@anthusai/papyrus 5.30.0 → 5.32.0

package/amplify/data/resource.js

@@ -1163,6 +1163,25 @@ const schema = a.schema({
         allow.group("editor").to(["read"]),
         allow.group(adminGroup).to(authoringOperations),
     ]),
+    Automation: a
+        .model({
+        id: a.id().required(),
+        title: a.string().required(),
+        description: a.string(),
+        enabled: a.boolean().required(),
+        trigger: a.json().required(),
+        procedureKey: a.string().required(),
+        inputTemplate: a.json(),
+        limits: a.json(),
+        createdBy: a.string(),
+        createdAt: a.datetime().required(),
+        updatedBy: a.string(),
+        updatedAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.group("editor").to(["read", "create", "update"]),
+        allow.group(adminGroup).to(authoringOperations),
+    ]),
     NewsroomSection: a
         .model({
         id: a.id().required(),

package/amplify/data/resource.ts

@@ -1259,6 +1259,26 @@ const schema = a.schema({
       allow.group(adminGroup).to(authoringOperations),
     ]),
 
+  Automation: a
+    .model({
+      id: a.id().required(),
+      title: a.string().required(),
+      description: a.string(),
+      enabled: a.boolean().required(),
+      trigger: a.json().required(),
+      procedureKey: a.string().required(),
+      inputTemplate: a.json(),
+      limits: a.json(),
+      createdBy: a.string(),
+      createdAt: a.datetime().required(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
   NewsroomSection: a
     .model({
       id: a.id().required(),

package/amplify/data/schema.js

@@ -2,6 +2,7 @@ import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
+import { automationViewSchemaDefinitions } from "../functions/automation-view/schema.js";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
@@ -1082,6 +1083,25 @@ function buildBaseDefinitions(includeEditions) {
             allow.group("editor").to(["read"]),
             allow.group(adminGroup).to(authoringOperations),
         ]),
+        /** A named "when X happens, run procedure Y" (PPY-9ff95b). Step 1 mirrors the monitoring router's procedureTriggers and starts nothing itself. */
+        Automation: modelWithoutSubscriptions({
+            id: a.id().required(),
+            title: a.string().required(),
+            description: a.string(),
+            enabled: a.boolean().required(),
+            trigger: a.json().required(),
+            procedureKey: a.string().required(),
+            inputTemplate: a.json(),
+            limits: a.json(),
+            createdBy: a.string(),
+            createdAt: a.datetime().required(),
+            updatedBy: a.string(),
+            updatedAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.group("editor").to(["read", "create", "update"]),
+            allow.group(adminGroup).to(authoringOperations),
+        ]),
         NewsroomSection: modelWithoutSubscriptions({
             id: a.id().required(),
             tenantId: a.string(),
@@ -2021,6 +2041,7 @@ function buildBaseDefinitions(includeEditions) {
         ]),
         ...editorialChecksSchemaDefinitions,
         ...monitoringViewSchemaDefinitions,
+        ...automationViewSchemaDefinitions,
     };
     if (!includeEditions) {
         const mutableDefinitions = definitions;

package/amplify/data/schema.ts

@@ -2,6 +2,7 @@ import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
+import { automationViewSchemaDefinitions } from "../functions/automation-view/schema";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
@@ -1176,6 +1177,26 @@ const definitions = {
       allow.group(adminGroup).to(authoringOperations),
     ]),
 
+  /** A named "when X happens, run procedure Y" (PPY-9ff95b). Step 1 mirrors the monitoring router's procedureTriggers and starts nothing itself. */
+  Automation: modelWithoutSubscriptions({
+      id: a.id().required(),
+      title: a.string().required(),
+      description: a.string(),
+      enabled: a.boolean().required(),
+      trigger: a.json().required(),
+      procedureKey: a.string().required(),
+      inputTemplate: a.json(),
+      limits: a.json(),
+      createdBy: a.string(),
+      createdAt: a.datetime().required(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
   NewsroomSection: modelWithoutSubscriptions({
       id: a.id().required(),
       tenantId: a.string(),
@@ -2145,6 +2166,7 @@ const definitions = {
     ]),
   ...editorialChecksSchemaDefinitions,
   ...monitoringViewSchemaDefinitions,
+  ...automationViewSchemaDefinitions,
 };
 if (!includeEditions) {
   const mutableDefinitions = definitions as Record<string, unknown>;

package/amplify/functions/automation-view/handler.py

@@ -0,0 +1,11 @@
+"""The automation-view function: `automationOverview` for editors and admins, read-only."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.automation_view import handle
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    return handle(event)

package/amplify/functions/automation-view/resource.js

@@ -0,0 +1,24 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+/** AppSync gives a resolver 30 seconds; a table read and ten run lookups need a few. */
+export const AUTOMATION_VIEW_TIMEOUT_SECONDS = 25;
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const automationView = defineFunction((scope) => new Function(scope, "papyrus-automation-view", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(AUTOMATION_VIEW_TIMEOUT_SECONDS),
+    memorySize: 256,
+    code: pythonLambdaCode({ functionDir: "automation-view", modules: ["papyrus_content"], noDeps: true }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/automation-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/automation-view/resource.ts

@@ -0,0 +1,34 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+/** AppSync gives a resolver 30 seconds; a table read and ten run lookups need a few. */
+export const AUTOMATION_VIEW_TIMEOUT_SECONDS = 25;
+
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const automationView = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-automation-view", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(AUTOMATION_VIEW_TIMEOUT_SECONDS),
+      memorySize: 256,
+      code: pythonLambdaCode(
+        { functionDir: "automation-view", modules: ["papyrus_content"], noDeps: true },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/automation-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/automation-view/schema.js

@@ -0,0 +1,16 @@
+import { a } from "@aws-amplify/backend";
+import { automationView } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. The Automation page reads the automation records, the monitoring
+ * trigger rows they link to, and the procedure runs through this one query. AppSync admits editors
+ * and admins only; the function checks the groups again.
+ */
+export const automationViewSchemaDefinitions = {
+    automationOverview: a
+        .query()
+        .arguments({ automationId: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(automationView)),
+};

package/amplify/functions/automation-view/schema.ts

@@ -0,0 +1,18 @@
+import { a } from "@aws-amplify/backend";
+import { automationView } from "./resource";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. The Automation page reads the automation records, the monitoring
+ * trigger rows they link to, and the procedure runs through this one query. AppSync admits editors
+ * and admins only; the function checks the groups again.
+ */
+export const automationViewSchemaDefinitions = {
+  automationOverview: a
+    .query()
+    .arguments({ automationId: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(a.handler.function(automationView)),
+};

package/amplify/functions/automation-view/wire.js

@@ -0,0 +1,32 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { MONITORING_TABLE_PARAMETER, MONITORING_VIEW_TABLE_ACTIONS, monitoringViewParameterArn, monitoringViewTableArns, } from "../monitoring-view/wire.js";
+/** The two reads the function makes of its own site's API with its own role. It writes nothing. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = ["Query/fields/listAutomations", "Query/fields/getProcedureRun"];
+/**
+ * Environment and least-privilege IAM for the automation-view function: two fields of the site's own API,
+ * and the same read-only grant on the monitoring table that the Monitoring page has. A site outside the
+ * monitoring account finds no parameter and the page lists its records without runs.
+ */
+export function wireAutomationView(backend) {
+    const lambda = backend.automationView.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    const apiId = backend.data.resources.graphqlApi.apiId;
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: AUTOMATION_VIEW_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account),
+    }));
+}

package/amplify/functions/automation-view/wire.ts

@@ -0,0 +1,46 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import {
+  MONITORING_TABLE_PARAMETER,
+  MONITORING_VIEW_TABLE_ACTIONS,
+  monitoringViewParameterArn,
+  monitoringViewTableArns,
+} from "../monitoring-view/wire";
+
+/** The two reads the function makes of its own site's API with its own role. It writes nothing. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = ["Query/fields/listAutomations", "Query/fields/getProcedureRun"];
+
+/**
+ * Environment and least-privilege IAM for the automation-view function: two fields of the site's own API,
+ * and the same read-only grant on the monitoring table that the Monitoring page has. A site outside the
+ * monitoring account finds no parameter and the page lists its records without runs.
+ */
+export function wireAutomationView(backend: any): void {
+  const lambda = backend.automationView.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  const apiId = backend.data.resources.graphqlApi.apiId as string;
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: AUTOMATION_VIEW_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account),
+    }),
+  );
+}

package/amplify/plugins/reader-steering/config.js

@@ -5,8 +5,9 @@ export const MODERATION_MODES = ["off", "human", "ai"];
 export const AI_KEY_PARAMETER = /^\/papyrus\/[a-z0-9][a-z0-9-]{0,62}\/openai-api-key$/;
 export const AI_MODEL_NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/;
 export const SUBMISSION_KIND_NAME = /^[a-z][a-z0-9-]{0,23}$/;
+export const SUBJECT_TYPES = ["item", "submission", "story", "proposal", "concept"];
 export const COMPUTE_ROLE_ARN = /^arn:aws:iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
 function object(raw, label, known) {
     if (raw === undefined)
         return {};
@@ -111,6 +112,11 @@ export function resolveReaderSteeringConfig(request) {
             throw new Error(`reader-steering plugin moderation.ai.model must be a model name matching ${AI_MODEL_NAME}`);
         }
     }
+    const subjects = object(raw.subjects, "subjects", ["types"]);
+    const subjectTypes = subjects.types === undefined ? ["item", "submission"] : subjects.types;
+    if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => SUBJECT_TYPES.includes(type))) {
+        throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
+    }
     const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
     const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
     const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -154,6 +160,7 @@ export function resolveReaderSteeringConfig(request) {
             itemType: lowercaseName(submissions.itemType, "submissions.itemType", "brief"),
             section: lowercaseName(submissions.section, "submissions.section", "unsectioned"),
         },
+        subjects: { types: [...new Set(subjectTypes)] },
         moderation: {
             mode: mode,
             preModeration,

package/amplify/plugins/reader-steering/config.ts

@@ -7,6 +7,7 @@ export const MODERATION_MODES = ["off", "human", "ai"] as const;
 export const AI_KEY_PARAMETER = /^\/papyrus\/[a-z0-9][a-z0-9-]{0,62}\/openai-api-key$/;
 export const AI_MODEL_NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/;
 export const SUBMISSION_KIND_NAME = /^[a-z][a-z0-9-]{0,23}$/;
+export const SUBJECT_TYPES = ["item", "submission", "story", "proposal", "concept"] as const;
 export const COMPUTE_ROLE_ARN = /^arn:aws:iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
 
 export type ReaderSteeringConfig = {
@@ -63,6 +64,11 @@ export type ReaderSteeringConfig = {
     /** The section of that draft. */
     section: string;
   };
+  /**
+   * The kinds of subject a signed-in reader may vote on and flag, by `{type, id}`. Default: items and submissions, which is
+   * what readers could vote on before subject types existed. `story`, `proposal` and `concept` are opt-in.
+   */
+  subjects: { types: (typeof SUBJECT_TYPES)[number][] };
   moderation: {
     /**
      * `human`: new submissions and comments are public at once and wait in the Administration queue (the default for a pilot).
@@ -109,7 +115,7 @@ export type ReaderSteeringConfig = {
   retirementPoll: boolean;
 };
 
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
 
 function object(raw: unknown, label: string, known: string[]): Record<string, unknown> {
   if (raw === undefined) return {};
@@ -206,6 +212,11 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
       throw new Error(`reader-steering plugin moderation.ai.model must be a model name matching ${AI_MODEL_NAME}`);
     }
   }
+  const subjects = object(raw.subjects, "subjects", ["types"]);
+  const subjectTypes = subjects.types === undefined ? ["item", "submission"] : subjects.types;
+  if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => (SUBJECT_TYPES as readonly unknown[]).includes(type))) {
+    throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
+  }
   const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
   const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
   const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -249,6 +260,7 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
       itemType: lowercaseName(submissions.itemType, "submissions.itemType", "brief"),
       section: lowercaseName(submissions.section, "submissions.section", "unsectioned"),
     },
+    subjects: { types: [...new Set(subjectTypes)] as (typeof SUBJECT_TYPES)[number][] },
     moderation: {
       mode: mode as (typeof MODERATION_MODES)[number],
       preModeration,