@anthusai/papyrus 2.0.0-next.8 → 2.0.0-next.80

package/amplify/functions/assignment-action/data-access.js

@@ -9,6 +9,8 @@ export const ASSIGNMENT_DATA_FIELDS = [
     "Query/fields/getProcedureDefinition",
     "Query/fields/getModelAttachment",
     "Query/fields/getNewsroomSection",
+    "Query/fields/listNewsroomSections",
+    "Query/fields/listNewsroomSectionsByTenantAndSortOrder",
     "Query/fields/getKnowledgeCorpus",
     "Query/fields/getKnowledgeImportRun",
     "Query/fields/getReference",
@@ -71,21 +73,18 @@ export function scopeAssignmentDataAccess(lambda, graphqlApiArn) {
             if (!roles?.some((role) => JSON.stringify(role) === JSON.stringify(stack.resolve(roleName))))
                 return;
             const document = stack.resolve(node.policyDocument);
-            node.policyDocument = {
-                ...document,
-                Statement: document.Statement.map((statement) => {
-                    const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
-                    if (actions.includes("*") || actions.includes("appsync:*")) {
-                        throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
-                    }
-                    if (!actions.includes("appsync:GraphQL"))
-                        return statement;
-                    if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
-                        throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
-                    }
-                    return { ...statement, Resource: resources };
-                }),
-            };
+            document.Statement.forEach((statement, index) => {
+                const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
+                if (actions.includes("*") || actions.includes("appsync:*")) {
+                    throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
+                }
+                if (!actions.includes("appsync:GraphQL"))
+                    return;
+                if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
+                    throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
+                }
+                node.addPropertyOverride(`PolicyDocument.Statement.${index}.Resource`, resources);
+            });
         },
     });
 }

package/amplify/functions/assignment-action/data-access.ts

@@ -11,6 +11,8 @@ export const ASSIGNMENT_DATA_FIELDS = [
   "Query/fields/getProcedureDefinition",
   "Query/fields/getModelAttachment",
   "Query/fields/getNewsroomSection",
+  "Query/fields/listNewsroomSections",
+  "Query/fields/listNewsroomSectionsByTenantAndSortOrder",
   "Query/fields/getKnowledgeCorpus",
   "Query/fields/getKnowledgeImportRun",
   "Query/fields/getReference",
@@ -71,20 +73,17 @@ export function scopeAssignmentDataAccess(lambda: IFunction, graphqlApiArn: stri
       const roles = stack.resolve(node.roles) as unknown[] | undefined;
       if (!roles?.some((role) => JSON.stringify(role) === JSON.stringify(stack.resolve(roleName)))) return;
       const document = stack.resolve(node.policyDocument) as { Statement: Array<Record<string, unknown>> };
-      node.policyDocument = {
-        ...document,
-        Statement: document.Statement.map((statement) => {
-          const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
-          if (actions.includes("*") || actions.includes("appsync:*")) {
-            throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
-          }
-          if (!actions.includes("appsync:GraphQL")) return statement;
-          if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
-            throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
-          }
-          return { ...statement, Resource: resources };
-        }),
-      };
+      document.Statement.forEach((statement, index) => {
+        const actions = Array.isArray(statement.Action) ? statement.Action : [statement.Action];
+        if (actions.includes("*") || actions.includes("appsync:*")) {
+          throw new Error("Unexpected wildcard assignment action; review permissions before synthesis.");
+        }
+        if (!actions.includes("appsync:GraphQL")) return;
+        if (statement.Effect !== "Allow" || actions.length !== 1 || statement.NotResource) {
+          throw new Error("Unexpected assignment GraphQL policy; review field scoping before synthesis.");
+        }
+        node.addPropertyOverride(`PolicyDocument.Statement.${index}.Resource`, resources);
+      });
     },
   });
 }

package/amplify/functions/assignment-action/handler.ts

@@ -316,7 +316,7 @@ async function listAssignmentsForObject(event: Parameters<Schema["listAssignment
   return contexts;
 }
 
-async function editorialContext(client: DataClient, scope: { publicationKey?: string; sectionId?: string | null; storyLineageId?: string | null; assignmentId?: string | null; maxCharacters?: number | null }) {
+async function editorialContext(client: DataClient, scope: { publicationKey?: string; sectionId?: string | null; storyLineageId?: string | null; assignmentId?: string | null; maxCharacters?: number | null; optionalPublicationDoctrine?: boolean | null }) {
   if (!editorialEndpoint) throw new Error("Editorial context requires the configured backend endpoint.");
   return resolveEditorialContext(client as unknown as EditorialClient, {
     ...scope, endpoint: editorialEndpoint, tenantId: tenantIdFromEnvironment(), readAttachment: readEditorialAttachment,

package/amplify/functions/automation-view/handler.py

@@ -0,0 +1,17 @@
+"""The automation-view function: `automationOverview` (editors, admins and operator IAM roles, read only) and `runAutomation` (editors and admins)."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.automation_view import handle
+
+
+def _account(context: Any) -> str | None:
+    arn = getattr(context, "invoked_function_arn", None)
+    parts = str(arn or "").split(":")
+    return parts[4] if len(parts) > 4 and parts[4] else None
+
+
+def handler(event: dict[str, Any], context: Any = None) -> dict[str, Any]:
+    return handle(event, account_id=_account(context))

package/amplify/functions/automation-view/resource.js

@@ -0,0 +1,24 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+/** AppSync gives a resolver 30 seconds; a table read and ten run lookups need a few. */
+export const AUTOMATION_VIEW_TIMEOUT_SECONDS = 25;
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const automationView = defineFunction((scope) => new Function(scope, "papyrus-automation-view", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(AUTOMATION_VIEW_TIMEOUT_SECONDS),
+    memorySize: 256,
+    code: pythonLambdaCode({ functionDir: "automation-view", modules: ["papyrus_content"], noDeps: true }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/automation-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/automation-view/resource.ts

@@ -0,0 +1,34 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+/** AppSync gives a resolver 30 seconds; a table read and ten run lookups need a few. */
+export const AUTOMATION_VIEW_TIMEOUT_SECONDS = 25;
+
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const automationView = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-automation-view", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(AUTOMATION_VIEW_TIMEOUT_SECONDS),
+      memorySize: 256,
+      code: pythonLambdaCode(
+        { functionDir: "automation-view", modules: ["papyrus_content"], noDeps: true },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/automation-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/automation-view/schema.js

@@ -0,0 +1,26 @@
+import { a } from "@aws-amplify/backend";
+import { automationView } from "./resource.js";
+import { functionHandler } from "../../data/function-handler.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. The Automation page reads the automation records, the monitoring
+ * trigger rows they link to, and the procedure runs through `automationOverview`, and starts a run
+ * through `runAutomation`. Both admit editors and admins. AppSync also lets an IAM principal call the
+ * query when its own policy allows the field (every operation in this schema accepts IAM callers for
+ * the functions that call it); the function reads only for an IAM principal of its own account and refuses
+ * every IAM caller on `runAutomation`.
+ */
+export const automationViewSchemaDefinitions = {
+    automationOverview: a
+        .query()
+        .arguments({ automationId: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("automationView", automationView)),
+    runAutomation: a
+        .mutation()
+        .arguments({ automationId: a.string().required(), input: a.json() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("automationView", automationView)),
+};

package/amplify/functions/automation-view/schema.ts

@@ -0,0 +1,28 @@
+import { a } from "@aws-amplify/backend";
+import { automationView } from "./resource";
+import { functionHandler } from "../../data/function-handler";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. The Automation page reads the automation records, the monitoring
+ * trigger rows they link to, and the procedure runs through `automationOverview`, and starts a run
+ * through `runAutomation`. Both admit editors and admins. AppSync also lets an IAM principal call the
+ * query when its own policy allows the field (every operation in this schema accepts IAM callers for
+ * the functions that call it); the function reads only for an IAM principal of its own account and refuses
+ * every IAM caller on `runAutomation`.
+ */
+export const automationViewSchemaDefinitions = {
+  automationOverview: a
+    .query()
+    .arguments({ automationId: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("automationView", automationView)),
+  runAutomation: a
+    .mutation()
+    .arguments({ automationId: a.string().required(), input: a.json() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("automationView", automationView)),
+};

package/amplify/functions/automation-view/wire.js

@@ -0,0 +1,56 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { MONITORING_TABLE_PARAMETER, MONITORING_VIEW_TABLE_ACTIONS, monitoringViewParameterArn, monitoringViewTableArns, } from "../monitoring-view/wire.js";
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+    "Query/fields/getAutomation",
+    "Query/fields/getNewsroomProcedureDefinition",
+    "Query/fields/getProcedureRun",
+    "Query/fields/listAutomations",
+    "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
+/**
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
+ * monitoring account finds no parameter and the page lists its records without runs.
+ */
+export function wireAutomationView(backend) {
+    const lambda = backend.automationView.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
+    const apiId = backend.data.resources.graphqlApi.apiId;
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: AUTOMATION_VIEW_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account),
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+        conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["lambda:InvokeFunction"],
+        resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }));
+}

package/amplify/functions/automation-view/wire.ts

@@ -0,0 +1,76 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import {
+  MONITORING_TABLE_PARAMETER,
+  MONITORING_VIEW_TABLE_ACTIONS,
+  monitoringViewParameterArn,
+  monitoringViewTableArns,
+} from "../monitoring-view/wire";
+
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+  "Query/fields/getAutomation",
+  "Query/fields/getNewsroomProcedureDefinition",
+  "Query/fields/getProcedureRun",
+  "Query/fields/listAutomations",
+  "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
+
+/**
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
+ * monitoring account finds no parameter and the page lists its records without runs.
+ */
+export function wireAutomationView(backend: any): void {
+  const lambda = backend.automationView.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
+  const apiId = backend.data.resources.graphqlApi.apiId as string;
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: AUTOMATION_VIEW_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account),
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+      conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["lambda:InvokeFunction"],
+      resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }),
+  );
+}

package/amplify/functions/content-actions/handler.py

@@ -8,7 +8,9 @@ from papyrus_content.edge_invalidation import distribution_ids_from_environment,
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
 from papyrus_content.projection.deploy_render import deploy_render, drift_metric_line
+from papyrus_content.projection.lease import ProjectionLeaseHeld
 from papyrus_content.projection.engine import project, project_all, project_item_pages
+from papyrus_content.reader_steering.task import TASK_NAME as READER_SNAPSHOT_TASK, run_reader_snapshot
 from papyrus_content.projection.runtime import (
     DEAD_LETTER_QUEUE_ENV,
     context_from_environment,
@@ -23,6 +25,10 @@ from papyrus_content.rebuild_trigger import (
     trigger_staging_build,
 )
 from papyrus_content.story_reporting import save_story_version
+from papyrus_content.publication import ensure_publication_from_environment
+from papyrus_content.editorial_checks import GraphQLEditorialStore, ensure_default_policies
+from papyrus_content.reference_intake import IntakeError, intake_references
+from papyrus_content.publish_alerts import PUBLISHED_TASK_KEY, announce_published
 from papyrus_content.publishing import (
     ItemFields,
     PublishError,
@@ -115,11 +121,17 @@ def projection_context(client):
     return context
 
 
-def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
+def project_item_action(client, item_id: str, *, unpublished: bool, published_item_id: str | None = None) -> dict:
+    """Project one item. ``published_item_id`` is passed only for a real publish: the alert is announced once the page
+    is live, here when the projection succeeds, or by the scheduled retry (which carries the same marker) when it did not."""
     if not projection_configured():
+        if published_item_id:
+            announce_published(item_id, published_item_id)
         return {}
     liveness = {} if unpublished else {"live": False}
     task = {"task": "item", "itemId": item_id, "unpublished": unpublished}
+    if published_item_id:
+        task[PUBLISHED_TASK_KEY] = {"publishedItemId": published_item_id}
     try:
         report = project(projection_context(client), item_id, unpublished=unpublished)
     except Exception as error:  # noqa: BLE001 - a projection failure never fails the save
@@ -141,6 +153,8 @@ def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
         schedule_unpurged_invalidation(report.unpurged)
     if report.follow_up_item_pages:
         schedule_projection_task({"task": "item-pages", "exceptItemId": item_id}, "follow-up")
+    if report.ok and published_item_id:
+        announce_published(item_id, published_item_id)
     return response
 
 
@@ -148,8 +162,19 @@ def schedule_unpurged_invalidation(keys: list[str]) -> None:
     schedule_projection_task({"task": "invalidate", "keys": keys}, "edge invalidation failed")
 
 
+def ensure_default_editorial_policies(client) -> None:
+    """A deployed site starts with working editorial policies. Never fails the deploy: a problem is logged."""
+    try:
+        result = ensure_default_policies(GraphQLEditorialStore(execute=client.graphql))
+        print(json.dumps({"defaultEditorialPolicies": result}))
+    except Exception as error:
+        print(json.dumps({"defaultEditorialPoliciesError": str(error)[:500]}))
+
+
 def run_deploy_render_task(client) -> dict:
     """Render every published page after a backend deploy, then report drift (a dry run: nothing is deleted)."""
+    ensure_publication_from_environment(client)
+    ensure_default_editorial_policies(client)
     context = projection_context(client)
     report = deploy_render(context)
     print(drift_metric_line(report))
@@ -162,6 +187,13 @@ def run_deploy_render_task(client) -> dict:
 
 def run_projection_task(task: dict) -> dict:
     """An asynchronous projection task. Raising makes Lambda retry it, then send the event to the dead letter queue."""
+    try:
+        return _run_projection_task(task)
+    except ProjectionLeaseHeld as held:  # another projection of this publication outlasted the wait: retry later
+        raise ProjectionTaskFailed(str(held)) from held
+
+
+def _run_projection_task(task: dict) -> dict:
     client, _claims = create_authoring_client()
     if task.get("task") == "item-pages":
         report = project_item_pages(projection_context(client), except_item_id=task.get("exceptItemId"))
@@ -173,6 +205,8 @@ def run_projection_task(task: dict) -> dict:
         report = project_all(projection_context(client))
     elif task.get("task") == "deploy-render":
         return run_deploy_render_task(client)
+    elif task.get("task") == READER_SNAPSHOT_TASK:
+        return run_reader_snapshot(projection_context(client), client, poll_retirements=task.get("retirementPoll") is True).to_dict()
     elif task.get("task") == "invalidate":
         invalidate = projection_context(client).invalidate
         if invalidate is None:
@@ -184,6 +218,10 @@ def run_projection_task(task: dict) -> dict:
         schedule_unpurged_invalidation(report.unpurged)
     if not report.ok:
         raise ProjectionTaskFailed("; ".join(report.errors))
+    published = task.get(PUBLISHED_TASK_KEY)
+    if task.get("task") == "item" and not task.get("unpublished") and isinstance(published, dict):
+        # A real publish (the CLI marks it, as does the newsroom's retry): the page is live, so tell the newsletter.
+        announce_published(task["itemId"], published.get("publishedItemId"))
     return {"ok": True, "paths": [*report.written, *report.deleted]}
 
 
@@ -269,7 +307,9 @@ def publish_item_action(arguments: dict, actor: str) -> dict:
     }
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
-    response.update(project_item_action(client, arguments["id"], unpublished=False))
+    response.update(
+        project_item_action(client, arguments["id"], unpublished=False, published_item_id=result.published_item_id if result.changed else None)
+    )
     return response
 
 
@@ -283,6 +323,17 @@ def unpublish_item_action(arguments: dict, actor: str) -> dict:
     return response
 
 
+def move_story_stage_action(arguments: dict, actor: str) -> dict:
+    from papyrus_content.story_reporting import move_story_stage
+
+    client, _claims = create_authoring_client()
+    try:
+        result = move_story_stage(client, arguments["lineageId"], arguments["stage"], actor=actor, reason=arguments.get("reason"))
+    except ValueError as error:
+        return {"ok": False, "errors": [{"code": "invalid-stage", "message": str(error), "line": None}]}
+    return {"ok": True, **result}
+
+
 def request_staging_build_action() -> dict:
     cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
     if not cms_app_id:
@@ -299,12 +350,20 @@ def handler(event, context):
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)
     try:
+        if field == "intakePendingReferences":
+            client, _claims = create_authoring_client()
+            try:
+                return intake_references(client, arguments, event.get("identity") or {})
+            except IntakeError as error:
+                return {"ok": False, "errors": [{"code": "intake-rejected", "message": str(error)}]}
         if field == "deriveMarkus":
             return derive_markus_action(arguments)
         if field == "saveItemDraft":
             return save_item_draft_action(arguments, actor)
         if field == "publishItem":
             return publish_item_action(arguments, actor)
+        if field == "moveStoryStage":
+            return move_story_stage_action(arguments, actor)
         if field == "unpublishItem":
             return unpublish_item_action(arguments, actor)
         if field == "requestStagingBuild":

package/amplify/functions/content-actions/requirements.txt

@@ -3,3 +3,4 @@ citeproc-py>=0.8.2,<1
 anthus-markus==0.7.0
 Pillow>=11.3,<12
 awscrt>=0.23,<1
+humanus>=0.33,<0.34

package/amplify/functions/content-actions/resource.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1", "humanus>=0.33,<0.34"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/functions/content-actions/resource.ts

@@ -10,7 +10,7 @@ import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1", "humanus>=0.33,<0.34"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/handler.py

@@ -1,14 +1,14 @@
-"""The editorial-checks plugin's function: routes its GraphQL fields to papyrus_content.editorial_checks."""
+"""The editorial-checks function: routes its GraphQL fields to papyrus_content.editorial_checks."""
 
 from __future__ import annotations
 
 from typing import Any
 
-from papyrus_content.editorial_checks import GraphQLEditorialStore, Services, handle, load_provider_keys
+from papyrus_content.editorial_checks import GraphQLEditorialStore, Services, event_field_name, handle, load_provider_keys
 
 # Amplify passes secrets to Python functions as placeholders; resolve them once per cold start.
 load_provider_keys()
 
 
 def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
-    return handle(event["info"]["fieldName"], event.get("arguments") or {}, Services(store=GraphQLEditorialStore()))
+    return handle(event_field_name(event), event.get("arguments") or {}, Services(store=GraphQLEditorialStore()))

package/amplify/functions/editorial-checks/requirements.txt

@@ -0,0 +1 @@
+humanus[jev]>=0.33,<0.34

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/resource.js

@@ -4,12 +4,12 @@ import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../../../functions/shared/python-bundle.js";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
 const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
-/** AppSync gives a resolver 30 seconds; Limatus's classifier deadline (settings, default 20 s) keeps a check inside this. */
+/** AppSync gives a resolver 30 seconds; Humanus's classifier deadline (settings, default 20 s) keeps a check inside this. */
 export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
-/** Limatus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
-export const editorialChecksRequirements = ["limatus[jev]>=0.31,<0.32"];
+/** Humanus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
+export const editorialChecksRequirements = ["humanus[jev]>=0.33,<0.34"];
 function installRequirements(outputDir) {
     execFileSync("python3", [
         "-m", "pip", "install", "-r", path.join(functionDirectory, "requirements.txt"), "-t", outputDir, "--no-cache-dir",
@@ -24,7 +24,7 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
     timeout: Duration.seconds(EDITORIAL_CHECKS_TIMEOUT_SECONDS),
     memorySize: 1024,
     code: pythonLambdaCode({
-        functionDir: "../plugins/editorial-checks/function",
+        functionDir: "editorial-checks",
         modules: ["papyrus_content"],
         requirements: editorialChecksRequirements,
         noDeps: true,
@@ -35,9 +35,9 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
         [
             "set -euo pipefail",
             "mkdir -p /asset-output/papyrus_content",
-            "cp amplify/plugins/editorial-checks/function/handler.py /asset-output/handler.py",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
             "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
-            "python3 -m pip install -r amplify/plugins/editorial-checks/function/requirements.txt -t /asset-output --no-cache-dir",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
         ].join(" && "),
     ]),
 }), { resourceGroupName: "data" });