@anthusai/papyrus 5.48.0 → 5.50.0

package/components/use-reference-ratings.ts

@@ -41,20 +41,29 @@ export type RatingController = {
  * A Reject needs a reason code (the backend refuses one without), so it waits as `pending` until one is chosen; a typed reason is
  * kept in the store until it is saved and is never dropped by a failed save.
  */
-export function useRatingStore({ save, saved, seed, needsReason }: {
+export function useRatingStore({ save, saved, seed, needsReason, sticky, saveNote }: {
   save: RatingSave;
   saved: (id: string) => ReviewChoice | null;
   seed: (id: string) => { note: string; reasonCode: ReferenceRejectionReasonCode | null };
   /** Whether a Reject on this item must wait for a reason code. Default yes (a Reference); an AI draft or an email asks nothing. */
   needsReason?: (id: string) => boolean;
+  /**
+   * True for an item whose decision, once made, cannot be sent again (an AI draft moves its Proposal, a review request closes, a held email is
+   * queued). A reason typed after such a decision goes to `saveNote` instead, onto the decision that exists.
+   */
+  sticky?: (id: string) => boolean;
+  /** Saves the reason of an item that is already decided and sticky. Throws a sentence when it cannot. */
+  saveNote?: (id: string, note: string) => Promise<void>;
 }): RatingController {
   const [items, setItems] = useState<Record<string, ItemRating>>({});
   const itemsRef = useRef(items);
-  const latest = useRef({ save, saved, seed, needsReason });
-  latest.current = { save, saved, seed, needsReason };
+  const latest = useRef({ save, saved, seed, needsReason, sticky, saveNote });
+  latest.current = { save, saved, seed, needsReason, sticky, saveNote };
   const timers = useRef<Record<string, ReturnType<typeof setTimeout>>>({});
   const inFlight = useRef<Set<string>>(new Set());
   const dirty = useRef<Set<string>>(new Set());
+  const decidedHere = useRef<Set<string>>(new Set());
+  const noteInFlight = useRef<Set<string>>(new Set());
 
   const patch = useCallback((id: string, change: Partial<ItemRating>) => {
     const next = { ...itemsRef.current, [id]: { ...(itemsRef.current[id] ?? EMPTY), ...change } };
@@ -75,8 +84,35 @@ export function useRatingStore({ save, saved, seed, needsReason }: {
     return { note: item.note ?? seeded.note, reasonCode: item.reasonCode !== undefined ? item.reasonCode : seeded.reasonCode };
   };
 
+  /** True once a sticky item has its decision: from then on only its reason can change. */
+  const finalDecision = (id: string) => Boolean(latest.current.sticky?.(id) && latest.current.saveNote && (decidedHere.current.has(id) || latest.current.saved(id)));
+
+  /** A reason typed after the decision: saved onto it. The text stays in the store until it is saved, and a failed save never drops it. */
+  const saveNoteOnly = useCallback(async (id: string): Promise<void> => {
+    if (noteInFlight.current.has(id)) { dirty.current.add(`note:${id}`); return; }
+    noteInFlight.current.add(id);
+    dirty.current.delete(`note:${id}`);
+    const started = itemsRef.current[id]?.note;
+    const { note } = values(id);
+    patch(id, { feedback: { phase: "saving" } });
+    try {
+      await latest.current.saveNote!(id, note.trim());
+      const now = itemsRef.current[id];
+      patch(id, { feedback: { phase: "saved" }, ...(now?.note === started ? { note: undefined } : {}) });
+    } catch (failure) {
+      dirty.current.add(`note:${id}`); // still unsaved: tapping away, or the next pause, tries again
+      patch(id, { feedback: { phase: "error", message: failure instanceof Error ? failure.message : "Your note could not be saved. It is kept here; keep typing or tap away to try again." } });
+    } finally {
+      noteInFlight.current.delete(id);
+    }
+    if (itemsRef.current[id]?.feedback.phase !== "error" && dirty.current.delete(`note:${id}`)) void saveNoteOnly(id);
+  }, [patch]);
+
   const commit = useCallback(async (id: string, choice: ReviewChoice) => {
-    const { note, reasonCode } = values(id);
+    if (finalDecision(id)) { void saveNoteOnly(id); return; }
+    const { note, reasonCode: chosenCode } = values(id);
+    // A typed reason is a reason: a Reject with words but no reason button is filed under "other" rather than left waiting.
+    const reasonCode = chosenCode ?? (choice === "reject" && note.trim() ? "other" : null);
     if (choice === "reject" && !reasonCode && (latest.current.needsReason?.(id) ?? true)) { patch(id, { pending: "reject", askReason: true }); return; }
     if (inFlight.current.has(id)) { dirty.current.add(id); return; }
     inFlight.current.add(id);
@@ -85,21 +121,26 @@ export function useRatingStore({ save, saved, seed, needsReason }: {
     patch(id, { pending: choice, askReason: false, feedback: { phase: "saving" } });
     try {
       await latest.current.save(id, choice, { note: note.trim(), reasonCode: choice === "reject" ? reasonCode : null });
-      // What was saved now follows the record again (another editor's update shows); anything typed meanwhile is kept.
+      if (latest.current.sticky?.(id)) decidedHere.current.add(id);
+      // What was saved now follows the record again (another editor's update shows); anything typed meanwhile is kept. While another
+      // save is due (changed mid-save), the store keeps everything: the record may not show this save yet, and the next one sends it.
       const now = itemsRef.current[id] ?? EMPTY;
-      patch(id, { pending: null, feedback: { phase: "saved" }, ...(now.note === started.note ? { note: undefined } : {}), ...(now.reasonCode === started.reasonCode ? { reasonCode: undefined } : {}) });
+      const follow = !dirty.current.has(id);
+      patch(id, { pending: null, feedback: { phase: "saved" }, ...(follow && now.note === started.note ? { note: undefined } : {}), ...(follow && now.reasonCode === started.reasonCode ? { reasonCode: undefined } : {}) });
     } catch (failure) {
       // The typed reason stays in the store; only the vote is undone.
       patch(id, { pending: null, feedback: { phase: "error", message: failure instanceof Error ? failure.message : "Your answer could not be saved. Tap it again to retry." } });
     } finally {
       inFlight.current.delete(id);
     }
-    if (dirty.current.has(id)) { dirty.current.delete(id); const again = itemsRef.current[id]?.pending ?? latest.current.saved(id); if (again) void commit(id, again); }
-  }, [patch]);
+    // Changed while saving (a reason chip tapped mid-save): save again. The record may not show the vote yet, so fall back to it.
+    if (dirty.current.has(id)) { dirty.current.delete(id); const again = itemsRef.current[id]?.pending ?? latest.current.saved(id) ?? choice; if (again) void commit(id, again); }
+  }, [patch, saveNoteOnly]);
 
   const effective = (id: string): ReviewChoice | null => itemsRef.current[id]?.pending ?? latest.current.saved(id);
 
   const choose = useCallback((id: string, choice: ReviewChoice) => {
+    if (finalDecision(id)) return; // a decision that cannot be sent again is only ever given a reason, never a second vote
     if (effective(id) === choice && !itemsRef.current[id]?.askReason) return; // the chosen answer never unselects itself
     void commit(id, choice);
   }, [commit]);
@@ -128,7 +169,20 @@ export function useRatingStore({ save, saved, seed, needsReason }: {
 
   const cancelReason = useCallback((id: string) => patch(id, { pending: null, askReason: false }), [patch]);
 
-  useEffect(() => () => { for (const timer of Object.values(timers.current)) clearTimeout(timer); }, []);
+  // Leaving the page (or closing the view) saves what was typed and not yet saved, rather than dropping it.
+  const leaving = useRef<() => void>(() => undefined);
+  leaving.current = () => {
+    for (const key of [...dirty.current]) {
+      if (!key.startsWith("note:")) continue;
+      const id = key.slice(5);
+      const choice = effective(id);
+      if (choice && dirty.current.delete(key)) void commit(id, choice);
+    }
+  };
+  useEffect(() => () => {
+    for (const timer of Object.values(timers.current)) clearTimeout(timer);
+    leaving.current();
+  }, []);
 
   return { get, choose, setReason, setNote, commitNote, cancelReason };
 }

package/lib/review-client.ts

@@ -149,6 +149,22 @@ export async function saveDraftDecision(request: ReviewRequest, draftId: string,
   return normalizeReviewRow(result.data.updateReviewRequest);
 }
 
+/**
+ * Changes only the Why of an already decided draft or answered request (see `draftReasonUpdate` and `answerReasonUpdate`). The condition is that the
+ * request is still in the state it was read in, so a change cannot overwrite a request that closed or timed out meanwhile.
+ */
+export async function saveReviewReason(request: ReviewRequest, update: Record<string, unknown>): Promise<ReviewRequest> {
+  const result = await run(
+    `mutation Reason($input: UpdateReviewRequestInput!, $condition: ModelReviewRequestConditionInput) { updateReviewRequest(input: $input, condition: $condition) { ${FIELDS} } }`,
+    { input: update, condition: { state: { eq: request.state } } },
+  );
+  if (result.errors?.some((entry) => /conditional/i.test(`${entry.errorType ?? ""} ${entry.message ?? ""}`))) {
+    throw new Error("This request changed while you were writing. Your note is kept here; refresh, then save it again.");
+  }
+  if (result.errors?.length || !result.data?.updateReviewRequest) throw new Error("Your note could not be saved. It is kept here; keep typing or tap away to try again.");
+  return normalizeReviewRow(result.data.updateReviewRequest);
+}
+
 export type DraftLoad = { drafts: Record<string, DraftView>; missing: string[]; failed: string[] };
 
 /**

package/lib/review-drafts.ts

@@ -215,6 +215,38 @@ function quote(text: string): string {
   return `"${text.replace(/"/g, "'")}"`;
 }
 
+/** The words of an answer that covers several drafts: each rejection and each Why in a sentence, the plain Accepts of a mixed batch in one more. */
+export function draftFeedback(decisions: readonly (DraftDecision & { id: string })[]): string | null {
+  const rejected = decisions.filter((decision) => decision.choice === "reject");
+  const lines = decisions
+    .filter((decision) => decision.choice === "reject" || decision.why)
+    .map((decision) => `${decision.choice === "accept" ? "Accepted" : "Rejected"} ${quote(decision.title ?? decision.id)}${decision.notThisKind ? " as not this kind of story" : ""}${decision.why ? `: ${decision.why}` : ""}.`);
+  if (rejected.length > 0 && rejected.length < decisions.length) {
+    const kept = decisions.filter((decision) => decision.choice === "accept" && !decision.why).map((decision) => quote(decision.title ?? decision.id));
+    if (kept.length) lines.push(`Accepted ${kept.join(", ")}.`);
+  }
+  return lines.join(" ") || null;
+}
+
+/**
+ * The update that changes only the Why of a draft that is already decided. The Why is stored where the decision is: on the request's link
+ * for the draft and, once the request has closed, in its answer (`drafts` and the `feedback` sentence the idea pipeline reads back).
+ * The choice, the steering chip, who decided and when stay as they were. Applied with the condition that the state is unchanged.
+ */
+export function draftReasonUpdate(request: ReviewRequest, draftId: string, decision: DraftDecision, editor: string, now: Date): Record<string, unknown> {
+  const at = now.toISOString();
+  const why = decision.why?.trim() || null;
+  const next: DraftDecision = { ...decision, why };
+  const history = [...request.history, { at, event: "reason_edited", by: editor, note: `${decision.choice} ${draftId}` }].slice(-50);
+  const update: Record<string, unknown> = { id: request.id, links: JSON.stringify(withDecision(request, draftId, next)), updatedAt: at, history: JSON.stringify(history) };
+  if (request.answer?.drafts?.length && request.state === "answered") {
+    const known = request.answer.drafts;
+    const drafts = known.some((entry) => entry.id === draftId) ? known.map((entry) => (entry.id === draftId ? { ...entry, why } : entry)) : [...known, { ...next, id: draftId }];
+    update.answer = JSON.stringify({ ...request.answer, drafts, feedback: draftFeedback(drafts) });
+  }
+  return update;
+}
+
 /**
  * The answer that closes a request once every draft that can be decided has been: Accept on all is an approval, Reject on all a rejection,
  * a mix is an answer with a note naming each draft. A draft rejected as the wrong kind of story makes the answer a "not this kind" steer, which
@@ -230,21 +262,14 @@ export function batchAnswer(request: ReviewRequest, drafts: DraftLookup, fallbac
     decisions.push({ ...decision, title: decision.title ?? drafts[id]?.headline, id });
   }
   const rejected = decisions.filter((decision) => decision.choice === "reject");
-  const lines = decisions
-    .filter((decision) => decision.choice === "reject" || decision.why)
-    .map((decision) => `${decision.choice === "accept" ? "Accepted" : "Rejected"} ${quote(decision.title ?? decision.id)}${decision.notThisKind ? " as not this kind of story" : ""}${decision.why ? `: ${decision.why}` : ""}.`);
   const mixed = rejected.length > 0 && rejected.length < decisions.length;
-  if (mixed) {
-    const kept = decisions.filter((decision) => decision.choice === "accept" && !decision.why).map((decision) => quote(decision.title ?? decision.id));
-    if (kept.length) lines.push(`Accepted ${kept.join(", ")}.`);
-  }
   const links = request.links.some((link) => link.type === "proposal") ? request.links.map((link) => {
     const decision = decisions.find((entry) => entry.id === link.id);
     return decision ? { ...link, decision } : link;
   }) : [...request.links, ...decisions.map((decision) => ({ type: "proposal", id: decision.id, decision }))];
   return {
     decision: !rejected.length ? "approve" : mixed ? "feedback" : "reject",
-    feedback: lines.join(" ") || null,
+    feedback: draftFeedback(decisions),
     steer: rejected.some((decision) => decision.notThisKind) ? "not_this_kind" : null,
     drafts: decisions,
     links,

package/lib/review-requests.ts

@@ -108,6 +108,31 @@ export function answerUpdate(request: ReviewRequest, input: AnswerInput, by: str
   };
 }
 
+/**
+ * The update that changes only the note of a request that already has an answer (a hard gate, a stage review, an acknowledged flag).
+ * The decision, the steering signal, who answered and when stay as they were. Applied with the condition that the state is unchanged,
+ * so it cannot overwrite a request that timed out or was withdrawn in the meantime.
+ */
+export function answerReasonUpdate(request: ReviewRequest, why: string, editor: string, now: Date): Record<string, unknown> {
+  if (!request.answer) throw new Error("This request has no answer yet; answer it first.");
+  const at = now.toISOString();
+  const answer: ReviewAnswer = { ...request.answer, feedback: why.trim() || null };
+  const history = [...request.history, { at, event: "reason_edited", by: editor, note: request.answer.decision }].slice(-MAX_HISTORY);
+  return { id: request.id, answer: JSON.stringify(answer), updatedAt: at, history: JSON.stringify(history) };
+}
+
+/** A request with a stored update applied in memory, for the demo and the fixtures; the live data API returns the saved row instead. */
+export function applyReviewUpdate(request: ReviewRequest, update: Record<string, unknown>): ReviewRequest {
+  return {
+    ...request,
+    ...(typeof update.state === "string" ? { state: update.state as ReviewState } : {}),
+    ...(update.answer ? { answer: JSON.parse(String(update.answer)) } : {}),
+    ...(update.links ? { links: JSON.parse(String(update.links)) } : {}),
+    history: update.history ? JSON.parse(String(update.history)) : request.history,
+    updatedAt: String(update.updatedAt ?? request.updatedAt),
+  };
+}
+
 // --- words ------------------------------------------------------------------------------------------------
 
 export function formatWhen(iso: string | null | undefined): string {

package/lib/source-frameable.ts

@@ -0,0 +1,69 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+
+/**
+ * Whether a source page lets another site show it in a frame. Most news sites refuse (X-Frame-Options or a CSP frame-ancestors
+ * rule), and a refused frame is just an empty box, which the browser cannot detect from outside. So the newsroom asks here,
+ * on the server, before it shows a web page's live preview.
+ */
+
+/** True when the response headers allow framing by any site. A rule naming specific origins is treated as a refusal. */
+export function frameableFromHeaders(headers: Headers): boolean {
+  const xfo = headers.get("x-frame-options")?.trim().toLowerCase();
+  if (xfo && (xfo.includes("deny") || xfo.includes("sameorigin") || xfo.startsWith("allow-from"))) return false;
+  const csp = headers.get("content-security-policy");
+  if (csp) {
+    for (const directive of csp.split(";")) {
+      const [name, ...sources] = directive.trim().split(/\s+/);
+      if (name?.toLowerCase() !== "frame-ancestors") continue;
+      if (!sources.some((source) => source === "*" || source === "https:" || source === "http:")) return false;
+    }
+  }
+  return true;
+}
+
+/** Loopback, private, link-local and other non-public addresses, which the server must never be made to fetch. */
+export function isPrivateAddress(address: string): boolean {
+  const v4 = address.startsWith("::ffff:") ? address.slice(7) : address;
+  if (isIP(v4) === 4) {
+    const [a, b] = v4.split(".").map(Number);
+    return a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b <= 127) || (a === 169 && b === 254)
+      || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || a >= 224;
+  }
+  const v6 = address.toLowerCase();
+  return v6 === "::" || v6 === "::1" || v6.startsWith("fc") || v6.startsWith("fd") || v6.startsWith("fe80");
+}
+
+/** A plain public http(s) address on the default port whose host resolves only to public addresses, else null. */
+export async function publicHttpUrl(raw: string): Promise<URL | null> {
+  let url: URL;
+  try { url = new URL(raw); } catch { return null; }
+  if ((url.protocol !== "https:" && url.protocol !== "http:") || url.port || url.username || url.password) return null;
+  try {
+    const addresses = isIP(url.hostname) ? [{ address: url.hostname }] : await lookup(url.hostname, { all: true });
+    return addresses.length && addresses.every(({ address }) => !isPrivateAddress(address)) ? url : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Asks the page itself. Anything that fails (bad address, error status, timeout, too many redirects) counts as not frameable. */
+export async function checkSourceFrameable(raw: string, { timeoutMs = 5000, maxRedirects = 4 } = {}): Promise<boolean> {
+  let next = await publicHttpUrl(raw);
+  for (let hop = 0; next && hop <= maxRedirects; hop += 1) {
+    let response: Response;
+    try {
+      response = await fetch(next, { method: "GET", redirect: "manual", signal: AbortSignal.timeout(timeoutMs), headers: { accept: "text/html" } });
+    } catch {
+      return false;
+    }
+    void response.body?.cancel();
+    const location = response.headers.get("location");
+    if (response.status >= 300 && response.status < 400 && location) {
+      next = await publicHttpUrl(new URL(location, next).toString());
+      continue;
+    }
+    return response.ok && frameableFromHeaders(response.headers);
+  }
+  return false;
+}

package/package.json

@@ -114,7 +114,6 @@
     "./components/newsroom-mobile-navigation": "./components/newsroom-mobile-navigation.tsx",
     "./components/newsroom-ops-overview": "./components/newsroom-ops-overview.tsx",
     "./components/newsroom-ops-shell": "./components/newsroom-ops-shell.tsx",
-    "./components/newsroom-overview-skeleton": "./components/newsroom-overview-skeleton.tsx",
     "./components/newsroom-references-view": "./components/newsroom-references-view.tsx",
     "./components/newsroom-theme-fonts/broadsheet-green": "./components/newsroom-theme-fonts/broadsheet-green.tsx",
     "./components/newsroom-theme-fonts/newspaper-gothic": "./components/newsroom-theme-fonts/newspaper-gothic.tsx",
@@ -164,6 +163,7 @@
     "./components/story-reporting-trail-client": "./components/story-reporting-trail-client.ts",
     "./components/story-reporting-trail": "./components/story-reporting-trail.tsx",
     "./components/topic-steering-workspace": "./components/topic-steering-workspace.tsx",
+    "./components/ui/auto-grow-textarea": "./components/ui/auto-grow-textarea.tsx",
     "./components/ui/badge": "./components/ui/badge.tsx",
     "./components/ui/button-group": "./components/ui/button-group.tsx",
     "./components/ui/button": "./components/ui/button.tsx",
@@ -368,6 +368,7 @@
     "./lib/site-renderer": "./lib/site-renderer.ts",
     "./lib/site-section-suggestions": "./lib/site-section-suggestions.ts",
     "./lib/site-stack": "./lib/site-stack.ts",
+    "./lib/source-frameable": "./lib/source-frameable.ts",
     "./lib/staff-groups": "./lib/staff-groups.ts",
     "./lib/staging-gate": "./lib/staging-gate.ts",
     "./lib/staging-gated-path": "./lib/staging-gated-path.ts",
@@ -419,6 +420,7 @@
     "./app/api/newsroom/curation/context/route": "./app/api/newsroom/curation/context/route.ts",
     "./app/api/newsroom/curation/priming/route": "./app/api/newsroom/curation/priming/route.ts",
     "./app/api/newsroom/curation/publication/route": "./app/api/newsroom/curation/publication/route.ts",
+    "./app/api/newsroom/source-frameable/route": "./app/api/newsroom/source-frameable/route.ts",
     "./app/api/reader/comment/delete/route": "./app/api/reader/comment/delete/route.ts",
     "./app/api/reader/comment/edit/route": "./app/api/reader/comment/edit/route.ts",
     "./app/api/reader/comment/route": "./app/api/reader/comment/route.ts",
@@ -495,7 +497,7 @@
       "optional": true
     }
   },
-  "version": "5.48.0",
+  "version": "5.50.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.48.0",
+  "version": "5.50.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -285,6 +285,17 @@
         "runtime": "\"nodejs\""
       }
     },
+    {
+      "file": "app/api/newsroom/source-frameable/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/reader/comment/delete/route.ts",
       "hasDefault": false,

package/components/newsroom-overview-skeleton.tsx

@@ -1,25 +0,0 @@
-"use client";
-
-import * as React from "react";
-
-/** Placeholder geometry for the overview while private records or access are unresolved. */
-export function NewsroomOverviewSkeleton() {
-  return (
-    <div aria-label="Loading newsroom overview" className="space-y-8 font-sans" data-newsroom-overview-skeleton role="status">
-      <section className="newsroom-overview-feed-frame space-y-4 overflow-hidden rounded-xl border bg-card p-4" aria-label="Notification Center">
-        <div className="h-6 w-48 rounded bg-muted" />
-        <div className="h-4 w-3/4 max-w-xl rounded bg-muted" />
-        <div className="h-4 w-2/3 max-w-lg rounded bg-muted" />
-        <div className="grid gap-3 sm:grid-cols-2">
-          {Array.from({ length: 4 }, (_, index) => <div className="h-28 rounded-xl border bg-card p-4" key={index}>
-            <div className="h-4 w-2/3 rounded bg-muted" /><div className="mt-4 h-3 w-1/2 rounded bg-muted" />
-          </div>)}
-        </div>
-      </section>
-      <section aria-label="Needs attention" className="space-y-3">
-        <div className="h-4 w-32 rounded bg-muted" />
-        <div className="h-16 rounded-xl border bg-card p-4"><div className="h-4 w-1/2 rounded bg-muted" /><div className="mt-2 h-3 w-1/3 rounded bg-muted" /></div>
-      </section>
-    </div>
-  );
-}