@anthusai/papyrus 3.3.0 → 5.0.0

package/amplify/data/schema.js

@@ -1,6 +1,7 @@
 import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
+import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
@@ -1993,6 +1994,7 @@ const baseDefinitions = {
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
     ]),
+    ...editorialChecksSchemaDefinitions,
 };
 export const schema = a.schema(baseDefinitions).authorization((allow) => [
     allow.resource(assignmentAction).to(["query", "mutate"]),

package/amplify/data/schema.ts

@@ -1,6 +1,7 @@
 import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
+import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
@@ -2112,6 +2113,7 @@ const baseDefinitions = {
       allow.guest().to(["read"]),
       allow.groups(contentWriteGroups),
     ]),
+  ...editorialChecksSchemaDefinitions,
 };
 
 export const schema = a.schema(baseDefinitions).authorization((allow) => [

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/handler.py

@@ -1,4 +1,4 @@
-"""The editorial-checks plugin's function: routes its GraphQL fields to papyrus_content.editorial_checks."""
+"""The editorial-checks function: routes its GraphQL fields to papyrus_content.editorial_checks."""
 
 from __future__ import annotations
 

package/amplify/functions/editorial-checks/requirements.txt

@@ -0,0 +1 @@
+humanus[jev]>=0.33,<0.34

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/resource.js

@@ -4,12 +4,12 @@ import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../../../functions/shared/python-bundle.js";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
 const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
-/** AppSync gives a resolver 30 seconds; Limatus's classifier deadline (settings, default 20 s) keeps a check inside this. */
+/** AppSync gives a resolver 30 seconds; Humanus's classifier deadline (settings, default 20 s) keeps a check inside this. */
 export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
-/** Limatus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
-export const editorialChecksRequirements = ["limatus[jev]>=0.31,<0.32"];
+/** Humanus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
+export const editorialChecksRequirements = ["humanus[jev]>=0.33,<0.34"];
 function installRequirements(outputDir) {
     execFileSync("python3", [
         "-m", "pip", "install", "-r", path.join(functionDirectory, "requirements.txt"), "-t", outputDir, "--no-cache-dir",
@@ -24,7 +24,7 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
     timeout: Duration.seconds(EDITORIAL_CHECKS_TIMEOUT_SECONDS),
     memorySize: 1024,
     code: pythonLambdaCode({
-        functionDir: "../plugins/editorial-checks/function",
+        functionDir: "editorial-checks",
         modules: ["papyrus_content"],
         requirements: editorialChecksRequirements,
         noDeps: true,
@@ -35,9 +35,9 @@ export const editorialChecks = defineFunction((scope) => new Function(scope, "pa
         [
             "set -euo pipefail",
             "mkdir -p /asset-output/papyrus_content",
-            "cp amplify/plugins/editorial-checks/function/handler.py /asset-output/handler.py",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
             "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
-            "python3 -m pip install -r amplify/plugins/editorial-checks/function/requirements.txt -t /asset-output --no-cache-dir",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
         ].join(" && "),
     ]),
 }), { resourceGroupName: "data" });

package/amplify/{plugins/editorial-checks/function → functions/editorial-checks}/resource.ts

@@ -5,15 +5,15 @@ import type { Construct } from "constructs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../../../functions/shared/python-bundle";
+import { pythonLambdaCode } from "../shared/python-bundle";
 
 const functionDirectory = path.dirname(fileURLToPath(import.meta.url));
 
-/** AppSync gives a resolver 30 seconds; Limatus's classifier deadline (settings, default 20 s) keeps a check inside this. */
+/** AppSync gives a resolver 30 seconds; Humanus's classifier deadline (settings, default 20 s) keeps a check inside this. */
 export const EDITORIAL_CHECKS_TIMEOUT_SECONDS = 28;
 
-/** Limatus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
-export const editorialChecksRequirements = ["limatus[jev]>=0.31,<0.32"];
+/** Humanus with the Jev classifier lane; papyrus_content.editorial_checks does the work. */
+export const editorialChecksRequirements = ["humanus[jev]>=0.33,<0.34"];
 
 function installRequirements(outputDir: string): void {
   execFileSync(
@@ -37,7 +37,7 @@ export const editorialChecks = defineFunction(
       memorySize: 1024,
       code: pythonLambdaCode(
         {
-          functionDir: "../plugins/editorial-checks/function",
+          functionDir: "editorial-checks",
           modules: ["papyrus_content"],
           requirements: editorialChecksRequirements,
           noDeps: true,
@@ -49,9 +49,9 @@ export const editorialChecks = defineFunction(
           [
             "set -euo pipefail",
             "mkdir -p /asset-output/papyrus_content",
-            "cp amplify/plugins/editorial-checks/function/handler.py /asset-output/handler.py",
+            "cp amplify/functions/editorial-checks/handler.py /asset-output/handler.py",
             "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
-            "python3 -m pip install -r amplify/plugins/editorial-checks/function/requirements.txt -t /asset-output --no-cache-dir",
+            "python3 -m pip install -r amplify/functions/editorial-checks/requirements.txt -t /asset-output --no-cache-dir",
           ].join(" && "),
         ],
       ),

package/amplify/functions/editorial-checks/schema.js

@@ -0,0 +1,92 @@
+import { a } from "@aws-amplify/backend";
+import { editorialChecks } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
+ * content against them. Editors read policies and record decisions; admins
+ * manage policies and settings. Only the function (IAM) calls Humanus.
+ */
+export const editorialChecksSchemaDefinitions = {
+    EditorialPolicy: a
+        .model({
+        id: a.id().required(),
+        policyKey: a.string().required(),
+        scope: a.string().required(),
+        version: a.integer().required(),
+        title: a.string().required(),
+        guidance: a.string().required(),
+        severity: a.string().required(),
+        enabled: a.boolean().required(),
+        detectors: a.json().required(),
+        examples: a.json(),
+        rewriteGuidance: a.string(),
+        source: a.string().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialCheckSettings: a
+        .model({
+        id: a.id().required(),
+        settings: a.json().required(),
+    })
+        .disableOperations(["subscriptions"])
+        .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    EditorialFeedback: a
+        .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        findingId: a.string().required(),
+        policyId: a.string().required(),
+        detectorId: a.string().required(),
+        lane: a.string().required(),
+        probability: a.float(),
+        decision: a.string().required(),
+        reason: a.string(),
+        text: a.string(),
+    })
+        .disableOperations(["subscriptions"])
+        .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
+        .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
+    checkEditorial: a
+        .query()
+        .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    suggestEditorialRewrite: a
+        .query()
+        .arguments({
+        body: a.string().required(),
+        format: a.string(),
+        section: a.string(),
+        finding: a.json(),
+        selection: a.json(),
+        note: a.string(),
+    })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(editorialChecks)),
+    draftEditorialQuestions: a
+        .query()
+        .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    tryEditorialPolicy: a
+        .query()
+        .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    importEditorialStarterPack: a
+        .mutation()
+        .arguments({ name: a.string().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+    recalibrateEditorialPolicies: a
+        .mutation()
+        .returns(a.json())
+        .authorization((allow) => [allow.group("admin")])
+        .handler(a.handler.function(editorialChecks)),
+};

package/amplify/{plugins → functions}/editorial-checks/schema.ts

@@ -1,15 +1,14 @@
 import { a } from "@aws-amplify/backend";
-import { editorialChecks } from "./function/resource";
+import { editorialChecks } from "./resource";
 
 const editors = ["editor", "admin"];
 
 /**
- * Policies, settings and editors' decisions live in Papyrus; Limatus checks
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
  * content against them. Editors read policies and record decisions; admins
- * manage policies and settings. Only the function (IAM) calls Limatus.
+ * manage policies and settings. Only the function (IAM) calls Humanus.
  */
-export function editorialChecksSchemaDefinitions() {
-  return {
+export const editorialChecksSchemaDefinitions = {
     EditorialPolicy: a
       .model({
         id: a.id().required(),
@@ -93,4 +92,3 @@ export function editorialChecksSchemaDefinitions() {
       .authorization((allow) => [allow.group("admin")])
       .handler(a.handler.function(editorialChecks)),
   };
-}

package/amplify/functions/editorial-checks/wire.js

@@ -0,0 +1,49 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+    "Query/fields/listKnowledgeCorporaByRoleAndName",
+    "Query/fields/getEditorialContext",
+    "Query/fields/listEditorialPolicies",
+    "Query/fields/getEditorialCheckSettings",
+    "Query/fields/listEditorialFeedbacks",
+    "Mutation/fields/createEditorialPolicy",
+    "Mutation/fields/updateEditorialPolicy",
+];
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region, account, appId) {
+    const arn = (path) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+    return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+        arn(`papyrus/*/${name}`),
+        arn(`shared/papyrus/${name}`),
+        ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+    ]);
+}
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend) {
+    const lambda = backend.editorialChecks.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    for (const name of EDITORIAL_CHECKS_SECRETS)
+        backend.editorialChecks.addEnvironment(name, secret(name));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter", "ssm:GetParameters"],
+        resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }));
+    const apiId = backend.data.resources.graphqlApi.apiId;
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }));
+}

package/amplify/functions/editorial-checks/wire.ts

@@ -0,0 +1,57 @@
+import { secret } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The model operations the function performs with its own role. The two context reads are its least-privilege access to private policy. */
+export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
+  "Query/fields/listKnowledgeCorporaByRoleAndName",
+  "Query/fields/getEditorialContext",
+  "Query/fields/listEditorialPolicies",
+  "Query/fields/getEditorialCheckSettings",
+  "Query/fields/listEditorialFeedbacks",
+  "Mutation/fields/createEditorialPolicy",
+  "Mutation/fields/updateEditorialPolicy",
+];
+
+export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
+
+/**
+ * SSM parameters holding the provider keys. A Python function reads its secret()
+ * values itself (Amplify only resolves them for Node functions), so it needs read
+ * access to the app's branch and shared secret paths, and to the sandbox paths.
+ */
+export function editorialChecksSecretParameters(region: string, account: string, appId: string): string[] {
+  const arn = (path: string) => `arn:aws:ssm:${region}:${account}:parameter/amplify/${path}`;
+  return EDITORIAL_CHECKS_SECRETS.flatMap((name) => [
+    arn(`papyrus/*/${name}`),
+    arn(`shared/papyrus/${name}`),
+    ...(appId ? [arn(`${appId}/*/${name}`), arn(`shared/${appId}/${name}`)] : []),
+  ]);
+}
+
+/**
+ * Environment, secrets and least-privilege IAM for the editorial-checks function. Every site gets
+ * these; whether checks run is a stored setting (EditorialCheckSettings.enabled), not a deploy flag.
+ */
+export function wireEditorialChecks(backend: any): void {
+  const lambda = backend.editorialChecks.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  for (const name of EDITORIAL_CHECKS_SECRETS) backend.editorialChecks.addEnvironment(name, secret(name));
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter", "ssm:GetParameters"],
+      resources: editorialChecksSecretParameters(stack.region, stack.account, (process.env.AWS_APP_ID ?? "").trim()),
+    }),
+  );
+  const apiId = backend.data.resources.graphqlApi.apiId as string;
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: EDITORIAL_CHECKS_FUNCTION_FIELDS.map((field) => `arn:aws:appsync:${stack.region}:${stack.account}:apis/${apiId}/types/${field}`),
+    }),
+  );
+}

package/amplify/plugins/registry.js

@@ -1,8 +1,6 @@
-import { editorialChecksPlugin } from "./editorial-checks/papyrus.plugin.js";
 import { signupPlugin } from "./signup/papyrus.plugin.js";
 /** Plugins are packaged with Papyrus and pinned by its version: there is no registry to fetch from. */
 export const KNOWN_PLUGINS = {
-    "editorial-checks": editorialChecksPlugin,
     signup: signupPlugin,
 };
 export function resolvePlugins(requests) {

package/amplify/plugins/registry.ts

@@ -1,10 +1,8 @@
 import type { PapyrusPlugin, PluginRequest } from "./types";
-import { editorialChecksPlugin } from "./editorial-checks/papyrus.plugin";
 import { signupPlugin } from "./signup/papyrus.plugin";
 
 /** Plugins are packaged with Papyrus and pinned by its version: there is no registry to fetch from. */
 export const KNOWN_PLUGINS: Record<string, PapyrusPlugin<any, any>> = {
-  "editorial-checks": editorialChecksPlugin,
   signup: signupPlugin,
 };
 

package/amplify/publication/redirect-and-index.js

@@ -22,6 +22,29 @@ function rewriteToIndexDocument(uri) {
   return uri;
 }
 
+// Pattern redirects: data from the site's projection.json, spliced between the markers at deploy
+// time by redirect-rules.ts. Each rule is {p: regex, t: target with $1..$9, s: status, x: excluded paths}.
+const patternRules = /*PAPYRUS_PATTERN_RULES*/[]/*END_PAPYRUS_PATTERN_RULES*/;
+
+function lookUpPatternRedirect(uri) {
+  for (let index = 0; index < patternRules.length; index += 1) {
+    const rule = patternRules[index];
+    if (rule.x.indexOf(uri) !== -1) {
+      continue;
+    }
+    const match = new RegExp(rule.p).exec(uri);
+    if (match !== null) {
+      return {
+        status: rule.s,
+        target: rule.t.replace(/\$([0-9])/g, function (whole, group) {
+          return match[Number(group)] || "";
+        }),
+      };
+    }
+  }
+  return null;
+}
+
 async function handler(event) {
   const request = event.request;
   const redirectTarget = await lookUpRedirectTarget(request.uri);
@@ -32,6 +55,14 @@ async function handler(event) {
       headers: { location: { value: redirectTarget } },
     };
   }
+  const patternRedirect = lookUpPatternRedirect(request.uri);
+  if (patternRedirect !== null) {
+    return {
+      statusCode: patternRedirect.status,
+      statusDescription: "Moved",
+      headers: { location: { value: patternRedirect.target } },
+    };
+  }
   request.uri = rewriteToIndexDocument(request.uri);
   return request;
 }

package/amplify/publication/redirect-rules.js

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
+const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
+/**
+ * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
+ * `urls.style: "directory"`, `/x.html` to `/x/`. Mirrors `StandardSettings.edge_rules` in Python.
+ */
+export function edgeRulesFromSettings(settings) {
+    const rules = (settings.redirects?.patterns ?? []).map((rule) => ({
+        p: rule.pattern,
+        t: rule.to,
+        s: rule.status ?? 301,
+        x: rule.except ?? [],
+    }));
+    if (settings.urls?.style === "directory") {
+        rules.push({ p: "^/(.+)\\.html$", t: "/$1/", s: 301, x: ["/404.html"] });
+    }
+    return rules;
+}
+export function readEdgeRules(staticDir, baseDirectory = process.cwd()) {
+    if (staticDir === undefined)
+        return [];
+    const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
+    if (!existsSync(settingsPath))
+        return [];
+    return edgeRulesFromSettings(JSON.parse(readFileSync(settingsPath, "utf8")));
+}
+/** The CloudFront Function source with the site's pattern rules spliced in; the source unchanged when there are none. */
+export function compileRedirectFunctionSource(source, rules) {
+    const start = source.indexOf(START_MARKER);
+    const end = source.indexOf(END_MARKER);
+    if (start === -1 || end === -1 || end < start) {
+        throw new Error("redirect function source has no pattern-rule markers");
+    }
+    if (rules.length === 0)
+        return source;
+    const literal = JSON.stringify(rules);
+    return source.slice(0, start + START_MARKER.length) + literal + source.slice(end);
+}

package/amplify/publication/redirect-rules.ts

@@ -0,0 +1,47 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+/** One pattern redirect as the edge function reads it: regex, target with $1..$9, status, excluded paths. */
+export type EdgeRedirectRule = { p: string; t: string; s: number; x: string[] };
+
+const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
+const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
+
+type ProjectionRedirects = { patterns?: { pattern: string; to: string; status?: number; except?: string[] }[] };
+type ProjectionSettings = { urls?: { style?: string }; redirects?: ProjectionRedirects };
+
+/**
+ * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
+ * `urls.style: "directory"`, `/x.html` to `/x/`. Mirrors `StandardSettings.edge_rules` in Python.
+ */
+export function edgeRulesFromSettings(settings: ProjectionSettings): EdgeRedirectRule[] {
+  const rules = (settings.redirects?.patterns ?? []).map((rule) => ({
+    p: rule.pattern,
+    t: rule.to,
+    s: rule.status ?? 301,
+    x: rule.except ?? [],
+  }));
+  if (settings.urls?.style === "directory") {
+    rules.push({ p: "^/(.+)\\.html$", t: "/$1/", s: 301, x: ["/404.html"] });
+  }
+  return rules;
+}
+
+export function readEdgeRules(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeRedirectRule[] {
+  if (staticDir === undefined) return [];
+  const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
+  if (!existsSync(settingsPath)) return [];
+  return edgeRulesFromSettings(JSON.parse(readFileSync(settingsPath, "utf8")) as ProjectionSettings);
+}
+
+/** The CloudFront Function source with the site's pattern rules spliced in; the source unchanged when there are none. */
+export function compileRedirectFunctionSource(source: string, rules: EdgeRedirectRule[]): string {
+  const start = source.indexOf(START_MARKER);
+  const end = source.indexOf(END_MARKER);
+  if (start === -1 || end === -1 || end < start) {
+    throw new Error("redirect function source has no pattern-rule markers");
+  }
+  if (rules.length === 0) return source;
+  const literal = JSON.stringify(rules);
+  return source.slice(0, start + START_MARKER.length) + literal + source.slice(end);
+}

package/amplify/publication/s3-projection.js

@@ -7,11 +7,13 @@ import { SqsDestination } from "aws-cdk-lib/aws-lambda-destinations";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig } from "../site-backend-config.js";
 import { addRenditionsFunction } from "./renditions-function.js";
 import { RENDITIONS_FUNCTION_NAME_ENV } from "./renditions-settings.js";
+import { compileRedirectFunctionSource, readEdgeRules } from "./redirect-rules.js";
 import { addInvalidationPathAlarm } from "./invalidation-alarm.js";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
 const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
@@ -70,7 +72,7 @@ export function addS3ProjectionPublication(scope, props, media) {
     const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
     const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
         runtime: cloudfront.FunctionRuntime.JS_2_0,
-        code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeRules(props.staticDir))),
         keyValueStore,
     });
     const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/publication/s3-projection.ts

@@ -10,11 +10,13 @@ import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import type { Construct } from "constructs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
 import { addRenditionsFunction, type RenditionsFunction } from "./renditions-function";
 import { RENDITIONS_FUNCTION_NAME_ENV, type RenditionsPlan } from "./renditions-settings";
+import { compileRedirectFunctionSource, readEdgeRules } from "./redirect-rules";
 import { addInvalidationPathAlarm } from "./invalidation-alarm";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
 
@@ -112,7 +114,9 @@ export function addS3ProjectionPublication(
   const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
   const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
     runtime: cloudfront.FunctionRuntime.JS_2_0,
-    code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+    code: cloudfront.FunctionCode.fromInline(
+      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeRules(props.staticDir)),
+    ),
     keyValueStore,
   });
   const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/site-backend.js

@@ -20,6 +20,8 @@ import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
+import { editorialChecks } from "./functions/editorial-checks/resource.js";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
@@ -89,6 +91,7 @@ export function defineSiteBackend(papyrusSite) {
         auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
+        editorialChecks,
         data: defineSiteData(pluginDefinitions),
         knowledgeQuery,
         manageUserRole,
@@ -589,6 +592,7 @@ export function defineSiteBackend(papyrusSite) {
                 : null,
         },
     });
+    wireEditorialChecks(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }

package/amplify/site-backend.ts

@@ -27,6 +27,8 @@ import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
+import { editorialChecks } from "./functions/editorial-checks/resource";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
 import { assignmentAction } from "./functions/assignment-action/resource";
@@ -110,6 +112,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
+    editorialChecks,
     data: defineSiteData(pluginDefinitions),
     knowledgeQuery,
     manageUserRole,
@@ -732,6 +735,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         : null,
     },
   });
+  wireEditorialChecks(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 
   return backend;