@anthusai/papyrus 5.43.0-next.2 → 5.43.0-next.21

package/amplify/data/resource.js

@@ -603,6 +603,12 @@ const schema = a.schema({
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(functionHandler("contentActions", contentActions)),
+    correctReferenceCapture: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(functionHandler("contentActions", contentActions)),
     saveItemDraft: a
         .mutation()
         .arguments({ input: a.json().required() })

package/amplify/data/resource.ts

@@ -657,6 +657,13 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(functionHandler("contentActions", contentActions)),
 
+  correctReferenceCapture: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(functionHandler("contentActions", contentActions)),
+
   saveItemDraft: a
     .mutation()
     .arguments({ input: a.json().required() })

package/amplify/data/schema.js

@@ -530,6 +530,12 @@ function buildBaseDefinitions(includeEditions) {
             .returns(a.json())
             .authorization((allow) => [allow.groups(contentWriteGroups)])
             .handler(functionHandler("contentActions", contentActions)),
+        correctReferenceCapture: a
+            .mutation()
+            .arguments({ input: a.json().required() })
+            .returns(a.json())
+            .authorization((allow) => [allow.groups(contentWriteGroups)])
+            .handler(functionHandler("contentActions", contentActions)),
         saveItemDraft: a
             .mutation()
             .arguments({ input: a.json().required() })

package/amplify/data/schema.ts

@@ -582,6 +582,13 @@ const definitions = {
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(functionHandler("contentActions", contentActions)),
 
+  correctReferenceCapture: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(functionHandler("contentActions", contentActions)),
+
   saveItemDraft: a
     .mutation()
     .arguments({ input: a.json().required() })

package/amplify/functions/category-action/handler.ts

@@ -24,6 +24,7 @@ import {
   requestDelegation,
   type DelegationStore,
 } from "../shared/curation-delegation-flow";
+import { claimGroups } from "../../../lib/staff-groups";
 
 type ReviewHandler = Schema["reviewSteeringProposal"]["functionHandler"];
 type ReferenceCurationHandler = Schema["reviewReferenceCuration"]["functionHandler"];
@@ -360,7 +361,7 @@ function requireSignedInPerson(event: { identity?: unknown }): { sub: string; la
   }
   const identity = event.identity as { sub?: unknown; claims?: Record<string, unknown> };
   const claims = identity.claims ?? {};
-  const groups = Array.isArray(claims["cognito:groups"]) ? (claims["cognito:groups"] as unknown[]) : [];
+  const groups = claimGroups(claims["cognito:groups"]);
   return {
     sub: normalizeRequiredString(claims.sub ?? identity.sub, "identity.sub"),
     label: normalizeOptionalString(claims.email) ?? normalizeOptionalString(claims.name) ?? "Newsroom editor",

package/amplify/functions/content-actions/handler.py

@@ -365,6 +365,14 @@ def handler(event, context):
                     client, arguments, event.get("identity") or {}, receipt_store=receipt_store)
             except IntakeError as error:
                 return {"ok": False, "errors": [{"code": "intake-rejected", "message": str(error)}]}
+        if field == "correctReferenceCapture":
+            from papyrus_content.reference_curation_store import CurationError, correct_reference_capture
+
+            client, _claims = create_authoring_client()
+            try:
+                return correct_reference_capture(client, arguments, event.get("identity") or {})
+            except CurationError as error:
+                return {"ok": False, "errors": [{"code": "correction-rejected", "message": str(error)}]}
         if field == "deriveMarkus":
             return derive_markus_action(arguments)
         if field == "saveItemDraft":

package/amplify/functions/model-attachment-upload/handler.ts

@@ -41,6 +41,7 @@ const ALLOWED_ROLES = new Set([
   "item_excerpt",
   "message_body",
   "metadata",
+  "preview",
   "ontology_concept_profile",
   "ontology_relation_explanation",
   "published_item_body",

package/amplify/functions/monitoring-view/schema.js

@@ -14,6 +14,14 @@ export const monitoringViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(functionHandler("monitoringView", monitoringView)),
+    // One more page of one Monitoring list (runs, routerRuns, items, emailSubmissions), after a cursor from
+    // the overview or a previous page. filter "held" lists only held email submissions, restarting from the newest.
+    monitoringPage: a
+        .query()
+        .arguments({ list: a.string().required(), cursor: a.string(), filter: a.string(), scope: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
     monitoringEmailSubmission: a
         .query()
         .arguments({ receiptId: a.string().required() })
@@ -26,6 +34,14 @@ export const monitoringViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(functionHandler("monitoringView", monitoringView)),
+    // Accept ("release") or Reject ("discard") one held email submission. The function validates the
+    // signed-in editor and that the message is routed to this publication; the receiver applies it.
+    monitoringDecideEmailSubmission: a
+        .mutation()
+        .arguments({ receiptId: a.string().required(), decision: a.string().required(), reason: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
     monitoringResolveEmailArticleLink: a
         .mutation()
         .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/monitoring-view/schema.ts

@@ -16,6 +16,14 @@ export const monitoringViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(functionHandler("monitoringView", monitoringView)),
+  // One more page of one Monitoring list (runs, routerRuns, items, emailSubmissions), after a cursor from
+  // the overview or a previous page. filter "held" lists only held email submissions, restarting from the newest.
+  monitoringPage: a
+    .query()
+    .arguments({ list: a.string().required(), cursor: a.string(), filter: a.string(), scope: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
   monitoringEmailSubmission: a
     .query()
     .arguments({ receiptId: a.string().required() })
@@ -28,6 +36,14 @@ export const monitoringViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(functionHandler("monitoringView", monitoringView)),
+  // Accept ("release") or Reject ("discard") one held email submission. The function validates the
+  // signed-in editor and that the message is routed to this publication; the receiver applies it.
+  monitoringDecideEmailSubmission: a
+    .mutation()
+    .arguments({ receiptId: a.string().required(), decision: a.string().required(), reason: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
   monitoringResolveEmailArticleLink: a
     .mutation()
     .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/procedure-action/handler.ts

@@ -3,6 +3,7 @@ import { getAmplifyDataClientConfig } from "@aws-amplify/backend/function/runtim
 import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
+import { claimGroups } from "../../../lib/staff-groups";
 
 type DataClient = ReturnType<typeof generateClient<Schema>>;
 type DataClientErrors = Array<{ message?: string | null } | string | null> | null | undefined;
@@ -474,20 +475,11 @@ function validateJsonSchemaInput(schema: Record<string, unknown>, input: Record<
 
 function requireAdmin(event: ProcedureEvent): void {
   const claims = objectValue(event.identity?.claims);
-  const groups = [
-    ...normalizeClaimGroups(claims["cognito:groups"]),
-    ...normalizeClaimGroups(claims.groups),
-  ];
+  const groups = [...claimGroups(claims["cognito:groups"]), ...claimGroups(claims.groups)];
   if (groups.includes("admin")) return;
   throw new Error("Admin role required.");
 }
 
-function normalizeClaimGroups(value: unknown): string[] {
-  if (Array.isArray(value)) return value.map((entry) => String(entry).trim()).filter(Boolean);
-  if (typeof value === "string") return value.split(",").map((entry) => entry.trim()).filter(Boolean);
-  return [];
-}
-
 async function getDataClient(): Promise<DataClient> {
   if (!clientPromise) {
     clientPromise = (async () => {

package/amplify/functions/proposal-actions/proposals.py

@@ -92,6 +92,25 @@ def is_appsync_event(event: dict[str, Any]) -> bool:
     return "arguments" in event and ("info" in event or event_field_name(event) is not None)
 PROPOSER_AI = "ai"
 STAFF_GROUPS = frozenset({"editor", "admin"})
+
+_GROUP_SEPARATORS = re.compile(r"[\s,]+")
+
+
+def claim_groups(value: Any) -> list[str]:
+    """Copy of ``papyrus_content.staff_groups.claim_groups`` (this function ships without that package; a test keeps them equal)."""
+    if isinstance(value, (list, tuple, set, frozenset)):
+        raw = [item for item in value if isinstance(item, str)]
+    elif isinstance(value, str):
+        raw = _GROUP_SEPARATORS.split(value)
+    else:
+        return []
+    cleaned = (item.strip().strip("\"'[](){}").strip() for item in raw)
+    return [item for item in cleaned if item]
+
+
+def has_editor_rights(groups: Any) -> bool:
+    """``admin`` has every editor right: an admin who is not in the ``editor`` group is staff."""
+    return any(group.lower() in STAFF_GROUPS for group in claim_groups(groups))
 #: The only moves an operator's IAM role may make, as (from, to). Everything after the draft is an editor's decision.
 OPERATOR_TRANSITIONS = frozenset({(DRAFT, IN_STEERING), (DRAFT, DECLINED)})
 BY_STAFF, BY_OPERATOR = "staff", "operator"
@@ -140,10 +159,8 @@ def staff_subject(identity: dict[str, Any]) -> str | None:
     """The Cognito subject of an editor or admin, or ``None`` for anyone else."""
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []
-    if isinstance(groups, str):
-        groups = [group.strip() for group in groups.strip("[]").replace(",", " ").split()]
     subject = identity.get("sub")
-    if not isinstance(subject, str) or not subject or not STAFF_GROUPS.intersection(groups):
+    if not isinstance(subject, str) or not subject or not has_editor_rights(groups):
         return None
     return subject
 

package/amplify/plugins/reader-steering/function/handler.py

@@ -1468,10 +1468,8 @@ def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSet
     identity = event.get("identity") or {}
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []
-    if isinstance(groups, str):
-        groups = [group.strip() for group in groups.strip("[]").replace(",", " ").split()]
     subject = identity.get("sub")
-    if not isinstance(subject, str) or not subject or not moderation_rules.STAFF_GROUPS.intersection(groups):
+    if not isinstance(subject, str) or not subject or not moderation_rules.has_editor_rights(groups):
         return moderation_rules.refused("not_staff", "Only editors and admins can moderate.").to_dict()
     arguments = event.get("arguments") or {}
     outcome = moderation_rules.apply_action(

package/amplify/plugins/reader-steering/function/moderation.py

@@ -37,6 +37,25 @@ READER_ID = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f
 ACTION_ID = re.compile(r"mod-[0-9a-f]{32}")
 MAXIMUM_REASON = 500
 STAFF_GROUPS = frozenset({"editor", "admin"})
+
+_GROUP_SEPARATORS = re.compile(r"[\s,]+")
+
+
+def claim_groups(value: Any) -> list[str]:
+    """Copy of ``papyrus_content.staff_groups.claim_groups`` (this function ships without that package; a test keeps them equal)."""
+    if isinstance(value, (list, tuple, set, frozenset)):
+        raw = [item for item in value if isinstance(item, str)]
+    elif isinstance(value, str):
+        raw = _GROUP_SEPARATORS.split(value)
+    else:
+        return []
+    cleaned = (item.strip().strip("\"'[](){}").strip() for item in raw)
+    return [item for item in cleaned if item]
+
+
+def has_editor_rights(groups: Any) -> bool:
+    """``admin`` has every editor right: an admin who is not in the ``editor`` group is staff."""
+    return any(group.lower() in STAFF_GROUPS for group in claim_groups(groups))
 ITEM_ID_PREFIX = "item-"
 
 

package/bin/papyrus-app.mjs

@@ -1,9 +1,20 @@
 #!/usr/bin/env node
+import path from "node:path";
 import { sync } from "../src/sync.mjs";
 
 const [command, ...rest] = process.argv.slice(2);
 if (command === "sync") {
   sync();
+} else if (command === "brand" && rest[0] === "diff") {
+  const { brandDiff } = await import("../src/brand.mjs");
+  const flag = rest.indexOf("--papyrus");
+  const checkout = flag === -1 ? undefined : rest[flag + 1];
+  try {
+    process.exit(brandDiff({ id: rest[1], checkout: checkout && path.resolve(checkout) }).drifted ? 1 : 0);
+  } catch (error) {
+    console.error(error.message);
+    process.exit(2);
+  }
 } else if (command === "videoml-bundle") {
   const preview = rest.includes("--preview");
   const { buildBrowserBundle } = await import("../scripts/videoml/build-browser-bundle.mjs");
@@ -15,6 +26,6 @@ if (command === "sync") {
     process.exit(1);
   }
 } else {
-  console.error("Usage: papyrus-app sync | papyrus-app videoml-bundle [--preview]");
+  console.error("Usage: papyrus-app sync | papyrus-app brand diff <brand-id> [--papyrus <checkout>] | papyrus-app videoml-bundle [--preview]");
   process.exit(command ? 1 : 0);
 }

package/bin/papyrus-infra.mjs

@@ -3,6 +3,7 @@
  * papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]
  * papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]
  * papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader
+ * papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out]   (the private chat data stack)
  * papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]
  * Synthesizes the app-shell stack for a publication from its own site.json,
  * prints one of the generated Amplify build specs, or deploys the stack from
@@ -16,6 +17,7 @@ import { resolveCdkEnvironment } from "../src/cdk-environment.mjs";
 
 const USAGE = [
   "Usage: papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]",
+  "       papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
   "       papyrus-infra deploy-edge --stack NAME --template FILE [--adoption-template FILE --adopt-resources FILE] [--parameter KEY=VALUE]... [--delete-function NAME] [--only-branch main] [--only-app-id ID] [--region R]",
@@ -186,8 +188,9 @@ if (command === "deploy") {
 }
 
 let AmplifyAppShellStack;
+let PapyrusChatStack;
 try {
-  ({ AmplifyAppShellStack } = await import("../infra/index.js"));
+  ({ AmplifyAppShellStack, PapyrusChatStack } = await import("../infra/index.js"));
 } catch (error) {
   console.error(`papyrus-infra: ${error instanceof Error ? error.message : error}`);
   process.exit(1);
@@ -195,6 +198,23 @@ try {
 
 const { App } = createRequire(path.join(process.cwd(), "noop.js"))("aws-cdk-lib");
 const app = new App({ outdir: path.resolve(opt("out", "cdk.out")) });
+if (opt("part", "shell") === "chat") {
+  // The site's private newsroom chat data stack (docs/private-newsroom-chat-per-site.md); deployed before the app shell enables chat.
+  if (!config.chat?.enabled) {
+    console.error(`papyrus-infra: site ${config.siteId} has no enabled chat block`);
+    process.exit(1);
+  }
+  const lambdaAssetDirectory = opt("chat-lambdas");
+  const chatStack = new PapyrusChatStack(app, {
+    config,
+    env: resolveEnvironmentOrExit(),
+    lambdaAssetDirectory: lambdaAssetDirectory ? path.resolve(lambdaAssetDirectory) : undefined,
+    description: `Private Papyrus newsroom chat data plane for ${config.siteId}.`,
+  });
+  app.synth();
+  console.log(`synthesized ${chatStack.stackName} -> ${path.resolve(opt("out", "cdk.out"))}`);
+  process.exit(0);
+}
 new AmplifyAppShellStack(app, `AmplifyAppShell-${config.siteId}`, config, {
   env: resolveEnvironmentOrExit(),
   stackName: resolveStackName(config),

package/components/dev-sandbox-editor-sign-in.tsx

@@ -2,9 +2,9 @@
 
 import { fetchAuthSession, signIn, signOut } from "aws-amplify/auth";
 import { configureAmplifyClient } from "./amplify-client-provider";
+import { hasEditorRights } from "../lib/staff-groups";
 import type { DevSandboxEditorAuth } from "../lib/dev-sandbox-editor-auth";
 
-const EDITOR_GROUPS = new Set(["editor", "admin"]);
 
 function readSessionGroups(session: Awaited<ReturnType<typeof fetchAuthSession>>): string[] {
   const accessPayload = session.tokens?.accessToken?.payload ?? {};
@@ -29,7 +29,7 @@ function readSessionGroups(session: Awaited<ReturnType<typeof fetchAuthSession>>
 
 function sessionHasEditorAccess(session: Awaited<ReturnType<typeof fetchAuthSession>>): boolean {
   if (!session.tokens?.accessToken) return false;
-  return readSessionGroups(session).some((group) => EDITOR_GROUPS.has(group));
+  return hasEditorRights(readSessionGroups(session));
 }
 
 export async function ensureDevSandboxEditorSession(