@anthusai/papyrus 5.42.1 → 5.43.0-next.2

package/lib/newsroom-chat-identity.ts

@@ -0,0 +1,39 @@
+import { CognitoJwtVerifier } from "aws-jwt-verify";
+import type { JwksCache } from "aws-jwt-verify/jwk";
+import type { NextRequest } from "next/server";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+
+export type NewsroomChatIdentity = { subject: string; issuer: string; clientId: string; expiresAt: number };
+export type NewsroomChatIdentityResolver = (request: NextRequest) => Promise<NewsroomChatIdentity | null>;
+
+export function newsroomChatIdentityResolver(
+  auth: { user_pool_id: string; user_pool_client_id: string },
+  jwksCache?: JwksCache,
+): NewsroomChatIdentityResolver {
+  const verifier = CognitoJwtVerifier.create({
+    userPoolId: auth.user_pool_id,
+    clientId: auth.user_pool_client_id,
+    tokenUse: "access",
+    groups: ["editor", "admin"],
+  }, jwksCache ? { jwksCache } : undefined);
+  return async (request) => {
+    const token = request.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1];
+    if (!token) return null;
+    try {
+      const claims = await verifier.verify(token);
+      return { subject: claims.sub, issuer: claims.iss, clientId: auth.user_pool_client_id, expiresAt: claims.exp };
+    } catch {
+      return null;
+    }
+  };
+}
+
+let configuredResolver: { key: string; resolve: NewsroomChatIdentityResolver } | undefined;
+
+export async function resolveNewsroomChatIdentity(request: NextRequest): Promise<NewsroomChatIdentity | null> {
+  const auth = readAmplifyOutputsFile()?.auth as { user_pool_id?: string; user_pool_client_id?: string } | undefined;
+  if (!auth?.user_pool_id || !auth.user_pool_client_id) throw new Error("Newsroom identity configuration is unavailable");
+  const key = `${auth.user_pool_id}:${auth.user_pool_client_id}`;
+  if (configuredResolver?.key !== key) configuredResolver = { key, resolve: newsroomChatIdentityResolver({ user_pool_id: auth.user_pool_id, user_pool_client_id: auth.user_pool_client_id }) };
+  return configuredResolver.resolve(request);
+}

package/lib/papyrus-hosted-chat.ts

@@ -1,51 +1,36 @@
+import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "./newsroom-chat-identity";
 import { createHash } from "node:crypto";
 import type { EmbeddedChatAppDependencies } from "chatticus/chat-server";
 import type { NextRequest } from "next/server";
-import {
-  ProspectusAccountsError,
-  authorizeSignedInPersonForAccount,
-} from "./prospectus-site-identity";
-import {
-  resolveProspectusSignInRuntime,
-  signedInProspectusSession,
-  type ProspectusSignInRuntime,
-} from "./prospectus-session";
-import { prospectusSiteProduct, publishingAccountsForSite } from "./prospectus-publication-access";
 import { publicSiteOrigin } from "./site-origin-value";
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
 
 export interface PapyrusChatScope {
-  siteProduct: string;
-  accountId: string;
-  personId: string;
   tenantId: string;
   editorId: string;
 }
 
 export interface PapyrusHostedChatOptions {
-  resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
+  resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
   resolvePrivateDependencies?: () => Promise<EmbeddedChatAppDependencies | null>;
   privateChatEnabled?: boolean;
-  siteProduct?: string | null;
   environment?: Record<string, string | undefined>;
   nowInSeconds?: () => number;
 }
 
-function siteAndAccountKey(siteProduct: string, accountId: string): string {
-  return createHash("sha256").update(JSON.stringify([siteProduct, accountId])).digest("hex");
+/** A new namespace: never aliases Account-scoped or legacy transcripts. */
+export function derivePapyrusChatScope(publicationNamespace: string, issuer: string, subject: string): PapyrusChatScope {
+  const tenantHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer])).digest("hex");
+  const editorHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer, subject])).digest("hex");
+  return { tenantId: `papyrus-newsroom-v1-${tenantHash.slice(0, 40)}`, editorId: `papyrus-newsroom-editor-v1-${editorHash.slice(0, 40)}` };
 }
 
-export function derivePapyrusChatScope(siteProduct: string, accountId: string, personId: string): PapyrusChatScope {
-  const tenantHash = siteAndAccountKey(siteProduct, accountId);
-  const editorHash = createHash("sha256").update(JSON.stringify([siteProduct, accountId, personId])).digest("hex");
-  return {
-    siteProduct,
-    personId,
-    accountId,
-    tenantId: `papyrus-${tenantHash.slice(0, 40)}`,
-    editorId: `papyrus-editor-${editorHash.slice(0, 40)}`,
-  };
+/** Existing server storage resources bind the publication, independently of request hosts or claims. */
+function publicationNamespace(environment: Record<string, string | undefined>, clientId: string): string | null {
+  const bucket = environment.PAPYRUS_CHAT_SESSION_BUCKET?.trim();
+  const table = environment.PAPYRUS_CHAT_MESSAGING_TABLE?.trim();
+  return bucket && table ? JSON.stringify([bucket, table, clientId]) : null;
 }
 
 type ResolvedPapyrusPrincipal = {
@@ -59,60 +44,24 @@ type ResolvedPapyrusPrincipal = {
 
 async function principalForRequest(
   request: NextRequest,
-  operation: "console:read" | "console:write",
   options: PapyrusHostedChatOptions,
-): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number }> {
-  const environment = options.environment ?? process.env;
-  const siteProduct = options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct(environment);
-  if (!siteProduct) return { principal: null, status: 503 };
-
-  let runtime: ProspectusSignInRuntime | null;
+): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; expiresAt?: number }> {
+  let identity;
   try {
-    runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(publicSiteOrigin(request, environment));
+    identity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
   } catch {
     return { principal: null, status: 503 };
   }
-  if (!runtime) return { principal: null, status: 503 };
-
-  const nowInSeconds = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
-  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
-  if (!session || !session.selectedAccountId || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
-    return { principal: null, status: 401 };
-  }
-
-  try {
-    const directory = await runtime.accounts.accountDirectory(session.accessToken);
-    if (directory.person?.id !== session.personId) return { principal: null, status: 401 };
-    if (!publishingAccountsForSite(directory.accounts, siteProduct).some((account) => account.accountId === session.selectedAccountId)) {
-      return { principal: null, status: 403 };
-    }
-    const authorization = await authorizeSignedInPersonForAccount(
-      runtime.accounts,
-      session.accessToken,
-      session.selectedAccountId,
-      operation,
-    );
-    if (authorization.personId !== session.personId || authorization.accountId !== session.selectedAccountId || authorization.operation !== operation) {
-      return { principal: null, status: 403 };
-    }
-    const scope = derivePapyrusChatScope(siteProduct, session.selectedAccountId, session.personId);
-    return {
-      principal: {
-        kind: "user",
-        tenantId: scope.tenantId,
-        userId: scope.editorId,
-        workerId: null,
-        organizationStatus: "enabled",
-        role: "member",
-      },
-      status: 200,
-    };
-  } catch (error) {
-    if (error instanceof ProspectusAccountsError && (error.status === 401 || error.status === 403)) {
-      return { principal: null, status: error.status };
-    }
-    return { principal: null, status: 503 };
-  }
+  const now = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
+  if (!identity || !identity.subject || !identity.issuer || !identity.clientId || !Number.isFinite(identity.expiresAt) || identity.expiresAt <= now) return { principal: null, status: 401 };
+  const namespace = publicationNamespace(options.environment ?? process.env, identity.clientId);
+  if (!namespace) return { principal: null, status: 503 };
+  const scope = derivePapyrusChatScope(namespace, identity.issuer, identity.subject);
+  return {
+    principal: { kind: "user", tenantId: scope.tenantId, userId: scope.editorId, workerId: null, organizationStatus: "enabled", role: "member" },
+    status: 200,
+    expiresAt: identity.expiresAt,
+  };
 }
 
 function jsonFailure(status: number, error: string): Response {
@@ -162,6 +111,9 @@ export async function handlePapyrusHostedChatRequest(
   const privateChatEnabled = options.privateChatEnabled ?? environment.PAPYRUS_PRIVATE_CHAT_ENABLED === "true";
   if (!privateChatEnabled) return jsonFailure(404, "private_chat_disabled");
 
+  const authorization = await principalForRequest(request, options);
+  if (!authorization.principal) return jsonFailure(authorization.status, (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
+
   let dependencies: EmbeddedChatAppDependencies | null;
   try {
     if (options.resolvePrivateDependencies) {
@@ -178,9 +130,6 @@ export async function handlePapyrusHostedChatRequest(
   }
   if (!dependencies) return jsonFailure(503, "private_chat_storage_unavailable");
 
-  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
-  if (!authorization.principal) return jsonFailure(authorization.status, authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable");
-
   const headers = new Headers({ accept: request.headers.get("accept") ?? "application/json" });
   let body: string | undefined;
   if (request.method === "POST" && isMessageRoute) {
@@ -213,5 +162,38 @@ export async function handlePapyrusHostedChatRequest(
     ...dependencies,
     resolvePrincipal: async () => authorization.principal,
   });
-  return app.fetch(forwarded);
+  const response = await app.fetch(forwarded);
+  if (path[0] !== "turns" || path[2] !== "stream" || !response.ok || !response.body) return response;
+  const remaining = (authorization.expiresAt! - (options.nowInSeconds?.() ?? Date.now() / 1000)) * 1000;
+  return expireChatStream(response, remaining);
+}
+
+/** End an established stream at JWT expiry; reconnect must pass current authorization again. */
+export function expireChatStream(response: Response, remainingMilliseconds: number): Response {
+  if (!response.body) return response;
+  const reader = response.body.getReader();
+  let closed = false;
+  let timer: ReturnType<typeof setTimeout>;
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      timer = setTimeout(() => {
+        if (closed) return;
+        closed = true;
+        controller.close();
+        void reader.cancel().catch(() => {});
+      }, Math.max(0, Math.min(remainingMilliseconds, 2_147_483_647)));
+    },
+    async pull(controller) {
+      try {
+        const next = await reader.read();
+        if (closed) return;
+        if (next.done) { closed = true; clearTimeout(timer); controller.close(); }
+        else controller.enqueue(next.value);
+      } catch (error) {
+        if (!closed) { closed = true; clearTimeout(timer); controller.error(error); }
+      }
+    },
+    async cancel(reason) { closed = true; clearTimeout(timer); await reader.cancel(reason); },
+  });
+  return new Response(body, { status: response.status, headers: response.headers });
 }

package/lib/papyrus-private-chat-client.ts

@@ -1,3 +1,4 @@
+import { newsroomChatFetch } from "./newsroom-chat-client";
 export type PapyrusPrivateChatChannel = {
   channel_id: string;
   participants: Array<{ kind: string; actor_id: string }>;
@@ -30,6 +31,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   });
   const payload = await response.json().catch(() => null) as Record<string, unknown> | null;
   if (!response.ok) {
+    if (response.status === 401) throw new Error("sign_in_required");
+    if (response.status === 403) throw new Error("chat_account_access_denied");
     const error = typeof payload?.error === "string" ? payload.error
       : typeof payload?.detail === "string" ? payload.detail
         : `Private chat request failed (${response.status}).`;
@@ -39,8 +42,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   return payload as T;
 }
 
-/** Open the current editor's server-derived private channel using the signed same-origin session cookie. */
-export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = globalThis.fetch): Promise<PapyrusPrivateChatChannel> {
+/** Open the current editor's server-derived private channel using the verified publication-local newsroom identity. */
+export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = newsroomChatFetch): Promise<PapyrusPrivateChatChannel> {
   const result = await requestJson<PapyrusPrivateChatChannel>("private-channel", { method: "POST" }, fetcher);
   if (!result.channel_id?.trim() || !Array.isArray(result.participants)) {
     throw new Error("Private chat returned an invalid channel.");
@@ -51,7 +54,7 @@ export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch =
 /** Read only the private channel returned by the host's authenticated open request. */
 export async function listPapyrusPrivateChatMessages(
   channelId: string,
-  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
 ): Promise<PapyrusPrivateChatMessage[]> {
   if (!channelId.trim()) throw new Error("A private chat channel is required.");
   const result = await requestJson<{ messages?: unknown }>(`channels/${encodeURIComponent(channelId)}/messages`, { method: "GET" }, fetcher);
@@ -64,7 +67,7 @@ export async function sendPapyrusPrivateChatMessage(
   channelId: string,
   body: string,
   idempotencyKey: string,
-  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
 ): Promise<PapyrusPrivateChatSendResult> {
   if (!channelId.trim() || !body.trim() || !idempotencyKey.trim()) {
     throw new Error("A channel, message and idempotency key are required.");

package/lib/proposals-admin.ts

@@ -0,0 +1,115 @@
+/**
+ * The data side of the Administration "Proposals" panel, which every site has (the queue is core; the reader-steering
+ * plugin only adds reader votes). Rows come from the staff-readable `Proposal` model; an editor moves one with the
+ * `transitionProposal` mutation. Pure functions, no network, so the rules the panel shows can be tested.
+ */
+
+export type ProposalRow = {
+  id: string;
+  kind: string;
+  title: string;
+  summary?: string | null;
+  body?: string | null;
+  state: string;
+  proposer?: string | null;
+  held?: boolean | null;
+  pinned?: boolean | null;
+  createdAt: string;
+};
+
+export type ProposalFilter = "open" | "draft" | "in_steering" | "editor_review" | "decided";
+/** A button: the states it moves through in order (one call each) or, for pin and hold, the `editProposal` action it runs. */
+export type ProposalMove = { label: string; path?: string[]; edit?: "pin" | "unpin" | "hold" | "release"; state?: string };
+
+const STATE_LABELS: Record<string, string> = {
+  draft: "Draft",
+  in_steering: "In steering",
+  editor_review: "Editor review",
+  approved: "Approved",
+  declined: "Declined",
+  overridden_by_editor: "Decided by an editor",
+};
+
+const KIND_LABELS: Record<string, string> = {
+  story_draft: "Story draft",
+  new_concept: "New concept",
+  rename: "Rename",
+  merge: "Merge",
+  split: "Split",
+  new_column: "New column",
+  element_symbol: "Element symbol",
+};
+
+const DECIDED = new Set(["approved", "declined", "overridden_by_editor"]);
+
+/**
+ * What an editor may do next; the function enforces the same table (overriding the community needs a reason and is not offered
+ * here). On a site without reader-steering nobody steers, so a draft goes straight to editor review (two moves) and the
+ * "in steering" wording never shows.
+ */
+function stateMoves(state: string, readers: boolean): ProposalMove[] {
+  if (state === "draft") {
+    return readers
+      ? [{ label: "Send to steering", path: ["in_steering"] }, { label: "Decline", path: ["declined"] }]
+      : [{ label: "Move to editor review", path: ["in_steering", "editor_review"] }, { label: "Decline", path: ["declined"] }];
+  }
+  if (state === "in_steering") return [{ label: "Move to editor review", path: ["editor_review"] }];
+  if (state === "editor_review") return [{ label: "Approve", path: ["approved"] }, { label: "Decline", path: ["declined"] }];
+  return [];
+}
+
+export const PROPOSAL_FIELDS = "id kind title summary body state proposer held pinned createdAt";
+export const LIST_PROPOSALS = `query Proposals($nextToken: String) { listProposals(limit: 500, nextToken: $nextToken) { items { ${PROPOSAL_FIELDS} } nextToken } }`;
+export const EDIT_PROPOSAL = `mutation Edit($proposalId: String!, $action: String!) { editProposal(proposalId: $proposalId, action: $action) { status id error message } }`;
+export const TRANSITION_PROPOSAL = `mutation Move($proposalId: String!, $state: String!, $reason: String) { transitionProposal(proposalId: $proposalId, state: $state, reason: $reason) { status id error message } }`;
+
+export function stateLabel(state: string, readers = true): string {
+  if (!readers && state === "in_steering") return "Waiting for review";
+  return STATE_LABELS[state] ?? state;
+}
+
+export function kindLabel(kind: string): string {
+  return KIND_LABELS[kind] ?? kind;
+}
+
+/** AI-filed proposals say "AI"; a reader's proposal says "Reader" (their id is never shown). */
+export function proposerLabel(proposer: string | null | undefined): string {
+  return proposer === "ai" ? "AI" : proposer ? "Reader" : "Unknown";
+}
+
+export function proposalMoves(row: Pick<ProposalRow, "state" | "held" | "pinned">, readers = true): ProposalMove[] {
+  const edits: ProposalMove[] = [
+    { label: row.pinned ? "Unpin" : "Pin", edit: row.pinned ? "unpin" : "pin" },
+    ...(DECIDED.has(row.state) && !row.held ? [] : [{ label: row.held ? "Release hold" : "Hold", edit: (row.held ? "release" : "hold") as "release" | "hold" }]),
+  ];
+  // A proposal on hold refuses every state change until it is released.
+  return [...(row.held ? [] : stateMoves(row.state, readers)), ...edits];
+}
+
+export function sortProposals(rows: ProposalRow[]): ProposalRow[] {
+  return [...rows].sort((left, right) => right.createdAt.localeCompare(left.createdAt) || right.id.localeCompare(left.id));
+}
+
+export function filterProposals(rows: ProposalRow[], filter: ProposalFilter): ProposalRow[] {
+  if (filter === "open") return rows.filter((row) => !DECIDED.has(row.state));
+  if (filter === "decided") return rows.filter((row) => DECIDED.has(row.state));
+  return rows.filter((row) => row.state === filter);
+}
+
+export function countProposals(rows: ProposalRow[]): Record<ProposalFilter, number> {
+  return {
+    open: filterProposals(rows, "open").length,
+    draft: filterProposals(rows, "draft").length,
+    in_steering: filterProposals(rows, "in_steering").length,
+    editor_review: filterProposals(rows, "editor_review").length,
+    decided: filterProposals(rows, "decided").length,
+  };
+}
+
+export type ProposalReceipt = { status?: string | null; id?: string | null; error?: string | null; message?: string | null };
+
+export function proposalReceiptMessage(receipt: ProposalReceipt | null | undefined): string {
+  if (!receipt) return "The action did not answer.";
+  if (receipt.status === "ok") return "Done.";
+  return receipt.message || receipt.error || "The action was refused.";
+}

package/lib/prospectus-session.ts

@@ -33,6 +33,7 @@ const MINIMUM_SEALING_SECRET_LENGTH = 32;
 
 export interface PendingProspectusSignInCookie extends PendingProspectusSignIn {
   returnPath: string;
+  newsroomSubject?: string;
 }
 
 export interface ProspectusSignedInSession {
@@ -40,6 +41,7 @@ export interface ProspectusSignedInSession {
   accessToken: string;
   accessTokenExpiresAt: number;
   selectedAccountId?: string;
+  newsroomSubject?: string;
   siteSubject?: string;
 }
 

package/lib/prospectus-sign-in-routes.ts

@@ -1,3 +1,4 @@
+import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "./newsroom-chat-identity";
 import { NextResponse, type NextRequest } from "next/server";
 import {
   CYCLOTRON_LAB_PRODUCT,
@@ -36,6 +37,7 @@ import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfigured
  * unregistered deployment never half-signs anyone in.
  */
 export interface ProspectusSignInRouteOptions {
+  resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
   resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
   siteProduct?: string | null;
   completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
@@ -137,12 +139,25 @@ export function handleProspectusSignInStart(request: NextRequest, options: Prosp
 async function handleProspectusSignInStartRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
+  const newsroomConnection = request.nextUrl.searchParams.get("newsroomChat") === "true";
+  let newsroomSubject: string | undefined;
+  if (newsroomConnection) {
+    if (request.method !== "POST" || request.headers.get("origin") !== siteOriginFor(request, options)) {
+      return signInFailedResponse(403, "same_origin_required", "Connect chat from this newsroom.");
+    }
+    const identity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request).catch(() => null);
+    if (!identity) return signInFailedResponse(401, "sign_in_required", "An authenticated newsroom editor is required.");
+    newsroomSubject = identity.subject;
+  }
   const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
   const pendingSignInCookie: PendingProspectusSignInCookie = {
     ...pendingSignIn,
-    returnPath: sameSiteReturnPath(await requestedReturnPath(request)),
+    ...(newsroomSubject ? { newsroomSubject } : {}),
+    returnPath: sameSiteReturnPath(newsroomConnection ? request.nextUrl.searchParams.get("returnTo") : await requestedReturnPath(request)),
   };
-  const response = NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
+  const response = newsroomConnection
+    ? NextResponse.json({ authorizationUrl }, { headers: NO_STORE_HEADERS })
+    : NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
   response.cookies.set(
     PROSPECTUS_PENDING_SIGN_IN_COOKIE,
     sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_PENDING_SIGN_IN_COOKIE, pendingSignInCookie, pendingSignIn.expiresAt),
@@ -194,11 +209,13 @@ async function completeCallback(
       pendingSignIn,
       returnedState,
       authorizationCode,
+      expectedNewsroomSubject: pendingSignIn.newsroomSubject,
       nowInSeconds,
       ...options.completionOverrides,
     });
     const session: ProspectusSignedInSession = {
       personId: signedIn.person.id,
+      ...(pendingSignIn.newsroomSubject ? { newsroomSubject: pendingSignIn.newsroomSubject } : {}),
       accessToken: signedIn.accessToken,
       accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
       ...(signedIn.person.siteSubject ? { siteSubject: signedIn.person.siteSubject } : {}),

package/lib/prospectus-site-identity.ts

@@ -281,6 +281,7 @@ export interface CompleteProspectusGoogleSignInInput {
   pendingSignIn: PendingProspectusSignIn;
   returnedState: string;
   authorizationCode: string;
+  expectedNewsroomSubject?: string;
   verifyCognitoTokens?: CognitoTokenVerifier;
   fetcher?: typeof fetch;
   nowInSeconds?: number;
@@ -320,6 +321,12 @@ export async function completeProspectusGoogleSignIn(
     expiresInSeconds: Number(tokenBody.expires_in) || 0,
   };
   await (input.verifyCognitoTokens ?? cognitoTokenVerifier(input.cognitoClient))(tokens, input.pendingSignIn.nonce);
+  if (input.expectedNewsroomSubject) {
+    const claims = JSON.parse(Buffer.from(tokens.accessToken.split(".")[1], "base64url").toString("utf8")) as { sub?: string };
+    if (claims.sub !== input.expectedNewsroomSubject) {
+      throw new ProspectusAccountsError(403, "newsroom_identity_mismatch", "Continue with the same Google account as your newsroom session.");
+    }
+  }
   const { person } = await input.accounts.resolveGoogleSignIn(input.pendingSignIn, tokens.accessToken, tokens.idToken);
   return {
     person,

package/lib/relevance-decisions.ts

@@ -1,4 +1,5 @@
 import type { SemanticRelationRecord } from "./category-repository";
+import { normalizeReferenceCurationStatus } from "./reference-policy";
 
 export const RELEVANCE_RELATION = "relevance_decision_is";
 
@@ -162,3 +163,11 @@ export function curationForRelevanceReview(decision: RelevanceDecisionView, revi
     shareable: review.shareable,
   };
 }
+
+/**
+ * A pending reference with a current cyclotron suggestion is waiting for an editor's answer,
+ * whether or not the cyclotron flagged the decision itself for review.
+ */
+export function awaitsEditorReview(curationStatus: unknown, decision: RelevanceDecisionView | undefined): boolean {
+  return Boolean(decision) && normalizeReferenceCurationStatus(curationStatus) === "pending";
+}

package/lib/review-requests.ts

@@ -121,7 +121,7 @@ export function modeMark(mode: ReviewMode): string {
 export function nextText(request: ReviewRequest): string {
   if (request.state === "open") {
     if (request.mode === "hard_gate") return "Waiting for you. Nothing continues until you approve or reject.";
-    if (request.mode === "soft_review") return `Proceeds automatically on ${formatWhen(request.deadline)} unless you steer it.`;
+    if (request.mode === "soft_review") return request.deadline ? `Proceeds automatically on ${formatWhen(request.deadline)} unless you steer it.` : "Stays open until someone handles it. It never proceeds or expires on its own.";
     return "Nothing is waiting on this. It stays here until you acknowledge it.";
   }
   if (request.state === "timed_out") return `Proceeded without review on ${formatWhen(request.updatedAt)}.`;
@@ -219,9 +219,11 @@ export type NotificationSections = {
 export function sectionReviews(requests: ReviewRequest[]): NotificationSections {
   const open = requests.filter((request) => request.state === "open");
   const byRaised = (a: ReviewRequest, b: ReviewRequest) => a.raisedAt.localeCompare(b.raisedAt);
+  // Requests with a deadline first, soonest first; requests with no deadline after them, oldest first.
+  const bySoonestDeadline = (a: ReviewRequest, b: ReviewRequest) => (a.deadline && b.deadline ? a.deadline.localeCompare(b.deadline) : a.deadline ? -1 : b.deadline ? 1 : byRaised(a, b));
   return {
     hardGates: open.filter((request) => request.mode === "hard_gate").sort(byRaised),
-    softReviews: open.filter((request) => request.mode === "soft_review").sort((a, b) => (a.deadline ?? "").localeCompare(b.deadline ?? "")),
+    softReviews: open.filter((request) => request.mode === "soft_review").sort(bySoonestDeadline),
     flags: open.filter((request) => request.mode === "flag").sort((a, b) => b.raisedAt.localeCompare(a.raisedAt)),
     decided: requests.filter((request) => request.state !== "open").sort((a, b) => b.updatedAt.localeCompare(a.updatedAt)),
   };

package/package.json

@@ -106,6 +106,7 @@
     "./components/newsroom-client-shell": "./components/newsroom-client-shell.tsx",
     "./components/newsroom-curation-bootstrap": "./components/newsroom-curation-bootstrap.tsx",
     "./components/newsroom-curation-provider": "./components/newsroom-curation-provider.tsx",
+    "./components/newsroom-mobile-navigation": "./components/newsroom-mobile-navigation.tsx",
     "./components/newsroom-ops-overview": "./components/newsroom-ops-overview.tsx",
     "./components/newsroom-ops-shell": "./components/newsroom-ops-shell.tsx",
     "./components/newsroom-overview-skeleton": "./components/newsroom-overview-skeleton.tsx",
@@ -118,6 +119,7 @@
     "./components/newsroom-topics-view": "./components/newsroom-topics-view.tsx",
     "./components/notification-center": "./components/notification-center.tsx",
     "./components/papyrus-console-conversation": "./components/papyrus-console-conversation.tsx",
+    "./components/papyrus-console-frame": "./components/papyrus-console-frame.tsx",
     "./components/papyrus-console-shell": "./components/papyrus-console-shell.tsx",
     "./components/papyrus-private-chat-panel": "./components/papyrus-private-chat-panel.tsx",
     "./components/pictogram-figure": "./components/pictogram-figure.tsx",
@@ -125,6 +127,8 @@
     "./components/presentation-header": "./components/presentation-header.tsx",
     "./components/presentation-rhythm-hrule": "./components/presentation-rhythm-hrule.tsx",
     "./components/priming-proof-page": "./components/priming-proof-page.tsx",
+    "./components/proposals-panel": "./components/proposals-panel.tsx",
+    "./components/proposals-view": "./components/proposals-view.tsx",
     "./components/prospectus-account-chooser": "./components/prospectus-account-chooser.tsx",
     "./components/publication-cyclotron-panel": "./components/publication-cyclotron-panel.tsx",
     "./components/reader-auth-control": "./components/reader-auth-control.tsx",
@@ -139,6 +143,7 @@
     "./components/reference-live-agreement": "./components/reference-live-agreement.tsx",
     "./components/reference-priming": "./components/reference-priming.tsx",
     "./components/reference-relevance-review": "./components/reference-relevance-review.tsx",
+    "./components/reference-review-card": "./components/reference-review-card.tsx",
     "./components/reference-section-suggestion": "./components/reference-section-suggestion.tsx",
     "./components/reference-source-preview": "./components/reference-source-preview.tsx",
     "./components/settings-page": "./components/settings-page.tsx",
@@ -167,6 +172,7 @@
     "./components/ui/tooltip": "./components/ui/tooltip.tsx",
     "./components/use-blog-header-obstacles": "./components/use-blog-header-obstacles.ts",
     "./components/use-brand-fonts-ready": "./components/use-brand-fonts-ready.ts",
+    "./components/use-console-visibility": "./components/use-console-visibility.ts",
     "./components/use-editorial-checks": "./components/use-editorial-checks.ts",
     "./components/use-near-viewport": "./components/use-near-viewport.ts",
     "./components/use-paged-content-item-versions": "./components/use-paged-content-item-versions.ts",
@@ -194,6 +200,7 @@
     "./lib/category-dashboard": "./lib/category-dashboard.ts",
     "./lib/category-repository": "./lib/category-repository.ts",
     "./lib/chrome-text": "./lib/chrome-text.ts",
+    "./lib/cli-login-discovery": "./lib/cli-login-discovery.ts",
     "./lib/console-chat-client": "./lib/console-chat-client.ts",
     "./lib/console-web-context": "./lib/console-web-context.ts",
     "./lib/content-actions-client": "./lib/content-actions-client.ts",
@@ -257,6 +264,8 @@
     "./lib/newsroom-board": "./lib/newsroom-board.ts",
     "./lib/newsroom-card-layout": "./lib/newsroom-card-layout.ts",
     "./lib/newsroom-category-drilldown": "./lib/newsroom-category-drilldown.ts",
+    "./lib/newsroom-chat-client": "./lib/newsroom-chat-client.ts",
+    "./lib/newsroom-chat-identity": "./lib/newsroom-chat-identity.ts",
     "./lib/newsroom-demo-articles": "./lib/newsroom-demo-articles.ts",
     "./lib/newsroom-demo-dashboard": "./lib/newsroom-demo-dashboard.ts",
     "./lib/newsroom-demo-profile": "./lib/newsroom-demo-profile.ts",
@@ -283,6 +292,7 @@
     "./lib/presentation-footer": "./lib/presentation-footer.ts",
     "./lib/pretext-layout": "./lib/pretext-layout.ts",
     "./lib/priming-proof-report": "./lib/priming-proof-report.ts",
+    "./lib/proposals-admin": "./lib/proposals-admin.ts",
     "./lib/prospectus-account-client": "./lib/prospectus-account-client.ts",
     "./lib/prospectus-publication-access": "./lib/prospectus-publication-access.ts",
     "./lib/prospectus-session": "./lib/prospectus-session.ts",
@@ -356,6 +366,7 @@
     "./renderers/pretext/rhythm-blog-presentation": "./renderers/pretext/rhythm-blog-presentation.tsx",
     "./renderers/pretext/rhythm-shell-style": "./renderers/pretext/rhythm-shell-style.ts",
     "./app/%5F_preview/[[...path]]/route": "./app/%5F_preview/[[...path]]/route.ts",
+    "./app/.well-known/papyrus-cli.json/route": "./app/.well-known/papyrus-cli.json/route.ts",
     "./app/[year]/[month]/[day]/[articleSlug]/page": "./app/[year]/[month]/[day]/[articleSlug]/page.tsx",
     "./app/[year]/[month]/[day]/page": "./app/[year]/[month]/[day]/page.tsx",
     "./app/[year]/[month]/[day]/page/[pageNumber]/page": "./app/[year]/[month]/[day]/page/[pageNumber]/page.tsx",
@@ -456,7 +467,7 @@
       "optional": true
     }
   },
-  "version": "5.42.1",
+  "version": "5.43.0-next.2",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.42.1",
+  "version": "5.43.0-next.2",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -11,6 +11,17 @@
         "dynamic": "\"force-dynamic\""
       }
     },
+    {
+      "file": "app/.well-known/papyrus-cli.json/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/[year]/[month]/[day]/[articleSlug]/page.tsx",
       "reader": true,