@anthusai/papyrus 0.0.0 → 1.0.0-next.10

package/infra/amplify-app-shell.js

@@ -0,0 +1,234 @@
+import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as amplify from "aws-cdk-lib/aws-amplify";
+import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
+import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
+import { isStagingEnabled, resolveStackName, resolveStagingDomainName } from "./site-config.js";
+function environmentVariables(variables) {
+    return Object.entries(variables).map(([name, value]) => ({ name, value }));
+}
+/**
+ * Provisions the Amplify *app shell* of a Papyrus publication from its
+ * site.json:
+ *
+ *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
+ *     and `staging` (frontend only, reads the production backend)
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - a domain association per branch/app when a domain is configured (without
+ *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
+ *     URL is used), IAM service and compute roles
+ *   - `cms.staging: false` omits the staging branch and its domain
+ *
+ * No repository and no access token are configured: the apps are manual-deploy
+ * until Amplify's GitHub App is connected once in the console
+ * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * app by `ampx pipeline-deploy` from the production build.
+ */
+export class AmplifyAppShellStack extends Stack {
+    cmsAppId;
+    readerAppId;
+    constructor(scope, id, config, props) {
+        super(scope, id, props);
+        const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+        const stagingEnabled = isStagingEnabled(config);
+        const stagingDomainName = resolveStagingDomainName(config);
+        const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
+            assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
+            description: `Backend deploy and staging build service role for Amplify app ${cmsAppName} (AdministratorAccess: documented risk)`,
+            managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")],
+        });
+        const computeRole = new iam.Role(this, "AmplifyComputeRole", {
+            assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
+            description: `SSR compute role for Amplify app ${cmsAppName}`,
+            managedPolicies: [
+                iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
+                iam.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchLogsFullAccess"),
+            ],
+        });
+        const cmsApp = new amplify.CfnApp(this, "App", {
+            name: cmsAppName,
+            description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
+            platform: "WEB_COMPUTE",
+            iamServiceRole: cmsServiceRole.roleArn,
+            computeRoleArn: computeRole.roleArn,
+            buildSpec: cmsProductionBuildSpec(config),
+            jobConfig: config.cms.buildComputeType ? { buildComputeType: config.cms.buildComputeType } : undefined,
+            customRules: [{ source: "/<*>", target: "/index.html", status: "404-200" }],
+        });
+        const stagingMode = config.frontend === "markus-static"
+            ? { PAPYRUS_STAGING_PREVIEW: "static" }
+            : { PAPYRUS_CONTENT_SOURCE: "drafts" };
+        const productionOrigin = config.cms.domainName
+            ? `https://${config.cms.domainName}/`
+            : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
+        const stagingOrigin = stagingDomainName
+            ? `https://${stagingDomainName}/`
+            : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+        const defaultOriginsToAllow = [
+            ...(config.cms.domainName ? [] : [productionOrigin]),
+            ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
+        ];
+        const oauthRedirectUrls = defaultOriginsToAllow.length === 0
+            ? config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS
+            : Fn.join(",", [config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS, ...defaultOriginsToAllow]);
+        const productionBranch = new amplify.CfnBranch(this, "Branch", {
+            appId: cmsApp.attrAppId,
+            branchName: "main",
+            stage: "PRODUCTION",
+            enableAutoBuild: true,
+            enablePerformanceMode: false,
+            environmentVariables: environmentVariables({
+                ...config.cms.environment,
+                PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
+                PAPYRUS_SITE_BRAND: config.brand,
+                SITE_ENV: "production",
+                PAPYRUS_CONTENT_SOURCE: "published",
+            }),
+        });
+        if (stagingEnabled) {
+            const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+                appId: cmsApp.attrAppId,
+                branchName: "staging",
+                stage: "BETA",
+                enableAutoBuild: true,
+                enablePerformanceMode: false,
+                buildSpec: cmsStagingBuildSpec(config),
+                environmentVariables: environmentVariables({
+                    ...config.cms.environment,
+                    PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
+                    PAPYRUS_SITE_BRAND: config.brand,
+                    SITE_ENV: "staging",
+                    ...stagingMode,
+                    NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
+                        ? `https://${stagingDomainName}`
+                        : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
+                }),
+            });
+            if (stagingDomainName) {
+                const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
+                    appId: cmsApp.attrAppId,
+                    domainName: stagingDomainName,
+                    subDomainSettings: [{ branchName: "staging", prefix: "" }],
+                });
+                stagingDomain.addResourceDependency(stagingBranch);
+            }
+        }
+        if (config.cms.domainName) {
+            const productionDomain = new amplify.CfnDomain(this, "Domain", {
+                appId: cmsApp.attrAppId,
+                domainName: config.cms.domainName,
+                subDomainSettings: [{ branchName: "main", prefix: "" }],
+            });
+            productionDomain.addResourceDependency(productionBranch);
+        }
+        this.cmsAppId = cmsApp.attrAppId;
+        new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
+        new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+        if (stagingEnabled) {
+            new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
+        }
+        if (config.reader) {
+            this.readerAppId = this.addReaderApp(config, config.reader);
+        }
+        if (config.github) {
+            this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
+        }
+    }
+    addGithubCiRole(config, github, amplifyAppIds) {
+        const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubOidcProvider", this.formatArn({
+            service: "iam",
+            region: "",
+            resource: "oidc-provider",
+            resourceName: GITHUB_OIDC_PROVIDER_HOST,
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        }));
+        const ciRole = new iam.Role(this, "GithubCiRole", {
+            roleName: `${config.siteId}-github-ci`,
+            description: `GitHub Actions role for ${github.owner}/${github.repo} (OIDC, least privilege, no admin policy)`,
+            maxSessionDuration: Duration.hours(1),
+            assumedBy: new iam.OpenIdConnectPrincipal(provider, {
+                StringEquals: { [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com" },
+                StringLike: {
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.map((branch) => `repo:${github.owner}/${github.repo}:ref:refs/heads/${branch}`),
+                },
+            }),
+        });
+        ciRole.addToPolicy(new iam.PolicyStatement({
+            sid: "StartAndInspectAmplifyJobs",
+            actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
+            resources: amplifyAppIds.flatMap((appId) => [
+                this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+            ]),
+        }));
+        ciRole.addToPolicy(new iam.PolicyStatement({
+            sid: "ReadSiteSecretsForJwtMinting",
+            actions: ["ssm:GetParameter", "ssm:GetParameters"],
+            resources: [
+                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+            ],
+        }));
+        ciRole.addToPolicy(new iam.PolicyStatement({
+            sid: "WhoAmI",
+            actions: ["sts:GetCallerIdentity"],
+            resources: ["*"],
+        }));
+        if (github.ciCanDeployInfra) {
+            ciRole.addToPolicy(new iam.PolicyStatement({
+                sid: "DeployThisSitesAppShellStack",
+                actions: ["cloudformation:*"],
+                resources: [
+                    this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `${resolveStackName(config)}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                ],
+            }));
+        }
+        new CfnOutput(this, "GithubCiRoleArn", { value: ciRole.roleArn, description: `Role for GitHub Actions in ${github.owner}/${github.repo}` });
+    }
+    addReaderApp(config, reader) {
+        const readerAppName = reader.appName ?? `${config.siteId}-reader`;
+        const readerBranchName = reader.branchName ?? "main";
+        const readerServiceRole = new iam.Role(this, "ReaderServiceRole", {
+            assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
+            description: `Static reader build role for Amplify app ${readerAppName} (reads published media only; content is read as a Cognito guest)`,
+        });
+        readerServiceRole.addToPolicy(new iam.PolicyStatement({
+            sid: "ReadMediaForExport",
+            actions: ["s3:GetObject"],
+            resources: ["arn:aws:s3:::amplify-*/media/*"],
+        }));
+        const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+            name: readerAppName,
+            description: `Papyrus static reader for ${config.siteId} (WEB)`,
+            platform: "WEB",
+            iamServiceRole: readerServiceRole.roleArn,
+            buildSpec: readerBuildSpec(config),
+        });
+        const readerBranch = new amplify.CfnBranch(this, "ReaderBranch", {
+            appId: readerApp.attrAppId,
+            branchName: readerBranchName,
+            stage: "PRODUCTION",
+            enableAutoBuild: true,
+            environmentVariables: environmentVariables({
+                ...(reader.environment ?? {}),
+                PAPYRUS_SITE_BRAND: config.brand,
+                SITE_ENV: "production",
+            }),
+        });
+        if (reader.domainName) {
+            const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
+                appId: readerApp.attrAppId,
+                domainName: reader.domainName,
+                subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+            });
+            readerDomain.addResourceDependency(readerBranch);
+        }
+        new CfnOutput(this, "ReaderAppId", { value: readerApp.attrAppId, description: `Amplify app id for ${readerAppName}` });
+        new CfnOutput(this, "ReaderOrigin", {
+            value: reader.domainName
+                ? `https://${reader.domainName}/`
+                : Fn.join("", [`https://${readerBranchName}.`, readerApp.attrDefaultDomain, "/"]),
+        });
+        return readerApp.attrAppId;
+    }
+}

package/infra/amplify-app-shell.ts

@@ -0,0 +1,284 @@
+import { Construct } from "constructs";
+import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as amplify from "aws-cdk-lib/aws-amplify";
+import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
+import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
+import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveStackName, resolveStagingDomainName } from "./site-config";
+
+function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
+  return Object.entries(variables).map(([name, value]) => ({ name, value }));
+}
+
+/**
+ * Provisions the Amplify *app shell* of a Papyrus publication from its
+ * site.json:
+ *
+ *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
+ *     and `staging` (frontend only, reads the production backend)
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - a domain association per branch/app when a domain is configured (without
+ *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
+ *     URL is used), IAM service and compute roles
+ *   - `cms.staging: false` omits the staging branch and its domain
+ *
+ * No repository and no access token are configured: the apps are manual-deploy
+ * until Amplify's GitHub App is connected once in the console
+ * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * app by `ampx pipeline-deploy` from the production build.
+ */
+export class AmplifyAppShellStack extends Stack {
+  public readonly cmsAppId: string;
+  public readonly readerAppId?: string;
+
+  constructor(scope: Construct, id: string, config: AmplifyAppShellSiteConfig, props?: StackProps) {
+    super(scope, id, props);
+
+    const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+    const stagingEnabled = isStagingEnabled(config);
+    const stagingDomainName = resolveStagingDomainName(config);
+
+    const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
+      assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
+      description: `Backend deploy and staging build service role for Amplify app ${cmsAppName} (AdministratorAccess: documented risk)`,
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")],
+    });
+
+    const computeRole = new iam.Role(this, "AmplifyComputeRole", {
+      assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
+      description: `SSR compute role for Amplify app ${cmsAppName}`,
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
+        iam.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchLogsFullAccess"),
+      ],
+    });
+
+    const cmsApp = new amplify.CfnApp(this, "App", {
+      name: cmsAppName,
+      description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
+      platform: "WEB_COMPUTE",
+      iamServiceRole: cmsServiceRole.roleArn,
+      computeRoleArn: computeRole.roleArn,
+      buildSpec: cmsProductionBuildSpec(config),
+      jobConfig: config.cms.buildComputeType ? { buildComputeType: config.cms.buildComputeType } : undefined,
+      customRules: [{ source: "/<*>", target: "/index.html", status: "404-200" }],
+    });
+
+    const stagingMode: Record<string, string> = config.frontend === "markus-static"
+      ? { PAPYRUS_STAGING_PREVIEW: "static" }
+      : { PAPYRUS_CONTENT_SOURCE: "drafts" };
+
+    const productionOrigin = config.cms.domainName
+      ? `https://${config.cms.domainName}/`
+      : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
+    const stagingOrigin = stagingDomainName
+      ? `https://${stagingDomainName}/`
+      : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+    const defaultOriginsToAllow = [
+      ...(config.cms.domainName ? [] : [productionOrigin]),
+      ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
+    ];
+    const oauthRedirectUrls = defaultOriginsToAllow.length === 0
+      ? config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS
+      : Fn.join(",", [config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS, ...defaultOriginsToAllow]);
+
+    const productionBranch = new amplify.CfnBranch(this, "Branch", {
+      appId: cmsApp.attrAppId,
+      branchName: "main",
+      stage: "PRODUCTION",
+      enableAutoBuild: true,
+      enablePerformanceMode: false,
+      environmentVariables: environmentVariables({
+        ...config.cms.environment,
+        PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
+        PAPYRUS_SITE_BRAND: config.brand,
+        SITE_ENV: "production",
+        PAPYRUS_CONTENT_SOURCE: "published",
+      }),
+    });
+
+    if (stagingEnabled) {
+      const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+        appId: cmsApp.attrAppId,
+        branchName: "staging",
+        stage: "BETA",
+        enableAutoBuild: true,
+        enablePerformanceMode: false,
+        buildSpec: cmsStagingBuildSpec(config),
+        environmentVariables: environmentVariables({
+          ...config.cms.environment,
+          PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
+          PAPYRUS_SITE_BRAND: config.brand,
+          SITE_ENV: "staging",
+          ...stagingMode,
+          NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
+            ? `https://${stagingDomainName}`
+            : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
+        }),
+      });
+
+      if (stagingDomainName) {
+        const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
+          appId: cmsApp.attrAppId,
+          domainName: stagingDomainName,
+          subDomainSettings: [{ branchName: "staging", prefix: "" }],
+        });
+        stagingDomain.addResourceDependency(stagingBranch);
+      }
+    }
+
+    if (config.cms.domainName) {
+      const productionDomain = new amplify.CfnDomain(this, "Domain", {
+        appId: cmsApp.attrAppId,
+        domainName: config.cms.domainName,
+        subDomainSettings: [{ branchName: "main", prefix: "" }],
+      });
+      productionDomain.addResourceDependency(productionBranch);
+    }
+
+    this.cmsAppId = cmsApp.attrAppId;
+    new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
+    new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+    if (stagingEnabled) {
+      new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
+    }
+
+    if (config.reader) {
+      this.readerAppId = this.addReaderApp(config, config.reader);
+    }
+
+    if (config.github) {
+      this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
+    }
+  }
+
+  private addGithubCiRole(
+    config: AmplifyAppShellSiteConfig,
+    github: NonNullable<AmplifyAppShellSiteConfig["github"]>,
+    amplifyAppIds: string[],
+  ): void {
+    const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
+      this,
+      "GithubOidcProvider",
+      this.formatArn({
+        service: "iam",
+        region: "",
+        resource: "oidc-provider",
+        resourceName: GITHUB_OIDC_PROVIDER_HOST,
+        arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+      }),
+    );
+
+    const ciRole = new iam.Role(this, "GithubCiRole", {
+      roleName: `${config.siteId}-github-ci`,
+      description: `GitHub Actions role for ${github.owner}/${github.repo} (OIDC, least privilege, no admin policy)`,
+      maxSessionDuration: Duration.hours(1),
+      assumedBy: new iam.OpenIdConnectPrincipal(provider, {
+        StringEquals: { [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com" },
+        StringLike: {
+          [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.map(
+            (branch) => `repo:${github.owner}/${github.repo}:ref:refs/heads/${branch}`,
+          ),
+        },
+      }),
+    });
+
+    ciRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "StartAndInspectAmplifyJobs",
+        actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
+        resources: amplifyAppIds.flatMap((appId) => [
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ]),
+      }),
+    );
+    ciRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "ReadSiteSecretsForJwtMinting",
+        actions: ["ssm:GetParameter", "ssm:GetParameters"],
+        resources: [
+          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ],
+      }),
+    );
+    ciRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "WhoAmI",
+        actions: ["sts:GetCallerIdentity"],
+        resources: ["*"],
+      }),
+    );
+    if (github.ciCanDeployInfra) {
+      ciRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "DeployThisSitesAppShellStack",
+          actions: ["cloudformation:*"],
+          resources: [
+            this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `${resolveStackName(config)}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          ],
+        }),
+      );
+    }
+
+    new CfnOutput(this, "GithubCiRoleArn", { value: ciRole.roleArn, description: `Role for GitHub Actions in ${github.owner}/${github.repo}` });
+  }
+
+  private addReaderApp(
+    config: AmplifyAppShellSiteConfig,
+    reader: NonNullable<AmplifyAppShellSiteConfig["reader"]>,
+  ): string {
+    const readerAppName = reader.appName ?? `${config.siteId}-reader`;
+    const readerBranchName = reader.branchName ?? "main";
+
+    const readerServiceRole = new iam.Role(this, "ReaderServiceRole", {
+      assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
+      description: `Static reader build role for Amplify app ${readerAppName} (reads published media only; content is read as a Cognito guest)`,
+    });
+    readerServiceRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "ReadMediaForExport",
+        actions: ["s3:GetObject"],
+        resources: ["arn:aws:s3:::amplify-*/media/*"],
+      }),
+    );
+
+    const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+      name: readerAppName,
+      description: `Papyrus static reader for ${config.siteId} (WEB)`,
+      platform: "WEB",
+      iamServiceRole: readerServiceRole.roleArn,
+      buildSpec: readerBuildSpec(config),
+    });
+
+    const readerBranch = new amplify.CfnBranch(this, "ReaderBranch", {
+      appId: readerApp.attrAppId,
+      branchName: readerBranchName,
+      stage: "PRODUCTION",
+      enableAutoBuild: true,
+      environmentVariables: environmentVariables({
+        ...(reader.environment ?? {}),
+        PAPYRUS_SITE_BRAND: config.brand,
+        SITE_ENV: "production",
+      }),
+    });
+
+    if (reader.domainName) {
+      const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
+        appId: readerApp.attrAppId,
+        domainName: reader.domainName,
+        subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+      });
+      readerDomain.addResourceDependency(readerBranch);
+    }
+
+    new CfnOutput(this, "ReaderAppId", { value: readerApp.attrAppId, description: `Amplify app id for ${readerAppName}` });
+    new CfnOutput(this, "ReaderOrigin", {
+      value: reader.domainName
+        ? `https://${reader.domainName}/`
+        : Fn.join("", [`https://${readerBranchName}.`, readerApp.attrDefaultDomain, "/"]),
+    });
+    return readerApp.attrAppId;
+  }
+}

package/infra/build-specs.js

@@ -0,0 +1,85 @@
+import { resolveStoragePreviewPrefix } from "./site-config.js";
+export function papyrusVersionToPep440(version) {
+    const match = /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z-]+\.(\d+))?$/.exec(version);
+    if (!match)
+        throw new Error(`cannot map ${version} to PEP 440`);
+    return match[2] === undefined ? match[1] : `${match[1]}.dev${match[2]}`;
+}
+function yamlScalar(command) {
+    const needsQuoting = /: | #|^[-?:,\[\]{}#&*!|>'"%@`]|:$/.test(command);
+    return needsQuoting ? `'${command.replace(/'/g, "''")}'` : command;
+}
+function commandLines(commands, indent) {
+    return commands.map((command) => `${indent}- ${yamlScalar(command)}`);
+}
+const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
+const FRONTEND_ENVIRONMENT_CAPTURE = "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
+function pythonProvisioningCommands(config) {
+    return [
+        "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
+        "curl -LsSf https://astral.sh/uv/install.sh | sh",
+        "export PATH=\"$HOME/.local/bin:$PATH\"",
+        "uv python install 3.12",
+        "uv venv --python 3.12 .venv",
+        `uv pip install --python .venv "papyrus-newsroom[markus]==${papyrusVersionToPep440(config.papyrusVersion)}"`,
+        "export PATH=\"$PWD/.venv/bin:$PATH\"",
+    ];
+}
+function reader(config) {
+    if (!config.reader)
+        throw new Error(`site ${config.siteId} has no reader app (frontend ${config.frontend})`);
+    return config.reader;
+}
+function frontendSection(preBuildCommands, buildCommands, artifactsDirectory, cachePaths) {
+    const lines = ["frontend:", "  phases:"];
+    if (preBuildCommands.length > 0) {
+        lines.push("    preBuild:", "      commands:", ...commandLines(preBuildCommands, "        "));
+    }
+    lines.push("    build:", "      commands:", ...commandLines(buildCommands, "        "), "  artifacts:", `    baseDirectory: ${artifactsDirectory}`, "    files:", "      - '**/*'", "  cache:", "    paths:", ...cachePaths.map((cachePath) => `      - ${cachePath}`));
+    return lines;
+}
+export function cmsProductionBuildSpec(config) {
+    return [
+        "version: 1",
+        "backend:",
+        "  phases:",
+        "    build:",
+        "      commands:",
+        ...commandLines([
+            NPM_CLEAN_INSTALL,
+            "if [ -z \"${PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI:-}\" ]; then export PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD=true; fi",
+            "npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID",
+        ], "        "),
+        ...frontendSection([], [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"], ".next", [".next/cache/**/*", ".npm/**/*"]),
+    ].join("\n") + "\n";
+}
+export function cmsStagingBuildSpec(config) {
+    const preBuild = [NPM_CLEAN_INSTALL, "npx ampx generate outputs --branch main --app-id $AWS_APP_ID"];
+    const cachePaths = [".next/cache/**/*", ".npm/**/*"];
+    if (config.frontend === "markus-static") {
+        const readerConfig = reader(config);
+        preBuild.push(...pythonProvisioningCommands(config), "papyrus auth refresh-jwt --write-env .env", "papyrus ops content export-published --drafts --out content-export --clean", readerConfig.buildCommand, `papyrus ops content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`);
+        cachePaths.push(".uv-cache/**/*");
+    }
+    return [
+        "version: 1",
+        ...frontendSection(preBuild, [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"], ".next", cachePaths),
+    ].join("\n") + "\n";
+}
+export function readerBuildSpec(config) {
+    const readerConfig = reader(config);
+    return [
+        "version: 1",
+        ...frontendSection([
+            ...pythonProvisioningCommands(config),
+            "papyrus ops content export-published --auth guest --out content-export --clean",
+        ], [readerConfig.buildCommand], readerConfig.baseDirectory, [".uv-cache/**/*"]),
+    ].join("\n") + "\n";
+}
+export function buildSpecFor(config, app) {
+    if (app === "cms-production")
+        return cmsProductionBuildSpec(config);
+    if (app === "cms-staging")
+        return cmsStagingBuildSpec(config);
+    return readerBuildSpec(config);
+}