@anthusai/papyrus 5.43.0-next.5 → 5.43.0-next.51

package/amplify/data/message-actions.js

@@ -0,0 +1,68 @@
+import { a } from "@aws-amplify/backend";
+/**
+ * Messages belong to their author, and the backend says so. The browser cannot create, edit or delete a Message through the
+ * model (editors and admins only read it); it calls these four mutations, whose resolvers stamp the author from the signed-in
+ * identity and check ownership against the stored `authorSub` in the same DynamoDB write. `renameThread` does the same for a
+ * conversation's title. Functions and IAM callers (the router, procedures, the console responder, email, Slack) write the
+ * model directly with their own grants, as before.
+ *
+ * Each resolver is one self-contained file (AppSync takes a single file and offers `@aws-appsync/utils` only).
+ */
+const people = (allow) => [allow.group("editor"), allow.group("admin")];
+const adminsOnly = (allow) => [allow.group("admin")];
+const onMessages = (entry) => a.handler.custom({ dataSource: a.ref("Message"), entry });
+const onThreads = (entry) => a.handler.custom({ dataSource: a.ref("MessageThread"), entry });
+export const messageActionsSchemaDefinitions = {
+    postMessage: a
+        .mutation()
+        .arguments({
+        id: a.id().required(),
+        threadId: a.id().required(),
+        content: a.string(),
+        summary: a.string(),
+        parentMessageId: a.id(),
+        sequenceNumber: a.integer(),
+        messageKind: a.string().required(),
+        messageDomain: a.string().required(),
+        messageType: a.string(),
+        role: a.string(),
+        source: a.string(),
+        authorLabel: a.string(),
+        semanticLayer: a.string(),
+        searchVisibility: a.string(),
+        responseTarget: a.string(),
+        responseStatus: a.string(),
+        responseOwner: a.string(),
+        responseStartedAt: a.datetime(),
+        responseCompletedAt: a.datetime(),
+        metadata: a.json(),
+        newsroomFeedKey: a.string(),
+    })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/post-message.js")),
+    editMessage: a
+        .mutation()
+        .arguments({ id: a.id().required(), content: a.string().required(), summary: a.string() })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/edit-message.js")),
+    deleteOwnMessage: a
+        .mutation()
+        .arguments({ id: a.id().required() })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/delete-own-message.js")),
+    moderateMessage: a
+        .mutation()
+        .arguments({ id: a.id().required() })
+        .returns(a.ref("Message"))
+        .authorization(adminsOnly)
+        .handler(onMessages("./resolvers/moderate-message.js")),
+    renameThread: a
+        .mutation()
+        .arguments({ id: a.id().required(), title: a.string().required() })
+        .returns(a.ref("MessageThread"))
+        .authorization(people)
+        .handler(onThreads("./resolvers/rename-thread.js")),
+};

package/amplify/data/message-actions.ts

@@ -0,0 +1,70 @@
+import { a } from "@aws-amplify/backend";
+
+/**
+ * Messages belong to their author, and the backend says so. The browser cannot create, edit or delete a Message through the
+ * model (editors and admins only read it); it calls these four mutations, whose resolvers stamp the author from the signed-in
+ * identity and check ownership against the stored `authorSub` in the same DynamoDB write. `renameThread` does the same for a
+ * conversation's title. Functions and IAM callers (the router, procedures, the console responder, email, Slack) write the
+ * model directly with their own grants, as before.
+ *
+ * Each resolver is one self-contained file (AppSync takes a single file and offers `@aws-appsync/utils` only).
+ */
+const people = (allow: any) => [allow.group("editor"), allow.group("admin")];
+const adminsOnly = (allow: any) => [allow.group("admin")];
+const onMessages = (entry: string) => a.handler.custom({ dataSource: a.ref("Message"), entry });
+const onThreads = (entry: string) => a.handler.custom({ dataSource: a.ref("MessageThread"), entry });
+
+export const messageActionsSchemaDefinitions = {
+  postMessage: a
+    .mutation()
+    .arguments({
+      id: a.id().required(),
+      threadId: a.id().required(),
+      content: a.string(),
+      summary: a.string(),
+      parentMessageId: a.id(),
+      sequenceNumber: a.integer(),
+      messageKind: a.string().required(),
+      messageDomain: a.string().required(),
+      messageType: a.string(),
+      role: a.string(),
+      source: a.string(),
+      authorLabel: a.string(),
+      semanticLayer: a.string(),
+      searchVisibility: a.string(),
+      responseTarget: a.string(),
+      responseStatus: a.string(),
+      responseOwner: a.string(),
+      responseStartedAt: a.datetime(),
+      responseCompletedAt: a.datetime(),
+      metadata: a.json(),
+      newsroomFeedKey: a.string(),
+    })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/post-message.js")),
+  editMessage: a
+    .mutation()
+    .arguments({ id: a.id().required(), content: a.string().required(), summary: a.string() })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/edit-message.js")),
+  deleteOwnMessage: a
+    .mutation()
+    .arguments({ id: a.id().required() })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/delete-own-message.js")),
+  moderateMessage: a
+    .mutation()
+    .arguments({ id: a.id().required() })
+    .returns(a.ref("Message"))
+    .authorization(adminsOnly)
+    .handler(onMessages("./resolvers/moderate-message.js")),
+  renameThread: a
+    .mutation()
+    .arguments({ id: a.id().required(), title: a.string().required() })
+    .returns(a.ref("MessageThread"))
+    .authorization(people)
+    .handler(onThreads("./resolvers/rename-thread.js")),
+};

package/amplify/data/resolvers/delete-own-message.js

@@ -0,0 +1,30 @@
+// deleteOwnMessage: the author deletes their own Message. A soft delete: the Message stays (replies keep their place) marked
+// deleted, with when and by whom. Nothing is removed.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to delete a message.", "Unauthorized");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      status: ddb.operations.replace("deleted"),
+      deletedAt: ddb.operations.replace(now),
+      deletedBySub: ddb.operations.replace(identity.sub),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { authorSub: { eq: identity.sub }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the author can delete their own message, and it may already be deleted.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/edit-message.js

@@ -0,0 +1,33 @@
+// editMessage: a person changes the text of their own Message, and no one else's. The condition is checked by DynamoDB against the
+// stored authorSub in the same write, so there is no window between the check and the change. A deleted Message cannot be edited.
+// Authorship cannot be reassigned: the update never touches authorSub.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to edit a message.", "Unauthorized");
+  const content = typeof ctx.args.content === "string" ? ctx.args.content.trim() : "";
+  if (!content) util.error("A message cannot be empty.", "BadRequest");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      content: ddb.operations.replace(content),
+      summary: ddb.operations.replace(ctx.args.summary ? ctx.args.summary : content.slice(0, 120)),
+      editedAt: ddb.operations.replace(now),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { authorSub: { eq: identity.sub }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the author can edit a message, and a deleted message cannot be edited.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/moderate-message.js

@@ -0,0 +1,32 @@
+// moderateMessage: an admin removes anyone's Message. The same soft delete as the author's, with no change to the text, and only
+// for the admin group (checked here as well as by the mutation's authorization).
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to moderate a message.", "Unauthorized");
+  const groups = identity.groups || [];
+  if (groups.indexOf("admin") < 0) util.error("Only an admin can delete someone else's message.", "Unauthorized");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      status: ddb.operations.replace("deleted"),
+      deletedAt: ddb.operations.replace(now),
+      deletedBySub: ddb.operations.replace(identity.sub),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { id: { attributeExists: true }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("That message does not exist or is already deleted.", "NotFound");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/post-message.js

@@ -0,0 +1,68 @@
+// postMessage: the only way a person's Message is created. The author is the signed-in user (the identity's sub), whatever the
+// client sends: the mutation has no author argument, and a label is only a label. One DynamoDB PutItem that refuses to replace an
+// existing Message (ids are derived from the sequence number, so a lost race comes back as a conflict the caller retries).
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+function clean(value) {
+  const out = {};
+  const keys = Object.keys(value);
+  for (let index = 0; index < keys.length; index++) {
+    const key = keys[index];
+    if (value[key] !== null && value[key] !== undefined) out[key] = value[key];
+  }
+  return out;
+}
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to post a message.", "Unauthorized");
+  const args = ctx.args;
+  const content = typeof args.content === "string" ? args.content.trim() : "";
+  // A placeholder waiting for a responder (PENDING) may start empty; any other message needs text.
+  if (!content && args.responseStatus !== "PENDING") util.error("A message cannot be empty.", "BadRequest");
+  if (!args.id || !args.threadId) util.error("A message needs an id and a conversation.", "BadRequest");
+  const now = util.time.nowISO8601();
+  const claims = identity.claims || {};
+  const email = typeof claims.email === "string" ? claims.email : "";
+  const label = typeof args.authorLabel === "string" && args.authorLabel.trim() ? args.authorLabel.trim() : email ? email : "editor";
+  const item = clean({
+    __typename: "Message",
+    id: args.id,
+    messageKind: args.messageKind,
+    messageDomain: args.messageDomain,
+    status: "active",
+    summary: args.summary ? args.summary : content.slice(0, 120),
+    source: args.source,
+    authorSub: identity.sub,
+    authorLabel: label,
+    threadId: args.threadId,
+    parentMessageId: args.parentMessageId,
+    sequenceNumber: args.sequenceNumber,
+    role: args.role ? args.role : "human",
+    messageType: args.messageType,
+    content: content,
+    semanticLayer: args.semanticLayer,
+    searchVisibility: args.searchVisibility,
+    responseTarget: args.responseTarget,
+    responseStatus: args.responseStatus ? args.responseStatus : "COMPLETED",
+    responseOwner: args.responseOwner,
+    responseStartedAt: args.responseStartedAt,
+    responseCompletedAt: args.responseCompletedAt,
+    metadata: args.metadata,
+    createdAt: now,
+    updatedAt: now,
+    newsroomFeedKey: args.newsroomFeedKey,
+  });
+  return ddb.put({ key: { id: args.id }, item: item, condition: { id: { attributeExists: false } } });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("A message with this id already exists (conditional check failed); try again.", "Conflict");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/rename-thread.js

@@ -0,0 +1,28 @@
+// renameThread: the person who started a conversation, or an admin, gives it a new title. The browser's own update of a thread
+// cannot change the title (the field is read and create only), so this is the one way. Nothing else about the thread changes.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to rename a conversation.", "Unauthorized");
+  const title = typeof ctx.args.title === "string" ? ctx.args.title.trim() : "";
+  if (!title) util.error("A title cannot be empty.", "BadRequest");
+  const groups = identity.groups || [];
+  const isAdmin = groups.indexOf("admin") >= 0;
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: { title: ddb.operations.replace(title.slice(0, 120)) },
+    condition: isAdmin ? { id: { attributeExists: true } } : { createdBySub: { eq: identity.sub } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the person who started this conversation, or an admin, can rename it.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resource.js

@@ -247,8 +247,6 @@ const schema = a.schema({
         referenceId: a.id().required(),
         status: a.string().required(),
         reasonCode: a.string(),
-        messageId: a.id(),
-        relationId: a.id(),
     }),
     ReferenceQualityActionResult: a.customType({
         ok: a.boolean().required(),
@@ -603,6 +601,12 @@ const schema = a.schema({
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(functionHandler("contentActions", contentActions)),
+    correctReferenceCapture: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(functionHandler("contentActions", contentActions)),
     saveItemDraft: a
         .mutation()
         .arguments({ input: a.json().required() })
@@ -1563,8 +1567,26 @@ const schema = a.schema({
         curationStatusUpdatedAt: a.datetime(),
         curationStatusUpdatedBy: a.string(),
         curationStatusReason: a.string(),
+        curationReasonCode: a.string(),
+        curationActorKind: a.string(),
+        curationSectionId: a.string(),
+        curationShareable: a.boolean(),
+        curationDelegation: a.json(),
+        curationDecisionRelationId: a.string(),
         newsroomFeedKey: a.string(),
         reviewedFeedKey: a.string(),
+        discoveredByMonitorId: a.string(),
+        discoveryDetails: a.json(),
+        discoveryRule: a.json(),
+        // The References page reads the feed through two indexes (docs/reference-feed-indexes.md). `feedStateKey` is
+        // "<corpusId>#unrated" or "<corpusId>#rated" for a current, not archived Reference (null otherwise: it is in no feed).
+        // `predictionSortKey` orders Best bets, `feedArrivalAt` orders Newest. The prediction is the Cyclotron's ORIGINAL
+        // P(accept), written once, and never rewritten by a vote.
+        feedStateKey: a.string(),
+        feedArrivalAt: a.datetime(),
+        predictedAcceptProbability: a.float(),
+        predictionDecidedAt: a.datetime(),
+        predictionSortKey: a.string(),
         updatedAt: a.datetime(),
     })
         .secondaryIndexes((index) => [
@@ -1577,6 +1599,9 @@ const schema = a.schema({
         index("curationStatus").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusAndUpdatedAt"),
         index("curationStatusKey").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusKeyAndUpdatedAt"),
         index("reviewedFeedKey").sortKeys(["updatedAt"]).queryField("listReferencesByReviewedFeedAndUpdatedAt"),
+        index("discoveredByMonitorId").sortKeys(["createdAt"]).queryField("listReferencesByMonitorAndCreatedAt"),
+        index("feedStateKey").sortKeys(["predictionSortKey"]).queryField("listReferencesByFeedStateAndPrediction"),
+        index("feedStateKey").sortKeys(["feedArrivalAt"]).queryField("listReferencesByFeedStateAndArrival"),
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
@@ -1664,6 +1689,9 @@ const schema = a.schema({
         authorSub: a.string(),
         authorUserProfileId: a.id(),
         authorLabel: a.string(),
+        editedAt: a.datetime(),
+        deletedAt: a.datetime(),
+        deletedBySub: a.string(),
         threadId: a.id(),
         parentMessageId: a.id(),
         sequenceNumber: a.integer(),
@@ -1698,7 +1726,10 @@ const schema = a.schema({
         index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
         .authorization((allow) => [
-        allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+        // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+        // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+        allow.group("editor").to(["read"]),
+        allow.group(adminGroup).to(["read"]),
         allow.authenticated("identityPool").to(["read", "create", "update"]),
     ]),
     MessageThread: a

package/amplify/data/resource.ts

@@ -267,8 +267,6 @@ const schema = a.schema({
     referenceId: a.id().required(),
     status: a.string().required(),
     reasonCode: a.string(),
-    messageId: a.id(),
-    relationId: a.id(),
   }),
 
   ReferenceQualityActionResult: a.customType({
@@ -657,6 +655,13 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(functionHandler("contentActions", contentActions)),
 
+  correctReferenceCapture: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(functionHandler("contentActions", contentActions)),
+
   saveItemDraft: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -1675,8 +1680,26 @@ const schema = a.schema({
       curationStatusUpdatedAt: a.datetime(),
       curationStatusUpdatedBy: a.string(),
       curationStatusReason: a.string(),
+      curationReasonCode: a.string(),
+      curationActorKind: a.string(),
+      curationSectionId: a.string(),
+      curationShareable: a.boolean(),
+      curationDelegation: a.json(),
+      curationDecisionRelationId: a.string(),
       newsroomFeedKey: a.string(),
       reviewedFeedKey: a.string(),
+      discoveredByMonitorId: a.string(),
+      discoveryDetails: a.json(),
+      discoveryRule: a.json(),
+      // The References page reads the feed through two indexes (docs/reference-feed-indexes.md). `feedStateKey` is
+      // "<corpusId>#unrated" or "<corpusId>#rated" for a current, not archived Reference (null otherwise: it is in no feed).
+      // `predictionSortKey` orders Best bets, `feedArrivalAt` orders Newest. The prediction is the Cyclotron's ORIGINAL
+      // P(accept), written once, and never rewritten by a vote.
+      feedStateKey: a.string(),
+      feedArrivalAt: a.datetime(),
+      predictedAcceptProbability: a.float(),
+      predictionDecidedAt: a.datetime(),
+      predictionSortKey: a.string(),
       updatedAt: a.datetime(),
     })
     .secondaryIndexes((index) => [
@@ -1689,6 +1712,9 @@ const schema = a.schema({
       index("curationStatus").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusAndUpdatedAt"),
       index("curationStatusKey").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusKeyAndUpdatedAt"),
       index("reviewedFeedKey").sortKeys(["updatedAt"]).queryField("listReferencesByReviewedFeedAndUpdatedAt"),
+      index("discoveredByMonitorId").sortKeys(["createdAt"]).queryField("listReferencesByMonitorAndCreatedAt"),
+      index("feedStateKey").sortKeys(["predictionSortKey"]).queryField("listReferencesByFeedStateAndPrediction"),
+      index("feedStateKey").sortKeys(["feedArrivalAt"]).queryField("listReferencesByFeedStateAndArrival"),
     ])
     .authorization((allow) => [
       allow.groups(categoryWriteGroups).to(["read"]),
@@ -1779,6 +1805,9 @@ const schema = a.schema({
       authorSub: a.string(),
       authorUserProfileId: a.id(),
       authorLabel: a.string(),
+      editedAt: a.datetime(),
+      deletedAt: a.datetime(),
+      deletedBySub: a.string(),
       threadId: a.id(),
       parentMessageId: a.id(),
       sequenceNumber: a.integer(),
@@ -1813,7 +1842,10 @@ const schema = a.schema({
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+      // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+      // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(["read"]),
       allow.authenticated("identityPool").to(["read", "create", "update"]),
     ]),
 

package/amplify/data/schema.js

@@ -4,6 +4,7 @@ import { categoryAction } from "../functions/category-action/resource.js";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
 import { automationViewSchemaDefinitions } from "../functions/automation-view/schema.js";
 import { proposalActionsSchemaDefinitions } from "../functions/proposal-actions/schema.js";
+import { messageActionsSchemaDefinitions } from "./message-actions.js";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
@@ -259,8 +260,6 @@ function buildBaseDefinitions(includeEditions) {
             referenceId: a.id().required(),
             status: a.string().required(),
             reasonCode: a.string(),
-            messageId: a.id(),
-            relationId: a.id(),
         }),
         ReferenceQualityActionResult: a.customType({
             ok: a.boolean().required(),
@@ -530,6 +529,12 @@ function buildBaseDefinitions(includeEditions) {
             .returns(a.json())
             .authorization((allow) => [allow.groups(contentWriteGroups)])
             .handler(functionHandler("contentActions", contentActions)),
+        correctReferenceCapture: a
+            .mutation()
+            .arguments({ input: a.json().required() })
+            .returns(a.json())
+            .authorization((allow) => [allow.groups(contentWriteGroups)])
+            .handler(functionHandler("contentActions", contentActions)),
         saveItemDraft: a
             .mutation()
             .arguments({ input: a.json().required() })
@@ -1469,8 +1474,26 @@ function buildBaseDefinitions(includeEditions) {
             curationStatusUpdatedAt: a.datetime(),
             curationStatusUpdatedBy: a.string(),
             curationStatusReason: a.string(),
+            curationReasonCode: a.string(),
+            curationActorKind: a.string(),
+            curationSectionId: a.string(),
+            curationShareable: a.boolean(),
+            curationDelegation: a.json(),
+            curationDecisionRelationId: a.string(),
             newsroomFeedKey: a.string(),
             reviewedFeedKey: a.string(),
+            discoveredByMonitorId: a.string(),
+            discoveryDetails: a.json(),
+            discoveryRule: a.json(),
+            // The References page reads the feed through two indexes (docs/reference-feed-indexes.md). `feedStateKey` is
+            // "<corpusId>#unrated" or "<corpusId>#rated" for a current, not archived Reference (null otherwise: it is in no feed).
+            // `predictionSortKey` orders Best bets, `feedArrivalAt` orders Newest. The prediction is the Cyclotron's ORIGINAL
+            // P(accept), written once, and never rewritten by a vote.
+            feedStateKey: a.string(),
+            feedArrivalAt: a.datetime(),
+            predictedAcceptProbability: a.float(),
+            predictionDecidedAt: a.datetime(),
+            predictionSortKey: a.string(),
             updatedAt: a.datetime(),
         })
             .secondaryIndexes((index) => [
@@ -1483,6 +1506,9 @@ function buildBaseDefinitions(includeEditions) {
             index("curationStatus").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusAndUpdatedAt"),
             index("curationStatusKey").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusKeyAndUpdatedAt"),
             index("reviewedFeedKey").sortKeys(["updatedAt"]).queryField("listReferencesByReviewedFeedAndUpdatedAt"),
+            index("discoveredByMonitorId").sortKeys(["createdAt"]).queryField("listReferencesByMonitorAndCreatedAt"),
+            index("feedStateKey").sortKeys(["predictionSortKey"]).queryField("listReferencesByFeedStateAndPrediction"),
+            index("feedStateKey").sortKeys(["feedArrivalAt"]).queryField("listReferencesByFeedStateAndArrival"),
         ])
             .authorization((allow) => [
             allow.groups(categoryWriteGroups).to(["read"]),
@@ -1567,6 +1593,9 @@ function buildBaseDefinitions(includeEditions) {
             authorSub: a.string(),
             authorUserProfileId: a.id(),
             authorLabel: a.string(),
+            editedAt: a.datetime(),
+            deletedAt: a.datetime(),
+            deletedBySub: a.string(),
             threadId: a.id(),
             parentMessageId: a.id(),
             sequenceNumber: a.integer(),
@@ -1601,19 +1630,24 @@ function buildBaseDefinitions(includeEditions) {
             index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
         ])
             .authorization((allow) => [
-            allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+            // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+            // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+            allow.group("editor").to(["read"]),
+            allow.group(adminGroup).to(["read"]),
         ]),
         MessageThread: realtimeModel({
             id: a.id().required(),
             threadKind: a.string().required(),
             status: a.string().required(),
-            title: a.string().required(),
+            // The title and the creator are set when a conversation is created and read afterwards; a title changes only through
+            // renameThread (its creator or an admin), and the creator never changes.
+            title: a.string().required().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
             summary: a.string(),
             primaryAnchorKind: a.string(),
             primaryAnchorId: a.id(),
             primaryAnchorLineageId: a.id(),
             primaryAnchorKey: a.string(),
-            createdBySub: a.string(),
+            createdBySub: a.string().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
             createdByUserProfileId: a.id(),
             createdByLabel: a.string(),
             messageCount: a.integer(),
@@ -2098,6 +2132,7 @@ function buildBaseDefinitions(includeEditions) {
         ...monitoringViewSchemaDefinitions,
         ...automationViewSchemaDefinitions,
         ...proposalActionsSchemaDefinitions,
+        ...messageActionsSchemaDefinitions,
     };
     if (!includeEditions) {
         const mutableDefinitions = definitions;