@anthusai/papyrus 5.42.1 → 5.43.0-next.10

package/amplify/plugins/reader-steering/function/handler.py

@@ -30,7 +30,6 @@ if _FUNCTION_DIRECTORY not in sys.path:  # a Lambda already has its code directo
     sys.path.insert(0, _FUNCTION_DIRECTORY)
 import ai_moderation  # noqa: E402
 import moderation as moderation_rules  # noqa: E402
-import proposals as proposal_rules  # noqa: E402
 
 SITE_SUBJECT = re.compile(r"ss1_[A-Za-z0-9_-]{43}")
 INTERIM_SUBJECT = re.compile(r"ssdev_[A-Za-z0-9_-]{43}")
@@ -979,7 +978,6 @@ class DynamoReaderStore:
         report_table: str = "",
         action_table: str = "",
         item_table: str = "",
-        proposal_table: str = "",
         flag_table: str = "",
     ) -> None:
         self._resource = resource
@@ -994,72 +992,12 @@ class DynamoReaderStore:
             "report": report_table,
             "action": action_table,
             "item": item_table,
-            "proposal": proposal_table,
             "flag": flag_table,
         }
 
     def _table(self, key: str) -> Any:
         return self._resource.Table(self._names[key])
 
-    def get_proposal(self, proposal_id: str) -> dict[str, Any] | None:
-        item = self._table("proposal").get_item(Key={"id": proposal_id}, ConsistentRead=True).get("Item")
-        return plain(item) if item else None
-
-    def create_proposal(self, row: dict[str, Any]) -> bool:
-        item = {**_without_none(row), "__typename": "Proposal", "updatedAt": row["createdAt"]}
-        try:
-            self._table("proposal").put_item(Item=item, ConditionExpression="attribute_not_exists(id)")
-        except Exception as error:
-            if is_conditional_failure(error):
-                return False
-            raise
-        return True
-
-    def list_story_drafts(self, limit: int) -> list[dict[str, Any]]:
-        """The story drafts of the table, only the fields ``listStoryDrafts`` may answer; at most ``limit`` (the newest if there are more)."""
-        fields = proposal_rules.STORY_DRAFT_FIELDS
-        names = {"#kind": "kind", **{f"#f{index}": field for index, field in enumerate(fields)}}
-        request: dict[str, Any] = {
-            "FilterExpression": "#kind = :kind",
-            "ProjectionExpression": ", ".join(f"#f{index}" for index in range(len(fields))) + ", #kind",
-            "ExpressionAttributeNames": names,
-            "ExpressionAttributeValues": {":kind": "story_draft"},
-        }
-        rows: list[dict[str, Any]] = []
-        while True:
-            page = self._table("proposal").scan(**request)
-            rows.extend(plain(item) for item in page.get("Items") or [])
-            if not page.get("LastEvaluatedKey"):
-                break
-            request["ExclusiveStartKey"] = page["LastEvaluatedKey"]
-        rows.sort(key=lambda row: (row.get("createdAt") or "", row.get("id") or ""), reverse=True)
-        return [{field: row.get(field) for field in fields} for row in rows[:limit]]
-
-    def change_proposal(self, proposal_id: str, changes: dict[str, Any], expected_state: str, now_iso: str, *, expected_updated_at: str | None = None) -> bool:
-        """Apply ``changes`` if the state (and, when given, ``updatedAt``) is still what the caller saw; a value of ``None`` removes the attribute."""
-        names = {"#st": "state", "#u": "updatedAt", **{f"#c{index}": key for index, key in enumerate(changes)}}
-        sets = ", ".join(f"#c{index} = :c{index}" for index, value in enumerate(changes.values()) if value is not None)
-        removes = ", ".join(f"#c{index}" for index, value in enumerate(changes.values()) if value is None)
-        values = {":expected": expected_state, ":now": now_iso, **{f":c{index}": value for index, value in enumerate(changes.values()) if value is not None}}
-        condition = "#st = :expected"
-        if expected_updated_at is not None:
-            condition += " AND #u = :seen"
-            values[":seen"] = expected_updated_at
-        expression = f"SET {sets + ', ' if sets else ''}#u = :now" + (f" REMOVE {removes}" if removes else "")
-        try:
-            self._table("proposal").update_item(
-                Key={"id": proposal_id},
-                UpdateExpression=expression,
-                ConditionExpression=condition,
-                ExpressionAttributeNames=names,
-                ExpressionAttributeValues=values,
-            )
-        except Exception as error:
-            if is_conditional_failure(error):
-                return False
-            raise
-        return True
-
     def get_profile(self, site_subject: str) -> dict[str, Any] | None:
         item = self._table("profile").get_item(Key={"id": site_subject}, ConsistentRead=True).get("Item")
         return plain(item) if item else None
@@ -1473,7 +1411,6 @@ def store_from_environment(environment: dict[str, str] | None = None) -> DynamoR
         report_table=environment.get("PAPYRUS_READER_REPORT_TABLE", ""),
         action_table=environment.get("PAPYRUS_READER_ACTION_TABLE", ""),
         item_table=environment.get("PAPYRUS_READER_ITEM_TABLE", ""),
-        proposal_table=environment.get("PAPYRUS_READER_PROPOSAL_TABLE", ""),
         flag_table=environment.get("PAPYRUS_READER_FLAG_TABLE", ""),
     )
 
@@ -1528,17 +1465,11 @@ def run_ai_worker(
 
 def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSettings, now_seconds: float, account_id: str | None = None) -> dict[str, Any]:
     """``moderateReader`` from AppSync: an editor or admin hides, approves, promotes, bans or undoes. Answers a receipt, never an exception."""
-    if proposal_rules.event_field_name(event) in proposal_rules.MUTATIONS:
-        return proposal_rules.handle_proposal_event(event, store, now_iso=iso(now_seconds), account_id=account_id)
-    if proposal_rules.event_field_name(event) in proposal_rules.QUERIES:
-        return proposal_rules.handle_proposal_query(event, store, account_id=account_id)
     identity = event.get("identity") or {}
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []
-    if isinstance(groups, str):
-        groups = [group.strip() for group in groups.strip("[]").replace(",", " ").split()]
     subject = identity.get("sub")
-    if not isinstance(subject, str) or not subject or not moderation_rules.STAFF_GROUPS.intersection(groups):
+    if not isinstance(subject, str) or not subject or not moderation_rules.has_editor_rights(groups):
         return moderation_rules.refused("not_staff", "Only editors and admins can moderate.").to_dict()
     arguments = event.get("arguments") or {}
     outcome = moderation_rules.apply_action(
@@ -1556,8 +1487,18 @@ def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSet
     return outcome.to_dict()
 
 
+def is_appsync_event(event: dict[str, Any]) -> bool:
+    """True for an AppSync invocation (arguments plus ``info`` or a top-level ``fieldName``); the public path sends siteSubject, action and payload.
+
+    The Amplify Gen 2 Lambda data source sends ``fieldName`` at the top level with no ``info`` key; a direct resolver nests it under ``info``.
+    """
+    info = event.get("info")
+    name = (info.get("fieldName") if isinstance(info, dict) else None) or event.get("fieldName")
+    return "arguments" in event and ("info" in event or (isinstance(name, str) and bool(name)))
+
+
 def function_account(context: Any) -> str | None:
-    """The AWS account this function runs in, from its own ARN: the only account whose IAM operators may file proposals."""
+    """The AWS account this function runs in, from its own ARN: the account of the function."""
     parts = str(getattr(context, "invoked_function_arn", None) or "").split(":")
     return parts[4] if len(parts) > 4 and parts[4] else None
 
@@ -1568,7 +1509,7 @@ def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
     settings = settings_from_environment()
     store = store_from_environment()
     now_seconds = time.time()
-    if proposal_rules.is_appsync_event(event):
+    if is_appsync_event(event):
         return handle_staff_event(event, store=store, settings=settings, now_seconds=now_seconds, account_id=function_account(_context))
     target = snapshot_target_from_environment()
     if settings.moderation_mode == "ai" and target is not None and _context is not None:

package/amplify/plugins/reader-steering/function/moderation.py

@@ -37,6 +37,25 @@ READER_ID = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f
 ACTION_ID = re.compile(r"mod-[0-9a-f]{32}")
 MAXIMUM_REASON = 500
 STAFF_GROUPS = frozenset({"editor", "admin"})
+
+_GROUP_SEPARATORS = re.compile(r"[\s,]+")
+
+
+def claim_groups(value: Any) -> list[str]:
+    """Copy of ``papyrus_content.staff_groups.claim_groups`` (this function ships without that package; a test keeps them equal)."""
+    if isinstance(value, (list, tuple, set, frozenset)):
+        raw = [item for item in value if isinstance(item, str)]
+    elif isinstance(value, str):
+        raw = _GROUP_SEPARATORS.split(value)
+    else:
+        return []
+    cleaned = (item.strip().strip("\"'[](){}").strip() for item in raw)
+    return [item for item in cleaned if item]
+
+
+def has_editor_rights(groups: Any) -> bool:
+    """``admin`` has every editor right: an admin who is not in the ``editor`` group is staff."""
+    return any(group.lower() in STAFF_GROUPS for group in claim_groups(groups))
 ITEM_ID_PREFIX = "item-"
 
 

package/amplify/plugins/reader-steering/papyrus.plugin.js

@@ -14,9 +14,8 @@ export const READER_POLL_SECRET_PARAMETER_ENV = "PAPYRUS_READER_POLL_SECRET_PARA
 export const readerSteeringManifest = {
     name: "reader-steering",
     contract: 1,
-    models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction", "Proposal"],
-    mutations: ["moderateReader", "fileProposal", "transitionProposal", "editProposal"],
-    queries: ["listStoryDrafts"],
+    models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction"],
+    mutations: ["moderateReader"],
     guest: { mutations: [] },
     newsroomPanels: [{ id: "moderation", label: "Moderation" }],
     staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],
@@ -119,7 +118,6 @@ export const readerSteeringPlugin = {
             ["PAPYRUS_READER_COMMENT_TABLE", "ReaderComment"],
             ["PAPYRUS_READER_REPORT_TABLE", "ReaderReport"],
             ["PAPYRUS_READER_ACTION_TABLE", "ModerationAction"],
-            ["PAPYRUS_READER_PROPOSAL_TABLE", "Proposal"],
         ]) {
             tables[model].grantReadWriteData(lambda);
             lambda.addEnvironment(variable, tables[model].tableName);
@@ -136,8 +134,10 @@ export const readerSteeringPlugin = {
         // The snapshot reads submissions, and the review step writes their signals and moderation state.
         tables.ReaderSubmission.grantReadWriteData(contentActions);
         tables.ReaderComment.grantReadWriteData(contentActions);
-        // The snapshot reads proposals and freezes the community result of one that reaches editor review.
+        // The snapshot reads proposals and freezes the community result of one that reaches editor review. The Proposal model and the
+        // functions that file and move proposals are core (amplify/functions/proposal-actions); this plugin only reads the same table.
         tables.Proposal.grantReadWriteData(contentActions);
+        contentActions.addEnvironment("PAPYRUS_READER_PROPOSAL_TABLE", tables.Proposal.tableName);
         lambda.addEnvironment("PAPYRUS_READER_SETTINGS", JSON.stringify(readerActionsSettings(config, interimSubjectsAllowedAtSynth())));
         if (config.reservedConcurrency !== undefined) {
             lambda.node.defaultChild.addPropertyOverride("ReservedConcurrentExecutions", config.reservedConcurrency);

package/amplify/plugins/reader-steering/papyrus.plugin.ts

@@ -21,9 +21,8 @@ export const READER_POLL_SECRET_PARAMETER_ENV = "PAPYRUS_READER_POLL_SECRET_PARA
 export const readerSteeringManifest: PluginManifest = {
   name: "reader-steering",
   contract: 1,
-  models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction", "Proposal"],
-  mutations: ["moderateReader", "fileProposal", "transitionProposal", "editProposal"],
-  queries: ["listStoryDrafts"],
+  models: ["ReaderProfile", "ReaderHandle", "ReaderVote", "ReaderFlag", "ReaderSubmission", "ReaderComment", "ReaderReport", "ModerationAction"],
+  mutations: ["moderateReader"],
   guest: { mutations: [] },
   newsroomPanels: [{ id: "moderation", label: "Moderation" }],
   staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],
@@ -138,7 +137,6 @@ export const readerSteeringPlugin: PapyrusPlugin<ReaderSteeringConfig, { readerA
       ["PAPYRUS_READER_COMMENT_TABLE", "ReaderComment"],
       ["PAPYRUS_READER_REPORT_TABLE", "ReaderReport"],
       ["PAPYRUS_READER_ACTION_TABLE", "ModerationAction"],
-      ["PAPYRUS_READER_PROPOSAL_TABLE", "Proposal"],
     ] as const) {
       tables[model].grantReadWriteData(lambda);
       lambda.addEnvironment(variable, tables[model].tableName);
@@ -155,8 +153,10 @@ export const readerSteeringPlugin: PapyrusPlugin<ReaderSteeringConfig, { readerA
     // The snapshot reads submissions, and the review step writes their signals and moderation state.
     tables.ReaderSubmission.grantReadWriteData(contentActions);
     tables.ReaderComment.grantReadWriteData(contentActions);
-    // The snapshot reads proposals and freezes the community result of one that reaches editor review.
+    // The snapshot reads proposals and freezes the community result of one that reaches editor review. The Proposal model and the
+    // functions that file and move proposals are core (amplify/functions/proposal-actions); this plugin only reads the same table.
     tables.Proposal.grantReadWriteData(contentActions);
+    contentActions.addEnvironment("PAPYRUS_READER_PROPOSAL_TABLE", tables.Proposal.tableName);
 
     lambda.addEnvironment("PAPYRUS_READER_SETTINGS", JSON.stringify(readerActionsSettings(config, interimSubjectsAllowedAtSynth())));
     if (config.reservedConcurrency !== undefined) {

package/amplify/plugins/reader-steering/schema.js

@@ -135,101 +135,6 @@ export function readerSteeringSchemaDefinitions() {
             .disableOperations(["subscriptions"])
             .secondaryIndexes((index) => [index("target").sortKeys(["at"]).name("actionsByTarget").queryField("listModerationActionsByTargetAndAt")])
             .authorization(staffOnly),
-        Proposal: a
-            .model({
-            id: a.id().required(),
-            kind: a.string().required(),
-            title: a.string().required(),
-            summary: a.string(),
-            body: a.string().required(),
-            targets: a.json().required(),
-            evidence: a.json(),
-            proposer: a.string().required(),
-            state: a.string().required(),
-            history: a.json().required(),
-            communityResult: a.json(),
-            pinned: a.boolean(),
-            held: a.boolean(),
-            override: a.json(),
-            exclusions: a.json(),
-            editorLog: a.json(),
-            needsLook: a.json(),
-            createdAt: a.datetime().required(),
-        })
-            .disableOperations(["subscriptions"])
-            .secondaryIndexes((index) => [index("state").sortKeys(["createdAt"]).name("proposalsByState").queryField("listProposalsByStateAndCreatedAt")])
-            .authorization(staffOnly),
-        ProposalReceipt: a.customType({
-            status: a.string().required(),
-            id: a.string(),
-            error: a.string(),
-            message: a.string(),
-        }),
-        // What an operator may read of a story draft: these six fields and nothing else (no body, evidence, history, proposer, vote or log).
-        StoryDraftSummary: a.customType({
-            id: a.string().required(),
-            title: a.string().required(),
-            summary: a.string(),
-            targets: a.json(),
-            state: a.string().required(),
-            createdAt: a.string().required(),
-        }),
-        StoryDraftList: a.customType({
-            status: a.string().required(),
-            id: a.string(),
-            error: a.string(),
-            message: a.string(),
-            drafts: a.ref("StoryDraftSummary").array(),
-        }),
-        // Editors and admins file as themselves. AppSync also admits an IAM principal whose own policy allows the field (the
-        // schema accepts IAM callers for the functions that call it); the function files an AI proposal for an IAM principal
-        // of its own account only, and refuses an identity-pool user and any other account. No IAM rule is declared here.
-        fileProposal: a
-            .mutation()
-            .arguments({
-            kind: a.string().required(),
-            title: a.string().required(),
-            body: a.string().required(),
-            summary: a.string(),
-            targets: a.json(),
-            evidence: a.json(),
-        })
-            .returns(a.ref("ProposalReceipt"))
-            .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-            .handler(functionHandler("readerActions", readerActions)),
-        // The same IAM rule as fileProposal, narrower: an operator may move only draft to in_steering or declined.
-        // Approving, deciding after review and overriding are refused for IAM in the function (`operator_not_allowed`).
-        transitionProposal: a
-            .mutation()
-            .arguments({
-            proposalId: a.string().required(),
-            state: a.string().required(),
-            reason: a.string(),
-            result: a.string(),
-        })
-            .returns(a.ref("ProposalReceipt"))
-            .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-            .handler(functionHandler("readerActions", readerActions)),
-        // Read only, and the same caller rule as fileProposal: editors and admins, or an IAM principal of the function's own account. The function
-        // answers the story drafts' id, title, summary, targets, state and createdAt so an unattended trend run can dedupe; nothing else.
-        listStoryDrafts: a
-            .query()
-            .returns(a.ref("StoryDraftList"))
-            .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-            .handler(functionHandler("readerActions", readerActions)),
-        // Editors and admins only, and the function refuses an IAM operator: pin, unpin, hold, release, exclude_votes and
-        // undo_exclusion. `rule` is a batch rule for exclude_votes; `exclusionId` names the exclusion undo_exclusion reverses.
-        editProposal: a
-            .mutation()
-            .arguments({
-            proposalId: a.string().required(),
-            action: a.string().required(),
-            rule: a.string(),
-            exclusionId: a.string(),
-        })
-            .returns(a.ref("ProposalReceipt"))
-            .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-            .handler(functionHandler("readerActions", readerActions)),
         ModerationReceipt: a.customType({
             status: a.string().required(),
             id: a.string(),

package/amplify/plugins/reader-steering/schema.ts

@@ -137,101 +137,6 @@ export function readerSteeringSchemaDefinitions() {
       .disableOperations(["subscriptions"])
       .secondaryIndexes((index) => [index("target").sortKeys(["at"]).name("actionsByTarget").queryField("listModerationActionsByTargetAndAt")])
       .authorization(staffOnly),
-    Proposal: a
-      .model({
-        id: a.id().required(),
-        kind: a.string().required(),
-        title: a.string().required(),
-        summary: a.string(),
-        body: a.string().required(),
-        targets: a.json().required(),
-        evidence: a.json(),
-        proposer: a.string().required(),
-        state: a.string().required(),
-        history: a.json().required(),
-        communityResult: a.json(),
-        pinned: a.boolean(),
-        held: a.boolean(),
-        override: a.json(),
-        exclusions: a.json(),
-        editorLog: a.json(),
-        needsLook: a.json(),
-        createdAt: a.datetime().required(),
-      })
-      .disableOperations(["subscriptions"])
-      .secondaryIndexes((index) => [index("state").sortKeys(["createdAt"]).name("proposalsByState").queryField("listProposalsByStateAndCreatedAt")])
-      .authorization(staffOnly),
-    ProposalReceipt: a.customType({
-      status: a.string().required(),
-      id: a.string(),
-      error: a.string(),
-      message: a.string(),
-    }),
-    // What an operator may read of a story draft: these six fields and nothing else (no body, evidence, history, proposer, vote or log).
-    StoryDraftSummary: a.customType({
-      id: a.string().required(),
-      title: a.string().required(),
-      summary: a.string(),
-      targets: a.json(),
-      state: a.string().required(),
-      createdAt: a.string().required(),
-    }),
-    StoryDraftList: a.customType({
-      status: a.string().required(),
-      id: a.string(),
-      error: a.string(),
-      message: a.string(),
-      drafts: a.ref("StoryDraftSummary").array(),
-    }),
-    // Editors and admins file as themselves. AppSync also admits an IAM principal whose own policy allows the field (the
-    // schema accepts IAM callers for the functions that call it); the function files an AI proposal for an IAM principal
-    // of its own account only, and refuses an identity-pool user and any other account. No IAM rule is declared here.
-    fileProposal: a
-      .mutation()
-      .arguments({
-        kind: a.string().required(),
-        title: a.string().required(),
-        body: a.string().required(),
-        summary: a.string(),
-        targets: a.json(),
-        evidence: a.json(),
-      })
-      .returns(a.ref("ProposalReceipt"))
-      .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-      .handler(functionHandler("readerActions", readerActions)),
-    // The same IAM rule as fileProposal, narrower: an operator may move only draft to in_steering or declined.
-    // Approving, deciding after review and overriding are refused for IAM in the function (`operator_not_allowed`).
-    transitionProposal: a
-      .mutation()
-      .arguments({
-        proposalId: a.string().required(),
-        state: a.string().required(),
-        reason: a.string(),
-        result: a.string(),
-      })
-      .returns(a.ref("ProposalReceipt"))
-      .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-      .handler(functionHandler("readerActions", readerActions)),
-    // Read only, and the same caller rule as fileProposal: editors and admins, or an IAM principal of the function's own account. The function
-    // answers the story drafts' id, title, summary, targets, state and createdAt so an unattended trend run can dedupe; nothing else.
-    listStoryDrafts: a
-      .query()
-      .returns(a.ref("StoryDraftList"))
-      .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-      .handler(functionHandler("readerActions", readerActions)),
-    // Editors and admins only, and the function refuses an IAM operator: pin, unpin, hold, release, exclude_votes and
-    // undo_exclusion. `rule` is a batch rule for exclude_votes; `exclusionId` names the exclusion undo_exclusion reverses.
-    editProposal: a
-      .mutation()
-      .arguments({
-        proposalId: a.string().required(),
-        action: a.string().required(),
-        rule: a.string(),
-        exclusionId: a.string(),
-      })
-      .returns(a.ref("ProposalReceipt"))
-      .authorization((allow) => [allow.group("editor"), allow.group("admin")])
-      .handler(functionHandler("readerActions", readerActions)),
     ModerationReceipt: a.customType({
       status: a.string().required(),
       id: a.string(),

package/amplify/site-backend.js

@@ -24,6 +24,8 @@ import { defineSiteData } from "./data/resource.js";
 import { editorialChecks } from "./functions/editorial-checks/resource.js";
 import { automationView } from "./functions/automation-view/resource.js";
 import { wireAutomationView } from "./functions/automation-view/wire.js";
+import { proposalActions } from "./functions/proposal-actions/resource.js";
+import { wireProposalActions } from "./functions/proposal-actions/wire.js";
 import { monitoringView } from "./functions/monitoring-view/resource.js";
 import { wireEmailReferenceIntake, wireMonitoringView } from "./functions/monitoring-view/wire.js";
 import { wireEditorialChecks } from "./functions/editorial-checks/wire.js";
@@ -110,6 +112,7 @@ export function defineSiteBackend(papyrusSite) {
         modelAttachmentUpload,
         newsroomSummary,
         procedureAction,
+        proposalActions,
         publicForms,
         readerSettings,
         emailSubmissionProcessor,
@@ -631,6 +634,7 @@ export function defineSiteBackend(papyrusSite) {
     wireEditorialChecks(backend);
     wireMonitoringView(backend, emailMonitorId);
     wireAutomationView(backend);
+    wireProposalActions(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }

package/amplify/site-backend.ts

@@ -31,6 +31,8 @@ import { defineSiteData } from "./data/resource";
 import { editorialChecks } from "./functions/editorial-checks/resource";
 import { automationView } from "./functions/automation-view/resource";
 import { wireAutomationView } from "./functions/automation-view/wire";
+import { proposalActions } from "./functions/proposal-actions/resource";
+import { wireProposalActions } from "./functions/proposal-actions/wire";
 import { monitoringView } from "./functions/monitoring-view/resource";
 import { wireEmailReferenceIntake, wireMonitoringView } from "./functions/monitoring-view/wire";
 import { wireEditorialChecks } from "./functions/editorial-checks/wire";
@@ -131,6 +133,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     modelAttachmentUpload,
     newsroomSummary,
     procedureAction,
+    proposalActions,
     publicForms,
     readerSettings,
     emailSubmissionProcessor,
@@ -777,6 +780,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   wireEditorialChecks(backend);
   wireMonitoringView(backend, emailMonitorId);
   wireAutomationView(backend);
+  wireProposalActions(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 
   return backend;

package/app/.well-known/papyrus-cli.json/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCliLoginDiscovery } from "../../../lib/cli-login-discovery";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleCliLoginDiscovery(request);
+}

package/app/globals.css

@@ -1,7 +1,7 @@
 @import "./papyrus-theme.css";
 
-@import "tailwindcss";
-@import "tw-animate-css";
+/* Tailwind (import, @source globs, @theme tokens) lives only in ./tailwind.css. Importing it again here
+   emitted a second full Tailwind build that loaded later and whose `.hidden` overrode `md:flex`. */
 @import "@radix-ui/colors/slate.css";
 @import "@radix-ui/colors/slate-alpha.css";
 @import "@radix-ui/colors/slate-dark.css";
@@ -15,39 +15,6 @@
 @import "@radix-ui/colors/tomato-dark.css";
 @import "@radix-ui/colors/tomato-dark-alpha.css";
 
-@theme inline {
-  --radius-sm: calc(var(--radius) - 4px);
-  --radius-md: calc(var(--radius) - 2px);
-  --radius-lg: var(--radius);
-  --radius-xl: calc(var(--radius) + 4px);
-  --color-background: var(--background);
-  --color-foreground: var(--foreground);
-  --color-card: var(--card);
-  --color-card-foreground: var(--card-foreground);
-  --color-popover: var(--popover);
-  --color-popover-foreground: var(--popover-foreground);
-  --color-primary: var(--primary);
-  --color-primary-foreground: var(--primary-foreground);
-  --color-secondary: var(--secondary);
-  --color-secondary-foreground: var(--secondary-foreground);
-  --color-muted: var(--muted);
-  --color-muted-foreground: var(--muted-foreground);
-  --color-accent: var(--accent);
-  --color-accent-foreground: var(--accent-foreground);
-  --color-destructive: var(--destructive);
-  --color-destructive-foreground: var(--destructive-foreground);
-  --color-border: var(--border);
-  --color-input: var(--input);
-  --color-ring: var(--ring);
-  --color-danger: var(--danger);
-  --color-danger-foreground: var(--danger-foreground);
-  --color-surface: var(--surface);
-  --color-surface-foreground: var(--surface-foreground);
-  --color-foreground-strong: var(--foreground-strong);
-  --color-foreground-muted: var(--foreground-muted);
-  --color-foreground-subtle: var(--foreground-subtle);
-}
-
 :root {
   --radius: 0.875rem;
   --background: var(--slate-2);
@@ -10170,3 +10137,32 @@ img {
   }
 }
 
+
+@media (max-width: 900px) {
+  .edition-progress__button--console { display: none; }
+  .papyrus-console--open {
+    --papyrus-console-width: 100vw;
+    background: rgb(var(--paper-rgb));
+    height: 100dvh;
+    padding-bottom: env(safe-area-inset-bottom);
+    box-sizing: border-box;
+  }
+}
+
+.papyrus-console__access {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 16px;
+  padding: 24px 18px;
+  overflow-y: auto;
+  color: var(--ink);
+  font-size: 0.95rem;
+  line-height: 1.5;
+}
+.papyrus-console__access strong { font-size: 1.15rem; }
+.papyrus-console__access button { min-height: 44px; padding: 10px 14px; font: inherit; text-transform: none; letter-spacing: normal; }
+
+@media (max-width: 900px) {
+  .papyrus-console__header button { min-width: 44px; min-height: 44px; }
+}

package/app/tailwind.css

@@ -24,6 +24,8 @@
   --color-accent: var(--accent);
   --color-accent-foreground: var(--accent-foreground);
   --color-destructive: var(--destructive);
+  --color-destructive-foreground: var(--destructive-foreground);
+  --color-foreground-subtle: var(--foreground-subtle);
   --color-danger: var(--danger);
   --color-danger-foreground: var(--danger-foreground);
   --color-surface: var(--surface);

package/bin/papyrus-infra.mjs

@@ -3,6 +3,7 @@
  * papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]
  * papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]
  * papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader
+ * papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out]   (the private chat data stack)
  * papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]
  * Synthesizes the app-shell stack for a publication from its own site.json,
  * prints one of the generated Amplify build specs, or deploys the stack from
@@ -16,6 +17,7 @@ import { resolveCdkEnvironment } from "../src/cdk-environment.mjs";
 
 const USAGE = [
   "Usage: papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]",
+  "       papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
   "       papyrus-infra deploy-edge --stack NAME --template FILE [--adoption-template FILE --adopt-resources FILE] [--parameter KEY=VALUE]... [--delete-function NAME] [--only-branch main] [--only-app-id ID] [--region R]",
@@ -186,8 +188,9 @@ if (command === "deploy") {
 }
 
 let AmplifyAppShellStack;
+let PapyrusChatStack;
 try {
-  ({ AmplifyAppShellStack } = await import("../infra/index.js"));
+  ({ AmplifyAppShellStack, PapyrusChatStack } = await import("../infra/index.js"));
 } catch (error) {
   console.error(`papyrus-infra: ${error instanceof Error ? error.message : error}`);
   process.exit(1);
@@ -195,6 +198,23 @@ try {
 
 const { App } = createRequire(path.join(process.cwd(), "noop.js"))("aws-cdk-lib");
 const app = new App({ outdir: path.resolve(opt("out", "cdk.out")) });
+if (opt("part", "shell") === "chat") {
+  // The site's private newsroom chat data stack (docs/private-newsroom-chat-per-site.md); deployed before the app shell enables chat.
+  if (!config.chat?.enabled) {
+    console.error(`papyrus-infra: site ${config.siteId} has no enabled chat block`);
+    process.exit(1);
+  }
+  const lambdaAssetDirectory = opt("chat-lambdas");
+  const chatStack = new PapyrusChatStack(app, {
+    config,
+    env: resolveEnvironmentOrExit(),
+    lambdaAssetDirectory: lambdaAssetDirectory ? path.resolve(lambdaAssetDirectory) : undefined,
+    description: `Private Papyrus newsroom chat data plane for ${config.siteId}.`,
+  });
+  app.synth();
+  console.log(`synthesized ${chatStack.stackName} -> ${path.resolve(opt("out", "cdk.out"))}`);
+  process.exit(0);
+}
 new AmplifyAppShellStack(app, `AmplifyAppShell-${config.siteId}`, config, {
   env: resolveEnvironmentOrExit(),
   stackName: resolveStackName(config),