@anthusai/papyrus 1.0.0-next.4 → 1.0.0-next.41

package/scripts/videoml/standard-entry.tsx

@@ -0,0 +1,46 @@
+import React from "react";
+import { createRoot } from "react-dom/client";
+import {
+  ComposableRenderer,
+  RendererProvider,
+  interpolate,
+  spring,
+  useCurrentFrame,
+  useVideoConfig,
+} from "@videoml/toolchain/renderer";
+import { getComponent, listComponents, registerComponent } from "@videoml/toolchain/renderer/components/registry";
+
+type RenderFrameRequest = {
+  script: unknown;
+  frame: number;
+  config: { fps: number; width: number; height: number; durationFrames: number };
+  inputProps?: Record<string, unknown>;
+};
+
+const root = document.getElementById("root");
+let reactRoot: ReturnType<typeof createRoot> | null = null;
+
+const videoApi = {
+  registerComponent,
+  getComponent,
+  listComponents,
+  ComposableRenderer,
+  RendererProvider,
+  useCurrentFrame,
+  useVideoConfig,
+  interpolate,
+  spring,
+};
+
+(window as unknown as { Babulus: typeof videoApi }).Babulus = videoApi;
+
+(window as unknown as { renderFrame: (request: RenderFrameRequest) => Promise<void> }).renderFrame = (request) => {
+  if (!root) throw new Error("VideoML render shell has no #root element.");
+  reactRoot ??= createRoot(root);
+  reactRoot.render(
+    <RendererProvider frame={request.frame} config={request.config}>
+      <ComposableRenderer script={request.script as never} {...(request.inputProps ?? {})} />
+    </RendererProvider>,
+  );
+  return new Promise((resolve) => setTimeout(resolve, 100));
+};

package/src/sync.mjs

@@ -37,18 +37,42 @@ function shimFor(route) {
   return lines.join("\n") + "\n";
 }
 
-function middlewareShim(manifest) {
+export function middlewareShim(manifest) {
   const matcher = manifest.middleware.matcher ?? '["/((?!_next/static|_next/image|favicon.ico|icon).*)"]';
   return [
     MARKER,
     `export { middleware } from "${PKG}/middleware";`,
-    `export const config = { matcher: ${matcher} };`,
+    `export const config = { ${manifest.middleware.runtime ? `runtime: ${JSON.stringify(manifest.middleware.runtime)}, ` : ""}matcher: ${matcher} };`,
     "",
   ].join("\n");
 }
 
-export function sync({ root = process.cwd(), log = console.log } = {}) {
-  const manifest = JSON.parse(fs.readFileSync(path.join(pkgRoot, "routes.manifest.json"), "utf8"));
+const RESERVED_FIRST_SEGMENTS = new Set(["newsroom", "api", "_next", "_preview", "%5F_preview"]);
+
+export function normalizeReaderBasePath(value) {
+  const trimmed = (value ?? "").trim().replace(/\/+$/, "");
+  if (!trimmed) return "";
+  return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
+
+export function readReaderBasePath(root) {
+  let text;
+  try {
+    text = fs.readFileSync(path.join(root, "papyrus.config.ts"), "utf8");
+  } catch {
+    return "";
+  }
+  const match = text.match(/\breaderBasePath\s*:\s*(["'`])([^"'`]*)\1/);
+  return normalizeReaderBasePath(match ? match[2] : "");
+}
+
+export function sync({ root = process.cwd(), log = console.log, manifest: manifestOverride, readerBasePath: readerBasePathOverride } = {}) {
+  const manifest = manifestOverride ?? JSON.parse(fs.readFileSync(path.join(pkgRoot, "routes.manifest.json"), "utf8"));
+  const readerBasePath = normalizeReaderBasePath(readerBasePathOverride ?? readReaderBasePath(root));
+  if (readerBasePath && RESERVED_FIRST_SEGMENTS.has(readerBasePath.split("/")[1])) {
+    throw new Error(`readerBasePath "${readerBasePath}" collides with a Papyrus-owned route (newsroom, api, _preview)`);
+  }
+  const readerRouteFile = (file) => (readerBasePath ? file.replace(/^app\//, `app${readerBasePath}/`) : file);
   const generated = [];
   const skipped = [];
   const write = (relPath, content) => {
@@ -61,7 +85,7 @@ export function sync({ root = process.cwd(), log = console.log } = {}) {
     fs.writeFileSync(dest, content);
     generated.push(relPath);
   };
-  for (const route of manifest.routes) write(route.file, shimFor(route));
+  for (const route of manifest.routes) write(route.reader ? readerRouteFile(route.file) : route.file, shimFor(route));
   write("middleware.ts", middlewareShim(manifest));
 
   // Remove shims that are no longer in the manifest (e.g. after an upgrade).
@@ -81,7 +105,7 @@ export function sync({ root = process.cwd(), log = console.log } = {}) {
   const re = new RegExp(`${GITIGNORE_BEGIN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${GITIGNORE_END}`);
   fs.writeFileSync(giFile, re.test(gi) ? gi.replace(re, block) : `${gi}${gi.endsWith("\n") || !gi ? "" : "\n"}${block}\n`);
 
-  log(`papyrus-app sync: ${generated.length} shim(s) written, ${skipped.length} site-owned file(s) kept (${PKG}@${manifest.version})`);
+  log(`papyrus-app sync: ${generated.length} shim(s) written, ${skipped.length} site-owned file(s) kept (${PKG}@${manifest.version})${readerBasePath ? `, reader mounted at ${readerBasePath}` : ""}`);
   for (const rel of skipped) log(`  site-owned: ${rel}`);
   return { generated, skipped };
 }

package/src/with-papyrus.mjs

@@ -4,11 +4,12 @@ import { fileURLToPath } from "node:url";
 
 /**
  * Wrap a publication repo's Next config for Papyrus (SPIKE, PPY-82be6c).
- * - transpile the package (it ships TypeScript source),
+ * - transpile the package and the dependencies that ship TypeScript source (cyclotron),
  * - alias `papyrus-site` -> ./papyrus.config.ts,
  *   `papyrus-amplify-outputs` -> ./amplify_outputs.json and
  *   `papyrus-site-theme` -> ./publication/theme.css when it exists, else the shipped
  *   empty lib/empty-theme.css (both webpack and turbopack),
+ * - trace the corpora/ YAML and amplify_outputs.json that the reader reads via fs at runtime,
  * - carry Papyrus's own server-external packages and image settings.
  */
 const SERVER_EXTERNAL = [
@@ -22,6 +23,21 @@ const SERVER_EXTERNAL = [
   "@aws-amplify/data-schema",
 ];
 
+export const DEFAULT_TRANSPILE_PACKAGES = ["@anthusai/papyrus", "cyclotron"];
+
+export function mergeTranspilePackages(existing = []) {
+  return [...new Set([...existing, ...DEFAULT_TRANSPILE_PACKAGES])];
+}
+
+export const RUNTIME_TRACED_FILES = ["./corpora/**/*", "./amplify_outputs.json"];
+
+export function mergeOutputFileTracingIncludes(existing = {}) {
+  const merged = { ...existing };
+  const current = merged["/**"] ?? [];
+  merged["/**"] = [...new Set([...current, ...RUNTIME_TRACED_FILES])];
+  return merged;
+}
+
 const EMPTY_THEME = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../lib/empty-theme.css");
 
 export function withPapyrus(nextConfig = {}, options = {}) {
@@ -39,8 +55,9 @@ export function withPapyrus(nextConfig = {}, options = {}) {
   return {
     distDir: process.env.NEXT_DIST_DIR || ".next",
     ...nextConfig,
-    transpilePackages: [...new Set([...(nextConfig.transpilePackages ?? []), "@anthusai/papyrus"])],
+    transpilePackages: mergeTranspilePackages(nextConfig.transpilePackages),
     serverExternalPackages: [...new Set([...(nextConfig.serverExternalPackages ?? []), ...SERVER_EXTERNAL])],
+    outputFileTracingIncludes: mergeOutputFileTracingIncludes(nextConfig.outputFileTracingIncludes),
     images: nextConfig.images ?? { remotePatterns: [{ protocol: "https", hostname: "**" }] },
     experimental: { devtoolSegmentExplorer: false, ...nextConfig.experimental },
     turbopack: {

package/amplify/functions/graphql-jwt-authorizer/handler.ts

@@ -1,193 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-
-type AppSyncAuthorizerEvent = {
-  authorizationToken?: string;
-};
-
-type JwtHeader = {
-  alg?: string;
-  typ?: string;
-};
-
-type JwtClaims = {
-  iss?: string;
-  sub?: string;
-  aud?: string | string[];
-  exp?: number;
-  nbf?: number;
-  iat?: number;
-  scope?: string;
-  scp?: string | string[];
-  groups?: string | string[];
-  roles?: string | string[];
-  [key: string]: unknown;
-};
-
-export const handler = async (event: AppSyncAuthorizerEvent) => {
-  try {
-    const token = normalizeAuthorizationToken(event.authorizationToken);
-    const jwtSecret = await getJwtSecret();
-    const claims = verifyHs256Jwt(token, jwtSecret);
-    assertExpectedIssuer(claims);
-    assertExpectedAudience(claims);
-    assertRequiredScope(claims);
-
-    return {
-      isAuthorized: true,
-      resolverContext: {
-        sub: claims.sub ?? "unknown",
-        iss: claims.iss ?? "unknown",
-        scope: getClaimValues(claims.scope).join(" "),
-      },
-      ttlOverride: 300,
-    };
-  } catch (error) {
-    console.warn(`JWT authorizer rejected request: ${(error as Error).message}`);
-    return {
-      isAuthorized: false,
-      ttlOverride: 0,
-    };
-  }
-};
-
-function normalizeAuthorizationToken(value: string | undefined): string {
-  const token = value
-    ?.replace(/^PapyrusJwt\s+/i, "")
-    .replace(/^papyrus-jwt:/i, "")
-    .replace(/^Bearer\s+/i, "")
-    .trim();
-  if (!token) throw new Error("Missing Authorization token.");
-  return token;
-}
-
-function verifyHs256Jwt(token: string, jwtSecret: string): JwtClaims {
-  const [encodedHeader, encodedPayload, encodedSignature] = token.split(".");
-  if (!encodedHeader || !encodedPayload || !encodedSignature) {
-    throw new Error("JWT must have header, payload, and signature.");
-  }
-
-  const header = decodeJson<JwtHeader>(encodedHeader);
-  if (header.alg !== "HS256") {
-    throw new Error(`Unsupported JWT alg ${header.alg ?? "unknown"}.`);
-  }
-
-  const claims = decodeJson<JwtClaims>(encodedPayload);
-  const expectedSignature = createHmac("sha256", jwtSecret)
-    .update(`${encodedHeader}.${encodedPayload}`)
-    .digest("base64url");
-
-  if (!constantTimeEqual(encodedSignature, expectedSignature)) {
-    throw new Error("JWT signature verification failed.");
-  }
-
-  const now = Math.floor(Date.now() / 1000);
-  if (typeof claims.exp === "number" && claims.exp <= now) {
-    throw new Error("JWT is expired.");
-  }
-  if (typeof claims.nbf === "number" && claims.nbf > now) {
-    throw new Error("JWT is not yet valid.");
-  }
-
-  return claims;
-}
-
-function decodeJson<T>(encoded: string): T {
-  try {
-    return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as T;
-  } catch {
-    throw new Error("JWT contains invalid base64url JSON.");
-  }
-}
-
-let cachedJwtSecret: string | null = null;
-let ssmClient: SSMClient | null = null;
-
-async function getJwtSecret(): Promise<string> {
-  if (cachedJwtSecret) return cachedJwtSecret;
-
-  const directSecret = normalizeOptionalString(process.env.PAPYRUS_JWT_SECRET);
-  if (directSecret && !isAmplifySecretPlaceholder(directSecret)) {
-    cachedJwtSecret = directSecret;
-    return directSecret;
-  }
-
-  const parameterName = resolveAmplifySsmSecretPath("PAPYRUS_JWT_SECRET");
-  if (!parameterName) throw new Error("PAPYRUS_JWT_SECRET is not configured.");
-  ssmClient ??= new SSMClient({});
-  const response = await ssmClient.send(new GetParameterCommand({
-    Name: parameterName,
-    WithDecryption: true,
-  }));
-  const secret = normalizeOptionalString(response.Parameter?.Value);
-  if (!secret) throw new Error(`SSM parameter ${parameterName} did not return a value.`);
-  cachedJwtSecret = secret;
-  return secret;
-}
-
-function isAmplifySecretPlaceholder(value: string): boolean {
-  return /^<.*will be resolved.*>$/i.test(value);
-}
-
-function resolveAmplifySsmSecretPath(name: string): string | null {
-  const rawConfig = normalizeOptionalString(process.env.AMPLIFY_SSM_ENV_CONFIG);
-  if (!rawConfig) return null;
-  try {
-    const config = JSON.parse(rawConfig) as Record<string, { path?: string; sharedPath?: string } | undefined>;
-    return normalizeOptionalString(config[name]?.path) ?? normalizeOptionalString(config[name]?.sharedPath);
-  } catch {
-    throw new Error("AMPLIFY_SSM_ENV_CONFIG contains invalid JSON.");
-  }
-}
-
-function normalizeOptionalString(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed ? trimmed : null;
-}
-
-function assertExpectedIssuer(claims: JwtClaims): void {
-  const expectedIssuer = process.env.PAPYRUS_JWT_ISSUER;
-  if (expectedIssuer && claims.iss !== expectedIssuer) {
-    throw new Error("JWT issuer is not authorized.");
-  }
-}
-
-function assertExpectedAudience(claims: JwtClaims): void {
-  const expectedAudience = process.env.PAPYRUS_JWT_AUDIENCE;
-  if (!expectedAudience) return;
-
-  const audiences = Array.isArray(claims.aud) ? claims.aud : claims.aud ? [claims.aud] : [];
-  if (!audiences.includes(expectedAudience)) {
-    throw new Error("JWT audience is not authorized.");
-  }
-}
-
-function assertRequiredScope(claims: JwtClaims): void {
-  const requiredScope = process.env.PAPYRUS_JWT_REQUIRED_SCOPE;
-  if (!requiredScope) return;
-
-  const values = new Set([
-    ...getClaimValues(claims.scope),
-    ...getClaimValues(claims.scp),
-    ...getClaimValues(claims.groups),
-    ...getClaimValues(claims.roles),
-  ]);
-
-  if (!values.has(requiredScope)) {
-    throw new Error("JWT does not include the required authoring scope.");
-  }
-}
-
-function getClaimValues(value: unknown): string[] {
-  if (Array.isArray(value)) return value.flatMap(getClaimValues);
-  if (typeof value === "string") return value.split(/[,\s]+/).filter(Boolean);
-  return [];
-}
-
-function constantTimeEqual(left: string, right: string): boolean {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) return false;
-  return timingSafeEqual(leftBuffer, rightBuffer);
-}

package/amplify/functions/graphql-jwt-authorizer/resource.js

@@ -1,14 +0,0 @@
-import { defineFunction, secret } from "@aws-amplify/backend";
-export const graphqlJwtAuthorizer = defineFunction({
-    name: "papyrus-graphql-jwt-authorizer",
-    entry: "./handler.ts",
-    timeoutSeconds: 5,
-    memoryMB: 256,
-    resourceGroupName: "data",
-    environment: {
-        PAPYRUS_JWT_SECRET: secret("PAPYRUS_JWT_SECRET"),
-        PAPYRUS_JWT_ISSUER: "papyrus-cli",
-        PAPYRUS_JWT_AUDIENCE: "papyrus-authoring",
-        PAPYRUS_JWT_REQUIRED_SCOPE: "papyrus:write",
-    },
-});

package/amplify/functions/graphql-jwt-authorizer/resource.ts

@@ -1,15 +0,0 @@
-import { defineFunction, secret } from "@aws-amplify/backend";
-
-export const graphqlJwtAuthorizer = defineFunction({
-  name: "papyrus-graphql-jwt-authorizer",
-  entry: "./handler.ts",
-  timeoutSeconds: 5,
-  memoryMB: 256,
-  resourceGroupName: "data",
-  environment: {
-    PAPYRUS_JWT_SECRET: secret("PAPYRUS_JWT_SECRET"),
-    PAPYRUS_JWT_ISSUER: "papyrus-cli",
-    PAPYRUS_JWT_AUDIENCE: "papyrus-authoring",
-    PAPYRUS_JWT_REQUIRED_SCOPE: "papyrus:write",
-  },
-});