@anthusai/papyrus 1.0.0-next.2 → 1.0.0-next.21

package/amplify/functions/content-actions/handler.py

@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+import json
+import os
+from typing import Any
+
+from papyrus_content.graphql_authoring import create_authoring_client
+from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.rebuild_trigger import (
+    DEFAULT_STAGING_BRANCH,
+    reader_target_from_environment,
+    trigger_pretext_revalidation,
+    trigger_rebuild,
+    trigger_staging_build,
+)
+from papyrus_content.publishing import (
+    ItemFields,
+    PublishError,
+    publish_item,
+    save_item,
+    unpublish_item,
+)
+
+
+def parse_input(raw: Any) -> dict:
+    parsed = json.loads(raw) if isinstance(raw, (str, bytes)) else raw
+    if not isinstance(parsed, dict):
+        raise PublishError("invalid-input", "The input must be a JSON object.")
+    return parsed
+
+
+def actor_from_event(event: dict) -> str:
+    identity = event.get("identity") or {}
+    return identity.get("username") or identity.get("sub") or "unknown"
+
+
+def failure_response(error: PublishError) -> dict:
+    if error.errors:
+        errors = [body_error.to_dict() for body_error in error.errors]
+    else:
+        errors = [{"code": error.code, "message": error.message, "line": None}]
+    return {"ok": False, "errors": errors}
+
+
+def derive_markus_action(arguments: dict) -> dict:
+    derivation = derive_body(arguments.get("frontMatterYaml"), arguments.get("bodyMarkus") or "")
+    if not derivation.ok:
+        return {"ok": False, "errors": [body_error.to_dict() for body_error in derivation.errors]}
+    response = {
+        "ok": True,
+        "bodyIrBytes": len(json.dumps(derivation.body_ir, separators=(",", ":")).encode("utf-8")),
+        "errors": [],
+    }
+    if arguments.get("includeIr") is True:
+        response["bodyIr"] = derivation.body_ir
+    return response
+
+
+def save_item_draft_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    fields = ItemFields(
+        type=arguments["type"],
+        slug=arguments["slug"],
+        section=arguments.get("section"),
+        front_matter_yaml=arguments.get("frontMatterYaml"),
+        body_markus=arguments.get("bodyMarkus") or "",
+        aliases=list(arguments.get("aliases") or []),
+        id=arguments.get("id"),
+    )
+    record = save_item(client, fields, actor=actor, expected_content_hash=arguments.get("expectedContentHash"))
+    return {
+        "ok": True,
+        "item": {
+            "id": record["id"],
+            "contentHash": record["contentHash"],
+            "status": record["status"],
+            "slug": record["slug"],
+            "versionNumber": record.get("versionNumber"),
+        },
+    }
+
+
+def site_triggers_for(client, item_id: str) -> dict:
+    triggers: dict = {}
+    reader_app_id, reader_branch = reader_target_from_environment()
+    revalidate_base_url = (os.environ.get("PAPYRUS_REVALIDATE_BASE_URL") or "").strip()
+    if revalidate_base_url:
+        try:
+            item = client.get_record("Item", item_id) or {}
+            slugs = [item["slug"]] if item.get("slug") else []
+            revalidated = trigger_pretext_revalidation(slugs, None, base_url=revalidate_base_url)
+            triggers["revalidated"] = revalidated if revalidated is not None else {"ok": False, "reason": "not-configured"}
+        except Exception as error:  # noqa: BLE001 - a trigger failure never fails the publish
+            triggers["revalidated"] = {"ok": False, "error": f"{type(error).__name__}: {error}"}
+    if reader_app_id:
+        triggers["rebuild"] = trigger_rebuild(reader_app_id=reader_app_id, reader_branch=reader_branch)
+    return triggers
+
+
+def publish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = publish_item(client, arguments["id"], actor=actor)
+    response = {
+        "ok": True,
+        "changed": result.changed,
+        "publishedId": result.published_item_id,
+        "versionNumber": result.version_number,
+    }
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def unpublish_item_action(arguments: dict, actor: str) -> dict:
+    client, _claims = create_authoring_client()
+    result = unpublish_item(client, arguments["id"], actor=actor)
+    response = {"ok": True, "changed": result.changed}
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def request_staging_build_action() -> dict:
+    cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
+    if not cms_app_id:
+        return {"ok": False, "errors": [{"code": "staging-build-not-configured", "message": "This site has no staging build configured.", "line": None}]}
+    staging_branch = (os.environ.get("PAPYRUS_STAGING_BRANCH") or "").strip() or DEFAULT_STAGING_BRANCH
+    build = trigger_staging_build(cms_app_id=cms_app_id, staging_branch=staging_branch)
+    return {"ok": True, "build": build}
+
+
+def handler(event, context):
+    field = event["fieldName"]
+    arguments = parse_input(event["arguments"]["input"])
+    actor = actor_from_event(event)
+    try:
+        if field == "deriveMarkus":
+            return derive_markus_action(arguments)
+        if field == "saveItemDraft":
+            return save_item_draft_action(arguments, actor)
+        if field == "publishItem":
+            return publish_item_action(arguments, actor)
+        if field == "unpublishItem":
+            return unpublish_item_action(arguments, actor)
+        if field == "requestStagingBuild":
+            return request_staging_build_action()
+    except PublishError as error:
+        return failure_response(error)
+    raise ValueError(f"Unsupported field {field}")

package/amplify/functions/content-actions/requirements.txt

@@ -0,0 +1,4 @@
+PyYAML>=6.0.2,<7
+citeproc-py>=0.8.2,<1
+anthus-markus==0.5.1
+Pillow>=10,<12

package/amplify/functions/content-actions/resource.js

@@ -0,0 +1,40 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export const contentActions = defineFunction((scope) => {
+    return new Function(scope, "papyrus-content-actions", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(60),
+        memorySize: 1024,
+        code: pythonLambdaCode({
+            functionDir: "content-actions",
+            modules: ["papyrus_content"],
+            requirements: contentActionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/content-actions/resource.ts

@@ -0,0 +1,54 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+
+function installCheckoutRequirements(outputDir: string): void {
+  const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
+  execSync(
+    `python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`,
+    { cwd: projectRoot, stdio: "inherit" },
+  );
+}
+
+export const contentActions = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-content-actions", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(60),
+      memorySize: 1024,
+      code: pythonLambdaCode(
+        {
+          functionDir: "content-actions",
+          modules: ["papyrus_content"],
+          requirements: contentActionsRequirements,
+          noDeps: true,
+          checkoutExtras: installCheckoutRequirements,
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/content-actions/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "python3 -m pip install -r amplify/functions/content-actions/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/functions/shared/python-bundle.js

@@ -58,9 +58,24 @@ function bundleFromPip(outputDir, options) {
         // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
         "--ignore-requires-python",
         ...extra,
-        pipSpec(),
+        ...(options.noDeps ? [] : [pipSpec()]),
         ...(options.requirements ?? []),
     ], { stdio: "inherit" });
+    if (options.noDeps) {
+        execFileSync(python, [
+            "-m", "pip", "install",
+            "--target", outputDir,
+            "--no-cache-dir",
+            "--no-deps",
+            "--platform", "manylinux2014_aarch64",
+            "--implementation", "cp",
+            "--python-version", "3.12",
+            "--only-binary=:all:",
+            "--ignore-requires-python",
+            ...extra,
+            pipSpec(),
+        ], { stdio: "inherit" });
+    }
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
     if (options.corpora) {
         const corporaDir = path.join(outputDir, "corpora");
@@ -74,7 +89,7 @@ function bundleFromPip(outputDir, options) {
         }
     }
 }
-function bundleFromCheckout(outputDir, options) {
+export function bundleFromCheckout(outputDir, options) {
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
     for (const module of options.modules) {
         fs.mkdirSync(path.join(outputDir, module), { recursive: true });

package/amplify/functions/shared/python-bundle.ts

@@ -53,6 +53,8 @@ export type PythonBundleOptions = {
   checkoutExtras?: (outputDir: string) => void;
   /** Extra pip requirements in package mode, beyond `papyrus-newsroom`. */
   requirements?: string[];
+  /** Package mode: install `papyrus-newsroom` with `--no-deps`, then only `requirements`. */
+  noDeps?: boolean;
   /** Copy `<cwd>/corpora/*.yml` into the asset (publication-owned steering config). */
   corpora?: boolean;
 };
@@ -77,11 +79,30 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
       // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
       "--ignore-requires-python",
       ...extra,
-      pipSpec(),
+      ...(options.noDeps ? [] : [pipSpec()]),
       ...(options.requirements ?? []),
     ],
     { stdio: "inherit" },
   );
+  if (options.noDeps) {
+    execFileSync(
+      python,
+      [
+        "-m", "pip", "install",
+        "--target", outputDir,
+        "--no-cache-dir",
+        "--no-deps",
+        "--platform", "manylinux2014_aarch64",
+        "--implementation", "cp",
+        "--python-version", "3.12",
+        "--only-binary=:all:",
+        "--ignore-requires-python",
+        ...extra,
+        pipSpec(),
+      ],
+      { stdio: "inherit" },
+    );
+  }
   fs.copyFileSync(
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),
@@ -98,7 +119,7 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
   }
 }
 
-function bundleFromCheckout(outputDir: string, options: PythonBundleOptions): void {
+export function bundleFromCheckout(outputDir: string, options: PythonBundleOptions): void {
   fs.copyFileSync(
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),

package/amplify/rebuild-trigger-settings.js

@@ -0,0 +1,22 @@
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+function branchJobsArn(input, appId, branch) {
+    return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+export function rebuildTriggerSettings(input) {
+    const environment = {};
+    const resources = [];
+    const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+    if (readerAppId !== "") {
+        const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+        environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+        environment.PAPYRUS_READER_BRANCH = readerBranch;
+        resources.push(branchJobsArn(input, readerAppId, readerBranch));
+    }
+    const cmsAppId = input.cmsAppId.trim();
+    if (input.stagingBuildEnabled && cmsAppId !== "") {
+        environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+        environment.PAPYRUS_STAGING_BRANCH = "staging";
+        resources.push(branchJobsArn(input, cmsAppId, "staging"));
+    }
+    return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}

package/amplify/rebuild-trigger-settings.ts

@@ -0,0 +1,42 @@
+/**
+ * Environment and IAM policy for the content-actions Lambda's site triggers.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ */
+export type RebuildTriggerInput = {
+  reader?: { amplifyAppId: string; branchName?: string };
+  stagingBuildEnabled: boolean;
+  cmsAppId: string;
+  region: string;
+  account: string;
+};
+
+export type RebuildTriggerSettings = {
+  environment: Record<string, string>;
+  actions: string[];
+  resources: string[];
+};
+
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+
+function branchJobsArn(input: RebuildTriggerInput, appId: string, branch: string): string {
+  return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+
+export function rebuildTriggerSettings(input: RebuildTriggerInput): RebuildTriggerSettings {
+  const environment: Record<string, string> = {};
+  const resources: string[] = [];
+  const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+  if (readerAppId !== "") {
+    const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+    environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+    environment.PAPYRUS_READER_BRANCH = readerBranch;
+    resources.push(branchJobsArn(input, readerAppId, readerBranch));
+  }
+  const cmsAppId = input.cmsAppId.trim();
+  if (input.stagingBuildEnabled && cmsAppId !== "") {
+    environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+    environment.PAPYRUS_STAGING_BRANCH = "staging";
+    resources.push(branchJobsArn(input, cmsAppId, "staging"));
+  }
+  return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}

package/amplify/site-backend-config.ts

@@ -7,8 +7,13 @@ export type PapyrusAuthConfig = {
   /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
   redirectUrls?: string[];
   disableGoogleOAuth?: boolean;
-  /** Stable Cognito hosted-UI domain prefix. */
+  /** Desired Cognito hosted-UI domain prefix. Only applied when `applyCognitoDomainPrefix` is true. */
   cognitoDomainPrefix?: string;
+  /**
+   * Opt in to the prefix. Off by default because changing a live pool's
+   * domain replaces it and changes the Google redirect URI.
+   */
+  applyCognitoDomainPrefix?: boolean;
 };
 
 export type PapyrusSiteBackendConfig = {
@@ -21,6 +26,12 @@ export type PapyrusSiteBackendConfig = {
    */
   productionAppId?: string;
   auth?: PapyrusAuthConfig;
+  /** Static reader app (Markus-static sites) that a publish rebuilds through IAM `amplify:StartJob`. */
+  reader?: { amplifyAppId: string; branchName?: string };
+  /** Lets the newsroom start the `staging` branch build of this CMS app. */
+  stagingBuild?: { enabled: boolean };
+  /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (authenticated by the SSM secret named in branch variable `PAPYRUS_REVALIDATE_SECRET_PARAMETER`). */
+  revalidateBaseUrl?: string;
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend.js

@@ -12,12 +12,13 @@ import { CfnEventSourceMapping, FunctionUrlAuthType } from "aws-cdk-lib/aws-lamb
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource.js";
+import { contentActions } from "./functions/content-actions/resource.js";
 import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
@@ -75,12 +76,13 @@ export function defineSiteBackend(papyrusSite) {
     const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
     const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
     const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+    const authConfig = site.auth ?? authConfigFromEnv();
     const backend = defineBackend({
         assignmentAction,
-        auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+        auth: defineSiteAuth(authConfig),
         categoryAction,
+        contentActions,
         data,
-        graphqlJwtAuthorizer,
         knowledgeQuery,
         manageUserRole,
         modelAttachmentUpload,
@@ -93,6 +95,12 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+    if (authConfig.applyCognitoDomainPrefix === true
+        && requestedCognitoDomainPrefix !== ""
+        && authConfig.disableGoogleOAuth !== true) {
+        applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+    }
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
@@ -136,36 +144,18 @@ export function defineSiteBackend(papyrusSite) {
         const messageThreadTable = backend.data.resources.tables.MessageThread;
         const dataStack = Stack.of(messageTable);
         const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-        const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild;
-        const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-        const jwtAuthorizerVariables = jwtAuthorizerEnvironment
-            && typeof jwtAuthorizerEnvironment === "object"
-            && "variables" in jwtAuthorizerEnvironment
-            ? jwtAuthorizerEnvironment.variables
-            : undefined;
-        const jwtSsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || "";
+        const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
         if (enableConsoleResponder) {
-            const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+            new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
                 messageTable,
                 messageStreamArn,
                 threadTable: messageThreadTable,
                 projectRoot,
                 graphqlEndpoint,
-                amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
                 responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
                 model: process.env.PAPYRUS_CONSOLE_MODEL,
                 prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
             });
-            if (jwtSsmEnvConfig) {
-                consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-            }
-            const jwtSecretSsmParam = process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-                || (productionAppId !== "" && amplifyAppId === productionAppId
-                    ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-                    : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-            consoleChatResponder.responderFunction.addEnvironment("PAPYRUS_JWT_SECRET_SSM_PARAM", jwtSecretSsmParam);
         }
         if (enableSlackAgent) {
             const slackEventsLambda = backend.slackEvents.resources.lambda;
@@ -177,9 +167,9 @@ export function defineSiteBackend(papyrusSite) {
             backend.slackEvents.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackEvents.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
             backend.slackEvents.addEnvironment("PAPYRUS_SLACK_ALLOWED_USER_IDS", (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim());
-            if (jwtSsmEnvConfig) {
-                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+            if (amplifySsmEnvConfig) {
+                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
             }
             backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackDelivery.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
@@ -310,6 +300,7 @@ export function defineSiteBackend(papyrusSite) {
     for (const resource of [
         backend.assignmentAction,
         backend.categoryAction,
+        backend.contentActions,
         backend.emailSubmissionProcessor,
         backend.knowledgeQuery,
         backend.modelAttachmentUpload,
@@ -323,6 +314,39 @@ export function defineSiteBackend(papyrusSite) {
     grantNewsroomReadWrite(backend.assignmentAction.resources.lambda);
     grantNewsroomReadWrite(backend.categoryAction.resources.lambda);
     grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda);
+    const contentActionsLambda = backend.contentActions.resources.lambda;
+    grantNewsroomReadWriteDelete(contentActionsLambda);
+    contentActionsLambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    contentActionsLambda.addToRolePolicy(new PolicyStatement({
+        actions: ["appsync:GraphQL"],
+        resources: ["*"],
+    }));
+    const rebuildSettings = rebuildTriggerSettings({
+        reader: site.reader,
+        stagingBuildEnabled: site.stagingBuild?.enabled === true,
+        cmsAppId: amplifyAppId,
+        region: Stack.of(contentActionsLambda).region,
+        account: Stack.of(contentActionsLambda).account,
+    });
+    for (const [name, value] of Object.entries(rebuildSettings.environment)) {
+        contentActionsLambda.addEnvironment(name, value);
+    }
+    if (rebuildSettings.resources.length > 0) {
+        contentActionsLambda.addToRolePolicy(new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }));
+    }
+    if ((site.revalidateBaseUrl ?? "").trim() !== "") {
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
+        const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+        if (!revalidateSecretParameter.startsWith("/")) {
+            throw new Error("revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.");
+        }
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+        const revalidateStack = Stack.of(contentActionsLambda);
+        contentActionsLambda.addToRolePolicy(new PolicyStatement({
+            actions: ["ssm:GetParameter"],
+            resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+        }));
+    }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     if (backend.sesInboundReceive) {