@anthusai/papyrus 1.0.0-next.3 → 1.0.0-next.30

package/amplify/data/schema.ts

@@ -272,7 +272,6 @@ export const schema = a.schema({
     .returns(a.ref("ReferenceCurationActionResult"))
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom(),
     ])
     .handler(a.handler.function(categoryAction)),
 
@@ -288,7 +287,6 @@ export const schema = a.schema({
     .returns(a.ref("ReferenceQualityActionResult"))
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom(),
     ])
     .handler(a.handler.function(categoryAction)),
 
@@ -400,7 +398,7 @@ export const schema = a.schema({
   getNewsroomSummary: a
     .query()
     .returns(a.ref("NewsroomSummary"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(newsroomSummary)),
 
   deriveMarkus: a
@@ -431,13 +429,20 @@ export const schema = a.schema({
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  requestStagingBuild: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   knowledgeQuery: a
     .query()
     .arguments({
       input: a.json().required(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(knowledgeQuery)),
 
   updateNewsroomSummary: a
@@ -448,7 +453,7 @@ export const schema = a.schema({
       reason: a.string(),
     })
     .returns(a.ref("NewsroomSummary"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(newsroomSummary)),
 
   ModelAttachmentUploadSlot: a.customType({
@@ -508,7 +513,7 @@ export const schema = a.schema({
       status: a.string(),
     })
     .returns(a.ref("ModelAttachmentUploadSlot"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   completeModelAttachmentUpload: a
@@ -530,7 +535,7 @@ export const schema = a.schema({
       status: a.string(),
     })
     .returns(a.ref("ModelAttachment"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   abortModelAttachmentUpload: a
@@ -552,7 +557,7 @@ export const schema = a.schema({
       status: a.string(),
     })
     .returns(a.ref("ModelAttachmentUploadAbortResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   createModelAttachmentDownload: a
@@ -561,7 +566,7 @@ export const schema = a.schema({
       attachmentId: a.id().required(),
     })
     .returns(a.ref("ModelAttachmentDownloadSlot"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(modelAttachmentUpload)),
 
   AssignmentActionResult: a.customType({
@@ -655,7 +660,7 @@ export const schema = a.schema({
       limit: a.integer(),
     })
     .returns(a.ref("AssignmentContext").array().required())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   listAssignmentQueue: a
@@ -666,7 +671,7 @@ export const schema = a.schema({
       limit: a.integer(),
     })
     .returns(a.ref("AssignmentContext").array().required())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   getAssignmentContext: a
@@ -675,7 +680,7 @@ export const schema = a.schema({
       assignmentId: a.id().required(),
     })
     .returns(a.ref("AssignmentContext"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   claimAssignment: a
@@ -692,7 +697,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   releaseAssignment: a
@@ -704,7 +709,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   completeAssignment: a
@@ -716,7 +721,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   cancelAssignment: a
@@ -728,7 +733,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   reopenAssignment: a
@@ -740,7 +745,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   retryImmediateAssignment: a
@@ -752,7 +757,7 @@ export const schema = a.schema({
       note: a.string(),
     })
     .returns(a.ref("AssignmentActionResult"))
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
   listNewsroomProcedureDefinitions: a
@@ -768,7 +773,7 @@ export const schema = a.schema({
       procedureKey: a.string(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.group(adminGroup), allow.custom()])
+    .authorization((allow) => [allow.group(adminGroup)])
     .handler(a.handler.function(procedureAction)),
 
   saveNewsroomProcedureDefinition: a
@@ -810,7 +815,7 @@ export const schema = a.schema({
       actorLabel: a.string(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(procedureAction)),
 
   getNewsroomProcedureRun: a
@@ -819,7 +824,7 @@ export const schema = a.schema({
       id: a.id().required(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(procedureAction)),
 
   listNewsroomProcedureRunsByProcedure: a
@@ -828,7 +833,7 @@ export const schema = a.schema({
       procedureId: a.id().required(),
     })
     .returns(a.json())
-    .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(procedureAction)),
 
   Assignment: modelWithoutSubscriptions({
@@ -878,7 +883,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
       allow.authenticated("identityPool").to(authoringOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   AssignmentEvent: modelWithoutSubscriptions({
@@ -901,7 +905,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   ProcedureDefinition: modelWithoutSubscriptions({
@@ -926,7 +929,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.group(adminGroup),
-      allow.custom().to(authoringOperations),
     ]),
 
   ProcedureVersion: modelWithoutSubscriptions({
@@ -953,7 +955,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.group(adminGroup),
-      allow.custom().to(authoringOperations),
     ]),
 
   ProcedureRun: modelWithoutSubscriptions({
@@ -986,7 +987,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.group("editor").to(["read"]),
       allow.group(adminGroup).to(authoringOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   NewsroomSection: modelWithoutSubscriptions({
@@ -1014,7 +1014,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeCorpus: modelWithoutSubscriptions({
@@ -1032,7 +1031,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeImportRun: modelWithoutSubscriptions({
@@ -1060,7 +1058,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeRawPayload: modelWithoutSubscriptions({
@@ -1078,7 +1075,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   KnowledgeArtifact: modelWithoutSubscriptions({
@@ -1098,7 +1094,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   CategorySet: modelWithoutSubscriptions({
@@ -1128,7 +1123,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   Category: modelWithoutSubscriptions({
@@ -1170,7 +1164,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   CategoryKeyword: modelWithoutSubscriptions({
@@ -1199,7 +1192,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   LexicalSteeringRule: modelWithoutSubscriptions({
@@ -1228,7 +1220,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   SteeringProposal: modelWithoutSubscriptions({
@@ -1266,7 +1257,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   SteeringDecision: modelWithoutSubscriptions({
@@ -1286,7 +1276,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   Reference: realtimeModel({
@@ -1338,7 +1327,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   ReferenceAttachment: modelWithoutSubscriptions({
@@ -1368,7 +1356,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   SemanticNode: modelWithoutSubscriptions({
@@ -1406,7 +1393,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   Message: realtimeModel({
@@ -1455,7 +1441,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   MessageThread: realtimeModel({
@@ -1493,7 +1478,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read", "create", "update"]),
       allow.authenticated("identityPool").to(authoringOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   ModelAttachment: modelWithoutSubscriptions({
@@ -1525,7 +1509,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
-      allow.custom().to(authoringOperations),
     ]),
 
   SemanticRelationType: modelWithoutSubscriptions({
@@ -1553,7 +1536,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   SemanticRelation: modelWithoutSubscriptions({
@@ -1604,7 +1586,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-      allow.custom().to(authoringOperations),
     ]),
 
   Item: modelWithoutSubscriptions({
@@ -1654,7 +1635,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   Tag: modelWithoutSubscriptions({
@@ -1671,7 +1651,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   ItemTag: modelWithoutSubscriptions({
@@ -1691,7 +1670,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   MediaAsset: modelWithoutSubscriptions({
@@ -1724,7 +1702,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   Edition: modelWithoutSubscriptions({
@@ -1756,7 +1733,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   EditionItem: modelWithoutSubscriptions({
@@ -1779,7 +1755,6 @@ export const schema = a.schema({
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedItem: modelWithoutSubscriptions({
@@ -1820,7 +1795,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedMediaAsset: modelWithoutSubscriptions({
@@ -1856,7 +1830,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedEdition: modelWithoutSubscriptions({
@@ -1882,7 +1855,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedEditionItem: modelWithoutSubscriptions({
@@ -1907,7 +1879,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedCategorySet: modelWithoutSubscriptions({
@@ -1933,7 +1904,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 
   PublishedCategory: modelWithoutSubscriptions({
@@ -1969,7 +1939,6 @@ export const schema = a.schema({
     .authorization((allow) => [
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
-      allow.custom().to(authoringOperations),
     ]),
 }).authorization((allow) => [
   allow.resource(categoryAction),

package/amplify/functions/console-chat-responder/py/execute_tactus_runner.py

@@ -2,7 +2,6 @@
 from __future__ import annotations
 
 import json
-import os
 import sys
 from pathlib import Path
 from typing import Any
@@ -16,14 +15,6 @@ for root in SEARCH_PATHS:
         sys.path.insert(0, str(root))
 
 
-def _ensure_graphql_authoring_jwt() -> None:
-    if not os.environ.get("AWS_LAMBDA_FUNCTION_NAME", "").strip():
-        return
-    from papyrus_content.env import ensure_graphql_authoring_jwt  # type: ignore
-
-    ensure_graphql_authoring_jwt()
-
-
 def _error(code: str, message: str, *, retryable: bool = False) -> dict[str, Any]:
     return {
         "ok": False,
@@ -94,7 +85,6 @@ def _execute_tactus(arguments: dict[str, Any], web_ui_context: dict[str, Any] |
 
 
 def main() -> None:
-    _ensure_graphql_authoring_jwt()
     raw = sys.stdin.read()
     payload = json.loads(raw or "{}")
     mode = str(payload.get("mode") or "").strip()

package/amplify/functions/console-chat-responder/resource.js

@@ -19,11 +19,6 @@ export class ConsoleChatResponderStack extends NestedStack {
             PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS: process.env.PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS || "900",
             PAPYRUS_EXECUTE_TACTUS_RUNNER: process.env.PAPYRUS_EXECUTE_TACTUS_RUNNER || "/opt/papyrus/execute_tactus_runner.py",
             PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS: process.env.PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS || "30",
-            PAPYRUS_JWT_ISSUER: process.env.PAPYRUS_JWT_ISSUER || "papyrus-cli",
-            PAPYRUS_JWT_SUBJECT: process.env.PAPYRUS_JWT_SUBJECT || "papyrus-cli",
-            PAPYRUS_JWT_AUDIENCE: process.env.PAPYRUS_JWT_AUDIENCE || "papyrus-authoring",
-            PAPYRUS_JWT_GROUPS: process.env.PAPYRUS_JWT_GROUPS || "editor",
-            ...(props.amplifySsmEnvConfig ? { AMPLIFY_SSM_ENV_CONFIG: props.amplifySsmEnvConfig } : {}),
         };
         const imageUri = props.prebuiltImageUri?.trim() || process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI?.trim() || "";
         const allowLocalImageBuild = parseBooleanEnv(process.env.PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD);
@@ -87,8 +82,6 @@ export class ConsoleChatResponderStack extends NestedStack {
             ],
         }));
         const stack = Stack.of(this);
-        // execute_tactus_runner mints PAPYRUS_GRAPHQL_JWT via boto3 get_parameters; branch policies
-        // often grant GetParameters on path prefixes, not GetParameter per secret name.
         this.responderFunction.addToRolePolicy(new PolicyStatement({
             effect: Effect.ALLOW,
             actions: ["ssm:GetParameter", "ssm:GetParameters"],

package/amplify/functions/console-chat-responder/resource.ts

@@ -12,7 +12,6 @@ export type ConsoleChatResponderStackProps = NestedStackProps & {
   threadTable: ITable;
   projectRoot: string;
   graphqlEndpoint: string;
-  amplifySsmEnvConfig?: string;
   responseTarget?: string;
   model?: string;
   prebuiltImageUri?: string;
@@ -36,11 +35,6 @@ export class ConsoleChatResponderStack extends NestedStack {
       PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS: process.env.PAPYRUS_CONSOLE_STATIC_CONTEXT_TTL_SECONDS || "900",
       PAPYRUS_EXECUTE_TACTUS_RUNNER: process.env.PAPYRUS_EXECUTE_TACTUS_RUNNER || "/opt/papyrus/execute_tactus_runner.py",
       PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS: process.env.PAPYRUS_EXECUTE_TACTUS_TIMEOUT_SECONDS || "30",
-      PAPYRUS_JWT_ISSUER: process.env.PAPYRUS_JWT_ISSUER || "papyrus-cli",
-      PAPYRUS_JWT_SUBJECT: process.env.PAPYRUS_JWT_SUBJECT || "papyrus-cli",
-      PAPYRUS_JWT_AUDIENCE: process.env.PAPYRUS_JWT_AUDIENCE || "papyrus-authoring",
-      PAPYRUS_JWT_GROUPS: process.env.PAPYRUS_JWT_GROUPS || "editor",
-      ...(props.amplifySsmEnvConfig ? { AMPLIFY_SSM_ENV_CONFIG: props.amplifySsmEnvConfig } : {}),
     };
 
     const imageUri = props.prebuiltImageUri?.trim() || process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI?.trim() || "";
@@ -109,8 +103,6 @@ export class ConsoleChatResponderStack extends NestedStack {
       ],
     }));
     const stack = Stack.of(this);
-    // execute_tactus_runner mints PAPYRUS_GRAPHQL_JWT via boto3 get_parameters; branch policies
-    // often grant GetParameters on path prefixes, not GetParameter per secret name.
     this.responderFunction.addToRolePolicy(new PolicyStatement({
       effect: Effect.ALLOW,
       actions: ["ssm:GetParameter", "ssm:GetParameters"],

package/amplify/functions/console-chat-responder/src/main.rs

@@ -3017,15 +3017,6 @@ fn optional_env(name: &str) -> Option<String> {
         .filter(|value| !value.is_empty())
 }
 
-fn normalize_jwt(token: String) -> String {
-    token
-        .trim()
-        .trim_start_matches("Bearer ")
-        .trim_start_matches("bearer ")
-        .trim()
-        .to_string()
-}
-
 fn format_error_chain(error: &anyhow::Error) -> String {
     error
         .chain()

package/amplify/functions/content-actions/handler.py

@@ -1,10 +1,18 @@
 from __future__ import annotations
 
 import json
+import os
 from typing import Any
 
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.rebuild_trigger import (
+    DEFAULT_STAGING_BRANCH,
+    reader_target_from_environment,
+    trigger_pretext_revalidation,
+    trigger_rebuild,
+    trigger_staging_build,
+)
 from papyrus_content.publishing import (
     ItemFields,
     PublishError,
@@ -72,25 +80,57 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
     }
 
 
+def site_triggers_for(client, item_id: str) -> dict:
+    triggers: dict = {}
+    reader_app_id, reader_branch = reader_target_from_environment()
+    revalidate_base_url = (os.environ.get("PAPYRUS_REVALIDATE_BASE_URL") or "").strip()
+    if revalidate_base_url:
+        try:
+            item = client.get_record("Item", item_id) or {}
+            slugs = [item["slug"]] if item.get("slug") else []
+            revalidated = trigger_pretext_revalidation(slugs, None, base_url=revalidate_base_url)
+            triggers["revalidated"] = revalidated if revalidated is not None else {"ok": False, "reason": "not-configured"}
+        except Exception as error:  # noqa: BLE001 - a trigger failure never fails the publish
+            triggers["revalidated"] = {"ok": False, "error": f"{type(error).__name__}: {error}"}
+    if reader_app_id:
+        triggers["rebuild"] = trigger_rebuild(reader_app_id=reader_app_id, reader_branch=reader_branch)
+    return triggers
+
+
 def publish_item_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     result = publish_item(client, arguments["id"], actor=actor)
-    return {
+    response = {
         "ok": True,
         "changed": result.changed,
         "publishedId": result.published_item_id,
         "versionNumber": result.version_number,
     }
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
 
 
 def unpublish_item_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     result = unpublish_item(client, arguments["id"], actor=actor)
-    return {"ok": True, "changed": result.changed}
+    response = {"ok": True, "changed": result.changed}
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def request_staging_build_action() -> dict:
+    cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
+    if not cms_app_id:
+        return {"ok": False, "errors": [{"code": "staging-build-not-configured", "message": "This site has no staging build configured.", "line": None}]}
+    staging_branch = (os.environ.get("PAPYRUS_STAGING_BRANCH") or "").strip() or DEFAULT_STAGING_BRANCH
+    build = trigger_staging_build(cms_app_id=cms_app_id, staging_branch=staging_branch)
+    return {"ok": True, "build": build}
 
 
 def handler(event, context):
-    field = event["info"]["fieldName"]
+    field = event["fieldName"]
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)
     try:
@@ -102,6 +142,8 @@ def handler(event, context):
             return publish_item_action(arguments, actor)
         if field == "unpublishItem":
             return unpublish_item_action(arguments, actor)
+        if field == "requestStagingBuild":
+            return request_staging_build_action()
     except PublishError as error:
         return failure_response(error)
     raise ValueError(f"Unsupported field {field}")

package/amplify/rebuild-trigger-settings.js

@@ -0,0 +1,22 @@
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+function branchJobsArn(input, appId, branch) {
+    return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+export function rebuildTriggerSettings(input) {
+    const environment = {};
+    const resources = [];
+    const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+    if (readerAppId !== "") {
+        const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+        environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+        environment.PAPYRUS_READER_BRANCH = readerBranch;
+        resources.push(branchJobsArn(input, readerAppId, readerBranch));
+    }
+    const cmsAppId = input.cmsAppId.trim();
+    if (input.stagingBuildEnabled && cmsAppId !== "") {
+        environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+        environment.PAPYRUS_STAGING_BRANCH = "staging";
+        resources.push(branchJobsArn(input, cmsAppId, "staging"));
+    }
+    return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}