@anthusai/papyrus 1.0.0-next.9 → 1.1.0

package/amplify/plugins/signup/function/resource.ts

@@ -0,0 +1,35 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { AttributeType, BillingMode, Table } from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, Code, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
+
+export const signupSubmit = defineFunction(
+  (scope: Construct) => {
+    const rateTable = new Table(scope, "PapyrusSignupRateCounters", {
+      partitionKey: { name: "pk", type: AttributeType.STRING },
+      billingMode: BillingMode.PAY_PER_REQUEST,
+      timeToLiveAttribute: "expiresAt",
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+    const lambda = new Function(scope, "papyrus-signup-submit", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(10),
+      memorySize: 256,
+      code: Code.fromAsset(functionDirectory, { exclude: ["*.ts", "__pycache__", "*.pyc"] }),
+      environment: { PAPYRUS_SIGNUP_RATE_TABLE: rateTable.tableName },
+    });
+    lambda.addToRolePolicy(
+      new PolicyStatement({ effect: Effect.ALLOW, actions: ["dynamodb:UpdateItem"], resources: [rateTable.tableArn] }),
+    );
+    return lambda;
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/plugins/signup/papyrus.plugin.js

@@ -0,0 +1,59 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { signupSubmit } from "./function/resource.js";
+import { signupSchemaDefinitions } from "./schema.js";
+import { SIGNUP_MUTATION_FIELD, WAF_MINIMUM_RATE_LIMIT, addSignupRateLimit } from "./waf.js";
+const FORM_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const KNOWN_KEYS = new Set(["name", "forms", "addressLimitPerMinute", "waf"]);
+export const signupManifest = {
+    name: "signup",
+    contract: 1,
+    models: ["SignupEntry"],
+    mutations: [SIGNUP_MUTATION_FIELD],
+    guest: { mutations: [SIGNUP_MUTATION_FIELD] },
+    newsroomPanels: [{ id: "signups", label: "Signups" }],
+    staticAssets: ["_plugins/papyrus-signup@1.js"],
+};
+export function resolveSignupConfig(request) {
+    const raw = typeof request === "string" ? { name: request } : request;
+    const unknown = Object.keys(raw).filter((key) => !KNOWN_KEYS.has(key));
+    if (unknown.length > 0)
+        throw new Error(`Unknown signup plugin settings: ${unknown.join(", ")}`);
+    const forms = raw.forms ?? ["newsletter"];
+    if (!Array.isArray(forms) || forms.length === 0 || !forms.every((form) => typeof form === "string" && FORM_NAME.test(form))) {
+        throw new Error("signup plugin forms must be a non-empty list of lowercase names (letters, digits, hyphens; at most 40 characters)");
+    }
+    const addressLimitPerMinute = raw.addressLimitPerMinute ?? 20;
+    if (!Number.isInteger(addressLimitPerMinute) || addressLimitPerMinute < WAF_MINIMUM_RATE_LIMIT || addressLimitPerMinute > 1000) {
+        throw new Error(`signup plugin addressLimitPerMinute must be an integer from ${WAF_MINIMUM_RATE_LIMIT} to 1000`);
+    }
+    const waf = raw.waf ?? true;
+    if (typeof waf !== "boolean")
+        throw new Error("signup plugin waf must be a boolean");
+    return { forms: [...new Set(forms)], addressLimitPerMinute, waf };
+}
+export const signupPlugin = {
+    manifest: signupManifest,
+    resolveConfig: resolveSignupConfig,
+    functions: () => ({ signupSubmit }),
+    schemaDefinitions: signupSchemaDefinitions,
+    publicSettings: (config) => ({ contract: signupManifest.contract, forms: config.forms }),
+    wire(backend, config, context) {
+        const lambda = backend.signupSubmit.resources.lambda;
+        const stack = Stack.of(lambda);
+        lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
+        lambda.addEnvironment("PAPYRUS_SIGNUP_FORMS", config.forms.join(","));
+        lambda.addEnvironment("PAPYRUS_SIGNUP_ADDRESS_LIMIT", String(config.addressLimitPerMinute));
+        lambda.addToRolePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: ["appsync:GraphQL"],
+            resources: [`arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/Mutation/fields/createSignupEntry`],
+        }));
+        if (config.waf) {
+            addSignupRateLimit(context.createStack("signup-protection"), {
+                graphqlApiArn: `arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}`,
+                limit: config.addressLimitPerMinute,
+            });
+        }
+    },
+};

package/amplify/plugins/signup/papyrus.plugin.ts

@@ -0,0 +1,74 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import type { PapyrusPlugin, PluginManifest, PluginRequest, PluginWiringContext } from "../types";
+import { signupSubmit } from "./function/resource";
+import { signupSchemaDefinitions } from "./schema";
+import { SIGNUP_MUTATION_FIELD, WAF_MINIMUM_RATE_LIMIT, addSignupRateLimit } from "./waf";
+
+export type SignupPluginConfig = {
+  /** Form names the site accepts. A submission naming any other form is rejected. */
+  forms: string[];
+  /** Most submissions one address may make in a minute: enforced by the function and, with `waf`, by the web ACL. */
+  addressLimitPerMinute: number;
+  /** A regional web ACL with a rate-based rule on the API (about 6 USD a month). Off: the function's counters only. */
+  waf: boolean;
+};
+
+const FORM_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const KNOWN_KEYS = new Set(["name", "forms", "addressLimitPerMinute", "waf"]);
+
+export const signupManifest: PluginManifest = {
+  name: "signup",
+  contract: 1,
+  models: ["SignupEntry"],
+  mutations: [SIGNUP_MUTATION_FIELD],
+  guest: { mutations: [SIGNUP_MUTATION_FIELD] },
+  newsroomPanels: [{ id: "signups", label: "Signups" }],
+  staticAssets: ["_plugins/papyrus-signup@1.js"],
+};
+
+export function resolveSignupConfig(request: PluginRequest): SignupPluginConfig {
+  const raw = typeof request === "string" ? { name: request } : request;
+  const unknown = Object.keys(raw).filter((key) => !KNOWN_KEYS.has(key));
+  if (unknown.length > 0) throw new Error(`Unknown signup plugin settings: ${unknown.join(", ")}`);
+  const forms = (raw.forms as string[] | undefined) ?? ["newsletter"];
+  if (!Array.isArray(forms) || forms.length === 0 || !forms.every((form) => typeof form === "string" && FORM_NAME.test(form))) {
+    throw new Error("signup plugin forms must be a non-empty list of lowercase names (letters, digits, hyphens; at most 40 characters)");
+  }
+  const addressLimitPerMinute = (raw.addressLimitPerMinute as number | undefined) ?? 20;
+  if (!Number.isInteger(addressLimitPerMinute) || addressLimitPerMinute < WAF_MINIMUM_RATE_LIMIT || addressLimitPerMinute > 1000) {
+    throw new Error(`signup plugin addressLimitPerMinute must be an integer from ${WAF_MINIMUM_RATE_LIMIT} to 1000`);
+  }
+  const waf = (raw.waf as boolean | undefined) ?? true;
+  if (typeof waf !== "boolean") throw new Error("signup plugin waf must be a boolean");
+  return { forms: [...new Set(forms)], addressLimitPerMinute, waf };
+}
+
+export const signupPlugin: PapyrusPlugin<SignupPluginConfig, { signupSubmit: typeof signupSubmit }> = {
+  manifest: signupManifest,
+  resolveConfig: resolveSignupConfig,
+  functions: () => ({ signupSubmit }),
+  schemaDefinitions: signupSchemaDefinitions,
+  publicSettings: (config) => ({ contract: signupManifest.contract, forms: config.forms }),
+  wire(backend, config, context: PluginWiringContext) {
+    const lambda = backend.signupSubmit.resources.lambda as LambdaFunction;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
+    lambda.addEnvironment("PAPYRUS_SIGNUP_FORMS", config.forms.join(","));
+    lambda.addEnvironment("PAPYRUS_SIGNUP_ADDRESS_LIMIT", String(config.addressLimitPerMinute));
+    lambda.addToRolePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: [`arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/Mutation/fields/createSignupEntry`],
+      }),
+    );
+    if (config.waf) {
+      addSignupRateLimit(context.createStack("signup-protection"), {
+        graphqlApiArn: `arn:aws:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}`,
+        limit: config.addressLimitPerMinute,
+      });
+    }
+  },
+};

package/amplify/plugins/signup/schema.js

@@ -0,0 +1,40 @@
+import { a } from "@aws-amplify/backend";
+import { signupSubmit } from "./function/resource.js";
+/**
+ * SignupEntry is never guest-readable and has no create rule for anyone: only the
+ * submitSignup function (IAM) writes it. Editors and admins list it; admins delete.
+ */
+export function signupSchemaDefinitions() {
+    return {
+        SignupEntry: a
+            .model({
+            id: a.id().required(),
+            form: a.string().required(),
+            value: a.string().required(),
+            submittedAt: a.datetime().required(),
+        })
+            .disableOperations(["subscriptions"])
+            .secondaryIndexes((index) => [
+            index("form").sortKeys(["submittedAt"]).queryField("listSignupEntriesByFormAndSubmittedAt"),
+        ])
+            .authorization((allow) => [
+            allow.group("editor").to(["read"]),
+            allow.group("admin").to(["read", "delete"]),
+        ]),
+        SignupReceipt: a.customType({
+            status: a.string().required(),
+            message: a.string(),
+        }),
+        submitSignup: a
+            .mutation()
+            .arguments({
+            form: a.string().required(),
+            value: a.string().required(),
+            renderedAt: a.string().required(),
+            website: a.string(),
+        })
+            .returns(a.ref("SignupReceipt"))
+            .authorization((allow) => [allow.guest()])
+            .handler(a.handler.function(signupSubmit)),
+    };
+}

package/amplify/plugins/signup/schema.ts

@@ -0,0 +1,41 @@
+import { a } from "@aws-amplify/backend";
+import { signupSubmit } from "./function/resource";
+
+/**
+ * SignupEntry is never guest-readable and has no create rule for anyone: only the
+ * submitSignup function (IAM) writes it. Editors and admins list it; admins delete.
+ */
+export function signupSchemaDefinitions() {
+  return {
+    SignupEntry: a
+      .model({
+        id: a.id().required(),
+        form: a.string().required(),
+        value: a.string().required(),
+        submittedAt: a.datetime().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .secondaryIndexes((index) => [
+        index("form").sortKeys(["submittedAt"]).queryField("listSignupEntriesByFormAndSubmittedAt"),
+      ])
+      .authorization((allow) => [
+        allow.group("editor").to(["read"]),
+        allow.group("admin").to(["read", "delete"]),
+      ]),
+    SignupReceipt: a.customType({
+      status: a.string().required(),
+      message: a.string(),
+    }),
+    submitSignup: a
+      .mutation()
+      .arguments({
+        form: a.string().required(),
+        value: a.string().required(),
+        renderedAt: a.string().required(),
+        website: a.string(),
+      })
+      .returns(a.ref("SignupReceipt"))
+      .authorization((allow) => [allow.guest()])
+      .handler(a.handler.function(signupSubmit)),
+  };
+}

package/amplify/plugins/signup/waf.js

@@ -0,0 +1,48 @@
+import { CfnWebACL, CfnWebACLAssociation } from "aws-cdk-lib/aws-wafv2";
+export const SIGNUP_MUTATION_FIELD = "submitSignup";
+export const WAF_MINIMUM_RATE_LIMIT = 10;
+export const WAF_EVALUATION_WINDOW_SECONDS = 60;
+/**
+ * A regional web ACL on the AppSync API with one rate-based rule: more than `limit`
+ * submitSignup requests from one address in a minute are blocked with a 429 before
+ * the function runs. Only requests whose body names the mutation count, so reads,
+ * newsroom saves and CLI imports from the same address are never limited.
+ */
+export function addSignupRateLimit(scope, input) {
+    if (!Number.isInteger(input.limit) || input.limit < WAF_MINIMUM_RATE_LIMIT) {
+        throw new Error(`signup waf rate limit must be an integer of at least ${WAF_MINIMUM_RATE_LIMIT} (AWS WAF minimum)`);
+    }
+    const acl = new CfnWebACL(scope, "PapyrusSignupWebAcl", {
+        scope: "REGIONAL",
+        defaultAction: { allow: {} },
+        visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "PapyrusSignupWebAcl", sampledRequestsEnabled: true },
+        rules: [
+            {
+                name: "SignupRateLimitPerAddress",
+                priority: 0,
+                action: { block: { customResponse: { responseCode: 429 } } },
+                visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "SignupRateLimitPerAddress", sampledRequestsEnabled: true },
+                statement: {
+                    rateBasedStatement: {
+                        limit: input.limit,
+                        evaluationWindowSec: WAF_EVALUATION_WINDOW_SECONDS,
+                        aggregateKeyType: "IP",
+                        scopeDownStatement: {
+                            byteMatchStatement: {
+                                searchString: SIGNUP_MUTATION_FIELD,
+                                positionalConstraint: "CONTAINS",
+                                fieldToMatch: { body: { oversizeHandling: "NO_MATCH" } },
+                                textTransformations: [{ priority: 0, type: "NONE" }],
+                            },
+                        },
+                    },
+                },
+            },
+        ],
+    });
+    new CfnWebACLAssociation(scope, "PapyrusSignupWebAclAssociation", {
+        resourceArn: input.graphqlApiArn,
+        webAclArn: acl.attrArn,
+    });
+    return acl;
+}

package/amplify/plugins/signup/waf.ts

@@ -0,0 +1,51 @@
+import { CfnWebACL, CfnWebACLAssociation } from "aws-cdk-lib/aws-wafv2";
+import type { Construct } from "constructs";
+
+export const SIGNUP_MUTATION_FIELD = "submitSignup";
+export const WAF_MINIMUM_RATE_LIMIT = 10;
+export const WAF_EVALUATION_WINDOW_SECONDS = 60;
+
+/**
+ * A regional web ACL on the AppSync API with one rate-based rule: more than `limit`
+ * submitSignup requests from one address in a minute are blocked with a 429 before
+ * the function runs. Only requests whose body names the mutation count, so reads,
+ * newsroom saves and CLI imports from the same address are never limited.
+ */
+export function addSignupRateLimit(scope: Construct, input: { graphqlApiArn: string; limit: number }): CfnWebACL {
+  if (!Number.isInteger(input.limit) || input.limit < WAF_MINIMUM_RATE_LIMIT) {
+    throw new Error(`signup waf rate limit must be an integer of at least ${WAF_MINIMUM_RATE_LIMIT} (AWS WAF minimum)`);
+  }
+  const acl = new CfnWebACL(scope, "PapyrusSignupWebAcl", {
+    scope: "REGIONAL",
+    defaultAction: { allow: {} },
+    visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "PapyrusSignupWebAcl", sampledRequestsEnabled: true },
+    rules: [
+      {
+        name: "SignupRateLimitPerAddress",
+        priority: 0,
+        action: { block: { customResponse: { responseCode: 429 } } },
+        visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "SignupRateLimitPerAddress", sampledRequestsEnabled: true },
+        statement: {
+          rateBasedStatement: {
+            limit: input.limit,
+            evaluationWindowSec: WAF_EVALUATION_WINDOW_SECONDS,
+            aggregateKeyType: "IP",
+            scopeDownStatement: {
+              byteMatchStatement: {
+                searchString: SIGNUP_MUTATION_FIELD,
+                positionalConstraint: "CONTAINS",
+                fieldToMatch: { body: { oversizeHandling: "NO_MATCH" } },
+                textTransformations: [{ priority: 0, type: "NONE" }],
+              },
+            },
+          },
+        },
+      },
+    ],
+  });
+  new CfnWebACLAssociation(scope, "PapyrusSignupWebAclAssociation", {
+    resourceArn: input.graphqlApiArn,
+    webAclArn: acl.attrArn,
+  });
+  return acl;
+}

package/amplify/plugins/types.js

@@ -0,0 +1 @@
+export {};

package/amplify/plugins/types.ts

@@ -0,0 +1,39 @@
+import type { Construct } from "constructs";
+
+/** How a site asks for a plugin in `papyrus.config.ts`: `plugins: ["signup"]` or `plugins: [{ name: "signup", forms: ["news"] }]`. */
+export type PluginRequest = string | ({ name: string } & Record<string, unknown>);
+
+/** What a plugin declares about itself. A test pins the schema, the guest rules and the static files to this. */
+export type PluginManifest = {
+  name: string;
+  /** Public contract version. Bump it when a mutation input, a model field, an element name or an attribute changes. No compatibility shims. */
+  contract: number;
+  models: string[];
+  mutations: string[];
+  /** What an anonymous visitor may call. Everything else is closed to guests. */
+  guest: { mutations: string[] };
+  newsroomPanels: { id: string; label: string }[];
+  /** Keys the projector writes into the site bucket when the plugin is enabled. */
+  staticAssets: string[];
+};
+
+/** Where the deploy-time wiring puts its resources. Filled in by `defineSiteBackend`. */
+export type PluginWiringContext = {
+  createStack: (name: string) => Construct;
+  graphqlApiId: string;
+  graphqlEndpoint: string;
+};
+
+export type PapyrusPlugin<Config, Functions = unknown> = {
+  manifest: PluginManifest;
+  /** Validates the request and fills in defaults. Throws a readable error. */
+  resolveConfig: (request: PluginRequest) => Config;
+  /** Amplify function resources the plugin adds to `defineBackend`. */
+  functions: () => Functions;
+  /** Models and custom operations merged into the site schema. */
+  schemaDefinitions: () => Record<string, unknown>;
+  /** The settings the newsroom and the page component may read from `amplify_outputs.json` (`custom.papyrusPlugins.<name>`). Never secrets. */
+  publicSettings: (config: Config) => Record<string, unknown>;
+  /** Everything that needs the backend to exist: IAM, environment, WAF, outputs. */
+  wire: (backend: any, config: Config, context: PluginWiringContext) => void;
+};

package/amplify/plugins/wire.js

@@ -0,0 +1,24 @@
+export const PLUGINS_ENVIRONMENT_VARIABLE = "PAPYRUS_PLUGINS";
+export const PLUGINS_OUTPUT_KEY = "papyrusPlugins";
+/**
+ * Deploy-time wiring for every enabled plugin. A site without plugins reaches no line of this:
+ * nothing is added to the stacks, the environment or the outputs.
+ */
+export function wirePlugins(backend, plugins, contentActionsLambda) {
+    if (plugins.length === 0)
+        return;
+    const graphqlApi = backend.data.resources.graphqlApi;
+    const context = {
+        createStack: (name) => backend.createStack(name),
+        graphqlApiId: graphqlApi.apiId,
+        graphqlEndpoint: backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
+    };
+    for (const { plugin, config } of plugins)
+        plugin.wire(backend, config, context);
+    contentActionsLambda.addEnvironment(PLUGINS_ENVIRONMENT_VARIABLE, plugins.map(({ plugin }) => plugin.manifest.name).join(","));
+    backend.addOutput({
+        custom: {
+            [PLUGINS_OUTPUT_KEY]: Object.fromEntries(plugins.map(({ plugin, config }) => [plugin.manifest.name, plugin.publicSettings(config)])),
+        },
+    });
+}

package/amplify/plugins/wire.ts

@@ -0,0 +1,26 @@
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import type { ResolvedPlugin } from "./registry";
+
+export const PLUGINS_ENVIRONMENT_VARIABLE = "PAPYRUS_PLUGINS";
+export const PLUGINS_OUTPUT_KEY = "papyrusPlugins";
+
+/**
+ * Deploy-time wiring for every enabled plugin. A site without plugins reaches no line of this:
+ * nothing is added to the stacks, the environment or the outputs.
+ */
+export function wirePlugins(backend: any, plugins: ResolvedPlugin[], contentActionsLambda: LambdaFunction): void {
+  if (plugins.length === 0) return;
+  const graphqlApi = backend.data.resources.graphqlApi;
+  const context = {
+    createStack: (name: string) => backend.createStack(name),
+    graphqlApiId: graphqlApi.apiId as string,
+    graphqlEndpoint: backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string,
+  };
+  for (const { plugin, config } of plugins) plugin.wire(backend, config, context);
+  contentActionsLambda.addEnvironment(PLUGINS_ENVIRONMENT_VARIABLE, plugins.map(({ plugin }) => plugin.manifest.name).join(","));
+  backend.addOutput({
+    custom: {
+      [PLUGINS_OUTPUT_KEY]: Object.fromEntries(plugins.map(({ plugin, config }) => [plugin.manifest.name, plugin.publicSettings(config)])),
+    },
+  });
+}

package/amplify/publication/default-publication.js

@@ -0,0 +1,18 @@
+export const DEFAULT_MARKUS_PUBLICATION = { kind: "s3-projection", reprojectOnDeploy: true };
+/**
+ * The publication a site backend is built with. A Markus site that names a `reader` Amplify app
+ * keeps publishing through it (`amplify-static`); every other Markus site gets the s3-projection
+ * default unless it writes `publication: false`. Sites with another renderer get nothing unless
+ * they write a `publication`.
+ */
+export function resolveSitePublication(backend, rendererKind) {
+    if (backend.publication === false)
+        return undefined;
+    if (backend.publication !== undefined)
+        return backend.publication;
+    if (rendererKind !== "markus")
+        return undefined;
+    if (backend.reader !== undefined)
+        return undefined;
+    return DEFAULT_MARKUS_PUBLICATION;
+}

package/amplify/publication/default-publication.ts

@@ -0,0 +1,20 @@
+import type { PapyrusPublicationConfig, PapyrusSiteBackendConfig } from "../site-backend-config";
+
+export const DEFAULT_MARKUS_PUBLICATION: PapyrusPublicationConfig = { kind: "s3-projection", reprojectOnDeploy: true };
+
+/**
+ * The publication a site backend is built with. A Markus site that names a `reader` Amplify app
+ * keeps publishing through it (`amplify-static`); every other Markus site gets the s3-projection
+ * default unless it writes `publication: false`. Sites with another renderer get nothing unless
+ * they write a `publication`.
+ */
+export function resolveSitePublication(
+  backend: Pick<PapyrusSiteBackendConfig, "publication" | "reader">,
+  rendererKind: string | undefined,
+): PapyrusPublicationConfig | undefined {
+  if (backend.publication === false) return undefined;
+  if (backend.publication !== undefined) return backend.publication;
+  if (rendererKind !== "markus") return undefined;
+  if (backend.reader !== undefined) return undefined;
+  return DEFAULT_MARKUS_PUBLICATION;
+}

package/amplify/publication/invalidation-alarm.js

@@ -0,0 +1,26 @@
+import { Duration } from "aws-cdk-lib";
+import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
+export const FREE_INVALIDATION_PATHS_PER_MONTH = 1000;
+export const DAYS_PER_MONTH = 30.4;
+export const ALARM_WINDOW_DAYS = 7;
+export const INVALIDATION_METRIC_NAMESPACE = "Papyrus/Edge";
+export const INVALIDATION_METRIC_NAME = "InvalidatedPaths";
+/** CloudWatch cannot alarm across more than seven days, so the monthly free allowance is checked as its weekly pace. */
+export const WEEKLY_INVALIDATION_PATH_THRESHOLD = Math.round((FREE_INVALIDATION_PATHS_PER_MONTH * ALARM_WINDOW_DAYS) / DAYS_PER_MONTH);
+export function addInvalidationPathAlarm(scope, id, distributionId) {
+    const metric = new cloudwatch.Metric({
+        namespace: INVALIDATION_METRIC_NAMESPACE,
+        metricName: INVALIDATION_METRIC_NAME,
+        dimensionsMap: { DistributionId: distributionId },
+        statistic: "Sum",
+        period: Duration.days(ALARM_WINDOW_DAYS),
+    });
+    return new cloudwatch.Alarm(scope, id, {
+        metric,
+        evaluationPeriods: 1,
+        threshold: WEEKLY_INVALIDATION_PATH_THRESHOLD,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+        alarmDescription: `CloudFront invalidation paths on ${distributionId} are on pace to pass the ${FREE_INVALIDATION_PATHS_PER_MONTH} free paths a month.`,
+    });
+}

package/amplify/publication/invalidation-alarm.ts

@@ -0,0 +1,30 @@
+import { Duration } from "aws-cdk-lib";
+import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
+import type { Construct } from "constructs";
+
+export const FREE_INVALIDATION_PATHS_PER_MONTH = 1000;
+export const DAYS_PER_MONTH = 30.4;
+export const ALARM_WINDOW_DAYS = 7;
+export const INVALIDATION_METRIC_NAMESPACE = "Papyrus/Edge";
+export const INVALIDATION_METRIC_NAME = "InvalidatedPaths";
+
+/** CloudWatch cannot alarm across more than seven days, so the monthly free allowance is checked as its weekly pace. */
+export const WEEKLY_INVALIDATION_PATH_THRESHOLD = Math.round((FREE_INVALIDATION_PATHS_PER_MONTH * ALARM_WINDOW_DAYS) / DAYS_PER_MONTH);
+
+export function addInvalidationPathAlarm(scope: Construct, id: string, distributionId: string): cloudwatch.Alarm {
+  const metric = new cloudwatch.Metric({
+    namespace: INVALIDATION_METRIC_NAMESPACE,
+    metricName: INVALIDATION_METRIC_NAME,
+    dimensionsMap: { DistributionId: distributionId },
+    statistic: "Sum",
+    period: Duration.days(ALARM_WINDOW_DAYS),
+  });
+  return new cloudwatch.Alarm(scope, id, {
+    metric,
+    evaluationPeriods: 1,
+    threshold: WEEKLY_INVALIDATION_PATH_THRESHOLD,
+    comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+    treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+    alarmDescription: `CloudFront invalidation paths on ${distributionId} are on pace to pass the ${FREE_INVALIDATION_PATHS_PER_MONTH} free paths a month.`,
+  });
+}

package/amplify/publication/redirect-and-index.js

@@ -0,0 +1,37 @@
+import cf from "cloudfront";
+
+const redirectStore = cf.kvs();
+
+async function lookUpRedirectTarget(uri) {
+  try {
+    const target = await redirectStore.get(uri);
+    return target ? String(target) : null;
+  } catch (error) {
+    return null;
+  }
+}
+
+function rewriteToIndexDocument(uri) {
+  if (uri.endsWith("/")) {
+    return uri + "index.html";
+  }
+  const lastSegment = uri.substring(uri.lastIndexOf("/") + 1);
+  if (lastSegment.indexOf(".") === -1) {
+    return uri + "/index.html";
+  }
+  return uri;
+}
+
+async function handler(event) {
+  const request = event.request;
+  const redirectTarget = await lookUpRedirectTarget(request.uri);
+  if (redirectTarget !== null) {
+    return {
+      statusCode: 301,
+      statusDescription: "Moved Permanently",
+      headers: { location: { value: redirectTarget } },
+    };
+  }
+  request.uri = rewriteToIndexDocument(request.uri);
+  return request;
+}

package/amplify/publication/renditions-function.js

@@ -0,0 +1,74 @@
+import { Duration, Size } from "aws-cdk-lib";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Architecture, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../functions/shared/python-bundle.js";
+import { RENDITIONS_EPHEMERAL_STORAGE_MB, RENDITIONS_MEDIA_PREFIX, RENDITIONS_MEMORY_MB, RENDITIONS_TIMEOUT_SECONDS, renditionsEnvironment, renditionsEventPattern, } from "./renditions-settings.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../..");
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+function installCheckoutRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
+}
+export function addRenditionsFunction(scope, props) {
+    const deadLetterQueue = new sqs.Queue(scope, "RenditionsDeadLetterQueue", {
+        encryption: sqs.QueueEncryption.SQS_MANAGED,
+        retentionPeriod: Duration.days(14),
+        enforceSSL: true,
+    });
+    const renditions = new LambdaFunction(scope, "RenditionsFunction", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(RENDITIONS_TIMEOUT_SECONDS),
+        memorySize: RENDITIONS_MEMORY_MB,
+        ephemeralStorageSize: Size.mebibytes(RENDITIONS_EPHEMERAL_STORAGE_MB),
+        retryAttempts: 2,
+        deadLetterQueue,
+        environment: renditionsEnvironment(props.siteBucket.bucketName),
+        code: props.code ?? pythonLambdaCode({
+            functionDir: "renditions",
+            modules: ["papyrus_content"],
+            requirements: renditionsRequirements,
+            noDeps: true,
+            checkoutExtras: installCheckoutRequirements,
+            siteFiles: props.siteFiles,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_content",
+                "cp amplify/functions/renditions/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "python3 -m pip install -r amplify/functions/renditions/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:GetObject"],
+        resources: [props.mediaBucket.arnForObjects(`${RENDITIONS_MEDIA_PREFIX}*`)],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:PutObject", "s3:GetObject"],
+        resources: [props.siteBucket.arnForObjects("*")],
+    }));
+    renditions.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["s3:ListBucket"],
+        resources: [props.siteBucket.bucketArn],
+    }));
+    const rule = new events.Rule(scope, "MediaObjectCreatedRule", {
+        eventPattern: renditionsEventPattern(props.mediaBucket.bucketName),
+    });
+    rule.addTarget(new targets.LambdaFunction(renditions, { retryAttempts: 2 }));
+    return { function: renditions, rule, deadLetterQueue };
+}