@anthusai/papyrus 2.0.0-next.4 → 2.0.0-next.41

package/amplify/plugins/reader-steering/papyrus.plugin.js

@@ -0,0 +1,103 @@
+import { ArnPrincipal, Effect, PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Duration, Stack } from "aws-cdk-lib";
+import { Rule, RuleTargetInput, Schedule } from "aws-cdk-lib/aws-events";
+import { LambdaFunction as LambdaFunctionTarget } from "aws-cdk-lib/aws-events-targets";
+import { resolveReaderSteeringConfig } from "./config.js";
+import { readerActions } from "./function/resource.js";
+import { readerSteeringSchemaDefinitions } from "./schema.js";
+export { resolveReaderSteeringConfig };
+export const READER_STEERING_OUTPUT_KEY = "readerSteering";
+export const SNAPSHOT_SCHEDULE_PREFIX = "papyrus-reader-snapshot-";
+export const READER_SNAPSHOT_TASK = { projectionTask: { task: "reader-snapshot" } };
+export const readerSteeringManifest = {
+    name: "reader-steering",
+    contract: 1,
+    models: ["ReaderProfile", "ReaderHandle", "ReaderVote"],
+    mutations: [],
+    guest: { mutations: [] },
+    newsroomPanels: [],
+    staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],
+};
+/** What the reader-actions function reads from `PAPYRUS_READER_SETTINGS`. */
+export function readerActionsSettings(config, allowInterimSubjects) {
+    return {
+        dimensions: config.dimensions,
+        limits: config.limits,
+        reservedHandles: config.reservedHandles,
+        allowInterimSubjects,
+        snapshotDebounceSeconds: 60,
+    };
+}
+/** What the `reader-snapshot` projection task reads from `PAPYRUS_READER_SNAPSHOT_SETTINGS`. */
+export function readerSnapshotSettings(config) {
+    return {
+        dimensions: config.dimensions,
+        karma: config.karma,
+        ranking: config.ranking,
+        hypeMinimum: config.snapshot.hypeMinimum,
+        ...(config.hypeGap ? { hypeGap: config.hypeGap } : {}),
+        retirementPoll: config.retirementPoll,
+    };
+}
+export function interimSubjectsAllowedAtSynth(environment = process.env) {
+    return ["development", "test"].includes((environment.SITE_ENV ?? "").trim()) && environment.NODE_ENV !== "production";
+}
+export const readerSteeringPlugin = {
+    manifest: readerSteeringManifest,
+    resolveConfig: resolveReaderSteeringConfig,
+    functions: () => ({ readerActions }),
+    schemaDefinitions: readerSteeringSchemaDefinitions,
+    publicSettings: (config) => ({ contract: readerSteeringManifest.contract, dimensions: config.dimensions }),
+    wire(backend, config, context) {
+        const lambda = backend.readerActions.resources.lambda;
+        const tables = backend.data.resources.tables;
+        const contentActions = context.contentActionsLambda;
+        for (const [variable, model] of [
+            ["PAPYRUS_READER_PROFILE_TABLE", "ReaderProfile"],
+            ["PAPYRUS_READER_HANDLE_TABLE", "ReaderHandle"],
+            ["PAPYRUS_READER_VOTE_TABLE", "ReaderVote"],
+        ]) {
+            tables[model].grantReadWriteData(lambda);
+            lambda.addEnvironment(variable, tables[model].tableName);
+            contentActions.addEnvironment(variable, tables[model].tableName);
+        }
+        tables.PublishedItem.grantReadData(lambda);
+        lambda.addEnvironment("PAPYRUS_READER_PUBLISHED_ITEM_TABLE", tables.PublishedItem.tableName);
+        tables.ReaderVote.grantReadData(contentActions);
+        tables.ReaderProfile.grantReadWriteData(contentActions);
+        lambda.addEnvironment("PAPYRUS_READER_SETTINGS", JSON.stringify(readerActionsSettings(config, interimSubjectsAllowedAtSynth())));
+        if (config.reservedConcurrency !== undefined) {
+            lambda.node.defaultChild.addPropertyOverride("ReservedConcurrentExecutions", config.reservedConcurrency);
+        }
+        // Trailing-edge debounce: the first write in a window creates a one-off EventBridge Scheduler schedule at the end of
+        // the window (docs/reader-steering.md). The schedule invokes content-actions as this role; reader-actions may create
+        // schedules named for this feature, and pass exactly this role.
+        const schedulerRole = new Role(Stack.of(lambda), "ReaderSnapshotSchedulerRole", {
+            assumedBy: new ServicePrincipal("scheduler.amazonaws.com"),
+            description: "Lets one-off schedules created by reader-actions invoke the reader-snapshot run.",
+        });
+        contentActions.grantInvoke(schedulerRole);
+        const stack = Stack.of(lambda); // the role lives with the function, so the stacks keep their existing one-way dependency
+        lambda.addToRolePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: ["scheduler:CreateSchedule"],
+            resources: [`arn:${stack.partition}:scheduler:${stack.region}:${stack.account}:schedule/default/${SNAPSHOT_SCHEDULE_PREFIX}*`],
+        }));
+        lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["iam:PassRole"], resources: [schedulerRole.roleArn] }));
+        lambda.addEnvironment("PAPYRUS_READER_SNAPSHOT_FUNCTION_ARN", contentActions.functionArn);
+        lambda.addEnvironment("PAPYRUS_READER_SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
+        contentActions.addEnvironment("PAPYRUS_READER_SNAPSHOT_SETTINGS", JSON.stringify(readerSnapshotSettings(config)));
+        lambda.addPermission("InvokeFromCmsCompute", {
+            principal: new ArnPrincipal(config.computeRoleArn),
+            action: "lambda:InvokeFunction",
+        });
+        if (config.snapshot.schedule) {
+            new Rule(context.createStack("reader-steering-schedule"), "ReaderSnapshotSchedule", {
+                description: "Rebuilds the reader snapshot (time decay, Rising) and polls nothing else.",
+                schedule: Schedule.rate(Duration.hours(config.snapshot.intervalHours)),
+                targets: [new LambdaFunctionTarget(contentActions, { event: RuleTargetInput.fromObject(READER_SNAPSHOT_TASK), retryAttempts: 0 })],
+            });
+        }
+        backend.addOutput({ custom: { [READER_STEERING_OUTPUT_KEY]: { actionsFunction: lambda.functionName } } });
+    },
+};

package/amplify/plugins/reader-steering/papyrus.plugin.ts

@@ -0,0 +1,122 @@
+import { ArnPrincipal, Effect, PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Duration, Stack } from "aws-cdk-lib";
+import type { ITable } from "aws-cdk-lib/aws-dynamodb";
+import { Rule, RuleTargetInput, Schedule } from "aws-cdk-lib/aws-events";
+import { LambdaFunction as LambdaFunctionTarget } from "aws-cdk-lib/aws-events-targets";
+import { CfnFunction, type Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+import type { PapyrusPlugin, PluginManifest, PluginWiringContext } from "../types";
+import { resolveReaderSteeringConfig, type ReaderSteeringConfig } from "./config";
+import { readerActions } from "./function/resource";
+import { readerSteeringSchemaDefinitions } from "./schema";
+
+export { resolveReaderSteeringConfig };
+export type { ReaderSteeringConfig };
+
+export const READER_STEERING_OUTPUT_KEY = "readerSteering";
+export const SNAPSHOT_SCHEDULE_PREFIX = "papyrus-reader-snapshot-";
+export const READER_SNAPSHOT_TASK = { projectionTask: { task: "reader-snapshot" } };
+
+export const readerSteeringManifest: PluginManifest = {
+  name: "reader-steering",
+  contract: 1,
+  models: ["ReaderProfile", "ReaderHandle", "ReaderVote"],
+  mutations: [],
+  guest: { mutations: [] },
+  newsroomPanels: [],
+  staticAssets: ["_plugins/papyrus-reader@1.js", "_plugins/papyrus-reader@1.css"],
+};
+
+/** What the reader-actions function reads from `PAPYRUS_READER_SETTINGS`. */
+export function readerActionsSettings(config: ReaderSteeringConfig, allowInterimSubjects: boolean) {
+  return {
+    dimensions: config.dimensions,
+    limits: config.limits,
+    reservedHandles: config.reservedHandles,
+    allowInterimSubjects,
+    snapshotDebounceSeconds: 60,
+  };
+}
+
+/** What the `reader-snapshot` projection task reads from `PAPYRUS_READER_SNAPSHOT_SETTINGS`. */
+export function readerSnapshotSettings(config: ReaderSteeringConfig) {
+  return {
+    dimensions: config.dimensions,
+    karma: config.karma,
+    ranking: config.ranking,
+    hypeMinimum: config.snapshot.hypeMinimum,
+    ...(config.hypeGap ? { hypeGap: config.hypeGap } : {}),
+    retirementPoll: config.retirementPoll,
+  };
+}
+
+export function interimSubjectsAllowedAtSynth(environment: Record<string, string | undefined> = process.env): boolean {
+  return ["development", "test"].includes((environment.SITE_ENV ?? "").trim()) && environment.NODE_ENV !== "production";
+}
+
+export const readerSteeringPlugin: PapyrusPlugin<ReaderSteeringConfig, { readerActions: typeof readerActions }> = {
+  manifest: readerSteeringManifest,
+  resolveConfig: resolveReaderSteeringConfig,
+  functions: () => ({ readerActions }),
+  schemaDefinitions: readerSteeringSchemaDefinitions,
+  publicSettings: (config) => ({ contract: readerSteeringManifest.contract, dimensions: config.dimensions }),
+  wire(backend, config, context: PluginWiringContext) {
+    const lambda = backend.readerActions.resources.lambda as LambdaFunction;
+    const tables = backend.data.resources.tables as Record<string, ITable>;
+    const contentActions = context.contentActionsLambda;
+
+    for (const [variable, model] of [
+      ["PAPYRUS_READER_PROFILE_TABLE", "ReaderProfile"],
+      ["PAPYRUS_READER_HANDLE_TABLE", "ReaderHandle"],
+      ["PAPYRUS_READER_VOTE_TABLE", "ReaderVote"],
+    ] as const) {
+      tables[model].grantReadWriteData(lambda);
+      lambda.addEnvironment(variable, tables[model].tableName);
+      contentActions.addEnvironment(variable, tables[model].tableName);
+    }
+    tables.PublishedItem.grantReadData(lambda);
+    lambda.addEnvironment("PAPYRUS_READER_PUBLISHED_ITEM_TABLE", tables.PublishedItem.tableName);
+    tables.ReaderVote.grantReadData(contentActions);
+    tables.ReaderProfile.grantReadWriteData(contentActions);
+
+    lambda.addEnvironment("PAPYRUS_READER_SETTINGS", JSON.stringify(readerActionsSettings(config, interimSubjectsAllowedAtSynth())));
+    if (config.reservedConcurrency !== undefined) {
+      (lambda.node.defaultChild as CfnFunction).addPropertyOverride("ReservedConcurrentExecutions", config.reservedConcurrency);
+    }
+
+    // Trailing-edge debounce: the first write in a window creates a one-off EventBridge Scheduler schedule at the end of
+    // the window (docs/reader-steering.md). The schedule invokes content-actions as this role; reader-actions may create
+    // schedules named for this feature, and pass exactly this role.
+    const schedulerRole = new Role(Stack.of(lambda), "ReaderSnapshotSchedulerRole", {
+      assumedBy: new ServicePrincipal("scheduler.amazonaws.com"),
+      description: "Lets one-off schedules created by reader-actions invoke the reader-snapshot run.",
+    });
+    contentActions.grantInvoke(schedulerRole);
+    const stack = Stack.of(lambda); // the role lives with the function, so the stacks keep their existing one-way dependency
+    lambda.addToRolePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["scheduler:CreateSchedule"],
+        resources: [`arn:${stack.partition}:scheduler:${stack.region}:${stack.account}:schedule/default/${SNAPSHOT_SCHEDULE_PREFIX}*`],
+      }),
+    );
+    lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["iam:PassRole"], resources: [schedulerRole.roleArn] }));
+    lambda.addEnvironment("PAPYRUS_READER_SNAPSHOT_FUNCTION_ARN", contentActions.functionArn);
+    lambda.addEnvironment("PAPYRUS_READER_SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
+    contentActions.addEnvironment("PAPYRUS_READER_SNAPSHOT_SETTINGS", JSON.stringify(readerSnapshotSettings(config)));
+
+    lambda.addPermission("InvokeFromCmsCompute", {
+      principal: new ArnPrincipal(config.computeRoleArn),
+      action: "lambda:InvokeFunction",
+    });
+
+    if (config.snapshot.schedule) {
+      new Rule(context.createStack("reader-steering-schedule"), "ReaderSnapshotSchedule", {
+        description: "Rebuilds the reader snapshot (time decay, Rising) and polls nothing else.",
+        schedule: Schedule.rate(Duration.hours(config.snapshot.intervalHours)),
+        targets: [new LambdaFunctionTarget(contentActions, { event: RuleTargetInput.fromObject(READER_SNAPSHOT_TASK), retryAttempts: 0 })],
+      });
+    }
+
+    backend.addOutput({ custom: { [READER_STEERING_OUTPUT_KEY]: { actionsFunction: lambda.functionName } } });
+  },
+};

package/amplify/plugins/reader-steering/schema.js

@@ -0,0 +1,40 @@
+import { a } from "@aws-amplify/backend";
+/**
+ * Staff and IAM only: no guest, API key or reader rule on any model. The reader-actions function writes the
+ * tables directly with its own role, and editors may list them; admins may delete. `id` is the lookup key:
+ * the siteSubject for a profile, the lowercase handle for a claim and `subjectKey#readerId#dimension` for a vote.
+ */
+const staffOnly = (allow) => [allow.group("editor").to(["read"]), allow.group("admin").to(["read", "delete"])];
+export function readerSteeringSchemaDefinitions() {
+    return {
+        ReaderProfile: a
+            .model({
+            id: a.id().required(),
+            siteSubject: a.string().required(),
+            readerId: a.string().required(),
+            handle: a.string(),
+            state: a.string().required(),
+            karma: a.integer(),
+        })
+            .disableOperations(["subscriptions"])
+            .authorization(staffOnly),
+        ReaderHandle: a
+            .model({
+            id: a.id().required(),
+            readerId: a.string().required(),
+        })
+            .disableOperations(["subscriptions"])
+            .authorization(staffOnly),
+        ReaderVote: a
+            .model({
+            id: a.id().required(),
+            subjectKey: a.string().required(),
+            readerId: a.string().required(),
+            dimension: a.string().required(),
+            value: a.integer().required(),
+            voterRole: a.string().required(),
+        })
+            .disableOperations(["subscriptions"])
+            .authorization(staffOnly),
+    };
+}

package/amplify/plugins/reader-steering/schema.ts

@@ -0,0 +1,42 @@
+import { a } from "@aws-amplify/backend";
+
+/**
+ * Staff and IAM only: no guest, API key or reader rule on any model. The reader-actions function writes the
+ * tables directly with its own role, and editors may list them; admins may delete. `id` is the lookup key:
+ * the siteSubject for a profile, the lowercase handle for a claim and `subjectKey#readerId#dimension` for a vote.
+ */
+const staffOnly = (allow: any) => [allow.group("editor").to(["read"]), allow.group("admin").to(["read", "delete"])];
+
+export function readerSteeringSchemaDefinitions() {
+  return {
+    ReaderProfile: a
+      .model({
+        id: a.id().required(),
+        siteSubject: a.string().required(),
+        readerId: a.string().required(),
+        handle: a.string(),
+        state: a.string().required(),
+        karma: a.integer(),
+      })
+      .disableOperations(["subscriptions"])
+      .authorization(staffOnly),
+    ReaderHandle: a
+      .model({
+        id: a.id().required(),
+        readerId: a.string().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .authorization(staffOnly),
+    ReaderVote: a
+      .model({
+        id: a.id().required(),
+        subjectKey: a.string().required(),
+        readerId: a.string().required(),
+        dimension: a.string().required(),
+        value: a.integer().required(),
+        voterRole: a.string().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .authorization(staffOnly),
+  };
+}

package/amplify/plugins/registry.js

@@ -1,6 +1,8 @@
+import { readerSteeringPlugin } from "./reader-steering/papyrus.plugin.js";
 import { signupPlugin } from "./signup/papyrus.plugin.js";
 /** Plugins are packaged with Papyrus and pinned by its version: there is no registry to fetch from. */
 export const KNOWN_PLUGINS = {
+    "reader-steering": readerSteeringPlugin,
     signup: signupPlugin,
 };
 export function resolvePlugins(requests) {

package/amplify/plugins/registry.ts

@@ -1,8 +1,10 @@
 import type { PapyrusPlugin, PluginRequest } from "./types";
+import { readerSteeringPlugin } from "./reader-steering/papyrus.plugin";
 import { signupPlugin } from "./signup/papyrus.plugin";
 
 /** Plugins are packaged with Papyrus and pinned by its version: there is no registry to fetch from. */
 export const KNOWN_PLUGINS: Record<string, PapyrusPlugin<any, any>> = {
+  "reader-steering": readerSteeringPlugin,
   signup: signupPlugin,
 };
 

package/amplify/plugins/types.ts

@@ -1,3 +1,4 @@
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
 import type { Construct } from "constructs";
 
 /** How a site asks for a plugin in `papyrus.config.ts`: `plugins: ["signup"]` or `plugins: [{ name: "signup", forms: ["news"] }]`. */
@@ -22,6 +23,8 @@ export type PluginWiringContext = {
   createStack: (name: string) => Construct;
   graphqlApiId: string;
   graphqlEndpoint: string;
+  /** The site's `content-actions` function: it runs the projection tasks a plugin may add (for example `reader-snapshot`). */
+  contentActionsLambda: LambdaFunction;
 };
 
 export type PapyrusPlugin<Config, Functions = unknown> = {

package/amplify/plugins/wire.js

@@ -12,6 +12,7 @@ export function wirePlugins(backend, plugins, contentActionsLambda) {
         createStack: (name) => backend.createStack(name),
         graphqlApiId: graphqlApi.apiId,
         graphqlEndpoint: backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
+        contentActionsLambda,
     };
     for (const { plugin, config } of plugins)
         plugin.wire(backend, config, context);

package/amplify/plugins/wire.ts

@@ -15,6 +15,7 @@ export function wirePlugins(backend: any, plugins: ResolvedPlugin[], contentActi
     createStack: (name: string) => backend.createStack(name),
     graphqlApiId: graphqlApi.apiId as string,
     graphqlEndpoint: backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string,
+    contentActionsLambda,
   };
   for (const { plugin, config } of plugins) plugin.wire(backend, config, context);
   contentActionsLambda.addEnvironment(PLUGINS_ENVIRONMENT_VARIABLE, plugins.map(({ plugin }) => plugin.manifest.name).join(","));

package/amplify/publication/redirect-and-index.js

@@ -12,6 +12,9 @@ async function lookUpRedirectTarget(uri) {
 }
 
 function rewriteToIndexDocument(uri) {
+  if (uri === "/404") {
+    return "/404.html";
+  }
   if (uri.endsWith("/")) {
     return uri + "index.html";
   }
@@ -22,6 +25,88 @@ function rewriteToIndexDocument(uri) {
   return uri;
 }
 
+// Pattern redirects: data from the site's projection.json, spliced between the markers at deploy
+// time by redirect-rules.ts. Each rule is {p: regex, t: target with $1..$9, s: status, x: excluded paths}.
+const patternRules = /*PAPYRUS_PATTERN_RULES*/[]/*END_PAPYRUS_PATTERN_RULES*/;
+
+function lookUpPatternRedirect(uri) {
+  for (let index = 0; index < patternRules.length; index += 1) {
+    const rule = patternRules[index];
+    if (rule.x.indexOf(uri) !== -1) {
+      continue;
+    }
+    const match = new RegExp(rule.p).exec(uri);
+    if (match !== null) {
+      return {
+        status: rule.s,
+        target: rule.t.replace(/\$([0-9])/g, function (whole, group) {
+          return match[Number(group)] || "";
+        }),
+      };
+    }
+  }
+  return null;
+}
+
+// Content negotiation for agents: when the site publishes Markdown twins (standard front end, agents.markdown), a request
+// whose Accept header prefers text/markdown over text/html is rewritten to the .md object before the cache lookup. The
+// flag is spliced in by redirect-rules.ts at deploy time.
+const negotiateMarkdown = /*PAPYRUS_NEGOTIATE_MARKDOWN*/false/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/;
+
+function qualityOf(accept, mediaType) {
+  let quality = 0;
+  const parts = accept.toLowerCase().split(",");
+  for (let index = 0; index < parts.length; index += 1) {
+    const fields = parts[index].split(";");
+    if (fields[0].trim() !== mediaType) {
+      continue;
+    }
+    quality = 1;
+    for (let field = 1; field < fields.length; field += 1) {
+      const pair = fields[field].trim();
+      if (pair.indexOf("q=") === 0) {
+        quality = Number(pair.substring(2));
+        if (isNaN(quality)) {
+          quality = 0;
+        }
+      }
+    }
+  }
+  return quality;
+}
+
+function prefersMarkdown(request) {
+  const header = request.headers && request.headers.accept;
+  if (!header || !header.value) {
+    return false;
+  }
+  const markdown = qualityOf(header.value, "text/markdown");
+  return markdown > 0 && markdown > qualityOf(header.value, "text/html");
+}
+
+function markdownTwin(uri) {
+  if (uri === "/404.html" || uri.length < 6 || uri.substring(uri.length - 5) !== ".html") {
+    return null;
+  }
+  return uri.substring(0, uri.length - 5) + ".md";
+}
+
+// Directory-style sites keep a page's twin at /x/index.md, so a bare /x.md is rewritten there. The edge cannot test for
+// existence, hence the rule: a last segment <name>.md with a name other than index. A path prefix (a base path) is just
+// part of <path>. The flag is spliced in by redirect-rules.ts at deploy time from urls.style.
+const directoryTwins = /*PAPYRUS_DIRECTORY_TWINS*/false/*END_PAPYRUS_DIRECTORY_TWINS*/;
+
+function directoryTwin(uri) {
+  if (uri.length < 5 || uri.substring(uri.length - 3) !== ".md") {
+    return null;
+  }
+  const lastSegment = uri.substring(uri.lastIndexOf("/") + 1);
+  if (lastSegment === "index.md" || lastSegment === ".md") {
+    return null;
+  }
+  return uri.substring(0, uri.length - 3) + "/index.md";
+}
+
 async function handler(event) {
   const request = event.request;
   const redirectTarget = await lookUpRedirectTarget(request.uri);
@@ -32,6 +117,26 @@ async function handler(event) {
       headers: { location: { value: redirectTarget } },
     };
   }
+  const patternRedirect = lookUpPatternRedirect(request.uri);
+  if (patternRedirect !== null) {
+    return {
+      statusCode: patternRedirect.status,
+      statusDescription: "Moved",
+      headers: { location: { value: patternRedirect.target } },
+    };
+  }
   request.uri = rewriteToIndexDocument(request.uri);
+  if (directoryTwins) {
+    const bareTwin = directoryTwin(request.uri);
+    if (bareTwin !== null) {
+      request.uri = bareTwin;
+    }
+  }
+  if (negotiateMarkdown && prefersMarkdown(request)) {
+    const twin = markdownTwin(request.uri);
+    if (twin !== null) {
+      request.uri = twin;
+    }
+  }
   return request;
 }

package/amplify/publication/redirect-rules.js

@@ -0,0 +1,73 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+/** Mirrors DIRECTORY_HTML_PATTERN and DIRECTORY_SLASH_PATTERN in standard/config.py. */
+const DIRECTORY_HTML_PATTERN = "^/(?!(?:.*/)?index\\.html$)(.+)\\.html$";
+const DIRECTORY_SLASH_PATTERN = "^/((?:[^/]+/)*[^/.]+)$";
+const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
+const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
+/**
+ * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
+ * `urls.style: "directory"`, `/x.html` to `/x/`. Mirrors `StandardSettings.edge_rules` in Python.
+ */
+export function edgeRulesFromSettings(settings) {
+    const rules = (settings.redirects?.patterns ?? []).map((rule) => ({
+        p: rule.pattern,
+        t: rule.to,
+        s: rule.status ?? 301,
+        x: rule.except ?? [],
+    }));
+    if (settings.urls?.style === "directory") {
+        // /x.html to /x/ (a directory index file such as /x/index.html is served as it is), then /x to /x/.
+        rules.push({ p: DIRECTORY_HTML_PATTERN, t: "/$1/", s: 301, x: ["/404.html"] });
+        rules.push({ p: DIRECTORY_SLASH_PATTERN, t: "/$1/", s: 301, x: ["/404"] });
+    }
+    return rules;
+}
+/** A standard-front-end site publishes Markdown twins unless it turns `agents.markdown` off. */
+export function negotiatesMarkdown(settings) {
+    return settings.site !== undefined && settings.agents?.markdown !== false;
+}
+/** A directory-style site keeps a page's Markdown twin at `/x/index.md`; the edge then serves a bare `/x.md` from there. */
+export function usesDirectoryTwins(settings) {
+    return negotiatesMarkdown(settings) && settings.urls?.style === "directory";
+}
+export function readEdgeConfig(staticDir, baseDirectory = process.cwd()) {
+    if (staticDir === undefined)
+        return { rules: [], negotiateMarkdown: false, directoryTwins: false };
+    const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
+    if (!existsSync(settingsPath))
+        return { rules: [], negotiateMarkdown: false, directoryTwins: false };
+    const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+    return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings), directoryTwins: usesDirectoryTwins(settings) };
+}
+export function readEdgeRules(staticDir, baseDirectory = process.cwd()) {
+    return readEdgeConfig(staticDir, baseDirectory).rules;
+}
+const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const TWINS_START = "/*PAPYRUS_DIRECTORY_TWINS*/";
+const TWINS_END = "/*END_PAPYRUS_DIRECTORY_TWINS*/";
+function spliceFlag(source, start, end, label) {
+    const from = source.indexOf(start);
+    const to = source.indexOf(end);
+    if (from === -1 || to === -1 || to < from) {
+        throw new Error(`redirect function source has no ${label} markers`);
+    }
+    return source.slice(0, from + start.length) + "true" + source.slice(to);
+}
+/** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
+export function compileRedirectFunctionSource(source, rules, options = {}) {
+    const start = source.indexOf(START_MARKER);
+    const end = source.indexOf(END_MARKER);
+    if (start === -1 || end === -1 || end < start) {
+        throw new Error("redirect function source has no pattern-rule markers");
+    }
+    let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
+    if (options.negotiateMarkdown === true) {
+        compiled = spliceFlag(compiled, NEGOTIATE_START, NEGOTIATE_END, "markdown negotiation");
+    }
+    if (options.directoryTwins === true) {
+        compiled = spliceFlag(compiled, TWINS_START, TWINS_END, "directory twin");
+    }
+    return compiled;
+}

package/amplify/publication/redirect-rules.ts

@@ -0,0 +1,93 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+/** One pattern redirect as the edge function reads it: regex, target with $1..$9, status, excluded paths. */
+export type EdgeRedirectRule = { p: string; t: string; s: number; x: string[] };
+
+/** Mirrors DIRECTORY_HTML_PATTERN and DIRECTORY_SLASH_PATTERN in standard/config.py. */
+const DIRECTORY_HTML_PATTERN = "^/(?!(?:.*/)?index\\.html$)(.+)\\.html$";
+const DIRECTORY_SLASH_PATTERN = "^/((?:[^/]+/)*[^/.]+)$";
+
+const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
+const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
+
+type ProjectionRedirects = { patterns?: { pattern: string; to: string; status?: number; except?: string[] }[] };
+type ProjectionSettings = { site?: unknown; urls?: { style?: string }; redirects?: ProjectionRedirects; agents?: { markdown?: boolean } };
+
+/**
+ * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
+ * `urls.style: "directory"`, `/x.html` to `/x/`. Mirrors `StandardSettings.edge_rules` in Python.
+ */
+export function edgeRulesFromSettings(settings: ProjectionSettings): EdgeRedirectRule[] {
+  const rules = (settings.redirects?.patterns ?? []).map((rule) => ({
+    p: rule.pattern,
+    t: rule.to,
+    s: rule.status ?? 301,
+    x: rule.except ?? [],
+  }));
+  if (settings.urls?.style === "directory") {
+    // /x.html to /x/ (a directory index file such as /x/index.html is served as it is), then /x to /x/.
+    rules.push({ p: DIRECTORY_HTML_PATTERN, t: "/$1/", s: 301, x: ["/404.html"] });
+    rules.push({ p: DIRECTORY_SLASH_PATTERN, t: "/$1/", s: 301, x: ["/404"] });
+  }
+  return rules;
+}
+
+/** A standard-front-end site publishes Markdown twins unless it turns `agents.markdown` off. */
+export function negotiatesMarkdown(settings: ProjectionSettings): boolean {
+  return settings.site !== undefined && settings.agents?.markdown !== false;
+}
+
+/** A directory-style site keeps a page's Markdown twin at `/x/index.md`; the edge then serves a bare `/x.md` from there. */
+export function usesDirectoryTwins(settings: ProjectionSettings): boolean {
+  return negotiatesMarkdown(settings) && settings.urls?.style === "directory";
+}
+
+export type EdgeConfig = { rules: EdgeRedirectRule[]; negotiateMarkdown: boolean; directoryTwins: boolean };
+
+export function readEdgeConfig(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeConfig {
+  if (staticDir === undefined) return { rules: [], negotiateMarkdown: false, directoryTwins: false };
+  const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
+  if (!existsSync(settingsPath)) return { rules: [], negotiateMarkdown: false, directoryTwins: false };
+  const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as ProjectionSettings;
+  return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings), directoryTwins: usesDirectoryTwins(settings) };
+}
+
+export function readEdgeRules(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeRedirectRule[] {
+  return readEdgeConfig(staticDir, baseDirectory).rules;
+}
+
+const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const TWINS_START = "/*PAPYRUS_DIRECTORY_TWINS*/";
+const TWINS_END = "/*END_PAPYRUS_DIRECTORY_TWINS*/";
+
+function spliceFlag(source: string, start: string, end: string, label: string): string {
+  const from = source.indexOf(start);
+  const to = source.indexOf(end);
+  if (from === -1 || to === -1 || to < from) {
+    throw new Error(`redirect function source has no ${label} markers`);
+  }
+  return source.slice(0, from + start.length) + "true" + source.slice(to);
+}
+
+/** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
+export function compileRedirectFunctionSource(
+  source: string,
+  rules: EdgeRedirectRule[],
+  options: { negotiateMarkdown?: boolean; directoryTwins?: boolean } = {},
+): string {
+  const start = source.indexOf(START_MARKER);
+  const end = source.indexOf(END_MARKER);
+  if (start === -1 || end === -1 || end < start) {
+    throw new Error("redirect function source has no pattern-rule markers");
+  }
+  let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
+  if (options.negotiateMarkdown === true) {
+    compiled = spliceFlag(compiled, NEGOTIATE_START, NEGOTIATE_END, "markdown negotiation");
+  }
+  if (options.directoryTwins === true) {
+    compiled = spliceFlag(compiled, TWINS_START, TWINS_END, "directory twin");
+  }
+  return compiled;
+}