@anthusai/papyrus 1.0.0-next.43 → 1.0.0-next.45

package/amplify/site-backend-config.ts

@@ -22,6 +22,80 @@ export type PapyrusAuthConfig = {
   applyCognitoDomainPrefix?: boolean;
 };
 
+export type S3ProjectionDistributionConfig = {
+  create: boolean;
+  aliases?: string[];
+  certificateArn?: string;
+  acm?: { hostedZoneId: string; hostedZoneName: string };
+};
+
+export type PapyrusPublicationConfig = {
+  kind: "s3-projection";
+  /** Site repo path (relative, `.py`) of the SiteProjector bundled into content-actions as `site_projector`. */
+  projector?: string;
+  /** Site repo directory (relative) bundled into content-actions as `site_static/`. */
+  staticDir?: string;
+  /** Existing CloudFront distribution that reads the site bucket through OAC. */
+  edgeDistributionArn?: string;
+  /** Create the distribution (and optionally its certificate) in the site backend. Default: not created. */
+  distribution?: S3ProjectionDistributionConfig;
+  /** Default true: the site bucket is retained when the stack is deleted. `false` destroys it and its objects. */
+  retainBucketOnDelete?: boolean;
+};
+
+const CLOUDFRONT_DISTRIBUTION_ARN = /^arn:aws[a-z-]*:cloudfront::\d{12}:distribution\/[A-Z0-9]+$/;
+
+function isRelativePathWithoutParentSegments(value: string): boolean {
+  if (value === "" || value.startsWith("/") || value.includes("\\")) return false;
+  return !value.split("/").includes("..");
+}
+
+export function validatePublicationConfig(publication: unknown): string[] {
+  const problems: string[] = [];
+  if (typeof publication !== "object" || publication === null) {
+    return ["publication must be an object"];
+  }
+  const config = publication as Partial<PapyrusPublicationConfig> & { kind?: unknown };
+  if (config.kind !== "s3-projection") {
+    problems.push(`publication.kind must be "s3-projection" (got ${JSON.stringify(config.kind)})`);
+  }
+  if (config.projector !== undefined) {
+    if (typeof config.projector !== "string" || !isRelativePathWithoutParentSegments(config.projector) || !config.projector.endsWith(".py")) {
+      problems.push("publication.projector must be a relative .py path without '..'");
+    }
+  }
+  if (config.staticDir !== undefined) {
+    if (typeof config.staticDir !== "string" || !isRelativePathWithoutParentSegments(config.staticDir)) {
+      problems.push("publication.staticDir must be a relative path without '..'");
+    }
+  }
+  if (config.edgeDistributionArn !== undefined && !CLOUDFRONT_DISTRIBUTION_ARN.test(config.edgeDistributionArn)) {
+    problems.push("publication.edgeDistributionArn must be a CloudFront distribution ARN (arn:aws:cloudfront::<account>:distribution/<id>)");
+  }
+  const distribution = config.distribution;
+  if (distribution !== undefined) {
+    if (config.edgeDistributionArn !== undefined && distribution.create === true) {
+      problems.push("publication.edgeDistributionArn and publication.distribution.create are mutually exclusive");
+    }
+    const aliases = distribution.aliases ?? [];
+    if (aliases.length > 0 && distribution.create !== true) {
+      problems.push("publication.distribution.aliases require distribution.create to be true");
+    }
+    if (aliases.length > 0 && !distribution.certificateArn && !distribution.acm) {
+      problems.push("publication.distribution.aliases require certificateArn or acm");
+    }
+    if (distribution.acm !== undefined && (!distribution.acm.hostedZoneId || !distribution.acm.hostedZoneName)) {
+      problems.push("publication.distribution.acm requires hostedZoneId and hostedZoneName");
+    }
+  }
+  return problems;
+}
+
+export function assertValidPublicationConfig(publication: unknown): void {
+  const problems = validatePublicationConfig(publication);
+  if (problems.length > 0) throw new Error(`Invalid backend.publication: ${problems.join("; ")}`);
+}
+
 export type PapyrusSiteBackendConfig = {
   /** Brand id; namespaces account-global resources (S3 Vectors index name). */
   brandId?: string;
@@ -56,6 +130,8 @@ export type PapyrusSiteBackendConfig = {
     /** Let this stack verify the SES domain identity and write its TXT record. Default false: verify once by hand. */
     manageDomainIdentity?: boolean;
   };
+  /** Opt-in static projection of published pages into an S3 site bucket. Unset: nothing is created. */
+  publication?: PapyrusPublicationConfig;
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend.js

@@ -7,14 +7,18 @@ import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aw
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves.js";
+import { addS3ProjectionPublication } from "./publication/s3-projection.js";
+import { planRenditions } from "./publication/renditions-settings.js";
+import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
+import { assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
-import { contentActions } from "./functions/content-actions/resource.js";
+import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource.js";
 import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
@@ -62,6 +66,11 @@ export function defineSiteBackend(papyrusSite) {
         ...baseAuthConfig,
         newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
     };
+    if (site.publication !== undefined)
+        assertValidPublicationConfig(site.publication);
+    const publicationPlan = planS3ProjectionBackend(site.publication);
+    const renditionsPlan = planRenditions(site.publication, process.cwd());
+    setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
     const backend = defineBackend({
         assignmentAction,
         auth: defineSiteAuth(authConfig),
@@ -217,8 +226,8 @@ export function defineSiteBackend(papyrusSite) {
     let storageBackupPlan;
     let storageBackupVault;
     const storageBucketCfn = storageBucket.node.defaultChild;
-    if ((enableStorageBackups || enableInboundEmail) && storageBucketCfn) {
-        // Backups and inbound-email intake both rely on S3 → EventBridge notifications.
+    if ((enableStorageBackups || enableInboundEmail || renditionsPlan.enabled) && storageBucketCfn) {
+        // Backups, inbound-email intake and upload-time renditions all rely on S3 → EventBridge notifications.
         storageBucketCfn.addPropertyOverride("NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled", true);
     }
     if (enableStorageBackups) {
@@ -302,6 +311,21 @@ export function defineSiteBackend(papyrusSite) {
     if (rebuildSettings.resources.length > 0) {
         contentActionsLambda.addToRolePolicy(new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }));
     }
+    let s3ProjectionPublication;
+    if (site.publication !== undefined) {
+        s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication, {
+            mediaBucket: storageBucket,
+            renditions: renditionsPlan,
+        });
+        contentActionsLambda.node.defaultChild.memorySize = publicationPlan.contentActionsMemorySize;
+    }
+    const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
+    for (const [name, value] of Object.entries(publicationWiring.environment)) {
+        contentActionsLambda.addEnvironment(name, value);
+    }
+    for (const statement of publicationWiring.policyStatements) {
+        contentActionsLambda.addToRolePolicy(statement);
+    }
     if ((site.revalidateBaseUrl ?? "").trim() !== "") {
         backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
         const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();

package/amplify/site-backend.ts

@@ -3,21 +3,25 @@ import { Stack } from "aws-cdk-lib";
 import type * as backup from "aws-cdk-lib/aws-backup";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { CfnEventSourceMapping, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+import { CfnEventSourceMapping, CfnFunction, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import type { Construct } from "constructs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves";
+import { addS3ProjectionPublication, type S3ProjectionPublication } from "./publication/s3-projection";
+import { planRenditions } from "./publication/renditions-settings";
+import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
+import { assertValidPublicationConfig } from "./site-backend-config";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
-import { contentActions } from "./functions/content-actions/resource";
+import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource";
 import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
@@ -80,6 +84,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     ...baseAuthConfig,
     newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
   };
+  if (site.publication !== undefined) assertValidPublicationConfig(site.publication);
+  const publicationPlan = planS3ProjectionBackend(site.publication);
+  const renditionsPlan = planRenditions(site.publication, process.cwd());
+  setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
   const backend = defineBackend({
     assignmentAction,
     auth: defineSiteAuth(authConfig),
@@ -279,8 +287,8 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   let storageBackupVault: backup.BackupVault | undefined;
 
   const storageBucketCfn = storageBucket.node.defaultChild as s3.CfnBucket | undefined;
-  if ((enableStorageBackups || enableInboundEmail) && storageBucketCfn) {
-    // Backups and inbound-email intake both rely on S3 → EventBridge notifications.
+  if ((enableStorageBackups || enableInboundEmail || renditionsPlan.enabled) && storageBucketCfn) {
+    // Backups, inbound-email intake and upload-time renditions all rely on S3 → EventBridge notifications.
     storageBucketCfn.addPropertyOverride(
       "NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled",
       true,
@@ -388,6 +396,21 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
       new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }),
     );
   }
+  let s3ProjectionPublication: S3ProjectionPublication | undefined;
+  if (site.publication !== undefined) {
+    s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication, {
+      mediaBucket: storageBucket,
+      renditions: renditionsPlan,
+    });
+    (contentActionsLambda.node.defaultChild as CfnFunction).memorySize = publicationPlan.contentActionsMemorySize;
+  }
+  const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
+  for (const [name, value] of Object.entries(publicationWiring.environment)) {
+    contentActionsLambda.addEnvironment(name, value);
+  }
+  for (const statement of publicationWiring.policyStatements) {
+    contentActionsLambda.addToRolePolicy(statement);
+  }
   if ((site.revalidateBaseUrl ?? "").trim() !== "") {
     backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
     const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();

package/package.json

@@ -302,7 +302,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.43",
+  "version": "1.0.0-next.45",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.43",
+  "version": "1.0.0-next.45",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",