> = {
+  story_draft: "Story draft",
+  new_concept: "New concept",
+  rename: "Rename",
+  merge: "Merge",
+  split: "Split",
+  new_column: "New column",
+  element_symbol: "Element symbol",
+};
+
+const DECIDED = new Set(["approved", "declined", "overridden_by_editor"]);
+
+/**
+ * What an editor may do next; the function enforces the same table (overriding the community needs a reason and is not offered
+ * here). On a site without reader-steering nobody steers, so a draft goes straight to editor review (two moves) and the
+ * "in steering" wording never shows.
+ */
+function stateMoves(state: string, readers: boolean): ProposalMove[] {
+  if (state === "draft") {
+    return readers
+      ? [{ label: "Send to steering", path: ["in_steering"] }, { label: "Decline", path: ["declined"] }]
+      : [{ label: "Move to editor review", path: ["in_steering", "editor_review"] }, { label: "Decline", path: ["declined"] }];
+  }
+  if (state === "in_steering") return [{ label: "Move to editor review", path: ["editor_review"] }];
+  if (state === "editor_review") return [{ label: "Approve", path: ["approved"] }, { label: "Decline", path: ["declined"] }];
+  return [];
+}
+
+export const PROPOSAL_FIELDS = "id kind title summary body state proposer held pinned createdAt";
+export const LIST_PROPOSALS = `query Proposals($nextToken: String) { listProposals(limit: 500, nextToken: $nextToken) { items { ${PROPOSAL_FIELDS} } nextToken } }`;
+export const EDIT_PROPOSAL = `mutation Edit($proposalId: String!, $action: String!) { editProposal(proposalId: $proposalId, action: $action) { status id error message } }`;
+export const TRANSITION_PROPOSAL = `mutation Move($proposalId: String!, $state: String!, $reason: String) { transitionProposal(proposalId: $proposalId, state: $state, reason: $reason) { status id error message } }`;
+
+export function stateLabel(state: string, readers = true): string {
+  if (!readers && state === "in_steering") return "Waiting for review";
+  return STATE_LABELS[state] ?? state;
+}
+
+export function kindLabel(kind: string): string {
+  return KIND_LABELS[kind] ?? kind;
+}
+
+/** AI-filed proposals say "AI"; a reader's proposal says "Reader" (their id is never shown). */
+export function proposerLabel(proposer: string | null | undefined): string {
+  return proposer === "ai" ? "AI" : proposer ? "Reader" : "Unknown";
+}
+
+export function proposalMoves(row: Pick<ProposalRow, "state" | "held" | "pinned">, readers = true): ProposalMove[] {
+  const edits: ProposalMove[] = [
+    { label: row.pinned ? "Unpin" : "Pin", edit: row.pinned ? "unpin" : "pin" },
+    ...(DECIDED.has(row.state) && !row.held ? [] : [{ label: row.held ? "Release hold" : "Hold", edit: (row.held ? "release" : "hold") as "release" | "hold" }]),
+  ];
+  // A proposal on hold refuses every state change until it is released.
+  return [...(row.held ? [] : stateMoves(row.state, readers)), ...edits];
+}
+
+export function sortProposals(rows: ProposalRow[]): ProposalRow[] {
+  return [...rows].sort((left, right) => right.createdAt.localeCompare(left.createdAt) || right.id.localeCompare(left.id));
+}
+
+export function filterProposals(rows: ProposalRow[], filter: ProposalFilter): ProposalRow[] {
+  if (filter === "open") return rows.filter((row) => !DECIDED.has(row.state));
+  if (filter === "decided") return rows.filter((row) => DECIDED.has(row.state));
+  return rows.filter((row) => row.state === filter);
+}
+
+export function countProposals(rows: ProposalRow[]): Record<ProposalFilter, number> {
+  return {
+    open: filterProposals(rows, "open").length,
+    draft: filterProposals(rows, "draft").length,
+    in_steering: filterProposals(rows, "in_steering").length,
+    editor_review: filterProposals(rows, "editor_review").length,
+    decided: filterProposals(rows, "decided").length,
+  };
+}
+
+export type ProposalReceipt = { status?: string | null; id?: string | null; error?: string | null; message?: string | null };
+
+export function proposalReceiptMessage(receipt: ProposalReceipt | null | undefined): string {
+  if (!receipt) return "The action did not answer.";
+  if (receipt.status === "ok") return "Done.";
+  return receipt.message || receipt.error || "The action was refused.";
+}

package/lib/proposals-client.ts

@@ -0,0 +1,29 @@
+"use client";
+
+import { generateClient } from "aws-amplify/data";
+import { EDIT_PROPOSAL, TRANSITION_PROPOSAL, type ProposalMove, type ProposalReceipt } from "./proposals-admin";
+
+type GraphResult = { data?: Record<string, ProposalReceipt | null>; errors?: { message?: string }[] };
+
+async function run(query: string, field: string, variables: Record<string, string | undefined>): Promise<ProposalReceipt> {
+  const client = generateClient({ authMode: "userPool" });
+  const result = (await client.graphql({ query, variables })) as GraphResult;
+  if (result.errors?.length) return { status: "refused", message: result.errors[0]?.message ?? "The action failed." };
+  return result.data?.[field] ?? { status: "refused", message: "The action did not answer." };
+}
+
+/** Moves a proposal through `path`, one `transitionProposal` call per state, stopping at the first refusal. */
+export async function transitionProposalPath(proposalId: string, path: readonly string[], reason = ""): Promise<ProposalReceipt> {
+  let receipt: ProposalReceipt = { status: "refused", message: "Nothing to do." };
+  for (const state of path) {
+    receipt = await run(TRANSITION_PROPOSAL, "transitionProposal", { proposalId, state, ...(reason ? { reason } : {}) });
+    if (receipt.status !== "ok") break;
+  }
+  return receipt;
+}
+
+/** One button of the Proposals panel: a path of states, or `editProposal` for pin and hold. */
+export async function performProposalMove(proposalId: string, move: ProposalMove, reason: string): Promise<ProposalReceipt> {
+  if (move.edit) return run(EDIT_PROPOSAL, "editProposal", { proposalId, action: move.edit });
+  return transitionProposalPath(proposalId, move.path ?? [], reason);
+}

package/lib/prospectus-session.ts

@@ -33,6 +33,7 @@ const MINIMUM_SEALING_SECRET_LENGTH = 32;
 
 export interface PendingProspectusSignInCookie extends PendingProspectusSignIn {
   returnPath: string;
+  newsroomSubject?: string;
 }
 
 export interface ProspectusSignedInSession {
@@ -40,6 +41,7 @@ export interface ProspectusSignedInSession {
   accessToken: string;
   accessTokenExpiresAt: number;
   selectedAccountId?: string;
+  newsroomSubject?: string;
   siteSubject?: string;
 }