@anthusai/papyrus 5.27.0 → 5.29.0

package/amplify/functions/content-actions/handler.py

@@ -8,6 +8,7 @@ from papyrus_content.edge_invalidation import distribution_ids_from_environment,
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
 from papyrus_content.projection.deploy_render import deploy_render, drift_metric_line
+from papyrus_content.projection.lease import ProjectionLeaseHeld
 from papyrus_content.projection.engine import project, project_all, project_item_pages
 from papyrus_content.reader_steering.task import TASK_NAME as READER_SNAPSHOT_TASK, run_reader_snapshot
 from papyrus_content.projection.runtime import (
@@ -186,6 +187,13 @@ def run_deploy_render_task(client) -> dict:
 
 def run_projection_task(task: dict) -> dict:
     """An asynchronous projection task. Raising makes Lambda retry it, then send the event to the dead letter queue."""
+    try:
+        return _run_projection_task(task)
+    except ProjectionLeaseHeld as held:  # another projection of this publication outlasted the wait: retry later
+        raise ProjectionTaskFailed(str(held)) from held
+
+
+def _run_projection_task(task: dict) -> dict:
     client, _claims = create_authoring_client()
     if task.get("task") == "item-pages":
         report = project_item_pages(projection_context(client), except_item_id=task.get("exceptItemId"))

package/amplify/plugins/newsletter/config.js

@@ -11,6 +11,14 @@ const SCHEDULER_CRON = /^cron\(\S+ \S+ \S+ \S+ \S+ \S+\)$/;
 const UNSAFE_CSS = /[<>{};"\\`]|url\(|expression\(|@import/i;
 const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
 export const ITEM_URL_STYLES = ["html", "directory", "clean"];
+const THEME_STYLE_KEYS = [
+    "surface", "muted", "fontFamily", "headerBand", "headerText", "buttonFill", "buttonText", "buttonBorder", "footerBand",
+    "footerText", "labelFont",
+];
+const THEME_KEYS = [
+    "accent", "text", "background", ...THEME_STYLE_KEYS, "logoUrl", "wordmarkImageUrl", "wordmarkAlt", "wordmarkWidth", "wordmarkHeight",
+    "footerWordmarkWidth",
+];
 const KNOWN_KEYS = new Set([
     "name", "siteId", "siteOrigin", "basePath", "computeRoleArn", "sendingDomain", "fromAddress", "fromName", "instantAlerts", "theme", "lists",
     "configurationSet", "eventTopicName", "itemUrlStyle",
@@ -97,18 +105,18 @@ function itemUrlStyle(raw) {
     return raw;
 }
 function resolveTheme(raw) {
-    const theme = record(raw, "theme", ["accent", "text", "background", "surface", "muted", "fontFamily", "logoUrl"]);
+    const theme = record(raw, "theme", THEME_KEYS);
     const resolved = {
         accent: text(theme.accent, "theme.accent", 80),
         text: text(theme.text, "theme.text", 80),
         background: text(theme.background, "theme.background", 80),
     };
-    for (const key of ["surface", "muted", "fontFamily"]) {
+    for (const key of THEME_STYLE_KEYS) {
         if (theme[key] !== undefined)
             resolved[key] = text(theme[key], `theme.${key}`, 200);
     }
     for (const [key, value] of Object.entries(resolved)) {
-        if (UNSAFE_CSS.test(value))
+        if (typeof value === "string" && UNSAFE_CSS.test(value))
             fail(`theme.${key} contains characters that are not allowed in a style value`);
     }
     if (theme.logoUrl !== undefined) {
@@ -117,6 +125,37 @@ function resolveTheme(raw) {
             fail("theme.logoUrl must be an https URL");
         resolved.logoUrl = logoUrl;
     }
+    if (theme.wordmarkImageUrl !== undefined) {
+        const url = text(theme.wordmarkImageUrl, "theme.wordmarkImageUrl", 500);
+        if (!/^https:\/\/[^\s"'<>\\`]+$/.test(url))
+            fail("theme.wordmarkImageUrl must be an absolute https URL");
+        resolved.wordmarkImageUrl = url;
+        for (const key of ["wordmarkWidth", "wordmarkHeight"]) {
+            const value = theme[key];
+            if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2000) {
+                fail(`theme.${key} is required with theme.wordmarkImageUrl and must be a whole number of pixels from 1 to 2000`);
+            }
+            resolved[key] = value;
+        }
+    }
+    else if (theme.wordmarkWidth !== undefined || theme.wordmarkHeight !== undefined) {
+        fail("theme.wordmarkWidth and theme.wordmarkHeight need theme.wordmarkImageUrl");
+    }
+    if (theme.footerWordmarkWidth !== undefined) {
+        if (theme.wordmarkImageUrl === undefined)
+            fail("theme.footerWordmarkWidth needs theme.wordmarkImageUrl");
+        const width = theme.footerWordmarkWidth;
+        if (typeof width !== "number" || !Number.isInteger(width) || width < 1 || width > 400) {
+            fail("theme.footerWordmarkWidth must be a whole number of pixels from 1 to 400");
+        }
+        resolved.footerWordmarkWidth = width;
+    }
+    if (theme.wordmarkAlt !== undefined) {
+        const alt = text(theme.wordmarkAlt, "theme.wordmarkAlt", 200);
+        if (/[\u0000-\u001f\u007f]/.test(alt))
+            fail("theme.wordmarkAlt must not contain control characters");
+        resolved.wordmarkAlt = alt;
+    }
     return resolved;
 }
 function resolveRule(raw, label) {

package/amplify/plugins/newsletter/config.ts

@@ -24,8 +24,33 @@ export type NewsletterTheme = {
   muted?: string;
   fontFamily?: string;
   logoUrl?: string;
+  /** Branding, all optional: a plain theme keeps the plain layout. Colours are CSS values; the border is 1.5px when set. */
+  headerBand?: string;
+  headerText?: string;
+  buttonFill?: string;
+  buttonText?: string;
+  buttonBorder?: string;
+  footerBand?: string;
+  footerText?: string;
+  /** An absolute https image, drawn with alt text and explicit pixel size (web fonts do not load in email). */
+  wordmarkImageUrl?: string;
+  wordmarkAlt?: string;
+  wordmarkWidth?: number;
+  wordmarkHeight?: number;
+  /** Draws the footer's wordmark at this width in pixels (1 to 400), smaller than the header's; the height keeps the aspect ratio. */
+  footerWordmarkWidth?: number;
+  labelFont?: string;
 };
 
+const THEME_STYLE_KEYS = [
+  "surface", "muted", "fontFamily", "headerBand", "headerText", "buttonFill", "buttonText", "buttonBorder", "footerBand",
+  "footerText", "labelFont",
+] as const;
+const THEME_KEYS = [
+  "accent", "text", "background", ...THEME_STYLE_KEYS, "logoUrl", "wordmarkImageUrl", "wordmarkAlt", "wordmarkWidth", "wordmarkHeight",
+  "footerWordmarkWidth",
+];
+
 export type NewsletterRule = { sections?: string[]; tags?: string[]; types?: string[] };
 
 type ListBase = { id: string; name: string; description: string };
@@ -152,23 +177,50 @@ function itemUrlStyle(raw: unknown): ItemUrlStyle {
 }
 
 function resolveTheme(raw: unknown): NewsletterTheme {
-  const theme = record(raw, "theme", ["accent", "text", "background", "surface", "muted", "fontFamily", "logoUrl"]);
+  const theme = record(raw, "theme", THEME_KEYS);
   const resolved: NewsletterTheme = {
     accent: text(theme.accent, "theme.accent", 80),
     text: text(theme.text, "theme.text", 80),
     background: text(theme.background, "theme.background", 80),
   };
-  for (const key of ["surface", "muted", "fontFamily"] as const) {
+  for (const key of THEME_STYLE_KEYS) {
     if (theme[key] !== undefined) resolved[key] = text(theme[key], `theme.${key}`, 200);
   }
   for (const [key, value] of Object.entries(resolved)) {
-    if (UNSAFE_CSS.test(value)) fail(`theme.${key} contains characters that are not allowed in a style value`);
+    if (typeof value === "string" && UNSAFE_CSS.test(value)) fail(`theme.${key} contains characters that are not allowed in a style value`);
   }
   if (theme.logoUrl !== undefined) {
     const logoUrl = text(theme.logoUrl, "theme.logoUrl", 500);
     if (!/^https:\/\//.test(logoUrl)) fail("theme.logoUrl must be an https URL");
     resolved.logoUrl = logoUrl;
   }
+  if (theme.wordmarkImageUrl !== undefined) {
+    const url = text(theme.wordmarkImageUrl, "theme.wordmarkImageUrl", 500);
+    if (!/^https:\/\/[^\s"'<>\\`]+$/.test(url)) fail("theme.wordmarkImageUrl must be an absolute https URL");
+    resolved.wordmarkImageUrl = url;
+    for (const key of ["wordmarkWidth", "wordmarkHeight"] as const) {
+      const value = theme[key];
+      if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2000) {
+        fail(`theme.${key} is required with theme.wordmarkImageUrl and must be a whole number of pixels from 1 to 2000`);
+      }
+      resolved[key] = value;
+    }
+  } else if (theme.wordmarkWidth !== undefined || theme.wordmarkHeight !== undefined) {
+    fail("theme.wordmarkWidth and theme.wordmarkHeight need theme.wordmarkImageUrl");
+  }
+  if (theme.footerWordmarkWidth !== undefined) {
+    if (theme.wordmarkImageUrl === undefined) fail("theme.footerWordmarkWidth needs theme.wordmarkImageUrl");
+    const width = theme.footerWordmarkWidth;
+    if (typeof width !== "number" || !Number.isInteger(width) || width < 1 || width > 400) {
+      fail("theme.footerWordmarkWidth must be a whole number of pixels from 1 to 400");
+    }
+    resolved.footerWordmarkWidth = width;
+  }
+  if (theme.wordmarkAlt !== undefined) {
+    const alt = text(theme.wordmarkAlt, "theme.wordmarkAlt", 200);
+    if (/[\u0000-\u001f\u007f]/.test(alt)) fail("theme.wordmarkAlt must not contain control characters");
+    resolved.wordmarkAlt = alt;
+  }
   return resolved;
 }
 

package/amplify/publication/projection-lease.js

@@ -0,0 +1,30 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The shared lock table's name (created by the cloud knowledge run stack). The Lambda finds it through this SSM parameter. */
+export const PROJECTION_LOCK_TABLE_PARAMETER = "/papyrus/projection-lock/table-name";
+export const PROJECTION_LOCK_TABLE_NAME = "papyrus-projection-locks";
+export const PROJECTION_LOCK_TABLE_ACTIONS = ["dynamodb:PutItem", "dynamodb:DeleteItem", "dynamodb:UpdateItem", "dynamodb:GetItem"];
+export function projectionLeaseParameterArn(region, account) {
+    return `arn:aws:ssm:${region}:${account}:parameter${PROJECTION_LOCK_TABLE_PARAMETER}`;
+}
+export function projectionLeaseTableArn(region, account) {
+    return `arn:aws:dynamodb:${region}:${account}:table/${PROJECTION_LOCK_TABLE_NAME}*`;
+}
+/**
+ * Let a projecting Lambda take and release the per-publication projection lease: read the table-name
+ * parameter and write items in the lock table, nothing broader. The table itself is not created here;
+ * a deployment without it keeps projecting without a lease.
+ */
+export function addProjectionLeaseAccess(lambda) {
+    const stack = Stack.of(lambda);
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [projectionLeaseParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: PROJECTION_LOCK_TABLE_ACTIONS,
+        resources: [projectionLeaseTableArn(stack.region, stack.account)],
+    }));
+}

package/amplify/publication/projection-lease.ts

@@ -0,0 +1,39 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { IFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The shared lock table's name (created by the cloud knowledge run stack). The Lambda finds it through this SSM parameter. */
+export const PROJECTION_LOCK_TABLE_PARAMETER = "/papyrus/projection-lock/table-name";
+export const PROJECTION_LOCK_TABLE_NAME = "papyrus-projection-locks";
+export const PROJECTION_LOCK_TABLE_ACTIONS = ["dynamodb:PutItem", "dynamodb:DeleteItem", "dynamodb:UpdateItem", "dynamodb:GetItem"];
+
+export function projectionLeaseParameterArn(region: string, account: string): string {
+  return `arn:aws:ssm:${region}:${account}:parameter${PROJECTION_LOCK_TABLE_PARAMETER}`;
+}
+
+export function projectionLeaseTableArn(region: string, account: string): string {
+  return `arn:aws:dynamodb:${region}:${account}:table/${PROJECTION_LOCK_TABLE_NAME}*`;
+}
+
+/**
+ * Let a projecting Lambda take and release the per-publication projection lease: read the table-name
+ * parameter and write items in the lock table, nothing broader. The table itself is not created here;
+ * a deployment without it keeps projecting without a lease.
+ */
+export function addProjectionLeaseAccess(lambda: IFunction): void {
+  const stack = Stack.of(lambda);
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [projectionLeaseParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: PROJECTION_LOCK_TABLE_ACTIONS,
+      resources: [projectionLeaseTableArn(stack.region, stack.account)],
+    }),
+  );
+}

package/amplify/site-backend.js

@@ -11,6 +11,7 @@ import { resolveSitePublication } from "./publication/default-publication.js";
 import { REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS, addReprojectOnDeploy, reprojectDeployToken } from "./publication/reproject-on-deploy.js";
 import { addProjectionRetries, addS3ProjectionPublication } from "./publication/s3-projection.js";
 import { planRenditions } from "./publication/renditions-settings.js";
+import { addProjectionLeaseAccess } from "./publication/projection-lease.js";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
 import { assertValidPublicationConfig } from "./site-backend-config.js";
@@ -360,6 +361,7 @@ export function defineSiteBackend(papyrusSite) {
     }
     if (s3ProjectionPublication !== undefined) {
         addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+        addProjectionLeaseAccess(contentActionsLambda);
     }
     const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
     for (const [name, value] of Object.entries(publicationWiring.environment)) {

package/amplify/site-backend.ts

@@ -14,6 +14,7 @@ import { resolveSitePublication } from "./publication/default-publication";
 import { REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS, addReprojectOnDeploy, reprojectDeployToken } from "./publication/reproject-on-deploy";
 import { addProjectionRetries, addS3ProjectionPublication, type S3ProjectionPublication } from "./publication/s3-projection";
 import { planRenditions } from "./publication/renditions-settings";
+import { addProjectionLeaseAccess } from "./publication/projection-lease";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
 import { assertValidPublicationConfig } from "./site-backend-config";
@@ -456,6 +457,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   }
   if (s3ProjectionPublication !== undefined) {
     addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+    addProjectionLeaseAccess(contentActionsLambda);
   }
   const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
   for (const [name, value] of Object.entries(publicationWiring.environment)) {

package/infra/site-config.js

@@ -350,7 +350,7 @@ function parseAws(value) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
@@ -465,6 +465,7 @@ export function parseSiteConfig(raw) {
         storagePreviewPrefix,
         autoDeploy: autoDeploy,
         github,
+        ...(record.knowledgeRun !== undefined ? { knowledgeRun: record.knowledgeRun } : {}),
     };
     if (hasCmsApp(config))
         validateOauthRedirectUrls(config);

package/infra/site-config.ts

@@ -78,6 +78,11 @@ export type AmplifyAppShellSiteConfig = {
   };
   papyrusVersion: string;
   storagePreviewPrefix?: string;
+  /**
+   * The scheduled cloud knowledge run for this publication. The app-shell stack ignores it; it is validated by
+   * infra/scheduled-jobs/lib/knowledge-run-config.ts, which owns the schema.
+   */
+  knowledgeRun?: unknown;
   /**
    * Merge-to-main deploy from GitHub Actions through OIDC. When true (the default) the stack creates the
    * `<siteId>-github-deploy` role and turns off Amplify's own auto-build on the production branches, so the
@@ -485,7 +490,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "knowledgeRun", "autoDeploy", "github"],
     "site",
   );
 
@@ -600,6 +605,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     storagePreviewPrefix,
     autoDeploy: autoDeploy as boolean,
     github,
+    ...(record.knowledgeRun !== undefined ? { knowledgeRun: record.knowledgeRun } : {}),
   };
 
   if (hasCmsApp(config)) validateOauthRedirectUrls(config);

package/lib/newsletter-api.ts

@@ -238,6 +238,14 @@ function call(options: NewsletterApiOptions, functionName: string, event: Newsle
   return (options.invoke ?? invokeNewsletterLambda)(functionName, event);
 }
 
+/**
+ * Next answers HEAD by running the route's GET export, but leaves `request.method` as "HEAD". A check for `=== "GET"` therefore
+ * sends a mail scanner's HEAD down the POST path. Every read-only branch asks this instead, so HEAD redirects exactly like GET.
+ */
+function isReadRequest(request: Pick<NextRequest, "method">): boolean {
+  return request.method === "GET" || request.method === "HEAD";
+}
+
 function textResponse(body: string, status: number): NextResponse {
   return new NextResponse(body, { status, headers: { ...NO_STORE, "content-type": "text/plain; charset=utf-8" } });
 }
@@ -266,7 +274,7 @@ export async function handleNewsletterConfirm(request: NextRequest, options: New
   if (!plugin) return notFoundPage();
   const to = redirector(request, environment, plugin);
   if ("response" in to) return to.response;
-  if (request.method === "GET") {
+  if (isReadRequest(request)) {
     const token = manageTokenFrom(request.nextUrl.searchParams.get("t"));
     return token ? to.go("confirm", { token }, 302) : to.go("expired", {}, 302);
   }
@@ -304,7 +312,7 @@ export async function handleNewsletterUnsubscribe(request: NextRequest, options:
   const to = redirector(request, environment, plugin);
   if ("response" in to) return to.response;
   const query = request.nextUrl.searchParams;
-  if (request.method === "GET") {
+  if (isReadRequest(request)) {
     const token = manageTokenFrom(query.get("t"));
     const listId = listParameter(query.get("l"));
     return token ? to.go("unsubscribe", { token, ...(listId ? { list: listId } : {}) }, 302) : to.go("expired", {}, 302);
@@ -344,7 +352,7 @@ export async function handleNewsletterPreferences(request: NextRequest, options:
   if (!plugin) return notFoundPage();
   const to = redirector(request, environment, plugin);
   if ("response" in to) return to.response;
-  if (request.method === "GET") {
+  if (isReadRequest(request)) {
     const token = manageTokenFrom(request.nextUrl.searchParams.get("t"));
     return token ? to.go("preferences", { token }, 302) : to.go("expired", {}, 302);
   }

package/package.json

@@ -433,7 +433,7 @@
       "optional": true
     }
   },
-  "version": "5.27.0",
+  "version": "5.29.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.27.0",
+  "version": "5.29.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",