@anthusai/papyrus 1.0.0-next.42 → 1.0.0-next.44

package/amplify/functions/content-actions/handler.py

@@ -6,6 +6,13 @@ from typing import Any
 
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.projection.engine import project
+from papyrus_content.projection.runtime import (
+    DEAD_LETTER_QUEUE_ENV,
+    context_from_environment,
+    projection_configured,
+    public_item_url,
+)
 from papyrus_content.rebuild_trigger import (
     DEFAULT_STAGING_BRANCH,
     reader_target_from_environment,
@@ -56,6 +63,45 @@ def derive_markus_action(arguments: dict) -> dict:
     return response
 
 
+def send_to_projection_dead_letter_queue(item_id: str, unpublished: bool, error: str) -> None:
+    queue_url = (os.environ.get(DEAD_LETTER_QUEUE_ENV) or "").strip()
+    if not queue_url:
+        return
+    try:
+        import boto3
+
+        boto3.client("sqs").send_message(
+            QueueUrl=queue_url,
+            MessageBody=json.dumps({"itemId": item_id, "unpublished": unpublished, "error": error}),
+        )
+    except Exception:  # noqa: BLE001 - the dead letter is best effort; the response already reports the failure
+        pass
+
+
+def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
+    if not projection_configured():
+        return {}
+    liveness = {} if unpublished else {"live": False}
+    try:
+        context = context_from_environment(client)
+        report = project(context, item_id, unpublished=unpublished)
+    except Exception as error:  # noqa: BLE001 - a projection failure never fails the save
+        message = f"{type(error).__name__}: {error}"
+        send_to_projection_dead_letter_queue(item_id, unpublished, message)
+        return {**liveness, "projected": False, "paths": [], "error": message}
+    response = {"projected": report.ok, "paths": [*report.written, *report.deleted]}
+    if not unpublished:
+        response["live"] = report.ok
+        url = public_item_url(os.environ, report.item_paths)
+        if url:
+            response["url"] = url
+    if not report.ok:
+        message = "; ".join(report.errors)
+        send_to_projection_dead_letter_queue(item_id, unpublished, message)
+        response["error"] = message
+    return response
+
+
 def save_item_draft_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     fields = ItemFields(
@@ -68,7 +114,7 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
         id=arguments.get("id"),
     )
     record = save_item(client, fields, actor=actor, expected_content_hash=arguments.get("expectedContentHash"))
-    return {
+    response = {
         "ok": True,
         "item": {
             "id": record["id"],
@@ -78,6 +124,11 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
             "versionNumber": record.get("versionNumber"),
         },
     }
+    if record["status"] == "published" and projection_configured():
+        published = publish_item(client, record["id"], actor=actor)
+        response["item"]["versionNumber"] = published.version_number
+        response.update(project_item_action(client, record["id"], unpublished=False))
+    return response
 
 
 def site_triggers_for(client, item_id: str) -> dict:
@@ -108,6 +159,7 @@ def publish_item_action(arguments: dict, actor: str) -> dict:
     }
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
+    response.update(project_item_action(client, arguments["id"], unpublished=False))
     return response
 
 
@@ -117,6 +169,7 @@ def unpublish_item_action(arguments: dict, actor: str) -> dict:
     response = {"ok": True, "changed": result.changed}
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
+    response.update(project_item_action(client, arguments["id"], unpublished=True))
     return response
 
 

package/amplify/functions/content-actions/requirements.txt

@@ -2,3 +2,4 @@ PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
 anthus-markus==0.5.1
 Pillow>=10,<12
+awscrt>=0.23,<1

package/amplify/functions/content-actions/resource.js

@@ -7,11 +7,15 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12", "awscrt>=0.23,<1"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
 }
+let siteFilesForNextContentActionsBundle;
+export function setSiteFilesForContentActionsBundle(siteFiles) {
+    siteFilesForNextContentActionsBundle = siteFiles;
+}
 export const contentActions = defineFunction((scope) => {
     return new Function(scope, "papyrus-content-actions", {
         runtime: Runtime.PYTHON_3_12,
@@ -25,6 +29,7 @@ export const contentActions = defineFunction((scope) => {
             requirements: contentActionsRequirements,
             noDeps: true,
             checkoutExtras: installCheckoutRequirements,
+            ...(siteFilesForNextContentActionsBundle !== undefined ? { siteFiles: siteFilesForNextContentActionsBundle } : {}),
         }, [
             "bash",
             "-c",

package/amplify/functions/content-actions/resource.ts

@@ -5,12 +5,12 @@ import { Construct } from "constructs";
 import { execSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../shared/python-bundle";
+import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12", "awscrt>=0.23,<1"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
@@ -20,6 +20,12 @@ function installCheckoutRequirements(outputDir: string): void {
   );
 }
 
+let siteFilesForNextContentActionsBundle: SiteBundleFile[] | undefined;
+
+export function setSiteFilesForContentActionsBundle(siteFiles: SiteBundleFile[] | undefined): void {
+  siteFilesForNextContentActionsBundle = siteFiles;
+}
+
 export const contentActions = defineFunction(
   (scope: Construct) => {
     return new Function(scope, "papyrus-content-actions", {
@@ -35,6 +41,7 @@ export const contentActions = defineFunction(
           requirements: contentActionsRequirements,
           noDeps: true,
           checkoutExtras: installCheckoutRequirements,
+          ...(siteFilesForNextContentActionsBundle !== undefined ? { siteFiles: siteFilesForNextContentActionsBundle } : {}),
         },
         [
           "bash",

package/amplify/functions/shared/python-bundle.js

@@ -1,5 +1,6 @@
 import { AssetHashType, DockerImage } from "aws-cdk-lib";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -41,6 +42,39 @@ export function toPep440(version) {
         throw new Error(`Cannot map ${version} to a PEP 440 version`);
     return m[2] === undefined ? m[1] : `${m[1]}.dev${m[2]}`;
 }
+function isBytecodeArtifact(sourcePath) {
+    return sourcePath.split(path.sep).includes("__pycache__") || sourcePath.endsWith(".pyc");
+}
+export function copySiteFiles(outputDir, siteFiles) {
+    for (const siteFile of siteFiles ?? []) {
+        const sourcePath = path.resolve(process.cwd(), siteFile.from);
+        if (!fs.existsSync(sourcePath))
+            throw new Error(`Site file to bundle does not exist: ${siteFile.from}`);
+        const destinationPath = path.join(outputDir, siteFile.to);
+        fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
+        fs.cpSync(sourcePath, destinationPath, { recursive: true, filter: (candidate) => !isBytecodeArtifact(candidate) });
+    }
+}
+function listFilesRecursively(root) {
+    if (fs.statSync(root).isFile())
+        return [root];
+    return fs.readdirSync(root).sort().flatMap((entry) => listFilesRecursively(path.join(root, entry)))
+        .filter((candidate) => !isBytecodeArtifact(candidate));
+}
+export function siteFilesContentHash(siteFiles) {
+    const hash = createHash("sha256");
+    for (const siteFile of siteFiles ?? []) {
+        const sourcePath = path.resolve(process.cwd(), siteFile.from);
+        hash.update(`${siteFile.to}\0`);
+        if (!fs.existsSync(sourcePath))
+            continue;
+        for (const filePath of listFilesRecursively(sourcePath)) {
+            hash.update(`${path.relative(sourcePath, filePath)}\0`);
+            hash.update(fs.readFileSync(filePath));
+        }
+    }
+    return hash.digest("hex").slice(0, 16);
+}
 function pipSpec() {
     return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
@@ -77,6 +111,7 @@ function bundleFromPip(outputDir, options) {
         ], { stdio: "inherit" });
     }
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
+    copySiteFiles(outputDir, options.siteFiles);
     if (options.corpora) {
         const corporaDir = path.join(outputDir, "corpora");
         fs.mkdirSync(corporaDir, { recursive: true });
@@ -96,6 +131,7 @@ export function bundleFromCheckout(outputDir, options) {
         fs.cpSync(path.join(packageRoot, "src", module), path.join(outputDir, module), { recursive: true });
     }
     options.checkoutExtras?.(outputDir);
+    copySiteFiles(outputDir, options.siteFiles);
 }
 /**
  * CDK Code for a Python Lambda. In package mode the asset hash is derived
@@ -103,14 +139,18 @@ export function bundleFromCheckout(outputDir, options) {
  */
 export function pythonLambdaCode(options, dockerCommand) {
     const packageMode = isPackageMode();
+    const hasSiteFiles = (options.siteFiles ?? []).length > 0;
+    const siteFilesSuffix = hasSiteFiles ? `:site-${siteFilesContentHash(options.siteFiles)}` : "";
     return Code.fromAsset(packageRoot, {
         ...(packageMode
             ? {
                 assetHashType: AssetHashType.CUSTOM,
-                assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}`
+                assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}${siteFilesSuffix}`
                     .replace(/[^a-zA-Z0-9._:=,-]/g, "_"),
             }
-            : {}),
+            : hasSiteFiles
+                ? { assetHashType: AssetHashType.OUTPUT }
+                : {}),
         bundling: {
             image: Runtime.PYTHON_3_12.bundlingImage ?? DockerImage.fromRegistry("public.ecr.aws/sam/build-python3.12"),
             local: {

package/amplify/functions/shared/python-bundle.ts

@@ -1,5 +1,6 @@
 import { AssetHashType, DockerImage } from "aws-cdk-lib";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -57,8 +58,46 @@ export type PythonBundleOptions = {
   noDeps?: boolean;
   /** Copy `<cwd>/corpora/*.yml` into the asset (publication-owned steering config). */
   corpora?: boolean;
+  /** Site repo files copied into the asset; `from` is relative to the current working directory, `to` to the asset root. A directory is copied recursively. */
+  siteFiles?: SiteBundleFile[];
 };
 
+export type SiteBundleFile = { from: string; to: string };
+
+function isBytecodeArtifact(sourcePath: string): boolean {
+  return sourcePath.split(path.sep).includes("__pycache__") || sourcePath.endsWith(".pyc");
+}
+
+export function copySiteFiles(outputDir: string, siteFiles: SiteBundleFile[] | undefined): void {
+  for (const siteFile of siteFiles ?? []) {
+    const sourcePath = path.resolve(process.cwd(), siteFile.from);
+    if (!fs.existsSync(sourcePath)) throw new Error(`Site file to bundle does not exist: ${siteFile.from}`);
+    const destinationPath = path.join(outputDir, siteFile.to);
+    fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
+    fs.cpSync(sourcePath, destinationPath, { recursive: true, filter: (candidate) => !isBytecodeArtifact(candidate) });
+  }
+}
+
+function listFilesRecursively(root: string): string[] {
+  if (fs.statSync(root).isFile()) return [root];
+  return fs.readdirSync(root).sort().flatMap((entry) => listFilesRecursively(path.join(root, entry)))
+    .filter((candidate) => !isBytecodeArtifact(candidate));
+}
+
+export function siteFilesContentHash(siteFiles: SiteBundleFile[] | undefined): string {
+  const hash = createHash("sha256");
+  for (const siteFile of siteFiles ?? []) {
+    const sourcePath = path.resolve(process.cwd(), siteFile.from);
+    hash.update(`${siteFile.to}\0`);
+    if (!fs.existsSync(sourcePath)) continue;
+    for (const filePath of listFilesRecursively(sourcePath)) {
+      hash.update(`${path.relative(sourcePath, filePath)}\0`);
+      hash.update(fs.readFileSync(filePath));
+    }
+  }
+  return hash.digest("hex").slice(0, 16);
+}
+
 function pipSpec(): string {
   return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
@@ -107,6 +146,7 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),
   );
+  copySiteFiles(outputDir, options.siteFiles);
   if (options.corpora) {
     const corporaDir = path.join(outputDir, "corpora");
     fs.mkdirSync(corporaDir, { recursive: true });
@@ -129,6 +169,7 @@ export function bundleFromCheckout(outputDir: string, options: PythonBundleOptio
     fs.cpSync(path.join(packageRoot, "src", module), path.join(outputDir, module), { recursive: true });
   }
   options.checkoutExtras?.(outputDir);
+  copySiteFiles(outputDir, options.siteFiles);
 }
 
 /**
@@ -137,14 +178,18 @@ export function bundleFromCheckout(outputDir: string, options: PythonBundleOptio
  */
 export function pythonLambdaCode(options: PythonBundleOptions, dockerCommand: string[]): Code {
   const packageMode = isPackageMode();
+  const hasSiteFiles = (options.siteFiles ?? []).length > 0;
+  const siteFilesSuffix = hasSiteFiles ? `:site-${siteFilesContentHash(options.siteFiles)}` : "";
   return Code.fromAsset(packageRoot, {
     ...(packageMode
       ? {
           assetHashType: AssetHashType.CUSTOM,
-          assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}`
+          assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}${siteFilesSuffix}`
             .replace(/[^a-zA-Z0-9._:=,-]/g, "_"),
         }
-      : {}),
+      : hasSiteFiles
+        ? { assetHashType: AssetHashType.OUTPUT }
+        : {}),
     bundling: {
       image: Runtime.PYTHON_3_12.bundlingImage ?? DockerImage.fromRegistry("public.ecr.aws/sam/build-python3.12"),
       local: {

package/amplify/publication/redirect-and-index.js

@@ -0,0 +1,37 @@
+import cf from "cloudfront";
+
+const redirectStore = cf.kvs();
+
+async function lookUpRedirectTarget(uri) {
+  try {
+    const target = await redirectStore.get(uri);
+    return target ? String(target) : null;
+  } catch (error) {
+    return null;
+  }
+}
+
+function rewriteToIndexDocument(uri) {
+  if (uri.endsWith("/")) {
+    return uri + "index.html";
+  }
+  const lastSegment = uri.substring(uri.lastIndexOf("/") + 1);
+  if (lastSegment.indexOf(".") === -1) {
+    return uri + "/index.html";
+  }
+  return uri;
+}
+
+async function handler(event) {
+  const request = event.request;
+  const redirectTarget = await lookUpRedirectTarget(request.uri);
+  if (redirectTarget !== null) {
+    return {
+      statusCode: 301,
+      statusDescription: "Moved Permanently",
+      headers: { location: { value: redirectTarget } },
+    };
+  }
+  request.uri = rewriteToIndexDocument(request.uri);
+  return request;
+}

package/amplify/publication/s3-projection-settings.js

@@ -0,0 +1,63 @@
+export const S3_PROJECTION_PROJECTOR_MODULE = "site_projector";
+export const S3_PROJECTION_STATIC_DIRECTORY = "/var/task/site_static";
+export function distributionIdFromArn(distributionArn) {
+    return distributionArn.slice(distributionArn.lastIndexOf("/") + 1);
+}
+export function s3ProjectionEnvironment(input) {
+    const environment = {
+        PAPYRUS_PUBLICATION_KIND: "s3-projection",
+        PAPYRUS_SITE_BUCKET: input.bucketName,
+    };
+    const distributionId = input.distributionId
+        ?? (input.distributionArn !== undefined ? distributionIdFromArn(input.distributionArn) : undefined);
+    if (distributionId !== undefined)
+        environment.PAPYRUS_EDGE_DISTRIBUTION_ID = distributionId;
+    environment.PAPYRUS_REDIRECTS_KVS_ARN = input.keyValueStoreArn;
+    environment.PAPYRUS_PROJECTION_DLQ_URL = input.deadLetterQueueUrl;
+    if (input.publicHostName !== undefined)
+        environment.PAPYRUS_SITE_PUBLIC_URL = `https://${input.publicHostName}`;
+    if (input.projector !== undefined)
+        environment.PAPYRUS_SITE_PROJECTOR = S3_PROJECTION_PROJECTOR_MODULE;
+    if (input.staticDir !== undefined)
+        environment.PAPYRUS_SITE_STATIC_DIR = S3_PROJECTION_STATIC_DIRECTORY;
+    return environment;
+}
+export function s3ProjectionPolicyStatements(input) {
+    const statements = [
+        { actions: ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"], resources: [`${input.bucketArn}/*`] },
+        { actions: ["s3:ListBucket"], resources: [input.bucketArn] },
+    ];
+    if (input.distributionArn !== undefined) {
+        statements.push({ actions: ["cloudfront:CreateInvalidation"], resources: [input.distributionArn] });
+    }
+    statements.push({
+        actions: [
+            "cloudfront-keyvaluestore:DescribeKeyValueStore",
+            "cloudfront-keyvaluestore:GetKey",
+            "cloudfront-keyvaluestore:PutKey",
+            "cloudfront-keyvaluestore:DeleteKey",
+            "cloudfront-keyvaluestore:UpdateKeys",
+            "cloudfront-keyvaluestore:ListKeys",
+        ],
+        resources: [input.keyValueStoreArn],
+    }, { actions: ["sqs:SendMessage"], resources: [input.deadLetterQueueArn] });
+    return statements;
+}
+export const S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB = 2048;
+export function planS3ProjectionBackend(publication) {
+    if (publication === undefined)
+        return { enabled: false, siteFiles: [], contentActionsMemorySize: undefined };
+    const siteFiles = [];
+    if (publication.projector !== undefined) {
+        siteFiles.push({ from: publication.projector, to: `${S3_PROJECTION_PROJECTOR_MODULE}.py` });
+    }
+    if (publication.staticDir !== undefined) {
+        siteFiles.push({ from: publication.staticDir, to: "site_static" });
+    }
+    return { enabled: true, siteFiles, contentActionsMemorySize: S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB };
+}
+export function contentActionsPublicationWiring(publication) {
+    if (publication === undefined)
+        return { environment: {}, policyStatements: [] };
+    return { environment: publication.environment, policyStatements: publication.policyStatements };
+}

package/amplify/publication/s3-projection-settings.ts

@@ -0,0 +1,98 @@
+/**
+ * Environment contract and IAM statements for the s3-projection publication.
+ * Pure (no CDK imports) so both can be tested without synthesizing.
+ */
+export type S3ProjectionSettingsInput = {
+  bucketName: string;
+  bucketArn: string;
+  keyValueStoreArn: string;
+  deadLetterQueueUrl: string;
+  deadLetterQueueArn: string;
+  distributionArn?: string;
+  distributionId?: string;
+  publicHostName?: string;
+  projector?: string;
+  staticDir?: string;
+};
+
+export type S3ProjectionPolicyStatementSpec = {
+  actions: string[];
+  resources: string[];
+};
+
+export const S3_PROJECTION_PROJECTOR_MODULE = "site_projector";
+export const S3_PROJECTION_STATIC_DIRECTORY = "/var/task/site_static";
+
+export function distributionIdFromArn(distributionArn: string): string {
+  return distributionArn.slice(distributionArn.lastIndexOf("/") + 1);
+}
+
+export function s3ProjectionEnvironment(input: S3ProjectionSettingsInput): Record<string, string> {
+  const environment: Record<string, string> = {
+    PAPYRUS_PUBLICATION_KIND: "s3-projection",
+    PAPYRUS_SITE_BUCKET: input.bucketName,
+  };
+  const distributionId = input.distributionId
+    ?? (input.distributionArn !== undefined ? distributionIdFromArn(input.distributionArn) : undefined);
+  if (distributionId !== undefined) environment.PAPYRUS_EDGE_DISTRIBUTION_ID = distributionId;
+  environment.PAPYRUS_REDIRECTS_KVS_ARN = input.keyValueStoreArn;
+  environment.PAPYRUS_PROJECTION_DLQ_URL = input.deadLetterQueueUrl;
+  if (input.publicHostName !== undefined) environment.PAPYRUS_SITE_PUBLIC_URL = `https://${input.publicHostName}`;
+  if (input.projector !== undefined) environment.PAPYRUS_SITE_PROJECTOR = S3_PROJECTION_PROJECTOR_MODULE;
+  if (input.staticDir !== undefined) environment.PAPYRUS_SITE_STATIC_DIR = S3_PROJECTION_STATIC_DIRECTORY;
+  return environment;
+}
+
+export function s3ProjectionPolicyStatements(input: S3ProjectionSettingsInput): S3ProjectionPolicyStatementSpec[] {
+  const statements: S3ProjectionPolicyStatementSpec[] = [
+    { actions: ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"], resources: [`${input.bucketArn}/*`] },
+    { actions: ["s3:ListBucket"], resources: [input.bucketArn] },
+  ];
+  if (input.distributionArn !== undefined) {
+    statements.push({ actions: ["cloudfront:CreateInvalidation"], resources: [input.distributionArn] });
+  }
+  statements.push(
+    {
+      actions: [
+        "cloudfront-keyvaluestore:DescribeKeyValueStore",
+        "cloudfront-keyvaluestore:GetKey",
+        "cloudfront-keyvaluestore:PutKey",
+        "cloudfront-keyvaluestore:DeleteKey",
+        "cloudfront-keyvaluestore:UpdateKeys",
+        "cloudfront-keyvaluestore:ListKeys",
+      ],
+      resources: [input.keyValueStoreArn],
+    },
+    { actions: ["sqs:SendMessage"], resources: [input.deadLetterQueueArn] },
+  );
+  return statements;
+}
+
+export type S3ProjectionBackendPlan = {
+  enabled: boolean;
+  siteFiles: Array<{ from: string; to: string }>;
+  contentActionsMemorySize: number | undefined;
+};
+
+export const S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB = 2048;
+
+export function planS3ProjectionBackend(
+  publication: { projector?: string; staticDir?: string } | undefined,
+): S3ProjectionBackendPlan {
+  if (publication === undefined) return { enabled: false, siteFiles: [], contentActionsMemorySize: undefined };
+  const siteFiles: Array<{ from: string; to: string }> = [];
+  if (publication.projector !== undefined) {
+    siteFiles.push({ from: publication.projector, to: `${S3_PROJECTION_PROJECTOR_MODULE}.py` });
+  }
+  if (publication.staticDir !== undefined) {
+    siteFiles.push({ from: publication.staticDir, to: "site_static" });
+  }
+  return { enabled: true, siteFiles, contentActionsMemorySize: S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB };
+}
+
+export function contentActionsPublicationWiring<Statement>(
+  publication: { environment: Record<string, string>; policyStatements: Statement[] } | undefined,
+): { environment: Record<string, string>; policyStatements: Statement[] } {
+  if (publication === undefined) return { environment: {}, policyStatements: [] };
+  return { environment: publication.environment, policyStatements: publication.policyStatements };
+}

package/amplify/publication/s3-projection.js

@@ -0,0 +1,117 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { assertValidPublicationConfig } from "../site-backend-config.js";
+import { s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
+const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
+function createSiteBucket(scope, retainBucketOnDelete) {
+    return new s3.Bucket(scope, "SiteBucket", {
+        versioned: true,
+        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+        enforceSSL: true,
+        encryption: s3.BucketEncryption.S3_MANAGED,
+        lifecycleRules: [{ noncurrentVersionExpiration: Duration.days(90) }],
+        removalPolicy: retainBucketOnDelete ? RemovalPolicy.RETAIN : RemovalPolicy.DESTROY,
+        autoDeleteObjects: !retainBucketOnDelete,
+    });
+}
+function createDnsValidatedCertificate(scope, aliases, hostedZone) {
+    const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "SiteHostedZone", {
+        hostedZoneId: hostedZone.hostedZoneId,
+        zoneName: hostedZone.hostedZoneName,
+    });
+    return new acm.DnsValidatedCertificate(scope, "SiteCertificate", {
+        domainName: aliases[0],
+        subjectAlternativeNames: aliases.slice(1),
+        hostedZone: zone,
+        region: "us-east-1",
+    });
+}
+function createDistribution(scope, props, bucket, redirectFunction) {
+    const aliases = props.distribution?.aliases ?? [];
+    let certificate;
+    if (aliases.length > 0) {
+        certificate = props.distribution?.acm !== undefined
+            ? createDnsValidatedCertificate(scope, aliases, props.distribution.acm)
+            : acm.Certificate.fromCertificateArn(scope, "SiteCertificate", props.distribution?.certificateArn ?? "");
+    }
+    return new cloudfront.Distribution(scope, "SiteDistribution", {
+        defaultRootObject: "index.html",
+        httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+        enableLogging: false,
+        domainNames: aliases.length > 0 ? aliases : undefined,
+        certificate,
+        defaultBehavior: {
+            origin: origins.S3BucketOrigin.withOriginAccessControl(bucket),
+            viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            compress: true,
+            functionAssociations: [{ function: redirectFunction, eventType: cloudfront.FunctionEventType.VIEWER_REQUEST }],
+        },
+        errorResponses: [
+            { httpStatus: 404, responseHttpStatus: 404, responsePagePath: "/404.html" },
+            { httpStatus: 403, responseHttpStatus: 404, responsePagePath: "/404.html" },
+        ],
+    });
+}
+export function addS3ProjectionPublication(scope, props) {
+    assertValidPublicationConfig({ kind: "s3-projection", ...props });
+    const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
+    const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+    const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
+        runtime: cloudfront.FunctionRuntime.JS_2_0,
+        code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+        keyValueStore,
+    });
+    const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {
+        encryption: sqs.QueueEncryption.SQS_MANAGED,
+        retentionPeriod: Duration.days(14),
+        enforceSSL: true,
+    });
+    const createsDistribution = props.distribution?.create === true;
+    const distribution = createsDistribution ? createDistribution(scope, props, bucket, redirectFunction) : undefined;
+    let distributionArn;
+    if (distribution !== undefined) {
+        distributionArn = distribution.distributionArn;
+    }
+    else if (props.edgeDistributionArn !== undefined) {
+        distributionArn = props.edgeDistributionArn;
+        bucket.addToResourcePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            principals: [new ServicePrincipal("cloudfront.amazonaws.com")],
+            actions: ["s3:GetObject"],
+            resources: [bucket.arnForObjects("*")],
+            conditions: { StringEquals: { "aws:SourceArn": props.edgeDistributionArn } },
+        }));
+    }
+    const settingsInput = {
+        bucketName: bucket.bucketName,
+        bucketArn: bucket.bucketArn,
+        keyValueStoreArn: keyValueStore.keyValueStoreArn,
+        deadLetterQueueUrl: deadLetterQueue.queueUrl,
+        deadLetterQueueArn: deadLetterQueue.queueArn,
+        distributionArn,
+        distributionId: distribution?.distributionId,
+        publicHostName: distribution !== undefined
+            ? (props.distribution?.aliases?.[0] ?? distribution.distributionDomainName)
+            : undefined,
+        projector: props.projector,
+        staticDir: props.staticDir,
+    };
+    return {
+        bucket,
+        keyValueStore,
+        redirectFunction,
+        deadLetterQueue,
+        distribution,
+        distributionId: distribution?.distributionId,
+        environment: s3ProjectionEnvironment(settingsInput),
+        policyStatements: s3ProjectionPolicyStatements(settingsInput).map((statement) => new PolicyStatement({ effect: Effect.ALLOW, actions: statement.actions, resources: statement.resources })),
+    };
+}

package/amplify/publication/s3-projection.ts

@@ -0,0 +1,152 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import type { Construct } from "constructs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
+import { s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
+
+const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
+
+export type S3ProjectionPublicationProps = Omit<PapyrusPublicationConfig, "kind"> & { kind?: "s3-projection" };
+
+export type S3ProjectionPublication = {
+  bucket: s3.Bucket;
+  keyValueStore: cloudfront.KeyValueStore;
+  redirectFunction: cloudfront.Function;
+  deadLetterQueue: sqs.Queue;
+  distribution?: cloudfront.Distribution;
+  distributionId?: string;
+  environment: Record<string, string>;
+  policyStatements: PolicyStatement[];
+};
+
+function createSiteBucket(scope: Construct, retainBucketOnDelete: boolean): s3.Bucket {
+  return new s3.Bucket(scope, "SiteBucket", {
+    versioned: true,
+    blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+    enforceSSL: true,
+    encryption: s3.BucketEncryption.S3_MANAGED,
+    lifecycleRules: [{ noncurrentVersionExpiration: Duration.days(90) }],
+    removalPolicy: retainBucketOnDelete ? RemovalPolicy.RETAIN : RemovalPolicy.DESTROY,
+    autoDeleteObjects: !retainBucketOnDelete,
+  });
+}
+
+function createDnsValidatedCertificate(
+  scope: Construct,
+  aliases: string[],
+  hostedZone: { hostedZoneId: string; hostedZoneName: string },
+): acm.ICertificate {
+  const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "SiteHostedZone", {
+    hostedZoneId: hostedZone.hostedZoneId,
+    zoneName: hostedZone.hostedZoneName,
+  });
+  return new acm.DnsValidatedCertificate(scope, "SiteCertificate", {
+    domainName: aliases[0],
+    subjectAlternativeNames: aliases.slice(1),
+    hostedZone: zone,
+    region: "us-east-1",
+  });
+}
+
+function createDistribution(
+  scope: Construct,
+  props: S3ProjectionPublicationProps,
+  bucket: s3.Bucket,
+  redirectFunction: cloudfront.Function,
+): cloudfront.Distribution {
+  const aliases = props.distribution?.aliases ?? [];
+  let certificate: acm.ICertificate | undefined;
+  if (aliases.length > 0) {
+    certificate = props.distribution?.acm !== undefined
+      ? createDnsValidatedCertificate(scope, aliases, props.distribution.acm)
+      : acm.Certificate.fromCertificateArn(scope, "SiteCertificate", props.distribution?.certificateArn ?? "");
+  }
+  return new cloudfront.Distribution(scope, "SiteDistribution", {
+    defaultRootObject: "index.html",
+    httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+    enableLogging: false,
+    domainNames: aliases.length > 0 ? aliases : undefined,
+    certificate,
+    defaultBehavior: {
+      origin: origins.S3BucketOrigin.withOriginAccessControl(bucket),
+      viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      compress: true,
+      functionAssociations: [{ function: redirectFunction, eventType: cloudfront.FunctionEventType.VIEWER_REQUEST }],
+    },
+    errorResponses: [
+      { httpStatus: 404, responseHttpStatus: 404, responsePagePath: "/404.html" },
+      { httpStatus: 403, responseHttpStatus: 404, responsePagePath: "/404.html" },
+    ],
+  });
+}
+
+export function addS3ProjectionPublication(scope: Construct, props: S3ProjectionPublicationProps): S3ProjectionPublication {
+  assertValidPublicationConfig({ kind: "s3-projection", ...props });
+  const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
+
+  const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+  const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
+    runtime: cloudfront.FunctionRuntime.JS_2_0,
+    code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+    keyValueStore,
+  });
+  const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {
+    encryption: sqs.QueueEncryption.SQS_MANAGED,
+    retentionPeriod: Duration.days(14),
+    enforceSSL: true,
+  });
+
+  const createsDistribution = props.distribution?.create === true;
+  const distribution = createsDistribution ? createDistribution(scope, props, bucket, redirectFunction) : undefined;
+
+  let distributionArn: string | undefined;
+  if (distribution !== undefined) {
+    distributionArn = distribution.distributionArn;
+  } else if (props.edgeDistributionArn !== undefined) {
+    distributionArn = props.edgeDistributionArn;
+    bucket.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [new ServicePrincipal("cloudfront.amazonaws.com")],
+        actions: ["s3:GetObject"],
+        resources: [bucket.arnForObjects("*")],
+        conditions: { StringEquals: { "aws:SourceArn": props.edgeDistributionArn } },
+      }),
+    );
+  }
+
+  const settingsInput = {
+    bucketName: bucket.bucketName,
+    bucketArn: bucket.bucketArn,
+    keyValueStoreArn: keyValueStore.keyValueStoreArn,
+    deadLetterQueueUrl: deadLetterQueue.queueUrl,
+    deadLetterQueueArn: deadLetterQueue.queueArn,
+    distributionArn,
+    distributionId: distribution?.distributionId,
+    publicHostName: distribution !== undefined
+      ? (props.distribution?.aliases?.[0] ?? distribution.distributionDomainName)
+      : undefined,
+    projector: props.projector,
+    staticDir: props.staticDir,
+  };
+  return {
+    bucket,
+    keyValueStore,
+    redirectFunction,
+    deadLetterQueue,
+    distribution,
+    distributionId: distribution?.distributionId,
+    environment: s3ProjectionEnvironment(settingsInput),
+    policyStatements: s3ProjectionPolicyStatements(settingsInput).map(
+      (statement) => new PolicyStatement({ effect: Effect.ALLOW, actions: statement.actions, resources: statement.resources }),
+    ),
+  };
+}

package/amplify/revalidate-secret-policy.js

@@ -0,0 +1,13 @@
+/**
+ * IAM statement for the content-actions Lambda's read of the revalidate secret.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ * The Lambda reads the parameter through boto3 get_parameters (plural), so the
+ * plural action must be granted alongside the singular one.
+ */
+export const REVALIDATE_SECRET_READ_ACTIONS = ["ssm:GetParameter", "ssm:GetParameters"];
+export function revalidateSecretReadStatement(input) {
+    return {
+        actions: REVALIDATE_SECRET_READ_ACTIONS,
+        resources: [`arn:${input.partition}:ssm:${input.region}:${input.account}:parameter${input.parameterName}`],
+    };
+}

package/amplify/revalidate-secret-policy.ts

@@ -0,0 +1,19 @@
+/**
+ * IAM statement for the content-actions Lambda's read of the revalidate secret.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ * The Lambda reads the parameter through boto3 get_parameters (plural), so the
+ * plural action must be granted alongside the singular one.
+ */
+export const REVALIDATE_SECRET_READ_ACTIONS = ["ssm:GetParameter", "ssm:GetParameters"];
+
+export function revalidateSecretReadStatement(input: {
+  partition: string;
+  region: string;
+  account: string;
+  parameterName: string;
+}): { actions: string[]; resources: string[] } {
+  return {
+    actions: REVALIDATE_SECRET_READ_ACTIONS,
+    resources: [`arn:${input.partition}:ssm:${input.region}:${input.account}:parameter${input.parameterName}`],
+  };
+}

package/amplify/site-backend-config.js

@@ -1 +1,51 @@
-export {};
+const CLOUDFRONT_DISTRIBUTION_ARN = /^arn:aws[a-z-]*:cloudfront::\d{12}:distribution\/[A-Z0-9]+$/;
+function isRelativePathWithoutParentSegments(value) {
+    if (value === "" || value.startsWith("/") || value.includes("\\"))
+        return false;
+    return !value.split("/").includes("..");
+}
+export function validatePublicationConfig(publication) {
+    const problems = [];
+    if (typeof publication !== "object" || publication === null) {
+        return ["publication must be an object"];
+    }
+    const config = publication;
+    if (config.kind !== "s3-projection") {
+        problems.push(`publication.kind must be "s3-projection" (got ${JSON.stringify(config.kind)})`);
+    }
+    if (config.projector !== undefined) {
+        if (typeof config.projector !== "string" || !isRelativePathWithoutParentSegments(config.projector) || !config.projector.endsWith(".py")) {
+            problems.push("publication.projector must be a relative .py path without '..'");
+        }
+    }
+    if (config.staticDir !== undefined) {
+        if (typeof config.staticDir !== "string" || !isRelativePathWithoutParentSegments(config.staticDir)) {
+            problems.push("publication.staticDir must be a relative path without '..'");
+        }
+    }
+    if (config.edgeDistributionArn !== undefined && !CLOUDFRONT_DISTRIBUTION_ARN.test(config.edgeDistributionArn)) {
+        problems.push("publication.edgeDistributionArn must be a CloudFront distribution ARN (arn:aws:cloudfront::<account>:distribution/<id>)");
+    }
+    const distribution = config.distribution;
+    if (distribution !== undefined) {
+        if (config.edgeDistributionArn !== undefined && distribution.create === true) {
+            problems.push("publication.edgeDistributionArn and publication.distribution.create are mutually exclusive");
+        }
+        const aliases = distribution.aliases ?? [];
+        if (aliases.length > 0 && distribution.create !== true) {
+            problems.push("publication.distribution.aliases require distribution.create to be true");
+        }
+        if (aliases.length > 0 && !distribution.certificateArn && !distribution.acm) {
+            problems.push("publication.distribution.aliases require certificateArn or acm");
+        }
+        if (distribution.acm !== undefined && (!distribution.acm.hostedZoneId || !distribution.acm.hostedZoneName)) {
+            problems.push("publication.distribution.acm requires hostedZoneId and hostedZoneName");
+        }
+    }
+    return problems;
+}
+export function assertValidPublicationConfig(publication) {
+    const problems = validatePublicationConfig(publication);
+    if (problems.length > 0)
+        throw new Error(`Invalid backend.publication: ${problems.join("; ")}`);
+}

package/amplify/site-backend-config.ts

@@ -22,6 +22,80 @@ export type PapyrusAuthConfig = {
   applyCognitoDomainPrefix?: boolean;
 };
 
+export type S3ProjectionDistributionConfig = {
+  create: boolean;
+  aliases?: string[];
+  certificateArn?: string;
+  acm?: { hostedZoneId: string; hostedZoneName: string };
+};
+
+export type PapyrusPublicationConfig = {
+  kind: "s3-projection";
+  /** Site repo path (relative, `.py`) of the SiteProjector bundled into content-actions as `site_projector`. */
+  projector?: string;
+  /** Site repo directory (relative) bundled into content-actions as `site_static/`. */
+  staticDir?: string;
+  /** Existing CloudFront distribution that reads the site bucket through OAC. */
+  edgeDistributionArn?: string;
+  /** Create the distribution (and optionally its certificate) in the site backend. Default: not created. */
+  distribution?: S3ProjectionDistributionConfig;
+  /** Default true: the site bucket is retained when the stack is deleted. `false` destroys it and its objects. */
+  retainBucketOnDelete?: boolean;
+};
+
+const CLOUDFRONT_DISTRIBUTION_ARN = /^arn:aws[a-z-]*:cloudfront::\d{12}:distribution\/[A-Z0-9]+$/;
+
+function isRelativePathWithoutParentSegments(value: string): boolean {
+  if (value === "" || value.startsWith("/") || value.includes("\\")) return false;
+  return !value.split("/").includes("..");
+}
+
+export function validatePublicationConfig(publication: unknown): string[] {
+  const problems: string[] = [];
+  if (typeof publication !== "object" || publication === null) {
+    return ["publication must be an object"];
+  }
+  const config = publication as Partial<PapyrusPublicationConfig> & { kind?: unknown };
+  if (config.kind !== "s3-projection") {
+    problems.push(`publication.kind must be "s3-projection" (got ${JSON.stringify(config.kind)})`);
+  }
+  if (config.projector !== undefined) {
+    if (typeof config.projector !== "string" || !isRelativePathWithoutParentSegments(config.projector) || !config.projector.endsWith(".py")) {
+      problems.push("publication.projector must be a relative .py path without '..'");
+    }
+  }
+  if (config.staticDir !== undefined) {
+    if (typeof config.staticDir !== "string" || !isRelativePathWithoutParentSegments(config.staticDir)) {
+      problems.push("publication.staticDir must be a relative path without '..'");
+    }
+  }
+  if (config.edgeDistributionArn !== undefined && !CLOUDFRONT_DISTRIBUTION_ARN.test(config.edgeDistributionArn)) {
+    problems.push("publication.edgeDistributionArn must be a CloudFront distribution ARN (arn:aws:cloudfront::<account>:distribution/<id>)");
+  }
+  const distribution = config.distribution;
+  if (distribution !== undefined) {
+    if (config.edgeDistributionArn !== undefined && distribution.create === true) {
+      problems.push("publication.edgeDistributionArn and publication.distribution.create are mutually exclusive");
+    }
+    const aliases = distribution.aliases ?? [];
+    if (aliases.length > 0 && distribution.create !== true) {
+      problems.push("publication.distribution.aliases require distribution.create to be true");
+    }
+    if (aliases.length > 0 && !distribution.certificateArn && !distribution.acm) {
+      problems.push("publication.distribution.aliases require certificateArn or acm");
+    }
+    if (distribution.acm !== undefined && (!distribution.acm.hostedZoneId || !distribution.acm.hostedZoneName)) {
+      problems.push("publication.distribution.acm requires hostedZoneId and hostedZoneName");
+    }
+  }
+  return problems;
+}
+
+export function assertValidPublicationConfig(publication: unknown): void {
+  const problems = validatePublicationConfig(publication);
+  if (problems.length > 0) throw new Error(`Invalid backend.publication: ${problems.join("; ")}`);
+}
+
 export type PapyrusSiteBackendConfig = {
   /** Brand id; namespaces account-global resources (S3 Vectors index name). */
   brandId?: string;
@@ -56,6 +130,8 @@ export type PapyrusSiteBackendConfig = {
     /** Let this stack verify the SES domain identity and write its TXT record. Default false: verify once by hand. */
     manageDomainIdentity?: boolean;
   };
+  /** Opt-in static projection of published pages into an S3 site bucket. Unset: nothing is created. */
+  publication?: PapyrusPublicationConfig;
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend.js

@@ -7,13 +7,17 @@ import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aw
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves.js";
+import { addS3ProjectionPublication } from "./publication/s3-projection.js";
+import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
+import { assertValidPublicationConfig } from "./site-backend-config.js";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
-import { contentActions } from "./functions/content-actions/resource.js";
+import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource.js";
 import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
@@ -61,6 +65,10 @@ export function defineSiteBackend(papyrusSite) {
         ...baseAuthConfig,
         newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
     };
+    if (site.publication !== undefined)
+        assertValidPublicationConfig(site.publication);
+    const publicationPlan = planS3ProjectionBackend(site.publication);
+    setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
     const backend = defineBackend({
         assignmentAction,
         auth: defineSiteAuth(authConfig),
@@ -301,6 +309,18 @@ export function defineSiteBackend(papyrusSite) {
     if (rebuildSettings.resources.length > 0) {
         contentActionsLambda.addToRolePolicy(new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }));
     }
+    let s3ProjectionPublication;
+    if (site.publication !== undefined) {
+        s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication);
+        contentActionsLambda.node.defaultChild.memorySize = publicationPlan.contentActionsMemorySize;
+    }
+    const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
+    for (const [name, value] of Object.entries(publicationWiring.environment)) {
+        contentActionsLambda.addEnvironment(name, value);
+    }
+    for (const statement of publicationWiring.policyStatements) {
+        contentActionsLambda.addToRolePolicy(statement);
+    }
     if ((site.revalidateBaseUrl ?? "").trim() !== "") {
         backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
         const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
@@ -309,10 +329,12 @@ export function defineSiteBackend(papyrusSite) {
         }
         backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
         const revalidateStack = Stack.of(contentActionsLambda);
-        contentActionsLambda.addToRolePolicy(new PolicyStatement({
-            actions: ["ssm:GetParameter"],
-            resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
-        }));
+        contentActionsLambda.addToRolePolicy(new PolicyStatement(revalidateSecretReadStatement({
+            partition: revalidateStack.partition,
+            region: revalidateStack.region,
+            account: revalidateStack.account,
+            parameterName: revalidateSecretParameter,
+        })));
     }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);

package/amplify/site-backend.ts

@@ -3,20 +3,24 @@ import { Stack } from "aws-cdk-lib";
 import type * as backup from "aws-cdk-lib/aws-backup";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { CfnEventSourceMapping, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+import { CfnEventSourceMapping, CfnFunction, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import type { Construct } from "constructs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves";
+import { addS3ProjectionPublication, type S3ProjectionPublication } from "./publication/s3-projection";
+import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
+import { assertValidPublicationConfig } from "./site-backend-config";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
-import { contentActions } from "./functions/content-actions/resource";
+import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource";
 import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
@@ -79,6 +83,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     ...baseAuthConfig,
     newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
   };
+  if (site.publication !== undefined) assertValidPublicationConfig(site.publication);
+  const publicationPlan = planS3ProjectionBackend(site.publication);
+  setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
   const backend = defineBackend({
     assignmentAction,
     auth: defineSiteAuth(authConfig),
@@ -387,6 +394,18 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
       new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }),
     );
   }
+  let s3ProjectionPublication: S3ProjectionPublication | undefined;
+  if (site.publication !== undefined) {
+    s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication);
+    (contentActionsLambda.node.defaultChild as CfnFunction).memorySize = publicationPlan.contentActionsMemorySize;
+  }
+  const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
+  for (const [name, value] of Object.entries(publicationWiring.environment)) {
+    contentActionsLambda.addEnvironment(name, value);
+  }
+  for (const statement of publicationWiring.policyStatements) {
+    contentActionsLambda.addToRolePolicy(statement);
+  }
   if ((site.revalidateBaseUrl ?? "").trim() !== "") {
     backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
     const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
@@ -398,10 +417,14 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
     const revalidateStack = Stack.of(contentActionsLambda);
     contentActionsLambda.addToRolePolicy(
-      new PolicyStatement({
-        actions: ["ssm:GetParameter"],
-        resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
-      }),
+      new PolicyStatement(
+        revalidateSecretReadStatement({
+          partition: revalidateStack.partition,
+          region: revalidateStack.region,
+          account: revalidateStack.account,
+          parameterName: revalidateSecretParameter,
+        }),
+      ),
     );
   }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);

package/package.json

@@ -302,7 +302,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.42",
+  "version": "1.0.0-next.44",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.42",
+  "version": "1.0.0-next.44",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",