@anthusai/papyrus 2.0.0-next.3 → 2.0.0-next.31

package/amplify/functions/public-forms/resource.js

@@ -0,0 +1,9 @@
+import { defineFunction } from "@aws-amplify/backend";
+/** The public form receiving endpoint. Wired (table, Function URL, origins, output) by `wire.ts`. */
+export const publicForms = defineFunction({
+    name: "papyrus-public-forms",
+    entry: "./handler.ts",
+    timeoutSeconds: 10,
+    memoryMB: 256,
+    resourceGroupName: "data",
+});

package/amplify/functions/public-forms/resource.ts

@@ -0,0 +1,10 @@
+import { defineFunction } from "@aws-amplify/backend";
+
+/** The public form receiving endpoint. Wired (table, Function URL, origins, output) by `wire.ts`. */
+export const publicForms = defineFunction({
+  name: "papyrus-public-forms",
+  entry: "./handler.ts",
+  timeoutSeconds: 10,
+  memoryMB: 256,
+  resourceGroupName: "data",
+});

package/amplify/functions/public-forms/wire.js

@@ -0,0 +1,25 @@
+import { RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+export const PUBLIC_FORMS_OUTPUT_KEY = "publicForms";
+/**
+ * Wires the endpoint: the rate-limit counter table (TTL), the Function URL and the function's settings, and returns
+ * the URL for the `custom.publicForms.endpoint` output. Everything lives in the function's own stack.
+ */
+export function wirePublicForms(backend, wiring) {
+    const lambda = backend.publicForms.resources.lambda;
+    const stack = Stack.of(lambda);
+    const table = new dynamodb.Table(stack, "PublicFormsLimits", {
+        partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+        billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+        timeToLiveAttribute: "expiresAt",
+        removalPolicy: RemovalPolicy.DESTROY,
+    });
+    lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["dynamodb:UpdateItem"], resources: [table.tableArn] }));
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_TABLE", table.tableName);
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_ORIGINS", wiring.allowedOrigins.join(","));
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_HONEYPOTS", (wiring.honeypotFields ?? []).join(","));
+    // CORS is answered by the handler (it must echo exactly one allowed origin), so the URL carries no CORS block.
+    return lambda.addFunctionUrl({ authType: FunctionUrlAuthType.NONE }).url;
+}

package/amplify/functions/public-forms/wire.ts

@@ -0,0 +1,32 @@
+import { RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { type Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+
+export const PUBLIC_FORMS_OUTPUT_KEY = "publicForms";
+
+export type PublicFormsWiring = {
+  allowedOrigins: string[];
+  honeypotFields?: string[];
+};
+
+/**
+ * Wires the endpoint: the rate-limit counter table (TTL), the Function URL and the function's settings, and returns
+ * the URL for the `custom.publicForms.endpoint` output. Everything lives in the function's own stack.
+ */
+export function wirePublicForms(backend: { publicForms: { resources: { lambda: unknown }; addEnvironment: (name: string, value: string) => void } }, wiring: PublicFormsWiring): string {
+  const lambda = backend.publicForms.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  const table = new dynamodb.Table(stack, "PublicFormsLimits", {
+    partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+    billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+    timeToLiveAttribute: "expiresAt",
+    removalPolicy: RemovalPolicy.DESTROY,
+  });
+  lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["dynamodb:UpdateItem"], resources: [table.tableArn] }));
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_TABLE", table.tableName);
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_ORIGINS", wiring.allowedOrigins.join(","));
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_HONEYPOTS", (wiring.honeypotFields ?? []).join(","));
+  // CORS is answered by the handler (it must echo exactly one allowed origin), so the URL carries no CORS block.
+  return lambda.addFunctionUrl({ authType: FunctionUrlAuthType.NONE }).url;
+}

package/amplify/functions/shared/python-bundle.js

@@ -78,23 +78,29 @@ export function siteFilesContentHash(siteFiles) {
 function pipSpec() {
     return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
+/** What the first pip install gets: `papyrus-newsroom` with its dependencies, plus the function's own requirements. Empty means skip it. */
+export function firstPipRequirements(options) {
+    return [...(options.noDeps ? [] : [pipSpec()]), ...(options.requirements ?? [])];
+}
 function bundleFromPip(outputDir, options) {
     const extra = (process.env.PAPYRUS_PIP_EXTRA_ARGS ?? "").trim().split(/\s+/).filter(Boolean);
     const python = (process.env.PAPYRUS_PIP_PYTHON ?? "python3").trim();
-    execFileSync(python, [
-        "-m", "pip", "install",
-        "--target", outputDir,
-        "--no-cache-dir",
-        "--platform", "manylinux2014_aarch64",
-        "--implementation", "cp",
-        "--python-version", "3.12",
-        "--only-binary=:all:",
-        // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
-        "--ignore-requires-python",
-        ...extra,
-        ...(options.noDeps ? [] : [pipSpec()]),
-        ...(options.requirements ?? []),
-    ], { stdio: "inherit" });
+    const requirements = firstPipRequirements(options);
+    if (requirements.length > 0) {
+        execFileSync(python, [
+            "-m", "pip", "install",
+            "--target", outputDir,
+            "--no-cache-dir",
+            "--platform", "manylinux2014_aarch64",
+            "--implementation", "cp",
+            "--python-version", "3.12",
+            "--only-binary=:all:",
+            // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
+            "--ignore-requires-python",
+            ...extra,
+            ...requirements,
+        ], { stdio: "inherit" });
+    }
     if (options.noDeps) {
         execFileSync(python, [
             "-m", "pip", "install",

package/amplify/functions/shared/python-bundle.ts

@@ -102,27 +102,34 @@ function pipSpec(): string {
   return (process.env.PAPYRUS_PIP_SPEC ?? "").trim() || `papyrus-newsroom==${toPep440(papyrusVersion())}`;
 }
 
+/** What the first pip install gets: `papyrus-newsroom` with its dependencies, plus the function's own requirements. Empty means skip it. */
+export function firstPipRequirements(options: Pick<PythonBundleOptions, "noDeps" | "requirements">): string[] {
+  return [...(options.noDeps ? [] : [pipSpec()]), ...(options.requirements ?? [])];
+}
+
 function bundleFromPip(outputDir: string, options: PythonBundleOptions): void {
   const extra = (process.env.PAPYRUS_PIP_EXTRA_ARGS ?? "").trim().split(/\s+/).filter(Boolean);
   const python = (process.env.PAPYRUS_PIP_PYTHON ?? "python3").trim();
-  execFileSync(
-    python,
-    [
-      "-m", "pip", "install",
-      "--target", outputDir,
-      "--no-cache-dir",
-      "--platform", "manylinux2014_aarch64",
-      "--implementation", "cp",
-      "--python-version", "3.12",
-      "--only-binary=:all:",
-      // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
-      "--ignore-requires-python",
-      ...extra,
-      ...(options.noDeps ? [] : [pipSpec()]),
-      ...(options.requirements ?? []),
-    ],
-    { stdio: "inherit" },
-  );
+  const requirements = firstPipRequirements(options);
+  if (requirements.length > 0) {
+    execFileSync(
+      python,
+      [
+        "-m", "pip", "install",
+        "--target", outputDir,
+        "--no-cache-dir",
+        "--platform", "manylinux2014_aarch64",
+        "--implementation", "cp",
+        "--python-version", "3.12",
+        "--only-binary=:all:",
+        // Older pip (e.g. a Python 3.9 build image) checks Requires-Python against the host interpreter, not --python-version.
+        "--ignore-requires-python",
+        ...extra,
+        ...requirements,
+      ],
+      { stdio: "inherit" },
+    );
+  }
   if (options.noDeps) {
     execFileSync(
       python,

package/amplify/publication/redirect-and-index.js

@@ -12,6 +12,9 @@ async function lookUpRedirectTarget(uri) {
 }
 
 function rewriteToIndexDocument(uri) {
+  if (uri === "/404") {
+    return "/404.html";
+  }
   if (uri.endsWith("/")) {
     return uri + "index.html";
   }
@@ -22,6 +25,72 @@ function rewriteToIndexDocument(uri) {
   return uri;
 }
 
+// Pattern redirects: data from the site's projection.json, spliced between the markers at deploy
+// time by redirect-rules.ts. Each rule is {p: regex, t: target with $1..$9, s: status, x: excluded paths}.
+const patternRules = /*PAPYRUS_PATTERN_RULES*/[]/*END_PAPYRUS_PATTERN_RULES*/;
+
+function lookUpPatternRedirect(uri) {
+  for (let index = 0; index < patternRules.length; index += 1) {
+    const rule = patternRules[index];
+    if (rule.x.indexOf(uri) !== -1) {
+      continue;
+    }
+    const match = new RegExp(rule.p).exec(uri);
+    if (match !== null) {
+      return {
+        status: rule.s,
+        target: rule.t.replace(/\$([0-9])/g, function (whole, group) {
+          return match[Number(group)] || "";
+        }),
+      };
+    }
+  }
+  return null;
+}
+
+// Content negotiation for agents: when the site publishes Markdown twins (standard front end, agents.markdown), a request
+// whose Accept header prefers text/markdown over text/html is rewritten to the .md object before the cache lookup. The
+// flag is spliced in by redirect-rules.ts at deploy time.
+const negotiateMarkdown = /*PAPYRUS_NEGOTIATE_MARKDOWN*/false/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/;
+
+function qualityOf(accept, mediaType) {
+  let quality = 0;
+  const parts = accept.toLowerCase().split(",");
+  for (let index = 0; index < parts.length; index += 1) {
+    const fields = parts[index].split(";");
+    if (fields[0].trim() !== mediaType) {
+      continue;
+    }
+    quality = 1;
+    for (let field = 1; field < fields.length; field += 1) {
+      const pair = fields[field].trim();
+      if (pair.indexOf("q=") === 0) {
+        quality = Number(pair.substring(2));
+        if (isNaN(quality)) {
+          quality = 0;
+        }
+      }
+    }
+  }
+  return quality;
+}
+
+function prefersMarkdown(request) {
+  const header = request.headers && request.headers.accept;
+  if (!header || !header.value) {
+    return false;
+  }
+  const markdown = qualityOf(header.value, "text/markdown");
+  return markdown > 0 && markdown > qualityOf(header.value, "text/html");
+}
+
+function markdownTwin(uri) {
+  if (uri === "/404.html" || uri.length < 6 || uri.substring(uri.length - 5) !== ".html") {
+    return null;
+  }
+  return uri.substring(0, uri.length - 5) + ".md";
+}
+
 async function handler(event) {
   const request = event.request;
   const redirectTarget = await lookUpRedirectTarget(request.uri);
@@ -32,6 +101,20 @@ async function handler(event) {
       headers: { location: { value: redirectTarget } },
     };
   }
+  const patternRedirect = lookUpPatternRedirect(request.uri);
+  if (patternRedirect !== null) {
+    return {
+      statusCode: patternRedirect.status,
+      statusDescription: "Moved",
+      headers: { location: { value: patternRedirect.target } },
+    };
+  }
   request.uri = rewriteToIndexDocument(request.uri);
+  if (negotiateMarkdown && prefersMarkdown(request)) {
+    const twin = markdownTwin(request.uri);
+    if (twin !== null) {
+      request.uri = twin;
+    }
+  }
   return request;
 }

package/amplify/publication/redirect-rules.js

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+/** Mirrors DIRECTORY_HTML_PATTERN and DIRECTORY_SLASH_PATTERN in standard/config.py. */
+const DIRECTORY_HTML_PATTERN = "^/(?!(?:.*/)?index\\.html$)(.+)\\.html$";
+const DIRECTORY_SLASH_PATTERN = "^/((?:[^/]+/)*[^/.]+)$";
+const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
+const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
+/**
+ * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
+ * `urls.style: "directory"`, `/x.html` to `/x/`. Mirrors `StandardSettings.edge_rules` in Python.
+ */
+export function edgeRulesFromSettings(settings) {
+    const rules = (settings.redirects?.patterns ?? []).map((rule) => ({
+        p: rule.pattern,
+        t: rule.to,
+        s: rule.status ?? 301,
+        x: rule.except ?? [],
+    }));
+    if (settings.urls?.style === "directory") {
+        // /x.html to /x/ (a directory index file such as /x/index.html is served as it is), then /x to /x/.
+        rules.push({ p: DIRECTORY_HTML_PATTERN, t: "/$1/", s: 301, x: ["/404.html"] });
+        rules.push({ p: DIRECTORY_SLASH_PATTERN, t: "/$1/", s: 301, x: ["/404"] });
+    }
+    return rules;
+}
+/** A standard-front-end site publishes Markdown twins unless it turns `agents.markdown` off. */
+export function negotiatesMarkdown(settings) {
+    return settings.site !== undefined && settings.agents?.markdown !== false;
+}
+export function readEdgeConfig(staticDir, baseDirectory = process.cwd()) {
+    if (staticDir === undefined)
+        return { rules: [], negotiateMarkdown: false };
+    const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
+    if (!existsSync(settingsPath))
+        return { rules: [], negotiateMarkdown: false };
+    const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+    return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings) };
+}
+export function readEdgeRules(staticDir, baseDirectory = process.cwd()) {
+    return readEdgeConfig(staticDir, baseDirectory).rules;
+}
+const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+/** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
+export function compileRedirectFunctionSource(source, rules, options = {}) {
+    const start = source.indexOf(START_MARKER);
+    const end = source.indexOf(END_MARKER);
+    if (start === -1 || end === -1 || end < start) {
+        throw new Error("redirect function source has no pattern-rule markers");
+    }
+    let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
+    if (options.negotiateMarkdown === true) {
+        const from = compiled.indexOf(NEGOTIATE_START);
+        const to = compiled.indexOf(NEGOTIATE_END);
+        if (from === -1 || to === -1 || to < from) {
+            throw new Error("redirect function source has no markdown negotiation markers");
+        }
+        compiled = compiled.slice(0, from + NEGOTIATE_START.length) + "true" + compiled.slice(to);
+    }
+    return compiled;
+}

package/amplify/publication/redirect-rules.ts

@@ -0,0 +1,79 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+/** One pattern redirect as the edge function reads it: regex, target with $1..$9, status, excluded paths. */
+export type EdgeRedirectRule = { p: string; t: string; s: number; x: string[] };
+
+/** Mirrors DIRECTORY_HTML_PATTERN and DIRECTORY_SLASH_PATTERN in standard/config.py. */
+const DIRECTORY_HTML_PATTERN = "^/(?!(?:.*/)?index\\.html$)(.+)\\.html$";
+const DIRECTORY_SLASH_PATTERN = "^/((?:[^/]+/)*[^/.]+)$";
+
+const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
+const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
+
+type ProjectionRedirects = { patterns?: { pattern: string; to: string; status?: number; except?: string[] }[] };
+type ProjectionSettings = { site?: unknown; urls?: { style?: string }; redirects?: ProjectionRedirects; agents?: { markdown?: boolean } };
+
+/**
+ * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
+ * `urls.style: "directory"`, `/x.html` to `/x/`. Mirrors `StandardSettings.edge_rules` in Python.
+ */
+export function edgeRulesFromSettings(settings: ProjectionSettings): EdgeRedirectRule[] {
+  const rules = (settings.redirects?.patterns ?? []).map((rule) => ({
+    p: rule.pattern,
+    t: rule.to,
+    s: rule.status ?? 301,
+    x: rule.except ?? [],
+  }));
+  if (settings.urls?.style === "directory") {
+    // /x.html to /x/ (a directory index file such as /x/index.html is served as it is), then /x to /x/.
+    rules.push({ p: DIRECTORY_HTML_PATTERN, t: "/$1/", s: 301, x: ["/404.html"] });
+    rules.push({ p: DIRECTORY_SLASH_PATTERN, t: "/$1/", s: 301, x: ["/404"] });
+  }
+  return rules;
+}
+
+/** A standard-front-end site publishes Markdown twins unless it turns `agents.markdown` off. */
+export function negotiatesMarkdown(settings: ProjectionSettings): boolean {
+  return settings.site !== undefined && settings.agents?.markdown !== false;
+}
+
+export type EdgeConfig = { rules: EdgeRedirectRule[]; negotiateMarkdown: boolean };
+
+export function readEdgeConfig(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeConfig {
+  if (staticDir === undefined) return { rules: [], negotiateMarkdown: false };
+  const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
+  if (!existsSync(settingsPath)) return { rules: [], negotiateMarkdown: false };
+  const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as ProjectionSettings;
+  return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings) };
+}
+
+export function readEdgeRules(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeRedirectRule[] {
+  return readEdgeConfig(staticDir, baseDirectory).rules;
+}
+
+const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+
+/** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
+export function compileRedirectFunctionSource(
+  source: string,
+  rules: EdgeRedirectRule[],
+  options: { negotiateMarkdown?: boolean } = {},
+): string {
+  const start = source.indexOf(START_MARKER);
+  const end = source.indexOf(END_MARKER);
+  if (start === -1 || end === -1 || end < start) {
+    throw new Error("redirect function source has no pattern-rule markers");
+  }
+  let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
+  if (options.negotiateMarkdown === true) {
+    const from = compiled.indexOf(NEGOTIATE_START);
+    const to = compiled.indexOf(NEGOTIATE_END);
+    if (from === -1 || to === -1 || to < from) {
+      throw new Error("redirect function source has no markdown negotiation markers");
+    }
+    compiled = compiled.slice(0, from + NEGOTIATE_START.length) + "true" + compiled.slice(to);
+  }
+  return compiled;
+}

package/amplify/publication/s3-projection.js

@@ -7,11 +7,13 @@ import { SqsDestination } from "aws-cdk-lib/aws-lambda-destinations";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig } from "../site-backend-config.js";
 import { addRenditionsFunction } from "./renditions-function.js";
 import { RENDITIONS_FUNCTION_NAME_ENV } from "./renditions-settings.js";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules.js";
 import { addInvalidationPathAlarm } from "./invalidation-alarm.js";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
 const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
@@ -70,7 +72,9 @@ export function addS3ProjectionPublication(scope, props, media) {
     const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
     const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
         runtime: cloudfront.FunctionRuntime.JS_2_0,
-        code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeConfig(props.staticDir).rules, {
+            negotiateMarkdown: readEdgeConfig(props.staticDir).negotiateMarkdown,
+        })),
         keyValueStore,
     });
     const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/publication/s3-projection.ts

@@ -10,11 +10,13 @@ import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import type { Construct } from "constructs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
 import { addRenditionsFunction, type RenditionsFunction } from "./renditions-function";
 import { RENDITIONS_FUNCTION_NAME_ENV, type RenditionsPlan } from "./renditions-settings";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules";
 import { addInvalidationPathAlarm } from "./invalidation-alarm";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
 
@@ -112,7 +114,11 @@ export function addS3ProjectionPublication(
   const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
   const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
     runtime: cloudfront.FunctionRuntime.JS_2_0,
-    code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+    code: cloudfront.FunctionCode.fromInline(
+      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeConfig(props.staticDir).rules, {
+        negotiateMarkdown: readEdgeConfig(props.staticDir).negotiateMarkdown,
+      }),
+    ),
     keyValueStore,
   });
   const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/site-backend-config.ts

@@ -145,6 +145,13 @@ export type PapyrusSiteBackendConfig = {
    * DependsOn ordering; no resource changes. Default 12; 0 turns it off.
    */
   resolverWaveSize?: number;
+  /**
+   * Optional model groups to leave out of the data API (see `OPTIONAL_MODEL_GROUPS`; today `editions`).
+   * CloudFormation allows 2,500 resources per stack operation, nested stacks included, and a fresh create of the full
+   * model set exceeds it. Deploy a new site once with a group excluded, then remove the exclusion and deploy again:
+   * the second deploy is an ordinary update that adds the models.
+   */
+  excludeModelGroups?: string[];
   /** Static reader app (Markus-static sites) that a publish rebuilds through IAM `amplify:StartJob`. */
   reader?: { amplifyAppId: string; branchName?: string };
   /** Lets the newsroom start the `staging` branch build of this CMS app. */
@@ -178,6 +185,16 @@ export type PapyrusSiteBackendConfig = {
    * Unset: no plugin, and the synthesized backend is exactly what it was before plugins existed.
    */
   plugins?: PluginRequest[];
+  /**
+   * The public form receiving endpoint every site gets (docs/public-forms.md). It accepts posts only from the site's
+   * own public hosts (distribution aliases, reader domain, revalidate URL, sign-in redirect URLs) plus these.
+   */
+  publicForms?: {
+    /** Extra https origins (or http://localhost) allowed to post, for example `https://www.example.org`. */
+    allowedOrigins?: string[];
+    /** Extra honeypot field names besides `website`. */
+    honeypotFields?: string[];
+  };
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend.js

@@ -20,9 +20,14 @@ import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
+import { editorialChecks } from "./functions/editorial-checks/resource.js";
+import { monitoringView } from "./functions/monitoring-view/resource.js";
+import { wireMonitoringView } from "./functions/monitoring-view/wire.js";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
+import { scopeAssignmentDataAccess } from "./functions/assignment-action/data-access.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
 import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource.js";
@@ -30,6 +35,9 @@ import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
 import { newsroomSummary } from "./functions/newsroom-summary/resource.js";
+import { derivePublicFormOrigins } from "./functions/public-forms/origins.js";
+import { publicForms } from "./functions/public-forms/resource.js";
+import { wirePublicForms } from "./functions/public-forms/wire.js";
 import { procedureAction } from "./functions/procedure-action/resource.js";
 import { readerSettings } from "./functions/reader-settings/resource.js";
 import { emailSubmissionProcessor } from "./functions/email-submission-processor/resource.js";
@@ -88,12 +96,15 @@ export function defineSiteBackend(papyrusSite) {
         auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
-        data: defineSiteData(pluginDefinitions),
+        editorialChecks,
+        data: defineSiteData(pluginDefinitions, site.excludeModelGroups ?? []),
         knowledgeQuery,
         manageUserRole,
+        monitoringView,
         modelAttachmentUpload,
         newsroomSummary,
         procedureAction,
+        publicForms,
         readerSettings,
         emailSubmissionProcessor,
         sesInboundReceive,
@@ -304,10 +315,19 @@ export function defineSiteBackend(papyrusSite) {
     }
     grantCorporaRead(backend.knowledgeQuery.resources.lambda);
     grantNewsroomReadWrite(backend.assignmentAction.resources.lambda);
+    scopeAssignmentDataAccess(backend.assignmentAction.resources.lambda, backend.data.resources.graphqlApi.arn);
     grantNewsroomReadWrite(backend.categoryAction.resources.lambda);
     grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda);
     const contentActionsLambda = backend.contentActions.resources.lambda;
     grantNewsroomReadWriteDelete(contentActionsLambda);
+    if ((activeBrand?.corpusKey ?? "").trim() !== "") {
+        // A deploy creates the publication's canonical corpus from the brand when the backend has none.
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_CORPUS_KEY", (activeBrand?.corpusKey ?? "").trim());
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_NAME", (activeBrand?.publicationName ?? activeBrand?.corpusKey ?? "").trim());
+    }
+    // AppSync validates the token; pending intake additionally binds its actor
+    // and publication to this deployment's pool and existing API endpoint.
+    contentActionsLambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
     contentActionsLambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     contentActionsLambda.addToRolePolicy(new PolicyStatement({
         actions: ["appsync:GraphQL"],
@@ -548,8 +568,21 @@ export function defineSiteBackend(papyrusSite) {
                 : []),
         ],
     }));
+    const publicFormsEndpoint = wirePublicForms(backend, {
+        allowedOrigins: derivePublicFormOrigins({
+            explicit: site.publicForms?.allowedOrigins,
+            hosts: [activeBrand?.readerDeployment?.domain, ...(publication?.distribution?.aliases ?? [])],
+            urls: [site.revalidateBaseUrl, ...siteAuthRedirectUrls(authConfig)],
+        }),
+        honeypotFields: site.publicForms?.honeypotFields,
+    });
     backend.addOutput({
         custom: {
+            publicForms: { endpoint: publicFormsEndpoint },
+            // Lets the operator CLI re-project on publish without PAPYRUS_PUBLICATION_KIND / PAPYRUS_CONTENT_ACTIONS_FUNCTION (PPY-0c0b75).
+            publication: s3ProjectionPublication !== undefined
+                ? { kind: "s3-projection", contentActionsFunction: contentActionsLambda.functionName }
+                : null,
             prospectusSignIn: prospectusGoogleOnlyClient
                 ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
                 : null,
@@ -584,6 +617,8 @@ export function defineSiteBackend(papyrusSite) {
                 : null,
         },
     });
+    wireEditorialChecks(backend);
+    wireMonitoringView(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }