@anthusai/papyrus 2.0.0-next.2 → 2.0.0-next.20

package/amplify/functions/editorial-checks/schema.ts

@@ -0,0 +1,94 @@
+import { a } from "@aws-amplify/backend";
+import { editorialChecks } from "./resource";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
+ * content against them. Editors read policies and record decisions; admins
+ * manage policies and settings. Only the function (IAM) calls Humanus.
+ */
+export const editorialChecksSchemaDefinitions = {
+    EditorialPolicy: a
+      .model({
+        id: a.id().required(),
+        policyKey: a.string().required(),
+        scope: a.string().required(),
+        version: a.integer().required(),
+        title: a.string().required(),
+        guidance: a.string().required(),
+        severity: a.string().required(),
+        enabled: a.boolean().required(),
+        detectors: a.json().required(),
+        examples: a.json(),
+        rewriteGuidance: a.string(),
+        source: a.string().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialCheckSettings: a
+      .model({
+        id: a.id().required(),
+        settings: a.json().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialFeedback: a
+      .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        findingId: a.string().required(),
+        policyId: a.string().required(),
+        detectorId: a.string().required(),
+        lane: a.string().required(),
+        probability: a.float(),
+        decision: a.string().required(),
+        reason: a.string(),
+        text: a.string(),
+      })
+      .disableOperations(["subscriptions"])
+      .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
+      .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
+    checkEditorial: a
+      .query()
+      .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
+      .returns(a.json())
+      .authorization((allow) => [allow.groups(editors)])
+      .handler(a.handler.function(editorialChecks)),
+    suggestEditorialRewrite: a
+      .query()
+      .arguments({
+        body: a.string().required(),
+        format: a.string(),
+        section: a.string(),
+        finding: a.json(),
+        selection: a.json(),
+        note: a.string(),
+      })
+      .returns(a.json())
+      .authorization((allow) => [allow.groups(editors)])
+      .handler(a.handler.function(editorialChecks)),
+    draftEditorialQuestions: a
+      .query()
+      .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
+      .returns(a.json())
+      .authorization((allow) => [allow.group("admin")])
+      .handler(a.handler.function(editorialChecks)),
+    tryEditorialPolicy: a
+      .query()
+      .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
+      .returns(a.json())
+      .authorization((allow) => [allow.group("admin")])
+      .handler(a.handler.function(editorialChecks)),
+    importEditorialStarterPack: a
+      .mutation()
+      .arguments({ name: a.string().required() })
+      .returns(a.json())
+      .authorization((allow) => [allow.group("admin")])
+      .handler(a.handler.function(editorialChecks)),
+    recalibrateEditorialPolicies: a
+      .mutation()
+      .returns(a.json())
+      .authorization((allow) => [allow.group("admin")])
+      .handler(a.handler.function(editorialChecks)),
+  };

package/amplify/functions/editorial-checks/wire.js

@@ -0,0 +1,49 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+    "Query/fields/listKnowledgeCorporaByRoleAndName",
+    "Query/fields/getEditorialContext",
+    "Query/fields/listEditorialPolicies",
+    "Query/fields/getEditorialCheckSettings",
+    "Query/fields/listEditorialFeedbacks",
+    "Mutation/fields/createEditorialPolicy",
+    "Mutation/fields/updateEditorialPolicy",
+];
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region, account, appId) {
+    const arn = (path) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+    return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+        arn(`papyrus/*/${name}`),
+        arn(`shared/papyrus/${name}`),
+        ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+    ]);
+}
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend) {
+    const lambda = backend.editorialChecks.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    for (const name of EDITORIAL_CHECKS_SECRETS)
+        backend.editorialChecks.addEnvironment(name, secret(name));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter", "ssm:GetParameters"],
+        resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }));
+    const apiId = backend.data.resources.graphqlApi.apiId;
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }));
+}

package/amplify/functions/editorial-checks/wire.ts

@@ -0,0 +1,57 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+  "Query/fields/listKnowledgeCorporaByRoleAndName",
+  "Query/fields/getEditorialContext",
+  "Query/fields/listEditorialPolicies",
+  "Query/fields/getEditorialCheckSettings",
+  "Query/fields/listEditorialFeedbacks",
+  "Mutation/fields/createEditorialPolicy",
+  "Mutation/fields/updateEditorialPolicy",
+];
+
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region: string, account: string, appId: string): string[] {
+  const arn = (path: string) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+  return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+    arn(`papyrus/*/${name}`),
+    arn(`shared/papyrus/${name}`),
+    ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+  ]);
+}
+
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend: any): void {
+  const lambda = backend.editorialChecks.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  for (const name of EDITORIAL_CHECKS_SECRETS) backend.editorialChecks.addEnvironment(name, secret(name));
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter", "ssm:GetParameters"],
+      resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }),
+  );
+  const apiId = backend.data.resources.graphqlApi.apiId as string;
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }),
+  );
+}

package/amplify/functions/model-attachment-upload/handler.ts

@@ -49,6 +49,7 @@ const ALLOWED_ROLES = new Set([
   "graph_export",
   "raw_payload",
   "priming_outcome",
+  "priming_attempts",
 ]);
 const ALLOWED_MEDIA_TYPES = new Set([
   "application/json",

package/amplify/functions/monitoring-view/handler.py

@@ -0,0 +1,11 @@
+"""The monitoring-view function: `monitoringOverview` for editors and admins, read-only."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.monitoring_view import handle
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    return handle(event)

package/amplify/functions/monitoring-view/resource.js

@@ -0,0 +1,24 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction((scope) => new Function(scope, "papyrus-monitoring-view", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+    memorySize: 256,
+    code: pythonLambdaCode({ functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/monitoring-view/resource.ts

@@ -0,0 +1,34 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-monitoring-view", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+      memorySize: 256,
+      code: pythonLambdaCode(
+        { functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/monitoring-view/schema.js

@@ -0,0 +1,16 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+    monitoringOverview: a
+        .query()
+        .arguments({ scope: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(monitoringView)),
+};

package/amplify/functions/monitoring-view/schema.ts

@@ -0,0 +1,18 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+  monitoringOverview: a
+    .query()
+    .arguments({ scope: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(a.handler.function(monitoringView)),
+};

package/amplify/functions/monitoring-view/wire.js

@@ -0,0 +1,37 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region, account) {
+    const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+    return [table, `${table}/index/routing`];
+}
+export function monitoringViewParameterArn(region, account) {
+    return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend) {
+    const lambda = backend.monitoringView.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account),
+    }));
+}

package/amplify/functions/monitoring-view/wire.ts

@@ -0,0 +1,47 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region: string, account: string): string[] {
+  const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+  return [table, `${table}/index/routing`];
+}
+
+export function monitoringViewParameterArn(region: string, account: string): string {
+  return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend: any): void {
+  const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account),
+    }),
+  );
+}

package/amplify/functions/shared/python-bundle.js

@@ -78,23 +78,29 @@ export function siteFilesContentHash(siteFiles) {
 function pipSpec() {
     return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
+/** What the first pip install gets: `papyrus-newsroom` with its dependencies, plus the function's own requirements. Empty means skip it. */
+export function firstPipRequirements(options) {
+    return [...(options.noDeps ? [] : [pipSpec()]), ...(options.requirements ?? [])];
+}
 function bundleFromPip(outputDir, options) {
     const extra = (process.env.PAPYRUS_PIP_EXTRA_ARGS ?? "").trim().split(/\s+/).filter(Boolean);
     const python = (process.env.PAPYRUS_PIP_PYTHON ?? "python3").trim();
-    execFileSync(python, [
-        "-m", "pip", "install",
-        "--target", outputDir,
-        "--no-cache-dir",
-        "--platform", "manylinux2014_aarch64",
-        "--implementation", "cp",
-        "--python-version", "3.12",
-        "--only-binary=:all:",
-        // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
-        "--ignore-requires-python",
-        ...extra,
-        ...(options.noDeps ? [] : [pipSpec()]),
-        ...(options.requirements ?? []),
-    ], { stdio: "inherit" });
+    const requirements = firstPipRequirements(options);
+    if (requirements.length > 0) {
+        execFileSync(python, [
+            "-m", "pip", "install",
+            "--target", outputDir,
+            "--no-cache-dir",
+            "--platform", "manylinux2014_aarch64",
+            "--implementation", "cp",
+            "--python-version", "3.12",
+            "--only-binary=:all:",
+            // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
+            "--ignore-requires-python",
+            ...extra,
+            ...requirements,
+        ], { stdio: "inherit" });
+    }
     if (options.noDeps) {
         execFileSync(python, [
             "-m", "pip", "install",

package/amplify/functions/shared/python-bundle.ts

@@ -102,27 +102,34 @@ function pipSpec(): string {
   return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
 
+/** What the first pip install gets: `papyrus-newsroom` with its dependencies, plus the function's own requirements. Empty means skip it. */
+export function firstPipRequirements(options: Pick<PythonBundleOptions, "noDeps" | "requirements">): string[] {
+  return [...(options.noDeps ? [] : [pipSpec()]), ...(options.requirements ?? [])];
+}
+
 function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
   const extra = (process.env.PAPYRUS_PIP_EXTRA_ARGS ?? "").trim().split(/\s+/).filter(Boolean);
   const python = (process.env.PAPYRUS_PIP_PYTHON ?? "python3").trim();
-  execFileSync(
-    python,
-    [
-      "-m", "pip", "install",
-      "--target", outputDir,
-      "--no-cache-dir",
-      "--platform", "manylinux2014_aarch64",
-      "--implementation", "cp",
-      "--python-version", "3.12",
-      "--only-binary=:all:",
-      // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
-      "--ignore-requires-python",
-      ...extra,
-      ...(options.noDeps ? [] : [pipSpec()]),
-      ...(options.requirements ?? []),
-    ],
-    { stdio: "inherit" },
-  );
+  const requirements = firstPipRequirements(options);
+  if (requirements.length > 0) {
+    execFileSync(
+      python,
+      [
+        "-m", "pip", "install",
+        "--target", outputDir,
+        "--no-cache-dir",
+        "--platform", "manylinux2014_aarch64",
+        "--implementation", "cp",
+        "--python-version", "3.12",
+        "--only-binary=:all:",
+        // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
+        "--ignore-requires-python",
+        ...extra,
+        ...requirements,
+      ],
+      { stdio: "inherit" },
+    );
+  }
   if (options.noDeps) {
     execFileSync(
       python,

package/amplify/publication/redirect-and-index.js

@@ -12,6 +12,9 @@ async function lookUpRedirectTarget(uri) {
 }
 
 function rewriteToIndexDocument(uri) {
+  if (uri === "/404") {
+    return "/404.html";
+  }
   if (uri.endsWith("/")) {
     return uri + "index.html";
   }
@@ -22,6 +25,72 @@ function rewriteToIndexDocument(uri) {
   return uri;
 }
 
+// Pattern redirects: data from the site's projection.json, spliced between the markers at deploy
+// time by redirect-rules.ts. Each rule is {p: regex, t: target with $1..$9, s: status, x: excluded paths}.
+const patternRules = /*PAPYRUS_PATTERN_RULES*/[]/*END_PAPYRUS_PATTERN_RULES*/;
+
+function lookUpPatternRedirect(uri) {
+  for (let index = 0; index < patternRules.length; index += 1) {
+    const rule = patternRules[index];
+    if (rule.x.indexOf(uri) !== -1) {
+      continue;
+    }
+    const match = new RegExp(rule.p).exec(uri);
+    if (match !== null) {
+      return {
+        status: rule.s,
+        target: rule.t.replace(/\$([0-9])/g, function (whole, group) {
+          return match[Number(group)] || "";
+        }),
+      };
+    }
+  }
+  return null;
+}
+
+// Content negotiation for agents: when the site publishes Markdown twins (standard front end, agents.markdown), a request
+// whose Accept header prefers text/markdown over text/html is rewritten to the .md object before the cache lookup. The
+// flag is spliced in by redirect-rules.ts at deploy time.
+const negotiateMarkdown = /*PAPYRUS_NEGOTIATE_MARKDOWN*/false/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/;
+
+function qualityOf(accept, mediaType) {
+  let quality = 0;
+  const parts = accept.toLowerCase().split(",");
+  for (let index = 0; index < parts.length; index += 1) {
+    const fields = parts[index].split(";");
+    if (fields[0].trim() !== mediaType) {
+      continue;
+    }
+    quality = 1;
+    for (let field = 1; field < fields.length; field += 1) {
+      const pair = fields[field].trim();
+      if (pair.indexOf("q=") === 0) {
+        quality = Number(pair.substring(2));
+        if (isNaN(quality)) {
+          quality = 0;
+        }
+      }
+    }
+  }
+  return quality;
+}
+
+function prefersMarkdown(request) {
+  const header = request.headers && request.headers.accept;
+  if (!header || !header.value) {
+    return false;
+  }
+  const markdown = qualityOf(header.value, "text/markdown");
+  return markdown > 0 && markdown > qualityOf(header.value, "text/html");
+}
+
+function markdownTwin(uri) {
+  if (uri === "/404.html" || uri.length < 6 || uri.substring(uri.length - 5) !== ".html") {
+    return null;
+  }
+  return uri.substring(0, uri.length - 5) + ".md";
+}
+
 async function handler(event) {
   const request = event.request;
   const redirectTarget = await lookUpRedirectTarget(request.uri);
@@ -32,6 +101,20 @@ async function handler(event) {
       headers: { location: { value: redirectTarget } },
     };
   }
+  const patternRedirect = lookUpPatternRedirect(request.uri);
+  if (patternRedirect !== null) {
+    return {
+      statusCode: patternRedirect.status,
+      statusDescription: "Moved",
+      headers: { location: { value: patternRedirect.target } },
+    };
+  }
   request.uri = rewriteToIndexDocument(request.uri);
+  if (negotiateMarkdown && prefersMarkdown(request)) {
+    const twin = markdownTwin(request.uri);
+    if (twin !== null) {
+      request.uri = twin;
+    }
+  }
   return request;
 }