@anthusai/papyrus 1.0.0-next.1 → 1.0.0-next.10

package/amplify/data/resource.js

@@ -2,6 +2,7 @@ import { a, defineData } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
 import { graphqlJwtAuthorizer } from "../functions/graphql-jwt-authorizer/resource.js";
+import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource.js";
@@ -468,6 +469,36 @@ const schema = a.schema({
         .returns(a.ref("NewsroomSummary"))
         .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
         .handler(a.handler.function(newsroomSummary)),
+    deriveMarkus: a
+        .query()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    saveItemDraft: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    publishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    unpublishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    requestStagingBuild: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     knowledgeQuery: a
         .query()
         .arguments({
@@ -2012,6 +2043,7 @@ const schema = a.schema({
     ]),
 }).authorization((allow) => [
     allow.resource(categoryAction),
+    allow.resource(contentActions),
     allow.resource(manageUserRole),
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),

package/amplify/data/resource.ts

@@ -2,6 +2,7 @@ import { type ClientSchema, a, defineData } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
 import { graphqlJwtAuthorizer } from "../functions/graphql-jwt-authorizer/resource";
+import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
@@ -508,6 +509,41 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
     .handler(a.handler.function(newsroomSummary)),
 
+  deriveMarkus: a
+    .query()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  saveItemDraft: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  publishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  unpublishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  requestStagingBuild: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   knowledgeQuery: a
     .query()
     .arguments({
@@ -2120,6 +2156,7 @@ const schema = a.schema({
     ]),
 }).authorization((allow) => [
   allow.resource(categoryAction),
+  allow.resource(contentActions),
   allow.resource(manageUserRole),
   allow.resource(modelAttachmentUpload),
   allow.resource(newsroomSummary),

package/amplify/data/schema.js

@@ -1,6 +1,7 @@
 import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
+import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource.js";
@@ -368,6 +369,36 @@ export const schema = a.schema({
         .returns(a.ref("NewsroomSummary"))
         .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
         .handler(a.handler.function(newsroomSummary)),
+    deriveMarkus: a
+        .query()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    saveItemDraft: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    publishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    unpublishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    requestStagingBuild: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     knowledgeQuery: a
         .query()
         .arguments({
@@ -1843,6 +1874,7 @@ export const schema = a.schema({
     ]),
 }).authorization((allow) => [
     allow.resource(categoryAction),
+    allow.resource(contentActions),
     allow.resource(manageUserRole),
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),

package/amplify/data/schema.ts

@@ -1,6 +1,7 @@
 import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
+import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
@@ -402,6 +403,41 @@ export const schema = a.schema({
     .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
     .handler(a.handler.function(newsroomSummary)),
 
+  deriveMarkus: a
+    .query()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  saveItemDraft: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  publishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  unpublishItem: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
+  requestStagingBuild: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   knowledgeQuery: a
     .query()
     .arguments({
@@ -1944,6 +1980,7 @@ export const schema = a.schema({
     ]),
 }).authorization((allow) => [
   allow.resource(categoryAction),
+  allow.resource(contentActions),
   allow.resource(manageUserRole),
   allow.resource(modelAttachmentUpload),
   allow.resource(newsroomSummary),

package/amplify/functions/content-actions/handler.py

@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+import json
+import os
+from typing import Any
+
+from papyrus_content.graphql_authoring import create_authoring_client
+from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.rebuild_trigger import (
+    DEFAULT_STAGING_BRANCH,
+    reader_target_from_environment,
+    trigger_pretext_revalidation,
+    trigger_rebuild,
+    trigger_staging_build,
+)
+from papyrus_content.publishing import (
+    ItemFields,
+    PublishError,
+    publish_item,
+    save_item,
+    unpublish_item,
+)
+
+
+def parse_input(raw: Any) -> dict:
+    parsed = json.loads(raw) if isinstance(raw, (str, bytes)) else raw
+    if not isinstance(parsed, dict):
+        raise PublishError("invalid-input", "The input must be a JSON object.")
+    return parsed
+
+
+def actor_from_event(event: dict) -> str:
+    identity = event.get("identity") or {}
+    return identity.get("username") or identity.get("sub") or "unknown"
+
+
+def failure_response(error: PublishError) -> dict:
+    if error.errors:
+        errors = [body_error.to_dict() for body_error in error.errors]
+    else:
+        errors = [{"code": error.code, "message": error.message, "line": None}]
+    return {"ok": False, "errors": errors}
+
+
+def derive_markus_action(arguments: dict) -> dict:
+    derivation = derive_body(arguments.get("frontMatterYaml"), arguments.get("bodyMarkus") or "")
+    if not derivation.ok:
+        return {"ok": False, "errors": [body_error.to_dict() for body_error in derivation.errors]}
+    response = {
+        "ok": True,
+        "bodyIrBytes": len(json.dumps(derivation.body_ir, separators=(",", ":")).encode("utf-8")),
+        "errors": [],
+    }
+    if arguments.get("includeIr") is True:
+        response["bodyIr"] = derivation.body_ir
+    return response
+
+
+def save_item_draft_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    fields = ItemFields(
+        type=arguments["type"],
+        slug=arguments["slug"],
+        section=arguments.get("section"),
+        front_matter_yaml=arguments.get("frontMatterYaml"),
+        body_markus=arguments.get("bodyMarkus") or "",
+        aliases=list(arguments.get("aliases") or []),
+        id=arguments.get("id"),
+    )
+    record = save_item(client, fields, actor=actor, expected_content_hash=arguments.get("expectedContentHash"))
+    return {
+        "ok": True,
+        "item": {
+            "id": record["id"],
+            "contentHash": record["contentHash"],
+            "status": record["status"],
+            "slug": record["slug"],
+            "versionNumber": record.get("versionNumber"),
+        },
+    }
+
+
+def site_triggers_for(client, item_id: str) -> dict:
+    triggers: dict = {}
+    reader_app_id, reader_branch = reader_target_from_environment()
+    revalidate_base_url = (os.environ.get("PAPYRUS_REVALIDATE_BASE_URL") or "").strip()
+    if revalidate_base_url:
+        try:
+            item = client.get_record("Item", item_id) or {}
+            slugs = [item["slug"]] if item.get("slug") else []
+            revalidated = trigger_pretext_revalidation(slugs, None, base_url=revalidate_base_url)
+            triggers["revalidated"] = revalidated if revalidated is not None else {"ok": False, "reason": "not-configured"}
+        except Exception as error:  # noqa: BLE001 - a trigger failure never fails the publish
+            triggers["revalidated"] = {"ok": False, "error": f"{type(error).__name__}: {error}"}
+    if reader_app_id:
+        triggers["rebuild"] = trigger_rebuild(reader_app_id=reader_app_id, reader_branch=reader_branch)
+    return triggers
+
+
+def publish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = publish_item(client, arguments["id"], actor=actor)
+    response = {
+        "ok": True,
+        "changed": result.changed,
+        "publishedId": result.published_item_id,
+        "versionNumber": result.version_number,
+    }
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def unpublish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = unpublish_item(client, arguments["id"], actor=actor)
+    response = {"ok": True, "changed": result.changed}
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def request_staging_build_action() -> dict:
+    cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
+    if not cms_app_id:
+        return {"ok": False, "errors": [{"code": "staging-build-not-configured", "message": "This site has no staging build configured.", "line": None}]}
+    staging_branch = (os.environ.get("PAPYRUS_STAGING_BRANCH") or "").strip() or DEFAULT_STAGING_BRANCH
+    build = trigger_staging_build(cms_app_id=cms_app_id, staging_branch=staging_branch)
+    return {"ok": True, "build": build}
+
+
+def handler(event, context):
+    field = event["fieldName"]
+    arguments = parse_input(event["arguments"]["input"])
+    actor = actor_from_event(event)
+    try:
+        if field == "deriveMarkus":
+            return derive_markus_action(arguments)
+        if field == "saveItemDraft":
+            return save_item_draft_action(arguments, actor)
+        if field == "publishItem":
+            return publish_item_action(arguments, actor)
+        if field == "unpublishItem":
+            return unpublish_item_action(arguments, actor)
+        if field == "requestStagingBuild":
+            return request_staging_build_action()
+    except PublishError as error:
+        return failure_response(error)
+    raise ValueError(f"Unsupported field {field}")

package/amplify/functions/content-actions/requirements.txt

@@ -0,0 +1,4 @@
+PyYAML>=6.0.2,<7
+citeproc-py>=0.8.2,<1
+anthus-markus==0.5.1
+Pillow>=10,<12

package/amplify/functions/content-actions/resource.js

@@ -0,0 +1,40 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export const contentActions = defineFunction((scope) => {
+    return new Function(scope, "papyrus-content-actions", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(60),
+        memorySize: 1024,
+        code: pythonLambdaCode({
+            functionDir: "content-actions",
+            modules: ["papyrus_content"],
+            requirements: contentActionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/content-actions/resource.ts

@@ -0,0 +1,54 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+
+function installCheckoutRequirements(outputDir: string): void {
+  const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+  execSync(
+    `python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`,
+    { cwd: projectRoot, stdio: "inherit" },
+  );
+}
+
+export const contentActions = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-content-actions", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(60),
+      memorySize: 1024,
+      code: pythonLambdaCode(
+        {
+          functionDir: "content-actions",
+          modules: ["papyrus_content"],
+          requirements: contentActionsRequirements,
+          noDeps: true,
+          checkoutExtras: installCheckoutRequirements,
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/functions/shared/python-bundle.js

@@ -58,9 +58,24 @@ function bundleFromPip(outputDir, options) {
         // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
         "--ignore-requires-python",
         ...extra,
-        pipSpec(),
+        ...(options.noDeps ? [] : [pipSpec()]),
         ...(options.requirements ?? []),
     ], { stdio: "inherit" });
+    if (options.noDeps) {
+        execFileSync(python, [
+            "-m", "pip", "install",
+            "--target", outputDir,
+            "--no-cache-dir",
+            "--no-deps",
+            "--platform", "manylinux2014_aarch64",
+            "--implementation", "cp",
+            "--python-version", "3.12",
+            "--only-binary=:all:",
+            "--ignore-requires-python",
+            ...extra,
+            pipSpec(),
+        ], { stdio: "inherit" });
+    }
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
     if (options.corpora) {
         const corporaDir = path.join(outputDir, "corpora");
@@ -74,7 +89,7 @@ function bundleFromPip(outputDir, options) {
         }
     }
 }
-function bundleFromCheckout(outputDir, options) {
+export function bundleFromCheckout(outputDir, options) {
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
     for (const module of options.modules) {
         fs.mkdirSync(path.join(outputDir, module), { recursive: true });

package/amplify/functions/shared/python-bundle.ts

@@ -53,6 +53,8 @@ export type PythonBundleOptions = {
   checkoutExtras?: (outputDir: string) => void;
   /** Extra pip requirements in package mode, beyond `papyrus-newsroom`. */
   requirements?: string[];
+  /** Package mode: install `papyrus-newsroom` with `--no-deps`, then only `requirements`. */
+  noDeps?: boolean;
   /** Copy `<cwd>/corpora/*.yml` into the asset (publication-owned steering config). */
   corpora?: boolean;
 };
@@ -77,11 +79,30 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
       // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
       "--ignore-requires-python",
       ...extra,
-      pipSpec(),
+      ...(options.noDeps ? [] : [pipSpec()]),
       ...(options.requirements ?? []),
     ],
     { stdio: "inherit" },
   );
+  if (options.noDeps) {
+    execFileSync(
+      python,
+      [
+        "-m", "pip", "install",
+        "--target", outputDir,
+        "--no-cache-dir",
+        "--no-deps",
+        "--platform", "manylinux2014_aarch64",
+        "--implementation", "cp",
+        "--python-version", "3.12",
+        "--only-binary=:all:",
+        "--ignore-requires-python",
+        ...extra,
+        pipSpec(),
+      ],
+      { stdio: "inherit" },
+    );
+  }
   fs.copyFileSync(
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),
@@ -98,7 +119,7 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
   }
 }
 
-function bundleFromCheckout(outputDir: string, options: PythonBundleOptions): void {
+export function bundleFromCheckout(outputDir: string, options: PythonBundleOptions): void {
   fs.copyFileSync(
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),

package/amplify/rebuild-trigger-settings.js

@@ -0,0 +1,22 @@
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+function branchJobsArn(input, appId, branch) {
+    return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+export function rebuildTriggerSettings(input) {
+    const environment = {};
+    const resources = [];
+    const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+    if (readerAppId !== "") {
+        const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+        environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+        environment.PAPYRUS_READER_BRANCH = readerBranch;
+        resources.push(branchJobsArn(input, readerAppId, readerBranch));
+    }
+    const cmsAppId = input.cmsAppId.trim();
+    if (input.stagingBuildEnabled && cmsAppId !== "") {
+        environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+        environment.PAPYRUS_STAGING_BRANCH = "staging";
+        resources.push(branchJobsArn(input, cmsAppId, "staging"));
+    }
+    return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}

package/amplify/rebuild-trigger-settings.ts

@@ -0,0 +1,42 @@
+/**
+ * Environment and IAM policy for the content-actions Lambda's site triggers.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ */
+export type RebuildTriggerInput = {
+  reader?: { amplifyAppId: string; branchName?: string };
+  stagingBuildEnabled: boolean;
+  cmsAppId: string;
+  region: string;
+  account: string;
+};
+
+export type RebuildTriggerSettings = {
+  environment: Record<string, string>;
+  actions: string[];
+  resources: string[];
+};
+
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+
+function branchJobsArn(input: RebuildTriggerInput, appId: string, branch: string): string {
+  return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+
+export function rebuildTriggerSettings(input: RebuildTriggerInput): RebuildTriggerSettings {
+  const environment: Record<string, string> = {};
+  const resources: string[] = [];
+  const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+  if (readerAppId !== "") {
+    const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+    environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+    environment.PAPYRUS_READER_BRANCH = readerBranch;
+    resources.push(branchJobsArn(input, readerAppId, readerBranch));
+  }
+  const cmsAppId = input.cmsAppId.trim();
+  if (input.stagingBuildEnabled && cmsAppId !== "") {
+    environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+    environment.PAPYRUS_STAGING_BRANCH = "staging";
+    resources.push(branchJobsArn(input, cmsAppId, "staging"));
+  }
+  return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}

package/amplify/site-backend-config.ts

@@ -21,6 +21,12 @@ export type PapyrusSiteBackendConfig = {
    */
   productionAppId?: string;
   auth?: PapyrusAuthConfig;
+  /** Static reader app (Markus-static sites) that a publish rebuilds through IAM `amplify:StartJob`. */
+  reader?: { amplifyAppId: string; branchName?: string };
+  /** Lets the newsroom start the `staging` branch build of this CMS app. */
+  stagingBuild?: { enabled: boolean };
+  /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (secret `PAPYRUS_REVALIDATE_SECRET`). */
+  revalidateBaseUrl?: string;
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;