@anthusai/papyrus 2.0.0-next.2 → 2.0.0-next.20

package/amplify/data/resource.js

@@ -589,6 +589,12 @@ const schema = a.schema({
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(a.handler.function(contentActions)),
+    intakePendingReferences: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     saveItemDraft: a
         .mutation()
         .arguments({ input: a.json().required() })
@@ -601,6 +607,12 @@ const schema = a.schema({
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(a.handler.function(contentActions)),
+    moveStoryStage: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     unpublishItem: a
         .mutation()
         .arguments({ input: a.json().required() })
@@ -2146,6 +2158,7 @@ const schema = a.schema({
         allow.groups(contentWriteGroups),
     ]),
 }).authorization((allow) => [
+    allow.resource(assignmentAction).to(["query", "mutate"]),
     allow.resource(categoryAction),
     allow.resource(contentActions),
     allow.resource(manageUserRole),

package/amplify/data/resource.ts

@@ -641,6 +641,13 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  intakePendingReferences: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   saveItemDraft: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -655,6 +662,13 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  moveStoryStage: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   unpublishItem: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -2271,6 +2285,7 @@ const schema = a.schema({
       allow.groups(contentWriteGroups),
     ]),
 }).authorization((allow) => [
+  allow.resource(assignmentAction).to(["query", "mutate"]),
   allow.resource(categoryAction),
   allow.resource(contentActions),
   allow.resource(manageUserRole),

package/amplify/data/schema.js

@@ -1,6 +1,8 @@
 import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
+import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
+import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
@@ -496,6 +498,12 @@ const baseDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(a.handler.function(contentActions)),
+    intakePendingReferences: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     saveItemDraft: a
         .mutation()
         .arguments({ input: a.json().required() })
@@ -508,6 +516,12 @@ const baseDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(a.handler.function(contentActions)),
+    moveStoryStage: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     unpublishItem: a
         .mutation()
         .arguments({ input: a.json().required() })
@@ -1987,8 +2001,11 @@ const baseDefinitions = {
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
     ]),
+    ...editorialChecksSchemaDefinitions,
+    ...monitoringViewSchemaDefinitions,
 };
 export const schema = a.schema(baseDefinitions).authorization((allow) => [
+    allow.resource(assignmentAction).to(["query", "mutate"]),
     allow.resource(categoryAction),
     allow.resource(contentActions),
     allow.resource(manageUserRole),
@@ -1999,6 +2016,7 @@ export const schema = a.schema(baseDefinitions).authorization((allow) => [
 /** The deployed schema of a site that enables plugins: the base definitions plus what each plugin contributes (docs/plugins.md). */
 export function schemaWithPlugins(pluginDefinitions) {
     return a.schema({ ...baseDefinitions, ...pluginDefinitions }).authorization((allow) => [
+        allow.resource(assignmentAction).to(["query", "mutate"]),
         allow.resource(categoryAction),
         allow.resource(contentActions),
         allow.resource(manageUserRole),

package/amplify/data/schema.ts

@@ -1,6 +1,8 @@
 import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
+import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
+import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
@@ -542,6 +544,13 @@ const baseDefinitions = {
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  intakePendingReferences: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   saveItemDraft: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -556,6 +565,13 @@ const baseDefinitions = {
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  moveStoryStage: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   unpublishItem: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -2105,9 +2121,12 @@ const baseDefinitions = {
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
     ]),
+  ...editorialChecksSchemaDefinitions,
+  ...monitoringViewSchemaDefinitions,
 };
 
 export const schema = a.schema(baseDefinitions).authorization((allow) => [
+  allow.resource(assignmentAction).to(["query", "mutate"]),
   allow.resource(categoryAction),
   allow.resource(contentActions),
   allow.resource(manageUserRole),
@@ -2119,6 +2138,7 @@ export const schema = a.schema(baseDefinitions).authorization((allow) => [
 /** The deployed schema of a site that enables plugins: the base definitions plus what each plugin contributes (docs/plugins.md). */
 export function schemaWithPlugins(pluginDefinitions: Record<string, any>) {
   return a.schema({ ...baseDefinitions, ...pluginDefinitions } as typeof baseDefinitions).authorization((allow) => [
+    allow.resource(assignmentAction).to(["query", "mutate"]),
     allow.resource(categoryAction),
     allow.resource(contentActions),
     allow.resource(manageUserRole),

package/amplify/functions/assignment-action/data-access.js

@@ -0,0 +1,88 @@
+import { Aspects, Stack } from "aws-cdk-lib";
+import { CfnPolicy } from "aws-cdk-lib/aws-iam";
+/** Lifecycle/context calls, including the fixed reference registration CLI's provenance operations. */
+export const ASSIGNMENT_DATA_FIELDS = [
+    "Query/fields/getAssignment",
+    "Query/fields/getKnowledgeRawPayload",
+    "Query/fields/getProcedureRun",
+    "Query/fields/getProcedureVersion",
+    "Query/fields/getProcedureDefinition",
+    "Query/fields/getModelAttachment",
+    "Query/fields/getNewsroomSection",
+    "Query/fields/getKnowledgeCorpus",
+    "Query/fields/getKnowledgeImportRun",
+    "Query/fields/getReference",
+    "Query/fields/getReferenceAttachment",
+    "Query/fields/getMessage",
+    "Query/fields/getSemanticRelation",
+    "Query/fields/getSemanticNode",
+    "Query/fields/listReferences",
+    "Query/fields/listReferenceAttachments",
+    "Query/fields/listSemanticRelations",
+    "Query/fields/listKnowledgeCorporaByRoleAndName",
+    "Query/fields/listItemsByLineageAndVersion",
+    "Query/fields/itemBySlug",
+    "Query/fields/itemByTenantSlug",
+    "Query/fields/listModelAttachmentsByOwnerRoleAndSortKey",
+    "Query/fields/listAssignmentsByQueueStatusAndPriority",
+    "Query/fields/listSemanticRelationsByObjectState",
+    "Query/fields/listSemanticRelationsBySubjectState",
+    "Query/fields/listAssignmentEventsByAssignmentAndCreatedAt",
+    "Mutation/fields/createAssignment",
+    "Mutation/fields/updateAssignment",
+    "Mutation/fields/createAssignmentEvent",
+    "Mutation/fields/createProcedureRun",
+    "Mutation/fields/updateProcedureRun",
+    "Mutation/fields/createKnowledgeCorpus",
+    "Mutation/fields/updateKnowledgeCorpus",
+    "Mutation/fields/createKnowledgeImportRun",
+    "Mutation/fields/updateKnowledgeImportRun",
+    "Mutation/fields/createKnowledgeRawPayload",
+    "Mutation/fields/updateKnowledgeRawPayload",
+    "Mutation/fields/createReference",
+    "Mutation/fields/updateReference",
+    "Mutation/fields/createReferenceAttachment",
+    "Mutation/fields/updateReferenceAttachment",
+    "Mutation/fields/createMessage",
+    "Mutation/fields/updateMessage",
+    "Mutation/fields/createSemanticRelation",
+    "Mutation/fields/updateSemanticRelation",
+    "Mutation/fields/createSemanticNode",
+    "Mutation/fields/updateSemanticNode",
+    "Mutation/fields/createModelAttachment",
+    "Mutation/fields/updateModelAttachment",
+    "Mutation/fields/createModelAttachmentUpload",
+    "Mutation/fields/completeModelAttachmentUpload",
+    "Mutation/fields/createModelAttachmentDownload",
+    "Mutation/fields/updateNewsroomSummary",
+];
+/** Keep the SDK's generated configuration, replacing only this role's GraphQL grants at synthesis. */
+export function scopeAssignmentDataAccess(lambda, graphqlApiArn) {
+    if (!lambda.role)
+        throw new Error("Assignment function needs an execution role.");
+    const roleName = lambda.role.roleName;
+    const resources = ASSIGNMENT_DATA_FIELDS.map((field) => `${graphqlApiArn}/types/${field}`);
+    Aspects.of(Stack.of(lambda)).add({
+        visit(node) {
+            if (!(node instanceof CfnPolicy))
+                return;
+            const stack = Stack.of(node);
+            const roles = stack.resolve(node.roles);
+            if (!roles?.some((role) => JSON.stringify(role) === JSON.stringify(stack.resolve(roleName))))
+                return;
+            const document = stack.resolve(node.policyDocument);
+            document.Statement.forEach((statement, index) => {
+                const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
+                if (actions.includes("*") || actions.includes("appsync:*")) {
+                    throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
+                }
+                if (!actions.includes("appsync:GraphQL"))
+                    return;
+                if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
+                    throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
+                }
+                node.addPropertyOverride(`PolicyDocument.Statement.${index}.Resource`, resources);
+            });
+        },
+    });
+}

package/amplify/functions/assignment-action/data-access.ts

@@ -0,0 +1,87 @@
+import { Aspects, Stack } from "aws-cdk-lib";
+import { CfnPolicy } from "aws-cdk-lib/aws-iam";
+import type { IFunction } from "aws-cdk-lib/aws-lambda";
+
+/** Lifecycle/context calls, including the fixed reference registration CLI's provenance operations. */
+export const ASSIGNMENT_DATA_FIELDS = [
+  "Query/fields/getAssignment",
+  "Query/fields/getKnowledgeRawPayload",
+  "Query/fields/getProcedureRun",
+  "Query/fields/getProcedureVersion",
+  "Query/fields/getProcedureDefinition",
+  "Query/fields/getModelAttachment",
+  "Query/fields/getNewsroomSection",
+  "Query/fields/getKnowledgeCorpus",
+  "Query/fields/getKnowledgeImportRun",
+  "Query/fields/getReference",
+  "Query/fields/getReferenceAttachment",
+  "Query/fields/getMessage",
+  "Query/fields/getSemanticRelation",
+  "Query/fields/getSemanticNode",
+  "Query/fields/listReferences",
+  "Query/fields/listReferenceAttachments",
+  "Query/fields/listSemanticRelations",
+  "Query/fields/listKnowledgeCorporaByRoleAndName",
+  "Query/fields/listItemsByLineageAndVersion",
+  "Query/fields/itemBySlug",
+  "Query/fields/itemByTenantSlug",
+  "Query/fields/listModelAttachmentsByOwnerRoleAndSortKey",
+  "Query/fields/listAssignmentsByQueueStatusAndPriority",
+  "Query/fields/listSemanticRelationsByObjectState",
+  "Query/fields/listSemanticRelationsBySubjectState",
+  "Query/fields/listAssignmentEventsByAssignmentAndCreatedAt",
+  "Mutation/fields/createAssignment",
+  "Mutation/fields/updateAssignment",
+  "Mutation/fields/createAssignmentEvent",
+  "Mutation/fields/createProcedureRun",
+  "Mutation/fields/updateProcedureRun",
+  "Mutation/fields/createKnowledgeCorpus",
+  "Mutation/fields/updateKnowledgeCorpus",
+  "Mutation/fields/createKnowledgeImportRun",
+  "Mutation/fields/updateKnowledgeImportRun",
+  "Mutation/fields/createKnowledgeRawPayload",
+  "Mutation/fields/updateKnowledgeRawPayload",
+  "Mutation/fields/createReference",
+  "Mutation/fields/updateReference",
+  "Mutation/fields/createReferenceAttachment",
+  "Mutation/fields/updateReferenceAttachment",
+  "Mutation/fields/createMessage",
+  "Mutation/fields/updateMessage",
+  "Mutation/fields/createSemanticRelation",
+  "Mutation/fields/updateSemanticRelation",
+  "Mutation/fields/createSemanticNode",
+  "Mutation/fields/updateSemanticNode",
+  "Mutation/fields/createModelAttachment",
+  "Mutation/fields/updateModelAttachment",
+  "Mutation/fields/createModelAttachmentUpload",
+  "Mutation/fields/completeModelAttachmentUpload",
+  "Mutation/fields/createModelAttachmentDownload",
+  "Mutation/fields/updateNewsroomSummary",
+] as const;
+
+/** Keep the SDK's generated configuration, replacing only this role's GraphQL grants at synthesis. */
+export function scopeAssignmentDataAccess(lambda: IFunction, graphqlApiArn: string): void {
+  if (!lambda.role) throw new Error("Assignment function needs an execution role.");
+  const roleName = lambda.role.roleName;
+  const resources = ASSIGNMENT_DATA_FIELDS.map((field) => `${graphqlApiArn}/types/${field}`);
+  Aspects.of(Stack.of(lambda)).add({
+    visit(node) {
+      if (!(node instanceof CfnPolicy)) return;
+      const stack = Stack.of(node);
+      const roles = stack.resolve(node.roles) as unknown[] | undefined;
+      if (!roles?.some((role) => JSON.stringify(role) === JSON.stringify(stack.resolve(roleName)))) return;
+      const document = stack.resolve(node.policyDocument) as { Statement: Array<Record<string, unknown>> };
+      document.Statement.forEach((statement, index) => {
+        const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
+        if (actions.includes("*") || actions.includes("appsync:*")) {
+          throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
+        }
+        if (!actions.includes("appsync:GraphQL")) return;
+        if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
+          throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
+        }
+        node.addPropertyOverride(`PolicyDocument.Statement.${index}.Resource`, resources);
+      });
+    },
+  });
+}

package/amplify/functions/content-actions/handler.py

@@ -23,6 +23,8 @@ from papyrus_content.rebuild_trigger import (
     trigger_staging_build,
 )
 from papyrus_content.story_reporting import save_story_version
+from papyrus_content.publication import ensure_publication_from_environment
+from papyrus_content.reference_intake import IntakeError, intake_references
 from papyrus_content.publishing import (
     ItemFields,
     PublishError,
@@ -150,6 +152,7 @@ def schedule_unpurged_invalidation(keys: list[str]) -> None:
 
 def run_deploy_render_task(client) -> dict:
     """Render every published page after a backend deploy, then report drift (a dry run: nothing is deleted)."""
+    ensure_publication_from_environment(client)
     context = projection_context(client)
     report = deploy_render(context)
     print(drift_metric_line(report))
@@ -283,6 +286,17 @@ def unpublish_item_action(arguments: dict, actor: str) -> dict:
     return response
 
 
+def move_story_stage_action(arguments: dict, actor: str) -> dict:
+    from papyrus_content.story_reporting import move_story_stage
+
+    client, _claims = create_authoring_client()
+    try:
+        result = move_story_stage(client, arguments["lineageId"], arguments["stage"], actor=actor, reason=arguments.get("reason"))
+    except ValueError as error:
+        return {"ok": False, "errors": [{"code": "invalid-stage", "message": str(error), "line": None}]}
+    return {"ok": True, **result}
+
+
 def request_staging_build_action() -> dict:
     cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
     if not cms_app_id:
@@ -299,12 +313,20 @@ def handler(event, context):
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)
     try:
+        if field == "intakePendingReferences":
+            client, _claims = create_authoring_client()
+            try:
+                return intake_references(client, arguments, event.get("identity") or {})
+            except IntakeError as error:
+                return {"ok": False, "errors": [{"code": "intake-rejected", "message": str(error)}]}
         if field == "deriveMarkus":
             return derive_markus_action(arguments)
         if field == "saveItemDraft":
             return save_item_draft_action(arguments, actor)
         if field == "publishItem":
             return publish_item_action(arguments, actor)
+        if field == "moveStoryStage":
+            return move_story_stage_action(arguments, actor)
         if field == "unpublishItem":
             return unpublish_item_action(arguments, actor)
         if field == "requestStagingBuild":

package/amplify/functions/editorial-checks/handler.py

@@ -0,0 +1,14 @@
+"""The editorial-checks function: routes its GraphQL fields to papyrus_content.editorial_checks."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.editorial_checks import GraphQLEditorialStore, Services, handle, load_provider_keys
+
+# Amplify passes secrets to Python functions as placeholders; resolve them once per cold start.
+load_provider_keys()
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    return handle(event["info"]["fieldName"], event.get("arguments") or {}, Services(store=GraphQLEditorialStore()))

package/amplify/functions/editorial-checks/requirements.txt

@@ -0,0 +1 @@
+humanus[jev]>=0.33,<0.34

package/amplify/functions/editorial-checks/resource.js

@@ -0,0 +1,43 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
+/** AppSync gives a resolver 30 seconds; Humanus's classifier deadline (settings, default 20 s) keeps a check inside this. */
+export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
+/** Humanus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
+export const editorialChecksRequirements = ["humanus[jev]>=0.33,<0.34"];
+function installRequirements(outputDir) {
+    execFileSync("python3", [
+        "-m", "pip", "install", "-r", path.join(functionDirectory, "requirements.txt"), "-t", outputDir, "--no-cache-dir",
+        "--platform", "manylinux2014_aarch64", "--implementation", "cp", "--python-version", "3.12",
+        "--only-binary=:all:", "--ignore-requires-python",
+    ], { stdio: "inherit" });
+}
+export const editorialChecks = defineFunction((scope) => new Function(scope, "papyrus-editorial-checks", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(EDITORIAL_CHECKS_TIMEOUT_SECONDS),
+    memorySize: 1024,
+    code: pythonLambdaCode({
+        functionDir: "editorial-checks",
+        modules: ["papyrus_content"],
+        requirements: editorialChecksRequirements,
+        noDeps: true,
+        checkoutExtras: installRequirements,
+    }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/editorial-checks/resource.ts

@@ -0,0 +1,60 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
+
+/** AppSync gives a resolver 30 seconds; Humanus's classifier deadline (settings, default 20 s) keeps a check inside this. */
+export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
+
+/** Humanus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
+export const editorialChecksRequirements = ["humanus[jev]>=0.33,<0.34"];
+
+function installRequirements(outputDir: string): void {
+  execFileSync(
+    "python3",
+    [
+      "-m", "pip", "install", "-r", path.join(functionDirectory, "requirements.txt"), "-t", outputDir, "--no-cache-dir",
+      "--platform", "manylinux2014_aarch64", "--implementation", "cp", "--python-version", "3.12",
+      "--only-binary=:all:", "--ignore-requires-python",
+    ],
+    { stdio: "inherit" },
+  );
+}
+
+export const editorialChecks = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-editorial-checks", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(EDITORIAL_CHECKS_TIMEOUT_SECONDS),
+      memorySize: 1024,
+      code: pythonLambdaCode(
+        {
+          functionDir: "editorial-checks",
+          modules: ["papyrus_content"],
+          requirements: editorialChecksRequirements,
+          noDeps: true,
+          checkoutExtras: installRequirements,
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/editorial-checks/schema.js

@@ -0,0 +1,92 @@
+import { a } from "@aws-amplify/backend";
+import { editorialChecks } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
+ * content against them. Editors read policies and record decisions; admins
+ * manage policies and settings. Only the function (IAM) calls Humanus.
+ */
+export const editorialChecksSchemaDefinitions = {
+    EditorialPolicy: a
+        .model({
+        id: a.id().required(),
+        policyKey: a.string().required(),
+        scope: a.string().required(),
+        version: a.integer().required(),
+        title: a.string().required(),
+        guidance: a.string().required(),
+        severity: a.string().required(),
+        enabled: a.boolean().required(),
+        detectors: a.json().required(),
+        examples: a.json(),
+        rewriteGuidance: a.string(),
+        source: a.string().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialCheckSettings: a
+        .model({
+        id: a.id().required(),
+        settings: a.json().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialFeedback: a
+        .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        findingId: a.string().required(),
+        policyId: a.string().required(),
+        detectorId: a.string().required(),
+        lane: a.string().required(),
+        probability: a.float(),
+        decision: a.string().required(),
+        reason: a.string(),
+        text: a.string(),
+    })
+        .disableOperations(["subscriptions"])
+        .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
+        .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
+    checkEditorial: a
+        .query()
+        .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    suggestEditorialRewrite: a
+        .query()
+        .arguments({
+        body: a.string().required(),
+        format: a.string(),
+        section: a.string(),
+        finding: a.json(),
+        selection: a.json(),
+        note: a.string(),
+    })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    draftEditorialQuestions: a
+        .query()
+        .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    tryEditorialPolicy: a
+        .query()
+        .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    importEditorialStarterPack: a
+        .mutation()
+        .arguments({ name: a.string().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    recalibrateEditorialPolicies: a
+        .mutation()
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+};