@anthusai/papyrus 1.0.0-next.9 → 1.0.0

package/amplify/plugins/signup/schema.js

@@ -0,0 +1,40 @@
+import { a } from "@aws-amplify/backend";
+import { signupSubmit } from "./function/resource.js";
+/**
+ * SignupEntry is never guest-readable and has no create rule for anyone: only the
+ * submitSignup function (IAM) writes it. Editors and admins list it; admins delete.
+ */
+export function signupSchemaDefinitions() {
+    return {
+        SignupEntry: a
+            .model({
+            id: a.id().required(),
+            form: a.string().required(),
+            value: a.string().required(),
+            submittedAt: a.datetime().required(),
+        })
+            .disableOperations(["subscriptions"])
+            .secondaryIndexes((index) => [
+            index("form").sortKeys(["submittedAt"]).queryField("listSignupEntriesByFormAndSubmittedAt"),
+        ])
+            .authorization((allow) => [
+            allow.group("editor").to(["read"]),
+            allow.group("admin").to(["read", "delete"]),
+        ]),
+        SignupReceipt: a.customType({
+            status: a.string().required(),
+            message: a.string(),
+        }),
+        submitSignup: a
+            .mutation()
+            .arguments({
+            form: a.string().required(),
+            value: a.string().required(),
+            renderedAt: a.string().required(),
+            website: a.string(),
+        })
+            .returns(a.ref("SignupReceipt"))
+            .authorization((allow) => [allow.guest()])
+            .handler(a.handler.function(signupSubmit)),
+    };
+}

package/amplify/plugins/signup/schema.ts

@@ -0,0 +1,41 @@
+import { a } from "@aws-amplify/backend";
+import { signupSubmit } from "./function/resource";
+
+/**
+ * SignupEntry is never guest-readable and has no create rule for anyone: only the
+ * submitSignup function (IAM) writes it. Editors and admins list it; admins delete.
+ */
+export function signupSchemaDefinitions() {
+  return {
+    SignupEntry: a
+      .model({
+        id: a.id().required(),
+        form: a.string().required(),
+        value: a.string().required(),
+        submittedAt: a.datetime().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .secondaryIndexes((index) => [
+        index("form").sortKeys(["submittedAt"]).queryField("listSignupEntriesByFormAndSubmittedAt"),
+      ])
+      .authorization((allow) => [
+        allow.group("editor").to(["read"]),
+        allow.group("admin").to(["read", "delete"]),
+      ]),
+    SignupReceipt: a.customType({
+      status: a.string().required(),
+      message: a.string(),
+    }),
+    submitSignup: a
+      .mutation()
+      .arguments({
+        form: a.string().required(),
+        value: a.string().required(),
+        renderedAt: a.string().required(),
+        website: a.string(),
+      })
+      .returns(a.ref("SignupReceipt"))
+      .authorization((allow) => [allow.guest()])
+      .handler(a.handler.function(signupSubmit)),
+  };
+}

package/amplify/plugins/signup/waf.js

@@ -0,0 +1,48 @@
+import { CfnWebACL, CfnWebACLAssociation } from "aws-cdk-lib/aws-wafv2";
+export const SIGNUP_MUTATION_FIELD = "submitSignup";
+export const WAF_MINIMUM_RATE_LIMIT = 10;
+export const WAF_EVALUATION_WINDOW_SECONDS = 60;
+/**
+ * A regional web ACL on the AppSync API with one rate-based rule: more than `limit`
+ * submitSignup requests from one address in a minute are blocked with a 429 before
+ * the function runs. Only requests whose body names the mutation count, so reads,
+ * newsroom saves and CLI imports from the same address are never limited.
+ */
+export function addSignupRateLimit(scope, input) {
+    if (!Number.isInteger(input.limit) || input.limit < WAF_MINIMUM_RATE_LIMIT) {
+        throw new Error(`signup waf rate limit must be an integer of at least ${WAF_MINIMUM_RATE_LIMIT} (AWS WAF minimum)`);
+    }
+    const acl = new CfnWebACL(scope, "PapyrusSignupWebAcl", {
+        scope: "REGIONAL",
+        defaultAction: { allow: {} },
+        visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "PapyrusSignupWebAcl", sampledRequestsEnabled: true },
+        rules: [
+            {
+                name: "SignupRateLimitPerAddress",
+                priority: 0,
+                action: { block: { customResponse: { responseCode: 429 } } },
+                visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "SignupRateLimitPerAddress", sampledRequestsEnabled: true },
+                statement: {
+                    rateBasedStatement: {
+                        limit: input.limit,
+                        evaluationWindowSec: WAF_EVALUATION_WINDOW_SECONDS,
+                        aggregateKeyType: "IP",
+                        scopeDownStatement: {
+                            byteMatchStatement: {
+                                searchString: SIGNUP_MUTATION_FIELD,
+                                positionalConstraint: "CONTAINS",
+                                fieldToMatch: { body: { oversizeHandling: "NO_MATCH" } },
+                                textTransformations: [{ priority: 0, type: "NONE" }],
+                            },
+                        },
+                    },
+                },
+            },
+        ],
+    });
+    new CfnWebACLAssociation(scope, "PapyrusSignupWebAclAssociation", {
+        resourceArn: input.graphqlApiArn,
+        webAclArn: acl.attrArn,
+    });
+    return acl;
+}

package/amplify/plugins/signup/waf.ts

@@ -0,0 +1,51 @@
+import { CfnWebACL, CfnWebACLAssociation } from "aws-cdk-lib/aws-wafv2";
+import type { Construct } from "constructs";
+
+export const SIGNUP_MUTATION_FIELD = "submitSignup";
+export const WAF_MINIMUM_RATE_LIMIT = 10;
+export const WAF_EVALUATION_WINDOW_SECONDS = 60;
+
+/**
+ * A regional web ACL on the AppSync API with one rate-based rule: more than `limit`
+ * submitSignup requests from one address in a minute are blocked with a 429 before
+ * the function runs. Only requests whose body names the mutation count, so reads,
+ * newsroom saves and CLI imports from the same address are never limited.
+ */
+export function addSignupRateLimit(scope: Construct, input: { graphqlApiArn: string; limit: number }): CfnWebACL {
+  if (!Number.isInteger(input.limit) || input.limit < WAF_MINIMUM_RATE_LIMIT) {
+    throw new Error(`signup waf rate limit must be an integer of at least ${WAF_MINIMUM_RATE_LIMIT} (AWS WAF minimum)`);
+  }
+  const acl = new CfnWebACL(scope, "PapyrusSignupWebAcl", {
+    scope: "REGIONAL",
+    defaultAction: { allow: {} },
+    visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "PapyrusSignupWebAcl", sampledRequestsEnabled: true },
+    rules: [
+      {
+        name: "SignupRateLimitPerAddress",
+        priority: 0,
+        action: { block: { customResponse: { responseCode: 429 } } },
+        visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "SignupRateLimitPerAddress", sampledRequestsEnabled: true },
+        statement: {
+          rateBasedStatement: {
+            limit: input.limit,
+            evaluationWindowSec: WAF_EVALUATION_WINDOW_SECONDS,
+            aggregateKeyType: "IP",
+            scopeDownStatement: {
+              byteMatchStatement: {
+                searchString: SIGNUP_MUTATION_FIELD,
+                positionalConstraint: "CONTAINS",
+                fieldToMatch: { body: { oversizeHandling: "NO_MATCH" } },
+                textTransformations: [{ priority: 0, type: "NONE" }],
+              },
+            },
+          },
+        },
+      },
+    ],
+  });
+  new CfnWebACLAssociation(scope, "PapyrusSignupWebAclAssociation", {
+    resourceArn: input.graphqlApiArn,
+    webAclArn: acl.attrArn,
+  });
+  return acl;
+}

package/amplify/plugins/types.js

@@ -0,0 +1 @@
+export {};

package/amplify/plugins/types.ts

@@ -0,0 +1,39 @@
+import type { Construct } from "constructs";
+
+/** How a site asks for a plugin in `papyrus.config.ts`: `plugins: ["signup"]` or `plugins: [{ name: "signup", forms: ["news"] }]`. */
+export type PluginRequest = string | ({ name: string } & Record<string, unknown>);
+
+/** What a plugin declares about itself. A test pins the schema, the guest rules and the static files to this. */
+export type PluginManifest = {
+  name: string;
+  /** Public contract version. Bump it when a mutation input, a model field, an element name or an attribute changes. No compatibility shims. */
+  contract: number;
+  models: string[];
+  mutations: string[];
+  /** What an anonymous visitor may call. Everything else is closed to guests. */
+  guest: { mutations: string[] };
+  newsroomPanels: { id: string; label: string }[];
+  /** Keys the projector writes into the site bucket when the plugin is enabled. */
+  staticAssets: string[];
+};
+
+/** Where the deploy-time wiring puts its resources. Filled in by `defineSiteBackend`. */
+export type PluginWiringContext = {
+  createStack: (name: string) => Construct;
+  graphqlApiId: string;
+  graphqlEndpoint: string;
+};
+
+export type PapyrusPlugin<Config, Functions = unknown> = {
+  manifest: PluginManifest;
+  /** Validates the request and fills in defaults. Throws a readable error. */
+  resolveConfig: (request: PluginRequest) => Config;
+  /** Amplify function resources the plugin adds to `defineBackend`. */
+  functions: () => Functions;
+  /** Models and custom operations merged into the site schema. */
+  schemaDefinitions: () => Record<string, unknown>;
+  /** The settings the newsroom and the page component may read from `amplify_outputs.json` (`custom.papyrusPlugins.<name>`). Never secrets. */
+  publicSettings: (config: Config) => Record<string, unknown>;
+  /** Everything that needs the backend to exist: IAM, environment, WAF, outputs. */
+  wire: (backend: any, config: Config, context: PluginWiringContext) => void;
+};

package/amplify/plugins/wire.js

@@ -0,0 +1,24 @@
+export const PLUGINS_ENVIRONMENT_VARIABLE = "PAPYRUS_PLUGINS";
+export const PLUGINS_OUTPUT_KEY = "papyrusPlugins";
+/**
+ * Deploy-time wiring for every enabled plugin. A site without plugins reaches no line of this:
+ * nothing is added to the stacks, the environment or the outputs.
+ */
+export function wirePlugins(backend, plugins, contentActionsLambda) {
+    if (plugins.length === 0)
+        return;
+    const graphqlApi = backend.data.resources.graphqlApi;
+    const context = {
+        createStack: (name) => backend.createStack(name),
+        graphqlApiId: graphqlApi.apiId,
+        graphqlEndpoint: backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
+    };
+    for (const { plugin, config } of plugins)
+        plugin.wire(backend, config, context);
+    contentActionsLambda.addEnvironment(PLUGINS_ENVIRONMENT_VARIABLE, plugins.map(({ plugin }) => plugin.manifest.name).join(","));
+    backend.addOutput({
+        custom: {
+            [PLUGINS_OUTPUT_KEY]: Object.fromEntries(plugins.map(({ plugin, config }) => [plugin.manifest.name, plugin.publicSettings(config)])),
+        },
+    });
+}

package/amplify/plugins/wire.ts

@@ -0,0 +1,26 @@
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import type { ResolvedPlugin } from "./registry";
+
+export const PLUGINS_ENVIRONMENT_VARIABLE = "PAPYRUS_PLUGINS";
+export const PLUGINS_OUTPUT_KEY = "papyrusPlugins";
+
+/**
+ * Deploy-time wiring for every enabled plugin. A site without plugins reaches no line of this:
+ * nothing is added to the stacks, the environment or the outputs.
+ */
+export function wirePlugins(backend: any, plugins: ResolvedPlugin[], contentActionsLambda: LambdaFunction): void {
+  if (plugins.length === 0) return;
+  const graphqlApi = backend.data.resources.graphqlApi;
+  const context = {
+    createStack: (name: string) => backend.createStack(name),
+    graphqlApiId: graphqlApi.apiId as string,
+    graphqlEndpoint: backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string,
+  };
+  for (const { plugin, config } of plugins) plugin.wire(backend, config, context);
+  contentActionsLambda.addEnvironment(PLUGINS_ENVIRONMENT_VARIABLE, plugins.map(({ plugin }) => plugin.manifest.name).join(","));
+  backend.addOutput({
+    custom: {
+      [PLUGINS_OUTPUT_KEY]: Object.fromEntries(plugins.map(({ plugin, config }) => [plugin.manifest.name, plugin.publicSettings(config)])),
+    },
+  });
+}

package/amplify/publication/default-publication.js

@@ -0,0 +1,18 @@
+export const DEFAULT_MARKUS_PUBLICATION = { kind: "s3-projection", reprojectOnDeploy: true };
+/**
+ * The publication a site backend is built with. A Markus site that names a `reader` Amplify app
+ * keeps publishing through it (`amplify-static`); every other Markus site gets the s3-projection
+ * default unless it writes `publication: false`. Sites with another renderer get nothing unless
+ * they write a `publication`.
+ */
+export function resolveSitePublication(backend, rendererKind) {
+    if (backend.publication === false)
+        return undefined;
+    if (backend.publication !== undefined)
+        return backend.publication;
+    if (rendererKind !== "markus")
+        return undefined;
+    if (backend.reader !== undefined)
+        return undefined;
+    return DEFAULT_MARKUS_PUBLICATION;
+}

package/amplify/publication/default-publication.ts

@@ -0,0 +1,20 @@
+import type { PapyrusPublicationConfig, PapyrusSiteBackendConfig } from "../site-backend-config";
+
+export const DEFAULT_MARKUS_PUBLICATION: PapyrusPublicationConfig = { kind: "s3-projection", reprojectOnDeploy: true };
+
+/**
+ * The publication a site backend is built with. A Markus site that names a `reader` Amplify app
+ * keeps publishing through it (`amplify-static`); every other Markus site gets the s3-projection
+ * default unless it writes `publication: false`. Sites with another renderer get nothing unless
+ * they write a `publication`.
+ */
+export function resolveSitePublication(
+  backend: Pick<PapyrusSiteBackendConfig, "publication" | "reader">,
+  rendererKind: string | undefined,
+): PapyrusPublicationConfig | undefined {
+  if (backend.publication === false) return undefined;
+  if (backend.publication !== undefined) return backend.publication;
+  if (rendererKind !== "markus") return undefined;
+  if (backend.reader !== undefined) return undefined;
+  return DEFAULT_MARKUS_PUBLICATION;
+}

package/amplify/publication/invalidation-alarm.js

@@ -0,0 +1,26 @@
+import { Duration } from "aws-cdk-lib";
+import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
+export const FREE_INVALIDATION_PATHS_PER_MONTH = 1000;
+export const DAYS_PER_MONTH = 30.4;
+export const ALARM_WINDOW_DAYS = 7;
+export const INVALIDATION_METRIC_NAMESPACE = "Papyrus/Edge";
+export const INVALIDATION_METRIC_NAME = "InvalidatedPaths";
+/** CloudWatch cannot alarm across more than seven days, so the monthly free allowance is checked as its weekly pace. */
+export const WEEKLY_INVALIDATION_PATH_THRESHOLD = Math.round((FREE_INVALIDATION_PATHS_PER_MONTH * ALARM_WINDOW_DAYS) / DAYS_PER_MONTH);
+export function addInvalidationPathAlarm(scope, id, distributionId) {
+    const metric = new cloudwatch.Metric({
+        namespace: INVALIDATION_METRIC_NAMESPACE,
+        metricName: INVALIDATION_METRIC_NAME,
+        dimensionsMap: { DistributionId: distributionId },
+        statistic: "Sum",
+        period: Duration.days(ALARM_WINDOW_DAYS),
+    });
+    return new cloudwatch.Alarm(scope, id, {
+        metric,
+        evaluationPeriods: 1,
+        threshold: WEEKLY_INVALIDATION_PATH_THRESHOLD,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+        alarmDescription: `CloudFront invalidation paths on ${distributionId} are on pace to pass the ${FREE_INVALIDATION_PATHS_PER_MONTH} free paths a month.`,
+    });
+}

package/amplify/publication/invalidation-alarm.ts

@@ -0,0 +1,30 @@
+import { Duration } from "aws-cdk-lib";
+import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
+import type { Construct } from "constructs";
+
+export const FREE_INVALIDATION_PATHS_PER_MONTH = 1000;
+export const DAYS_PER_MONTH = 30.4;
+export const ALARM_WINDOW_DAYS = 7;
+export const INVALIDATION_METRIC_NAMESPACE = "Papyrus/Edge";
+export const INVALIDATION_METRIC_NAME = "InvalidatedPaths";
+
+/** CloudWatch cannot alarm across more than seven days, so the monthly free allowance is checked as its weekly pace. */
+export const WEEKLY_INVALIDATION_PATH_THRESHOLD = Math.round((FREE_INVALIDATION_PATHS_PER_MONTH * ALARM_WINDOW_DAYS) / DAYS_PER_MONTH);
+
+export function addInvalidationPathAlarm(scope: Construct, id: string, distributionId: string): cloudwatch.Alarm {
+  const metric = new cloudwatch.Metric({
+    namespace: INVALIDATION_METRIC_NAMESPACE,
+    metricName: INVALIDATION_METRIC_NAME,
+    dimensionsMap: { DistributionId: distributionId },
+    statistic: "Sum",
+    period: Duration.days(ALARM_WINDOW_DAYS),
+  });
+  return new cloudwatch.Alarm(scope, id, {
+    metric,
+    evaluationPeriods: 1,
+    threshold: WEEKLY_INVALIDATION_PATH_THRESHOLD,
+    comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+    treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+    alarmDescription: `CloudFront invalidation paths on ${distributionId} are on pace to pass the ${FREE_INVALIDATION_PATHS_PER_MONTH} free paths a month.`,
+  });
+}

package/amplify/publication/redirect-and-index.js

@@ -0,0 +1,37 @@
+import cf from "cloudfront";
+
+const redirectStore = cf.kvs();
+
+async function lookUpRedirectTarget(uri) {
+  try {
+    const target = await redirectStore.get(uri);
+    return target ? String(target) : null;
+  } catch (error) {
+    return null;
+  }
+}
+
+function rewriteToIndexDocument(uri) {
+  if (uri.endsWith("/")) {
+    return uri + "index.html";
+  }
+  const lastSegment = uri.substring(uri.lastIndexOf("/") + 1);
+  if (lastSegment.indexOf(".") === -1) {
+    return uri + "/index.html";
+  }
+  return uri;
+}
+
+async function handler(event) {
+  const request = event.request;
+  const redirectTarget = await lookUpRedirectTarget(request.uri);
+  if (redirectTarget !== null) {
+    return {
+      statusCode: 301,
+      statusDescription: "Moved Permanently",
+      headers: { location: { value: redirectTarget } },
+    };
+  }
+  request.uri = rewriteToIndexDocument(request.uri);
+  return request;
+}

package/amplify/publication/renditions-function.js

@@ -0,0 +1,74 @@
+import { Duration, Size } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../functions/shared/python-bundle.js";
+import { RENDITIONS_EPHEMERAL_STORAGE_MB, RENDITIONS_MEDIA_PREFIX, RENDITIONS_MEMORY_MB, RENDITIONS_TIMEOUT_SECONDS, renditionsEnvironment, renditionsEventPattern, } from "./renditions-settings.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../..");
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export function addRenditionsFunction(scope, props) {
+    const deadLetterQueue = new sqs.Queue(scope, "RenditionsDeadLetterQueue", {
+        encryption: sqs.QueueEncryption.SQS_MANAGED,
+        retentionPeriod: Duration.days(14),
+        enforceSSL: true,
+    });
+    const renditions = new LambdaFunction(scope, "RenditionsFunction", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(RENDITIONS_TIMEOUT_SECONDS),
+        memorySize: RENDITIONS_MEMORY_MB,
+        ephemeralStorageSize: Size.mebibytes(RENDITIONS_EPHEMERAL_STORAGE_MB),
+        retryAttempts: 2,
+        deadLetterQueue,
+        environment: renditionsEnvironment(props.siteBucket.bucketName),
+        code: props.code ?? pythonLambdaCode({
+            functionDir: "renditions",
+            modules: ["papyrus_content"],
+            requirements: renditionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+            siteFiles: props.siteFiles,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/renditions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/renditions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:GetObject"],
+        resources: [props.mediaBucket.arnForObjects(`${RENDITIONS_MEDIA_PREFIX}*`)],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:PutObject", "s3:GetObject"],
+        resources: [props.siteBucket.arnForObjects("*")],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:ListBucket"],
+        resources: [props.siteBucket.bucketArn],
+    }));
+    const rule = new events.Rule(scope, "MediaObjectCreatedRule", {
+        eventPattern: renditionsEventPattern(props.mediaBucket.bucketName),
+    });
+    rule.addTarget(new targets.LambdaFunction(renditions, { retryAttempts: 2 }));
+    return { function: renditions, rule, deadLetterQueue };
+}

package/amplify/publication/renditions-function.ts

@@ -0,0 +1,112 @@
+import { Duration, Size } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, type Code, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import type { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode, type SiteBundleFile } from "../functions/shared/python-bundle";
+import {
+  RENDITIONS_EPHEMERAL_STORAGE_MB,
+  RENDITIONS_MEDIA_PREFIX,
+  RENDITIONS_MEMORY_MB,
+  RENDITIONS_TIMEOUT_SECONDS,
+  renditionsEnvironment,
+  renditionsEventPattern,
+} from "./renditions-settings";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../..");
+
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+
+export type RenditionsFunctionProps = {
+  siteBucket: s3.IBucket;
+  mediaBucket: s3.IBucket;
+  siteFiles: SiteBundleFile[];
+  code?: Code;
+};
+
+export type RenditionsFunction = {
+  function: LambdaFunction;
+  rule: events.Rule;
+  deadLetterQueue: sqs.Queue;
+};
+
+function installCheckoutRequirements(outputDir: string): void {
+  const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
+  execSync(
+    `python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`,
+    { cwd: projectRoot, stdio: "inherit" },
+  );
+}
+
+export function addRenditionsFunction(scope: Construct, props: RenditionsFunctionProps): RenditionsFunction {
+  const deadLetterQueue = new sqs.Queue(scope, "RenditionsDeadLetterQueue", {
+    encryption: sqs.QueueEncryption.SQS_MANAGED,
+    retentionPeriod: Duration.days(14),
+    enforceSSL: true,
+  });
+  const renditions = new LambdaFunction(scope, "RenditionsFunction", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(RENDITIONS_TIMEOUT_SECONDS),
+    memorySize: RENDITIONS_MEMORY_MB,
+    ephemeralStorageSize: Size.mebibytes(RENDITIONS_EPHEMERAL_STORAGE_MB),
+    retryAttempts: 2,
+    deadLetterQueue,
+    environment: renditionsEnvironment(props.siteBucket.bucketName),
+    code: props.code ?? pythonLambdaCode(
+      {
+        functionDir: "renditions",
+        modules: ["papyrus_content"],
+        requirements: renditionsRequirements,
+        noDeps: true,
+        checkoutExtras: installCheckoutRequirements,
+        siteFiles: props.siteFiles,
+      },
+      [
+        "bash",
+        "-c",
+        [
+          "set -euo pipefail",
+          "mkdir -p /asset-output/papyrus_content",
+          "cp amplify/functions/renditions/handler.py /asset-output/handler.py",
+          "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          "python3 -m pip install -r amplify/functions/renditions/requirements.txt -t /asset-output --no-cache-dir",
+        ].join(" && "),
+      ],
+    ),
+  });
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:GetObject"],
+      resources: [props.mediaBucket.arnForObjects(`${RENDITIONS_MEDIA_PREFIX}*`)],
+    }),
+  );
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject", "s3:GetObject"],
+      resources: [props.siteBucket.arnForObjects("*")],
+    }),
+  );
+  renditions.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:ListBucket"],
+      resources: [props.siteBucket.bucketArn],
+    }),
+  );
+  const rule = new events.Rule(scope, "MediaObjectCreatedRule", {
+    eventPattern: renditionsEventPattern(props.mediaBucket.bucketName),
+  });
+  rule.addTarget(new targets.LambdaFunction(renditions, { retryAttempts: 2 }));
+  return { function: renditions, rule, deadLetterQueue };
+}

package/amplify/publication/renditions-settings.js

@@ -0,0 +1,51 @@
+/**
+ * Pure planning for the upload-time renditions function of an s3-projection
+ * site (no CDK imports, so it can be tested without synthesizing).
+ *
+ * The function exists only for a site whose `projection.json` carries an
+ * `images` section (the one place the image pipeline settings live, shared by
+ * the renditions function and the projector) or `media.originals: true`
+ * (every media object is also published as is, at its key without `media/`).
+ */
+import fs from "node:fs";
+import path from "node:path";
+export const RENDITIONS_MEMORY_MB = 3008;
+export const RENDITIONS_TIMEOUT_SECONDS = 300;
+export const RENDITIONS_EPHEMERAL_STORAGE_MB = 2048;
+export const RENDITIONS_STATIC_DIRECTORY = "/var/task/site_static";
+export const RENDITIONS_MEDIA_PREFIX = "media/";
+export const RENDITIONS_FUNCTION_NAME_ENV = "PAPYRUS_RENDITIONS_FUNCTION_NAME";
+export function projectionSettingsHaveImages(settingsPath) {
+    if (!fs.existsSync(settingsPath))
+        return false;
+    const parsed = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+    return typeof parsed.images === "object" && parsed.images !== null;
+}
+export function projectionSettingsPublishOriginals(settingsPath) {
+    if (!fs.existsSync(settingsPath))
+        return false;
+    const parsed = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+    return parsed.media?.originals === true;
+}
+export function planRenditions(publication, workingDirectory) {
+    if (publication?.staticDir === undefined)
+        return { enabled: false, siteFiles: [] };
+    const settingsFile = path.join(publication.staticDir, "projection.json");
+    const resolved = path.resolve(workingDirectory, settingsFile);
+    if (!projectionSettingsHaveImages(resolved) && !projectionSettingsPublishOriginals(resolved))
+        return { enabled: false, siteFiles: [] };
+    return { enabled: true, siteFiles: [{ from: settingsFile, to: "site_static/projection.json" }] };
+}
+export function renditionsEventPattern(mediaBucketName) {
+    return {
+        source: ["aws.s3"],
+        detailType: ["Object Created"],
+        detail: { bucket: { name: [mediaBucketName] }, object: { key: [{ prefix: RENDITIONS_MEDIA_PREFIX }] } },
+    };
+}
+export function renditionsEnvironment(siteBucketName) {
+    return {
+        PAPYRUS_SITE_BUCKET: siteBucketName,
+        PAPYRUS_SITE_STATIC_DIR: RENDITIONS_STATIC_DIRECTORY,
+    };
+}