@anthusai/papyrus 1.0.0-next.2 → 1.0.0-next.3

package/amplify/data/resource.js

@@ -2,6 +2,7 @@ import { a, defineData } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
 import { graphqlJwtAuthorizer } from "../functions/graphql-jwt-authorizer/resource.js";
+import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource.js";
@@ -468,6 +469,30 @@ const schema = a.schema({
         .returns(a.ref("NewsroomSummary"))
         .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
         .handler(a.handler.function(newsroomSummary)),
+    deriveMarkus: a
+        .query()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    saveItemDraft: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    publishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    unpublishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     knowledgeQuery: a
         .query()
         .arguments({
@@ -2012,6 +2037,7 @@ const schema = a.schema({
     ]),
 }).authorization((allow) => [
     allow.resource(categoryAction),
+    allow.resource(contentActions),
     allow.resource(manageUserRole),
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),

package/amplify/data/resource.ts

@@ -2,6 +2,7 @@ import { type ClientSchema, a, defineData } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
 import { graphqlJwtAuthorizer } from "../functions/graphql-jwt-authorizer/resource";
+import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
@@ -508,6 +509,34 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
     .handler(a.handler.function(newsroomSummary)),
 
+  deriveMarkus: a
+    .query()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  saveItemDraft: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  publishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  unpublishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   knowledgeQuery: a
     .query()
     .arguments({
@@ -2120,6 +2149,7 @@ const schema = a.schema({
     ]),
 }).authorization((allow) => [
   allow.resource(categoryAction),
+  allow.resource(contentActions),
   allow.resource(manageUserRole),
   allow.resource(modelAttachmentUpload),
   allow.resource(newsroomSummary),

package/amplify/data/schema.js

@@ -1,6 +1,7 @@
 import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
+import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource.js";
@@ -368,6 +369,30 @@ export const schema = a.schema({
         .returns(a.ref("NewsroomSummary"))
         .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
         .handler(a.handler.function(newsroomSummary)),
+    deriveMarkus: a
+        .query()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    saveItemDraft: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    publishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    unpublishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     knowledgeQuery: a
         .query()
         .arguments({
@@ -1843,6 +1868,7 @@ export const schema = a.schema({
     ]),
 }).authorization((allow) => [
     allow.resource(categoryAction),
+    allow.resource(contentActions),
     allow.resource(manageUserRole),
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),

package/amplify/data/schema.ts

@@ -1,6 +1,7 @@
 import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
+import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
@@ -402,6 +403,34 @@ export const schema = a.schema({
     .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
     .handler(a.handler.function(newsroomSummary)),
 
+  deriveMarkus: a
+    .query()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  saveItemDraft: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  publishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  unpublishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   knowledgeQuery: a
     .query()
     .arguments({
@@ -1944,6 +1973,7 @@ export const schema = a.schema({
     ]),
 }).authorization((allow) => [
   allow.resource(categoryAction),
+  allow.resource(contentActions),
   allow.resource(manageUserRole),
   allow.resource(modelAttachmentUpload),
   allow.resource(newsroomSummary),

package/amplify/functions/content-actions/handler.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from papyrus_content.graphql_authoring import create_authoring_client
+from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.publishing import (
+    ItemFields,
+    PublishError,
+    publish_item,
+    save_item,
+    unpublish_item,
+)
+
+
+def parse_input(raw: Any) -> dict:
+    parsed = json.loads(raw) if isinstance(raw, (str, bytes)) else raw
+    if not isinstance(parsed, dict):
+        raise PublishError("invalid-input", "The input must be a JSON object.")
+    return parsed
+
+
+def actor_from_event(event: dict) -> str:
+    identity = event.get("identity") or {}
+    return identity.get("username") or identity.get("sub") or "unknown"
+
+
+def failure_response(error: PublishError) -> dict:
+    if error.errors:
+        errors = [body_error.to_dict() for body_error in error.errors]
+    else:
+        errors = [{"code": error.code, "message": error.message, "line": None}]
+    return {"ok": False, "errors": errors}
+
+
+def derive_markus_action(arguments: dict) -> dict:
+    derivation = derive_body(arguments.get("frontMatterYaml"), arguments.get("bodyMarkus") or "")
+    if not derivation.ok:
+        return {"ok": False, "errors": [body_error.to_dict() for body_error in derivation.errors]}
+    response = {
+        "ok": True,
+        "bodyIrBytes": len(json.dumps(derivation.body_ir, separators=(",", ":")).encode("utf-8")),
+        "errors": [],
+    }
+    if arguments.get("includeIr") is True:
+        response["bodyIr"] = derivation.body_ir
+    return response
+
+
+def save_item_draft_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    fields = ItemFields(
+        type=arguments["type"],
+        slug=arguments["slug"],
+        section=arguments.get("section"),
+        front_matter_yaml=arguments.get("frontMatterYaml"),
+        body_markus=arguments.get("bodyMarkus") or "",
+        aliases=list(arguments.get("aliases") or []),
+        id=arguments.get("id"),
+    )
+    record = save_item(client, fields, actor=actor, expected_content_hash=arguments.get("expectedContentHash"))
+    return {
+        "ok": True,
+        "item": {
+            "id": record["id"],
+            "contentHash": record["contentHash"],
+            "status": record["status"],
+            "slug": record["slug"],
+            "versionNumber": record.get("versionNumber"),
+        },
+    }
+
+
+def publish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = publish_item(client, arguments["id"], actor=actor)
+    return {
+        "ok": True,
+        "changed": result.changed,
+        "publishedId": result.published_item_id,
+        "versionNumber": result.version_number,
+    }
+
+
+def unpublish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = unpublish_item(client, arguments["id"], actor=actor)
+    return {"ok": True, "changed": result.changed}
+
+
+def handler(event, context):
+    field = event["info"]["fieldName"]
+    arguments = parse_input(event["arguments"]["input"])
+    actor = actor_from_event(event)
+    try:
+        if field == "deriveMarkus":
+            return derive_markus_action(arguments)
+        if field == "saveItemDraft":
+            return save_item_draft_action(arguments, actor)
+        if field == "publishItem":
+            return publish_item_action(arguments, actor)
+        if field == "unpublishItem":
+            return unpublish_item_action(arguments, actor)
+    except PublishError as error:
+        return failure_response(error)
+    raise ValueError(f"Unsupported field {field}")

package/amplify/functions/content-actions/requirements.txt

@@ -0,0 +1,4 @@
+PyYAML>=6.0.2,<7
+citeproc-py>=0.8.2,<1
+anthus-markus==0.5.1
+Pillow>=10,<12

package/amplify/functions/content-actions/resource.js

@@ -0,0 +1,40 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export const contentActions = defineFunction((scope) => {
+    return new Function(scope, "papyrus-content-actions", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(60),
+        memorySize: 1024,
+        code: pythonLambdaCode({
+            functionDir: "content-actions",
+            modules: ["papyrus_content"],
+            requirements: contentActionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/content-actions/resource.ts

@@ -0,0 +1,54 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+
+function installCheckoutRequirements(outputDir: string): void {
+  const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+  execSync(
+    `python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`,
+    { cwd: projectRoot, stdio: "inherit" },
+  );
+}
+
+export const contentActions = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-content-actions", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(60),
+      memorySize: 1024,
+      code: pythonLambdaCode(
+        {
+          functionDir: "content-actions",
+          modules: ["papyrus_content"],
+          requirements: contentActionsRequirements,
+          noDeps: true,
+          checkoutExtras: installCheckoutRequirements,
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/functions/shared/python-bundle.js

@@ -58,9 +58,24 @@ function bundleFromPip(outputDir, options) {
         // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
         "--ignore-requires-python",
         ...extra,
-        pipSpec(),
+        ...(options.noDeps ? [] : [pipSpec()]),
         ...(options.requirements ?? []),
     ], { stdio: "inherit" });
+    if (options.noDeps) {
+        execFileSync(python, [
+            "-m", "pip", "install",
+            "--target", outputDir,
+            "--no-cache-dir",
+            "--no-deps",
+            "--platform", "manylinux2014_aarch64",
+            "--implementation", "cp",
+            "--python-version", "3.12",
+            "--only-binary=:all:",
+            "--ignore-requires-python",
+            ...extra,
+            pipSpec(),
+        ], { stdio: "inherit" });
+    }
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
     if (options.corpora) {
         const corporaDir = path.join(outputDir, "corpora");
@@ -74,7 +89,7 @@ function bundleFromPip(outputDir, options) {
         }
     }
 }
-function bundleFromCheckout(outputDir, options) {
+export function bundleFromCheckout(outputDir, options) {
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
     for (const module of options.modules) {
         fs.mkdirSync(path.join(outputDir, module), { recursive: true });

package/amplify/functions/shared/python-bundle.ts

@@ -53,6 +53,8 @@ export type PythonBundleOptions = {
   checkoutExtras?: (outputDir: string) => void;
   /** Extra pip requirements in package mode, beyond `papyrus-newsroom`. */
   requirements?: string[];
+  /** Package mode: install `papyrus-newsroom` with `--no-deps`, then only `requirements`. */
+  noDeps?: boolean;
   /** Copy `<cwd>/corpora/*.yml` into the asset (publication-owned steering config). */
   corpora?: boolean;
 };
@@ -77,11 +79,30 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
       // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
       "--ignore-requires-python",
       ...extra,
-      pipSpec(),
+      ...(options.noDeps ? [] : [pipSpec()]),
       ...(options.requirements ?? []),
     ],
     { stdio: "inherit" },
   );
+  if (options.noDeps) {
+    execFileSync(
+      python,
+      [
+        "-m", "pip", "install",
+        "--target", outputDir,
+        "--no-cache-dir",
+        "--no-deps",
+        "--platform", "manylinux2014_aarch64",
+        "--implementation", "cp",
+        "--python-version", "3.12",
+        "--only-binary=:all:",
+        "--ignore-requires-python",
+        ...extra,
+        pipSpec(),
+      ],
+      { stdio: "inherit" },
+    );
+  }
   fs.copyFileSync(
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),
@@ -98,7 +119,7 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
   }
 }
 
-function bundleFromCheckout(outputDir: string, options: PythonBundleOptions): void {
+export function bundleFromCheckout(outputDir: string, options: PythonBundleOptions): void {
   fs.copyFileSync(
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),

package/amplify/site-backend.js

@@ -18,6 +18,7 @@ import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
 import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource.js";
+import { contentActions } from "./functions/content-actions/resource.js";
 import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
@@ -79,6 +80,7 @@ export function defineSiteBackend(papyrusSite) {
         assignmentAction,
         auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
         categoryAction,
+        contentActions,
         data,
         graphqlJwtAuthorizer,
         knowledgeQuery,
@@ -310,6 +312,7 @@ export function defineSiteBackend(papyrusSite) {
     for (const resource of [
         backend.assignmentAction,
         backend.categoryAction,
+        backend.contentActions,
         backend.emailSubmissionProcessor,
         backend.knowledgeQuery,
         backend.modelAttachmentUpload,
@@ -323,6 +326,13 @@ export function defineSiteBackend(papyrusSite) {
     grantNewsroomReadWrite(backend.assignmentAction.resources.lambda);
     grantNewsroomReadWrite(backend.categoryAction.resources.lambda);
     grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda);
+    const contentActionsLambda = backend.contentActions.resources.lambda;
+    grantNewsroomReadWriteDelete(contentActionsLambda);
+    contentActionsLambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    contentActionsLambda.addToRolePolicy(new PolicyStatement({
+        actions: ["appsync:GraphQL"],
+        resources: ["*"],
+    }));
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     if (backend.sesInboundReceive) {

package/amplify/site-backend.ts

@@ -19,6 +19,7 @@ import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
 import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource";
+import { contentActions } from "./functions/content-actions/resource";
 import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
@@ -90,6 +91,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     assignmentAction,
     auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
     categoryAction,
+    contentActions,
     data,
     graphqlJwtAuthorizer,
     knowledgeQuery,
@@ -386,6 +388,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   for (const resource of [
     backend.assignmentAction,
     backend.categoryAction,
+    backend.contentActions,
     backend.emailSubmissionProcessor,
     backend.knowledgeQuery,
     backend.modelAttachmentUpload,
@@ -399,6 +402,18 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   grantNewsroomReadWrite(backend.assignmentAction.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.categoryAction.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda as LambdaFunction);
+  const contentActionsLambda = backend.contentActions.resources.lambda as LambdaFunction;
+  grantNewsroomReadWriteDelete(contentActionsLambda);
+  contentActionsLambda.addEnvironment(
+    "PAPYRUS_GRAPHQL_ENDPOINT",
+    backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
+  );
+  contentActionsLambda.addToRolePolicy(
+    new PolicyStatement({
+      actions: ["appsync:GraphQL"],
+      resources: ["*"],
+    }),
+  );
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   if (backend.sesInboundReceive) {

package/app/[year]/[month]/[day]/[articleSlug]/page.tsx

@@ -52,8 +52,8 @@ export default async function DateScopedArticlePage({ params }: DateScopedArticl
       editionFooter={{
         editionBasePath,
         entries: buildPresentationFooterEntries(content),
-        subtitle: SITE_BRAND.id === "threat-intelligence" ? "" : (content.description?.trim() || "Inside Papyrus"),
-        title: SITE_BRAND.id === "threat-intelligence" ? "ANTHUS THREAT INTELLIGENCE" : undefined,
+        subtitle: SITE_BRAND.footerSubtitleOverride ?? (content.description?.trim() || "Inside Papyrus"),
+        title: SITE_BRAND.footerTitle,
       }}
       item={item}
       backHref={`${editionBasePath}#${item.slug}`}

package/app/globals.css

@@ -1,7 +1,4 @@
-@import "../publications/threat_intelligence/theme.css";
-@import "../publications/papyrus/theme.css";
-@import "../publications/pilobol_us/theme.css";
-@import "../publications/anth_us/theme.css";
+@import "./papyrus-theme.css";
 
 @import "tailwindcss";
 @import "tw-animate-css";

package/app/layout.tsx

@@ -1,14 +1,14 @@
 import type { Metadata } from "next";
 import { Playfair_Display, Plus_Jakarta_Sans } from "next/font/google";
-import { cookies } from "next/headers";
 import Script from "next/script";
 import { AmplifyClientProvider } from "../components/amplify-client-provider";
 import { PapyrusConsoleShell } from "../components/papyrus-console-shell";
 import { TooltipProvider } from "../components/ui/tooltip";
-import { getPresentationChoices, getSiteBrand, resolveRuntimeSiteBrandId } from "../lib/site-brand";
+import { getPresentationChoices, getSiteBrand } from "../lib/site-brand";
 import { getSiteStack } from "../lib/site-stack";
 import "./tailwind.css";
 import "./globals.css";
+import "papyrus-site-theme";
 
 const playfairDisplay = Playfair_Display({
   subsets: ["latin"],
@@ -22,16 +22,8 @@ const plusJakartaSans = Plus_Jakarta_Sans({
 
 const faviconVersion = "20260517-1";
 const defaultTheme = "system";
-const BRAND_OVERRIDE_COOKIE = "papyrus-site-brand-override";
-
-async function resolveLayoutSiteBrand() {
-  const cookieStore = await cookies();
-  const brandId = resolveRuntimeSiteBrandId(cookieStore.get(BRAND_OVERRIDE_COOKIE)?.value ?? null);
-  return getSiteBrand(brandId);
-}
-
 export async function generateMetadata(): Promise<Metadata> {
-  const siteBrand = await resolveLayoutSiteBrand();
+  const siteBrand = getSiteBrand();
   return {
     title: siteBrand.appTitle,
     description: siteBrand.appDescription,
@@ -45,7 +37,7 @@ export async function generateMetadata(): Promise<Metadata> {
 }
 
 export default async function RootLayout({ children }: Readonly<{ children: React.ReactNode }>) {
-  const siteBrand = await resolveLayoutSiteBrand();
+  const siteBrand = getSiteBrand();
   const presentationChoices = getPresentationChoices(siteBrand);
   const siteStack = getSiteStack(siteBrand);
 

package/components/news-desk-page.tsx

@@ -1,4 +1,3 @@
-import { cookies } from "next/headers";
 import { NewsDeskWorkspace, type NewsDeskTab } from "./topic-steering-workspace";
 import {
   createDemoCategorySteeringDashboard,
@@ -7,7 +6,6 @@ import {
   loadConfiguredCorpusSummaries,
 } from "../lib/category-repository";
 import {
-  BRAND_OVERRIDE_COOKIE,
   getBrandAnalysisProfilesPath,
   getBrandNewsroomSectionsConfigPath,
   getBrandSteeringConfigPath,
@@ -65,8 +63,7 @@ export async function NewsDeskPage({ section: routeSection, sectionPageId, selec
     proposal: getFirstSearchParam(resolvedSearchParams, "proposal"),
   };
   const useDemoDashboard = getFirstSearchParam(resolvedSearchParams, "demo") === "1";
-  const brandOverride = (await cookies()).get(BRAND_OVERRIDE_COOKIE)?.value ?? null;
-  const brand = resolveActiveSiteBrand(brandOverride);
+  const brand = resolveActiveSiteBrand();
   const analysisProfiles = await loadAnalysisProfileSummaries(getBrandAnalysisProfilesPath(brand));
   const configuredCorpora = await loadConfiguredCorpusSummaries(getBrandSteeringConfigPath(brand));
   const dashboard = useDemoDashboard