@anthusai/papyrus 3.3.0 → 4.0.0

package/amplify/data/schema.js

@@ -1,6 +1,7 @@
 import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
+import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
@@ -1993,6 +1994,7 @@ const baseDefinitions = {
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
     ]),
+    ...editorialChecksSchemaDefinitions,
 };
 export const schema = a.schema(baseDefinitions).authorization((allow) => [
     allow.resource(assignmentAction).to(["query", "mutate"]),

package/amplify/data/schema.ts

@@ -1,6 +1,7 @@
 import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
+import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
@@ -2112,6 +2113,7 @@ const baseDefinitions = {
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
     ]),
+  ...editorialChecksSchemaDefinitions,
 };
 
 export const schema = a.schema(baseDefinitions).authorization((allow) => [

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/handler.py

@@ -1,4 +1,4 @@
-"""The editorial-checks plugin's function: routes its GraphQL fields to papyrus_content.editorial_checks."""
+"""The editorial-checks function: routes its GraphQL fields to papyrus_content.editorial_checks."""
 
 from __future__ import annotations
 

package/amplify/functions/editorial-checks/requirements.txt

@@ -0,0 +1 @@
+limatus[jev]>=0.32,<0.33

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/resource.js

@@ -4,12 +4,12 @@ import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../../../functions/shared/python-bundle.js";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
 const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
 /** AppSync gives a resolver 30 seconds; Limatus's classifier deadline (settings, default 20 s) keeps a check inside this. */
 export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
 /** Limatus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
-export const editorialChecksRequirements = ["limatus[jev]>=0.31,<0.32"];
+export const editorialChecksRequirements = ["limatus[jev]>=0.32,<0.33"];
 function installRequirements(outputDir) {
     execFileSync("python3", [
         "-m", "pip", "install", "-r", path.join(functionDirectory, "requirements.txt"), "-t", outputDir, "--no-cache-dir",
@@ -24,7 +24,7 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
     timeout: Duration.seconds(EDITORIAL_CHECKS_TIMEOUT_SECONDS),
     memorySize: 1024,
     code: pythonLambdaCode({
-        functionDir: "../plugins/editorial-checks/function",
+        functionDir: "editorial-checks",
         modules: ["papyrus_content"],
         requirements: editorialChecksRequirements,
         noDeps: true,
@@ -35,9 +35,9 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
         [
             "set -euo pipefail",
             "mkdir -p /asset-output/papyrus_content",
-            "cp amplify/plugins/editorial-checks/function/handler.py /asset-output/handler.py",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
             "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
-            "python3 -m pip install -r amplify/plugins/editorial-checks/function/requirements.txt -t /asset-output --no-cache-dir",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
         ].join(" && "),
     ]),
 }), { resourceGroupName: "data" });

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/resource.ts

@@ -5,7 +5,7 @@ import type { Construct } from "constructs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../../../functions/shared/python-bundle";
+import { pythonLambdaCode } from "../shared/python-bundle";
 
 const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
 
@@ -13,7 +13,7 @@ const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
 export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
 
 /** Limatus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
-export const editorialChecksRequirements = ["limatus[jev]>=0.31,<0.32"];
+export const editorialChecksRequirements = ["limatus[jev]>=0.32,<0.33"];
 
 function installRequirements(outputDir: string): void {
   execFileSync(
@@ -37,7 +37,7 @@ export const editorialChecks = defineFunction(
       memorySize: 1024,
       code: pythonLambdaCode(
         {
-          functionDir: "../plugins/editorial-checks/function",
+          functionDir: "editorial-checks",
           modules: ["papyrus_content"],
           requirements: editorialChecksRequirements,
           noDeps: true,
@@ -49,9 +49,9 @@ export const editorialChecks = defineFunction(
           [
             "set -euo pipefail",
             "mkdir -p /asset-output/papyrus_content",
-            "cp amplify/plugins/editorial-checks/function/handler.py /asset-output/handler.py",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
             "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
-            "python3 -m pip install -r amplify/plugins/editorial-checks/function/requirements.txt -t /asset-output --no-cache-dir",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
           ].join(" && "),
         ],
       ),

package/amplify/functions/editorial-checks/schema.js

@@ -0,0 +1,92 @@
+import { a } from "@aws-amplify/backend";
+import { editorialChecks } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Limatus checks
+ * content against them. Editors read policies and record decisions; admins
+ * manage policies and settings. Only the function (IAM) calls Limatus.
+ */
+export const editorialChecksSchemaDefinitions = {
+    EditorialPolicy: a
+        .model({
+        id: a.id().required(),
+        policyKey: a.string().required(),
+        scope: a.string().required(),
+        version: a.integer().required(),
+        title: a.string().required(),
+        guidance: a.string().required(),
+        severity: a.string().required(),
+        enabled: a.boolean().required(),
+        detectors: a.json().required(),
+        examples: a.json(),
+        rewriteGuidance: a.string(),
+        source: a.string().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialCheckSettings: a
+        .model({
+        id: a.id().required(),
+        settings: a.json().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialFeedback: a
+        .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        findingId: a.string().required(),
+        policyId: a.string().required(),
+        detectorId: a.string().required(),
+        lane: a.string().required(),
+        probability: a.float(),
+        decision: a.string().required(),
+        reason: a.string(),
+        text: a.string(),
+    })
+        .disableOperations(["subscriptions"])
+        .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
+        .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
+    checkEditorial: a
+        .query()
+        .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    suggestEditorialRewrite: a
+        .query()
+        .arguments({
+        body: a.string().required(),
+        format: a.string(),
+        section: a.string(),
+        finding: a.json(),
+        selection: a.json(),
+        note: a.string(),
+    })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    draftEditorialQuestions: a
+        .query()
+        .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    tryEditorialPolicy: a
+        .query()
+        .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    importEditorialStarterPack: a
+        .mutation()
+        .arguments({ name: a.string().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    recalibrateEditorialPolicies: a
+        .mutation()
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+};

package/amplify/{plugins → functions}/editorial-checks/schema.ts

@@ -1,15 +1,14 @@
 import { a } from "@aws-amplify/backend";
-import { editorialChecks } from "./function/resource";
+import { editorialChecks } from "./resource";
 
 const editors = ["editor", "admin"];
 
 /**
- * Policies, settings and editors' decisions live in Papyrus; Limatus checks
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Limatus checks
  * content against them. Editors read policies and record decisions; admins
  * manage policies and settings. Only the function (IAM) calls Limatus.
  */
-export function editorialChecksSchemaDefinitions() {
-  return {
+export const editorialChecksSchemaDefinitions = {
     EditorialPolicy: a
       .model({
         id: a.id().required(),
@@ -93,4 +92,3 @@ export function editorialChecksSchemaDefinitions() {
       .authorization((allow) => [allow.group("admin")])
       .handler(a.handler.function(editorialChecks)),
   };
-}

package/amplify/functions/editorial-checks/wire.js

@@ -0,0 +1,49 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+    "Query/fields/listKnowledgeCorporaByRoleAndName",
+    "Query/fields/getEditorialContext",
+    "Query/fields/listEditorialPolicies",
+    "Query/fields/getEditorialCheckSettings",
+    "Query/fields/listEditorialFeedbacks",
+    "Mutation/fields/createEditorialPolicy",
+    "Mutation/fields/updateEditorialPolicy",
+];
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region, account, appId) {
+    const arn = (path) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+    return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+        arn(`papyrus/*/${name}`),
+        arn(`shared/papyrus/${name}`),
+        ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+    ]);
+}
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend) {
+    const lambda = backend.editorialChecks.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    for (const name of EDITORIAL_CHECKS_SECRETS)
+        backend.editorialChecks.addEnvironment(name, secret(name));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter", "ssm:GetParameters"],
+        resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }));
+    const apiId = backend.data.resources.graphqlApi.apiId;
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }));
+}

package/amplify/functions/editorial-checks/wire.ts

@@ -0,0 +1,57 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+  "Query/fields/listKnowledgeCorporaByRoleAndName",
+  "Query/fields/getEditorialContext",
+  "Query/fields/listEditorialPolicies",
+  "Query/fields/getEditorialCheckSettings",
+  "Query/fields/listEditorialFeedbacks",
+  "Mutation/fields/createEditorialPolicy",
+  "Mutation/fields/updateEditorialPolicy",
+];
+
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region: string, account: string, appId: string): string[] {
+  const arn = (path: string) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+  return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+    arn(`papyrus/*/${name}`),
+    arn(`shared/papyrus/${name}`),
+    ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+  ]);
+}
+
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend: any): void {
+  const lambda = backend.editorialChecks.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  for (const name of EDITORIAL_CHECKS_SECRETS) backend.editorialChecks.addEnvironment(name, secret(name));
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter", "ssm:GetParameters"],
+      resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }),
+  );
+  const apiId = backend.data.resources.graphqlApi.apiId as string;
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }),
+  );
+}

package/amplify/plugins/registry.js

@@ -1,8 +1,6 @@
-import { editorialChecksPlugin } from "./editorial-checks/papyrus.plugin.js";
 import { signupPlugin } from "./signup/papyrus.plugin.js";
 /** Plugins are packaged with Papyrus and pinned by its version: there is no registry to fetch from. */
 export const KNOWN_PLUGINS = {
-    "editorial-checks": editorialChecksPlugin,
     signup: signupPlugin,
 };
 export function resolvePlugins(requests) {

package/amplify/plugins/registry.ts

@@ -1,10 +1,8 @@
 import type { PapyrusPlugin, PluginRequest } from "./types";
-import { editorialChecksPlugin } from "./editorial-checks/papyrus.plugin";
 import { signupPlugin } from "./signup/papyrus.plugin";
 
 /** Plugins are packaged with Papyrus and pinned by its version: there is no registry to fetch from. */
 export const KNOWN_PLUGINS: Record<string, PapyrusPlugin<any, any>> = {
-  "editorial-checks": editorialChecksPlugin,
   signup: signupPlugin,
 };
 

package/amplify/site-backend.js

@@ -20,6 +20,8 @@ import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
+import { editorialChecks } from "./functions/editorial-checks/resource.js";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
@@ -89,6 +91,7 @@ export function defineSiteBackend(papyrusSite) {
         auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
+        editorialChecks,
         data: defineSiteData(pluginDefinitions),
         knowledgeQuery,
         manageUserRole,
@@ -589,6 +592,7 @@ export function defineSiteBackend(papyrusSite) {
                 : null,
         },
     });
+    wireEditorialChecks(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }

package/amplify/site-backend.ts

@@ -27,6 +27,8 @@ import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
+import { editorialChecks } from "./functions/editorial-checks/resource";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
 import { assignmentAction } from "./functions/assignment-action/resource";
@@ -110,6 +112,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
+    editorialChecks,
     data: defineSiteData(pluginDefinitions),
     knowledgeQuery,
     manageUserRole,
@@ -732,6 +735,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         : null,
     },
   });
+  wireEditorialChecks(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 
   return backend;

package/components/editorial-checks-admin-panel.tsx

@@ -21,7 +21,11 @@ import {
   type EditorialSettings,
 } from "../lib/editorial-checks-client";
 
-const STARTER_PACK = "ai-writing-tells";
+const STARTER_PACKS = [
+  { name: "ai-writing-tells", label: "AI-writing tells" },
+  { name: "plain-language", label: "Federal Plain Language Guidelines" },
+  { name: "asd-ste100", label: "ASD-STE100 Simplified Technical English" },
+] as const;
 const POLICY_KEY = /^[a-z0-9][a-z0-9._-]*$/;
 
 type Draft = {
@@ -87,6 +91,7 @@ export function EditorialChecksAdminPanel() {
   const [settings, setSettings] = useState<EditorialSettings>(DEFAULT_EDITORIAL_SETTINGS);
   const [settingsExist, setSettingsExist] = useState(false);
   const [draft, setDraft] = useState<Draft | null>(null);
+  const [starterPack, setStarterPack] = useState<string>(STARTER_PACKS[0].name);
   const [message, setMessage] = useState<string | null>(null);
   const [working, setWorking] = useState<string | null>(null);
   const [tryText, setTryText] = useState("");
@@ -157,18 +162,22 @@ export function EditorialChecksAdminPanel() {
       <h4>Policies</h4>
       <div className="flex flex-wrap gap-2">
         <Button onClick={() => { setDraft(draftFrom(emptyPolicy(), true)); setTryResult(null); }} size="sm" type="button">New policy</Button>
+        <select aria-label="Starter pack" onChange={(event) => setStarterPack(event.target.value)} value={starterPack}>
+          {STARTER_PACKS.map((pack) => <option key={pack.name} value={pack.name}>{pack.label}</option>)}
+        </select>
         <Button
           disabled={working !== null}
           onClick={() => run("import", async () => {
-            const outcome = await importStarterPack(STARTER_PACK);
+            const outcome = await importStarterPack(starterPack);
             await refresh();
-            return `Starter pack: ${outcome.created} policies added, ${outcome.skipped} already present.`;
+            const label = STARTER_PACKS.find((pack) => pack.name === starterPack)?.label ?? starterPack;
+            return `${label}: ${outcome.created} policies added, ${outcome.skipped} already present.`;
           })}
           size="sm"
           type="button"
           variant="outline"
         >
-          Add AI-writing tells starter pack
+          Add starter pack
         </Button>
         <Button
           disabled={working !== null}
@@ -320,6 +329,7 @@ export function EditorialChecksAdminPanel() {
           });
         }}
       >
+        <label><input checked={settings.enabled} data-editorial-enabled onChange={(event) => setSettings({ ...settings, enabled: event.target.checked })} type="checkbox" /> Run editorial checks for this publication (turning this off stops checks and rewrites; policies are kept)</label>
         <label><input checked={settings.lanes.rules} onChange={(event) => setSettings({ ...settings, lanes: { ...settings.lanes, rules: event.target.checked } })} type="checkbox" /> Rule checks</label>
         <label><input checked={settings.lanes.classifier} onChange={(event) => setSettings({ ...settings, lanes: { ...settings.lanes, classifier: event.target.checked } })} type="checkbox" /> Judgment checks (decision model)</label>
         <label><input checked={settings.checkWhileTyping} onChange={(event) => setSettings({ ...settings, checkWhileTyping: event.target.checked })} type="checkbox" /> Check while editors type (after a short pause)</label>

package/components/newsroom-article-editor.tsx

@@ -48,11 +48,9 @@ import {
 import { getNewsroomNavHref } from "../lib/newsroom-nav";
 import { SITE_BRAND } from "../lib/site-brand";
 import { cn } from "../lib/utils";
-import amplifyOutputs from "papyrus-amplify-outputs";
-import { applyReplacement, editorialChecksEnabled, inlineFindings, visibleFindings } from "../lib/editorial-checks";
+import { applyReplacement, inlineFindings, visibleFindings } from "../lib/editorial-checks";
 import { graphqlEditorialBackend } from "../lib/editorial-checks-client";
 import { demoEditorialBackend } from "../lib/editorial-checks-demo";
-import type { PluginOutputs } from "../lib/plugin-settings";
 import type { FindingActions } from "./editorial-finding-card";
 import { EditorialFindingsPanel } from "./editorial-findings-panel";
 import { EditorialPreviewPopover, type PreviewPopoverTarget } from "./editorial-preview-popover";
@@ -219,7 +217,7 @@ export function NewsroomArticleEditor({ articleId, demo, embedded = false }: { a
   const frontMatterYaml = editor?.frontMatterYaml ?? null;
   const bodyMarkus = editor?.bodyMarkus ?? null;
   const editorialBackend = useMemo(
-    () => (demo ? demoEditorialBackend : !previewMode && editorialChecksEnabled(amplifyOutputs as PluginOutputs) ? graphqlEditorialBackend : null),
+    () => (demo ? demoEditorialBackend : !previewMode ? graphqlEditorialBackend : null),
     [demo, previewMode],
   );
   const editorial = useEditorialChecks({

package/components/topic-steering-workspace.tsx

@@ -4318,17 +4318,15 @@ function AdministrationDeskView({
                 <strong>Agent delegations</strong>
                 <span>Let an agent curate References for you</span>
               </Link>
-              {editorialChecksPluginEnabled() ? (
-                <Link
-                  href={administrationPanelHref("editorial-checks", isDemo)}
-                  data-news-desk-admin-nav="editorial-checks"
-                  data-active={administrationPanel === "editorial-checks" || undefined}
-                  onClick={() => onPanelChange("editorial-checks")}
-                >
-                  <strong>Editorial checks</strong>
-                  <span>Policies the article editor checks drafts against</span>
-                </Link>
-              ) : null}
+              <Link
+                href={administrationPanelHref("editorial-checks", isDemo)}
+                data-news-desk-admin-nav="editorial-checks"
+                data-active={administrationPanel === "editorial-checks" || undefined}
+                onClick={() => onPanelChange("editorial-checks")}
+              >
+                <strong>Editorial checks</strong>
+                <span>Policies the article editor checks drafts against</span>
+              </Link>
               {signupPluginEnabled() ? (
                 <Link
                   href={administrationPanelHref("signups", isDemo)}
@@ -12807,14 +12805,9 @@ function signupPluginEnabled(): boolean {
   return pluginSettings(amplifyOutputs as PluginOutputs, "signup") !== null;
 }
 
-function editorialChecksPluginEnabled(): boolean {
-  return pluginSettings(amplifyOutputs as PluginOutputs, "editorial-checks") !== null;
-}
-
 function normalizeAdministrationPanel(value: string | null | undefined): AdministrationPanel {
-  if (value === "policies" || value === "sections" || value === "procedures" || value === "delegations") return value;
+  if (value === "policies" || value === "sections" || value === "procedures" || value === "delegations" || value === "editorial-checks") return value;
   if (value === "signups" && signupPluginEnabled()) return value;
-  if (value === "editorial-checks" && editorialChecksPluginEnabled()) return value;
   return "users";
 }
 

package/components/use-editorial-checks.ts

@@ -27,14 +27,16 @@ export function useEditorialChecks({
   section,
   itemId,
 }: {
-  /** null turns editorial checks off. */
+  /** null when there is no backend to check against (a preview). Whether a publication runs checks is its stored setting. */
   backend: EditorialChecksBackend | null;
   body: string | null;
   section: string;
   itemId: string | null;
 }) {
-  const enabled = backend !== null;
+  const available = backend !== null;
   const [settings, setSettings] = useState<EditorialSettings>(DEFAULT_EDITORIAL_SETTINGS);
+  const [settingsLoaded, setSettingsLoaded] = useState(false);
+  const enabled = available && settings.enabled;
   const [result, setResult] = useState<EditorialCheckResult | null>(null);
   const [checkedBody, setCheckedBody] = useState<string | null>(null);
   const [status, setStatus] = useState<CheckStatus>({ state: "idle" });
@@ -46,9 +48,9 @@ export function useEditorialChecks({
   const sequence = useRef(0);
 
   useEffect(() => {
-    if (!enabled) return;
-    backend?.loadSettings().then(({ settings: loaded }) => setSettings(loaded)).catch(() => undefined);
-  }, [backend, enabled]);
+    if (!available) return;
+    backend?.loadSettings().then(({ settings: loaded }) => setSettings(loaded)).catch(() => undefined).finally(() => setSettingsLoaded(true));
+  }, [available, backend]);
 
   useEffect(() => {
     if (!enabled || !itemId) return;
@@ -57,7 +59,7 @@ export function useEditorialChecks({
 
   const check = useCallback(async () => {
     const text = latestBody.current;
-    if (!backend || text === null || !text.trim()) return;
+    if (!backend || !enabled || text === null || !text.trim()) return;
     const run = ++sequence.current;
     setStatus({ state: "checking" });
     try {
@@ -73,13 +75,13 @@ export function useEditorialChecks({
     } catch (error) {
       if (run === sequence.current) setStatus({ state: "error", message: error instanceof Error ? error.message : "The check failed." });
     }
-  }, [backend, section]);
+  }, [backend, enabled, section]);
 
   useEffect(() => {
-    if (!enabled || !settings.checkWhileTyping || body === null || body === checkedBody) return;
+    if (!enabled || !settingsLoaded || !settings.checkWhileTyping || body === null || body === checkedBody) return;
     const timer = window.setTimeout(() => void check(), CHECK_PAUSE_MS);
     return () => window.clearTimeout(timer);
-  }, [body, check, checkedBody, enabled, settings.checkWhileTyping]);
+  }, [body, check, checkedBody, enabled, settings.checkWhileTyping, settingsLoaded]);
 
   const record = useCallback(
     (finding: EditorialFinding, decision: FeedbackDecision, reason: string | null = null) => {
@@ -105,7 +107,7 @@ export function useEditorialChecks({
     [backend, section],
   );
 
-  const current = result && checkedBody === body;
+  const current = enabled && result && checkedBody === body;
   return {
     enabled,
     settings,

package/lib/editorial-checks-backend.ts

@@ -1,7 +1,7 @@
 import type { EditorialCheckResult, EditorialFeedbackInput, EditorialFinding, RewriteResult, Span } from "./editorial-checks";
 import type { EditorialSettings } from "./editorial-checks-settings";
 
-/** What the article editor needs from editorial checks: the plugin's GraphQL API, or the demo. */
+/** What the article editor needs from editorial checks: the site's GraphQL API, or the demo. */
 export type EditorialChecksBackend = {
   loadSettings: () => Promise<{ settings: EditorialSettings; exists: boolean }>;
   dismissedFindingIds: (itemId: string) => Promise<Set<string>>;

package/lib/editorial-checks-client.ts

@@ -184,7 +184,7 @@ export async function recalibrate(): Promise<{ updated: number; detectors: { pol
   return parsed(data.recalibrateEditorialPolicies);
 }
 
-/** The plugin's GraphQL API, signed in as the editor. */
+/** The site's GraphQL API, signed in as the editor. */
 export const graphqlEditorialBackend: EditorialChecksBackend = {
   loadSettings,
   dismissedFindingIds,

package/lib/editorial-checks-demo.ts

@@ -1,7 +1,7 @@
 /**
  * Demo-mode editorial checks: no backend, a few stock phrases, canned rewrites.
  * The shapes match Limatus results so the editor, the preview marks and the
- * rewrite flow behave as they do against the real plugin.
+ * rewrite flow behave as they do against the real backend.
  */
 import type { EditorialCheckResult, EditorialFinding, EditorialSegment, RewriteResult, Span } from "./editorial-checks";
 import type { EditorialChecksBackend } from "./editorial-checks-backend";

package/lib/editorial-checks-settings.ts

@@ -1,5 +1,7 @@
 /** Runtime settings for editorial checks, stored in EditorialCheckSettings (id "settings"). */
 export type EditorialSettings = {
+  /** Core to every site and on by default; a publication turns its checks off here. */
+  enabled: boolean;
   lanes: { rules: boolean; classifier: boolean };
   classifierModel: string;
   rewriteModel: string;
@@ -12,6 +14,7 @@ export type EditorialSettings = {
 };
 
 export const DEFAULT_EDITORIAL_SETTINGS: EditorialSettings = {
+  enabled: true,
   lanes: { rules: true, classifier: true },
   classifierModel: "jev-latest",
   rewriteModel: "gpt-6-luna",

package/lib/editorial-checks.ts

@@ -3,9 +3,6 @@
  * over them. Limatus counts offsets in UTF-16 code units, which is exactly how
  * JavaScript indexes strings, so spans apply to the body text as they are.
  */
-import { pluginSettings, type PluginOutputs } from "./plugin-settings";
-
-export const EDITORIAL_CHECKS_PLUGIN = "editorial-checks";
 
 export type Span = { start: number; end: number };
 export type Severity = "info" | "warn" | "error";
@@ -91,10 +88,6 @@ export const UNSAVED_ITEM_ID = "unsaved";
 
 const SEVERITY_ORDER: Record<Severity, number> = { error: 0, warn: 1, info: 2 };
 
-export function editorialChecksEnabled(outputs: PluginOutputs | null | undefined): boolean {
-  return pluginSettings(outputs, EDITORIAL_CHECKS_PLUGIN) !== null;
-}
-
 /** Findings worth showing: not dismissed, not covering the whole document, most severe first, then in reading order. */
 export function visibleFindings(findings: EditorialFinding[], dismissed: ReadonlySet<string>): EditorialFinding[] {
   return findings

package/package.json

@@ -395,7 +395,7 @@
       "optional": true
     }
   },
-  "version": "3.3.0",
+  "version": "4.0.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.3.0",
+  "version": "4.0.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",

package/amplify/plugins/editorial-checks/function/requirements.txt

@@ -1 +0,0 @@
-limatus[jev]>=0.31,<0.32

package/amplify/plugins/editorial-checks/papyrus.plugin.js

@@ -1,71 +0,0 @@
-import { secret } from "@aws-amplify/backend";
-import { Stack } from "aws-cdk-lib";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { editorialChecks } from "./function/resource.js";
-import { editorialChecksSchemaDefinitions } from "./schema.js";
-export const EDITORIAL_CHECKS_QUERIES = ["checkEditorial", "suggestEditorialRewrite", "draftEditorialQuestions", "tryEditorialPolicy"];
-export const EDITORIAL_CHECKS_MUTATIONS = ["importEditorialStarterPack", "recalibrateEditorialPolicies"];
-/** The model operations the function performs with its own role. */
-export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
-    "Query/fields/listKnowledgeCorporaByRoleAndName",
-    "Query/fields/getEditorialContext",
-    "Query/fields/listEditorialPolicies",
-    "Query/fields/getEditorialCheckSettings",
-    "Query/fields/listEditorialFeedbacks",
-    "Mutation/fields/createEditorialPolicy",
-    "Mutation/fields/updateEditorialPolicy",
-];
-export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
-/**
- * SSM parameters holding the provider keys. A Python function reads its secret()
- * values itself (Amplify only resolves them for Node functions), so it needs read
- * access to the app's branch and shared secret paths, and to the sandbox paths.
- */
-export function editorialChecksSecretParameters(region, account, appId) {
-    const arn = (path) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
-    return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
-        arn(`papyrus/*/${name}`),
-        arn(`shared/papyrus/${name}`),
-        ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
-    ]);
-}
-export const editorialChecksManifest = {
-    name: "editorial-checks",
-    contract: 1,
-    models: ["EditorialPolicy", "EditorialCheckSettings", "EditorialFeedback"],
-    mutations: [...EDITORIAL_CHECKS_QUERIES, ...EDITORIAL_CHECKS_MUTATIONS],
-    guest: { mutations: [] },
-    newsroomPanels: [{ id: "editorial-checks", label: "Editorial checks" }],
-    staticAssets: [],
-};
-export function resolveEditorialChecksConfig(request) {
-    const raw = typeof request === "string" ? { name: request } : request;
-    const unknown = Object.keys(raw).filter((key) => key !== "name");
-    if (unknown.length > 0)
-        throw new Error(`Unknown editorial-checks plugin settings: ${unknown.join(", ")} (runtime settings are edited in the newsroom)`);
-    return {};
-}
-export const editorialChecksPlugin = {
-    manifest: editorialChecksManifest,
-    resolveConfig: resolveEditorialChecksConfig,
-    functions: () => ({ editorialChecks }),
-    schemaDefinitions: editorialChecksSchemaDefinitions,
-    publicSettings: () => ({ contract: editorialChecksManifest.contract }),
-    wire(backend, _config, context) {
-        const lambda = backend.editorialChecks.resources.lambda;
-        const stack = Stack.of(lambda);
-        lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
-        for (const name of EDITORIAL_CHECKS_SECRETS)
-            backend.editorialChecks.addEnvironment(name, secret(name));
-        lambda.addToRolePolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: ["ssm:GetParameter", "ssm:GetParameters"],
-            resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
-        }));
-        lambda.addToRolePolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: ["appsync:GraphQL"],
-            resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/${field}`),
-        }));
-    },
-};

package/amplify/plugins/editorial-checks/papyrus.plugin.ts

@@ -1,87 +0,0 @@
-import { secret } from "@aws-amplify/backend";
-import { Stack } from "aws-cdk-lib";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
-import type { PapyrusPlugin, PluginManifest, PluginRequest, PluginWiringContext } from "../types";
-import { editorialChecks } from "./function/resource";
-import { editorialChecksSchemaDefinitions } from "./schema";
-
-/** Runtime settings (lanes, models, deadline) live in EditorialCheckSettings, edited in the newsroom; enabling the plugin takes no options. */
-export type EditorialChecksPluginConfig = Record<string, never>;
-
-export const EDITORIAL_CHECKS_QUERIES = ["checkEditorial", "suggestEditorialRewrite", "draftEditorialQuestions", "tryEditorialPolicy"];
-export const EDITORIAL_CHECKS_MUTATIONS = ["importEditorialStarterPack", "recalibrateEditorialPolicies"];
-
-/** The model operations the function performs with its own role. */
-export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
-  "Query/fields/listKnowledgeCorporaByRoleAndName",
-  "Query/fields/getEditorialContext",
-  "Query/fields/listEditorialPolicies",
-  "Query/fields/getEditorialCheckSettings",
-  "Query/fields/listEditorialFeedbacks",
-  "Mutation/fields/createEditorialPolicy",
-  "Mutation/fields/updateEditorialPolicy",
-];
-
-export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
-
-/**
- * SSM parameters holding the provider keys. A Python function reads its secret()
- * values itself (Amplify only resolves them for Node functions), so it needs read
- * access to the app's branch and shared secret paths, and to the sandbox paths.
- */
-export function editorialChecksSecretParameters(region: string, account: string, appId: string): string[] {
-  const arn = (path: string) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
-  return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
-    arn(`papyrus/*/${name}`),
-    arn(`shared/papyrus/${name}`),
-    ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
-  ]);
-}
-
-export const editorialChecksManifest: PluginManifest = {
-  name: "editorial-checks",
-  contract: 1,
-  models: ["EditorialPolicy", "EditorialCheckSettings", "EditorialFeedback"],
-  mutations: [...EDITORIAL_CHECKS_QUERIES, ...EDITORIAL_CHECKS_MUTATIONS],
-  guest: { mutations: [] },
-  newsroomPanels: [{ id: "editorial-checks", label: "Editorial checks" }],
-  staticAssets: [],
-};
-
-export function resolveEditorialChecksConfig(request: PluginRequest): EditorialChecksPluginConfig {
-  const raw = typeof request === "string" ? { name: request } : request;
-  const unknown = Object.keys(raw).filter((key) => key !== "name");
-  if (unknown.length > 0) throw new Error(`Unknown editorial-checks plugin settings: ${unknown.join(", ")} (runtime settings are edited in the newsroom)`);
-  return {};
-}
-
-export const editorialChecksPlugin: PapyrusPlugin<EditorialChecksPluginConfig, { editorialChecks: typeof editorialChecks }> = {
-  manifest: editorialChecksManifest,
-  resolveConfig: resolveEditorialChecksConfig,
-  functions: () => ({ editorialChecks }),
-  schemaDefinitions: editorialChecksSchemaDefinitions,
-  publicSettings: () => ({ contract: editorialChecksManifest.contract }),
-  wire(backend, _config, context: PluginWiringContext) {
-    const lambda = backend.editorialChecks.resources.lambda as LambdaFunction;
-    const stack = Stack.of(lambda);
-    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
-    for (const name of EDITORIAL_CHECKS_SECRETS) backend.editorialChecks.addEnvironment(name, secret(name));
-    lambda.addToRolePolicy(
-      new PolicyStatement({
-        effect: Effect.ALLOW,
-        actions: ["ssm:GetParameter", "ssm:GetParameters"],
-        resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
-      }),
-    );
-    lambda.addToRolePolicy(
-      new PolicyStatement({
-        effect: Effect.ALLOW,
-        actions: ["appsync:GraphQL"],
-        resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map(
-          (field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/${field}`,
-        ),
-      }),
-    );
-  },
-};

package/amplify/plugins/editorial-checks/schema.js

@@ -1,94 +0,0 @@
-import { a } from "@aws-amplify/backend";
-import { editorialChecks } from "./function/resource.js";
-const editors = ["editor", "admin"];
-/**
- * Policies, settings and editors' decisions live in Papyrus; Limatus checks
- * content against them. Editors read policies and record decisions; admins
- * manage policies and settings. Only the function (IAM) calls Limatus.
- */
-export function editorialChecksSchemaDefinitions() {
-    return {
-        EditorialPolicy: a
-            .model({
-            id: a.id().required(),
-            policyKey: a.string().required(),
-            scope: a.string().required(),
-            version: a.integer().required(),
-            title: a.string().required(),
-            guidance: a.string().required(),
-            severity: a.string().required(),
-            enabled: a.boolean().required(),
-            detectors: a.json().required(),
-            examples: a.json(),
-            rewriteGuidance: a.string(),
-            source: a.string().required(),
-        })
-            .disableOperations(["subscriptions"])
-            .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
-        EditorialCheckSettings: a
-            .model({
-            id: a.id().required(),
-            settings: a.json().required(),
-        })
-            .disableOperations(["subscriptions"])
-            .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
-        EditorialFeedback: a
-            .model({
-            id: a.id().required(),
-            itemId: a.string().required(),
-            findingId: a.string().required(),
-            policyId: a.string().required(),
-            detectorId: a.string().required(),
-            lane: a.string().required(),
-            probability: a.float(),
-            decision: a.string().required(),
-            reason: a.string(),
-            text: a.string(),
-        })
-            .disableOperations(["subscriptions"])
-            .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
-            .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
-        checkEditorial: a
-            .query()
-            .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
-            .returns(a.json())
-            .authorization((allow) => [allow.groups(editors)])
-            .handler(a.handler.function(editorialChecks)),
-        suggestEditorialRewrite: a
-            .query()
-            .arguments({
-            body: a.string().required(),
-            format: a.string(),
-            section: a.string(),
-            finding: a.json(),
-            selection: a.json(),
-            note: a.string(),
-        })
-            .returns(a.json())
-            .authorization((allow) => [allow.groups(editors)])
-            .handler(a.handler.function(editorialChecks)),
-        draftEditorialQuestions: a
-            .query()
-            .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-        tryEditorialPolicy: a
-            .query()
-            .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-        importEditorialStarterPack: a
-            .mutation()
-            .arguments({ name: a.string().required() })
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-        recalibrateEditorialPolicies: a
-            .mutation()
-            .returns(a.json())
-            .authorization((allow) => [allow.group("admin")])
-            .handler(a.handler.function(editorialChecks)),
-    };
-}