@anthusai/papyrus 5.0.0 → 5.2.0

package/amplify/data/resource.js

@@ -607,6 +607,12 @@ const schema = a.schema({
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(a.handler.function(contentActions)),
+    moveStoryStage: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     unpublishItem: a
         .mutation()
         .arguments({ input: a.json().required() })

package/amplify/data/resource.ts

@@ -662,6 +662,13 @@ const schema = a.schema({
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  moveStoryStage: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   unpublishItem: a
     .mutation()
     .arguments({ input: a.json().required() })

package/amplify/data/schema.js

@@ -2,6 +2,7 @@ import { a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
+import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
@@ -515,6 +516,12 @@ const baseDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(contentWriteGroups)])
         .handler(a.handler.function(contentActions)),
+    moveStoryStage: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     unpublishItem: a
         .mutation()
         .arguments({ input: a.json().required() })
@@ -1995,6 +2002,7 @@ const baseDefinitions = {
         allow.groups(contentWriteGroups),
     ]),
     ...editorialChecksSchemaDefinitions,
+    ...monitoringViewSchemaDefinitions,
 };
 export const schema = a.schema(baseDefinitions).authorization((allow) => [
     allow.resource(assignmentAction).to(["query", "mutate"]),

package/amplify/data/schema.ts

@@ -2,6 +2,7 @@ import { type ClientSchema, a } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource";
 import { categoryAction } from "../functions/category-action/resource";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
+import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
@@ -564,6 +565,13 @@ const baseDefinitions = {
     .authorization((allow) => [allow.groups(contentWriteGroups)])
     .handler(a.handler.function(contentActions)),
 
+  moveStoryStage: a
+    .mutation()
+    .arguments({ input: a.json().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(contentWriteGroups)])
+    .handler(a.handler.function(contentActions)),
+
   unpublishItem: a
     .mutation()
     .arguments({ input: a.json().required() })
@@ -2114,6 +2122,7 @@ const baseDefinitions = {
       allow.groups(contentWriteGroups),
     ]),
   ...editorialChecksSchemaDefinitions,
+  ...monitoringViewSchemaDefinitions,
 };
 
 export const schema = a.schema(baseDefinitions).authorization((allow) => [

package/amplify/functions/content-actions/handler.py

@@ -23,6 +23,7 @@ from papyrus_content.rebuild_trigger import (
     trigger_staging_build,
 )
 from papyrus_content.story_reporting import save_story_version
+from papyrus_content.publication import ensure_publication_from_environment
 from papyrus_content.reference_intake import IntakeError, intake_references
 from papyrus_content.publishing import (
     ItemFields,
@@ -151,6 +152,7 @@ def schedule_unpurged_invalidation(keys: list[str]) -> None:
 
 def run_deploy_render_task(client) -> dict:
     """Render every published page after a backend deploy, then report drift (a dry run: nothing is deleted)."""
+    ensure_publication_from_environment(client)
     context = projection_context(client)
     report = deploy_render(context)
     print(drift_metric_line(report))
@@ -284,6 +286,17 @@ def unpublish_item_action(arguments: dict, actor: str) -> dict:
     return response
 
 
+def move_story_stage_action(arguments: dict, actor: str) -> dict:
+    from papyrus_content.story_reporting import move_story_stage
+
+    client, _claims = create_authoring_client()
+    try:
+        result = move_story_stage(client, arguments["lineageId"], arguments["stage"], actor=actor, reason=arguments.get("reason"))
+    except ValueError as error:
+        return {"ok": False, "errors": [{"code": "invalid-stage", "message": str(error), "line": None}]}
+    return {"ok": True, **result}
+
+
 def request_staging_build_action() -> dict:
     cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
     if not cms_app_id:
@@ -312,6 +325,8 @@ def handler(event, context):
             return save_item_draft_action(arguments, actor)
         if field == "publishItem":
             return publish_item_action(arguments, actor)
+        if field == "moveStoryStage":
+            return move_story_stage_action(arguments, actor)
         if field == "unpublishItem":
             return unpublish_item_action(arguments, actor)
         if field == "requestStagingBuild":

package/amplify/functions/monitoring-view/handler.py

@@ -0,0 +1,11 @@
+"""The monitoring-view function: `monitoringOverview` for editors and admins, read-only."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.monitoring_view import handle
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    return handle(event)

package/amplify/functions/monitoring-view/resource.js

@@ -0,0 +1,24 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction((scope) => new Function(scope, "papyrus-monitoring-view", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+    memorySize: 256,
+    code: pythonLambdaCode({ functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/monitoring-view/resource.ts

@@ -0,0 +1,34 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-monitoring-view", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+      memorySize: 256,
+      code: pythonLambdaCode(
+        { functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/monitoring-view/schema.js

@@ -0,0 +1,16 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+    monitoringOverview: a
+        .query()
+        .arguments({ scope: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(monitoringView)),
+};

package/amplify/functions/monitoring-view/schema.ts

@@ -0,0 +1,18 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+  monitoringOverview: a
+    .query()
+    .arguments({ scope: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(a.handler.function(monitoringView)),
+};

package/amplify/functions/monitoring-view/wire.js

@@ -0,0 +1,37 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region, account) {
+    const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+    return [table, `${table}/index/routing`];
+}
+export function monitoringViewParameterArn(region, account) {
+    return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend) {
+    const lambda = backend.monitoringView.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account),
+    }));
+}

package/amplify/functions/monitoring-view/wire.ts

@@ -0,0 +1,47 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region: string, account: string): string[] {
+  const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+  return [table, `${table}/index/routing`];
+}
+
+export function monitoringViewParameterArn(region: string, account: string): string {
+  return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend: any): void {
+  const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account),
+    }),
+  );
+}

package/amplify/publication/redirect-and-index.js

@@ -45,6 +45,49 @@ function lookUpPatternRedirect(uri) {
   return null;
 }
 
+// Content negotiation for agents: when the site publishes Markdown twins (standard front end, agents.markdown), a request
+// whose Accept header prefers text/markdown over text/html is rewritten to the .md object before the cache lookup. The
+// flag is spliced in by redirect-rules.ts at deploy time.
+const negotiateMarkdown = /*PAPYRUS_NEGOTIATE_MARKDOWN*/false/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/;
+
+function qualityOf(accept, mediaType) {
+  let quality = 0;
+  const parts = accept.toLowerCase().split(",");
+  for (let index = 0; index < parts.length; index += 1) {
+    const fields = parts[index].split(";");
+    if (fields[0].trim() !== mediaType) {
+      continue;
+    }
+    quality = 1;
+    for (let field = 1; field < fields.length; field += 1) {
+      const pair = fields[field].trim();
+      if (pair.indexOf("q=") === 0) {
+        quality = Number(pair.substring(2));
+        if (isNaN(quality)) {
+          quality = 0;
+        }
+      }
+    }
+  }
+  return quality;
+}
+
+function prefersMarkdown(request) {
+  const header = request.headers && request.headers.accept;
+  if (!header || !header.value) {
+    return false;
+  }
+  const markdown = qualityOf(header.value, "text/markdown");
+  return markdown > 0 && markdown > qualityOf(header.value, "text/html");
+}
+
+function markdownTwin(uri) {
+  if (uri === "/404.html" || uri.length < 6 || uri.substring(uri.length - 5) !== ".html") {
+    return null;
+  }
+  return uri.substring(0, uri.length - 5) + ".md";
+}
+
 async function handler(event) {
   const request = event.request;
   const redirectTarget = await lookUpRedirectTarget(request.uri);
@@ -64,5 +107,11 @@ async function handler(event) {
     };
   }
   request.uri = rewriteToIndexDocument(request.uri);
+  if (negotiateMarkdown && prefersMarkdown(request)) {
+    const twin = markdownTwin(request.uri);
+    if (twin !== null) {
+      request.uri = twin;
+    }
+  }
   return request;
 }

package/amplify/publication/redirect-rules.js

@@ -18,23 +18,39 @@ export function edgeRulesFromSettings(settings) {
     }
     return rules;
 }
-export function readEdgeRules(staticDir, baseDirectory = process.cwd()) {
+/** A standard-front-end site publishes Markdown twins unless it turns `agents.markdown` off. */
+export function negotiatesMarkdown(settings) {
+    return settings.site !== undefined && settings.agents?.markdown !== false;
+}
+export function readEdgeConfig(staticDir, baseDirectory = process.cwd()) {
     if (staticDir === undefined)
-        return [];
+        return { rules: [], negotiateMarkdown: false };
     const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
     if (!existsSync(settingsPath))
-        return [];
-    return edgeRulesFromSettings(JSON.parse(readFileSync(settingsPath, "utf8")));
+        return { rules: [], negotiateMarkdown: false };
+    const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+    return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings) };
 }
-/** The CloudFront Function source with the site's pattern rules spliced in; the source unchanged when there are none. */
-export function compileRedirectFunctionSource(source, rules) {
+export function readEdgeRules(staticDir, baseDirectory = process.cwd()) {
+    return readEdgeConfig(staticDir, baseDirectory).rules;
+}
+const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+/** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
+export function compileRedirectFunctionSource(source, rules, options = {}) {
     const start = source.indexOf(START_MARKER);
     const end = source.indexOf(END_MARKER);
     if (start === -1 || end === -1 || end < start) {
         throw new Error("redirect function source has no pattern-rule markers");
     }
-    if (rules.length === 0)
-        return source;
-    const literal = JSON.stringify(rules);
-    return source.slice(0, start + START_MARKER.length) + literal + source.slice(end);
+    let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
+    if (options.negotiateMarkdown === true) {
+        const from = compiled.indexOf(NEGOTIATE_START);
+        const to = compiled.indexOf(NEGOTIATE_END);
+        if (from === -1 || to === -1 || to < from) {
+            throw new Error("redirect function source has no markdown negotiation markers");
+        }
+        compiled = compiled.slice(0, from + NEGOTIATE_START.length) + "true" + compiled.slice(to);
+    }
+    return compiled;
 }

package/amplify/publication/redirect-rules.ts

@@ -8,7 +8,7 @@ const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
 const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
 
 type ProjectionRedirects = { patterns?: { pattern: string; to: string; status?: number; except?: string[] }[] };
-type ProjectionSettings = { urls?: { style?: string }; redirects?: ProjectionRedirects };
+type ProjectionSettings = { site?: unknown; urls?: { style?: string }; redirects?: ProjectionRedirects; agents?: { markdown?: boolean } };
 
 /**
  * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
@@ -27,21 +27,47 @@ export function edgeRulesFromSettings(settings: ProjectionSettings): EdgeRedirec
   return rules;
 }
 
-export function readEdgeRules(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeRedirectRule[] {
-  if (staticDir === undefined) return [];
+/** A standard-front-end site publishes Markdown twins unless it turns `agents.markdown` off. */
+export function negotiatesMarkdown(settings: ProjectionSettings): boolean {
+  return settings.site !== undefined && settings.agents?.markdown !== false;
+}
+
+export type EdgeConfig = { rules: EdgeRedirectRule[]; negotiateMarkdown: boolean };
+
+export function readEdgeConfig(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeConfig {
+  if (staticDir === undefined) return { rules: [], negotiateMarkdown: false };
   const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
-  if (!existsSync(settingsPath)) return [];
-  return edgeRulesFromSettings(JSON.parse(readFileSync(settingsPath, "utf8")) as ProjectionSettings);
+  if (!existsSync(settingsPath)) return { rules: [], negotiateMarkdown: false };
+  const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as ProjectionSettings;
+  return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings) };
 }
 
-/** The CloudFront Function source with the site's pattern rules spliced in; the source unchanged when there are none. */
-export function compileRedirectFunctionSource(source: string, rules: EdgeRedirectRule[]): string {
+export function readEdgeRules(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeRedirectRule[] {
+  return readEdgeConfig(staticDir, baseDirectory).rules;
+}
+
+const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+
+/** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
+export function compileRedirectFunctionSource(
+  source: string,
+  rules: EdgeRedirectRule[],
+  options: { negotiateMarkdown?: boolean } = {},
+): string {
   const start = source.indexOf(START_MARKER);
   const end = source.indexOf(END_MARKER);
   if (start === -1 || end === -1 || end < start) {
     throw new Error("redirect function source has no pattern-rule markers");
   }
-  if (rules.length === 0) return source;
-  const literal = JSON.stringify(rules);
-  return source.slice(0, start + START_MARKER.length) + literal + source.slice(end);
+  let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
+  if (options.negotiateMarkdown === true) {
+    const from = compiled.indexOf(NEGOTIATE_START);
+    const to = compiled.indexOf(NEGOTIATE_END);
+    if (from === -1 || to === -1 || to < from) {
+      throw new Error("redirect function source has no markdown negotiation markers");
+    }
+    compiled = compiled.slice(0, from + NEGOTIATE_START.length) + "true" + compiled.slice(to);
+  }
+  return compiled;
 }

package/amplify/publication/s3-projection.js

@@ -13,7 +13,7 @@ import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig } from "../site-backend-config.js";
 import { addRenditionsFunction } from "./renditions-function.js";
 import { RENDITIONS_FUNCTION_NAME_ENV } from "./renditions-settings.js";
-import { compileRedirectFunctionSource, readEdgeRules } from "./redirect-rules.js";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules.js";
 import { addInvalidationPathAlarm } from "./invalidation-alarm.js";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
 const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
@@ -72,7 +72,9 @@ export function addS3ProjectionPublication(scope, props, media) {
     const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
     const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
         runtime: cloudfront.FunctionRuntime.JS_2_0,
-        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeRules(props.staticDir))),
+        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeConfig(props.staticDir).rules, {
+            negotiateMarkdown: readEdgeConfig(props.staticDir).negotiateMarkdown,
+        })),
         keyValueStore,
     });
     const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/publication/s3-projection.ts

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
 import { addRenditionsFunction, type RenditionsFunction } from "./renditions-function";
 import { RENDITIONS_FUNCTION_NAME_ENV, type RenditionsPlan } from "./renditions-settings";
-import { compileRedirectFunctionSource, readEdgeRules } from "./redirect-rules";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules";
 import { addInvalidationPathAlarm } from "./invalidation-alarm";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
 
@@ -115,7 +115,9 @@ export function addS3ProjectionPublication(
   const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
     runtime: cloudfront.FunctionRuntime.JS_2_0,
     code: cloudfront.FunctionCode.fromInline(
-      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeRules(props.staticDir)),
+      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeConfig(props.staticDir).rules, {
+        negotiateMarkdown: readEdgeConfig(props.staticDir).negotiateMarkdown,
+      }),
     ),
     keyValueStore,
   });

package/amplify/site-backend.js

@@ -21,6 +21,8 @@ import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRe
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
 import { editorialChecks } from "./functions/editorial-checks/resource.js";
+import { monitoringView } from "./functions/monitoring-view/resource.js";
+import { wireMonitoringView } from "./functions/monitoring-view/wire.js";
 import { wireEditorialChecks } from "./functions/editorial-checks/wire.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
@@ -95,6 +97,7 @@ export function defineSiteBackend(papyrusSite) {
         data: defineSiteData(pluginDefinitions),
         knowledgeQuery,
         manageUserRole,
+        monitoringView,
         modelAttachmentUpload,
         newsroomSummary,
         procedureAction,
@@ -313,6 +316,11 @@ export function defineSiteBackend(papyrusSite) {
     grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda);
     const contentActionsLambda = backend.contentActions.resources.lambda;
     grantNewsroomReadWriteDelete(contentActionsLambda);
+    if ((activeBrand?.corpusKey ?? "").trim() !== "") {
+        // A deploy creates the publication's canonical corpus from the brand when the backend has none.
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_CORPUS_KEY", (activeBrand?.corpusKey ?? "").trim());
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_NAME", (activeBrand?.publicationName ?? activeBrand?.corpusKey ?? "").trim());
+    }
     // AppSync validates the token; pending intake additionally binds its actor
     // and publication to this deployment's pool and existing API endpoint.
     contentActionsLambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
@@ -593,6 +601,7 @@ export function defineSiteBackend(papyrusSite) {
         },
     });
     wireEditorialChecks(backend);
+    wireMonitoringView(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }

package/amplify/site-backend.ts

@@ -28,6 +28,8 @@ import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRe
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
 import { editorialChecks } from "./functions/editorial-checks/resource";
+import { monitoringView } from "./functions/monitoring-view/resource";
+import { wireMonitoringView } from "./functions/monitoring-view/wire";
 import { wireEditorialChecks } from "./functions/editorial-checks/wire";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
@@ -116,6 +118,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     data: defineSiteData(pluginDefinitions),
     knowledgeQuery,
     manageUserRole,
+    monitoringView,
     modelAttachmentUpload,
     newsroomSummary,
     procedureAction,
@@ -399,6 +402,11 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda as LambdaFunction);
   const contentActionsLambda = backend.contentActions.resources.lambda as LambdaFunction;
   grantNewsroomReadWriteDelete(contentActionsLambda);
+  if ((activeBrand?.corpusKey ?? "").trim() !== "") {
+    // A deploy creates the publication's canonical corpus from the brand when the backend has none.
+    contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_CORPUS_KEY", (activeBrand?.corpusKey ?? "").trim());
+    contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_NAME", (activeBrand?.publicationName ?? activeBrand?.corpusKey ?? "").trim());
+  }
   // AppSync validates the token; pending intake additionally binds its actor
   // and publication to this deployment's pool and existing API endpoint.
   contentActionsLambda.addEnvironment(
@@ -736,6 +744,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     },
   });
   wireEditorialChecks(backend);
+  wireMonitoringView(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 
   return backend;