@anthusai/papyrus 5.58.0 → 5.59.0

package/amplify/data/message-actions.js

@@ -0,0 +1,68 @@
+import { a } from "@aws-amplify/backend";
+/**
+ * Messages belong to their author, and the backend says so. The browser cannot create, edit or delete a Message through the
+ * model (editors and admins only read it); it calls these four mutations, whose resolvers stamp the author from the signed-in
+ * identity and check ownership against the stored `authorSub` in the same DynamoDB write. `renameThread` does the same for a
+ * conversation's title. Functions and IAM callers (the router, procedures, the console responder, email, Slack) write the
+ * model directly with their own grants, as before.
+ *
+ * Each resolver is one self-contained file (AppSync takes a single file and offers `@aws-appsync/utils` only).
+ */
+const people = (allow) => [allow.group("editor"), allow.group("admin")];
+const adminsOnly = (allow) => [allow.group("admin")];
+const onMessages = (entry) => a.handler.custom({ dataSource: a.ref("Message"), entry });
+const onThreads = (entry) => a.handler.custom({ dataSource: a.ref("MessageThread"), entry });
+export const messageActionsSchemaDefinitions = {
+    postMessage: a
+        .mutation()
+        .arguments({
+        id: a.id().required(),
+        threadId: a.id().required(),
+        content: a.string(),
+        summary: a.string(),
+        parentMessageId: a.id(),
+        sequenceNumber: a.integer(),
+        messageKind: a.string().required(),
+        messageDomain: a.string().required(),
+        messageType: a.string(),
+        role: a.string(),
+        source: a.string(),
+        authorLabel: a.string(),
+        semanticLayer: a.string(),
+        searchVisibility: a.string(),
+        responseTarget: a.string(),
+        responseStatus: a.string(),
+        responseOwner: a.string(),
+        responseStartedAt: a.datetime(),
+        responseCompletedAt: a.datetime(),
+        metadata: a.json(),
+        newsroomFeedKey: a.string(),
+    })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/post-message.js")),
+    editMessage: a
+        .mutation()
+        .arguments({ id: a.id().required(), content: a.string().required(), summary: a.string() })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/edit-message.js")),
+    deleteOwnMessage: a
+        .mutation()
+        .arguments({ id: a.id().required() })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/delete-own-message.js")),
+    moderateMessage: a
+        .mutation()
+        .arguments({ id: a.id().required() })
+        .returns(a.ref("Message"))
+        .authorization(adminsOnly)
+        .handler(onMessages("./resolvers/moderate-message.js")),
+    renameThread: a
+        .mutation()
+        .arguments({ id: a.id().required(), title: a.string().required() })
+        .returns(a.ref("MessageThread"))
+        .authorization(people)
+        .handler(onThreads("./resolvers/rename-thread.js")),
+};

package/amplify/data/message-actions.ts

@@ -0,0 +1,70 @@
+import { a } from "@aws-amplify/backend";
+
+/**
+ * Messages belong to their author, and the backend says so. The browser cannot create, edit or delete a Message through the
+ * model (editors and admins only read it); it calls these four mutations, whose resolvers stamp the author from the signed-in
+ * identity and check ownership against the stored `authorSub` in the same DynamoDB write. `renameThread` does the same for a
+ * conversation's title. Functions and IAM callers (the router, procedures, the console responder, email, Slack) write the
+ * model directly with their own grants, as before.
+ *
+ * Each resolver is one self-contained file (AppSync takes a single file and offers `@aws-appsync/utils` only).
+ */
+const people = (allow: any) => [allow.group("editor"), allow.group("admin")];
+const adminsOnly = (allow: any) => [allow.group("admin")];
+const onMessages = (entry: string) => a.handler.custom({ dataSource: a.ref("Message"), entry });
+const onThreads = (entry: string) => a.handler.custom({ dataSource: a.ref("MessageThread"), entry });
+
+export const messageActionsSchemaDefinitions = {
+  postMessage: a
+    .mutation()
+    .arguments({
+      id: a.id().required(),
+      threadId: a.id().required(),
+      content: a.string(),
+      summary: a.string(),
+      parentMessageId: a.id(),
+      sequenceNumber: a.integer(),
+      messageKind: a.string().required(),
+      messageDomain: a.string().required(),
+      messageType: a.string(),
+      role: a.string(),
+      source: a.string(),
+      authorLabel: a.string(),
+      semanticLayer: a.string(),
+      searchVisibility: a.string(),
+      responseTarget: a.string(),
+      responseStatus: a.string(),
+      responseOwner: a.string(),
+      responseStartedAt: a.datetime(),
+      responseCompletedAt: a.datetime(),
+      metadata: a.json(),
+      newsroomFeedKey: a.string(),
+    })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/post-message.js")),
+  editMessage: a
+    .mutation()
+    .arguments({ id: a.id().required(), content: a.string().required(), summary: a.string() })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/edit-message.js")),
+  deleteOwnMessage: a
+    .mutation()
+    .arguments({ id: a.id().required() })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/delete-own-message.js")),
+  moderateMessage: a
+    .mutation()
+    .arguments({ id: a.id().required() })
+    .returns(a.ref("Message"))
+    .authorization(adminsOnly)
+    .handler(onMessages("./resolvers/moderate-message.js")),
+  renameThread: a
+    .mutation()
+    .arguments({ id: a.id().required(), title: a.string().required() })
+    .returns(a.ref("MessageThread"))
+    .authorization(people)
+    .handler(onThreads("./resolvers/rename-thread.js")),
+};

package/amplify/data/resolvers/delete-own-message.js

@@ -0,0 +1,30 @@
+// deleteOwnMessage: the author deletes their own Message. A soft delete: the Message stays (replies keep their place) marked
+// deleted, with when and by whom. Nothing is removed.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to delete a message.", "Unauthorized");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      status: ddb.operations.replace("deleted"),
+      deletedAt: ddb.operations.replace(now),
+      deletedBySub: ddb.operations.replace(identity.sub),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { authorSub: { eq: identity.sub }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the author can delete their own message, and it may already be deleted.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/edit-message.js

@@ -0,0 +1,33 @@
+// editMessage: a person changes the text of their own Message, and no one else's. The condition is checked by DynamoDB against the
+// stored authorSub in the same write, so there is no window between the check and the change. A deleted Message cannot be edited.
+// Authorship cannot be reassigned: the update never touches authorSub.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to edit a message.", "Unauthorized");
+  const content = typeof ctx.args.content === "string" ? ctx.args.content.trim() : "";
+  if (!content) util.error("A message cannot be empty.", "BadRequest");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      content: ddb.operations.replace(content),
+      summary: ddb.operations.replace(ctx.args.summary ? ctx.args.summary : content.slice(0, 120)),
+      editedAt: ddb.operations.replace(now),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { authorSub: { eq: identity.sub }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the author can edit a message, and a deleted message cannot be edited.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/moderate-message.js

@@ -0,0 +1,32 @@
+// moderateMessage: an admin removes anyone's Message. The same soft delete as the author's, with no change to the text, and only
+// for the admin group (checked here as well as by the mutation's authorization).
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to moderate a message.", "Unauthorized");
+  const groups = identity.groups || [];
+  if (groups.indexOf("admin") < 0) util.error("Only an admin can delete someone else's message.", "Unauthorized");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      status: ddb.operations.replace("deleted"),
+      deletedAt: ddb.operations.replace(now),
+      deletedBySub: ddb.operations.replace(identity.sub),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { id: { attributeExists: true }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("That message does not exist or is already deleted.", "NotFound");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/post-message.js

@@ -0,0 +1,68 @@
+// postMessage: the only way a person's Message is created. The author is the signed-in user (the identity's sub), whatever the
+// client sends: the mutation has no author argument, and a label is only a label. One DynamoDB PutItem that refuses to replace an
+// existing Message (ids are derived from the sequence number, so a lost race comes back as a conflict the caller retries).
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+function clean(value) {
+  const out = {};
+  const keys = Object.keys(value);
+  for (let index = 0; index < keys.length; index++) {
+    const key = keys[index];
+    if (value[key] !== null && value[key] !== undefined) out[key] = value[key];
+  }
+  return out;
+}
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to post a message.", "Unauthorized");
+  const args = ctx.args;
+  const content = typeof args.content === "string" ? args.content.trim() : "";
+  // A placeholder waiting for a responder (PENDING) may start empty; any other message needs text.
+  if (!content && args.responseStatus !== "PENDING") util.error("A message cannot be empty.", "BadRequest");
+  if (!args.id || !args.threadId) util.error("A message needs an id and a conversation.", "BadRequest");
+  const now = util.time.nowISO8601();
+  const claims = identity.claims || {};
+  const email = typeof claims.email === "string" ? claims.email : "";
+  const label = typeof args.authorLabel === "string" && args.authorLabel.trim() ? args.authorLabel.trim() : email ? email : "editor";
+  const item = clean({
+    __typename: "Message",
+    id: args.id,
+    messageKind: args.messageKind,
+    messageDomain: args.messageDomain,
+    status: "active",
+    summary: args.summary ? args.summary : content.slice(0, 120),
+    source: args.source,
+    authorSub: identity.sub,
+    authorLabel: label,
+    threadId: args.threadId,
+    parentMessageId: args.parentMessageId,
+    sequenceNumber: args.sequenceNumber,
+    role: args.role ? args.role : "human",
+    messageType: args.messageType,
+    content: content,
+    semanticLayer: args.semanticLayer,
+    searchVisibility: args.searchVisibility,
+    responseTarget: args.responseTarget,
+    responseStatus: args.responseStatus ? args.responseStatus : "COMPLETED",
+    responseOwner: args.responseOwner,
+    responseStartedAt: args.responseStartedAt,
+    responseCompletedAt: args.responseCompletedAt,
+    metadata: args.metadata,
+    createdAt: now,
+    updatedAt: now,
+    newsroomFeedKey: args.newsroomFeedKey,
+  });
+  return ddb.put({ key: { id: args.id }, item: item, condition: { id: { attributeExists: false } } });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("A message with this id already exists (conditional check failed); try again.", "Conflict");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/rename-thread.js

@@ -0,0 +1,28 @@
+// renameThread: the person who started a conversation, or an admin, gives it a new title. The browser's own update of a thread
+// cannot change the title (the field is read and create only), so this is the one way. Nothing else about the thread changes.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to rename a conversation.", "Unauthorized");
+  const title = typeof ctx.args.title === "string" ? ctx.args.title.trim() : "";
+  if (!title) util.error("A title cannot be empty.", "BadRequest");
+  const groups = identity.groups || [];
+  const isAdmin = groups.indexOf("admin") >= 0;
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: { title: ddb.operations.replace(title.slice(0, 120)) },
+    condition: isAdmin ? { id: { attributeExists: true } } : { createdBySub: { eq: identity.sub } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the person who started this conversation, or an admin, can rename it.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resource.js

@@ -1575,6 +1575,9 @@ const schema = a.schema({
         curationDecisionRelationId: a.string(),
         newsroomFeedKey: a.string(),
         reviewedFeedKey: a.string(),
+        discoveredByMonitorId: a.string(),
+        discoveryDetails: a.json(),
+        discoveryRule: a.json(),
         // The References page reads the feed through two indexes (docs/reference-feed-indexes.md). `feedStateKey` is
         // "<corpusId>#unrated" or "<corpusId>#rated" for a current, not archived Reference (null otherwise: it is in no feed).
         // `predictionSortKey` orders Best bets, `feedArrivalAt` orders Newest. The prediction is the Cyclotron's ORIGINAL
@@ -1596,6 +1599,7 @@ const schema = a.schema({
         index("curationStatus").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusAndUpdatedAt"),
         index("curationStatusKey").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusKeyAndUpdatedAt"),
         index("reviewedFeedKey").sortKeys(["updatedAt"]).queryField("listReferencesByReviewedFeedAndUpdatedAt"),
+        index("discoveredByMonitorId").sortKeys(["createdAt"]).queryField("listReferencesByMonitorAndCreatedAt"),
         index("feedStateKey").sortKeys(["predictionSortKey"]).queryField("listReferencesByFeedStateAndPrediction"),
         index("feedStateKey").sortKeys(["feedArrivalAt"]).queryField("listReferencesByFeedStateAndArrival"),
     ])
@@ -1722,12 +1726,11 @@ const schema = a.schema({
         index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
         .authorization((allow) => [
-        // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-        allow.group("editor").to(categoryAppendOnlyOperations),
-        allow.group(adminGroup).to(["read", "create", "delete"]),
+        // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+        // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+        allow.group("editor").to(["read"]),
+        allow.group(adminGroup).to(["read"]),
         allow.authenticated("identityPool").to(["read", "create", "update"]),
-        // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-        allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
     MessageThread: a
         .model({

package/amplify/data/resource.ts

@@ -1688,6 +1688,9 @@ const schema = a.schema({
       curationDecisionRelationId: a.string(),
       newsroomFeedKey: a.string(),
       reviewedFeedKey: a.string(),
+      discoveredByMonitorId: a.string(),
+      discoveryDetails: a.json(),
+      discoveryRule: a.json(),
       // The References page reads the feed through two indexes (docs/reference-feed-indexes.md). `feedStateKey` is
       // "<corpusId>#unrated" or "<corpusId>#rated" for a current, not archived Reference (null otherwise: it is in no feed).
       // `predictionSortKey` orders Best bets, `feedArrivalAt` orders Newest. The prediction is the Cyclotron's ORIGINAL
@@ -1709,6 +1712,7 @@ const schema = a.schema({
       index("curationStatus").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusAndUpdatedAt"),
       index("curationStatusKey").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusKeyAndUpdatedAt"),
       index("reviewedFeedKey").sortKeys(["updatedAt"]).queryField("listReferencesByReviewedFeedAndUpdatedAt"),
+      index("discoveredByMonitorId").sortKeys(["createdAt"]).queryField("listReferencesByMonitorAndCreatedAt"),
       index("feedStateKey").sortKeys(["predictionSortKey"]).queryField("listReferencesByFeedStateAndPrediction"),
       index("feedStateKey").sortKeys(["feedArrivalAt"]).queryField("listReferencesByFeedStateAndArrival"),
     ])
@@ -1838,12 +1842,11 @@ const schema = a.schema({
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-      allow.group("editor").to(categoryAppendOnlyOperations),
-      allow.group(adminGroup).to(["read", "create", "delete"]),
+      // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+      // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(["read"]),
       allow.authenticated("identityPool").to(["read", "create", "update"]),
-      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
 
   MessageThread: a

package/amplify/data/schema.js

@@ -4,6 +4,7 @@ import { categoryAction } from "../functions/category-action/resource.js";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
 import { automationViewSchemaDefinitions } from "../functions/automation-view/schema.js";
 import { proposalActionsSchemaDefinitions } from "../functions/proposal-actions/schema.js";
+import { messageActionsSchemaDefinitions } from "./message-actions.js";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
@@ -1481,6 +1482,9 @@ function buildBaseDefinitions(includeEditions) {
             curationDecisionRelationId: a.string(),
             newsroomFeedKey: a.string(),
             reviewedFeedKey: a.string(),
+            discoveredByMonitorId: a.string(),
+            discoveryDetails: a.json(),
+            discoveryRule: a.json(),
             // The References page reads the feed through two indexes (docs/reference-feed-indexes.md). `feedStateKey` is
             // "<corpusId>#unrated" or "<corpusId>#rated" for a current, not archived Reference (null otherwise: it is in no feed).
             // `predictionSortKey` orders Best bets, `feedArrivalAt` orders Newest. The prediction is the Cyclotron's ORIGINAL
@@ -1502,6 +1506,7 @@ function buildBaseDefinitions(includeEditions) {
             index("curationStatus").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusAndUpdatedAt"),
             index("curationStatusKey").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusKeyAndUpdatedAt"),
             index("reviewedFeedKey").sortKeys(["updatedAt"]).queryField("listReferencesByReviewedFeedAndUpdatedAt"),
+            index("discoveredByMonitorId").sortKeys(["createdAt"]).queryField("listReferencesByMonitorAndCreatedAt"),
             index("feedStateKey").sortKeys(["predictionSortKey"]).queryField("listReferencesByFeedStateAndPrediction"),
             index("feedStateKey").sortKeys(["feedArrivalAt"]).queryField("listReferencesByFeedStateAndArrival"),
         ])
@@ -1625,23 +1630,24 @@ function buildBaseDefinitions(includeEditions) {
             index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
         ])
             .authorization((allow) => [
-            // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-            allow.group("editor").to(categoryAppendOnlyOperations),
-            allow.group(adminGroup).to(["read", "create", "delete"]),
-            // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-            allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
+            // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+            // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+            allow.group("editor").to(["read"]),
+            allow.group(adminGroup).to(["read"]),
         ]),
         MessageThread: realtimeModel({
             id: a.id().required(),
             threadKind: a.string().required(),
             status: a.string().required(),
-            title: a.string().required(),
+            // The title and the creator are set when a conversation is created and read afterwards; a title changes only through
+            // renameThread (its creator or an admin), and the creator never changes.
+            title: a.string().required().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
             summary: a.string(),
             primaryAnchorKind: a.string(),
             primaryAnchorId: a.id(),
             primaryAnchorLineageId: a.id(),
             primaryAnchorKey: a.string(),
-            createdBySub: a.string(),
+            createdBySub: a.string().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
             createdByUserProfileId: a.id(),
             createdByLabel: a.string(),
             messageCount: a.integer(),
@@ -2126,6 +2132,7 @@ function buildBaseDefinitions(includeEditions) {
         ...monitoringViewSchemaDefinitions,
         ...automationViewSchemaDefinitions,
         ...proposalActionsSchemaDefinitions,
+        ...messageActionsSchemaDefinitions,
     };
     if (!includeEditions) {
         const mutableDefinitions = definitions;

package/amplify/data/schema.ts

@@ -4,6 +4,7 @@ import { categoryAction } from "../functions/category-action/resource";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
 import { automationViewSchemaDefinitions } from "../functions/automation-view/schema";
 import { proposalActionsSchemaDefinitions } from "../functions/proposal-actions/schema";
+import { messageActionsSchemaDefinitions } from "./message-actions";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
@@ -1592,6 +1593,9 @@ const definitions = {
       curationDecisionRelationId: a.string(),
       newsroomFeedKey: a.string(),
       reviewedFeedKey: a.string(),
+      discoveredByMonitorId: a.string(),
+      discoveryDetails: a.json(),
+      discoveryRule: a.json(),
       // The References page reads the feed through two indexes (docs/reference-feed-indexes.md). `feedStateKey` is
       // "<corpusId>#unrated" or "<corpusId>#rated" for a current, not archived Reference (null otherwise: it is in no feed).
       // `predictionSortKey` orders Best bets, `feedArrivalAt` orders Newest. The prediction is the Cyclotron's ORIGINAL
@@ -1613,6 +1617,7 @@ const definitions = {
       index("curationStatus").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusAndUpdatedAt"),
       index("curationStatusKey").sortKeys(["curationStatusUpdatedAt"]).queryField("listReferencesByCurationStatusKeyAndUpdatedAt"),
       index("reviewedFeedKey").sortKeys(["updatedAt"]).queryField("listReferencesByReviewedFeedAndUpdatedAt"),
+      index("discoveredByMonitorId").sortKeys(["createdAt"]).queryField("listReferencesByMonitorAndCreatedAt"),
       index("feedStateKey").sortKeys(["predictionSortKey"]).queryField("listReferencesByFeedStateAndPrediction"),
       index("feedStateKey").sortKeys(["feedArrivalAt"]).queryField("listReferencesByFeedStateAndArrival"),
     ])
@@ -1739,24 +1744,25 @@ const definitions = {
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-      allow.group("editor").to(categoryAppendOnlyOperations),
-      allow.group(adminGroup).to(["read", "create", "delete"]),
-      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
+      // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+      // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(["read"]),
     ]),
 
   MessageThread: realtimeModel({
       id: a.id().required(),
       threadKind: a.string().required(),
       status: a.string().required(),
-      title: a.string().required(),
+      // The title and the creator are set when a conversation is created and read afterwards; a title changes only through
+      // renameThread (its creator or an admin), and the creator never changes.
+      title: a.string().required().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
       summary: a.string(),
       primaryAnchorKind: a.string(),
       primaryAnchorId: a.id(),
       primaryAnchorLineageId: a.id(),
       primaryAnchorKey: a.string(),
-      createdBySub: a.string(),
+      createdBySub: a.string().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
       createdByUserProfileId: a.id(),
       createdByLabel: a.string(),
       messageCount: a.integer(),
@@ -2256,6 +2262,7 @@ const definitions = {
   ...monitoringViewSchemaDefinitions,
   ...automationViewSchemaDefinitions,
   ...proposalActionsSchemaDefinitions,
+  ...messageActionsSchemaDefinitions,
 };
 if (!includeEditions) {
   const mutableDefinitions = definitions as Record<string, unknown>;

package/components/conversation-context.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { createContext, useContext, type ReactNode } from "react";
-import type { ConversationAnchor, ConversationMessage } from "../lib/conversation";
+import { NO_VIEWER, canDeleteMessage, canEditMessage, type ConversationAnchor, type ConversationMessage, type ConversationViewer } from "../lib/conversation";
 
 /**
  * Where conversations are read and written. The newsroom provides the network one; a demo or a test provides the in-memory one. A
@@ -14,6 +14,11 @@ export type ConversationStore = {
   append: (input: { anchor: ConversationAnchor; body: string; parentMessageId: string | null }) => Promise<ConversationMessage>;
   /** Message counts by Reference lineage, for the feed cards. */
   counts: () => Promise<Map<string, number>>;
+  /** Who is looking, and display names by profile id: what Edit, Delete and the author's name are decided from. */
+  viewer: () => Promise<ConversationViewer>;
+  authors: (profileIds: string[]) => Promise<Map<string, string>>;
+  edit: (messageId: string, body: string) => Promise<ConversationMessage>;
+  remove: (messageId: string, moderate: boolean) => Promise<ConversationMessage>;
 };
 
 const ConversationStoreContext = createContext<ConversationStore | null>(null);
@@ -27,11 +32,32 @@ export function useConversationStore(): ConversationStore | null {
 }
 
 /** A store that keeps everything in memory: the demo newsroom, and the tests. */
-export function createMemoryConversationStore(authorLabel: string, seed: Record<string, ConversationMessage[]> = {}): ConversationStore {
+export function createMemoryConversationStore(authorLabel: string, seed: Record<string, ConversationMessage[]> = {}, who: { viewer?: ConversationViewer; profiles?: Record<string, string> } = {}): ConversationStore {
+  const viewer = who.viewer ?? NO_VIEWER;
   const byAnchor = new Map<string, ConversationMessage[]>(Object.entries(seed));
   const keyOf = (anchor: ConversationAnchor) => `${anchor.kind}#${anchor.lineageId ?? ""}`;
+  const change = (messageId: string, apply: (message: ConversationMessage) => ConversationMessage) => {
+    for (const [key, list] of byAnchor) {
+      const found = list.find((message) => message.id === messageId);
+      if (!found) continue;
+      const changed = apply(found);
+      byAnchor.set(key, list.map((message) => (message.id === messageId ? changed : message)));
+      return changed;
+    }
+    throw new Error("That message is not here.");
+  };
   return {
     authorLabel,
+    viewer: async () => viewer,
+    authors: async (ids) => new Map(ids.filter((id) => who.profiles?.[id]).map((id) => [id, who.profiles![id]])),
+    edit: async (messageId, body) => change(messageId, (message) => {
+      if (!canEditMessage(viewer, message)) throw new Error("Only the author can edit a message.");
+      return { ...message, content: body.trim(), editedAt: new Date().toISOString() };
+    }),
+    remove: async (messageId) => change(messageId, (message) => {
+      if (!canDeleteMessage(viewer, message)) throw new Error("Only the author or an admin can delete a message.");
+      return { ...message, content: "", deleted: true, deletedAt: new Date().toISOString() };
+    }),
     load: async (anchor) => [...(byAnchor.get(keyOf(anchor)) ?? [])],
     append: async ({ anchor, body, parentMessageId }) => {
       const list = byAnchor.get(keyOf(anchor)) ?? [];
@@ -40,6 +66,7 @@ export function createMemoryConversationStore(authorLabel: string, seed: Record<
         id: `message-memory-${sequenceNumber}-${list.length}`,
         parentMessageId,
         authorLabel,
+        authorSub: viewer.sub,
         content: body.trim(),
         createdAt: new Date().toISOString(),
         sequenceNumber,

package/components/conversation-provider.tsx

@@ -2,7 +2,7 @@
 
 import { useMemo, type ReactNode } from "react";
 import { ConversationStoreProvider, createMemoryConversationStore, type ConversationStore } from "./conversation-context";
-import { appendConversationMessage, loadConversationMessages, loadReferenceConversationCounts } from "./news-desk-taxonomy-client";
+import { appendConversationMessage, deleteConversationMessage, editConversationMessage, loadConversationMessages, loadConversationViewer, loadReferenceConversationCounts, loadUserProfileNames } from "./news-desk-taxonomy-client";
 
 function networkConversationStore(authorLabel: string): ConversationStore {
   return {
@@ -10,6 +10,10 @@ function networkConversationStore(authorLabel: string): ConversationStore {
     load: loadConversationMessages,
     append: async ({ anchor, body, parentMessageId }) => (await appendConversationMessage({ anchor, body, parentMessageId })).message,
     counts: loadReferenceConversationCounts,
+    viewer: loadConversationViewer,
+    authors: loadUserProfileNames,
+    edit: editConversationMessage,
+    remove: (messageId, moderate) => deleteConversationMessage(messageId, moderate),
   };
 }