@anthusai/papyrus 5.32.0 → 5.33.1

package/amplify/functions/automation-view/wire.js

@@ -1,11 +1,23 @@
 import { Stack } from "aws-cdk-lib";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { MONITORING_TABLE_PARAMETER, MONITORING_VIEW_TABLE_ACTIONS, monitoringViewParameterArn, monitoringViewTableArns, } from "../monitoring-view/wire.js";
-/** The two reads the function makes of its own site's API with its own role. It writes nothing. */
-export const AUTOMATION_VIEW_FUNCTION_FIELDS = ["Query/fields/listAutomations", "Query/fields/getProcedureRun"];
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+    "Query/fields/getAutomation",
+    "Query/fields/getNewsroomProcedureDefinition",
+    "Query/fields/getProcedureRun",
+    "Query/fields/listAutomations",
+    "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
 /**
- * Environment and least-privilege IAM for the automation-view function: two fields of the site's own API,
- * and the same read-only grant on the monitoring table that the Monitoring page has. A site outside the
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
  * monitoring account finds no parameter and the page lists its records without runs.
  */
 export function wireAutomationView(backend) {
@@ -13,6 +25,7 @@ export function wireAutomationView(backend) {
     const stack = Stack.of(lambda);
     lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
     const apiId = backend.data.resources.graphqlApi.apiId;
     lambda.addToRolePolicy(new PolicyStatement({
         effect: Effect.ALLOW,
@@ -29,4 +42,15 @@ export function wireAutomationView(backend) {
         actions: MONITORING_VIEW_TABLE_ACTIONS,
         resources: monitoringViewTableArns(stack.region, stack.account),
     }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+        conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["lambda:InvokeFunction"],
+        resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }));
 }

package/amplify/functions/automation-view/wire.ts

@@ -8,12 +8,26 @@ import {
   monitoringViewTableArns,
 } from "../monitoring-view/wire";
 
-/** The two reads the function makes of its own site's API with its own role. It writes nothing. */
-export const AUTOMATION_VIEW_FUNCTION_FIELDS = ["Query/fields/listAutomations", "Query/fields/getProcedureRun"];
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+  "Query/fields/getAutomation",
+  "Query/fields/getNewsroomProcedureDefinition",
+  "Query/fields/getProcedureRun",
+  "Query/fields/listAutomations",
+  "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
 
 /**
- * Environment and least-privilege IAM for the automation-view function: two fields of the site's own API,
- * and the same read-only grant on the monitoring table that the Monitoring page has. A site outside the
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
  * monitoring account finds no parameter and the page lists its records without runs.
  */
 export function wireAutomationView(backend: any): void {
@@ -21,6 +35,7 @@ export function wireAutomationView(backend: any): void {
   const stack = Stack.of(lambda);
   lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
   const apiId = backend.data.resources.graphqlApi.apiId as string;
   lambda.addToRolePolicy(
     new PolicyStatement({
@@ -43,4 +58,19 @@ export function wireAutomationView(backend: any): void {
       resources: monitoringViewTableArns(stack.region, stack.account),
     }),
   );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+      conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["lambda:InvokeFunction"],
+      resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }),
+  );
 }

package/amplify/functions/editorial-checks/schema.js

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { editorialChecks } from "./resource.js";
+import { functionHandler } from "../../data/function-handler.js";
 const editors = ["editor", "admin"];
 /**
  * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
@@ -69,19 +70,19 @@ export const editorialChecksSchemaDefinitions = {
         .query()
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
     checkItemVersion: a
         .mutation()
         .arguments({ itemId: a.id().required() })
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
     checkEditorial: a
         .query()
         .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
     suggestEditorialRewrite: a
         .query()
         .arguments({
@@ -94,28 +95,28 @@ export const editorialChecksSchemaDefinitions = {
     })
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
     draftEditorialQuestions: a
         .query()
         .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
         .returns(a.json())
         .authorization((allow) => [allow.group("admin")])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
     tryEditorialPolicy: a
         .query()
         .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
         .returns(a.json())
         .authorization((allow) => [allow.group("admin")])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
     importEditorialStarterPack: a
         .mutation()
         .arguments({ name: a.string().required() })
         .returns(a.json())
         .authorization((allow) => [allow.group("admin")])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
     recalibrateEditorialPolicies: a
         .mutation()
         .returns(a.json())
         .authorization((allow) => [allow.group("admin")])
-        .handler(a.handler.function(editorialChecks)),
+        .handler(functionHandler("editorialChecks", editorialChecks)),
 };

package/amplify/functions/editorial-checks/schema.ts

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { editorialChecks } from "./resource";
+import { functionHandler } from "../../data/function-handler";
 
 const editors = ["editor", "admin"];
 
@@ -71,19 +72,19 @@ export const editorialChecksSchemaDefinitions = {
       .query()
       .returns(a.json())
       .authorization((allow) => [allow.groups(editors)])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     checkItemVersion: a
       .mutation()
       .arguments({ itemId: a.id().required() })
       .returns(a.json())
       .authorization((allow) => [allow.groups(editors)])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     checkEditorial: a
       .query()
       .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
       .returns(a.json())
       .authorization((allow) => [allow.groups(editors)])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     suggestEditorialRewrite: a
       .query()
       .arguments({
@@ -96,28 +97,28 @@ export const editorialChecksSchemaDefinitions = {
       })
       .returns(a.json())
       .authorization((allow) => [allow.groups(editors)])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     draftEditorialQuestions: a
       .query()
       .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     tryEditorialPolicy: a
       .query()
       .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     importEditorialStarterPack: a
       .mutation()
       .arguments({ name: a.string().required() })
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     recalibrateEditorialPolicies: a
       .mutation()
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
   };

package/amplify/functions/monitoring-view/schema.js

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { monitoringView } from "./resource.js";
+import { functionHandler } from "../../data/function-handler.js";
 const editors = ["editor", "admin"];
 /**
  * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
@@ -12,5 +13,5 @@ export const monitoringViewSchemaDefinitions = {
         .arguments({ scope: a.string() })
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
-        .handler(a.handler.function(monitoringView)),
+        .handler(functionHandler("monitoringView", monitoringView)),
 };

package/amplify/functions/monitoring-view/schema.ts

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { monitoringView } from "./resource";
+import { functionHandler } from "../../data/function-handler";
 
 const editors = ["editor", "admin"];
 
@@ -14,5 +15,5 @@ export const monitoringViewSchemaDefinitions = {
     .arguments({ scope: a.string() })
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
-    .handler(a.handler.function(monitoringView)),
+    .handler(functionHandler("monitoringView", monitoringView)),
 };

package/amplify/plugins/newsletter/schema.js

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { newsletterOps } from "./ops/resource.js";
+import { functionHandler } from "../../data/function-handler.js";
 const staff = ["editor", "admin"];
 const admins = ["admin"];
 /** The newsroom's newsletter operations, all JSON in and out. The function checks the groups again from the identity claims. */
@@ -46,7 +47,7 @@ export const NEWSLETTER_OPERATION_GROUPS = {
  * table, never readable through the content API. It adds fourteen operations for the newsroom's Newsletter panel.
  */
 export function newsletterSchemaDefinitions() {
-    const handler = a.handler.function(newsletterOps);
+    const handler = functionHandler("newsletterOps", newsletterOps);
     const query = (name) => a.query().arguments({ input: a.json() }).returns(a.json()).authorization((allow) => [allow.groups(NEWSLETTER_OPERATION_GROUPS[name])]).handler(handler);
     const mutation = (name) => a.mutation().arguments({ input: a.json() }).returns(a.json()).authorization((allow) => [allow.groups(NEWSLETTER_OPERATION_GROUPS[name])]).handler(handler);
     return {

package/amplify/plugins/newsletter/schema.ts

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { newsletterOps } from "./ops/resource";
+import { functionHandler } from "../../data/function-handler";
 
 const staff = ["editor", "admin"];
 const admins = ["admin"];
@@ -49,7 +50,7 @@ export const NEWSLETTER_OPERATION_GROUPS: Record<string, string[]> = {
  * table, never readable through the content API. It adds fourteen operations for the newsroom's Newsletter panel.
  */
 export function newsletterSchemaDefinitions(): Record<string, unknown> {
-  const handler = a.handler.function(newsletterOps);
+  const handler = functionHandler("newsletterOps", newsletterOps);
   const query = (name: string) =>
     a.query().arguments({ input: a.json() }).returns(a.json()).authorization((allow) => [allow.groups(NEWSLETTER_OPERATION_GROUPS[name])]).handler(handler);
   const mutation = (name: string) =>

package/amplify/plugins/reader-steering/config.js

@@ -7,7 +7,7 @@ export const AI_MODEL_NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/;
 export const SUBMISSION_KIND_NAME = /^[a-z][a-z0-9-]{0,23}$/;
 export const SUBJECT_TYPES = ["item", "submission", "story", "proposal", "concept"];
 export const COMPUTE_ROLE_ARN = /^arn:aws:iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects", "proposals"]);
 function object(raw, label, known) {
     if (raw === undefined)
         return {};
@@ -117,6 +117,7 @@ export function resolveReaderSteeringConfig(request) {
     if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => SUBJECT_TYPES.includes(type))) {
         throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
     }
+    const proposals = object(raw.proposals, "proposals", ["publish"]);
     const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
     const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
     const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -173,6 +174,7 @@ export function resolveReaderSteeringConfig(request) {
             maximumLength: integer(comments.maximumLength, "comments.maximumLength", 2000, 1, 10000),
             maximumLinks: integer(comments.maximumLinks, "comments.maximumLinks", 3, 0, 50),
         },
+        proposals: { publish: flag(proposals.publish, "proposals.publish") },
         retirementPoll,
         ...(hypeGap ? { hypeGap } : {}),
         ...(raw.reservedConcurrency === undefined ? {} : { reservedConcurrency: integer(raw.reservedConcurrency, "reservedConcurrency", 1, 1, 1000) }),

package/amplify/plugins/reader-steering/config.ts

@@ -98,6 +98,14 @@ export type ReaderSteeringConfig = {
     /** Most links (http, https or www) in a comment. */
     maximumLinks: number;
   };
+  proposals: {
+    /**
+     * Publish every proposal, in every state (drafts included), as public `_data/proposals/` files in each snapshot run.
+     * Off by default: proposals stay private records until a site opts in. Turning it off stops further updates; it does not
+     * delete files already published.
+     */
+    publish: boolean;
+  };
   /**
    * The hype gap is `mean(plus dimensions) - mean(minus dimensions)`, computed for reader means and for editor scores.
    * Absent means no hype gap is published. The site names the dimensions in each group.
@@ -115,7 +123,7 @@ export type ReaderSteeringConfig = {
   retirementPoll: boolean;
 };
 
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects", "proposals"]);
 
 function object(raw: unknown, label: string, known: string[]): Record<string, unknown> {
   if (raw === undefined) return {};
@@ -217,6 +225,7 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
   if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => (SUBJECT_TYPES as readonly unknown[]).includes(type))) {
     throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
   }
+  const proposals = object(raw.proposals, "proposals", ["publish"]);
   const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
   const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
   const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -273,6 +282,7 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
       maximumLength: integer(comments.maximumLength, "comments.maximumLength", 2000, 1, 10000),
       maximumLinks: integer(comments.maximumLinks, "comments.maximumLinks", 3, 0, 50),
     },
+    proposals: { publish: flag(proposals.publish, "proposals.publish") },
     retirementPoll,
     ...(hypeGap ? { hypeGap } : {}),
     ...(raw.reservedConcurrency === undefined ? {} : { reservedConcurrency: integer(raw.reservedConcurrency, "reservedConcurrency", 1, 1, 1000) }),

package/amplify/plugins/reader-steering/papyrus.plugin.js

@@ -159,6 +159,8 @@ export const readerSteeringPlugin = {
         lambda.addEnvironment("PAPYRUS_READER_SNAPSHOT_FUNCTION_ARN", contentActions.functionArn);
         lambda.addEnvironment("PAPYRUS_READER_SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
         contentActions.addEnvironment("PAPYRUS_READER_SNAPSHOT_SETTINGS", JSON.stringify(readerSnapshotSettings(config)));
+        // Proposals are private unless the site opts in (docs/reader-steering.md, Proposals); the snapshot reads this flag.
+        contentActions.addEnvironment("PAPYRUS_READER_PUBLISH_PROPOSALS", config.proposals.publish ? "true" : "false");
         if (config.moderation.ai)
             wireAiModeration(lambda, contentActions, schedulerRole, config.moderation.ai.apiKeyParameter);
         lambda.addPermission("InvokeFromCmsCompute", {

package/amplify/plugins/reader-steering/papyrus.plugin.ts

@@ -182,6 +182,8 @@ export const readerSteeringPlugin: PapyrusPlugin<ReaderSteeringConfig, { readerA
     lambda.addEnvironment("PAPYRUS_READER_SNAPSHOT_FUNCTION_ARN", contentActions.functionArn);
     lambda.addEnvironment("PAPYRUS_READER_SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
     contentActions.addEnvironment("PAPYRUS_READER_SNAPSHOT_SETTINGS", JSON.stringify(readerSnapshotSettings(config)));
+    // Proposals are private unless the site opts in (docs/reader-steering.md, Proposals); the snapshot reads this flag.
+    contentActions.addEnvironment("PAPYRUS_READER_PUBLISH_PROPOSALS", config.proposals.publish ? "true" : "false");
 
     if (config.moderation.ai) wireAiModeration(lambda, contentActions, schedulerRole, config.moderation.ai.apiKeyParameter);
 

package/amplify/plugins/reader-steering/schema.js

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { readerActions } from "./function/resource.js";
+import { functionHandler } from "../../data/function-handler.js";
 /**
  * Staff and IAM only: no guest, API key or reader rule on any model. The reader-actions function writes the
  * tables directly with its own role, and editors may list them; admins may delete. `id` is the lookup key:
@@ -170,7 +171,7 @@ export function readerSteeringSchemaDefinitions() {
         })
             .returns(a.ref("ProposalReceipt"))
             .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-            .handler(a.handler.function(readerActions)),
+            .handler(functionHandler("readerActions", readerActions)),
         transitionProposal: a
             .mutation()
             .arguments({
@@ -181,7 +182,7 @@ export function readerSteeringSchemaDefinitions() {
         })
             .returns(a.ref("ProposalReceipt"))
             .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-            .handler(a.handler.function(readerActions)),
+            .handler(functionHandler("readerActions", readerActions)),
         ModerationReceipt: a.customType({
             status: a.string().required(),
             id: a.string(),
@@ -199,6 +200,6 @@ export function readerSteeringSchemaDefinitions() {
         })
             .returns(a.ref("ModerationReceipt"))
             .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-            .handler(a.handler.function(readerActions)),
+            .handler(functionHandler("readerActions", readerActions)),
     };
 }

package/amplify/plugins/reader-steering/schema.ts

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { readerActions } from "./function/resource";
+import { functionHandler } from "../../data/function-handler";
 
 /**
  * Staff and IAM only: no guest, API key or reader rule on any model. The reader-actions function writes the
@@ -172,7 +173,7 @@ export function readerSteeringSchemaDefinitions() {
       })
       .returns(a.ref("ProposalReceipt"))
       .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-      .handler(a.handler.function(readerActions)),
+      .handler(functionHandler("readerActions", readerActions)),
     transitionProposal: a
       .mutation()
       .arguments({
@@ -183,7 +184,7 @@ export function readerSteeringSchemaDefinitions() {
       })
       .returns(a.ref("ProposalReceipt"))
       .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-      .handler(a.handler.function(readerActions)),
+      .handler(functionHandler("readerActions", readerActions)),
     ModerationReceipt: a.customType({
       status: a.string().required(),
       id: a.string(),
@@ -201,6 +202,6 @@ export function readerSteeringSchemaDefinitions() {
       })
       .returns(a.ref("ModerationReceipt"))
       .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-      .handler(a.handler.function(readerActions)),
+      .handler(functionHandler("readerActions", readerActions)),
   };
 }

package/amplify/plugins/signup/schema.js

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { signupSubmit } from "./function/resource.js";
+import { functionHandler } from "../../data/function-handler.js";
 /**
  * SignupEntry is never guest-readable and has no create rule for anyone: only the
  * submitSignup function (IAM) writes it. Editors and admins list it; admins delete.
@@ -35,6 +36,6 @@ export function signupSchemaDefinitions() {
         })
             .returns(a.ref("SignupReceipt"))
             .authorization((allow) => [allow.guest()])
-            .handler(a.handler.function(signupSubmit)),
+            .handler(functionHandler("signupSubmit", signupSubmit)),
     };
 }

package/amplify/plugins/signup/schema.ts

@@ -1,5 +1,6 @@
 import { a } from "@aws-amplify/backend";
 import { signupSubmit } from "./function/resource";
+import { functionHandler } from "../../data/function-handler";
 
 /**
  * SignupEntry is never guest-readable and has no create rule for anyone: only the
@@ -36,6 +37,6 @@ export function signupSchemaDefinitions() {
       })
       .returns(a.ref("SignupReceipt"))
       .authorization((allow) => [allow.guest()])
-      .handler(a.handler.function(signupSubmit)),
+      .handler(functionHandler("signupSubmit", signupSubmit)),
   };
 }

package/components/automation-panel.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import { loadAutomationOverview } from "../lib/automation-client";
+import { loadAutomationOverview, runAutomationNow } from "../lib/automation-client";
 import { FIXTURE_AUTOMATION_OVERVIEW } from "../lib/automation-fixture";
 import type { AutomationResult } from "../lib/automation-overview";
 import { AutomationView } from "./automation-view";
@@ -35,5 +35,15 @@ export function AutomationPanel({ isDemo }: { isDemo: boolean }) {
     };
   }, [isDemo]);
 
-  return <AutomationView result={result} selectedId={selectedId} onSelect={setSelectedId} demo={isDemo} />;
+  const runNow = isDemo ? undefined : async (automationId: string, input: Record<string, unknown> | null) => {
+    const outcome = await runAutomationNow(automationId, input);
+    try {
+      setResult(await loadAutomationOverview());   // show the new run without waiting for the minute
+    } catch {
+      /* the next refresh will */
+    }
+    return outcome;
+  };
+
+  return <AutomationView result={result} selectedId={selectedId} onSelect={setSelectedId} demo={isDemo} onRunNow={runNow} />;
 }

package/components/automation-run-now.tsx

@@ -0,0 +1,97 @@
+"use client";
+
+import { useState } from "react";
+import {
+  atATimeText,
+  inputTemplateText,
+  parseRunInput,
+  runNowMessage,
+  type AutomationRecord,
+  type RunNowResult,
+} from "../lib/automation-overview";
+
+export type RunNowPhase = "idle" | "confirming" | "running" | "done";
+
+/**
+ * "Run now": a button, then a confirm step that says what will start and, when the record's input names
+ * placeholders for an item, asks for the input of this run. Starting costs money (the procedure calls a model),
+ * so nothing starts on the first click. `initialPhase` and `initialMessage` exist so every step renders from a test.
+ */
+export function RunNowControl({
+  record,
+  demo = false,
+  onRun,
+  initialPhase = "idle",
+  initialMessage = null,
+}: {
+  record: Pick<AutomationRecord, "id" | "title" | "procedureKey" | "runNow" | "limits">;
+  demo?: boolean;
+  onRun?: (automationId: string, input: Record<string, unknown> | null) => Promise<RunNowResult>;
+  initialPhase?: RunNowPhase;
+  initialMessage?: string | null;
+}) {
+  const [phase, setPhase] = useState<RunNowPhase>(initialPhase);
+  const [message, setMessage] = useState<string | null>(initialMessage);
+  const [text, setText] = useState(record.runNow.needsInput ? inputTemplateText(record.runNow.inputNames) : "");
+  const [problem, setProblem] = useState<string | null>(null);
+
+  if (!record.runNow.available) {
+    return (
+      <p className="news-desk-delegation-note" data-automation-run-now-unavailable>
+        Run now is not available: {record.runNow.reason === "disabled" ? "the automation is disabled. Enable it first." : (record.runNow.reason ?? "not supported")}.
+      </p>
+    );
+  }
+
+  async function confirm() {
+    const parsed = parseRunInput(text);
+    if (!parsed.ok) {
+      setProblem(parsed.message);
+      return;
+    }
+    if (record.runNow.needsInput && parsed.value === null) {
+      setProblem("This automation's input names an item, so give the input for this run.");
+      return;
+    }
+    setProblem(null);
+    setPhase("running");
+    try {
+      const result = onRun ? await onRun(record.id, parsed.value) : ({ state: "unavailable" } as RunNowResult);
+      setMessage(runNowMessage(result));
+    } catch {
+      setMessage(runNowMessage({ state: "unavailable" }));
+    }
+    setPhase("done");
+  }
+
+  return (
+    <div data-automation-run-now={record.id} data-run-now-phase={phase}>
+      {phase === "idle" || phase === "done" ? (
+        <button type="button" data-automation-run-now-start onClick={() => { setMessage(null); setPhase("confirming"); }}>
+          Run now
+        </button>
+      ) : null}
+      {phase === "confirming" || phase === "running" ? (
+        <div role="group" aria-label={`Confirm Run now for ${record.title}`} data-automation-run-now-confirm>
+          <p>
+            Run <strong>{record.procedureKey}</strong> now? It calls a model, which costs money, and it counts against the
+            limit ({atATimeText(record.limits)}). The run is linked to this automation.
+          </p>
+          {demo ? <p className="news-desk-delegation-note">This is the demo, so nothing will start.</p> : null}
+          <label>
+            Input for this run{record.runNow.needsInput ? " (required)" : " (optional; blank uses the record's input)"}
+            <textarea rows={4} value={text} onChange={(event) => setText(event.target.value)} disabled={phase === "running"} data-automation-run-now-input />
+          </label>
+          {problem ? <p role="alert" data-automation-run-now-problem>{problem}</p> : null}
+          <button type="button" onClick={() => void confirm()} disabled={phase === "running" || demo} data-automation-run-now-confirm-button>
+            {phase === "running" ? "Starting…" : "Confirm: start the run"}
+          </button>{" "}
+          <button type="button" onClick={() => { setPhase("idle"); setProblem(null); }} disabled={phase === "running"} data-automation-run-now-cancel>
+            Cancel
+          </button>
+        </div>
+      ) : null}
+      {message ? <p role="status" data-automation-run-now-message>{message}</p> : null}
+    </div>
+  );
+}