@anthusai/papyrus 5.20.0 → 5.22.0

package/amplify/plugins/newsletter/schema.ts

@@ -0,0 +1,61 @@
+import { a } from "@aws-amplify/backend";
+import { newsletterOps } from "./ops/resource";
+
+const staff = ["editor", "admin"];
+const admins = ["admin"];
+
+/** The newsroom's newsletter operations, all JSON in and out. The function checks the groups again from the identity claims. */
+export const NEWSLETTER_QUERIES = [
+  "newsletterIssues",
+  "newsletterIssue",
+  "newsletterPreview",
+  "newsletterOverview",
+  "newsletterIssueDeliveries",
+  "newsletterSubscribers",
+  "newsletterExport",
+];
+export const NEWSLETTER_MUTATIONS = [
+  "newsletterApproveIssue",
+  "newsletterCancelIssue",
+  "newsletterStopIssue",
+  "newsletterTestSend",
+  "newsletterCreateDraft",
+  "newsletterErase",
+  "newsletterResume",
+];
+/**
+ * Who AppSync admits to each operation. Approve, cancel, stop, the subscriber list, the export, erasure and resume are admin
+ * only; everything else (counts, issues, preview, test send, new draft, delivery history with masked addresses) is editors and admins.
+ */
+export const NEWSLETTER_OPERATION_GROUPS: Record<string, string[]> = {
+  newsletterIssues: staff,
+  newsletterIssue: staff,
+  newsletterPreview: staff,
+  newsletterTestSend: staff,
+  newsletterCreateDraft: staff,
+  newsletterApproveIssue: admins,
+  newsletterCancelIssue: admins,
+  newsletterStopIssue: admins,
+  newsletterOverview: staff,
+  newsletterIssueDeliveries: staff,
+  newsletterSubscribers: admins,
+  newsletterExport: admins,
+  newsletterErase: admins,
+  newsletterResume: admins,
+};
+
+/**
+ * The newsletter plugin adds no GraphQL model: subscriber records are personal data kept in the plugin's own DynamoDB
+ * table, never readable through the content API. It adds fourteen operations for the newsroom's Newsletter panel.
+ */
+export function newsletterSchemaDefinitions(): Record<string, unknown> {
+  const handler = a.handler.function(newsletterOps);
+  const query = (name: string) =>
+    a.query().arguments({ input: a.json() }).returns(a.json()).authorization((allow) => [allow.groups(NEWSLETTER_OPERATION_GROUPS[name])]).handler(handler);
+  const mutation = (name: string) =>
+    a.mutation().arguments({ input: a.json() }).returns(a.json()).authorization((allow) => [allow.groups(NEWSLETTER_OPERATION_GROUPS[name])]).handler(handler);
+  return {
+    ...Object.fromEntries(NEWSLETTER_QUERIES.map((name) => [name, query(name)])),
+    ...Object.fromEntries(NEWSLETTER_MUTATIONS.map((name) => [name, mutation(name)])),
+  };
+}

package/amplify/plugins/newsletter/secure-string-parameter.js

@@ -0,0 +1,107 @@
+/**
+ * A generated secret in SSM Parameter Store as a standard SecureString (never Secrets Manager).
+ *
+ * This is the same construct as `infra/amplify-app-shell/lib/secure-string-parameter.ts`, copied because the Papyrus npm
+ * package ships `amplify/` but not `infra/` (the app-shell CDK app has its own tsconfig). Keep the two in step.
+ * CloudFormation cannot create a SecureString, so a custom resource Lambda puts it: it generates the value, never returns
+ * or logs it, never overwrites an existing parameter, and delete retains it. Readers get `ssm:GetParameter` on `parameterArn`
+ * only; decrypting with the AWS-managed `aws/ssm` key needs no KMS grant.
+ */
+import { Construct } from "constructs";
+import { ArnFormat, CustomResource, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as customResources from "aws-cdk-lib/custom-resources";
+/** Source of the Lambda behind SecureStringParameter, inline (CommonJS, under the 4096-character inline limit). */
+export const SECURE_STRING_PARAMETER_HANDLER_SOURCE = `
+const { randomInt } = require("node:crypto");
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function generate(length) {
+  let value = "";
+  for (let index = 0; index < length; index += 1) value += ALPHABET[randomInt(ALPHABET.length)];
+  return value;
+}
+exports.createHandler = (ssm, PutParameterCommand) => async (event) => {
+  const name = event.ResourceProperties.ParameterName;
+  if (event.RequestType === "Delete") return { PhysicalResourceId: event.PhysicalResourceId };
+  try {
+    await ssm.send(new PutParameterCommand({
+      Name: name,
+      Description: event.ResourceProperties.Description,
+      Type: "SecureString",
+      Tier: "Standard",
+      Overwrite: false,
+      Value: generate(Number(event.ResourceProperties.Length)),
+    }));
+  } catch (error) {
+    if (!error || error.name !== "ParameterAlreadyExists") {
+      throw new Error("PutParameter failed for " + name + " (" + (error && error.name ? error.name : "error") + ")");
+    }
+  }
+  return { PhysicalResourceId: name };
+};
+exports.handler = async (event) => {
+  const { SSMClient, PutParameterCommand } = require("@aws-sdk/client-ssm");
+  return exports.createHandler(new SSMClient({}), PutParameterCommand)(event);
+};
+`;
+/** One Lambda and role per stack, shared by every SecureStringParameter in it. */
+class SecureStringParameterProvider extends Construct {
+    static ID = "SecureStringParameterProvider";
+    role;
+    provider;
+    static of(stack) {
+        return stack.node.tryFindChild(SecureStringParameterProvider.ID)
+            ?? new SecureStringParameterProvider(stack);
+    }
+    constructor(stack) {
+        super(stack, SecureStringParameterProvider.ID);
+        this.role = new iam.Role(this, "Role", {
+            assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+            description: "Creates generated SecureString parameters: PutParameter per named parameter, never overwriting",
+            managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")],
+        });
+        const onEvent = new lambda.Function(this, "OnEvent", {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            handler: "index.handler",
+            code: lambda.Code.fromInline(SECURE_STRING_PARAMETER_HANDLER_SOURCE),
+            role: this.role,
+            timeout: Duration.seconds(30),
+            description: "Creates a generated SecureString parameter once; never returns or logs the value",
+        });
+        this.provider = new customResources.Provider(this, "Provider", { onEventHandler: onEvent });
+    }
+}
+export class SecureStringParameter extends Construct {
+    parameterName;
+    parameterArn;
+    constructor(scope, id, props) {
+        super(scope, id);
+        if (!props.parameterName.startsWith("/"))
+            throw new Error(`SSM parameter name must be absolute: ${props.parameterName}`);
+        const length = props.length ?? 64;
+        if (!Number.isInteger(length) || length < 32)
+            throw new Error("A generated secret must be at least 32 characters.");
+        const stack = Stack.of(this);
+        this.parameterName = props.parameterName;
+        this.parameterArn = stack.formatArn({
+            service: "ssm",
+            resource: "parameter",
+            resourceName: props.parameterName.slice(1),
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        });
+        const shared = SecureStringParameterProvider.of(stack);
+        shared.role.addToPolicy(new iam.PolicyStatement({
+            sid: `Put${id.replace(/[^A-Za-z0-9]/g, "")}`,
+            actions: ["ssm:PutParameter"],
+            resources: [this.parameterArn],
+        }));
+        const resource = new CustomResource(this, "Resource", {
+            serviceToken: shared.provider.serviceToken,
+            resourceType: "Custom::SecureStringParameter",
+            properties: { ParameterName: props.parameterName, Description: props.description, Length: String(length) },
+            removalPolicy: RemovalPolicy.RETAIN,
+        });
+        resource.node.addDependency(shared.role);
+    }
+}

package/amplify/plugins/newsletter/secure-string-parameter.ts

@@ -0,0 +1,120 @@
+/**
+ * A generated secret in SSM Parameter Store as a standard SecureString (never Secrets Manager).
+ *
+ * This is the same construct as `infra/amplify-app-shell/lib/secure-string-parameter.ts`, copied because the Papyrus npm
+ * package ships `amplify/` but not `infra/` (the app-shell CDK app has its own tsconfig). Keep the two in step.
+ * CloudFormation cannot create a SecureString, so a custom resource Lambda puts it: it generates the value, never returns
+ * or logs it, never overwrites an existing parameter, and delete retains it. Readers get `ssm:GetParameter` on `parameterArn`
+ * only; decrypting with the AWS-managed `aws/ssm` key needs no KMS grant.
+ */
+import { Construct } from "constructs";
+import { ArnFormat, CustomResource, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as customResources from "aws-cdk-lib/custom-resources";
+
+export interface SecureStringParameterProps {
+  /** Absolute parameter name, e.g. `/papyrus/<siteId>/prospectus-session-sealing`. */
+  parameterName: string;
+  description: string;
+  /** Length of the generated value. Default 64. */
+  length?: number;
+}
+
+/** Source of the Lambda behind SecureStringParameter, inline (CommonJS, under the 4096-character inline limit). */
+export const SECURE_STRING_PARAMETER_HANDLER_SOURCE = `
+const { randomInt } = require("node:crypto");
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function generate(length) {
+  let value = "";
+  for (let index = 0; index < length; index += 1) value += ALPHABET[randomInt(ALPHABET.length)];
+  return value;
+}
+exports.createHandler = (ssm, PutParameterCommand) => async (event) => {
+  const name = event.ResourceProperties.ParameterName;
+  if (event.RequestType === "Delete") return { PhysicalResourceId: event.PhysicalResourceId };
+  try {
+    await ssm.send(new PutParameterCommand({
+      Name: name,
+      Description: event.ResourceProperties.Description,
+      Type: "SecureString",
+      Tier: "Standard",
+      Overwrite: false,
+      Value: generate(Number(event.ResourceProperties.Length)),
+    }));
+  } catch (error) {
+    if (!error || error.name !== "ParameterAlreadyExists") {
+      throw new Error("PutParameter failed for " + name + " (" + (error && error.name ? error.name : "error") + ")");
+    }
+  }
+  return { PhysicalResourceId: name };
+};
+exports.handler = async (event) => {
+  const { SSMClient, PutParameterCommand } = require("@aws-sdk/client-ssm");
+  return exports.createHandler(new SSMClient({}), PutParameterCommand)(event);
+};
+`;
+
+/** One Lambda and role per stack, shared by every SecureStringParameter in it. */
+class SecureStringParameterProvider extends Construct {
+  static readonly ID = "SecureStringParameterProvider";
+  public readonly role: iam.Role;
+  public readonly provider: customResources.Provider;
+
+  static of(stack: Stack): SecureStringParameterProvider {
+    return (stack.node.tryFindChild(SecureStringParameterProvider.ID) as SecureStringParameterProvider | undefined)
+      ?? new SecureStringParameterProvider(stack);
+  }
+
+  private constructor(stack: Stack) {
+    super(stack, SecureStringParameterProvider.ID);
+    this.role = new iam.Role(this, "Role", {
+      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+      description: "Creates generated SecureString parameters: PutParameter per named parameter, never overwriting",
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")],
+    });
+    const onEvent = new lambda.Function(this, "OnEvent", {
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambda.Code.fromInline(SECURE_STRING_PARAMETER_HANDLER_SOURCE),
+      role: this.role,
+      timeout: Duration.seconds(30),
+      description: "Creates a generated SecureString parameter once; never returns or logs the value",
+    });
+    this.provider = new customResources.Provider(this, "Provider", { onEventHandler: onEvent });
+  }
+}
+
+export class SecureStringParameter extends Construct {
+  public readonly parameterName: string;
+  public readonly parameterArn: string;
+
+  constructor(scope: Construct, id: string, props: SecureStringParameterProps) {
+    super(scope, id);
+    if (!props.parameterName.startsWith("/")) throw new Error(`SSM parameter name must be absolute: ${props.parameterName}`);
+    const length = props.length ?? 64;
+    if (!Number.isInteger(length) || length < 32) throw new Error("A generated secret must be at least 32 characters.");
+    const stack = Stack.of(this);
+    this.parameterName = props.parameterName;
+    this.parameterArn = stack.formatArn({
+      service: "ssm",
+      resource: "parameter",
+      resourceName: props.parameterName.slice(1),
+      arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+    });
+
+    const shared = SecureStringParameterProvider.of(stack);
+    shared.role.addToPolicy(new iam.PolicyStatement({
+      sid: `Put${id.replace(/[^A-Za-z0-9]/g, "")}`,
+      actions: ["ssm:PutParameter"],
+      resources: [this.parameterArn],
+    }));
+    const resource = new CustomResource(this, "Resource", {
+      serviceToken: shared.provider.serviceToken,
+      resourceType: "Custom::SecureStringParameter",
+      properties: { ParameterName: props.parameterName, Description: props.description, Length: String(length) },
+      removalPolicy: RemovalPolicy.RETAIN,
+    });
+    resource.node.addDependency(shared.role);
+  }
+}

package/amplify/plugins/newsletter/sending.js

@@ -0,0 +1,140 @@
+import { Duration, Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Architecture, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import { SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
+import { CfnSchedule } from "aws-cdk-lib/aws-scheduler";
+import { Queue, QueueEncryption } from "aws-cdk-lib/aws-sqs";
+export const NEWSLETTER_WORKER_HANDLER = "papyrus_content.newsletter.worker.handler";
+/** The worker mails up to 50 subscribers per message at the SES send rate; the visibility timeout is six times this. */
+export const WORKER_TIMEOUT_SECONDS = 180;
+export const SEND_MAX_RECEIVE_COUNT = 3;
+/** The schedule names the function may manage at run time: `papyrus-nl-<siteId>-<issue8>`. */
+export const SCHEDULE_NAME_PREFIX = "papyrus-nl-";
+export const newsletterFunctionName = (siteId) => `papyrus-newsletter-${siteId}`;
+export const newsletterWorkerName = (siteId) => `papyrus-newsletter-send-${siteId}`;
+export const newsletterSendQueueName = (siteId) => `papyrus-newsletter-send-${siteId}`;
+/** The AppSync fields the `newsletter` function reads and writes through the content API (the roundup draft, the issue's Item, and the published item an alert is about). */
+export const NEWSLETTER_APPSYNC_FIELDS = [
+    "Query/fields/getItem",
+    "Query/fields/getPublishedItem",
+    "Query/fields/listPublishedItems",
+    "Mutation/fields/createItem",
+    "Mutation/fields/updateItem",
+];
+/** The only two SSM parameters that hold the postal address: the site's override and the shared default. */
+export function postalAddressParameterArns(stack, siteId) {
+    return [`/papyrus/${siteId}/email/postal-address`, "/papyrus/email/postal-address"].map((name) => `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter${name}`);
+}
+export function scheduleArnPattern(stack, siteId) {
+    return `arn:${stack.partition}:scheduler:${stack.region}:${stack.account}:schedule/default/${SCHEDULE_NAME_PREFIX}${siteId}-*`;
+}
+export function functionArn(stack, name) {
+    return `arn:${stack.partition}:lambda:${stack.region}:${stack.account}:function:${name}`;
+}
+/**
+ * Everything that sends: the queue and its dead letter queue, the send worker, the scheduler role and the per-list
+ * draft schedules, and the IAM they need. Nothing here lets the function reach anything but its own queue, its own
+ * schedules (`papyrus-nl-<siteId>-*`), two postal address parameters and five content API fields.
+ */
+export function wireSending(inputs) {
+    const { stack, config, context, backend, table, lambda, environment, keyParameterArn, sesResources, code } = inputs;
+    const deadLetterQueue = new Queue(stack, "SendDeadLetterQueue", {
+        queueName: `${newsletterSendQueueName(config.siteId)}-dlq`,
+        retentionPeriod: Duration.days(14),
+        encryption: QueueEncryption.SQS_MANAGED,
+        enforceSSL: true,
+    });
+    const queue = new Queue(stack, "SendQueue", {
+        queueName: newsletterSendQueueName(config.siteId),
+        visibilityTimeout: Duration.seconds(WORKER_TIMEOUT_SECONDS * 6),
+        encryption: QueueEncryption.SQS_MANAGED,
+        enforceSSL: true,
+        deadLetterQueue: { queue: deadLetterQueue, maxReceiveCount: SEND_MAX_RECEIVE_COUNT },
+    });
+    // The role EventBridge Scheduler assumes to invoke the function, for the draft schedules and the one-time send schedules.
+    const schedulerRole = new Role(stack, "SchedulerRole", {
+        assumedBy: new ServicePrincipal("scheduler.amazonaws.com", { conditions: { StringEquals: { "aws:SourceAccount": stack.account } } }),
+        description: `Lets EventBridge Scheduler invoke the ${config.siteId} newsletter function`,
+    });
+    lambda.grantInvoke(schedulerRole);
+    const contentActions = context.contentActionsLambda;
+    lambda.addEnvironment("FUNCTION_ARN", functionArn(stack, newsletterFunctionName(config.siteId)));
+    lambda.addEnvironment("SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
+    lambda.addEnvironment("QUEUE_URL", queue.queueUrl);
+    lambda.addEnvironment("CONTENT_ACTIONS_FUNCTION", contentActions.functionName);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
+    queue.grantSendMessages(lambda);
+    contentActions.grantInvoke(lambda);
+    lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["ssm:GetParameter"], resources: postalAddressParameterArns(stack, config.siteId) }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["scheduler:CreateSchedule", "scheduler:UpdateSchedule", "scheduler:DeleteSchedule"],
+        resources: [scheduleArnPattern(stack, config.siteId)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["iam:PassRole"],
+        resources: [schedulerRole.roleArn],
+        conditions: { StringEquals: { "iam:PassedToService": "scheduler.amazonaws.com" } },
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["appsync:GraphQL"],
+        resources: NEWSLETTER_APPSYNC_FIELDS.map((field) => `arn:${stack.partition}:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/${field}`),
+    }));
+    const worker = new LambdaFunction(stack, "SendWorkerFunction", {
+        functionName: newsletterWorkerName(config.siteId),
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: NEWSLETTER_WORKER_HANDLER,
+        timeout: Duration.seconds(WORKER_TIMEOUT_SECONDS),
+        memorySize: 512,
+        // One message at a time, so the send rate is the account's SES rate, never a multiple of it.
+        reservedConcurrentExecutions: 1,
+        description: `Mails queued newsletter batches for ${config.siteId}, paced under the SES send rate`,
+        environment: { ...environment, QUEUE_URL: queue.queueUrl, CONTENT_ACTIONS_FUNCTION: contentActions.functionName },
+        code,
+    });
+    worker.addEventSource(new SqsEventSource(queue, { batchSize: 1 }));
+    table.grantReadWriteData(worker);
+    queue.grantSendMessages(worker);
+    contentActions.grantInvoke(worker);
+    worker.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["ssm:GetParameter"], resources: [keyParameterArn] }));
+    worker.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ses:SendEmail", "ses:SendRawEmail"],
+        resources: sesResources,
+        conditions: { StringEquals: { "ses:FromAddress": config.fromAddress } },
+    }));
+    // GetAccount (the send rate) does not support resource-level permissions.
+    worker.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["sesv2:GetAccount"], resources: ["*"] }));
+    // A roundup list drafts itself on its schedule, in the schedule's own time zone.
+    const roundups = config.lists.filter((list) => list.kind === "roundup");
+    for (const list of roundups) {
+        new CfnSchedule(stack, `Draft${list.id.replace(/(^|-)([a-z0-9])/g, (_match, _dash, letter) => letter.toUpperCase())}`, {
+            description: `Draft the ${list.id} roundup for ${config.siteId}`,
+            scheduleExpression: list.schedule.draft,
+            scheduleExpressionTimezone: list.schedule.timezone,
+            flexibleTimeWindow: { mode: "OFF" },
+            state: "ENABLED",
+            target: {
+                arn: lambda.functionArn,
+                roleArn: schedulerRole.roleArn,
+                input: JSON.stringify({ task: "assemble-roundup", listId: list.id }),
+                retryPolicy: { maximumRetryAttempts: 2, maximumEventAgeInSeconds: 3600 },
+            },
+        });
+    }
+    // The newsroom operations reach the function through the thin AppSync function the plugin defines.
+    const operations = backend.newsletterOps?.resources.lambda;
+    if (operations) {
+        const operationsStack = Stack.of(operations);
+        operations.addEnvironment("NEWSLETTER_FUNCTION_NAME", newsletterFunctionName(config.siteId));
+        operations.addToRolePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: ["lambda:InvokeFunction"],
+            resources: [functionArn(operationsStack, newsletterFunctionName(config.siteId))],
+        }));
+    }
+    return { queue, deadLetterQueue, worker, schedulerRole };
+}

package/amplify/plugins/newsletter/sending.ts

@@ -0,0 +1,186 @@
+import { Duration, Stack } from "aws-cdk-lib";
+import type { Table } from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Architecture, type Code, Function as LambdaFunction, Runtime } from "aws-cdk-lib/aws-lambda";
+import { SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
+import { CfnSchedule } from "aws-cdk-lib/aws-scheduler";
+import { Queue, QueueEncryption } from "aws-cdk-lib/aws-sqs";
+import type { PluginWiringContext } from "../types";
+import type { NewsletterConfig, RoundupList } from "./config";
+
+export const NEWSLETTER_WORKER_HANDLER = "papyrus_content.newsletter.worker.handler";
+/** The worker mails up to 50 subscribers per message at the SES send rate; the visibility timeout is six times this. */
+export const WORKER_TIMEOUT_SECONDS = 180;
+export const SEND_MAX_RECEIVE_COUNT = 3;
+/** The schedule names the function may manage at run time: `papyrus-nl-<siteId>-<issue8>`. */
+export const SCHEDULE_NAME_PREFIX = "papyrus-nl-";
+
+export const newsletterFunctionName = (siteId: string) => `papyrus-newsletter-${siteId}`;
+export const newsletterWorkerName = (siteId: string) => `papyrus-newsletter-send-${siteId}`;
+export const newsletterSendQueueName = (siteId: string) => `papyrus-newsletter-send-${siteId}`;
+
+/** The AppSync fields the `newsletter` function reads and writes through the content API (the roundup draft, the issue's Item, and the published item an alert is about). */
+export const NEWSLETTER_APPSYNC_FIELDS = [
+  "Query/fields/getItem",
+  "Query/fields/getPublishedItem",
+  "Query/fields/listPublishedItems",
+  "Mutation/fields/createItem",
+  "Mutation/fields/updateItem",
+];
+
+/** The only two SSM parameters that hold the postal address: the site's override and the shared default. */
+export function postalAddressParameterArns(stack: Stack, siteId: string): string[] {
+  return [`/papyrus/${siteId}/email/postal-address`, "/papyrus/email/postal-address"].map(
+    (name) => `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter${name}`,
+  );
+}
+
+export function scheduleArnPattern(stack: Stack, siteId: string): string {
+  return `arn:${stack.partition}:scheduler:${stack.region}:${stack.account}:schedule/default/${SCHEDULE_NAME_PREFIX}${siteId}-*`;
+}
+
+export function functionArn(stack: Stack, name: string): string {
+  return `arn:${stack.partition}:lambda:${stack.region}:${stack.account}:function:${name}`;
+}
+
+type SendingInputs = {
+  stack: Stack;
+  config: NewsletterConfig;
+  context: PluginWiringContext;
+  backend: any;
+  table: Table;
+  lambda: LambdaFunction;
+  environment: Record<string, string>;
+  keyParameterArn: string;
+  sesResources: string[];
+  code: Code;
+};
+
+/**
+ * Everything that sends: the queue and its dead letter queue, the send worker, the scheduler role and the per-list
+ * draft schedules, and the IAM they need. Nothing here lets the function reach anything but its own queue, its own
+ * schedules (`papyrus-nl-<siteId>-*`), two postal address parameters and five content API fields.
+ */
+export function wireSending(inputs: SendingInputs): { queue: Queue; deadLetterQueue: Queue; worker: LambdaFunction; schedulerRole: Role } {
+  const { stack, config, context, backend, table, lambda, environment, keyParameterArn, sesResources, code } = inputs;
+
+  const deadLetterQueue = new Queue(stack, "SendDeadLetterQueue", {
+    queueName: `${newsletterSendQueueName(config.siteId)}-dlq`,
+    retentionPeriod: Duration.days(14),
+    encryption: QueueEncryption.SQS_MANAGED,
+    enforceSSL: true,
+  });
+  const queue = new Queue(stack, "SendQueue", {
+    queueName: newsletterSendQueueName(config.siteId),
+    visibilityTimeout: Duration.seconds(WORKER_TIMEOUT_SECONDS * 6),
+    encryption: QueueEncryption.SQS_MANAGED,
+    enforceSSL: true,
+    deadLetterQueue: { queue: deadLetterQueue, maxReceiveCount: SEND_MAX_RECEIVE_COUNT },
+  });
+
+  // The role EventBridge Scheduler assumes to invoke the function, for the draft schedules and the one-time send schedules.
+  const schedulerRole = new Role(stack, "SchedulerRole", {
+    assumedBy: new ServicePrincipal("scheduler.amazonaws.com", { conditions: { StringEquals: { "aws:SourceAccount": stack.account } } }),
+    description: `Lets EventBridge Scheduler invoke the ${config.siteId} newsletter function`,
+  });
+  lambda.grantInvoke(schedulerRole);
+
+  const contentActions = context.contentActionsLambda;
+  lambda.addEnvironment("FUNCTION_ARN", functionArn(stack, newsletterFunctionName(config.siteId)));
+  lambda.addEnvironment("SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
+  lambda.addEnvironment("QUEUE_URL", queue.queueUrl);
+  lambda.addEnvironment("CONTENT_ACTIONS_FUNCTION", contentActions.functionName);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", context.graphqlEndpoint);
+
+  queue.grantSendMessages(lambda);
+  contentActions.grantInvoke(lambda);
+  lambda.addToRolePolicy(
+    new PolicyStatement({ effect: Effect.ALLOW, actions: ["ssm:GetParameter"], resources: postalAddressParameterArns(stack, config.siteId) }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["scheduler:CreateSchedule", "scheduler:UpdateSchedule", "scheduler:DeleteSchedule"],
+      resources: [scheduleArnPattern(stack, config.siteId)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["iam:PassRole"],
+      resources: [schedulerRole.roleArn],
+      conditions: { StringEquals: { "iam:PassedToService": "scheduler.amazonaws.com" } },
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:GraphQL"],
+      resources: NEWSLETTER_APPSYNC_FIELDS.map(
+        (field) => `arn:${stack.partition}:appsync:${stack.region}:${stack.account}:apis/${context.graphqlApiId}/types/${field}`,
+      ),
+    }),
+  );
+
+  const worker = new LambdaFunction(stack, "SendWorkerFunction", {
+    functionName: newsletterWorkerName(config.siteId),
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: NEWSLETTER_WORKER_HANDLER,
+    timeout: Duration.seconds(WORKER_TIMEOUT_SECONDS),
+    memorySize: 512,
+    // One message at a time, so the send rate is the account's SES rate, never a multiple of it.
+    reservedConcurrentExecutions: 1,
+    description: `Mails queued newsletter batches for ${config.siteId}, paced under the SES send rate`,
+    environment: { ...environment, QUEUE_URL: queue.queueUrl, CONTENT_ACTIONS_FUNCTION: contentActions.functionName },
+    code,
+  });
+  worker.addEventSource(new SqsEventSource(queue, { batchSize: 1 }));
+  table.grantReadWriteData(worker);
+  queue.grantSendMessages(worker);
+  contentActions.grantInvoke(worker);
+  worker.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["ssm:GetParameter"], resources: [keyParameterArn] }));
+  worker.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ses:SendEmail", "ses:SendRawEmail"],
+      resources: sesResources,
+      conditions: { StringEquals: { "ses:FromAddress": config.fromAddress } },
+    }),
+  );
+  // GetAccount (the send rate) does not support resource-level permissions.
+  worker.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["sesv2:GetAccount"], resources: ["*"] }));
+
+  // A roundup list drafts itself on its schedule, in the schedule's own time zone.
+  const roundups = config.lists.filter((list): list is RoundupList => list.kind === "roundup");
+  for (const list of roundups) {
+    new CfnSchedule(stack, `Draft${list.id.replace(/(^|-)([a-z0-9])/g, (_match, _dash, letter: string) => letter.toUpperCase())}`, {
+      description: `Draft the ${list.id} roundup for ${config.siteId}`,
+      scheduleExpression: list.schedule.draft,
+      scheduleExpressionTimezone: list.schedule.timezone,
+      flexibleTimeWindow: { mode: "OFF" },
+      state: "ENABLED",
+      target: {
+        arn: lambda.functionArn,
+        roleArn: schedulerRole.roleArn,
+        input: JSON.stringify({ task: "assemble-roundup", listId: list.id }),
+        retryPolicy: { maximumRetryAttempts: 2, maximumEventAgeInSeconds: 3600 },
+      },
+    });
+  }
+
+  // The newsroom operations reach the function through the thin AppSync function the plugin defines.
+  const operations = backend.newsletterOps?.resources.lambda as LambdaFunction | undefined;
+  if (operations) {
+    const operationsStack = Stack.of(operations);
+    operations.addEnvironment("NEWSLETTER_FUNCTION_NAME", newsletterFunctionName(config.siteId));
+    operations.addToRolePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["lambda:InvokeFunction"],
+        resources: [functionArn(operationsStack, newsletterFunctionName(config.siteId))],
+      }),
+    );
+  }
+  return { queue, deadLetterQueue, worker, schedulerRole };
+}