@anthusai/papyrus 2.0.0-next.10 → 2.0.0-next.101

package/amplify/plugins/editorial-checks/papyrus.plugin.js

@@ -1,71 +0,0 @@
-import { secret } from "@aws-amplify/backend";
-import { Stack } from "aws-cdk-lib";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { editorialChecks } from "./function/resource.js";
-import { editorialChecksSchemaDefinitions } from "./schema.js";
-export const EDITORIAL_CHECKS_QUERIES = ["checkEditorial", "suggestEditorialRewrite", "draftEditorialQuestions", "tryEditorialPolicy"];
-export const EDITORIAL_CHECKS_MUTATIONS = ["importEditorialStarterPack", "recalibrateEditorialPolicies"];
-/** The model operations the function performs with its own role. */
-export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
-    "Query/fields/listKnowledgeCorporaByRoleAndName",
-    "Query/fields/getEditorialContext",
-    "Query/fields/listEditorialPolicies",
-    "Query/fields/getEditorialCheckSettings",
-    "Query/fields/listEditorialFeedbacks",
-    "Mutation/fields/createEditorialPolicy",
-    "Mutation/fields/updateEditorialPolicy",
-];
-export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
-/**
- * SSM parameters holding the provider keys. A Python function reads its secret()
- * values itself (Amplify only resolves them for Node functions), so it needs read
- * access to the app's branch and shared secret paths, and to the sandbox paths.
- */
-export function editorialChecksSecretParameters(region, account, appId) {
-    const arn = (path) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
-    return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
-        arn(`papyrus/*/${name}`),
-        arn(`shared/papyrus/${name}`),
-        ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
-    ]);
-}
-export const editorialChecksManifest = {
-    name: "editorial-checks",
-    contract: 1,
-    models: ["EditorialPolicy", "EditorialCheckSettings", "EditorialFeedback"],
-    mutations: [...EDITORIAL_CHECKS_QUERIES, ...EDITORIAL_CHECKS_MUTATIONS],
-    guest: { mutations: [] },
-    newsroomPanels: [{ id: "editorial-checks", label: "Editorial checks" }],
-    staticAssets: [],
-};
-export function resolveEditorialChecksConfig(request) {
-    const raw = typeof request === "string" ? { name: request } : request;
-    const unknown = Object.keys(raw).filter((key) => key !== "name");
-    if (unknown.length > 0)
-        throw new Error(`Unknown editorial-checks plugin settings: ${unknown.join(", ")} (runtime settings are edited in the newsroom)`);
-    return {};
-}
-export const editorialChecksPlugin = {
-    manifest: editorialChecksManifest,
-    resolveConfig: resolveEditorialChecksConfig,
-    functions: () => ({ editorialChecks }),
-    schemaDefinitions: editorialChecksSchemaDefinitions,
-    publicSettings: () => ({ contract: editorialChecksManifest.contract }),
-    wire(backend, _config, context) {
-        const lambda = backend.editorialChecks.resources.lambda;
-        const stack = Stack.of(lambda);
-        lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
-        for (const name of EDITORIAL_CHECKS_SECRETS)
-            backend.editorialChecks.addEnvironment(name, secret(name));
-        lambda.addToRolePolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: ["ssm:GetParameter", "ssm:GetParameters"],
-            resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
-        }));
-        lambda.addToRolePolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: ["appsync:GraphQL"],
-            resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/${field}`),
-        }));
-    },
-};

package/amplify/plugins/editorial-checks/papyrus.plugin.ts

@@ -1,87 +0,0 @@
-import { secret } from "@aws-amplify/backend";
-import { Stack } from "aws-cdk-lib";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
-import type { PapyrusPlugin, PluginManifest, PluginRequest, PluginWiringContext } from "../types";
-import { editorialChecks } from "./function/resource";
-import { editorialChecksSchemaDefinitions } from "./schema";
-
-/** Runtime settings (lanes, models, deadline) live in EditorialCheckSettings, edited in the newsroom; enabling the plugin takes no options. */
-export type EditorialChecksPluginConfig = Record<string, never>;
-
-export const EDITORIAL_CHECKS_QUERIES = ["checkEditorial", "suggestEditorialRewrite", "draftEditorialQuestions", "tryEditorialPolicy"];
-export const EDITORIAL_CHECKS_MUTATIONS = ["importEditorialStarterPack", "recalibrateEditorialPolicies"];
-
-/** The model operations the function performs with its own role. */
-export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
-  "Query/fields/listKnowledgeCorporaByRoleAndName",
-  "Query/fields/getEditorialContext",
-  "Query/fields/listEditorialPolicies",
-  "Query/fields/getEditorialCheckSettings",
-  "Query/fields/listEditorialFeedbacks",
-  "Mutation/fields/createEditorialPolicy",
-  "Mutation/fields/updateEditorialPolicy",
-];
-
-export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
-
-/**
- * SSM parameters holding the provider keys. A Python function reads its secret()
- * values itself (Amplify only resolves them for Node functions), so it needs read
- * access to the app's branch and shared secret paths, and to the sandbox paths.
- */
-export function editorialChecksSecretParameters(region: string, account: string, appId: string): string[] {
-  const arn = (path: string) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
-  return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
-    arn(`papyrus/*/${name}`),
-    arn(`shared/papyrus/${name}`),
-    ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
-  ]);
-}
-
-export const editorialChecksManifest: PluginManifest = {
-  name: "editorial-checks",
-  contract: 1,
-  models: ["EditorialPolicy", "EditorialCheckSettings", "EditorialFeedback"],
-  mutations: [...EDITORIAL_CHECKS_QUERIES, ...EDITORIAL_CHECKS_MUTATIONS],
-  guest: { mutations: [] },
-  newsroomPanels: [{ id: "editorial-checks", label: "Editorial checks" }],
-  staticAssets: [],
-};
-
-export function resolveEditorialChecksConfig(request: PluginRequest): EditorialChecksPluginConfig {
-  const raw = typeof request === "string" ? { name: request } : request;
-  const unknown = Object.keys(raw).filter((key) => key !== "name");
-  if (unknown.length > 0) throw new Error(`Unknown editorial-checks plugin settings: ${unknown.join(", ")} (runtime settings are edited in the newsroom)`);
-  return {};
-}
-
-export const editorialChecksPlugin: PapyrusPlugin<EditorialChecksPluginConfig, { editorialChecks: typeof editorialChecks }> = {
-  manifest: editorialChecksManifest,
-  resolveConfig: resolveEditorialChecksConfig,
-  functions: () => ({ editorialChecks }),
-  schemaDefinitions: editorialChecksSchemaDefinitions,
-  publicSettings: () => ({ contract: editorialChecksManifest.contract }),
-  wire(backend, _config, context: PluginWiringContext) {
-    const lambda = backend.editorialChecks.resources.lambda as LambdaFunction;
-    const stack = Stack.of(lambda);
-    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
-    for (const name of EDITORIAL_CHECKS_SECRETS) backend.editorialChecks.addEnvironment(name, secret(name));
-    lambda.addToRolePolicy(
-      new PolicyStatement({
-        effect: Effect.ALLOW,
-        actions: ["ssm:GetParameter", "ssm:GetParameters"],
-        resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
-      }),
-    );
-    lambda.addToRolePolicy(
-      new PolicyStatement({
-        effect: Effect.ALLOW,
-        actions: ["appsync:GraphQL"],
-        resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map(
-          (field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/${field}`,
-        ),
-      }),
-    );
-  },
-};

package/amplify/plugins/editorial-checks/schema.js

@@ -1,94 +0,0 @@
-import { a } from "@aws-amplify/backend";
-import { editorialChecks } from "./function/resource.js";
-const editors = ["editor", "admin"];
-/**
- * Policies, settings and editors' decisions live in Papyrus; Limatus checks
- * content against them. Editors read policies and record decisions; admins
- * manage policies and settings. Only the function (IAM) calls Limatus.
- */
-export function editorialChecksSchemaDefinitions() {
-    return {
-        EditorialPolicy: a
-            .model({
-            id: a.id().required(),
-            policyKey: a.string().required(),
-            scope: a.string().required(),
-            version: a.integer().required(),
-            title: a.string().required(),
-            guidance: a.string().required(),
-            severity: a.string().required(),
-            enabled: a.boolean().required(),
-            detectors: a.json().required(),
-            examples: a.json(),
-            rewriteGuidance: a.string(),
-            source: a.string().required(),
-        })
-            .disableOperations(["subscriptions"])
-            .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
-        EditorialCheckSettings: a
-            .model({
-            id: a.id().required(),
-            settings: a.json().required(),
-        })
-            .disableOperations(["subscriptions"])
-            .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
-        EditorialFeedback: a
-            .model({
-            id: a.id().required(),
-            itemId: a.string().required(),
-            findingId: a.string().required(),
-            policyId: a.string().required(),
-            detectorId: a.string().required(),
-            lane: a.string().required(),
-            probability: a.float(),
-            decision: a.string().required(),
-            reason: a.string(),
-            text: a.string(),
-        })
-            .disableOperations(["subscriptions"])
-            .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
-            .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
-        checkEditorial: a
-            .query()
-            .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
-            .returns(a.json())
-            .authorization((allow) => [allow.groups(editors)])
-            .handler(a.handler.function(editorialChecks)),
-        suggestEditorialRewrite: a
-            .query()
-            .arguments({
-            body: a.string().required(),
-            format: a.string(),
-            section: a.string(),
-            finding: a.json(),
-            selection: a.json(),
-            note: a.string(),
-        })
-            .returns(a.json())
-            .authorization((allow) => [allow.groups(editors)])
-            .handler(a.handler.function(editorialChecks)),
-        draftEditorialQuestions: a
-            .query()
-            .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-        tryEditorialPolicy: a
-            .query()
-            .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-        importEditorialStarterPack: a
-            .mutation()
-            .arguments({ name: a.string().required() })
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-        recalibrateEditorialPolicies: a
-            .mutation()
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-    };
-}