@anthusai/papyrus 2.0.0-next.7 → 2.0.0-next.70

package/amplify/functions/editorial-checks/schema.js

@@ -0,0 +1,121 @@
+import { a } from "@aws-amplify/backend";
+import { editorialChecks } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
+ * content against them. Editors read policies and record decisions; admins
+ * manage policies and settings. Only the function (IAM) calls Humanus.
+ */
+export const editorialChecksSchemaDefinitions = {
+    EditorialPolicy: a
+        .model({
+        id: a.id().required(),
+        policyKey: a.string().required(),
+        scope: a.string().required(),
+        version: a.integer().required(),
+        title: a.string().required(),
+        guidance: a.string().required(),
+        severity: a.string().required(),
+        enabled: a.boolean().required(),
+        detectors: a.json().required(),
+        examples: a.json(),
+        rewriteGuidance: a.string(),
+        source: a.string().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialCheckSettings: a
+        .model({
+        id: a.id().required(),
+        settings: a.json().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialFeedback: a
+        .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        findingId: a.string().required(),
+        policyId: a.string().required(),
+        detectorId: a.string().required(),
+        lane: a.string().required(),
+        probability: a.float(),
+        decision: a.string().required(),
+        reason: a.string(),
+        text: a.string(),
+    })
+        .disableOperations(["subscriptions"])
+        .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
+        .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
+    EditorialCheckRun: a
+        .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        lineageId: a.string().required(),
+        versionNumber: a.integer().required(),
+        section: a.string(),
+        contentHash: a.string(),
+        packVersion: a.string(),
+        violations: a.integer().required(),
+        reviews: a.integer().required(),
+        findings: a.json().required(),
+        lanes: a.json(),
+        checkedAt: a.datetime().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .secondaryIndexes((index) => [index("lineageId").sortKeys(["versionNumber"]).queryField("listEditorialCheckRunsByLineage")])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    listEditorialStarterPacks: a
+        .query()
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    checkItemVersion: a
+        .mutation()
+        .arguments({ itemId: a.id().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    checkEditorial: a
+        .query()
+        .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    suggestEditorialRewrite: a
+        .query()
+        .arguments({
+        body: a.string().required(),
+        format: a.string(),
+        section: a.string(),
+        finding: a.json(),
+        selection: a.json(),
+        note: a.string(),
+    })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    draftEditorialQuestions: a
+        .query()
+        .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    tryEditorialPolicy: a
+        .query()
+        .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    importEditorialStarterPack: a
+        .mutation()
+        .arguments({ name: a.string().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    recalibrateEditorialPolicies: a
+        .mutation()
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+};

package/amplify/{plugins → functions}/editorial-checks/schema.ts

@@ -1,15 +1,14 @@
 import { a } from "@aws-amplify/backend";
-import { editorialChecks } from "./function/resource";
+import { editorialChecks } from "./resource";
 
 const editors = ["editor", "admin"];
 
 /**
- * Policies, settings and editors' decisions live in Papyrus; Limatus checks
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
  * content against them. Editors read policies and record decisions; admins
- * manage policies and settings. Only the function (IAM) calls Limatus.
+ * manage policies and settings. Only the function (IAM) calls Humanus.
  */
-export function editorialChecksSchemaDefinitions() {
-  return {
+export const editorialChecksSchemaDefinitions = {
     EditorialPolicy: a
       .model({
         id: a.id().required(),
@@ -50,6 +49,35 @@ export function editorialChecksSchemaDefinitions() {
       .disableOperations(["subscriptions"])
       .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
       .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
+    EditorialCheckRun: a
+      .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        lineageId: a.string().required(),
+        versionNumber: a.integer().required(),
+        section: a.string(),
+        contentHash: a.string(),
+        packVersion: a.string(),
+        violations: a.integer().required(),
+        reviews: a.integer().required(),
+        findings: a.json().required(),
+        lanes: a.json(),
+        checkedAt: a.datetime().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .secondaryIndexes((index) => [index("lineageId").sortKeys(["versionNumber"]).queryField("listEditorialCheckRunsByLineage")])
+      .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    listEditorialStarterPacks: a
+      .query()
+      .returns(a.json())
+      .authorization((allow) => [allow.groups(editors)])
+      .handler(a.handler.function(editorialChecks)),
+    checkItemVersion: a
+      .mutation()
+      .arguments({ itemId: a.id().required() })
+      .returns(a.json())
+      .authorization((allow) => [allow.groups(editors)])
+      .handler(a.handler.function(editorialChecks)),
     checkEditorial: a
       .query()
       .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
@@ -93,4 +121,3 @@ export function editorialChecksSchemaDefinitions() {
       .authorization((allow) => [allow.group("admin")])
       .handler(a.handler.function(editorialChecks)),
   };
-}

package/amplify/functions/editorial-checks/wire.js

@@ -0,0 +1,53 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+    "Query/fields/listKnowledgeCorporaByRoleAndName",
+    "Query/fields/getEditorialContext",
+    "Query/fields/listEditorialPolicies",
+    "Query/fields/getEditorialCheckSettings",
+    "Query/fields/listEditorialFeedbacks",
+    "Mutation/fields/createEditorialPolicy",
+    "Mutation/fields/updateEditorialPolicy",
+    "Query/fields/getItem",
+    "Query/fields/getEditorialCheckRun",
+    "Mutation/fields/createEditorialCheckRun",
+    "Mutation/fields/updateEditorialCheckRun",
+];
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region, account, appId) {
+    const arn = (path) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+    return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+        arn(`papyrus/*/${name}`),
+        arn(`shared/papyrus/${name}`),
+        ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+    ]);
+}
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend) {
+    const lambda = backend.editorialChecks.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    for (const name of EDITORIAL_CHECKS_SECRETS)
+        backend.editorialChecks.addEnvironment(name, secret(name));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter", "ssm:GetParameters"],
+        resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }));
+    const apiId = backend.data.resources.graphqlApi.apiId;
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }));
+}

package/amplify/functions/editorial-checks/wire.ts

@@ -0,0 +1,61 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+  "Query/fields/listKnowledgeCorporaByRoleAndName",
+  "Query/fields/getEditorialContext",
+  "Query/fields/listEditorialPolicies",
+  "Query/fields/getEditorialCheckSettings",
+  "Query/fields/listEditorialFeedbacks",
+  "Mutation/fields/createEditorialPolicy",
+  "Mutation/fields/updateEditorialPolicy",
+  "Query/fields/getItem",
+  "Query/fields/getEditorialCheckRun",
+  "Mutation/fields/createEditorialCheckRun",
+  "Mutation/fields/updateEditorialCheckRun",
+];
+
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region: string, account: string, appId: string): string[] {
+  const arn = (path: string) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+  return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+    arn(`papyrus/*/${name}`),
+    arn(`shared/papyrus/${name}`),
+    ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+  ]);
+}
+
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend: any): void {
+  const lambda = backend.editorialChecks.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  for (const name of EDITORIAL_CHECKS_SECRETS) backend.editorialChecks.addEnvironment(name, secret(name));
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter", "ssm:GetParameters"],
+      resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }),
+  );
+  const apiId = backend.data.resources.graphqlApi.apiId as string;
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }),
+  );
+}

package/amplify/functions/monitoring-view/handler.py

@@ -0,0 +1,11 @@
+"""The monitoring-view function: `monitoringOverview` for editors and admins, read-only."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.monitoring_view import handle
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    return handle(event)

package/amplify/functions/monitoring-view/resource.js

@@ -0,0 +1,24 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction((scope) => new Function(scope, "papyrus-monitoring-view", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+    memorySize: 256,
+    code: pythonLambdaCode({ functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/monitoring-view/resource.ts

@@ -0,0 +1,34 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-monitoring-view", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+      memorySize: 256,
+      code: pythonLambdaCode(
+        { functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/monitoring-view/schema.js

@@ -0,0 +1,16 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+    monitoringOverview: a
+        .query()
+        .arguments({ scope: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(monitoringView)),
+};

package/amplify/functions/monitoring-view/schema.ts

@@ -0,0 +1,18 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+  monitoringOverview: a
+    .query()
+    .arguments({ scope: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(a.handler.function(monitoringView)),
+};

package/amplify/functions/monitoring-view/wire.js

@@ -0,0 +1,37 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region, account) {
+    const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+    return [table, `${table}/index/routing`];
+}
+export function monitoringViewParameterArn(region, account) {
+    return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend) {
+    const lambda = backend.monitoringView.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account),
+    }));
+}

package/amplify/functions/monitoring-view/wire.ts

@@ -0,0 +1,47 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region: string, account: string): string[] {
+  const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+  return [table, `${table}/index/routing`];
+}
+
+export function monitoringViewParameterArn(region: string, account: string): string {
+  return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend: any): void {
+  const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account),
+    }),
+  );
+}