@anthusai/papyrus 1.0.0-next.43 → 1.0.0-next.45

package/amplify/functions/content-actions/handler.py

@@ -6,6 +6,13 @@ from typing import Any
 
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.projection.engine import project
+from papyrus_content.projection.runtime import (
+    DEAD_LETTER_QUEUE_ENV,
+    context_from_environment,
+    projection_configured,
+    public_item_url,
+)
 from papyrus_content.rebuild_trigger import (
     DEFAULT_STAGING_BRANCH,
     reader_target_from_environment,
@@ -56,6 +63,45 @@ def derive_markus_action(arguments: dict) -> dict:
     return response
 
 
+def send_to_projection_dead_letter_queue(item_id: str, unpublished: bool, error: str) -> None:
+    queue_url = (os.environ.get(DEAD_LETTER_QUEUE_ENV) or "").strip()
+    if not queue_url:
+        return
+    try:
+        import boto3
+
+        boto3.client("sqs").send_message(
+            QueueUrl=queue_url,
+            MessageBody=json.dumps({"itemId": item_id, "unpublished": unpublished, "error": error}),
+        )
+    except Exception:  # noqa: BLE001 - the dead letter is best effort; the response already reports the failure
+        pass
+
+
+def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
+    if not projection_configured():
+        return {}
+    liveness = {} if unpublished else {"live": False}
+    try:
+        context = context_from_environment(client)
+        report = project(context, item_id, unpublished=unpublished)
+    except Exception as error:  # noqa: BLE001 - a projection failure never fails the save
+        message = f"{type(error).__name__}: {error}"
+        send_to_projection_dead_letter_queue(item_id, unpublished, message)
+        return {**liveness, "projected": False, "paths": [], "error": message}
+    response = {"projected": report.ok, "paths": [*report.written, *report.deleted]}
+    if not unpublished:
+        response["live"] = report.ok
+        url = public_item_url(os.environ, report.item_paths)
+        if url:
+            response["url"] = url
+    if not report.ok:
+        message = "; ".join(report.errors)
+        send_to_projection_dead_letter_queue(item_id, unpublished, message)
+        response["error"] = message
+    return response
+
+
 def save_item_draft_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     fields = ItemFields(
@@ -68,7 +114,7 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
         id=arguments.get("id"),
     )
     record = save_item(client, fields, actor=actor, expected_content_hash=arguments.get("expectedContentHash"))
-    return {
+    response = {
         "ok": True,
         "item": {
             "id": record["id"],
@@ -78,6 +124,11 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
             "versionNumber": record.get("versionNumber"),
         },
     }
+    if record["status"] == "published" and projection_configured():
+        published = publish_item(client, record["id"], actor=actor)
+        response["item"]["versionNumber"] = published.version_number
+        response.update(project_item_action(client, record["id"], unpublished=False))
+    return response
 
 
 def site_triggers_for(client, item_id: str) -> dict:
@@ -108,6 +159,7 @@ def publish_item_action(arguments: dict, actor: str) -> dict:
     }
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
+    response.update(project_item_action(client, arguments["id"], unpublished=False))
     return response
 
 
@@ -117,6 +169,7 @@ def unpublish_item_action(arguments: dict, actor: str) -> dict:
     response = {"ok": True, "changed": result.changed}
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
+    response.update(project_item_action(client, arguments["id"], unpublished=True))
     return response
 
 

package/amplify/functions/content-actions/requirements.txt

@@ -1,4 +1,5 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
 anthus-markus==0.5.1
-Pillow>=10,<12
+Pillow>=11.3,<12
+awscrt>=0.23,<1

package/amplify/functions/content-actions/resource.js

@@ -7,11 +7,15 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
 }
+let siteFilesForNextContentActionsBundle;
+export function setSiteFilesForContentActionsBundle(siteFiles) {
+    siteFilesForNextContentActionsBundle = siteFiles;
+}
 export const contentActions = defineFunction((scope) => {
     return new Function(scope, "papyrus-content-actions", {
         runtime: Runtime.PYTHON_3_12,
@@ -25,6 +29,7 @@ export const contentActions = defineFunction((scope) => {
             requirements: contentActionsRequirements,
             noDeps: true,
             checkoutExtras: installCheckoutRequirements,
+            ...(siteFilesForNextContentActionsBundle !== undefined ? { siteFiles: siteFilesForNextContentActionsBundle } : {}),
         }, [
             "bash",
             "-c",

package/amplify/functions/content-actions/resource.ts

@@ -5,12 +5,12 @@ import { Construct } from "constructs";
 import { execSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../shared/python-bundle";
+import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
@@ -20,6 +20,12 @@ function installCheckoutRequirements(outputDir: string): void {
   );
 }
 
+let siteFilesForNextContentActionsBundle: SiteBundleFile[] | undefined;
+
+export function setSiteFilesForContentActionsBundle(siteFiles: SiteBundleFile[] | undefined): void {
+  siteFilesForNextContentActionsBundle = siteFiles;
+}
+
 export const contentActions = defineFunction(
   (scope: Construct) => {
     return new Function(scope, "papyrus-content-actions", {
@@ -35,6 +41,7 @@ export const contentActions = defineFunction(
           requirements: contentActionsRequirements,
           noDeps: true,
           checkoutExtras: installCheckoutRequirements,
+          ...(siteFilesForNextContentActionsBundle !== undefined ? { siteFiles: siteFilesForNextContentActionsBundle } : {}),
         },
         [
           "bash",

package/amplify/functions/renditions/handler.py

@@ -0,0 +1,94 @@
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from typing import Any
+
+from papyrus_content.projection.runtime import SITE_BUCKET_ENV, SITE_STATIC_DIRECTORY_ENV
+from papyrus_content.renditions import (
+    RenditionSettings,
+    S3RenditionStore,
+    make_renditions,
+    meta_key,
+    settings_from_static_directory,
+    source_from_media_key,
+)
+
+_loaded: dict[str, Any] = {}
+
+
+def configured_settings() -> RenditionSettings | None:
+    if "settings" not in _loaded:
+        static_directory = (os.environ.get(SITE_STATIC_DIRECTORY_ENV) or "").strip()
+        _loaded["settings"] = settings_from_static_directory(Path(static_directory) if static_directory else None)
+    return _loaded["settings"]
+
+
+def site_store() -> S3RenditionStore:
+    if "store" not in _loaded:
+        _loaded["store"] = S3RenditionStore(os.environ[SITE_BUCKET_ENV])
+    return _loaded["store"]
+
+
+def s3_client():
+    if "s3" not in _loaded:
+        import boto3
+
+        _loaded["s3"] = boto3.client("s3")
+    return _loaded["s3"]
+
+
+def media_objects(event: dict) -> list[tuple[str, str]]:
+    if event.get("source") == "aws.s3" and "detail" in event:
+        detail = event["detail"]
+        return [(detail["bucket"]["name"], detail["object"]["key"])]
+    if "bucket" in event and "key" in event:
+        return [(event["bucket"], event["key"])]
+    raise ValueError("The event is neither an S3 object event nor a {bucket, key} request.")
+
+
+def render_media_object(
+    settings: RenditionSettings, bucket: str, key: str, *, skip_existing: bool = False, dry_run: bool = False
+) -> dict:
+    source = source_from_media_key(key)
+    if source is None:
+        return {"key": key, "action": "ignored", "reason": "not an image under media/"}
+    if skip_existing and site_store().get(meta_key(settings.pipeline, source)) is not None:
+        return {"key": key, "source": source, "action": "skipped-existing"}
+    if dry_run:
+        return {"key": key, "source": source, "action": "would-render"}
+    started = time.perf_counter()
+    data = s3_client().get_object(Bucket=bucket, Key=key)["Body"].read()
+    downloaded = time.perf_counter()
+    result = make_renditions(settings, site_store(), source, data)
+    finished = time.perf_counter()
+    return {
+        "key": key,
+        "source": source,
+        "action": "rendered",
+        "kind": result["kind"],
+        "written": result["written"],
+        "sourceBytes": len(data),
+        "downloadMilliseconds": round((downloaded - started) * 1000),
+        "renditionMilliseconds": round((finished - downloaded) * 1000),
+    }
+
+
+def handler(event, context):
+    settings = configured_settings()
+    if settings is None:
+        return {"ok": True, "results": [], "skipped": "this site has no images settings in projection.json"}
+    results = [
+        render_media_object(
+            settings,
+            bucket,
+            key,
+            skip_existing=event.get("skipExisting") is True,
+            dry_run=event.get("dryRun") is True,
+        )
+        for bucket, key in media_objects(event)
+    ]
+    print(json.dumps({"renditions": results}))
+    return {"ok": True, "results": results}

package/amplify/functions/renditions/requirements.txt

@@ -0,0 +1,4 @@
+PyYAML>=6.0.2,<7
+citeproc-py>=0.8.2,<1
+anthus-markus==0.5.1
+Pillow>=11.3,<12

package/amplify/functions/shared/python-bundle.js

@@ -1,5 +1,6 @@
 import { AssetHashType, DockerImage } from "aws-cdk-lib";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -41,6 +42,39 @@ export function toPep440(version) {
         throw new Error(`Cannot map ${version} to a PEP 440 version`);
     return m[2] === undefined ? m[1] : `${m[1]}.dev${m[2]}`;
 }
+function isBytecodeArtifact(sourcePath) {
+    return sourcePath.split(path.sep).includes("__pycache__") || sourcePath.endsWith(".pyc");
+}
+export function copySiteFiles(outputDir, siteFiles) {
+    for (const siteFile of siteFiles ?? []) {
+        const sourcePath = path.resolve(process.cwd(), siteFile.from);
+        if (!fs.existsSync(sourcePath))
+            throw new Error(`Site file to bundle does not exist: ${siteFile.from}`);
+        const destinationPath = path.join(outputDir, siteFile.to);
+        fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
+        fs.cpSync(sourcePath, destinationPath, { recursive: true, filter: (candidate) => !isBytecodeArtifact(candidate) });
+    }
+}
+function listFilesRecursively(root) {
+    if (fs.statSync(root).isFile())
+        return [root];
+    return fs.readdirSync(root).sort().flatMap((entry) => listFilesRecursively(path.join(root, entry)))
+        .filter((candidate) => !isBytecodeArtifact(candidate));
+}
+export function siteFilesContentHash(siteFiles) {
+    const hash = createHash("sha256");
+    for (const siteFile of siteFiles ?? []) {
+        const sourcePath = path.resolve(process.cwd(), siteFile.from);
+        hash.update(`${siteFile.to}\0`);
+        if (!fs.existsSync(sourcePath))
+            continue;
+        for (const filePath of listFilesRecursively(sourcePath)) {
+            hash.update(`${path.relative(sourcePath, filePath)}\0`);
+            hash.update(fs.readFileSync(filePath));
+        }
+    }
+    return hash.digest("hex").slice(0, 16);
+}
 function pipSpec() {
     return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
@@ -77,6 +111,7 @@ function bundleFromPip(outputDir, options) {
         ], { stdio: "inherit" });
     }
     fs.copyFileSync(path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"), path.join(outputDir, "handler.py"));
+    copySiteFiles(outputDir, options.siteFiles);
     if (options.corpora) {
         const corporaDir = path.join(outputDir, "corpora");
         fs.mkdirSync(corporaDir, { recursive: true });
@@ -96,6 +131,7 @@ export function bundleFromCheckout(outputDir, options) {
         fs.cpSync(path.join(packageRoot, "src", module), path.join(outputDir, module), { recursive: true });
     }
     options.checkoutExtras?.(outputDir);
+    copySiteFiles(outputDir, options.siteFiles);
 }
 /**
  * CDK Code for a Python Lambda. In package mode the asset hash is derived
@@ -103,14 +139,18 @@ export function bundleFromCheckout(outputDir, options) {
  */
 export function pythonLambdaCode(options, dockerCommand) {
     const packageMode = isPackageMode();
+    const hasSiteFiles = (options.siteFiles ?? []).length > 0;
+    const siteFilesSuffix = hasSiteFiles ? `:site-${siteFilesContentHash(options.siteFiles)}` : "";
     return Code.fromAsset(packageRoot, {
         ...(packageMode
             ? {
                 assetHashType: AssetHashType.CUSTOM,
-                assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}`
+                assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}${siteFilesSuffix}`
                     .replace(/[^a-zA-Z0-9._:=,-]/g, "_"),
             }
-            : {}),
+            : hasSiteFiles
+                ? { assetHashType: AssetHashType.OUTPUT }
+                : {}),
         bundling: {
             image: Runtime.PYTHON_3_12.bundlingImage ?? DockerImage.fromRegistry("public.ecr.aws/sam/build-python3.12"),
             local: {

package/amplify/functions/shared/python-bundle.ts

@@ -1,5 +1,6 @@
 import { AssetHashType, DockerImage } from "aws-cdk-lib";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -57,8 +58,46 @@ export type PythonBundleOptions = {
   noDeps?: boolean;
   /** Copy `<cwd>/corpora/*.yml` into the asset (publication-owned steering config). */
   corpora?: boolean;
+  /** Site repo files copied into the asset; `from` is relative to the current working directory, `to` to the asset root. A directory is copied recursively. */
+  siteFiles?: SiteBundleFile[];
 };
 
+export type SiteBundleFile = { from: string; to: string };
+
+function isBytecodeArtifact(sourcePath: string): boolean {
+  return sourcePath.split(path.sep).includes("__pycache__") || sourcePath.endsWith(".pyc");
+}
+
+export function copySiteFiles(outputDir: string, siteFiles: SiteBundleFile[] | undefined): void {
+  for (const siteFile of siteFiles ?? []) {
+    const sourcePath = path.resolve(process.cwd(), siteFile.from);
+    if (!fs.existsSync(sourcePath)) throw new Error(`Site file to bundle does not exist: ${siteFile.from}`);
+    const destinationPath = path.join(outputDir, siteFile.to);
+    fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
+    fs.cpSync(sourcePath, destinationPath, { recursive: true, filter: (candidate) => !isBytecodeArtifact(candidate) });
+  }
+}
+
+function listFilesRecursively(root: string): string[] {
+  if (fs.statSync(root).isFile()) return [root];
+  return fs.readdirSync(root).sort().flatMap((entry) => listFilesRecursively(path.join(root, entry)))
+    .filter((candidate) => !isBytecodeArtifact(candidate));
+}
+
+export function siteFilesContentHash(siteFiles: SiteBundleFile[] | undefined): string {
+  const hash = createHash("sha256");
+  for (const siteFile of siteFiles ?? []) {
+    const sourcePath = path.resolve(process.cwd(), siteFile.from);
+    hash.update(`${siteFile.to}\0`);
+    if (!fs.existsSync(sourcePath)) continue;
+    for (const filePath of listFilesRecursively(sourcePath)) {
+      hash.update(`${path.relative(sourcePath, filePath)}\0`);
+      hash.update(fs.readFileSync(filePath));
+    }
+  }
+  return hash.digest("hex").slice(0, 16);
+}
+
 function pipSpec(): string {
   return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
@@ -107,6 +146,7 @@ function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
     path.join(packageRoot, "amplify/functions", options.functionDir, "handler.py"),
     path.join(outputDir, "handler.py"),
   );
+  copySiteFiles(outputDir, options.siteFiles);
   if (options.corpora) {
     const corporaDir = path.join(outputDir, "corpora");
     fs.mkdirSync(corporaDir, { recursive: true });
@@ -129,6 +169,7 @@ export function bundleFromCheckout(outputDir: string, options: PythonBundleOptio
     fs.cpSync(path.join(packageRoot, "src", module), path.join(outputDir, module), { recursive: true });
   }
   options.checkoutExtras?.(outputDir);
+  copySiteFiles(outputDir, options.siteFiles);
 }
 
 /**
@@ -137,14 +178,18 @@ export function bundleFromCheckout(outputDir: string, options: PythonBundleOptio
  */
 export function pythonLambdaCode(options: PythonBundleOptions, dockerCommand: string[]): Code {
   const packageMode = isPackageMode();
+  const hasSiteFiles = (options.siteFiles ?? []).length > 0;
+  const siteFilesSuffix = hasSiteFiles ? `:site-${siteFilesContentHash(options.siteFiles)}` : "";
   return Code.fromAsset(packageRoot, {
     ...(packageMode
       ? {
           assetHashType: AssetHashType.CUSTOM,
-          assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}`
+          assetHash: `${options.functionDir}:${pipSpec()}:${(options.requirements ?? []).join(",")}${siteFilesSuffix}`
             .replace(/[^a-zA-Z0-9._:=,-]/g, "_"),
         }
-      : {}),
+      : hasSiteFiles
+        ? { assetHashType: AssetHashType.OUTPUT }
+        : {}),
     bundling: {
       image: Runtime.PYTHON_3_12.bundlingImage ?? DockerImage.fromRegistry("public.ecr.aws/sam/build-python3.12"),
       local: {

package/amplify/publication/redirect-and-index.js

@@ -0,0 +1,37 @@
+import cf from "cloudfront";
+
+const redirectStore = cf.kvs();
+
+async function lookUpRedirectTarget(uri) {
+  try {
+    const target = await redirectStore.get(uri);
+    return target ? String(target) : null;
+  } catch (error) {
+    return null;
+  }
+}
+
+function rewriteToIndexDocument(uri) {
+  if (uri.endsWith("/")) {
+    return uri + "index.html";
+  }
+  const lastSegment = uri.substring(uri.lastIndexOf("/") + 1);
+  if (lastSegment.indexOf(".") === -1) {
+    return uri + "/index.html";
+  }
+  return uri;
+}
+
+async function handler(event) {
+  const request = event.request;
+  const redirectTarget = await lookUpRedirectTarget(request.uri);
+  if (redirectTarget !== null) {
+    return {
+      statusCode: 301,
+      statusDescription: "Moved Permanently",
+      headers: { location: { value: redirectTarget } },
+    };
+  }
+  request.uri = rewriteToIndexDocument(request.uri);
+  return request;
+}

package/amplify/publication/renditions-function.js

@@ -0,0 +1,74 @@
+import { Duration, Size } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../functions/shared/python-bundle.js";
+import { RENDITIONS_EPHEMERAL_STORAGE_MB, RENDITIONS_MEDIA_PREFIX, RENDITIONS_MEMORY_MB, RENDITIONS_TIMEOUT_SECONDS, renditionsEnvironment, renditionsEventPattern, } from "./renditions-settings.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../..");
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export function addRenditionsFunction(scope, props) {
+    const deadLetterQueue = new sqs.Queue(scope, "RenditionsDeadLetterQueue", {
+        encryption: sqs.QueueEncryption.SQS_MANAGED,
+        retentionPeriod: Duration.days(14),
+        enforceSSL: true,
+    });
+    const renditions = new LambdaFunction(scope, "RenditionsFunction", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(RENDITIONS_TIMEOUT_SECONDS),
+        memorySize: RENDITIONS_MEMORY_MB,
+        ephemeralStorageSize: Size.mebibytes(RENDITIONS_EPHEMERAL_STORAGE_MB),
+        retryAttempts: 2,
+        deadLetterQueue,
+        environment: renditionsEnvironment(props.siteBucket.bucketName),
+        code: props.code ?? pythonLambdaCode({
+            functionDir: "renditions",
+            modules: ["papyrus_content"],
+            requirements: renditionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+            siteFiles: props.siteFiles,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/renditions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/renditions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:GetObject"],
+        resources: [props.mediaBucket.arnForObjects(`${RENDITIONS_MEDIA_PREFIX}*`)],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:PutObject", "s3:GetObject"],
+        resources: [props.siteBucket.arnForObjects("*")],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:ListBucket"],
+        resources: [props.siteBucket.bucketArn],
+    }));
+    const rule = new events.Rule(scope, "MediaObjectCreatedRule", {
+        eventPattern: renditionsEventPattern(props.mediaBucket.bucketName),
+    });
+    rule.addTarget(new targets.LambdaFunction(renditions, { retryAttempts: 2 }));
+    return { function: renditions, rule, deadLetterQueue };
+}

package/amplify/publication/renditions-function.ts

@@ -0,0 +1,112 @@
+import { Duration, Size } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, type Code, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import type { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode, type SiteBundleFile } from "../functions/shared/python-bundle";
+import {
+  RENDITIONS_EPHEMERAL_STORAGE_MB,
+  RENDITIONS_MEDIA_PREFIX,
+  RENDITIONS_MEMORY_MB,
+  RENDITIONS_TIMEOUT_SECONDS,
+  renditionsEnvironment,
+  renditionsEventPattern,
+} from "./renditions-settings";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../..");
+
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+
+export type RenditionsFunctionProps = {
+  siteBucket: s3.IBucket;
+  mediaBucket: s3.IBucket;
+  siteFiles: SiteBundleFile[];
+  code?: Code;
+};
+
+export type RenditionsFunction = {
+  function: LambdaFunction;
+  rule: events.Rule;
+  deadLetterQueue: sqs.Queue;
+};
+
+function installCheckoutRequirements(outputDir: string): void {
+  const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
+  execSync(
+    `python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`,
+    { cwd: projectRoot, stdio: "inherit" },
+  );
+}
+
+export function addRenditionsFunction(scope: Construct, props: RenditionsFunctionProps): RenditionsFunction {
+  const deadLetterQueue = new sqs.Queue(scope, "RenditionsDeadLetterQueue", {
+    encryption: sqs.QueueEncryption.SQS_MANAGED,
+    retentionPeriod: Duration.days(14),
+    enforceSSL: true,
+  });
+  const renditions = new LambdaFunction(scope, "RenditionsFunction", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(RENDITIONS_TIMEOUT_SECONDS),
+    memorySize: RENDITIONS_MEMORY_MB,
+    ephemeralStorageSize: Size.mebibytes(RENDITIONS_EPHEMERAL_STORAGE_MB),
+    retryAttempts: 2,
+    deadLetterQueue,
+    environment: renditionsEnvironment(props.siteBucket.bucketName),
+    code: props.code ?? pythonLambdaCode(
+      {
+        functionDir: "renditions",
+        modules: ["papyrus_content"],
+        requirements: renditionsRequirements,
+        noDeps: true,
+        checkoutExtras: installCheckoutRequirements,
+        siteFiles: props.siteFiles,
+      },
+      [
+        "bash",
+        "-c",
+        [
+          "set -euo pipefail",
+          "mkdir -p /asset-output/papyrus_content",
+          "cp amplify/functions/renditions/handler.py /asset-output/handler.py",
+          "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          "python3 -m pip install -r amplify/functions/renditions/requirements.txt -t /asset-output --no-cache-dir",
+        ].join(" && "),
+      ],
+    ),
+  });
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:GetObject"],
+      resources: [props.mediaBucket.arnForObjects(`${RENDITIONS_MEDIA_PREFIX}*`)],
+    }),
+  );
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject", "s3:GetObject"],
+      resources: [props.siteBucket.arnForObjects("*")],
+    }),
+  );
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:ListBucket"],
+      resources: [props.siteBucket.bucketArn],
+    }),
+  );
+  const rule = new events.Rule(scope, "MediaObjectCreatedRule", {
+    eventPattern: renditionsEventPattern(props.mediaBucket.bucketName),
+  });
+  rule.addTarget(new targets.LambdaFunction(renditions, { retryAttempts: 2 }));
+  return { function: renditions, rule, deadLetterQueue };
+}