@anthusai/papyrus 1.0.0-next.44 → 1.0.0-next.46

package/amplify/functions/content-actions/handler.py

@@ -6,7 +6,7 @@ from typing import Any
 
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
-from papyrus_content.projection.engine import project
+from papyrus_content.projection.engine import project, project_item_pages
 from papyrus_content.projection.runtime import (
     DEAD_LETTER_QUEUE_ENV,
     context_from_environment,
@@ -63,7 +63,14 @@ def derive_markus_action(arguments: dict) -> dict:
     return response
 
 
-def send_to_projection_dead_letter_queue(item_id: str, unpublished: bool, error: str) -> None:
+PROJECTION_TASK_KEY = "projectionTask"
+
+
+class ProjectionTaskFailed(Exception):
+    """Raised by an asynchronous projection task so Lambda retries it and, finally, sends it to the dead letter queue."""
+
+
+def send_to_projection_dead_letter_queue(task: dict, error: str) -> None:
     queue_url = (os.environ.get(DEAD_LETTER_QUEUE_ENV) or "").strip()
     if not queue_url:
         return
@@ -71,23 +78,50 @@ def send_to_projection_dead_letter_queue(item_id: str, unpublished: bool, error:
         import boto3
 
         boto3.client("sqs").send_message(
-            QueueUrl=queue_url,
-            MessageBody=json.dumps({"itemId": item_id, "unpublished": unpublished, "error": error}),
+            QueueUrl=queue_url, MessageBody=json.dumps({PROJECTION_TASK_KEY: task, "error": error})
         )
     except Exception:  # noqa: BLE001 - the dead letter is best effort; the response already reports the failure
         pass
 
 
+def schedule_projection_task(task: dict, error: str) -> bool:
+    """Run a projection task later, in this same function, as an asynchronous invocation.
+
+    The function has an on-failure destination (the dead letter queue), so a task
+    that keeps failing ends up there for ``papyrus ops content project --reconcile``.
+    """
+    function_name = (os.environ.get("AWS_LAMBDA_FUNCTION_NAME") or "").strip()
+    if not function_name:
+        send_to_projection_dead_letter_queue(task, error)
+        return False
+    try:
+        import boto3
+
+        boto3.client("lambda").invoke(
+            FunctionName=function_name, InvocationType="Event", Payload=json.dumps({PROJECTION_TASK_KEY: task}).encode("utf-8")
+        )
+        return True
+    except Exception as scheduling_error:  # noqa: BLE001 - fall back to the dead letter queue
+        send_to_projection_dead_letter_queue(task, f"{error}; scheduling failed: {scheduling_error}")
+        return False
+
+
+def projection_context(client):
+    context = context_from_environment(client)
+    context.defer_follow_up = True
+    return context
+
+
 def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
     if not projection_configured():
         return {}
     liveness = {} if unpublished else {"live": False}
+    task = {"task": "item", "itemId": item_id, "unpublished": unpublished}
     try:
-        context = context_from_environment(client)
-        report = project(context, item_id, unpublished=unpublished)
+        report = project(projection_context(client), item_id, unpublished=unpublished)
     except Exception as error:  # noqa: BLE001 - a projection failure never fails the save
         message = f"{type(error).__name__}: {error}"
-        send_to_projection_dead_letter_queue(item_id, unpublished, message)
+        schedule_projection_task(task, message)
         return {**liveness, "projected": False, "paths": [], "error": message}
     response = {"projected": report.ok, "paths": [*report.written, *report.deleted]}
     if not unpublished:
@@ -97,11 +131,29 @@ def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
             response["url"] = url
     if not report.ok:
         message = "; ".join(report.errors)
-        send_to_projection_dead_letter_queue(item_id, unpublished, message)
+        schedule_projection_task(task, message)
         response["error"] = message
+    if report.follow_up_item_pages:
+        schedule_projection_task({"task": "item-pages", "exceptItemId": item_id}, "follow-up")
     return response
 
 
+def run_projection_task(task: dict) -> dict:
+    """An asynchronous projection task. Raising makes Lambda retry it, then send the event to the dead letter queue."""
+    client, _claims = create_authoring_client()
+    if task.get("task") == "item-pages":
+        report = project_item_pages(projection_context(client), except_item_id=task.get("exceptItemId"))
+    elif task.get("task") == "item":
+        report = project(projection_context(client), task["itemId"], unpublished=bool(task.get("unpublished")))
+        if report.follow_up_item_pages:
+            schedule_projection_task({"task": "item-pages", "exceptItemId": task["itemId"]}, "follow-up")
+    else:
+        raise ProjectionTaskFailed(f"Unknown projection task {task.get('task')!r}")
+    if not report.ok:
+        raise ProjectionTaskFailed("; ".join(report.errors))
+    return {"ok": True, "paths": [*report.written, *report.deleted]}
+
+
 def save_item_draft_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     fields = ItemFields(
@@ -183,6 +235,8 @@ def request_staging_build_action() -> dict:
 
 
 def handler(event, context):
+    if PROJECTION_TASK_KEY in event:
+        return run_projection_task(event[PROJECTION_TASK_KEY])
     field = event["fieldName"]
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)

package/amplify/functions/content-actions/requirements.txt

@@ -1,5 +1,5 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
 anthus-markus==0.5.1
-Pillow>=10,<12
+Pillow>=11.3,<12
 awscrt>=0.23,<1

package/amplify/functions/content-actions/resource.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/functions/content-actions/resource.ts

@@ -10,7 +10,7 @@ import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");

package/amplify/functions/renditions/handler.py

@@ -0,0 +1,94 @@
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from typing import Any
+
+from papyrus_content.projection.runtime import SITE_BUCKET_ENV, SITE_STATIC_DIRECTORY_ENV
+from papyrus_content.renditions import (
+    RenditionSettings,
+    S3RenditionStore,
+    make_renditions,
+    meta_key,
+    settings_from_static_directory,
+    source_from_media_key,
+)
+
+_loaded: dict[str, Any] = {}
+
+
+def configured_settings() -> RenditionSettings | None:
+    if "settings" not in _loaded:
+        static_directory = (os.environ.get(SITE_STATIC_DIRECTORY_ENV) or "").strip()
+        _loaded["settings"] = settings_from_static_directory(Path(static_directory) if static_directory else None)
+    return _loaded["settings"]
+
+
+def site_store() -> S3RenditionStore:
+    if "store" not in _loaded:
+        _loaded["store"] = S3RenditionStore(os.environ[SITE_BUCKET_ENV])
+    return _loaded["store"]
+
+
+def s3_client():
+    if "s3" not in _loaded:
+        import boto3
+
+        _loaded["s3"] = boto3.client("s3")
+    return _loaded["s3"]
+
+
+def media_objects(event: dict) -> list[tuple[str, str]]:
+    if event.get("source") == "aws.s3" and "detail" in event:
+        detail = event["detail"]
+        return [(detail["bucket"]["name"], detail["object"]["key"])]
+    if "bucket" in event and "key" in event:
+        return [(event["bucket"], event["key"])]
+    raise ValueError("The event is neither an S3 object event nor a {bucket, key} request.")
+
+
+def render_media_object(
+    settings: RenditionSettings, bucket: str, key: str, *, skip_existing: bool = False, dry_run: bool = False
+) -> dict:
+    source = source_from_media_key(key)
+    if source is None:
+        return {"key": key, "action": "ignored", "reason": "not an image under media/"}
+    if skip_existing and site_store().get(meta_key(settings.pipeline, source)) is not None:
+        return {"key": key, "source": source, "action": "skipped-existing"}
+    if dry_run:
+        return {"key": key, "source": source, "action": "would-render"}
+    started = time.perf_counter()
+    data = s3_client().get_object(Bucket=bucket, Key=key)["Body"].read()
+    downloaded = time.perf_counter()
+    result = make_renditions(settings, site_store(), source, data)
+    finished = time.perf_counter()
+    return {
+        "key": key,
+        "source": source,
+        "action": "rendered",
+        "kind": result["kind"],
+        "written": result["written"],
+        "sourceBytes": len(data),
+        "downloadMilliseconds": round((downloaded - started) * 1000),
+        "renditionMilliseconds": round((finished - downloaded) * 1000),
+    }
+
+
+def handler(event, context):
+    settings = configured_settings()
+    if settings is None:
+        return {"ok": True, "results": [], "skipped": "this site has no images settings in projection.json"}
+    results = [
+        render_media_object(
+            settings,
+            bucket,
+            key,
+            skip_existing=event.get("skipExisting") is True,
+            dry_run=event.get("dryRun") is True,
+        )
+        for bucket, key in media_objects(event)
+    ]
+    print(json.dumps({"renditions": results}))
+    return {"ok": True, "results": results}

package/amplify/functions/renditions/requirements.txt

@@ -0,0 +1,4 @@
+PyYAML>=6.0.2,<7
+citeproc-py>=0.8.2,<1
+anthus-markus==0.5.1
+Pillow>=11.3,<12

package/amplify/publication/renditions-function.js

@@ -0,0 +1,74 @@
+import { Duration, Size } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../functions/shared/python-bundle.js";
+import { RENDITIONS_EPHEMERAL_STORAGE_MB, RENDITIONS_MEDIA_PREFIX, RENDITIONS_MEMORY_MB, RENDITIONS_TIMEOUT_SECONDS, renditionsEnvironment, renditionsEventPattern, } from "./renditions-settings.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../..");
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export function addRenditionsFunction(scope, props) {
+    const deadLetterQueue = new sqs.Queue(scope, "RenditionsDeadLetterQueue", {
+        encryption: sqs.QueueEncryption.SQS_MANAGED,
+        retentionPeriod: Duration.days(14),
+        enforceSSL: true,
+    });
+    const renditions = new LambdaFunction(scope, "RenditionsFunction", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(RENDITIONS_TIMEOUT_SECONDS),
+        memorySize: RENDITIONS_MEMORY_MB,
+        ephemeralStorageSize: Size.mebibytes(RENDITIONS_EPHEMERAL_STORAGE_MB),
+        retryAttempts: 2,
+        deadLetterQueue,
+        environment: renditionsEnvironment(props.siteBucket.bucketName),
+        code: props.code ?? pythonLambdaCode({
+            functionDir: "renditions",
+            modules: ["papyrus_content"],
+            requirements: renditionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+            siteFiles: props.siteFiles,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/renditions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/renditions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:GetObject"],
+        resources: [props.mediaBucket.arnForObjects(`${RENDITIONS_MEDIA_PREFIX}*`)],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:PutObject", "s3:GetObject"],
+        resources: [props.siteBucket.arnForObjects("*")],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:ListBucket"],
+        resources: [props.siteBucket.bucketArn],
+    }));
+    const rule = new events.Rule(scope, "MediaObjectCreatedRule", {
+        eventPattern: renditionsEventPattern(props.mediaBucket.bucketName),
+    });
+    rule.addTarget(new targets.LambdaFunction(renditions, { retryAttempts: 2 }));
+    return { function: renditions, rule, deadLetterQueue };
+}

package/amplify/publication/renditions-function.ts

@@ -0,0 +1,112 @@
+import { Duration, Size } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, type Code, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import type { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode, type SiteBundleFile } from "../functions/shared/python-bundle";
+import {
+  RENDITIONS_EPHEMERAL_STORAGE_MB,
+  RENDITIONS_MEDIA_PREFIX,
+  RENDITIONS_MEMORY_MB,
+  RENDITIONS_TIMEOUT_SECONDS,
+  renditionsEnvironment,
+  renditionsEventPattern,
+} from "./renditions-settings";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../..");
+
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+
+export type RenditionsFunctionProps = {
+  siteBucket: s3.IBucket;
+  mediaBucket: s3.IBucket;
+  siteFiles: SiteBundleFile[];
+  code?: Code;
+};
+
+export type RenditionsFunction = {
+  function: LambdaFunction;
+  rule: events.Rule;
+  deadLetterQueue: sqs.Queue;
+};
+
+function installCheckoutRequirements(outputDir: string): void {
+  const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
+  execSync(
+    `python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`,
+    { cwd: projectRoot, stdio: "inherit" },
+  );
+}
+
+export function addRenditionsFunction(scope: Construct, props: RenditionsFunctionProps): RenditionsFunction {
+  const deadLetterQueue = new sqs.Queue(scope, "RenditionsDeadLetterQueue", {
+    encryption: sqs.QueueEncryption.SQS_MANAGED,
+    retentionPeriod: Duration.days(14),
+    enforceSSL: true,
+  });
+  const renditions = new LambdaFunction(scope, "RenditionsFunction", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(RENDITIONS_TIMEOUT_SECONDS),
+    memorySize: RENDITIONS_MEMORY_MB,
+    ephemeralStorageSize: Size.mebibytes(RENDITIONS_EPHEMERAL_STORAGE_MB),
+    retryAttempts: 2,
+    deadLetterQueue,
+    environment: renditionsEnvironment(props.siteBucket.bucketName),
+    code: props.code ?? pythonLambdaCode(
+      {
+        functionDir: "renditions",
+        modules: ["papyrus_content"],
+        requirements: renditionsRequirements,
+        noDeps: true,
+        checkoutExtras: installCheckoutRequirements,
+        siteFiles: props.siteFiles,
+      },
+      [
+        "bash",
+        "-c",
+        [
+          "set -euo pipefail",
+          "mkdir -p /asset-output/papyrus_content",
+          "cp amplify/functions/renditions/handler.py /asset-output/handler.py",
+          "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          "python3 -m pip install -r amplify/functions/renditions/requirements.txt -t /asset-output --no-cache-dir",
+        ].join(" && "),
+      ],
+    ),
+  });
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:GetObject"],
+      resources: [props.mediaBucket.arnForObjects(`${RENDITIONS_MEDIA_PREFIX}*`)],
+    }),
+  );
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject", "s3:GetObject"],
+      resources: [props.siteBucket.arnForObjects("*")],
+    }),
+  );
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:ListBucket"],
+      resources: [props.siteBucket.bucketArn],
+    }),
+  );
+  const rule = new events.Rule(scope, "MediaObjectCreatedRule", {
+    eventPattern: renditionsEventPattern(props.mediaBucket.bucketName),
+  });
+  rule.addTarget(new targets.LambdaFunction(renditions, { retryAttempts: 2 }));
+  return { function: renditions, rule, deadLetterQueue };
+}

package/amplify/publication/renditions-settings.js

@@ -0,0 +1,43 @@
+/**
+ * Pure planning for the upload-time renditions function of an s3-projection
+ * site (no CDK imports, so it can be tested without synthesizing).
+ *
+ * The function exists only for a site whose `projection.json` carries an
+ * `images` section: that section is the one place the image pipeline settings
+ * live, shared by the renditions function and the projector.
+ */
+import fs from "node:fs";
+import path from "node:path";
+export const RENDITIONS_MEMORY_MB = 3008;
+export const RENDITIONS_TIMEOUT_SECONDS = 300;
+export const RENDITIONS_EPHEMERAL_STORAGE_MB = 2048;
+export const RENDITIONS_STATIC_DIRECTORY = "/var/task/site_static";
+export const RENDITIONS_MEDIA_PREFIX = "media/";
+export const RENDITIONS_FUNCTION_NAME_ENV = "PAPYRUS_RENDITIONS_FUNCTION_NAME";
+export function projectionSettingsHaveImages(settingsPath) {
+    if (!fs.existsSync(settingsPath))
+        return false;
+    const parsed = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+    return typeof parsed.images === "object" && parsed.images !== null;
+}
+export function planRenditions(publication, workingDirectory) {
+    if (publication?.staticDir === undefined)
+        return { enabled: false, siteFiles: [] };
+    const settingsFile = path.join(publication.staticDir, "projection.json");
+    if (!projectionSettingsHaveImages(path.resolve(workingDirectory, settingsFile)))
+        return { enabled: false, siteFiles: [] };
+    return { enabled: true, siteFiles: [{ from: settingsFile, to: "site_static/projection.json" }] };
+}
+export function renditionsEventPattern(mediaBucketName) {
+    return {
+        source: ["aws.s3"],
+        detailType: ["Object Created"],
+        detail: { bucket: { name: [mediaBucketName] }, object: { key: [{ prefix: RENDITIONS_MEDIA_PREFIX }] } },
+    };
+}
+export function renditionsEnvironment(siteBucketName) {
+    return {
+        PAPYRUS_SITE_BUCKET: siteBucketName,
+        PAPYRUS_SITE_STATIC_DIR: RENDITIONS_STATIC_DIRECTORY,
+    };
+}

package/amplify/publication/renditions-settings.ts

@@ -0,0 +1,50 @@
+/**
+ * Pure planning for the upload-time renditions function of an s3-projection
+ * site (no CDK imports, so it can be tested without synthesizing).
+ *
+ * The function exists only for a site whose `projection.json` carries an
+ * `images` section: that section is the one place the image pipeline settings
+ * live, shared by the renditions function and the projector.
+ */
+import fs from "node:fs";
+import path from "node:path";
+
+export const RENDITIONS_MEMORY_MB = 3008;
+export const RENDITIONS_TIMEOUT_SECONDS = 300;
+export const RENDITIONS_EPHEMERAL_STORAGE_MB = 2048;
+export const RENDITIONS_STATIC_DIRECTORY = "/var/task/site_static";
+export const RENDITIONS_MEDIA_PREFIX = "media/";
+export const RENDITIONS_FUNCTION_NAME_ENV = "PAPYRUS_RENDITIONS_FUNCTION_NAME";
+
+export type RenditionsPlan = {
+  enabled: boolean;
+  siteFiles: Array<{ from: string; to: string }>;
+};
+
+export function projectionSettingsHaveImages(settingsPath: string): boolean {
+  if (!fs.existsSync(settingsPath)) return false;
+  const parsed = JSON.parse(fs.readFileSync(settingsPath, "utf8")) as Record<string, unknown>;
+  return typeof parsed.images === "object" && parsed.images !== null;
+}
+
+export function planRenditions(publication: { staticDir?: string } | undefined, workingDirectory: string): RenditionsPlan {
+  if (publication?.staticDir === undefined) return { enabled: false, siteFiles: [] };
+  const settingsFile = path.join(publication.staticDir, "projection.json");
+  if (!projectionSettingsHaveImages(path.resolve(workingDirectory, settingsFile))) return { enabled: false, siteFiles: [] };
+  return { enabled: true, siteFiles: [{ from: settingsFile, to: "site_static/projection.json" }] };
+}
+
+export function renditionsEventPattern(mediaBucketName: string): Record<string, unknown> {
+  return {
+    source: ["aws.s3"],
+    detailType: ["Object Created"],
+    detail: { bucket: { name: [mediaBucketName] }, object: { key: [{ prefix: RENDITIONS_MEDIA_PREFIX }] } },
+  };
+}
+
+export function renditionsEnvironment(siteBucketName: string): Record<string, string> {
+  return {
+    PAPYRUS_SITE_BUCKET: siteBucketName,
+    PAPYRUS_SITE_STATIC_DIR: RENDITIONS_STATIC_DIRECTORY,
+  };
+}

package/amplify/publication/s3-projection.js

@@ -1,14 +1,17 @@
-import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
 import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
 import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
-import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { SqsDestination } from "aws-cdk-lib/aws-lambda-destinations";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig } from "../site-backend-config.js";
+import { addRenditionsFunction } from "./renditions-function.js";
+import { RENDITIONS_FUNCTION_NAME_ENV } from "./renditions-settings.js";
 import { s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
 const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
 function createSiteBucket(scope, retainBucketOnDelete) {
@@ -60,7 +63,7 @@ function createDistribution(scope, props, bucket, redirectFunction) {
         ],
     });
 }
-export function addS3ProjectionPublication(scope, props) {
+export function addS3ProjectionPublication(scope, props, media) {
     assertValidPublicationConfig({ kind: "s3-projection", ...props });
     const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
     const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
@@ -90,6 +93,9 @@ export function addS3ProjectionPublication(scope, props) {
             conditions: { StringEquals: { "aws:SourceArn": props.edgeDistributionArn } },
         }));
     }
+    const renditions = media?.renditions.enabled === true
+        ? addRenditionsFunction(scope, { siteBucket: bucket, mediaBucket: media.mediaBucket, siteFiles: media.renditions.siteFiles, code: media.renditionsCode })
+        : undefined;
     const settingsInput = {
         bucketName: bucket.bucketName,
         bucketArn: bucket.bucketArn,
@@ -111,7 +117,28 @@ export function addS3ProjectionPublication(scope, props) {
         deadLetterQueue,
         distribution,
         distributionId: distribution?.distributionId,
-        environment: s3ProjectionEnvironment(settingsInput),
+        renditions,
+        environment: {
+            ...s3ProjectionEnvironment(settingsInput),
+            ...(renditions !== undefined ? { [RENDITIONS_FUNCTION_NAME_ENV]: renditions.function.functionName } : {}),
+        },
         policyStatements: s3ProjectionPolicyStatements(settingsInput).map((statement) => new PolicyStatement({ effect: Effect.ALLOW, actions: statement.actions, resources: statement.resources })),
     };
 }
+/**
+ * The content-actions function runs a failed or follow-up projection again as an asynchronous
+ * invocation of itself: one retry, and an on-failure destination (the dead letter queue) for
+ * what still fails. The self-invoke permission is a separate policy on the role so that the
+ * function does not depend on a policy that refers to the function.
+ */
+export function addProjectionRetries(lambda, deadLetterQueue) {
+    lambda.configureAsyncInvoke({
+        retryAttempts: 1,
+        maxEventAge: Duration.hours(1),
+        onFailure: new SqsDestination(deadLetterQueue),
+    });
+    new Policy(Stack.of(lambda), "ContentActionsProjectionSelfInvoke", {
+        statements: [new PolicyStatement({ actions: ["lambda:InvokeFunction"], resources: [lambda.functionArn] })],
+        roles: [lambda.role],
+    });
+}

package/amplify/publication/s3-projection.ts

@@ -1,8 +1,11 @@
-import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
 import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import type { Code } from "aws-cdk-lib/aws-lambda";
 import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
-import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import { SqsDestination } from "aws-cdk-lib/aws-lambda-destinations";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
@@ -10,12 +13,20 @@ import type { Construct } from "constructs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
+import { addRenditionsFunction, type RenditionsFunction } from "./renditions-function";
+import { RENDITIONS_FUNCTION_NAME_ENV, type RenditionsPlan } from "./renditions-settings";
 import { s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
 
 const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
 
 export type S3ProjectionPublicationProps = Omit<PapyrusPublicationConfig, "kind"> & { kind?: "s3-projection" };
 
+export type S3ProjectionMedia = {
+  mediaBucket: s3.IBucket;
+  renditions: RenditionsPlan;
+  renditionsCode?: Code;
+};
+
 export type S3ProjectionPublication = {
   bucket: s3.Bucket;
   keyValueStore: cloudfront.KeyValueStore;
@@ -23,6 +34,7 @@ export type S3ProjectionPublication = {
   deadLetterQueue: sqs.Queue;
   distribution?: cloudfront.Distribution;
   distributionId?: string;
+  renditions?: RenditionsFunction;
   environment: Record<string, string>;
   policyStatements: PolicyStatement[];
 };
@@ -88,7 +100,11 @@ function createDistribution(
   });
 }
 
-export function addS3ProjectionPublication(scope: Construct, props: S3ProjectionPublicationProps): S3ProjectionPublication {
+export function addS3ProjectionPublication(
+  scope: Construct,
+  props: S3ProjectionPublicationProps,
+  media?: S3ProjectionMedia,
+): S3ProjectionPublication {
   assertValidPublicationConfig({ kind: "s3-projection", ...props });
   const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
 
@@ -123,6 +139,10 @@ export function addS3ProjectionPublication(scope: Construct, props: S3Projection
     );
   }
 
+  const renditions = media?.renditions.enabled === true
+    ? addRenditionsFunction(scope, { siteBucket: bucket, mediaBucket: media.mediaBucket, siteFiles: media.renditions.siteFiles, code: media.renditionsCode })
+    : undefined;
+
   const settingsInput = {
     bucketName: bucket.bucketName,
     bucketArn: bucket.bucketArn,
@@ -144,9 +164,31 @@ export function addS3ProjectionPublication(scope: Construct, props: S3Projection
     deadLetterQueue,
     distribution,
     distributionId: distribution?.distributionId,
-    environment: s3ProjectionEnvironment(settingsInput),
+    renditions,
+    environment: {
+      ...s3ProjectionEnvironment(settingsInput),
+      ...(renditions !== undefined ? { [RENDITIONS_FUNCTION_NAME_ENV]: renditions.function.functionName } : {}),
+    },
     policyStatements: s3ProjectionPolicyStatements(settingsInput).map(
       (statement) => new PolicyStatement({ effect: Effect.ALLOW, actions: statement.actions, resources: statement.resources }),
     ),
   };
 }
+
+/**
+ * The content-actions function runs a failed or follow-up projection again as an asynchronous
+ * invocation of itself: one retry, and an on-failure destination (the dead letter queue) for
+ * what still fails. The self-invoke permission is a separate policy on the role so that the
+ * function does not depend on a policy that refers to the function.
+ */
+export function addProjectionRetries(lambda: LambdaFunction, deadLetterQueue: sqs.IQueue): void {
+  lambda.configureAsyncInvoke({
+    retryAttempts: 1,
+    maxEventAge: Duration.hours(1),
+    onFailure: new SqsDestination(deadLetterQueue),
+  });
+  new Policy(Stack.of(lambda), "ContentActionsProjectionSelfInvoke", {
+    statements: [new PolicyStatement({ actions: ["lambda:InvokeFunction"], resources: [lambda.functionArn] })],
+    roles: [lambda.role!],
+  });
+}

package/amplify/site-backend.js

@@ -7,7 +7,8 @@ import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aw
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves.js";
-import { addS3ProjectionPublication } from "./publication/s3-projection.js";
+import { addProjectionRetries, addS3ProjectionPublication } from "./publication/s3-projection.js";
+import { planRenditions } from "./publication/renditions-settings.js";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
 import { assertValidPublicationConfig } from "./site-backend-config.js";
@@ -68,6 +69,7 @@ export function defineSiteBackend(papyrusSite) {
     if (site.publication !== undefined)
         assertValidPublicationConfig(site.publication);
     const publicationPlan = planS3ProjectionBackend(site.publication);
+    const renditionsPlan = planRenditions(site.publication, process.cwd());
     setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
     const backend = defineBackend({
         assignmentAction,
@@ -224,8 +226,8 @@ export function defineSiteBackend(papyrusSite) {
     let storageBackupPlan;
     let storageBackupVault;
     const storageBucketCfn = storageBucket.node.defaultChild;
-    if ((enableStorageBackups || enableInboundEmail) && storageBucketCfn) {
-        // Backups and inbound-email intake both rely on S3 → EventBridge notifications.
+    if ((enableStorageBackups || enableInboundEmail || renditionsPlan.enabled) && storageBucketCfn) {
+        // Backups, inbound-email intake and upload-time renditions all rely on S3 → EventBridge notifications.
         storageBucketCfn.addPropertyOverride("NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled", true);
     }
     if (enableStorageBackups) {
@@ -311,9 +313,15 @@ export function defineSiteBackend(papyrusSite) {
     }
     let s3ProjectionPublication;
     if (site.publication !== undefined) {
-        s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication);
+        s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication, {
+            mediaBucket: storageBucket,
+            renditions: renditionsPlan,
+        });
         contentActionsLambda.node.defaultChild.memorySize = publicationPlan.contentActionsMemorySize;
     }
+    if (s3ProjectionPublication !== undefined) {
+        addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+    }
     const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
     for (const [name, value] of Object.entries(publicationWiring.environment)) {
         contentActionsLambda.addEnvironment(name, value);

package/amplify/site-backend.ts

@@ -10,7 +10,8 @@ import type { Construct } from "constructs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves";
-import { addS3ProjectionPublication, type S3ProjectionPublication } from "./publication/s3-projection";
+import { addProjectionRetries, addS3ProjectionPublication, type S3ProjectionPublication } from "./publication/s3-projection";
+import { planRenditions } from "./publication/renditions-settings";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
 import { assertValidPublicationConfig } from "./site-backend-config";
@@ -85,6 +86,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   };
   if (site.publication !== undefined) assertValidPublicationConfig(site.publication);
   const publicationPlan = planS3ProjectionBackend(site.publication);
+  const renditionsPlan = planRenditions(site.publication, process.cwd());
   setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
   const backend = defineBackend({
     assignmentAction,
@@ -285,8 +287,8 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   let storageBackupVault: backup.BackupVault | undefined;
 
   const storageBucketCfn = storageBucket.node.defaultChild as s3.CfnBucket | undefined;
-  if ((enableStorageBackups || enableInboundEmail) && storageBucketCfn) {
-    // Backups and inbound-email intake both rely on S3 → EventBridge notifications.
+  if ((enableStorageBackups || enableInboundEmail || renditionsPlan.enabled) && storageBucketCfn) {
+    // Backups, inbound-email intake and upload-time renditions all rely on S3 → EventBridge notifications.
     storageBucketCfn.addPropertyOverride(
       "NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled",
       true,
@@ -396,9 +398,15 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   }
   let s3ProjectionPublication: S3ProjectionPublication | undefined;
   if (site.publication !== undefined) {
-    s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication);
+    s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), site.publication, {
+      mediaBucket: storageBucket,
+      renditions: renditionsPlan,
+    });
     (contentActionsLambda.node.defaultChild as CfnFunction).memorySize = publicationPlan.contentActionsMemorySize;
   }
+  if (s3ProjectionPublication !== undefined) {
+    addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+  }
   const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
   for (const [name, value] of Object.entries(publicationWiring.environment)) {
     contentActionsLambda.addEnvironment(name, value);

package/package.json

@@ -302,7 +302,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.44",
+  "version": "1.0.0-next.46",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.44",
+  "version": "1.0.0-next.46",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",