@anthusai/papyrus 1.17.0 → 1.18.0

package/amplify/data/resource.js

@@ -808,6 +808,7 @@ const schema = a.schema({
         categoryLineageId: a.id(),
     }),
     AssignmentContext: a.customType({
+        editorialContext: a.json().required(),
         assignment: a.ref("AssignmentSummary"),
         doctrine: a.ref("AssignmentDoctrineSummary").array().required(),
         targets: a.ref("AssignmentTargetSummary").array().required(),
@@ -834,6 +835,18 @@ const schema = a.schema({
         .returns(a.ref("AssignmentContext").array().required())
         .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
+    getEditorialContext: a
+        .query()
+        .arguments({
+        publicationKey: a.string().required(),
+        sectionId: a.id(),
+        storyLineageId: a.id(),
+        assignmentId: a.id(),
+        maxCharacters: a.integer(),
+    })
+        .returns(a.json().required())
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
+        .handler(a.handler.function(assignmentAction)),
     getAssignmentContext: a
         .query()
         .arguments({

package/amplify/data/resource.ts

@@ -878,6 +878,7 @@ const schema = a.schema({
   }),
 
   AssignmentContext: a.customType({
+    editorialContext: a.json().required(),
     assignment: a.ref("AssignmentSummary"),
     doctrine: a.ref("AssignmentDoctrineSummary").array().required(),
     targets: a.ref("AssignmentTargetSummary").array().required(),
@@ -907,6 +908,19 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
+  getEditorialContext: a
+    .query()
+    .arguments({
+      publicationKey: a.string().required(),
+      sectionId: a.id(),
+      storyLineageId: a.id(),
+      assignmentId: a.id(),
+      maxCharacters: a.integer(),
+    })
+    .returns(a.json().required())
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
+    .handler(a.handler.function(assignmentAction)),
+
   getAssignmentContext: a
     .query()
     .arguments({

package/amplify/data/schema.js

@@ -715,6 +715,7 @@ const baseDefinitions = {
         categoryLineageId: a.id(),
     }),
     AssignmentContext: a.customType({
+        editorialContext: a.json().required(),
         assignment: a.ref("AssignmentSummary"),
         doctrine: a.ref("AssignmentDoctrineSummary").array().required(),
         targets: a.ref("AssignmentTargetSummary").array().required(),
@@ -741,6 +742,18 @@ const baseDefinitions = {
         .returns(a.ref("AssignmentContext").array().required())
         .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
+    getEditorialContext: a
+        .query()
+        .arguments({
+        publicationKey: a.string().required(),
+        sectionId: a.id(),
+        storyLineageId: a.id(),
+        assignmentId: a.id(),
+        maxCharacters: a.integer(),
+    })
+        .returns(a.json().required())
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
+        .handler(a.handler.function(assignmentAction)),
     getAssignmentContext: a
         .query()
         .arguments({

package/amplify/data/schema.ts

@@ -779,6 +779,7 @@ const baseDefinitions = {
   }),
 
   AssignmentContext: a.customType({
+    editorialContext: a.json().required(),
     assignment: a.ref("AssignmentSummary"),
     doctrine: a.ref("AssignmentDoctrineSummary").array().required(),
     targets: a.ref("AssignmentTargetSummary").array().required(),
@@ -808,6 +809,19 @@ const baseDefinitions = {
     .authorization((allow) => [allow.groups(categoryWriteGroups)])
     .handler(a.handler.function(assignmentAction)),
 
+  getEditorialContext: a
+    .query()
+    .arguments({
+      publicationKey: a.string().required(),
+      sectionId: a.id(),
+      storyLineageId: a.id(),
+      assignmentId: a.id(),
+      maxCharacters: a.integer(),
+    })
+    .returns(a.json().required())
+    .authorization((allow) => [allow.groups(categoryWriteGroups)])
+    .handler(a.handler.function(assignmentAction)),
+
   getAssignmentContext: a
     .query()
     .arguments({

package/amplify/functions/assignment-action/handler.ts

@@ -1,3 +1,5 @@
+import { assignmentDoctrine, resolveEditorialContext, type EditorialClient } from "../shared/editorial-context";
+import { tenantIdFromEnvironment } from "../../../lib/tenant-keys";
 import { randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -7,7 +9,7 @@ import { getAmplifyDataClientConfig } from "@aws-amplify/backend/function/runtim
 import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
-import { putJsonModelPayload, readJsonModelPayload } from "../shared/model-payloads";
+import { putJsonModelPayload, readJsonModelPayload, readEditorialAttachment } from "../shared/model-payloads";
 
 type AssignmentHandler =
   | Schema["claimAssignment"]["functionHandler"]
@@ -17,6 +19,7 @@ type AssignmentHandler =
   | Schema["reopenAssignment"]["functionHandler"]
   | Schema["retryImmediateAssignment"]["functionHandler"]
   | Schema["getAssignmentContext"]["functionHandler"]
+  | Schema["getEditorialContext"]["functionHandler"]
   | Schema["listAssignmentQueue"]["functionHandler"]
   | Schema["listAssignmentsForObject"]["functionHandler"];
 type DataClient = ReturnType<typeof generateClient<Schema>>;
@@ -32,14 +35,12 @@ const IMMEDIATE_ASSIGNMENT_TYPES = new Set(["procedure.run"]);
 const NEWSROOM_SUMMARY_PAYLOAD_ID = "knowledge-raw-payload-newsroom-summary-current";
 const NEWSROOM_SUMMARY_PAYLOAD_OWNER_KIND = "knowledgeRawPayload";
 const SUMMARY_STALE_AFTER_MS = 15 * 60 * 1000;
-const PUBLICATION_DOCTRINE_DEFINITIONS = [
-  { scope: "publication", kind: "mission", label: "Editorial Mission", slug: "editorial-doctrine-mission" },
-  { scope: "publication", kind: "policy", label: "Editorial Policy", slug: "editorial-doctrine-policy" },
-] as const;
 let clientPromise: Promise<DataClient> | null = null;
+let editorialEndpoint: string | undefined;
 
 export const handler = async (event: any): Promise<any> => {
   const fieldName = normalizeRequiredString(event.info?.fieldName ?? event.fieldName, "fieldName");
+  if (fieldName === "getEditorialContext") return getEditorialContext(event as Parameters<Schema["getEditorialContext"]["functionHandler"]>[0]);
   if (fieldName === "getAssignmentContext") return getAssignmentContext(event as Parameters<Schema["getAssignmentContext"]["functionHandler"]>[0]);
   if (fieldName === "listAssignmentQueue") return listAssignmentQueue(event as Parameters<Schema["listAssignmentQueue"]["functionHandler"]>[0]);
   if (fieldName === "listAssignmentsForObject") return listAssignmentsForObject(event as Parameters<Schema["listAssignmentsForObject"]["functionHandler"]>[0]);
@@ -315,6 +316,20 @@ async function listAssignmentsForObject(event: Parameters<Schema["listAssignment
   return contexts;
 }
 
+async function editorialContext(client: DataClient, scope: { publicationKey?: string; sectionId?: string | null; storyLineageId?: string | null; assignmentId?: string | null; maxCharacters?: number | null }) {
+  if (!editorialEndpoint) throw new Error("Editorial context requires the configured backend endpoint.");
+  return resolveEditorialContext(client as unknown as EditorialClient, {
+    ...scope, endpoint: editorialEndpoint, tenantId: tenantIdFromEnvironment(), readAttachment: readEditorialAttachment,
+  });
+}
+
+async function getEditorialContext(event: Parameters<Schema["getEditorialContext"]["functionHandler"]>[0]) {
+  const client = await getDataClient();
+  return JSON.stringify(await editorialContext(client, {
+    ...event.arguments, publicationKey: normalizeRequiredString(event.arguments.publicationKey, "publicationKey"),
+  }));
+}
+
 async function buildAssignmentContext(client: DataClient, assignment: any) {
   const [relations, events] = await Promise.all([
     listRelationPages(client, "listSemanticRelationsBySubjectState", { subjectStateKey: semanticStateKey("assignment", assignment.id) }),
@@ -329,172 +344,17 @@ async function buildAssignmentContext(client: DataClient, assignment: any) {
       label: targetLabelFromRelation(relation),
       detail: relation.predicate,
     }));
-  const rootDeskCategory = await resolveRootDeskCategory(client, assignment, relations);
-  const doctrine = await buildAssignmentDoctrineContext(client, rootDeskCategory);
+  const pack = await editorialContext(client, { assignmentId: assignment.id });
+  const doctrine = assignmentDoctrine(pack);
   return {
     assignment,
+    editorialContext: JSON.stringify(pack),
     doctrine,
     targets,
     events,
   };
 }
 
-async function buildAssignmentDoctrineContext(client: DataClient, rootDeskCategory: any | null): Promise<any[]> {
-  const definitions = [
-    ...PUBLICATION_DOCTRINE_DEFINITIONS,
-    ...(rootDeskCategory ? [
-      {
-        scope: "desk",
-        kind: "mission",
-        label: "Desk Mission",
-        slug: deskDoctrineSlug(rootDeskCategory.categoryKey, "mission"),
-        categoryKey: rootDeskCategory.categoryKey,
-        categoryLineageId: rootDeskCategory.lineageId ?? rootDeskCategory.id,
-      },
-      {
-        scope: "desk",
-        kind: "policy",
-        label: "Desk Policies",
-        slug: deskDoctrineSlug(rootDeskCategory.categoryKey, "policy"),
-        categoryKey: rootDeskCategory.categoryKey,
-        categoryLineageId: rootDeskCategory.lineageId ?? rootDeskCategory.id,
-      },
-    ] : []),
-  ];
-
-  const context = [];
-  for (const definition of definitions) {
-    const record = await getDoctrineRecordBySlug(client, definition.slug);
-    if (!record) continue;
-    context.push({
-      scope: definition.scope,
-      kind: definition.kind,
-      label: definition.label,
-      slug: definition.slug,
-      body: compactStringArray(record.body),
-      categoryKey: "categoryKey" in definition ? definition.categoryKey : null,
-      categoryLineageId: "categoryLineageId" in definition ? definition.categoryLineageId : null,
-    });
-  }
-  return context;
-}
-
-async function resolveRootDeskCategory(client: DataClient, assignment: any, relations: any[]): Promise<any | null> {
-  const categoryLineageId = assignmentCategoryLineageIdFromRelations(relations);
-  if (categoryLineageId) {
-    const category = await getCurrentCategoryByLineage(client, categoryLineageId);
-    return category ? resolveRootCategory(client, category) : null;
-  }
-
-  const categoryKey = normalizeOptionalString(assignment.primaryFocusCategoryKey);
-  if (categoryKey && assignment.categorySetId) {
-    const category = await getCurrentCategoryBySetAndKey(client, assignment.categorySetId, categoryKey);
-    return category ? resolveRootCategory(client, category) : null;
-  }
-
-  return null;
-}
-
-function assignmentCategoryLineageIdFromRelations(relations: any[]): string | null {
-  const direct = relations.find((relation) => (
-    relation.relationState === "current"
-    && relation.objectKind === "category"
-    && relation.predicate === "requests_work_on"
-  )) ?? relations.find((relation) => (
-    relation.relationState === "current"
-    && relation.objectKind === "category"
-  ));
-  return normalizeOptionalString(direct?.objectLineageId);
-}
-
-async function resolveRootCategory(client: DataClient, category: any): Promise<any | null> {
-  let current = category;
-  for (let depth = 0; depth < 10; depth += 1) {
-    const parentCategoryKey = normalizeOptionalString(current?.parentCategoryKey);
-    if (!parentCategoryKey) return current;
-    const parent = await getCurrentCategoryBySetAndKey(client, current.categorySetId, parentCategoryKey);
-    if (!parent) return current;
-    current = parent;
-  }
-  return current;
-}
-
-async function getCurrentCategoryByLineage(client: DataClient, lineageId: string): Promise<any | null> {
-  const model = client.models.Category as any;
-  const query = model.listCategoriesByLineageAndVersion;
-  if (typeof query !== "function") return null;
-  const categories: any[] = [];
-  let nextToken: string | null | undefined;
-  do {
-    const response: DataClientResult<any[]> = await query({ lineageId }, { limit: 100, nextToken });
-    assertNoDataErrors(response.errors, "list Category lineage");
-    categories.push(...(response.data ?? []));
-    nextToken = response.nextToken;
-  } while (nextToken);
-  return selectCurrentVersion(categories);
-}
-
-async function getCurrentCategoryBySetAndKey(client: DataClient, categorySetId: string, categoryKey: string): Promise<any | null> {
-  const model = client.models.Category as any;
-  const query = model.listCategoriesBySetAndKey;
-  if (typeof query !== "function") return null;
-  const categories: any[] = [];
-  let nextToken: string | null | undefined;
-  do {
-    const response: DataClientResult<any[]> = await query({ categorySetId, categoryKey }, { limit: 100, nextToken });
-    assertNoDataErrors(response.errors, "list Category set/key");
-    categories.push(...(response.data ?? []));
-    nextToken = response.nextToken;
-  } while (nextToken);
-  return selectCurrentVersion(categories);
-}
-
-async function getDoctrineRecordBySlug(client: DataClient, slug: string): Promise<any | null> {
-  const model = client.models.Item as any;
-  const query = model.itemBySlug;
-  if (typeof query !== "function") return null;
-  const records: any[] = [];
-  let nextToken: string | null | undefined;
-  do {
-    const response: DataClientResult<any[]> = await query({ slug }, { limit: 100, nextToken });
-    assertNoDataErrors(response.errors, "query Item by slug");
-    records.push(...(response.data ?? []));
-    nextToken = response.nextToken;
-  } while (nextToken);
-  return records.find((record) => record.type === "doctrine" && record.status === "private")
-    ?? records.find((record) => record.type === "doctrine")
-    ?? null;
-}
-
-function selectCurrentVersion(records: any[]): any | null {
-  return [...records]
-    .filter((record) => record && record.status !== "deprecated")
-    .sort((left, right) => {
-      const stateDiff = versionStateRank(left.versionState) - versionStateRank(right.versionState);
-      if (stateDiff !== 0) return stateDiff;
-      return Number(right.versionNumber ?? 0) - Number(left.versionNumber ?? 0);
-    })[0] ?? null;
-}
-
-function versionStateRank(versionState: unknown): number {
-  if (versionState === "current") return 0;
-  if (versionState === "draft") return 1;
-  if (versionState === "superseded") return 8;
-  return 5;
-}
-
-function deskDoctrineSlug(categoryKey: string, kind: "mission" | "policy"): string {
-  return `desk-doctrine-${safeDoctrineKey(categoryKey)}-${kind}`;
-}
-
-function safeDoctrineKey(value: string): string {
-  return value
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    || "topic";
-}
 
 function compactStringArray(value: unknown): string[] {
   if (!Array.isArray(value)) return [];
@@ -1159,6 +1019,7 @@ async function getDataClient(): Promise<DataClient> {
     clientPromise = (async () => {
       const { resourceConfig, libraryOptions } = await getAmplifyDataClientConfig(process.env as never);
       Amplify.configure(resourceConfig, libraryOptions);
+      editorialEndpoint = resourceConfig.API?.GraphQL?.endpoint;
       return generateClient<Schema>();
     })();
   }

package/amplify/functions/shared/editorial-context.ts

@@ -0,0 +1,160 @@
+import { createHash } from "node:crypto";
+import { tenantScopedValue } from "../../../lib/tenant-keys";
+
+export type EditorialRecord = Record<string, any>;
+type Result = { data?: EditorialRecord | EditorialRecord[] | null; errors?: unknown; nextToken?: string | null };
+type Model = Record<string, (args: Record<string, any>, options?: Record<string, any>) => Promise<Result>>;
+export type EditorialClient = { models: Record<string, Model> };
+export type EditorialOptions = {
+  publicationKey?: string;
+  endpoint: string;
+  tenantId?: string;
+  sectionId?: string | null;
+  storyLineageId?: string | null;
+  assignmentId?: string | null;
+  maxCharacters?: number | null;
+  readAttachment: (attachment: EditorialRecord) => Promise<string>;
+};
+
+function checked(response: Result, operation: string) {
+  if (response.errors && (!Array.isArray(response.errors) || response.errors.length)) throw new Error(`${operation}: ${JSON.stringify(response.errors)}`);
+  return response;
+}
+
+async function pages(client: EditorialClient, model: string, index: string, args: EditorialRecord) {
+  const rows: EditorialRecord[] = [];
+  let nextToken: string | null | undefined;
+  do {
+    const response = checked(await client.models[model][index](args, { limit: 100, nextToken }), `read ${model} ${index}`);
+    rows.push(...(response.data as EditorialRecord[] ?? []));
+    nextToken = response.nextToken;
+  } while (nextToken);
+  return rows;
+}
+
+async function get(client: EditorialClient, model: string, id: string) {
+  const row = checked(await client.models[model].get({ id }), `read ${model}`).data as EditorialRecord | null;
+  if (!row) throw new Error(`${model} not found: ${id}`);
+  return row;
+}
+
+function tenant(row: EditorialRecord, tenantId?: string) {
+  if ((row.tenantId || null) !== (tenantId || null)) throw new Error("Editorial record tenant does not match the configured authoring scope.");
+}
+
+function canonical(value: any): any {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value !== null && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])]));
+  return value;
+}
+function digest(value: string) { return createHash("sha256").update(value, "utf8").digest("hex"); }
+function entry(scope: string, kind: string, text: string, record: EditorialRecord) {
+  return { scope, kind, text, source: {
+    ...Object.fromEntries(["id", "lineageId", "versionNumber", "updatedAt", "contentHash"].map(key => [key, record[key] ?? null])),
+    sha256: digest(text),
+  } };
+}
+
+export function buildEditorialContext(publication: EditorialRecord, scope: EditorialRecord, entries: EditorialRecord[], warnings: string[], maxCharacters = 0) {
+  const lines = [`Editorial context: ${publication.key}`, "Source: cloud",
+    "Precedence: publication > section > assignment. Surface conflicts; narrower instructions do not silently override publication policy.",
+    "Private operating guidance; not evidence or reader-facing copy."];
+  for (const value of entries) lines.push("", `## ${value.scope}: ${value.kind}`, value.text);
+  const text = lines.join("\n") + "\n";
+  const totalCharacters = Array.from(text).length;
+  if (!Number.isInteger(maxCharacters) || maxCharacters < 0) throw new Error("Editorial context budget must be nonnegative.");
+  if (maxCharacters && totalCharacters > maxCharacters) throw new Error(`Editorial context budget ${maxCharacters} cannot hold ${totalCharacters} required characters; policy was not truncated.`);
+  const payload = { schemaVersion: 1, rendererVersion: "editorial-context/v1", publication, scope, sourceMode: "cloud",
+    precedence: ["publication", "section", "assignment"], entries, sources: entries.map(value => value.source), warnings, text, totalCharacters };
+  return { ...payload, contextHash: digest(JSON.stringify(canonical(payload))), resolvedAt: new Date().toISOString() };
+}
+
+/** Private source adapter for the same deterministic contract exposed by papyrus editorial context. */
+export async function resolveEditorialContext(client: EditorialClient, options: EditorialOptions) {
+  if (!options.endpoint) throw new Error("Explicit publication endpoint is required for hosted editorial context.");
+  const corpora = await pages(client, "KnowledgeCorpus", "listKnowledgeCorporaByRoleAndName", { role: "canonical" });
+  const requested = options.publicationKey;
+  const normalized = requested?.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 140);
+  if (corpora.length !== 1 || !corpora[0].id?.startsWith("knowledge-corpus-") || corpora[0].role !== "canonical" || !corpora[0].name?.trim() ||
+      (requested !== undefined && (!normalized || corpora[0].id !== `knowledge-corpus-${normalized}`))) {
+    throw new Error("Requested publication does not match the hosted canonical corpus; missing or ambiguous publication binding.");
+  }
+  const publication = { key: corpora[0].id.slice("knowledge-corpus-".length), name: corpora[0].name,
+    corpusId: corpora[0].id, tenantId: options.tenantId ?? null, endpoint: options.endpoint };
+  const entries: EditorialRecord[] = [];
+  const warnings: string[] = [];
+  let sectionId = options.sectionId || null;
+  let storyLineageId = options.storyLineageId || null;
+  const assignmentId = options.assignmentId || null;
+  let assignment: EditorialRecord | undefined;
+  if (assignmentId) {
+    assignment = await get(client, "Assignment", assignmentId);
+    const assignedStory = assignment.itemLineageId;
+    if (storyLineageId && assignedStory && storyLineageId !== assignedStory) throw new Error("Requested story conflicts with assignment story lineage.");
+    storyLineageId ||= assignedStory || null;
+    const assignedSection = assignment.sectionKey || assignment.sectionId;
+    if (sectionId && assignedSection && sectionId !== assignedSection) throw new Error("Requested section conflicts with assignment section.");
+    sectionId ||= assignedSection || null;
+    warnings.push("Assignment policy snapshots are ignored; current publication and section records govern. Surface any conflicting assignment instructions.");
+  }
+  if (storyLineageId) {
+    const versions = await pages(client, "Item", "listItemsByLineageAndVersion", { lineageId: storyLineageId });
+    if (!versions.length) throw new Error(`Story not found: ${storyLineageId}`);
+    const story = versions.reduce((a, b) => Number(b.versionNumber || 0) > Number(a.versionNumber || 0) ? b : a);
+    tenant(story, options.tenantId);
+    if (sectionId && story.section && sectionId !== story.section) throw new Error("Requested section conflicts with story section.");
+    sectionId ||= story.section || null;
+  }
+  for (const kind of ["mission", "policy"]) {
+    const slug = `editorial-doctrine-${kind}`;
+    const rows = await pages(client, "Item", options.tenantId ? "itemByTenantSlug" : "itemBySlug",
+      options.tenantId ? { tenantSlug: tenantScopedValue(options.tenantId, slug) } : { slug });
+    const current = rows.filter(row => row.type === "doctrine" && row.status === "private" && row.versionState === "current");
+    if (current.length !== 1) throw new Error(`Publication ${kind}: expected exactly one current record, found ${current.length}.`);
+    const record = current[0];
+    tenant(record, options.tenantId);
+    const text = record.bodyMarkus ? String(record.bodyMarkus).trim() : (record.body ?? []).map((part: any) => String(part).trim()).filter(Boolean).join("\n\n");
+    if (!text) throw new Error(`Required publication ${kind} is empty.`);
+    entries.push(entry("publication", kind, text, record));
+  }
+  if (sectionId) {
+    const section = await get(client, "NewsroomSection", sectionId);
+    tenant(section, options.tenantId);
+    for (const [kind, key] of [["mission", "editorialMission"], ["policy", "editorialPolicy"], ["guidance", "assignmentGuidance"], ["kill criteria", "killCriteria"]]) {
+      const text = String(section[key] || "").trim();
+      if (text) entries.push(entry("section", kind, text, section));
+      else if (kind === "mission" || kind === "policy") warnings.push(`Section ${section.id} intentionally has an empty ${kind} slot; publication doctrine still applies.`);
+    }
+  }
+  if (assignment) {
+    if (options.tenantId && !storyLineageId && !sectionId) throw new Error("A tenant assignment needs a scoped story or section to establish its publication.");
+    const attachments = await pages(client, "ModelAttachment", "listModelAttachmentsByOwnerRoleAndSortKey", { ownerId: assignment.id });
+    let foundBrief = false;
+    for (const [role, kind] of [["assignment_brief", "brief"], ["assignment_instructions", "instructions"]]) {
+      const matching = attachments.filter(row => row.role === role && row.status !== "deleted");
+      if (matching.length > 1) throw new Error(`Ambiguous assignment ${kind} attachments.`);
+      if (matching.length) {
+        const attachment = matching[0];
+        if (attachment.ownerKind !== "assignment" || attachment.ownerId !== assignment.id) throw new Error("Assignment attachment owner does not match the requested scope.");
+        const text = (await options.readAttachment(attachment)).trim();
+        if (!text) throw new Error(`Assignment ${kind} attachment is empty.`);
+        entries.push(entry("assignment", kind, text, attachment));
+        foundBrief ||= kind === "brief";
+      }
+    }
+    if (!foundBrief && assignment.summary) {
+      entries.push(entry("assignment", "brief", assignment.summary, assignment));
+      warnings.push("No assignment brief attachment exists; the Assignment summary is supplied as its brief.");
+    }
+  }
+  return buildEditorialContext(publication, { sectionId, storyLineageId, assignmentId }, entries, warnings, options.maxCharacters ?? 0);
+}
+
+export function assignmentDoctrine(pack: Awaited<ReturnType<typeof resolveEditorialContext>>) {
+  return pack.entries.filter(value => value.scope !== "assignment").map(value => ({
+    scope: value.scope === "section" ? "desk" : "publication", kind: value.kind,
+    label: `${value.scope === "section" ? "Section" : "Editorial"} ${value.kind}`,
+    slug: value.scope === "section" ? `desk-section-${pack.scope.sectionId}-${value.kind.replaceAll(" ", "-")}` : `editorial-doctrine-${value.kind}`,
+    body: [value.text], ...(value.scope === "section" ? { categoryKey: pack.scope.sectionId, categoryLineageId: pack.scope.sectionId } : {}),
+  }));
+}

package/amplify/functions/shared/model-payloads.ts

@@ -135,6 +135,15 @@ async function readTextFromStorage(storagePath: string): Promise<string> {
   }
 }
 
+/** Strict read for required private editorial payloads; storage failures propagate. */
+export async function readEditorialAttachment(attachment: { storagePath?: string | null }): Promise<string> {
+  if (!attachment.storagePath) throw new Error("Editorial attachment has no storage path.");
+  const result = await s3.send(new GetObjectCommand({ Bucket: payloadBucketName(), Key: attachment.storagePath }));
+  const text = await result.Body?.transformToString("utf8");
+  if (!text?.trim()) throw new Error("Editorial attachment is empty.");
+  return text;
+}
+
 function isMissingStorageKeyError(error: unknown): boolean {
   if (!error || typeof error !== "object") return false;
   const record = error as Record<string, unknown>;

package/bin/papyrus-infra.mjs

@@ -3,11 +3,13 @@
  * papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]
  * papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]
  * papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader
- * Synthesizes the app-shell stack for a publication from its own site.json, or
- * prints one of the generated Amplify build specs. Synth only: deploying is a
- * separate, reviewed step.
+ * papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]
+ * Synthesizes the app-shell stack for a publication from its own site.json,
+ * prints one of the generated Amplify build specs, or deploys the stack from
+ * inside the Amplify build of the one branch that owns it.
  */
 import fs from "node:fs";
+import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { createRequire } from "node:module";
 import { buildSpecFor } from "../infra/build-specs.js";
@@ -17,6 +19,7 @@ const USAGE = [
   "Usage: papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
+  "       papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]",
 ].join("\n");
 
 const args = process.argv.slice(2);
@@ -25,7 +28,7 @@ const opt = (name, fallback) => {
   return i >= 0 ? args[i + 1] : fallback;
 };
 const command = args[0];
-if (command !== "synth" && command !== "print-buildspec") {
+if (command !== "synth" && command !== "print-buildspec" && command !== "deploy") {
   console.error(USAGE);
   process.exit(command ? 1 : 0);
 }
@@ -77,6 +80,41 @@ if (command === "print-buildspec") {
   process.exit(0);
 }
 
+if (command === "deploy") {
+  const buildAppId = process.env.AWS_APP_ID;
+  const buildBranch = process.env.AWS_BRANCH;
+  const owningBranch = opt("only-branch", "main");
+  const owningAppId = opt("only-app-id");
+  if (!buildAppId || !buildBranch) {
+    console.log("papyrus-infra deploy: not running inside an Amplify build, skipping");
+    process.exit(0);
+  }
+  if (buildBranch !== owningBranch || (owningAppId && buildAppId !== owningAppId)) {
+    console.log(`papyrus-infra deploy: ${buildAppId}/${buildBranch} does not own the stack, skipping`);
+    process.exit(0);
+  }
+  const outputDirectory = path.resolve(opt("out", process.env.CDK_OUTDIR ?? "cdk.out"));
+  const synthCommand = [
+    process.execPath,
+    path.resolve(process.argv[1]),
+    "synth",
+    "--site",
+    path.resolve(opt("site", "infra/site.json")),
+    "--out",
+    outputDirectory,
+    "--account",
+    opt("account", process.env.CDK_DEFAULT_ACCOUNT ?? "335163751677"),
+    "--region",
+    opt("region", process.env.CDK_DEFAULT_REGION ?? "us-east-1"),
+  ].map((part) => JSON.stringify(part)).join(" ");
+  const deployment = spawnSync(
+    "npx",
+    ["--yes", "aws-cdk@2", "deploy", "--app", synthCommand, "--require-approval", "never", `AmplifyAppShell-${config.siteId}`],
+    { stdio: "inherit" },
+  );
+  process.exit(deployment.status ?? 1);
+}
+
 let AmplifyAppShellStack;
 try {
   ({ AmplifyAppShellStack } = await import("../infra/index.js"));

package/infra/build-specs.js

@@ -43,7 +43,9 @@ function frontendSection(preBuildCommands, buildCommands, artifactsDirectory, ca
     lines.push("    build:", "      commands:", ...commandLines(buildCommands, "        "), "  artifacts:", `    baseDirectory: ${artifactsDirectory}`, "    files:", "      - '**/*'", "  cache:", "    paths:", ...cachePaths.map((cachePath) => `      - ${cachePath}`));
     return lines;
 }
+const DEPLOY_STACK_IN_BUILD = "npx papyrus-infra deploy --site infra/site.json --only-branch main";
 export function cmsProductionBuildSpec(config) {
+    const deployStackCommands = config.cms?.deployStackInBuild ? [DEPLOY_STACK_IN_BUILD] : [];
     return [
         "version: 1",
         "backend:",
@@ -52,6 +54,7 @@ export function cmsProductionBuildSpec(config) {
         "      commands:",
         ...commandLines([
             NPM_CLEAN_INSTALL,
+            ...deployStackCommands,
             "if [ -z \"${PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI:-}\" ]; then export PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD=true; fi",
             "npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID",
         ], "        "),

package/infra/build-specs.ts

@@ -67,7 +67,10 @@ function frontendSection(preBuildCommands: string[], buildCommands: string[], ar
   return lines;
 }
 
+const DEPLOY_STACK_IN_BUILD = "npx papyrus-infra deploy --site infra/site.json --only-branch main";
+
 export function cmsProductionBuildSpec(config: AmplifyAppShellSiteConfig): string {
+  const deployStackCommands = config.cms?.deployStackInBuild ? [DEPLOY_STACK_IN_BUILD] : [];
   return [
     "version: 1",
     "backend:",
@@ -77,6 +80,7 @@ export function cmsProductionBuildSpec(config: AmplifyAppShellSiteConfig): strin
     ...commandLines(
       [
         NPM_CLEAN_INSTALL,
+        ...deployStackCommands,
         "if [ -z \"${PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI:-}\" ]; then export PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD=true; fi",
         "npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID",
       ],

package/infra/site-config.js

@@ -199,7 +199,7 @@ function parseStagingPreview(value) {
 }
 function parseCms(value) {
     const cmsRecord = requireObject(value, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -210,6 +210,9 @@ function parseCms(value) {
     if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
         fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
     }
+    if (cmsRecord.deployStackInBuild !== undefined && typeof cmsRecord.deployStackInBuild !== "boolean") {
+        fail("cms.deployStackInBuild", `must be a boolean, got ${JSON.stringify(cmsRecord.deployStackInBuild)}`);
+    }
     const cms = {
         appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
         domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
@@ -222,6 +225,7 @@ function parseCms(value) {
         stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
         stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
         redirects: parseRedirects(cmsRecord.redirects),
+        deployStackInBuild: cmsRecord.deployStackInBuild,
         stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
         prospectusAccountsApiStageArn: optionalString(cmsRecord.prospectusAccountsApiStageArn, "cms.prospectusAccountsApiStageArn", PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN, "arn:aws:execute-api:<region>:<account>:<api id>/api"),
     };

package/infra/site-config.ts

@@ -42,6 +42,7 @@ export type CmsConfig = {
   stagingDomainPrefix?: string;
   redirects?: CmsRedirect[];
   prospectusAccountsApiStageArn?: string;
+  deployStackInBuild?: boolean;
 };
 
 export type AmplifyAppShellSiteConfig = {
@@ -281,7 +282,7 @@ function parseStagingPreview(value: unknown): StagingPreviewConfig | undefined {
 
 function parseCms(value: unknown): CmsConfig {
   const cmsRecord = requireObject(value, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -292,6 +293,9 @@ function parseCms(value: unknown): CmsConfig {
   if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
     fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
   }
+  if (cmsRecord.deployStackInBuild !== undefined && typeof cmsRecord.deployStackInBuild !== "boolean") {
+    fail("cms.deployStackInBuild", `must be a boolean, got ${JSON.stringify(cmsRecord.deployStackInBuild)}`);
+  }
   const cms: CmsConfig = {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
     domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
@@ -309,6 +313,7 @@ function parseCms(value: unknown): CmsConfig {
     stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
     stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
     redirects: parseRedirects(cmsRecord.redirects),
+    deployStackInBuild: cmsRecord.deployStackInBuild as boolean | undefined,
     stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
     prospectusAccountsApiStageArn: optionalString(
       cmsRecord.prospectusAccountsApiStageArn,

package/package.json

@@ -379,7 +379,7 @@
       "optional": true
     }
   },
-  "version": "1.17.0",
+  "version": "1.18.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.17.0",
+  "version": "1.18.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",