@anthusai/papyrus 2.0.0-next.73 → 2.0.0-next.75

package/amplify/data/resource.js

@@ -1152,6 +1152,8 @@ const schema = a.schema({
         error: a.json(),
         attempt: a.integer(),
         newsroomFeedKey: a.string(),
+        usage: a.json(),
+        costUsd: a.float(),
     })
         .secondaryIndexes((index) => [
         index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1163,6 +1165,73 @@ const schema = a.schema({
         allow.group("editor").to(["read"]),
         allow.group(adminGroup).to(authoringOperations),
     ]),
+    Automation: a
+        .model({
+        id: a.id().required(),
+        title: a.string().required(),
+        description: a.string(),
+        enabled: a.boolean().required(),
+        trigger: a.json().required(),
+        procedureKey: a.string().required(),
+        inputTemplate: a.json(),
+        limits: a.json(),
+        createdBy: a.string(),
+        createdAt: a.datetime().required(),
+        updatedBy: a.string(),
+        updatedAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.group("editor").to(["read", "create", "update"]),
+        allow.group(adminGroup).to(authoringOperations),
+    ]),
+    /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+    ReviewRequest: a
+        .model({
+        id: a.id().required(),
+        subject: a.json().required(),
+        mode: a.string().required(),
+        reason: a.string().required(),
+        ask: a.string(),
+        raisedBy: a.string().required(),
+        raisedAt: a.datetime().required(),
+        deadline: a.datetime(),
+        state: a.string().required(),
+        answer: a.json(),
+        links: a.json(),
+        history: a.json(),
+        appliedIn: a.json(),
+        updatedAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.group("editor").to(["read", "create", "update"]),
+        allow.group(adminGroup).to(authoringOperations),
+    ]),
+    /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+    ReviewReadMark: a
+        .model({
+        id: a.id().required(),
+        requestId: a.string().required(),
+        userKey: a.string().required(),
+        readAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+    ]),
+    /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+    ReviewRecipientRule: a
+        .model({
+        id: a.id().required(),
+        scope: a.string().required(),
+        key: a.string(),
+        roles: a.string().array(),
+        emails: a.string().array(),
+        updatedBy: a.string(),
+        updatedAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.group("editor").to(["read"]),
+        allow.group(adminGroup).to(authoringOperations),
+    ]),
     NewsroomSection: a
         .model({
         id: a.id().required(),

package/amplify/data/resource.ts

@@ -1247,6 +1247,8 @@ const schema = a.schema({
       error: a.json(),
       attempt: a.integer(),
       newsroomFeedKey: a.string(),
+      usage: a.json(),
+      costUsd: a.float(),
     })
     .secondaryIndexes((index) => [
       index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1259,6 +1261,77 @@ const schema = a.schema({
       allow.group(adminGroup).to(authoringOperations),
     ]),
 
+  Automation: a
+    .model({
+      id: a.id().required(),
+      title: a.string().required(),
+      description: a.string(),
+      enabled: a.boolean().required(),
+      trigger: a.json().required(),
+      procedureKey: a.string().required(),
+      inputTemplate: a.json(),
+      limits: a.json(),
+      createdBy: a.string(),
+      createdAt: a.datetime().required(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
+  /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+  ReviewRequest: a
+    .model({
+      id: a.id().required(),
+      subject: a.json().required(),
+      mode: a.string().required(),
+      reason: a.string().required(),
+      ask: a.string(),
+      raisedBy: a.string().required(),
+      raisedAt: a.datetime().required(),
+      deadline: a.datetime(),
+      state: a.string().required(),
+      answer: a.json(),
+      links: a.json(),
+      history: a.json(),
+      appliedIn: a.json(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
+  /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+  ReviewReadMark: a
+    .model({
+      id: a.id().required(),
+      requestId: a.string().required(),
+      userKey: a.string().required(),
+      readAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+    ]),
+
+  /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+  ReviewRecipientRule: a
+    .model({
+      id: a.id().required(),
+      scope: a.string().required(),
+      key: a.string(),
+      roles: a.string().array(),
+      emails: a.string().array(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
   NewsroomSection: a
     .model({
       id: a.id().required(),

package/amplify/data/schema.js

@@ -2,6 +2,7 @@ import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
+import { automationViewSchemaDefinitions } from "../functions/automation-view/schema.js";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
@@ -1071,6 +1072,8 @@ function buildBaseDefinitions(includeEditions) {
             error: a.json(),
             attempt: a.integer(),
             newsroomFeedKey: a.string(),
+            usage: a.json(),
+            costUsd: a.float(),
         })
             .secondaryIndexes((index) => [
             index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1082,6 +1085,70 @@ function buildBaseDefinitions(includeEditions) {
             allow.group("editor").to(["read"]),
             allow.group(adminGroup).to(authoringOperations),
         ]),
+        /** A named "when X happens, run procedure Y" (PPY-9ff95b). Step 1 mirrors the monitoring router's procedureTriggers and starts nothing itself. */
+        Automation: modelWithoutSubscriptions({
+            id: a.id().required(),
+            title: a.string().required(),
+            description: a.string(),
+            enabled: a.boolean().required(),
+            trigger: a.json().required(),
+            procedureKey: a.string().required(),
+            inputTemplate: a.json(),
+            limits: a.json(),
+            createdBy: a.string(),
+            createdAt: a.datetime().required(),
+            updatedBy: a.string(),
+            updatedAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.group("editor").to(["read", "create", "update"]),
+            allow.group(adminGroup).to(authoringOperations),
+        ]),
+        /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+        ReviewRequest: modelWithoutSubscriptions({
+            id: a.id().required(),
+            subject: a.json().required(),
+            mode: a.string().required(),
+            reason: a.string().required(),
+            ask: a.string(),
+            raisedBy: a.string().required(),
+            raisedAt: a.datetime().required(),
+            deadline: a.datetime(),
+            state: a.string().required(),
+            answer: a.json(),
+            links: a.json(),
+            history: a.json(),
+            appliedIn: a.json(),
+            updatedAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.group("editor").to(["read", "create", "update"]),
+            allow.group(adminGroup).to(authoringOperations),
+        ]),
+        /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+        ReviewReadMark: modelWithoutSubscriptions({
+            id: a.id().required(),
+            requestId: a.string().required(),
+            userKey: a.string().required(),
+            readAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+        ]),
+        /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+        ReviewRecipientRule: modelWithoutSubscriptions({
+            id: a.id().required(),
+            scope: a.string().required(),
+            key: a.string(),
+            roles: a.string().array(),
+            emails: a.string().array(),
+            updatedBy: a.string(),
+            updatedAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.group("editor").to(["read"]),
+            allow.group(adminGroup).to(authoringOperations),
+        ]),
         NewsroomSection: modelWithoutSubscriptions({
             id: a.id().required(),
             tenantId: a.string(),
@@ -2021,6 +2088,7 @@ function buildBaseDefinitions(includeEditions) {
         ]),
         ...editorialChecksSchemaDefinitions,
         ...monitoringViewSchemaDefinitions,
+        ...automationViewSchemaDefinitions,
     };
     if (!includeEditions) {
         const mutableDefinitions = definitions;

package/amplify/data/schema.ts

@@ -2,6 +2,7 @@ import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
+import { automationViewSchemaDefinitions } from "../functions/automation-view/schema";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
@@ -1164,6 +1165,8 @@ const definitions = {
       error: a.json(),
       attempt: a.integer(),
       newsroomFeedKey: a.string(),
+      usage: a.json(),
+      costUsd: a.float(),
     })
     .secondaryIndexes((index) => [
       index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1176,6 +1179,74 @@ const definitions = {
       allow.group(adminGroup).to(authoringOperations),
     ]),
 
+  /** A named "when X happens, run procedure Y" (PPY-9ff95b). Step 1 mirrors the monitoring router's procedureTriggers and starts nothing itself. */
+  Automation: modelWithoutSubscriptions({
+      id: a.id().required(),
+      title: a.string().required(),
+      description: a.string(),
+      enabled: a.boolean().required(),
+      trigger: a.json().required(),
+      procedureKey: a.string().required(),
+      inputTemplate: a.json(),
+      limits: a.json(),
+      createdBy: a.string(),
+      createdAt: a.datetime().required(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
+  /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+  ReviewRequest: modelWithoutSubscriptions({
+      id: a.id().required(),
+      subject: a.json().required(),
+      mode: a.string().required(),
+      reason: a.string().required(),
+      ask: a.string(),
+      raisedBy: a.string().required(),
+      raisedAt: a.datetime().required(),
+      deadline: a.datetime(),
+      state: a.string().required(),
+      answer: a.json(),
+      links: a.json(),
+      history: a.json(),
+      appliedIn: a.json(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
+  /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+  ReviewReadMark: modelWithoutSubscriptions({
+      id: a.id().required(),
+      requestId: a.string().required(),
+      userKey: a.string().required(),
+      readAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+    ]),
+
+  /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+  ReviewRecipientRule: modelWithoutSubscriptions({
+      id: a.id().required(),
+      scope: a.string().required(),
+      key: a.string(),
+      roles: a.string().array(),
+      emails: a.string().array(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
   NewsroomSection: modelWithoutSubscriptions({
       id: a.id().required(),
       tenantId: a.string(),
@@ -2145,6 +2216,7 @@ const definitions = {
     ]),
   ...editorialChecksSchemaDefinitions,
   ...monitoringViewSchemaDefinitions,
+  ...automationViewSchemaDefinitions,
 };
 if (!includeEditions) {
   const mutableDefinitions = definitions as Record<string, unknown>;

package/amplify/functions/automation-view/handler.py

@@ -0,0 +1,17 @@
+"""The automation-view function: `automationOverview` (editors, admins and operator IAM roles, read only) and `runAutomation` (editors and admins)."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.automation_view import handle
+
+
+def _account(context: Any) -> str | None:
+    arn = getattr(context, "invoked_function_arn", None)
+    parts = str(arn or "").split(":")
+    return parts[4] if len(parts) > 4 and parts[4] else None
+
+
+def handler(event: dict[str, Any], context: Any = None) -> dict[str, Any]:
+    return handle(event, account_id=_account(context))

package/amplify/functions/automation-view/resource.js

@@ -0,0 +1,24 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+/** AppSync gives a resolver 30 seconds; a table read and ten run lookups need a few. */
+export const AUTOMATION_VIEW_TIMEOUT_SECONDS = 25;
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const automationView = defineFunction((scope) => new Function(scope, "papyrus-automation-view", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(AUTOMATION_VIEW_TIMEOUT_SECONDS),
+    memorySize: 256,
+    code: pythonLambdaCode({ functionDir: "automation-view", modules: ["papyrus_content"], noDeps: true }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/automation-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/automation-view/resource.ts

@@ -0,0 +1,34 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+/** AppSync gives a resolver 30 seconds; a table read and ten run lookups need a few. */
+export const AUTOMATION_VIEW_TIMEOUT_SECONDS = 25;
+
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const automationView = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-automation-view", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(AUTOMATION_VIEW_TIMEOUT_SECONDS),
+      memorySize: 256,
+      code: pythonLambdaCode(
+        { functionDir: "automation-view", modules: ["papyrus_content"], noDeps: true },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/automation-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/automation-view/schema.js

@@ -0,0 +1,25 @@
+import { a } from "@aws-amplify/backend";
+import { automationView } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. The Automation page reads the automation records, the monitoring
+ * trigger rows they link to, and the procedure runs through `automationOverview`, and starts a run
+ * through `runAutomation`. Both admit editors and admins. AppSync also lets an IAM principal call the
+ * query when its own policy allows the field (every operation in this schema accepts IAM callers for
+ * the functions that call it); the function reads only for an IAM principal of its own account and refuses
+ * every IAM caller on `runAutomation`.
+ */
+export const automationViewSchemaDefinitions = {
+    automationOverview: a
+        .query()
+        .arguments({ automationId: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(automationView)),
+    runAutomation: a
+        .mutation()
+        .arguments({ automationId: a.string().required(), input: a.json() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(automationView)),
+};

package/amplify/functions/automation-view/schema.ts

@@ -0,0 +1,27 @@
+import { a } from "@aws-amplify/backend";
+import { automationView } from "./resource";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. The Automation page reads the automation records, the monitoring
+ * trigger rows they link to, and the procedure runs through `automationOverview`, and starts a run
+ * through `runAutomation`. Both admit editors and admins. AppSync also lets an IAM principal call the
+ * query when its own policy allows the field (every operation in this schema accepts IAM callers for
+ * the functions that call it); the function reads only for an IAM principal of its own account and refuses
+ * every IAM caller on `runAutomation`.
+ */
+export const automationViewSchemaDefinitions = {
+  automationOverview: a
+    .query()
+    .arguments({ automationId: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(a.handler.function(automationView)),
+  runAutomation: a
+    .mutation()
+    .arguments({ automationId: a.string().required(), input: a.json() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(a.handler.function(automationView)),
+};

package/amplify/functions/automation-view/wire.js

@@ -0,0 +1,56 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { MONITORING_TABLE_PARAMETER, MONITORING_VIEW_TABLE_ACTIONS, monitoringViewParameterArn, monitoringViewTableArns, } from "../monitoring-view/wire.js";
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+    "Query/fields/getAutomation",
+    "Query/fields/getNewsroomProcedureDefinition",
+    "Query/fields/getProcedureRun",
+    "Query/fields/listAutomations",
+    "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
+/**
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
+ * monitoring account finds no parameter and the page lists its records without runs.
+ */
+export function wireAutomationView(backend) {
+    const lambda = backend.automationView.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
+    const apiId = backend.data.resources.graphqlApi.apiId;
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: AUTOMATION_VIEW_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account),
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+        conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["lambda:InvokeFunction"],
+        resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }));
+}

package/amplify/functions/automation-view/wire.ts

@@ -0,0 +1,76 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import {
+  MONITORING_TABLE_PARAMETER,
+  MONITORING_VIEW_TABLE_ACTIONS,
+  monitoringViewParameterArn,
+  monitoringViewTableArns,
+} from "../monitoring-view/wire";
+
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+  "Query/fields/getAutomation",
+  "Query/fields/getNewsroomProcedureDefinition",
+  "Query/fields/getProcedureRun",
+  "Query/fields/listAutomations",
+  "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
+
+/**
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
+ * monitoring account finds no parameter and the page lists its records without runs.
+ */
+export function wireAutomationView(backend: any): void {
+  const lambda = backend.automationView.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
+  const apiId = backend.data.resources.graphqlApi.apiId as string;
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: AUTOMATION_VIEW_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account),
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+      conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["lambda:InvokeFunction"],
+      resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }),
+  );
+}

package/amplify/plugins/reader-steering/config.js

@@ -7,7 +7,7 @@ export const AI_MODEL_NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/;
 export const SUBMISSION_KIND_NAME = /^[a-z][a-z0-9-]{0,23}$/;
 export const SUBJECT_TYPES = ["item", "submission", "story", "proposal", "concept"];
 export const COMPUTE_ROLE_ARN = /^arn:aws:iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects", "proposals"]);
 function object(raw, label, known) {
     if (raw === undefined)
         return {};
@@ -117,6 +117,7 @@ export function resolveReaderSteeringConfig(request) {
     if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => SUBJECT_TYPES.includes(type))) {
         throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
     }
+    const proposals = object(raw.proposals, "proposals", ["publish"]);
     const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
     const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
     const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -173,6 +174,7 @@ export function resolveReaderSteeringConfig(request) {
             maximumLength: integer(comments.maximumLength, "comments.maximumLength", 2000, 1, 10000),
             maximumLinks: integer(comments.maximumLinks, "comments.maximumLinks", 3, 0, 50),
         },
+        proposals: { publish: flag(proposals.publish, "proposals.publish") },
         retirementPoll,
         ...(hypeGap ? { hypeGap } : {}),
         ...(raw.reservedConcurrency === undefined ? {} : { reservedConcurrency: integer(raw.reservedConcurrency, "reservedConcurrency", 1, 1, 1000) }),