@anthusai/papyrus 2.0.0-next.5 → 2.0.0-next.50

package/amplify/data/schema.ts

@@ -1,11 +1,14 @@
 import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
+import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
+import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
 import { newsroomSummary } from "../functions/newsroom-summary/resource";
+import { publicForms } from "../functions/public-forms/resource";
 import { procedureAction } from "../functions/procedure-action/resource";
 import { readerSettings } from "../functions/reader-settings/resource";
 
@@ -23,7 +26,27 @@ const modelWithoutSubscriptions = <Fields extends Parameters<typeof a.model>[0]>
   a.model(fields).disableOperations(["subscriptions"]);
 const realtimeModel = <Fields extends Parameters<typeof a.model>[0]>(fields: Fields) => a.model(fields);
 
-const baseDefinitions = {
+/**
+ * Model groups a site may leave out of its data API. CloudFormation creates at most 2,500 resources in one stack
+ * operation, nested stacks included, and the full model set exceeds that on a fresh create. A first deploy that
+ * excludes a group fits; a second deploy without the exclusion adds the models as an ordinary update.
+ */
+export const OPTIONAL_MODEL_GROUPS = {
+  editions: ["Edition", "EditionItem", "PublishedEdition", "PublishedEditionItem"],
+} as const;
+
+export type OptionalModelGroup = keyof typeof OPTIONAL_MODEL_GROUPS;
+
+export function assertKnownModelGroups(groups: readonly string[]): asserts groups is readonly OptionalModelGroup[] {
+  for (const group of groups) {
+    if (!(group in OPTIONAL_MODEL_GROUPS)) {
+      throw new Error(`Unknown model group "${group}"; known groups: ${Object.keys(OPTIONAL_MODEL_GROUPS).join(", ")}`);
+    }
+  }
+}
+
+function buildBaseDefinitions(includeEditions: boolean) {
+const definitions = {
   UserProfile: modelWithoutSubscriptions({
       id: a.id().required(),
       email: a.email(),
@@ -542,6 +565,13 @@ const baseDefinitions = {
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  intakePendingReferences: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   saveItemDraft: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -556,6 +586,13 @@ const baseDefinitions = {
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  moveStoryStage: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   unpublishItem: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -817,6 +854,7 @@ const baseDefinitions = {
       storyLineageId: a.id(),
       assignmentId: a.id(),
       maxCharacters: a.integer(),
+      optionalPublicationDoctrine: a.boolean(),
     })
     .returns(a.json().required())
     .authorization((allow) => [allow.groups(categoryWriteGroups)])
@@ -1782,7 +1820,7 @@ const baseDefinitions = {
       updatedAt: a.datetime(),
       tags: a.hasMany("ItemTag", "itemId"),
       mediaAssets: a.hasMany("MediaAsset", "itemId"),
-      editionItems: a.hasMany("EditionItem", "itemId"),
+      ...(includeEditions ? { editionItems: a.hasMany("EditionItem", "itemId") } : {}),
     })
     .secondaryIndexes((index) => [
       index("lineageId").sortKeys(["versionNumber"]).queryField("listItemsByLineageAndVersion"),
@@ -2105,27 +2143,47 @@ const baseDefinitions = {
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
     ]),
+  ...editorialChecksSchemaDefinitions,
+  ...monitoringViewSchemaDefinitions,
 };
+if (!includeEditions) {
+  const mutableDefinitions = definitions as Record<string, unknown>;
+  for (const modelName of OPTIONAL_MODEL_GROUPS.editions) delete mutableDefinitions[modelName];
+}
+return definitions;
+}
 
-export const schema = a.schema(baseDefinitions).authorization((allow) => [
-  allow.resource(categoryAction),
-  allow.resource(contentActions),
-  allow.resource(manageUserRole),
-  allow.resource(modelAttachmentUpload),
-  allow.resource(newsroomSummary),
-  allow.resource(procedureAction),
-]);
+export function baseModelNames(excludedGroups: readonly OptionalModelGroup[] = []): string[] {
+  return Object.keys(buildBaseDefinitions(!excludedGroups.includes("editions")));
+}
 
-/** The deployed schema of a site that enables plugins: the base definitions plus what each plugin contributes (docs/plugins.md). */
-export function schemaWithPlugins(pluginDefinitions: Record<string, any>) {
-  return a.schema({ ...baseDefinitions, ...pluginDefinitions } as typeof baseDefinitions).authorization((allow) => [
+const baseDefinitions = buildBaseDefinitions(true);
+
+/** Schema-level function grants shared by every deployed schema, with or without plugins, so none can drop one. */
+function functionGrants(allow: any) {
+  return [
+    allow.resource(assignmentAction).to(["query", "mutate"]),
     allow.resource(categoryAction),
     allow.resource(contentActions),
     allow.resource(manageUserRole),
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),
     allow.resource(procedureAction),
-  ]);
+    allow.resource(publicForms).to(["mutate"]),
+  ];
+}
+
+export const schema = a.schema(baseDefinitions).authorization(functionGrants);
+
+/** The deployed schema of a site that enables plugins: the base definitions plus what each plugin contributes (docs/plugins.md). */
+export function schemaWithPlugins(pluginDefinitions: Record<string, any>) {
+  return a.schema({ ...baseDefinitions, ...pluginDefinitions } as typeof baseDefinitions).authorization(functionGrants);
+}
+
+/** The schema of a site that leaves optional model groups out of its first deploy. */
+export function schemaExcludingGroups(excludedGroups: readonly OptionalModelGroup[], pluginDefinitions: Record<string, any> = {}) {
+  const definitions = buildBaseDefinitions(!excludedGroups.includes("editions")) as unknown as typeof baseDefinitions;
+  return a.schema({ ...definitions, ...pluginDefinitions } as typeof baseDefinitions).authorization(functionGrants);
 }
 
 export type Schema = ClientSchema<typeof schema>;

package/amplify/functions/assignment-action/data-access.js

@@ -0,0 +1,90 @@
+import { Aspects, Stack } from "aws-cdk-lib";
+import { CfnPolicy } from "aws-cdk-lib/aws-iam";
+/** Lifecycle/context calls, including the fixed reference registration CLI's provenance operations. */
+export const ASSIGNMENT_DATA_FIELDS = [
+    "Query/fields/getAssignment",
+    "Query/fields/getKnowledgeRawPayload",
+    "Query/fields/getProcedureRun",
+    "Query/fields/getProcedureVersion",
+    "Query/fields/getProcedureDefinition",
+    "Query/fields/getModelAttachment",
+    "Query/fields/getNewsroomSection",
+    "Query/fields/listNewsroomSections",
+    "Query/fields/listNewsroomSectionsByTenantAndSortOrder",
+    "Query/fields/getKnowledgeCorpus",
+    "Query/fields/getKnowledgeImportRun",
+    "Query/fields/getReference",
+    "Query/fields/getReferenceAttachment",
+    "Query/fields/getMessage",
+    "Query/fields/getSemanticRelation",
+    "Query/fields/getSemanticNode",
+    "Query/fields/listReferences",
+    "Query/fields/listReferenceAttachments",
+    "Query/fields/listSemanticRelations",
+    "Query/fields/listKnowledgeCorporaByRoleAndName",
+    "Query/fields/listItemsByLineageAndVersion",
+    "Query/fields/itemBySlug",
+    "Query/fields/itemByTenantSlug",
+    "Query/fields/listModelAttachmentsByOwnerRoleAndSortKey",
+    "Query/fields/listAssignmentsByQueueStatusAndPriority",
+    "Query/fields/listSemanticRelationsByObjectState",
+    "Query/fields/listSemanticRelationsBySubjectState",
+    "Query/fields/listAssignmentEventsByAssignmentAndCreatedAt",
+    "Mutation/fields/createAssignment",
+    "Mutation/fields/updateAssignment",
+    "Mutation/fields/createAssignmentEvent",
+    "Mutation/fields/createProcedureRun",
+    "Mutation/fields/updateProcedureRun",
+    "Mutation/fields/createKnowledgeCorpus",
+    "Mutation/fields/updateKnowledgeCorpus",
+    "Mutation/fields/createKnowledgeImportRun",
+    "Mutation/fields/updateKnowledgeImportRun",
+    "Mutation/fields/createKnowledgeRawPayload",
+    "Mutation/fields/updateKnowledgeRawPayload",
+    "Mutation/fields/createReference",
+    "Mutation/fields/updateReference",
+    "Mutation/fields/createReferenceAttachment",
+    "Mutation/fields/updateReferenceAttachment",
+    "Mutation/fields/createMessage",
+    "Mutation/fields/updateMessage",
+    "Mutation/fields/createSemanticRelation",
+    "Mutation/fields/updateSemanticRelation",
+    "Mutation/fields/createSemanticNode",
+    "Mutation/fields/updateSemanticNode",
+    "Mutation/fields/createModelAttachment",
+    "Mutation/fields/updateModelAttachment",
+    "Mutation/fields/createModelAttachmentUpload",
+    "Mutation/fields/completeModelAttachmentUpload",
+    "Mutation/fields/createModelAttachmentDownload",
+    "Mutation/fields/updateNewsroomSummary",
+];
+/** Keep the SDK's generated configuration, replacing only this role's GraphQL grants at synthesis. */
+export function scopeAssignmentDataAccess(lambda, graphqlApiArn) {
+    if (!lambda.role)
+        throw new Error("Assignment function needs an execution role.");
+    const roleName = lambda.role.roleName;
+    const resources = ASSIGNMENT_DATA_FIELDS.map((field) => `${graphqlApiArn}/types/${field}`);
+    Aspects.of(Stack.of(lambda)).add({
+        visit(node) {
+            if (!(node instanceof CfnPolicy))
+                return;
+            const stack = Stack.of(node);
+            const roles = stack.resolve(node.roles);
+            if (!roles?.some((role) => JSON.stringify(role) === JSON.stringify(stack.resolve(roleName))))
+                return;
+            const document = stack.resolve(node.policyDocument);
+            document.Statement.forEach((statement, index) => {
+                const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
+                if (actions.includes("*") || actions.includes("appsync:*")) {
+                    throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
+                }
+                if (!actions.includes("appsync:GraphQL"))
+                    return;
+                if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
+                    throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
+                }
+                node.addPropertyOverride(`PolicyDocument.Statement.${index}.Resource`, resources);
+            });
+        },
+    });
+}

package/amplify/functions/assignment-action/data-access.ts

@@ -0,0 +1,89 @@
+import { Aspects, Stack } from "aws-cdk-lib";
+import { CfnPolicy } from "aws-cdk-lib/aws-iam";
+import type { IFunction } from "aws-cdk-lib/aws-lambda";
+
+/** Lifecycle/context calls, including the fixed reference registration CLI's provenance operations. */
+export const ASSIGNMENT_DATA_FIELDS = [
+  "Query/fields/getAssignment",
+  "Query/fields/getKnowledgeRawPayload",
+  "Query/fields/getProcedureRun",
+  "Query/fields/getProcedureVersion",
+  "Query/fields/getProcedureDefinition",
+  "Query/fields/getModelAttachment",
+  "Query/fields/getNewsroomSection",
+  "Query/fields/listNewsroomSections",
+  "Query/fields/listNewsroomSectionsByTenantAndSortOrder",
+  "Query/fields/getKnowledgeCorpus",
+  "Query/fields/getKnowledgeImportRun",
+  "Query/fields/getReference",
+  "Query/fields/getReferenceAttachment",
+  "Query/fields/getMessage",
+  "Query/fields/getSemanticRelation",
+  "Query/fields/getSemanticNode",
+  "Query/fields/listReferences",
+  "Query/fields/listReferenceAttachments",
+  "Query/fields/listSemanticRelations",
+  "Query/fields/listKnowledgeCorporaByRoleAndName",
+  "Query/fields/listItemsByLineageAndVersion",
+  "Query/fields/itemBySlug",
+  "Query/fields/itemByTenantSlug",
+  "Query/fields/listModelAttachmentsByOwnerRoleAndSortKey",
+  "Query/fields/listAssignmentsByQueueStatusAndPriority",
+  "Query/fields/listSemanticRelationsByObjectState",
+  "Query/fields/listSemanticRelationsBySubjectState",
+  "Query/fields/listAssignmentEventsByAssignmentAndCreatedAt",
+  "Mutation/fields/createAssignment",
+  "Mutation/fields/updateAssignment",
+  "Mutation/fields/createAssignmentEvent",
+  "Mutation/fields/createProcedureRun",
+  "Mutation/fields/updateProcedureRun",
+  "Mutation/fields/createKnowledgeCorpus",
+  "Mutation/fields/updateKnowledgeCorpus",
+  "Mutation/fields/createKnowledgeImportRun",
+  "Mutation/fields/updateKnowledgeImportRun",
+  "Mutation/fields/createKnowledgeRawPayload",
+  "Mutation/fields/updateKnowledgeRawPayload",
+  "Mutation/fields/createReference",
+  "Mutation/fields/updateReference",
+  "Mutation/fields/createReferenceAttachment",
+  "Mutation/fields/updateReferenceAttachment",
+  "Mutation/fields/createMessage",
+  "Mutation/fields/updateMessage",
+  "Mutation/fields/createSemanticRelation",
+  "Mutation/fields/updateSemanticRelation",
+  "Mutation/fields/createSemanticNode",
+  "Mutation/fields/updateSemanticNode",
+  "Mutation/fields/createModelAttachment",
+  "Mutation/fields/updateModelAttachment",
+  "Mutation/fields/createModelAttachmentUpload",
+  "Mutation/fields/completeModelAttachmentUpload",
+  "Mutation/fields/createModelAttachmentDownload",
+  "Mutation/fields/updateNewsroomSummary",
+] as const;
+
+/** Keep the SDK's generated configuration, replacing only this role's GraphQL grants at synthesis. */
+export function scopeAssignmentDataAccess(lambda: IFunction, graphqlApiArn: string): void {
+  if (!lambda.role) throw new Error("Assignment function needs an execution role.");
+  const roleName = lambda.role.roleName;
+  const resources = ASSIGNMENT_DATA_FIELDS.map((field) => `${graphqlApiArn}/types/${field}`);
+  Aspects.of(Stack.of(lambda)).add({
+    visit(node) {
+      if (!(node instanceof CfnPolicy)) return;
+      const stack = Stack.of(node);
+      const roles = stack.resolve(node.roles) as unknown[] | undefined;
+      if (!roles?.some((role) => JSON.stringify(role) === JSON.stringify(stack.resolve(roleName)))) return;
+      const document = stack.resolve(node.policyDocument) as { Statement: Array<Record<string, unknown>> };
+      document.Statement.forEach((statement, index) => {
+        const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
+        if (actions.includes("*") || actions.includes("appsync:*")) {
+          throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
+        }
+        if (!actions.includes("appsync:GraphQL")) return;
+        if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
+          throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
+        }
+        node.addPropertyOverride(`PolicyDocument.Statement.${index}.Resource`, resources);
+      });
+    },
+  });
+}

package/amplify/functions/assignment-action/handler.ts

@@ -316,7 +316,7 @@ async function listAssignmentsForObject(event: Parameters<Schema["listAssignment
   return contexts;
 }
 
-async function editorialContext(client: DataClient, scope: { publicationKey?: string; sectionId?: string | null; storyLineageId?: string | null; assignmentId?: string | null; maxCharacters?: number | null }) {
+async function editorialContext(client: DataClient, scope: { publicationKey?: string; sectionId?: string | null; storyLineageId?: string | null; assignmentId?: string | null; maxCharacters?: number | null; optionalPublicationDoctrine?: boolean | null }) {
   if (!editorialEndpoint) throw new Error("Editorial context requires the configured backend endpoint.");
   return resolveEditorialContext(client as unknown as EditorialClient, {
     ...scope, endpoint: editorialEndpoint, tenantId: tenantIdFromEnvironment(), readAttachment: readEditorialAttachment,

package/amplify/functions/content-actions/handler.py

@@ -9,6 +9,7 @@ from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
 from papyrus_content.projection.deploy_render import deploy_render, drift_metric_line
 from papyrus_content.projection.engine import project, project_all, project_item_pages
+from papyrus_content.reader_steering.task import TASK_NAME as READER_SNAPSHOT_TASK, run_reader_snapshot
 from papyrus_content.projection.runtime import (
     DEAD_LETTER_QUEUE_ENV,
     context_from_environment,
@@ -23,6 +24,10 @@ from papyrus_content.rebuild_trigger import (
     trigger_staging_build,
 )
 from papyrus_content.story_reporting import save_story_version
+from papyrus_content.publication import ensure_publication_from_environment
+from papyrus_content.editorial_checks import GraphQLEditorialStore, ensure_default_policies
+from papyrus_content.reference_intake import IntakeError, intake_references
+from papyrus_content.publish_alerts import PUBLISHED_TASK_KEY, announce_published
 from papyrus_content.publishing import (
     ItemFields,
     PublishError,
@@ -115,11 +120,17 @@ def projection_context(client):
     return context
 
 
-def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
+def project_item_action(client, item_id: str, *, unpublished: bool, published_item_id: str | None = None) -> dict:
+    """Project one item. ``published_item_id`` is passed only for a real publish: the alert is announced once the page
+    is live, here when the projection succeeds, or by the scheduled retry (which carries the same marker) when it did not."""
     if not projection_configured():
+        if published_item_id:
+            announce_published(item_id, published_item_id)
         return {}
     liveness = {} if unpublished else {"live": False}
     task = {"task": "item", "itemId": item_id, "unpublished": unpublished}
+    if published_item_id:
+        task[PUBLISHED_TASK_KEY] = {"publishedItemId": published_item_id}
     try:
         report = project(projection_context(client), item_id, unpublished=unpublished)
     except Exception as error:  # noqa: BLE001 - a projection failure never fails the save
@@ -141,6 +152,8 @@ def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
         schedule_unpurged_invalidation(report.unpurged)
     if report.follow_up_item_pages:
         schedule_projection_task({"task": "item-pages", "exceptItemId": item_id}, "follow-up")
+    if report.ok and published_item_id:
+        announce_published(item_id, published_item_id)
     return response
 
 
@@ -148,8 +161,19 @@ def schedule_unpurged_invalidation(keys: list[str]) -> None:
     schedule_projection_task({"task": "invalidate", "keys": keys}, "edge invalidation failed")
 
 
+def ensure_default_editorial_policies(client) -> None:
+    """A deployed site starts with working editorial policies. Never fails the deploy: a problem is logged."""
+    try:
+        result = ensure_default_policies(GraphQLEditorialStore(execute=client.graphql))
+        print(json.dumps({"defaultEditorialPolicies": result}))
+    except Exception as error:
+        print(json.dumps({"defaultEditorialPoliciesError": str(error)[:500]}))
+
+
 def run_deploy_render_task(client) -> dict:
     """Render every published page after a backend deploy, then report drift (a dry run: nothing is deleted)."""
+    ensure_publication_from_environment(client)
+    ensure_default_editorial_policies(client)
     context = projection_context(client)
     report = deploy_render(context)
     print(drift_metric_line(report))
@@ -173,6 +197,8 @@ def run_projection_task(task: dict) -> dict:
         report = project_all(projection_context(client))
     elif task.get("task") == "deploy-render":
         return run_deploy_render_task(client)
+    elif task.get("task") == READER_SNAPSHOT_TASK:
+        return run_reader_snapshot(projection_context(client), client, poll_retirements=task.get("retirementPoll") is True).to_dict()
     elif task.get("task") == "invalidate":
         invalidate = projection_context(client).invalidate
         if invalidate is None:
@@ -184,6 +210,10 @@ def run_projection_task(task: dict) -> dict:
         schedule_unpurged_invalidation(report.unpurged)
     if not report.ok:
         raise ProjectionTaskFailed("; ".join(report.errors))
+    published = task.get(PUBLISHED_TASK_KEY)
+    if task.get("task") == "item" and not task.get("unpublished") and isinstance(published, dict):
+        # A real publish (the CLI marks it, as does the newsroom's retry): the page is live, so tell the newsletter.
+        announce_published(task["itemId"], published.get("publishedItemId"))
     return {"ok": True, "paths": [*report.written, *report.deleted]}
 
 
@@ -269,7 +299,9 @@ def publish_item_action(arguments: dict, actor: str) -> dict:
     }
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
-    response.update(project_item_action(client, arguments["id"], unpublished=False))
+    response.update(
+        project_item_action(client, arguments["id"], unpublished=False, published_item_id=result.published_item_id if result.changed else None)
+    )
     return response
 
 
@@ -283,6 +315,17 @@ def unpublish_item_action(arguments: dict, actor: str) -> dict:
     return response
 
 
+def move_story_stage_action(arguments: dict, actor: str) -> dict:
+    from papyrus_content.story_reporting import move_story_stage
+
+    client, _claims = create_authoring_client()
+    try:
+        result = move_story_stage(client, arguments["lineageId"], arguments["stage"], actor=actor, reason=arguments.get("reason"))
+    except ValueError as error:
+        return {"ok": False, "errors": [{"code": "invalid-stage", "message": str(error), "line": None}]}
+    return {"ok": True, **result}
+
+
 def request_staging_build_action() -> dict:
     cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
     if not cms_app_id:
@@ -299,12 +342,20 @@ def handler(event, context):
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)
     try:
+        if field == "intakePendingReferences":
+            client, _claims = create_authoring_client()
+            try:
+                return intake_references(client, arguments, event.get("identity") or {})
+            except IntakeError as error:
+                return {"ok": False, "errors": [{"code": "intake-rejected", "message": str(error)}]}
         if field == "deriveMarkus":
             return derive_markus_action(arguments)
         if field == "saveItemDraft":
             return save_item_draft_action(arguments, actor)
         if field == "publishItem":
             return publish_item_action(arguments, actor)
+        if field == "moveStoryStage":
+            return move_story_stage_action(arguments, actor)
         if field == "unpublishItem":
             return unpublish_item_action(arguments, actor)
         if field == "requestStagingBuild":

package/amplify/functions/content-actions/requirements.txt

@@ -3,3 +3,4 @@ citeproc-py>=0.8.2,<1
 anthus-markus==0.7.0
 Pillow>=11.3,<12
 awscrt>=0.23,<1
+humanus>=0.33,<0.34

package/amplify/functions/content-actions/resource.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1", "humanus>=0.33,<0.34"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/functions/content-actions/resource.ts

@@ -10,7 +10,7 @@ import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1", "humanus>=0.33,<0.34"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");

package/amplify/functions/editorial-checks/handler.py

@@ -0,0 +1,14 @@
+"""The editorial-checks function: routes its GraphQL fields to papyrus_content.editorial_checks."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.editorial_checks import GraphQLEditorialStore, Services, event_field_name, handle, load_provider_keys
+
+# Amplify passes secrets to Python functions as placeholders; resolve them once per cold start.
+load_provider_keys()
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    return handle(event_field_name(event), event.get("arguments") or {}, Services(store=GraphQLEditorialStore()))

package/amplify/functions/editorial-checks/requirements.txt

@@ -0,0 +1 @@
+humanus[jev]>=0.33,<0.34

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/resource.js

@@ -4,12 +4,12 @@ import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../../../functions/shared/python-bundle.js";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
 const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
-/** AppSync gives a resolver 30 seconds; Limatus's classifier deadline (settings, default 20 s) keeps a check inside this. */
+/** AppSync gives a resolver 30 seconds; Humanus's classifier deadline (settings, default 20 s) keeps a check inside this. */
 export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
-/** Limatus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
-export const editorialChecksRequirements = ["limatus[jev]>=0.31,<0.32"];
+/** Humanus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
+export const editorialChecksRequirements = ["humanus[jev]>=0.33,<0.34"];
 function installRequirements(outputDir) {
     execFileSync("python3", [
         "-m", "pip", "install", "-r", path.join(functionDirectory, "requirements.txt"), "-t", outputDir, "--no-cache-dir",
@@ -24,7 +24,7 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
     timeout: Duration.seconds(EDITORIAL_CHECKS_TIMEOUT_SECONDS),
     memorySize: 1024,
     code: pythonLambdaCode({
-        functionDir: "../plugins/editorial-checks/function",
+        functionDir: "editorial-checks",
         modules: ["papyrus_content"],
         requirements: editorialChecksRequirements,
         noDeps: true,
@@ -35,9 +35,9 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
         [
             "set -euo pipefail",
             "mkdir -p /asset-output/papyrus_content",
-            "cp amplify/plugins/editorial-checks/function/handler.py /asset-output/handler.py",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
             "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
-            "python3 -m pip install -r amplify/plugins/editorial-checks/function/requirements.txt -t /asset-output --no-cache-dir",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
         ].join(" && "),
     ]),
 }), { resourceGroupName: "data" });

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/resource.ts

@@ -5,15 +5,15 @@ import type { Construct } from "constructs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../../../functions/shared/python-bundle";
+import { pythonLambdaCode } from "../shared/python-bundle";
 
 const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
 
-/** AppSync gives a resolver 30 seconds; Limatus's classifier deadline (settings, default 20 s) keeps a check inside this. */
+/** AppSync gives a resolver 30 seconds; Humanus's classifier deadline (settings, default 20 s) keeps a check inside this. */
 export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
 
-/** Limatus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
-export const editorialChecksRequirements = ["limatus[jev]>=0.31,<0.32"];
+/** Humanus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
+export const editorialChecksRequirements = ["humanus[jev]>=0.33,<0.34"];
 
 function installRequirements(outputDir: string): void {
   execFileSync(
@@ -37,7 +37,7 @@ export const editorialChecks = defineFunction(
       memorySize: 1024,
       code: pythonLambdaCode(
         {
-          functionDir: "../plugins/editorial-checks/function",
+          functionDir: "editorial-checks",
           modules: ["papyrus_content"],
           requirements: editorialChecksRequirements,
           noDeps: true,
@@ -49,9 +49,9 @@ export const editorialChecks = defineFunction(
           [
             "set -euo pipefail",
             "mkdir -p /asset-output/papyrus_content",
-            "cp amplify/plugins/editorial-checks/function/handler.py /asset-output/handler.py",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
             "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
-            "python3 -m pip install -r amplify/plugins/editorial-checks/function/requirements.txt -t /asset-output --no-cache-dir",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
           ].join(" && "),
         ],
       ),