@anthusai/papyrus 0.0.0 → 1.0.0-next.2

package/amplify/functions/slack-delivery/resource.js

@@ -0,0 +1,38 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+// Repo root in a checkout, package root when installed from npm.
+const projectRoot = path.resolve(dirname, "../../..");
+export const slackDelivery = defineFunction((scope) => {
+    return new Function(scope, "papyrus-slack-delivery", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(60),
+        memorySize: 512,
+        code: pythonLambdaCode({
+            functionDir: "slack-delivery",
+            modules: ["papyrus_newsroom", "papyrus_content"],
+            requirements: ["PyYAML>=6.0.2,<7.0.0", "boto3>=1.34.0,<2.0.0"],
+            checkoutExtras(outputDir) {
+                execSync(`python3 -m pip install -r "${path.join(dirname, "requirements.txt")}" -t "${outputDir}" --no-cache-dir`, { cwd: projectRoot, stdio: "inherit" });
+            },
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_newsroom /asset-output/papyrus_content",
+                "cp amplify/functions/slack-delivery/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_newsroom/. /asset-output/papyrus_newsroom/",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/slack-delivery/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/slack-delivery/resource.ts

@@ -0,0 +1,51 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+// Repo root in a checkout, package root when installed from npm.
+const projectRoot = path.resolve(dirname, "../../..");
+
+export const slackDelivery = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-slack-delivery", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(60),
+      memorySize: 512,
+      code: pythonLambdaCode(
+        {
+          functionDir: "slack-delivery",
+          modules: ["papyrus_newsroom", "papyrus_content"],
+          requirements: ["PyYAML>=6.0.2,<7.0.0", "boto3>=1.34.0,<2.0.0"],
+          checkoutExtras(outputDir) {
+            execSync(
+              `python3 -m pip install -r "${path.join(dirname, "requirements.txt")}" -t "${outputDir}" --no-cache-dir`,
+              { cwd: projectRoot, stdio: "inherit" },
+            );
+          },
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_newsroom /asset-output/papyrus_content",
+            "cp amplify/functions/slack-delivery/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_newsroom/. /asset-output/papyrus_newsroom/",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "python3 -m pip install -r amplify/functions/slack-delivery/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/functions/slack-events/handler.ts

@@ -0,0 +1,155 @@
+import {
+  buildSlackPrompt,
+  chatMessageIdForSlackEvent,
+  shouldIgnoreSlackEvent,
+  slackSigningSecret,
+  slackThreadId,
+  verifySlackRequestSignature,
+} from "../shared/slack-events";
+import { enqueueConsoleChatTurn } from "../shared/console-chat-enqueue";
+import { getLambdaDataClient, LAMBDA_DATA_AUTH_MODE } from "../shared/lambda-data-client";
+
+type FunctionUrlEvent = {
+  headers?: Record<string, string | undefined>;
+  body?: string | null;
+  isBase64Encoded?: boolean;
+};
+
+export const handler = async (event: FunctionUrlEvent) => {
+  const rawBody = decodeBody(event);
+  const headers = normalizeHeaders(event.headers ?? {});
+  const timestamp = headers["x-slack-request-timestamp"] ?? "";
+  const signature = headers["x-slack-signature"] ?? "";
+
+  let payload: Record<string, unknown>;
+  try {
+    payload = JSON.parse(rawBody.toString("utf8")) as Record<string, unknown>;
+  } catch {
+    return jsonResponse(400, { ok: false, error: "invalid-json" });
+  }
+
+  const payloadType = String(payload.type ?? "").trim();
+  if (payloadType === "url_verification") {
+    // Slack only checks that the endpoint echoes `challenge` (no signature on this step).
+    // Match slack_agent.py; real events below still require a valid signing secret.
+    const challenge = String(payload.challenge ?? "").trim();
+    if (!challenge) {
+      return jsonResponse(400, { ok: false, error: "missing-challenge" });
+    }
+    return jsonResponse(200, { challenge });
+  }
+
+  let secret: string;
+  try {
+    secret = await slackSigningSecret();
+  } catch (error) {
+    return jsonResponse(500, {
+      ok: false,
+      error: error instanceof Error ? error.message : "PAPYRUS_SLACK_SIGNING_SECRET is not configured.",
+    });
+  }
+  if (!verifySlackRequestSignature({ signingSecret: secret, timestamp, rawBody, signature })) {
+    return jsonResponse(401, { ok: false, error: "invalid-slack-signature" });
+  }
+
+  if (payloadType !== "event_callback") {
+    return jsonResponse(200, { ok: true, ignored: true, reason: `unsupported-type:${payloadType || "missing"}` });
+  }
+
+  const eventId = String(payload.event_id ?? "").trim();
+  const teamId = String(payload.team_id ?? "").trim() || null;
+  const slackEvent = payload.event;
+  if (!slackEvent || typeof slackEvent !== "object") {
+    return jsonResponse(400, { ok: false, error: "missing-event" });
+  }
+
+  const eventRecord = slackEvent as Record<string, unknown>;
+  const eventType = String(eventRecord.type ?? "").trim();
+  if (eventType !== "message" && eventType !== "app_mention") {
+    return jsonResponse(200, { ok: true, ignored: true, reason: `unsupported-event:${eventType}` });
+  }
+
+  const ignoreReason = shouldIgnoreSlackEvent(eventRecord);
+  if (ignoreReason) {
+    return jsonResponse(200, { ok: true, ignored: true, reason: ignoreReason });
+  }
+
+  const channelId = String(eventRecord.channel ?? "").trim();
+  const threadTs = String(eventRecord.thread_ts ?? eventRecord.ts ?? "").trim();
+  if (!channelId || !threadTs) {
+    return jsonResponse(400, { ok: false, error: "missing-channel-or-ts" });
+  }
+
+  const resolvedEventId = eventId || `${eventType}-${threadTs}`;
+  const chatMessageId = chatMessageIdForSlackEvent(resolvedEventId);
+  const dataClient = await getLambdaDataClient();
+  const existing = await dataClient.models.Message.get(
+    { id: chatMessageId },
+    { authMode: LAMBDA_DATA_AUTH_MODE },
+  );
+  if (existing.data?.id) {
+    return jsonResponse(200, { ok: true, idempotent: true, chatMessageId });
+  }
+
+  const user = String(eventRecord.user ?? "slack-user").trim();
+  const threadId = slackThreadId(teamId ?? "", channelId, threadTs);
+  const prompt = buildSlackPrompt({
+    event: eventRecord,
+    teamId,
+    channelId,
+    threadTs,
+  });
+
+  const chat = await enqueueConsoleChatTurn(dataClient, {
+    threadId,
+    threadTitle: `Slack ${channelId}`,
+    threadSummary: "Slack agent conversation",
+    primaryAnchorKind: "slack_thread",
+    primaryAnchorId: threadId,
+    createdByLabel: `slack:${user}`,
+    prompt,
+    messageSummary: String(eventRecord.text ?? "Slack message").slice(0, 180),
+    source: "slack",
+    channel: "slack",
+    channelMetadata: {
+      slackTeamId: teamId,
+      slackChannelId: channelId,
+      slackThreadTs: threadTs,
+      slackUserId: user,
+      slackEventId: resolvedEventId,
+    },
+    threadMetadata: {
+      slackTeamId: teamId,
+      slackChannelId: channelId,
+      slackThreadTs: threadTs,
+    },
+    captureModelContext: true,
+    chatMessageId,
+  });
+
+  return jsonResponse(200, { ok: true, chat, eventId: resolvedEventId });
+};
+
+function decodeBody(event: FunctionUrlEvent): Buffer {
+  const body = event.body ?? "";
+  if (event.isBase64Encoded) {
+    return Buffer.from(body, "base64");
+  }
+  return Buffer.from(body, "utf8");
+}
+
+function normalizeHeaders(headers: Record<string, string | undefined>): Record<string, string> {
+  const normalized: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (typeof value === "string") normalized[key.toLowerCase()] = value;
+  }
+  return normalized;
+}
+
+function jsonResponse(statusCode: number, body: unknown) {
+  return {
+    statusCode,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  };
+}

package/amplify/functions/slack-events/resource.js

@@ -0,0 +1,11 @@
+import { defineFunction, secret } from "@aws-amplify/backend";
+export const slackEvents = defineFunction({
+    name: "papyrus-slack-events",
+    entry: "./handler.ts",
+    timeoutSeconds: 30,
+    memoryMB: 512,
+    resourceGroupName: "data",
+    environment: {
+        PAPYRUS_SLACK_SIGNING_SECRET: secret("PAPYRUS_SLACK_SIGNING_SECRET"),
+    },
+});

package/amplify/functions/slack-events/resource.ts

@@ -0,0 +1,12 @@
+import { defineFunction, secret } from "@aws-amplify/backend";
+
+export const slackEvents = defineFunction({
+  name: "papyrus-slack-events",
+  entry: "./handler.ts",
+  timeoutSeconds: 30,
+  memoryMB: 512,
+  resourceGroupName: "data",
+  environment: {
+    PAPYRUS_SLACK_SIGNING_SECRET: secret("PAPYRUS_SLACK_SIGNING_SECRET"),
+  },
+});

package/amplify/inbound-email/stack.js

@@ -0,0 +1,46 @@
+import { Duration } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as eventTargets from "aws-cdk-lib/aws-events-targets";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+/** EventBridge triggers live in the data stack with the receive Lambda. */
+export class InboundEmailStack extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const receiveFunction = lambda.Function.fromFunctionArn(this, "InboundReceiveFunction", props.receiveFunctionArn);
+        const objectCreatedRule = new events.Rule(this, "PapyrusInboundEmailObjectCreated", {
+            description: "Process inbound SES MIME objects stored under inbound-email/",
+            eventPattern: {
+                source: ["aws.s3"],
+                detailType: ["Object Created"],
+                detail: {
+                    bucket: { name: [props.storageBucket.bucketName] },
+                    object: { key: [{ prefix: "inbound-email/" }] },
+                },
+            },
+            targets: [new eventTargets.LambdaFunction(receiveFunction)],
+        });
+        // fromFunctionArn does not create invoke permissions; EventBridge needs an explicit grant.
+        receiveFunction.addPermission("AllowInboundEmailEventBridgeInvoke", {
+            principal: new iam.ServicePrincipal("events.amazonaws.com"),
+            sourceArn: objectCreatedRule.ruleArn,
+        });
+        const retrySweepRule = new events.Rule(this, "PapyrusInboundEmailRetrySweep", {
+            description: "Re-process inbound MIME objects left in inbound-email/ after failures",
+            schedule: events.Schedule.rate(Duration.minutes(15)),
+            targets: [
+                new eventTargets.LambdaFunction(receiveFunction, {
+                    event: events.RuleTargetInput.fromObject({
+                        source: "papyrus.inbound-email",
+                        action: "retry-pending",
+                    }),
+                }),
+            ],
+        });
+        receiveFunction.addPermission("AllowInboundEmailRetrySweepInvoke", {
+            principal: new iam.ServicePrincipal("events.amazonaws.com"),
+            sourceArn: retrySweepRule.ruleArn,
+        });
+    }
+}

package/amplify/inbound-email/stack.ts

@@ -0,0 +1,61 @@
+import { Duration, type StackProps } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as eventTargets from "aws-cdk-lib/aws-events-targets";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import { Construct } from "constructs";
+
+export type InboundEmailStackProps = StackProps & {
+  storageBucket: s3.IBucket;
+  receiveFunctionArn: string;
+};
+
+/** EventBridge triggers live in the data stack with the receive Lambda. */
+export class InboundEmailStack extends Construct {
+  constructor(scope: Construct, id: string, props: InboundEmailStackProps) {
+    super(scope, id);
+
+    const receiveFunction = lambda.Function.fromFunctionArn(
+      this,
+      "InboundReceiveFunction",
+      props.receiveFunctionArn,
+    );
+
+    const objectCreatedRule = new events.Rule(this, "PapyrusInboundEmailObjectCreated", {
+      description: "Process inbound SES MIME objects stored under inbound-email/",
+      eventPattern: {
+        source: ["aws.s3"],
+        detailType: ["Object Created"],
+        detail: {
+          bucket: { name: [props.storageBucket.bucketName] },
+          object: { key: [{ prefix: "inbound-email/" }] },
+        },
+      },
+      targets: [new eventTargets.LambdaFunction(receiveFunction)],
+    });
+
+    // fromFunctionArn does not create invoke permissions; EventBridge needs an explicit grant.
+    receiveFunction.addPermission("AllowInboundEmailEventBridgeInvoke", {
+      principal: new iam.ServicePrincipal("events.amazonaws.com"),
+      sourceArn: objectCreatedRule.ruleArn,
+    });
+
+    const retrySweepRule = new events.Rule(this, "PapyrusInboundEmailRetrySweep", {
+      description: "Re-process inbound MIME objects left in inbound-email/ after failures",
+      schedule: events.Schedule.rate(Duration.minutes(15)),
+      targets: [
+        new eventTargets.LambdaFunction(receiveFunction, {
+          event: events.RuleTargetInput.fromObject({
+            source: "papyrus.inbound-email",
+            action: "retry-pending",
+          }),
+        }),
+      ],
+    });
+    receiveFunction.addPermission("AllowInboundEmailRetrySweepInvoke", {
+      principal: new iam.ServicePrincipal("events.amazonaws.com"),
+      sourceArn: retrySweepRule.ruleArn,
+    });
+  }
+}

package/amplify/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/amplify/site-backend-config.js

@@ -0,0 +1 @@
+export {};

package/amplify/site-backend-config.ts

@@ -0,0 +1,30 @@
+/**
+ * Per-site backend configuration: the argument of `defineSiteBackend(site)`.
+ * Config is passed in; the environment is only a fallback so Papyrus's own
+ * `amplify/backend.ts` keeps its current behaviour.
+ */
+export type PapyrusAuthConfig = {
+  /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
+  redirectUrls?: string[];
+  disableGoogleOAuth?: boolean;
+  /** Stable Cognito hosted-UI domain prefix. */
+  cognitoDomainPrefix?: string;
+};
+
+export type PapyrusSiteBackendConfig = {
+  /** Brand id; namespaces account-global resources (S3 Vectors index name). */
+  brandId?: string;
+  /**
+   * Amplify app id whose `main` branch is this site's production pipeline.
+   * Owns the account-global resources (SES rule set, backup vault, legacy
+   * S3 Vectors index name). Unset for sandbox/scratch/new sites.
+   */
+  productionAppId?: string;
+  auth?: PapyrusAuthConfig;
+  features?: {
+    consoleResponder?: boolean;
+    inboundEmail?: boolean;
+    slack?: boolean;
+    storageBackups?: boolean;
+  };
+};