@anthusai/papyrus 1.0.0-next.2 → 1.0.0-next.21

package/amplify/data/schema.ts

@@ -1,6 +1,7 @@
 import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
+import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
@@ -271,7 +272,6 @@ export const schema = a.schema({
     .returns(a.ref("ReferenceCurationActionResult"))
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom(),
     ])
     .handler(a.handler.function(categoryAction)),
 
@@ -287,7 +287,6 @@ export const schema = a.schema({
     .returns(a.ref("ReferenceQualityActionResult"))
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom(),
     ])
     .handler(a.handler.function(categoryAction)),
 
@@ -399,16 +398,51 @@ export const schema = a.schema({
   getNewsroomSummary: a
     .query()
     .returns(a.ref("NewsroomSummary"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(newsroomSummary)),
 
+  deriveMarkus: a
+    .query()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  saveItemDraft: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  publishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  unpublishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  requestStagingBuild: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   knowledgeQuery: a
     .query()
     .arguments({
       input: a.json().required(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(knowledgeQuery)),
 
   updateNewsroomSummary: a
@@ -419,7 +453,7 @@ export const schema = a.schema({
       reason: a.string(),
     })
     .returns(a.ref("NewsroomSummary"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(newsroomSummary)),
 
   ModelAttachmentUploadSlot: a.customType({
@@ -479,7 +513,7 @@ export const schema = a.schema({
       status: a.string(),
     })
     .returns(a.ref("ModelAttachmentUploadSlot"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   completeModelAttachmentUpload: a
@@ -501,7 +535,7 @@ export const schema = a.schema({
       status: a.string(),
     })
     .returns(a.ref("ModelAttachment"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   abortModelAttachmentUpload: a
@@ -523,7 +557,7 @@ export const schema = a.schema({
       status: a.string(),
     })
     .returns(a.ref("ModelAttachmentUploadAbortResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   createModelAttachmentDownload: a
@@ -532,7 +566,7 @@ export const schema = a.schema({
       attachmentId: a.id().required(),
     })
     .returns(a.ref("ModelAttachmentDownloadSlot"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   AssignmentActionResult: a.customType({
@@ -626,7 +660,7 @@ export const schema = a.schema({
       limit: a.integer(),
     })
     .returns(a.ref("AssignmentContext").array().required())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   listAssignmentQueue: a
@@ -637,7 +671,7 @@ export const schema = a.schema({
       limit: a.integer(),
     })
     .returns(a.ref("AssignmentContext").array().required())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   getAssignmentContext: a
@@ -646,7 +680,7 @@ export const schema = a.schema({
       assignmentId: a.id().required(),
     })
     .returns(a.ref("AssignmentContext"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   claimAssignment: a
@@ -663,7 +697,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   releaseAssignment: a
@@ -675,7 +709,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   completeAssignment: a
@@ -687,7 +721,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   cancelAssignment: a
@@ -699,7 +733,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   reopenAssignment: a
@@ -711,7 +745,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   retryImmediateAssignment: a
@@ -723,7 +757,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   listNewsroomProcedureDefinitions: a
@@ -739,7 +773,7 @@ export const schema = a.schema({
       procedureKey: a.string(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.group(adminGroup), allow.custom()])
+    .authorization((allow) => [allow.group(adminGroup)])
     .handler(a.handler.function(procedureAction)),
 
   saveNewsroomProcedureDefinition: a
@@ -781,7 +815,7 @@ export const schema = a.schema({
       actorLabel: a.string(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(procedureAction)),
 
   getNewsroomProcedureRun: a
@@ -790,7 +824,7 @@ export const schema = a.schema({
       id: a.id().required(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(procedureAction)),
 
   listNewsroomProcedureRunsByProcedure: a
@@ -799,7 +833,7 @@ export const schema = a.schema({
       procedureId: a.id().required(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(procedureAction)),
 
   Assignment: modelWithoutSubscriptions({
@@ -849,7 +883,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
       allow.authenticated("identityPool").to(authoringOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   AssignmentEvent: modelWithoutSubscriptions({
@@ -872,7 +905,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   ProcedureDefinition: modelWithoutSubscriptions({
@@ -897,7 +929,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.group(adminGroup),
-      allow.custom().to(authoringOperations),
     ]),
 
   ProcedureVersion: modelWithoutSubscriptions({
@@ -924,7 +955,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.group(adminGroup),
-      allow.custom().to(authoringOperations),
     ]),
 
   ProcedureRun: modelWithoutSubscriptions({
@@ -957,7 +987,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.group("editor").to(["read"]),
       allow.group(adminGroup).to(authoringOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   NewsroomSection: modelWithoutSubscriptions({
@@ -985,7 +1014,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeCorpus: modelWithoutSubscriptions({
@@ -1003,7 +1031,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeImportRun: modelWithoutSubscriptions({
@@ -1031,7 +1058,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeRawPayload: modelWithoutSubscriptions({
@@ -1049,7 +1075,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeArtifact: modelWithoutSubscriptions({
@@ -1069,7 +1094,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   CategorySet: modelWithoutSubscriptions({
@@ -1099,7 +1123,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   Category: modelWithoutSubscriptions({
@@ -1141,7 +1164,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   CategoryKeyword: modelWithoutSubscriptions({
@@ -1170,7 +1192,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   LexicalSteeringRule: modelWithoutSubscriptions({
@@ -1199,7 +1220,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   SteeringProposal: modelWithoutSubscriptions({
@@ -1237,7 +1257,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   SteeringDecision: modelWithoutSubscriptions({
@@ -1257,7 +1276,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   Reference: realtimeModel({
@@ -1309,7 +1327,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   ReferenceAttachment: modelWithoutSubscriptions({
@@ -1339,7 +1356,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   SemanticNode: modelWithoutSubscriptions({
@@ -1377,7 +1393,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   Message: realtimeModel({
@@ -1426,7 +1441,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   MessageThread: realtimeModel({
@@ -1464,7 +1478,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read", "create", "update"]),
       allow.authenticated("identityPool").to(authoringOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   ModelAttachment: modelWithoutSubscriptions({
@@ -1496,7 +1509,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   SemanticRelationType: modelWithoutSubscriptions({
@@ -1524,7 +1536,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   SemanticRelation: modelWithoutSubscriptions({
@@ -1575,7 +1586,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   Item: modelWithoutSubscriptions({
@@ -1625,7 +1635,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   Tag: modelWithoutSubscriptions({
@@ -1642,7 +1651,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   ItemTag: modelWithoutSubscriptions({
@@ -1662,7 +1670,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   MediaAsset: modelWithoutSubscriptions({
@@ -1695,7 +1702,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   Edition: modelWithoutSubscriptions({
@@ -1727,7 +1733,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   EditionItem: modelWithoutSubscriptions({
@@ -1750,7 +1755,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedItem: modelWithoutSubscriptions({
@@ -1791,7 +1795,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedMediaAsset: modelWithoutSubscriptions({
@@ -1827,7 +1830,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedEdition: modelWithoutSubscriptions({
@@ -1853,7 +1855,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedEditionItem: modelWithoutSubscriptions({
@@ -1878,7 +1879,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedCategorySet: modelWithoutSubscriptions({
@@ -1904,7 +1904,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedCategory: modelWithoutSubscriptions({
@@ -1940,10 +1939,10 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 }).authorization((allow) => [
   allow.resource(categoryAction),
+  allow.resource(contentActions),
   allow.resource(manageUserRole),
   allow.resource(modelAttachmentUpload),
   allow.resource(newsroomSummary),

package/amplify/functions/console-chat-responder/py/execute_tactus_runner.py

@@ -2,7 +2,6 @@
 from __future__ import annotations
 
 import json
-import os
 import sys
 from pathlib import Path
 from typing import Any
@@ -16,14 +15,6 @@ for root in SEARCH_PATHS:
         sys.path.insert(0, str(root))
 
 
-def _ensure_graphql_authoring_jwt() -> None:
-    if not os.environ.get("AWS_LAMBDA_FUNCTION_NAME", "").strip():
-        return
-    from papyrus_content.env import ensure_graphql_authoring_jwt  # type: ignore
-
-    ensure_graphql_authoring_jwt()
-
-
 def _error(code: str, message: str, *, retryable: bool = False) -> dict[str, Any]:
     return {
         "ok": False,
@@ -94,7 +85,6 @@ def _execute_tactus(arguments: dict[str, Any], web_ui_context: dict[str, Any] |
 
 
 def main() -> None:
-    _ensure_graphql_authoring_jwt()
     raw = sys.stdin.read()
     payload = json.loads(raw or "{}")
     mode = str(payload.get("mode") or "").strip()

package/amplify/functions/console-chat-responder/resource.js

@@ -19,11 +19,6 @@ export class ConsoleChatResponderStack extends NestedStack {
             PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS: process.env.PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS || "900",
             PAPYRUS_EXECUTE_TACTUS_RUNNER: process.env.PAPYRUS_EXECUTE_TACTUS_RUNNER || "/opt/papyrus/execute_tactus_runner.py",
             PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS: process.env.PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS || "30",
-            PAPYRUS_JWT_ISSUER: process.env.PAPYRUS_JWT_ISSUER || "papyrus-cli",
-            PAPYRUS_JWT_SUBJECT: process.env.PAPYRUS_JWT_SUBJECT || "papyrus-cli",
-            PAPYRUS_JWT_AUDIENCE: process.env.PAPYRUS_JWT_AUDIENCE || "papyrus-authoring",
-            PAPYRUS_JWT_GROUPS: process.env.PAPYRUS_JWT_GROUPS || "editor",
-            ...(props.amplifySsmEnvConfig ? { AMPLIFY_SSM_ENV_CONFIG: props.amplifySsmEnvConfig } : {}),
         };
         const imageUri = props.prebuiltImageUri?.trim() || process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI?.trim() || "";
         const allowLocalImageBuild = parseBooleanEnv(process.env.PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD);
@@ -87,8 +82,6 @@ export class ConsoleChatResponderStack extends NestedStack {
             ],
         }));
         const stack = Stack.of(this);
-        // execute_tactus_runner mints PAPYRUS_GRAPHQL_JWT via boto3 get_parameters; branch policies
-        // often grant GetParameters on path prefixes, not GetParameter per secret name.
         this.responderFunction.addToRolePolicy(new PolicyStatement({
             effect: Effect.ALLOW,
             actions: ["ssm:GetParameter", "ssm:GetParameters"],

package/amplify/functions/console-chat-responder/resource.ts

@@ -12,7 +12,6 @@ export type ConsoleChatResponderStackProps = NestedStackProps & {
   threadTable: ITable;
   projectRoot: string;
   graphqlEndpoint: string;
-  amplifySsmEnvConfig?: string;
   responseTarget?: string;
   model?: string;
   prebuiltImageUri?: string;
@@ -36,11 +35,6 @@ export class ConsoleChatResponderStack extends NestedStack {
       PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS: process.env.PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS || "900",
       PAPYRUS_EXECUTE_TACTUS_RUNNER: process.env.PAPYRUS_EXECUTE_TACTUS_RUNNER || "/opt/papyrus/execute_tactus_runner.py",
       PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS: process.env.PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS || "30",
-      PAPYRUS_JWT_ISSUER: process.env.PAPYRUS_JWT_ISSUER || "papyrus-cli",
-      PAPYRUS_JWT_SUBJECT: process.env.PAPYRUS_JWT_SUBJECT || "papyrus-cli",
-      PAPYRUS_JWT_AUDIENCE: process.env.PAPYRUS_JWT_AUDIENCE || "papyrus-authoring",
-      PAPYRUS_JWT_GROUPS: process.env.PAPYRUS_JWT_GROUPS || "editor",
-      ...(props.amplifySsmEnvConfig ? { AMPLIFY_SSM_ENV_CONFIG: props.amplifySsmEnvConfig } : {}),
     };
 
     const imageUri = props.prebuiltImageUri?.trim() || process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI?.trim() || "";
@@ -109,8 +103,6 @@ export class ConsoleChatResponderStack extends NestedStack {
       ],
     }));
     const stack = Stack.of(this);
-    // execute_tactus_runner mints PAPYRUS_GRAPHQL_JWT via boto3 get_parameters; branch policies
-    // often grant GetParameters on path prefixes, not GetParameter per secret name.
     this.responderFunction.addToRolePolicy(new PolicyStatement({
       effect: Effect.ALLOW,
       actions: ["ssm:GetParameter", "ssm:GetParameters"],

package/amplify/functions/console-chat-responder/src/main.rs

@@ -3017,15 +3017,6 @@ fn optional_env(name: &str) -> Option<String> {
         .filter(|value| !value.is_empty())
 }
 
-fn normalize_jwt(token: String) -> String {
-    token
-        .trim()
-        .trim_start_matches("Bearer ")
-        .trim_start_matches("bearer ")
-        .trim()
-        .to_string()
-}
-
 fn format_error_chain(error: &anyhow::Error) -> String {
     error
         .chain()