@anthusai/papyrus 0.0.0 → 1.0.0-next.10

package/amplify/functions/content-actions/handler.py

@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+import json
+import os
+from typing import Any
+
+from papyrus_content.graphql_authoring import create_authoring_client
+from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.rebuild_trigger import (
+    DEFAULT_STAGING_BRANCH,
+    reader_target_from_environment,
+    trigger_pretext_revalidation,
+    trigger_rebuild,
+    trigger_staging_build,
+)
+from papyrus_content.publishing import (
+    ItemFields,
+    PublishError,
+    publish_item,
+    save_item,
+    unpublish_item,
+)
+
+
+def parse_input(raw: Any) -> dict:
+    parsed = json.loads(raw) if isinstance(raw, (str, bytes)) else raw
+    if not isinstance(parsed, dict):
+        raise PublishError("invalid-input", "The input must be a JSON object.")
+    return parsed
+
+
+def actor_from_event(event: dict) -> str:
+    identity = event.get("identity") or {}
+    return identity.get("username") or identity.get("sub") or "unknown"
+
+
+def failure_response(error: PublishError) -> dict:
+    if error.errors:
+        errors = [body_error.to_dict() for body_error in error.errors]
+    else:
+        errors = [{"code": error.code, "message": error.message, "line": None}]
+    return {"ok": False, "errors": errors}
+
+
+def derive_markus_action(arguments: dict) -> dict:
+    derivation = derive_body(arguments.get("frontMatterYaml"), arguments.get("bodyMarkus") or "")
+    if not derivation.ok:
+        return {"ok": False, "errors": [body_error.to_dict() for body_error in derivation.errors]}
+    response = {
+        "ok": True,
+        "bodyIrBytes": len(json.dumps(derivation.body_ir, separators=(",", ":")).encode("utf-8")),
+        "errors": [],
+    }
+    if arguments.get("includeIr") is True:
+        response["bodyIr"] = derivation.body_ir
+    return response
+
+
+def save_item_draft_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    fields = ItemFields(
+        type=arguments["type"],
+        slug=arguments["slug"],
+        section=arguments.get("section"),
+        front_matter_yaml=arguments.get("frontMatterYaml"),
+        body_markus=arguments.get("bodyMarkus") or "",
+        aliases=list(arguments.get("aliases") or []),
+        id=arguments.get("id"),
+    )
+    record = save_item(client, fields, actor=actor, expected_content_hash=arguments.get("expectedContentHash"))
+    return {
+        "ok": True,
+        "item": {
+            "id": record["id"],
+            "contentHash": record["contentHash"],
+            "status": record["status"],
+            "slug": record["slug"],
+            "versionNumber": record.get("versionNumber"),
+        },
+    }
+
+
+def site_triggers_for(client, item_id: str) -> dict:
+    triggers: dict = {}
+    reader_app_id, reader_branch = reader_target_from_environment()
+    revalidate_base_url = (os.environ.get("PAPYRUS_REVALIDATE_BASE_URL") or "").strip()
+    if revalidate_base_url:
+        try:
+            item = client.get_record("Item", item_id) or {}
+            slugs = [item["slug"]] if item.get("slug") else []
+            revalidated = trigger_pretext_revalidation(slugs, None, base_url=revalidate_base_url)
+            triggers["revalidated"] = revalidated if revalidated is not None else {"ok": False, "reason": "not-configured"}
+        except Exception as error:  # noqa: BLE001 - a trigger failure never fails the publish
+            triggers["revalidated"] = {"ok": False, "error": f"{type(error).__name__}: {error}"}
+    if reader_app_id:
+        triggers["rebuild"] = trigger_rebuild(reader_app_id=reader_app_id, reader_branch=reader_branch)
+    return triggers
+
+
+def publish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = publish_item(client, arguments["id"], actor=actor)
+    response = {
+        "ok": True,
+        "changed": result.changed,
+        "publishedId": result.published_item_id,
+        "versionNumber": result.version_number,
+    }
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def unpublish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = unpublish_item(client, arguments["id"], actor=actor)
+    response = {"ok": True, "changed": result.changed}
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def request_staging_build_action() -> dict:
+    cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
+    if not cms_app_id:
+        return {"ok": False, "errors": [{"code": "staging-build-not-configured", "message": "This site has no staging build configured.", "line": None}]}
+    staging_branch = (os.environ.get("PAPYRUS_STAGING_BRANCH") or "").strip() or DEFAULT_STAGING_BRANCH
+    build = trigger_staging_build(cms_app_id=cms_app_id, staging_branch=staging_branch)
+    return {"ok": True, "build": build}
+
+
+def handler(event, context):
+    field = event["fieldName"]
+    arguments = parse_input(event["arguments"]["input"])
+    actor = actor_from_event(event)
+    try:
+        if field == "deriveMarkus":
+            return derive_markus_action(arguments)
+        if field == "saveItemDraft":
+            return save_item_draft_action(arguments, actor)
+        if field == "publishItem":
+            return publish_item_action(arguments, actor)
+        if field == "unpublishItem":
+            return unpublish_item_action(arguments, actor)
+        if field == "requestStagingBuild":
+            return request_staging_build_action()
+    except PublishError as error:
+        return failure_response(error)
+    raise ValueError(f"Unsupported field {field}")

package/amplify/functions/content-actions/requirements.txt

@@ -0,0 +1,4 @@
+PyYAML>=6.0.2,<7
+citeproc-py>=0.8.2,<1
+anthus-markus==0.5.1
+Pillow>=10,<12

package/amplify/functions/content-actions/resource.js

@@ -0,0 +1,40 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export const contentActions = defineFunction((scope) => {
+    return new Function(scope, "papyrus-content-actions", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(60),
+        memorySize: 1024,
+        code: pythonLambdaCode({
+            functionDir: "content-actions",
+            modules: ["papyrus_content"],
+            requirements: contentActionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/content-actions/resource.ts

@@ -0,0 +1,54 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+
+function installCheckoutRequirements(outputDir: string): void {
+  const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+  execSync(
+    `python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`,
+    { cwd: projectRoot, stdio: "inherit" },
+  );
+}
+
+export const contentActions = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-content-actions", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(60),
+      memorySize: 1024,
+      code: pythonLambdaCode(
+        {
+          functionDir: "content-actions",
+          modules: ["papyrus_content"],
+          requirements: contentActionsRequirements,
+          noDeps: true,
+          checkoutExtras: installCheckoutRequirements,
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/functions/email-submission-processor/handler.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import json
+import os
+from typing import Any
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    if isinstance(event.get("Records"), list):
+        record = event["Records"][0]
+        body = record.get("body") if isinstance(record, dict) else None
+        if isinstance(body, str):
+            event = json.loads(body)
+        elif isinstance(body, dict):
+            event = body
+
+    message_id = str(event.get("messageId") or event.get("message_id") or "").strip()
+    if not message_id:
+        raise ValueError("messageId is required.")
+
+    if event.get("sendFeedbackOnly") or event.get("send_feedback_only"):
+        from papyrus_content.graphql_authoring import PapyrusGraphQLAuthoringClient
+        from papyrus_newsroom.email_submissions import send_submission_feedback_for_message
+
+        endpoint = os.environ.get("PAPYRUS_GRAPHQL_ENDPOINT", "").strip()
+        client = PapyrusGraphQLAuthoringClient(endpoint=endpoint or None)
+        return send_submission_feedback_for_message(client, message_id=message_id)
+
+    corpus_key = str(
+        event.get("corpusKey")
+        or event.get("corpus_key")
+        or os.environ.get("PAPYRUS_INBOUND_EMAIL_CORPUS_KEY")
+        or "AI-ML-research"
+    ).strip()
+
+    from papyrus_content.graphql_authoring import PapyrusGraphQLAuthoringClient
+    from papyrus_newsroom.email_submissions import process_email_submission_message
+
+    endpoint = os.environ.get("PAPYRUS_GRAPHQL_ENDPOINT", "").strip()
+    client = PapyrusGraphQLAuthoringClient(endpoint=endpoint or None)
+    return process_email_submission_message(
+        client,
+        message_id=message_id,
+        corpus_key=corpus_key,
+        apply=True,
+    )

package/amplify/functions/email-submission-processor/requirements.txt

@@ -0,0 +1,2 @@
+PyYAML>=6.0.2,<7
+requests>=2.32.3,<3

package/amplify/functions/email-submission-processor/resource.js

@@ -0,0 +1,56 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+function copyCheckoutCorpora(outputDir) {
+    const corporaDir = path.join(outputDir, "corpora");
+    fs.mkdirSync(corporaDir, { recursive: true });
+    for (const entry of fs.readdirSync(path.join(projectRoot, "corpora"))) {
+        if (!entry.endsWith(".yml"))
+            continue;
+        fs.copyFileSync(path.join(projectRoot, "corpora", entry), path.join(corporaDir, entry));
+    }
+    installPythonRequirements(outputDir);
+}
+function installPythonRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/email-submission-processor/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir`, {
+        cwd: projectRoot,
+        stdio: "inherit",
+    });
+}
+export const emailSubmissionProcessor = defineFunction((scope) => {
+    return new Function(scope, "papyrus-email-submission-processor", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.minutes(5),
+        memorySize: 1024,
+        code: pythonLambdaCode({
+            functionDir: "email-submission-processor",
+            modules: ["papyrus_newsroom", "papyrus_content", "papyrus_knowledge_query"],
+            requirements: ["PyYAML>=6.0.2,<7", "requests>=2.32.3,<3", "boto3>=1.34.0,<2.0.0"],
+            corpora: true,
+            checkoutExtras: copyCheckoutCorpora,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_newsroom /asset-output/papyrus_content /asset-output/papyrus_knowledge_query /asset-output/corpora",
+                "cp amplify/functions/email-submission-processor/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_newsroom/. /asset-output/papyrus_newsroom/",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "cp -R src/papyrus_knowledge_query/. /asset-output/papyrus_knowledge_query/",
+                "cp corpora/*.yml /asset-output/corpora/",
+                "python3 -m pip install -r amplify/functions/email-submission-processor/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/email-submission-processor/resource.ts

@@ -0,0 +1,69 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+
+function copyCheckoutCorpora(outputDir: string): void {
+  const corporaDir = path.join(outputDir, "corpora");
+  fs.mkdirSync(corporaDir, { recursive: true });
+  for (const entry of fs.readdirSync(path.join(projectRoot, "corpora"))) {
+    if (!entry.endsWith(".yml")) continue;
+    fs.copyFileSync(path.join(projectRoot, "corpora", entry), path.join(corporaDir, entry));
+  }
+  installPythonRequirements(outputDir);
+}
+
+function installPythonRequirements(outputDir: string): void {
+  const requirementsPath = path.join(
+    projectRoot,
+    "amplify/functions/email-submission-processor/requirements.txt",
+  );
+  execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir`, {
+    cwd: projectRoot,
+    stdio: "inherit",
+  });
+}
+
+export const emailSubmissionProcessor = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-email-submission-processor", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.minutes(5),
+      memorySize: 1024,
+      code: pythonLambdaCode(
+        {
+          functionDir: "email-submission-processor",
+          modules: ["papyrus_newsroom", "papyrus_content", "papyrus_knowledge_query"],
+          requirements: ["PyYAML>=6.0.2,<7", "requests>=2.32.3,<3", "boto3>=1.34.0,<2.0.0"],
+          corpora: true,
+          checkoutExtras: copyCheckoutCorpora,
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_newsroom /asset-output/papyrus_content /asset-output/papyrus_knowledge_query /asset-output/corpora",
+            "cp amplify/functions/email-submission-processor/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_newsroom/. /asset-output/papyrus_newsroom/",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "cp -R src/papyrus_knowledge_query/. /asset-output/papyrus_knowledge_query/",
+            "cp corpora/*.yml /asset-output/corpora/",
+            "python3 -m pip install -r amplify/functions/email-submission-processor/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/functions/graphql-jwt-authorizer/handler.ts

@@ -0,0 +1,193 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+
+type AppSyncAuthorizerEvent = {
+  authorizationToken?: string;
+};
+
+type JwtHeader = {
+  alg?: string;
+  typ?: string;
+};
+
+type JwtClaims = {
+  iss?: string;
+  sub?: string;
+  aud?: string | string[];
+  exp?: number;
+  nbf?: number;
+  iat?: number;
+  scope?: string;
+  scp?: string | string[];
+  groups?: string | string[];
+  roles?: string | string[];
+  [key: string]: unknown;
+};
+
+export const handler = async (event: AppSyncAuthorizerEvent) => {
+  try {
+    const token = normalizeAuthorizationToken(event.authorizationToken);
+    const jwtSecret = await getJwtSecret();
+    const claims = verifyHs256Jwt(token, jwtSecret);
+    assertExpectedIssuer(claims);
+    assertExpectedAudience(claims);
+    assertRequiredScope(claims);
+
+    return {
+      isAuthorized: true,
+      resolverContext: {
+        sub: claims.sub ?? "unknown",
+        iss: claims.iss ?? "unknown",
+        scope: getClaimValues(claims.scope).join(" "),
+      },
+      ttlOverride: 300,
+    };
+  } catch (error) {
+    console.warn(`JWT authorizer rejected request: ${(error as Error).message}`);
+    return {
+      isAuthorized: false,
+      ttlOverride: 0,
+    };
+  }
+};
+
+function normalizeAuthorizationToken(value: string | undefined): string {
+  const token = value
+    ?.replace(/^PapyrusJwt\s+/i, "")
+    .replace(/^papyrus-jwt:/i, "")
+    .replace(/^Bearer\s+/i, "")
+    .trim();
+  if (!token) throw new Error("Missing Authorization token.");
+  return token;
+}
+
+function verifyHs256Jwt(token: string, jwtSecret: string): JwtClaims {
+  const [encodedHeader, encodedPayload, encodedSignature] = token.split(".");
+  if (!encodedHeader || !encodedPayload || !encodedSignature) {
+    throw new Error("JWT must have header, payload, and signature.");
+  }
+
+  const header = decodeJson<JwtHeader>(encodedHeader);
+  if (header.alg !== "HS256") {
+    throw new Error(`Unsupported JWT alg ${header.alg ?? "unknown"}.`);
+  }
+
+  const claims = decodeJson<JwtClaims>(encodedPayload);
+  const expectedSignature = createHmac("sha256", jwtSecret)
+    .update(`${encodedHeader}.${encodedPayload}`)
+    .digest("base64url");
+
+  if (!constantTimeEqual(encodedSignature, expectedSignature)) {
+    throw new Error("JWT signature verification failed.");
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  if (typeof claims.exp === "number" && claims.exp <= now) {
+    throw new Error("JWT is expired.");
+  }
+  if (typeof claims.nbf === "number" && claims.nbf > now) {
+    throw new Error("JWT is not yet valid.");
+  }
+
+  return claims;
+}
+
+function decodeJson<T>(encoded: string): T {
+  try {
+    return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as T;
+  } catch {
+    throw new Error("JWT contains invalid base64url JSON.");
+  }
+}
+
+let cachedJwtSecret: string | null = null;
+let ssmClient: SSMClient | null = null;
+
+async function getJwtSecret(): Promise<string> {
+  if (cachedJwtSecret) return cachedJwtSecret;
+
+  const directSecret = normalizeOptionalString(process.env.PAPYRUS_JWT_SECRET);
+  if (directSecret && !isAmplifySecretPlaceholder(directSecret)) {
+    cachedJwtSecret = directSecret;
+    return directSecret;
+  }
+
+  const parameterName = resolveAmplifySsmSecretPath("PAPYRUS_JWT_SECRET");
+  if (!parameterName) throw new Error("PAPYRUS_JWT_SECRET is not configured.");
+  ssmClient ??= new SSMClient({});
+  const response = await ssmClient.send(new GetParameterCommand({
+    Name: parameterName,
+    WithDecryption: true,
+  }));
+  const secret = normalizeOptionalString(response.Parameter?.Value);
+  if (!secret) throw new Error(`SSM parameter ${parameterName} did not return a value.`);
+  cachedJwtSecret = secret;
+  return secret;
+}
+
+function isAmplifySecretPlaceholder(value: string): boolean {
+  return /^<.*will be resolved.*>$/i.test(value);
+}
+
+function resolveAmplifySsmSecretPath(name: string): string | null {
+  const rawConfig = normalizeOptionalString(process.env.AMPLIFY_SSM_ENV_CONFIG);
+  if (!rawConfig) return null;
+  try {
+    const config = JSON.parse(rawConfig) as Record<string, { path?: string; sharedPath?: string } | undefined>;
+    return normalizeOptionalString(config[name]?.path) ?? normalizeOptionalString(config[name]?.sharedPath);
+  } catch {
+    throw new Error("AMPLIFY_SSM_ENV_CONFIG contains invalid JSON.");
+  }
+}
+
+function normalizeOptionalString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+
+function assertExpectedIssuer(claims: JwtClaims): void {
+  const expectedIssuer = process.env.PAPYRUS_JWT_ISSUER;
+  if (expectedIssuer && claims.iss !== expectedIssuer) {
+    throw new Error("JWT issuer is not authorized.");
+  }
+}
+
+function assertExpectedAudience(claims: JwtClaims): void {
+  const expectedAudience = process.env.PAPYRUS_JWT_AUDIENCE;
+  if (!expectedAudience) return;
+
+  const audiences = Array.isArray(claims.aud) ? claims.aud : claims.aud ? [claims.aud] : [];
+  if (!audiences.includes(expectedAudience)) {
+    throw new Error("JWT audience is not authorized.");
+  }
+}
+
+function assertRequiredScope(claims: JwtClaims): void {
+  const requiredScope = process.env.PAPYRUS_JWT_REQUIRED_SCOPE;
+  if (!requiredScope) return;
+
+  const values = new Set([
+    ...getClaimValues(claims.scope),
+    ...getClaimValues(claims.scp),
+    ...getClaimValues(claims.groups),
+    ...getClaimValues(claims.roles),
+  ]);
+
+  if (!values.has(requiredScope)) {
+    throw new Error("JWT does not include the required authoring scope.");
+  }
+}
+
+function getClaimValues(value: unknown): string[] {
+  if (Array.isArray(value)) return value.flatMap(getClaimValues);
+  if (typeof value === "string") return value.split(/[,\s]+/).filter(Boolean);
+  return [];
+}
+
+function constantTimeEqual(left: string, right: string): boolean {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) return false;
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}

package/amplify/functions/graphql-jwt-authorizer/resource.js

@@ -0,0 +1,14 @@
+import { defineFunction, secret } from "@aws-amplify/backend";
+export const graphqlJwtAuthorizer = defineFunction({
+    name: "papyrus-graphql-jwt-authorizer",
+    entry: "./handler.ts",
+    timeoutSeconds: 5,
+    memoryMB: 256,
+    resourceGroupName: "data",
+    environment: {
+        PAPYRUS_JWT_SECRET: secret("PAPYRUS_JWT_SECRET"),
+        PAPYRUS_JWT_ISSUER: "papyrus-cli",
+        PAPYRUS_JWT_AUDIENCE: "papyrus-authoring",
+        PAPYRUS_JWT_REQUIRED_SCOPE: "papyrus:write",
+    },
+});

package/amplify/functions/graphql-jwt-authorizer/resource.ts

@@ -0,0 +1,15 @@
+import { defineFunction, secret } from "@aws-amplify/backend";
+
+export const graphqlJwtAuthorizer = defineFunction({
+  name: "papyrus-graphql-jwt-authorizer",
+  entry: "./handler.ts",
+  timeoutSeconds: 5,
+  memoryMB: 256,
+  resourceGroupName: "data",
+  environment: {
+    PAPYRUS_JWT_SECRET: secret("PAPYRUS_JWT_SECRET"),
+    PAPYRUS_JWT_ISSUER: "papyrus-cli",
+    PAPYRUS_JWT_AUDIENCE: "papyrus-authoring",
+    PAPYRUS_JWT_REQUIRED_SCOPE: "papyrus:write",
+  },
+});

package/amplify/functions/knowledge-query/handler.py

@@ -0,0 +1 @@
+from papyrus_knowledge_query.lambda_handler import handler

package/amplify/functions/knowledge-query/requirements.txt

@@ -0,0 +1,3 @@
+# Intentionally empty for deploy stability in Amplify Hosting CI.
+# The knowledge-query engine falls back to regex token accounting when tiktoken
+# is unavailable.