@anthusai/papyrus 1.0.0-next.34 → 1.0.0-next.36

package/amplify/data/schema.js

@@ -1290,6 +1290,11 @@ export const schema = a.schema({
         displayName: a.string(),
         description: a.string(),
         aliases: a.string().array(),
+        authorityScore: a.float(),
+        authorityRank: a.integer(),
+        acceptedReferenceMentionCount: a.integer(),
+        distinctSourceKindCount: a.integer(),
+        relationCount: a.integer(),
         status: a.string().required(),
         importRunId: a.id(),
         createdAt: a.datetime(),

package/amplify/data/schema.ts

@@ -1379,6 +1379,11 @@ export const schema = a.schema({
       displayName: a.string(),
       description: a.string(),
       aliases: a.string().array(),
+      authorityScore: a.float(),
+      authorityRank: a.integer(),
+      acceptedReferenceMentionCount: a.integer(),
+      distinctSourceKindCount: a.integer(),
+      relationCount: a.integer(),
       status: a.string().required(),
       importRunId: a.id(),
       createdAt: a.datetime(),

package/amplify/site-backend-names.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { Token } from "aws-cdk-lib";
 export function sanitizeAwsName(value, maxLength = 50) {
     return value
         .toLowerCase()
@@ -7,6 +8,18 @@ export function sanitizeAwsName(value, maxLength = 50) {
         .replace(/^-|-$/g, "")
         .slice(0, maxLength);
 }
+/**
+ * Account-global names are immutable in AWS, so they must be built from literal
+ * synth-time inputs only. A CDK token (or text that came from one, such as
+ * `token-token-17565`) makes the name change on every synth and fail with
+ * AlreadyExists, so this throws instead.
+ */
+export function assertLiteralResourceName(label, name) {
+    if (Token.isUnresolved(name) || /token|\$\{/i.test(name)) {
+        throw new Error(`${label} "${name}" is derived from an unresolved CDK token. Build account-global names from literal site config values only.`);
+    }
+    return name;
+}
 export function readBooleanEnvFlag(environment, name, defaultValue) {
     const raw = (environment[name] ?? "").trim().toLowerCase();
     if (["1", "true", "yes", "on"].includes(raw))
@@ -36,19 +49,21 @@ export function resolveSiteBackendFeatureFlags(features, environment, identity)
     };
 }
 export function deriveKnowledgeVectorIndexName(identity) {
-    return isLegacyProductionApp(identity)
+    const name = isLegacyProductionApp(identity)
         ? "papyrus-knowledge"
         : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+    return assertLiteralResourceName("Knowledge vector index name", name);
 }
-export function deriveStorageBackupVaultName(identity, backupsStackName, explicitName) {
+export function deriveStorageBackupVaultName(identity, explicitName) {
     const explicit = (explicitName ?? "").trim();
     if (explicit !== "")
-        return sanitizeAwsName(explicit);
+        return assertLiteralResourceName("Backup vault name", sanitizeAwsName(explicit));
     if (isLegacyProductionPipeline(identity)) {
-        return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+        return assertLiteralResourceName("Backup vault name", sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`));
     }
-    const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
-    return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+    const literalSiteKey = [identity.brandId, identity.amplifyAppId, identity.amplifyBranch].join("|");
+    const siteHash = createHash("sha256").update(literalSiteKey).digest("hex").slice(0, 8);
+    return assertLiteralResourceName("Backup vault name", `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${siteHash}-media-vault`);
 }
 /**
  * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
@@ -57,16 +72,16 @@ export function deriveStorageBackupVaultName(identity, backupsStackName, explici
  * its own brand-named rule set and never activates it from CloudFormation.
  */
 export function deriveReceiptRuleSetName(identity, inboundEmailDomain) {
-    if (isLegacyProductionApp(identity)) {
-        return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
-    }
-    return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+    const name = isLegacyProductionApp(identity)
+        ? `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`
+        : `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+    return assertLiteralResourceName("Receipt rule set name", name);
 }
 /** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
 export function deriveReceiptRuleName(identity) {
     if (isLegacyProductionApp(identity))
         return undefined;
-    return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+    return assertLiteralResourceName("Receipt rule name", `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`);
 }
 export function planInboundEmailSes(identity, inboundEmailEnabled, options) {
     const legacyPipeline = isLegacyProductionPipeline(identity);
@@ -78,10 +93,10 @@ export function planInboundEmailSes(identity, inboundEmailEnabled, options) {
         manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
     };
 }
-export function deriveSiteGlobalResourceNames(identity, inboundEmailDomain, backupsStackName) {
+export function deriveSiteGlobalResourceNames(identity, inboundEmailDomain) {
     return {
         knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
-        storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+        storageBackupVaultName: deriveStorageBackupVaultName(identity),
         receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
         receiptRuleName: deriveReceiptRuleName(identity),
     };

package/amplify/site-backend-names.ts

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { Token } from "aws-cdk-lib";
 
 export type SiteBackendFeatureFlags = {
   consoleResponder: boolean;
@@ -18,6 +19,21 @@ export function sanitizeAwsName(value: string, maxLength = 50): string {
     .slice(0, maxLength);
 }
 
+/**
+ * Account-global names are immutable in AWS, so they must be built from literal
+ * synth-time inputs only. A CDK token (or text that came from one, such as
+ * `token-token-17565`) makes the name change on every synth and fail with
+ * AlreadyExists, so this throws instead.
+ */
+export function assertLiteralResourceName(label: string, name: string): string {
+  if (Token.isUnresolved(name) || /token|\$\{/i.test(name)) {
+    throw new Error(
+      `${label} "${name}" is derived from an unresolved CDK token. Build account-global names from literal site config values only.`,
+    );
+  }
+  return name;
+}
+
 export function readBooleanEnvFlag(
   environment: Record<string, string | undefined>,
   name: string,
@@ -67,23 +83,27 @@ export function resolveSiteBackendFeatureFlags(
 }
 
 export function deriveKnowledgeVectorIndexName(identity: SiteBackendIdentity): string {
-  return isLegacyProductionApp(identity)
+  const name = isLegacyProductionApp(identity)
     ? "papyrus-knowledge"
     : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+  return assertLiteralResourceName("Knowledge vector index name", name);
 }
 
-export function deriveStorageBackupVaultName(
-  identity: SiteBackendIdentity,
-  backupsStackName: string,
-  explicitName?: string,
-): string {
+export function deriveStorageBackupVaultName(identity: SiteBackendIdentity, explicitName?: string): string {
   const explicit = (explicitName ?? "").trim();
-  if (explicit !== "") return sanitizeAwsName(explicit);
+  if (explicit !== "") return assertLiteralResourceName("Backup vault name", sanitizeAwsName(explicit));
   if (isLegacyProductionPipeline(identity)) {
-    return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+    return assertLiteralResourceName(
+      "Backup vault name",
+      sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`),
+    );
   }
-  const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
-  return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+  const literalSiteKey = [identity.brandId, identity.amplifyAppId, identity.amplifyBranch].join("|");
+  const siteHash = createHash("sha256").update(literalSiteKey).digest("hex").slice(0, 8);
+  return assertLiteralResourceName(
+    "Backup vault name",
+    `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${siteHash}-media-vault`,
+  );
 }
 
 /**
@@ -93,16 +113,16 @@ export function deriveStorageBackupVaultName(
  * its own brand-named rule set and never activates it from CloudFormation.
  */
 export function deriveReceiptRuleSetName(identity: SiteBackendIdentity, inboundEmailDomain: string): string {
-  if (isLegacyProductionApp(identity)) {
-    return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
-  }
-  return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+  const name = isLegacyProductionApp(identity)
+    ? `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`
+    : `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+  return assertLiteralResourceName("Receipt rule set name", name);
 }
 
 /** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
 export function deriveReceiptRuleName(identity: SiteBackendIdentity): string | undefined {
   if (isLegacyProductionApp(identity)) return undefined;
-  return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+  return assertLiteralResourceName("Receipt rule name", `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`);
 }
 
 export type InboundEmailSesPlan = {
@@ -136,11 +156,10 @@ export type SiteGlobalResourceNames = {
 export function deriveSiteGlobalResourceNames(
   identity: SiteBackendIdentity,
   inboundEmailDomain: string,
-  backupsStackName: string,
 ): SiteGlobalResourceNames {
   return {
     knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
-    storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+    storageBackupVaultName: deriveStorageBackupVaultName(identity),
     receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
     receiptRuleName: deriveReceiptRuleName(identity),
   };

package/amplify/site-backend.js

@@ -220,7 +220,7 @@ export function defineSiteBackend(papyrusSite) {
     }
     if (enableStorageBackups) {
         const storageBackupsStack = backend.createStack("storage-backups");
-        const storageBackupVaultName = deriveStorageBackupVaultName(siteBackendIdentity, storageBackupsStack.stackName, process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME);
+        const storageBackupVaultName = deriveStorageBackupVaultName(siteBackendIdentity, process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME);
         const storageBackups = addStorageBackups(storageBackupsStack, {
             storageBucket,
             backupVaultName: storageBackupVaultName,

package/amplify/site-backend.ts

@@ -282,7 +282,6 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     const storageBackupsStack = backend.createStack("storage-backups");
     const storageBackupVaultName = deriveStorageBackupVaultName(
       siteBackendIdentity,
-      storageBackupsStack.stackName,
       process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME,
     );
 

package/package.json

@@ -300,7 +300,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.34",
+  "version": "1.0.0-next.36",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.34",
+  "version": "1.0.0-next.36",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",

package/src/with-papyrus.mjs

@@ -9,6 +9,7 @@ import { fileURLToPath } from "node:url";
  *   `papyrus-amplify-outputs` -> ./amplify_outputs.json and
  *   `papyrus-site-theme` -> ./publication/theme.css when it exists, else the shipped
  *   empty lib/empty-theme.css (both webpack and turbopack),
+ * - trace the corpora/ YAML and amplify_outputs.json that the reader reads via fs at runtime,
  * - carry Papyrus's own server-external packages and image settings.
  */
 const SERVER_EXTERNAL = [
@@ -22,6 +23,15 @@ const SERVER_EXTERNAL = [
   "@aws-amplify/data-schema",
 ];
 
+export const RUNTIME_TRACED_FILES = ["./corpora/**/*", "./amplify_outputs.json"];
+
+export function mergeOutputFileTracingIncludes(existing = {}) {
+  const merged = { ...existing };
+  const current = merged["/**"] ?? [];
+  merged["/**"] = [...new Set([...current, ...RUNTIME_TRACED_FILES])];
+  return merged;
+}
+
 const EMPTY_THEME = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../lib/empty-theme.css");
 
 export function withPapyrus(nextConfig = {}, options = {}) {
@@ -41,6 +51,7 @@ export function withPapyrus(nextConfig = {}, options = {}) {
     ...nextConfig,
     transpilePackages: [...new Set([...(nextConfig.transpilePackages ?? []), "@anthusai/papyrus"])],
     serverExternalPackages: [...new Set([...(nextConfig.serverExternalPackages ?? []), ...SERVER_EXTERNAL])],
+    outputFileTracingIncludes: mergeOutputFileTracingIncludes(nextConfig.outputFileTracingIncludes),
     images: nextConfig.images ?? { remotePatterns: [{ protocol: "https", hostname: "**" }] },
     experimental: { devtoolSegmentExplorer: false, ...nextConfig.experimental },
     turbopack: {