@anthusai/papyrus 5.43.0 → 5.44.0

package/components/proposals-panel.tsx

@@ -2,21 +2,20 @@
 
 import { generateClient } from "aws-amplify/data";
 import amplifyOutputs from "papyrus-amplify-outputs";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { ProposalsView } from "./proposals-view";
 import { pluginSettings, type PluginOutputs } from "../lib/plugin-settings";
 import {
-  EDIT_PROPOSAL,
   LIST_PROPOSALS,
-  TRANSITION_PROPOSAL,
+  filterProposals,
   proposalReceiptMessage,
   type ProposalFilter,
   type ProposalMove,
-  type ProposalReceipt,
   type ProposalRow,
 } from "../lib/proposals-admin";
+import { performProposalMove } from "../lib/proposals-client";
 
-type GraphResult = { data?: Record<string, { items?: ProposalRow[]; nextToken?: string | null } | ProposalReceipt | null>; errors?: { message?: string }[] };
+type GraphResult = { data?: Record<string, { items?: ProposalRow[]; nextToken?: string | null } | null>; errors?: { message?: string }[] };
 const MAXIMUM_PAGES = 20;
 
 async function loadProposals(): Promise<ProposalRow[]> {
@@ -34,24 +33,6 @@ async function loadProposals(): Promise<ProposalRow[]> {
   return rows;
 }
 
-async function run(query: string, field: string, variables: Record<string, string | undefined>): Promise<ProposalReceipt> {
-  const client = generateClient({ authMode: "userPool" });
-  const result = (await client.graphql({ query, variables })) as GraphResult;
-  if (result.errors?.length) return { status: "refused", message: result.errors[0]?.message ?? "The action failed." };
-  return (result.data?.[field] as ProposalReceipt | null) ?? { status: "refused", message: "The action did not answer." };
-}
-
-/** One button: a path of states is one `transitionProposal` call per state, stopping at the first refusal; pin and hold are `editProposal`. */
-async function perform(proposalId: string, move: ProposalMove, reason: string): Promise<ProposalReceipt> {
-  if (move.edit) return run(EDIT_PROPOSAL, "editProposal", { proposalId, action: move.edit });
-  let receipt: ProposalReceipt = { status: "refused", message: "Nothing to do." };
-  for (const state of move.path ?? []) {
-    receipt = await run(TRANSITION_PROPOSAL, "transitionProposal", { proposalId, state, ...(reason ? { reason } : {}) });
-    if (receipt.status !== "ok") break;
-  }
-  return receipt;
-}
-
 /** Core to every site: it does not depend on the reader-steering plugin. */
 export function ProposalsPanel() {
   const [rows, setRows] = useState<ProposalRow[]>([]);
@@ -59,6 +40,8 @@ export function ProposalsPanel() {
   const [status, setStatus] = useState("Loading...");
   const [busy, setBusy] = useState(false);
   const [reason, setReason] = useState("");
+  const [focusId, setFocusId] = useState<string | null>(null);
+  const focused = useRef(false);
   const readers = useMemo(() => pluginSettings(amplifyOutputs as PluginOutputs, "reader-steering") !== null, []);
 
   const refresh = useCallback(async (quiet = false) => {
@@ -77,12 +60,25 @@ export function ProposalsPanel() {
     void refresh();
   }, [refresh]);
 
+  // Sent here by a link such as `?proposal=<id>`: show the view that holds it and scroll to it.
+  useEffect(() => {
+    setFocusId(new URLSearchParams(window.location.search).get("proposal"));
+  }, []);
+  useEffect(() => {
+    if (!focusId || focused.current) return;
+    const row = rows.find((candidate) => candidate.id === focusId);
+    if (!row) return;
+    focused.current = true;
+    setFilter(filterProposals([row], "open").length ? "open" : "decided");
+    window.requestAnimationFrame(() => document.getElementById(`proposal-${focusId}`)?.scrollIntoView({ block: "start" }));
+  }, [focusId, rows]);
+
   const onMove = useCallback(
     async (proposalId: string, move: ProposalMove) => {
       setBusy(true);
       setStatus("Working...");
       try {
-        const receipt = await perform(proposalId, move, reason.trim());
+        const receipt = await performProposalMove(proposalId, move, reason.trim());
         setStatus(proposalReceiptMessage(receipt));
         if (receipt.status === "ok") setReason("");
       } catch (error) {
@@ -105,6 +101,7 @@ export function ProposalsPanel() {
       onReason={setReason}
       onMove={(proposalId, move) => void onMove(proposalId, move)}
       onRefresh={() => void refresh()}
+      focusId={focusId}
     />
   );
 }

package/components/proposals-view.tsx

@@ -32,6 +32,8 @@ export type ProposalsViewProps = {
   onReason: (reason: string) => void;
   onMove: (proposalId: string, move: ProposalMove) => void;
   onRefresh: () => void;
+  /** A proposal the editor was sent to (from the Notification Center): its draft opens and it is marked. */
+  focusId?: string | null;
 };
 
 export function ProposalsView(props: ProposalsViewProps) {
@@ -62,7 +64,7 @@ export function ProposalsView(props: ProposalsViewProps) {
       ) : (
         <ul>
           {shown.map((row) => (
-            <li key={row.id} data-proposal-row={row.id}>
+            <li key={row.id} id={`proposal-${row.id}`} data-proposal-row={row.id} data-proposal-focused={props.focusId === row.id || undefined}>
               <article aria-label={row.title}>
                 <p>
                   <strong>{kindLabel(row.kind)}</strong>: {row.title} ({stateLabel(row.state, props.readers)}
@@ -70,7 +72,7 @@ export function ProposalsView(props: ProposalsViewProps) {
                 </p>
                 {row.summary ? <p>{row.summary}</p> : null}
                 {row.body ? (
-                  <details>
+                  <details open={props.focusId === row.id || undefined}>
                     <summary>Read the draft</summary>
                     <pre style={{ whiteSpace: "pre-wrap", overflowWrap: "anywhere" }}>{row.body}</pre>
                   </details>

package/components/reference-review-card.tsx

@@ -44,6 +44,84 @@ function percent(confidence: number | null): string | null {
   return confidence === null ? null : `${Math.round(confidence * 100)}%`;
 }
 
+/**
+ * The Cyclotron's read-only row: its Accept or Reject highlighted with its confidence, and a check or cross once a person has answered.
+ * Shared by the review card and by every list that shows a suggestion before a decision.
+ */
+export function CyclotronRow({ decided = null, prediction }: { decided?: ReviewChoice | null; prediction: CardPrediction }) {
+  const matched = decided && prediction.state === "ready" ? prediction.choice === decided : null;
+  return (
+    <div className="space-y-2" data-review-row="cyclotron">
+      <div className="flex items-center gap-3">
+        <span className="w-20 shrink-0 text-sm font-semibold">Cyclotron</span>
+        {prediction.state === "ready" ? (
+          <div className="flex flex-1 gap-2">
+            {(["accept", "reject"] as const).map((choice) => {
+              const predicted = prediction.state === "ready" && prediction.choice === choice;
+              const verdict = predicted && matched !== null ? (matched ? "match" : "miss") : null;
+              return (
+                <span
+                  className={cn(
+                    "inline-flex min-h-10 flex-1 items-center justify-center gap-1.5 rounded-md border px-3 text-sm",
+                    predicted ? "border-foreground bg-muted font-semibold" : "border-dashed text-muted-foreground",
+                    verdict === "match" && "border-green-700 bg-green-100 text-green-950",
+                    verdict === "miss" && "border-red-700 bg-red-100 text-red-950",
+                  )}
+                  data-cyclotron-choice={choice}
+                  data-predicted={predicted || undefined}
+                  data-verdict={verdict ?? undefined}
+                  key={choice}
+                >
+                  {verdict === "match" ? <CircleCheckIcon aria-hidden="true" className="size-4" /> : null}
+                  {verdict === "miss" ? <CircleXIcon aria-hidden="true" className="size-4" /> : null}
+                  {CHOICE_LABEL[choice]}
+                  {predicted && percent(prediction.confidence) ? <small className="text-xs font-normal">{percent(prediction.confidence)}</small> : null}
+                  {verdict ? <span className="sr-only">{verdict === "match" ? ", matches your answer" : ", differs from your answer"}</span> : null}
+                </span>
+              );
+            })}
+          </div>
+        ) : (
+          <p className="text-sm text-muted-foreground" data-cyclotron-state={prediction.state}>
+            {prediction.state === "loading" ? "Loading…" : prediction.state === "error" ? "Prediction unavailable" : "No prediction"}
+          </p>
+        )}
+      </div>
+    </div>
+  );
+}
+
+/** The two answers, large enough to tap: Accept and Reject, the chosen one filled and checked (never colour alone). */
+export function ChoiceButtons({ chosen, disabled = false, onChoose }: { chosen: ReviewChoice | null; disabled?: boolean; onChoose: (choice: ReviewChoice) => void }) {
+  return (
+    <div className="flex flex-1 gap-2">
+      {(["accept", "reject"] as const).map((choice) => {
+        const on = chosen === choice;
+        return (
+          <Button
+            aria-disabled={disabled ? true : undefined}
+            aria-pressed={on}
+            className="min-h-14 flex-1 text-base"
+            data-review-choice={choice}
+            key={choice}
+            onClick={() => onChoose(choice)}
+            type="button"
+            variant={on ? (choice === "accept" ? "default" : "destructive") : "outline"}
+          >
+            {on ? <CheckIcon aria-hidden="true" className="size-5" /> : null}
+            {CHOICE_LABEL[choice]}
+          </Button>
+        );
+      })}
+    </div>
+  );
+}
+
+/** A reference's relevance decision in the card's own vocabulary. */
+export function predictionFromDecision(decision: { label: string; positiveLabel: string | null; confidence: number | null }): CardPrediction {
+  return { state: "ready", choice: decision.label === (decision.positiveLabel ?? "include") ? "accept" : "reject", confidence: decision.confidence };
+}
+
 /**
  * One reusable card for answering a single question: Accept or Reject. The Cyclotron's row is
  * read-only; the human row is the real control and its answer is final. Saves on tap.
@@ -156,12 +234,6 @@ export function ReviewCard({
     return () => window.removeEventListener("keydown", onKey);
   });
 
-  const predictedMarker = (choice: ReviewChoice) => {
-    if (prediction.state !== "ready" || prediction.choice !== choice) return null;
-    return prediction.choice;
-  };
-  const matched = decided && prediction.state === "ready" ? prediction.choice === decided : null;
-
   return (
     <section aria-label="Review" className="space-y-4" data-review-card={itemId}>
       <header className="space-y-1">
@@ -175,67 +247,12 @@ export function ReviewCard({
         {summary ? <p className="text-sm text-muted-foreground">{summary}</p> : null}
       </header>
 
-      <div className="space-y-2" data-review-row="cyclotron">
-        <div className="flex items-center gap-3">
-          <span className="w-20 shrink-0 text-sm font-semibold">Cyclotron</span>
-          {prediction.state === "ready" ? (
-            <div className="flex flex-1 gap-2">
-              {(["accept", "reject"] as const).map((choice) => {
-                const predicted = predictedMarker(choice) !== null;
-                const verdict = predicted && matched !== null ? (matched ? "match" : "miss") : null;
-                return (
-                  <span
-                    className={cn(
-                      "inline-flex min-h-10 flex-1 items-center justify-center gap-1.5 rounded-md border px-3 text-sm",
-                      predicted ? "border-foreground bg-muted font-semibold" : "border-dashed text-muted-foreground",
-                      verdict === "match" && "border-green-700 bg-green-100 text-green-950",
-                      verdict === "miss" && "border-red-700 bg-red-100 text-red-950",
-                    )}
-                    data-cyclotron-choice={choice}
-                    data-predicted={predicted || undefined}
-                    data-verdict={verdict ?? undefined}
-                    key={choice}
-                  >
-                    {verdict === "match" ? <CircleCheckIcon aria-hidden="true" className="size-4" /> : null}
-                    {verdict === "miss" ? <CircleXIcon aria-hidden="true" className="size-4" /> : null}
-                    {CHOICE_LABEL[choice]}
-                    {predicted && percent(prediction.confidence) ? <small className="text-xs font-normal">{percent(prediction.confidence)}</small> : null}
-                    {verdict ? <span className="sr-only">{verdict === "match" ? ", matches your answer" : ", differs from your answer"}</span> : null}
-                  </span>
-                );
-              })}
-            </div>
-          ) : (
-            <p className="text-sm text-muted-foreground" data-cyclotron-state={prediction.state}>
-              {prediction.state === "loading" ? "Loading…" : prediction.state === "error" ? "Prediction unavailable" : "No prediction"}
-            </p>
-          )}
-        </div>
-      </div>
+      <CyclotronRow decided={decided} prediction={prediction} />
 
       <div className="space-y-2" data-review-row="you">
         <div className="flex items-center gap-3">
           <span className="w-20 shrink-0 text-sm font-semibold">You</span>
-          <div className="flex flex-1 gap-2">
-            {(["accept", "reject"] as const).map((choice) => {
-              const on = chosen === choice;
-              return (
-                <Button
-                  aria-disabled={disabledReason ? true : undefined}
-                  aria-pressed={on}
-                  className="min-h-14 flex-1 text-base"
-                  data-review-choice={choice}
-                  key={choice}
-                  onClick={() => choose(choice)}
-                  type="button"
-                  variant={on ? (choice === "accept" ? "default" : "destructive") : "outline"}
-                >
-                  {on ? <CheckIcon aria-hidden="true" className="size-5" /> : null}
-                  {CHOICE_LABEL[choice]}
-                </Button>
-              );
-            })}
-          </div>
+          <ChoiceButtons chosen={chosen} disabled={Boolean(disabledReason)} onChoose={choose} />
         </div>
         <div className="min-h-5 pl-[5.75rem] text-sm" role="status">
           {saving ? "Saving…" : saved ? (

package/infra/amplify-app-shell.js

@@ -6,10 +6,26 @@ import { addCloudEmail } from "./cloud-email.js";
 import { parseCloudEmail } from "./cloud-email-config.js";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveChatStackName, chatExportName, CHAT_EXPORTED_RESOURCES, CHAT_ENVIRONMENT_NAMES, CHAT_PRIVATE_ASSISTANT_ID, CHAT_PRIVATE_ASSISTANT_NAME, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
+/**
+ * The production branch's private chat environment. Only a site with an enabled `chat` block gets the flag and the
+ * resource names (imported from the chat data stack's exports, so that stack must be deployed first); every other
+ * site keeps the flag "false" and no chat variables, and its newsroom serves neither the chat route nor the UI.
+ */
+function chatEnvironment(config) {
+    const chatStackName = resolveChatStackName(config);
+    if (!chatStackName)
+        return { PAPYRUS_PRIVATE_CHAT_ENABLED: "false" };
+    return {
+        PAPYRUS_PRIVATE_CHAT_ENABLED: "true",
+        ...Object.fromEntries(CHAT_EXPORTED_RESOURCES.map((resource) => [CHAT_ENVIRONMENT_NAMES[resource], Fn.importValue(chatExportName(chatStackName, resource))])),
+        PAPYRUS_CHAT_PRIVATE_BOT_ID: CHAT_PRIVATE_ASSISTANT_ID,
+        PAPYRUS_CHAT_PRIVATE_BOT_NAME: CHAT_PRIVATE_ASSISTANT_NAME,
+    };
+}
 function readerCustomHeaders(rules) {
     if (!rules)
         return undefined;
@@ -199,7 +215,7 @@ export class AmplifyAppShellStack extends Stack {
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
                 ...emailEnvironment,
-                PAPYRUS_PRIVATE_CHAT_ENABLED: config.cms.environment.PAPYRUS_PRIVATE_CHAT_ENABLED ?? "false",
+                ...(config.chat?.enabled ? chatEnvironment(config) : { PAPYRUS_PRIVATE_CHAT_ENABLED: config.cms.environment.PAPYRUS_PRIVATE_CHAT_ENABLED ?? "false" }),
                 PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
                 ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,

package/infra/amplify-app-shell.ts

@@ -7,12 +7,28 @@ import { addCloudEmail } from "./cloud-email";
 import { parseCloudEmail } from "./cloud-email-config";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveChatStackName, chatExportName, CHAT_EXPORTED_RESOURCES, CHAT_ENVIRONMENT_NAMES, CHAT_PRIVATE_ASSISTANT_ID, CHAT_PRIVATE_ASSISTANT_NAME, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
 
+/**
+ * The production branch's private chat environment. Only a site with an enabled `chat` block gets the flag and the
+ * resource names (imported from the chat data stack's exports, so that stack must be deployed first); every other
+ * site keeps the flag "false" and no chat variables, and its newsroom serves neither the chat route nor the UI.
+ */
+function chatEnvironment(config: AmplifyAppShellSiteConfig): Record<string, string> {
+  const chatStackName = resolveChatStackName(config);
+  if (!chatStackName) return { PAPYRUS_PRIVATE_CHAT_ENABLED: "false" };
+  return {
+    PAPYRUS_PRIVATE_CHAT_ENABLED: "true",
+    ...Object.fromEntries(CHAT_EXPORTED_RESOURCES.map((resource) => [CHAT_ENVIRONMENT_NAMES[resource], Fn.importValue(chatExportName(chatStackName, resource))])),
+    PAPYRUS_CHAT_PRIVATE_BOT_ID: CHAT_PRIVATE_ASSISTANT_ID,
+    PAPYRUS_CHAT_PRIVATE_BOT_NAME: CHAT_PRIVATE_ASSISTANT_NAME,
+  };
+}
+
 function readerCustomHeaders(rules: ReaderCustomHeaderRule[] | undefined): string | undefined {
   if (!rules) return undefined;
   const lines = ["customHeaders:"];
@@ -221,7 +237,7 @@ export class AmplifyAppShellStack extends Stack {
       environmentVariables: environmentVariables({
         ...config.cms.environment,
         ...emailEnvironment,
-        PAPYRUS_PRIVATE_CHAT_ENABLED: config.cms.environment.PAPYRUS_PRIVATE_CHAT_ENABLED ?? "false",
+        ...(config.chat?.enabled ? chatEnvironment(config) : { PAPYRUS_PRIVATE_CHAT_ENABLED: config.cms.environment.PAPYRUS_PRIVATE_CHAT_ENABLED ?? "false" }),
         PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
         ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
         PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,

package/infra/chat-stack.js

@@ -0,0 +1,222 @@
+import { Annotations, Arn, ArnFormat, Aws, CfnOutput, CfnParameter, Duration, Fn, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as eventSources from "aws-cdk-lib/aws-lambda-event-sources";
+import * as logs from "aws-cdk-lib/aws-logs";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { CHAT_PRIVATE_ASSISTANT_ID, CHAT_PRIVATE_ASSISTANT_NAME, chatExportName, resolveChatLogGroupPrefix, resolveChatStackName, } from "./site-config.js";
+/**
+ * The private newsroom chat data plane of one publication: two DynamoDB tables, a private versioned S3 bucket, run
+ * and probe queues with DLQs, and the two worker Lambdas with their event source mappings. The CMS compute role
+ * receives the scoped gateway policy through the `GatewayRoleArn` parameter (the app shell's `CmsComputeRoleArn`
+ * output), and the app shell reads the resource names back through this stack's exports.
+ *
+ * The resource definitions are the ones the first activated stack `PapyrusChatDataCandidate` was activated from
+ * (infra/shared-chat-runtime/cdk/synth.cjs); logical ids and construct order are kept so that stack is adopted by an
+ * in-place update (scripts/test-infra-chat.ts compares the two templates).
+ */
+export class PapyrusChatStack extends Stack {
+    constructor(scope, props) {
+        const { config, lambdaAssetDirectory, ...stackProps } = props;
+        const chat = config.chat;
+        const stackName = resolveChatStackName(config);
+        if (!chat || !stackName)
+            throw new Error(`site ${config.siteId} does not enable chat`);
+        // The construct id is the stack name: the SQS event source mapping logical ids derive from it.
+        super(scope, stackName, { ...stackProps, stackName });
+        const modelKeyParameter = chat.modelKeyParameter;
+        const logGroupPrefix = resolveChatLogGroupPrefix(config);
+        const gatewayRoleArn = new CfnParameter(this, "GatewayRoleArn", {
+            type: "String",
+            description: "The site's CMS compute role ARN (CmsComputeRoleArn output of the app-shell stack); receives the scoped gateway policy.",
+            allowedPattern: "^arn:aws:iam::[0-9]{12}:role/.+$",
+        });
+        const privateBotId = new CfnParameter(this, "PrivateAssistantBotId", {
+            type: "String",
+            default: CHAT_PRIVATE_ASSISTANT_ID,
+            description: "Stable Papyrus-owned assistant ID; stored per derived account tenant on first private-channel open.",
+            allowedPattern: "^[A-Za-z0-9][A-Za-z0-9_-]{1,63}$",
+        });
+        const privateBotName = new CfnParameter(this, "PrivateAssistantBotName", {
+            type: "String",
+            default: CHAT_PRIVATE_ASSISTANT_NAME,
+            description: "Visible name for the private Papyrus assistant.",
+            allowedPattern: "^[A-Za-z0-9][A-Za-z0-9 ._-]{1,63}$",
+        });
+        const messaging = new dynamodb.Table(this, "PrivateMessaging", {
+            partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+            sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+            timeToLiveAttribute: "expires_at",
+            pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+            deletionProtection: true,
+            removalPolicy: RemovalPolicy.RETAIN,
+        });
+        const conversations = new dynamodb.Table(this, "PrivateConversationIndex", {
+            partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+            sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+            pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+            deletionProtection: true,
+            removalPolicy: RemovalPolicy.RETAIN,
+        });
+        for (const name of ["l1", "l2", "l3"]) {
+            conversations.addLocalSecondaryIndex({
+                indexName: `${name}-index`,
+                sortKey: { name, type: dynamodb.AttributeType.STRING },
+                projectionType: dynamodb.ProjectionType.ALL,
+            });
+        }
+        const objects = new s3.Bucket(this, "PrivateSessionObjects", {
+            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+            encryption: s3.BucketEncryption.S3_MANAGED,
+            enforceSSL: true,
+            versioned: true,
+            removalPolicy: RemovalPolicy.RETAIN,
+            objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_ENFORCED,
+        });
+        const queue = (id, extra = {}) => new sqs.Queue(this, id, { encryption: sqs.QueueEncryption.SQS_MANAGED, enforceSSL: true, ...extra });
+        const runDlq = queue("TurnRunDlq", { retentionPeriod: Duration.days(14) });
+        const probeDlq = queue("TurnProbeDlq", { retentionPeriod: Duration.days(14) });
+        const runs = queue("TurnRuns", {
+            visibilityTimeout: Duration.seconds(1800),
+            retentionPeriod: Duration.days(4),
+            deadLetterQueue: { queue: runDlq, maxReceiveCount: 5 },
+        });
+        const probes = queue("TurnProbes", {
+            visibilityTimeout: Duration.minutes(2),
+            retentionPeriod: Duration.days(4),
+            deadLetterQueue: { queue: probeDlq, maxReceiveCount: 5 },
+        });
+        const gateway = iam.Role.fromRoleArn(this, "PapyrusChatGatewayRole", gatewayRoleArn.valueAsString, { mutable: true });
+        gateway.addToPrincipalPolicy(new iam.PolicyStatement({
+            actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:TransactWriteItems", "dynamodb:Query", "dynamodb:BatchGetItem"],
+            resources: [messaging.tableArn],
+        }));
+        gateway.addToPrincipalPolicy(new iam.PolicyStatement({
+            actions: ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:BatchGetItem"],
+            resources: [conversations.tableArn, `${conversations.tableArn}/index/*`],
+        }));
+        gateway.addToPrincipalPolicy(new iam.PolicyStatement({ actions: ["s3:GetObject"], resources: [objects.arnForObjects("conversations/*")] }));
+        gateway.addToPrincipalPolicy(new iam.PolicyStatement({ actions: ["sqs:SendMessage"], resources: [runs.queueArn, probes.queueArn] }));
+        // Appended last, as in the activated stack's policy (the transaction-check correction was added to it afterwards).
+        gateway.addToPrincipalPolicy(new iam.PolicyStatement({ actions: ["dynamodb:ConditionCheckItem"], resources: [messaging.tableArn] }));
+        const hostedEnvironment = {
+            PAPYRUS_CHAT_MESSAGING_TABLE: messaging.tableName,
+            PAPYRUS_CHAT_CONVERSATIONS_TABLE: conversations.tableName,
+            PAPYRUS_CHAT_SESSION_BUCKET: objects.bucketName,
+            PAPYRUS_CHAT_TURN_RUNS_QUEUE_URL: runs.queueUrl,
+            PAPYRUS_CHAT_TURN_PROBES_QUEUE_URL: probes.queueUrl,
+            PAPYRUS_CHAT_PRIVATE_BOT_ID: privateBotId.valueAsString,
+            PAPYRUS_CHAT_PRIVATE_BOT_NAME: privateBotName.valueAsString,
+        };
+        const runLogGroup = new logs.LogGroup(this, "RunWorkerLogs", {
+            logGroupName: `${logGroupPrefix}-run-worker`,
+            retention: logs.RetentionDays.ONE_MONTH,
+            removalPolicy: RemovalPolicy.RETAIN,
+        });
+        const probeLogGroup = new logs.LogGroup(this, "ProbeWorkerLogs", {
+            logGroupName: `${logGroupPrefix}-probe-worker`,
+            retention: logs.RetentionDays.ONE_MONTH,
+            removalPolicy: RemovalPolicy.RETAIN,
+        });
+        const runWorker = new iam.Role(this, "RunWorkerRole", {
+            assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+            description: "Private Papyrus computerless chat run worker.",
+        });
+        runWorker.addToPolicy(new iam.PolicyStatement({
+            actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:BatchGetItem", "dynamodb:TransactWriteItems"],
+            resources: [messaging.tableArn, conversations.tableArn, `${conversations.tableArn}/index/*`],
+        }));
+        runWorker.addToPolicy(new iam.PolicyStatement({
+            actions: ["ssm:GetParameter"],
+            // Pseudo parameters, not the literal account: the template stays environment-agnostic like the activated stack.
+            resources: [Arn.format({ partition: Aws.PARTITION, region: Aws.REGION, account: Aws.ACCOUNT_ID, service: "ssm", resource: "parameter", resourceName: modelKeyParameter.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME })],
+        }));
+        runWorker.addToPolicy(new iam.PolicyStatement({ actions: ["logs:CreateLogStream", "logs:PutLogEvents"], resources: [`${runLogGroup.logGroupArn}:*`] }));
+        runWorker.addToPolicy(new iam.PolicyStatement({
+            actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+            resources: [objects.arnForObjects("conversations/*")],
+        }));
+        runWorker.addToPolicy(new iam.PolicyStatement({ actions: ["sqs:ChangeMessageVisibility", "sqs:SendMessage"], resources: [runs.queueArn, probes.queueArn] }));
+        const probeWorker = new iam.Role(this, "ProbeWorkerRole", {
+            assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+            description: "Private Papyrus chat deadline/recovery worker.",
+        });
+        probeWorker.addToPolicy(new iam.PolicyStatement({
+            actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:TransactWriteItems", "dynamodb:BatchGetItem"],
+            resources: [messaging.tableArn],
+        }));
+        probeWorker.addToPolicy(new iam.PolicyStatement({
+            actions: ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:BatchGetItem"],
+            resources: [conversations.tableArn, `${conversations.tableArn}/index/*`],
+        }));
+        probeWorker.addToPolicy(new iam.PolicyStatement({ actions: ["s3:GetObject"], resources: [objects.arnForObjects("conversations/*")] }));
+        probeWorker.addToPolicy(new iam.PolicyStatement({ actions: ["sqs:SendMessage"], resources: [runs.queueArn, probes.queueArn] }));
+        probeWorker.addToPolicy(new iam.PolicyStatement({ actions: ["logs:CreateLogStream", "logs:PutLogEvents"], resources: [`${probeLogGroup.logGroupArn}:*`] }));
+        let code;
+        if (chat.workerCodeS3Key) {
+            // Already uploaded and verified bytes: the template names the object, nothing is bundled or uploaded.
+            const assets = s3.Bucket.fromBucketName(this, "WorkerCodeAssets", Fn.sub("cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"));
+            code = lambda.Code.fromBucket(assets, chat.workerCodeS3Key);
+            Annotations.of(assets).acknowledgeWarning("@aws-cdk/aws-lambda:codeFromBucketObjectVersionNotSpecified", "the key is a content hash; it is never overwritten");
+        }
+        else {
+            if (!lambdaAssetDirectory)
+                throw new Error(`site ${config.siteId}: bundle the chat workers first (scripts/bundle-chat-lambdas.mjs) and pass -c chatLambdas=<dir>, or pin chat.workerCodeS3Key`);
+            code = lambda.Code.fromAsset(lambdaAssetDirectory);
+        }
+        const runWorkerFunction = new lambda.Function(this, "RunWorker", {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            handler: "run-worker.handler",
+            code,
+            role: runWorker,
+            memorySize: 1024,
+            timeout: Duration.seconds(900),
+            logGroup: runLogGroup,
+            environment: { ...hostedEnvironment, OPENAI_API_KEY_PARAMETER: modelKeyParameter },
+            description: "Runs Papyrus private chat turns with the computerless Chatticus execution profile.",
+        });
+        const probeWorkerFunction = new lambda.Function(this, "ProbeWorker", {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            handler: "probe-worker.handler",
+            code,
+            role: probeWorker,
+            memorySize: 512,
+            timeout: Duration.seconds(60),
+            logGroup: probeLogGroup,
+            environment: hostedEnvironment,
+            description: "Recovers and finalizes Papyrus private chat turns.",
+        });
+        // The model key parameter exists for every configured site, so the workers run from the first deploy.
+        runWorkerFunction.addEventSource(new eventSources.SqsEventSource(runs, { enabled: true, batchSize: 1 }));
+        probeWorkerFunction.addEventSource(new eventSources.SqsEventSource(probes, { enabled: true, batchSize: 1 }));
+        // Last, as in the activated stack (the storage-owner fence was added after the event source grants).
+        runWorker.addToPolicy(new iam.PolicyStatement({ actions: ["dynamodb:ConditionCheckItem"], resources: [conversations.tableArn] }));
+        const exported = (id, value, exportKey) => new CfnOutput(this, id, { value, ...(exportKey ? { exportName: chatExportName(stackName, exportKey) } : {}) });
+        exported("MessagingTableName", messaging.tableName, "MessagingTableName");
+        exported("ConversationIndexTableName", conversations.tableName, "ConversationIndexTableName");
+        exported("SessionBucketName", objects.bucketName, "SessionBucketName");
+        exported("TurnRunsQueueUrl", runs.queueUrl, "TurnRunsQueueUrl");
+        exported("TurnProbesQueueUrl", probes.queueUrl, "TurnProbesQueueUrl");
+        exported("FeatureDefault", "enabled per site by the chat block of its site.json (PAPYRUS_PRIVATE_CHAT_ENABLED on the CMS production branch)");
+        exported("SyntheticAdapterTestOnly", "false");
+        exported("GatewayMessagingTableEnvironmentName", "PAPYRUS_CHAT_MESSAGING_TABLE");
+        exported("GatewayMessagingTableName", messaging.tableName);
+        exported("GatewayConversationTableEnvironmentName", "PAPYRUS_CHAT_CONVERSATIONS_TABLE");
+        exported("GatewayConversationTableName", conversations.tableName);
+        exported("GatewaySessionBucketEnvironmentName", "PAPYRUS_CHAT_SESSION_BUCKET");
+        exported("GatewaySessionBucketName", objects.bucketName);
+        exported("GatewayRunQueueEnvironmentName", "PAPYRUS_CHAT_TURN_RUNS_QUEUE_URL");
+        exported("GatewayProbeQueueEnvironmentName", "PAPYRUS_CHAT_TURN_PROBES_QUEUE_URL");
+        exported("GatewayPrivateBotIdEnvironmentName", "PAPYRUS_CHAT_PRIVATE_BOT_ID");
+        exported("PrivateAssistantBotIdValue", privateBotId.valueAsString);
+        exported("GatewayPrivateBotNameEnvironmentName", "PAPYRUS_CHAT_PRIVATE_BOT_NAME");
+        exported("PrivateAssistantBotNameValue", privateBotName.valueAsString);
+        exported("WorkerModelKeyParameterName", modelKeyParameter);
+        exported("RunWorkerFunctionName", runWorkerFunction.functionName);
+        exported("ProbeWorkerFunctionName", probeWorkerFunction.functionName);
+    }
+}