@anthusai/papyrus 1.0.0-next.19 → 1.0.0-next.20

package/amplify/site-backend-config.ts

@@ -30,7 +30,7 @@ export type PapyrusSiteBackendConfig = {
   reader?: { amplifyAppId: string; branchName?: string };
   /** Lets the newsroom start the `staging` branch build of this CMS app. */
   stagingBuild?: { enabled: boolean };
-  /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (secret `PAPYRUS_REVALIDATE_SECRET`). */
+  /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (authenticated by the SSM secret named in branch variable `PAPYRUS_REVALIDATE_SECRET_PARAMETER`). */
   revalidateBaseUrl?: string;
   features?: {
     consoleResponder?: boolean;

package/amplify/site-backend.js

@@ -336,7 +336,16 @@ export function defineSiteBackend(papyrusSite) {
     }
     if ((site.revalidateBaseUrl ?? "").trim() !== "") {
         backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
-        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET", secret("PAPYRUS_REVALIDATE_SECRET"));
+        const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+        if (!revalidateSecretParameter.startsWith("/")) {
+            throw new Error("revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.");
+        }
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+        const revalidateStack = Stack.of(contentActionsLambda);
+        contentActionsLambda.addToRolePolicy(new PolicyStatement({
+            actions: ["ssm:GetParameter"],
+            resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+        }));
     }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);

package/amplify/site-backend.ts

@@ -416,7 +416,20 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   }
   if ((site.revalidateBaseUrl ?? "").trim() !== "") {
     backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
-    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET", secret("PAPYRUS_REVALIDATE_SECRET"));
+    const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+    if (!revalidateSecretParameter.startsWith("/")) {
+      throw new Error(
+        "revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.",
+      );
+    }
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+    const revalidateStack = Stack.of(contentActionsLambda);
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement({
+        actions: ["ssm:GetParameter"],
+        resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+      }),
+    );
   }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);

package/app/api/revalidate/route.ts

@@ -9,6 +9,7 @@ import {
   editionContentCacheTag,
   editionItemCacheTag,
 } from "../../../lib/cached-content-repository";
+import { isAuthorizedRevalidateRequest } from "../../../lib/revalidate-secret";
 import { getEditionArticlePath, getEditionDatePath } from "../../../lib/edition-routes";
 
 export const dynamic = "force-dynamic";
@@ -22,9 +23,8 @@ type RevalidateRequestBody = {
 };
 
 export async function POST(request: Request) {
-  const configuredSecret = process.env.PAPYRUS_REVALIDATE_SECRET?.trim();
-  const providedSecret = request.headers.get("x-papyrus-revalidate-secret")?.trim();
-  if (!configuredSecret || providedSecret !== configuredSecret) {
+  const providedSecret = request.headers.get("x-papyrus-revalidate-secret");
+  if (!(await isAuthorizedRevalidateRequest(providedSecret))) {
     return NextResponse.json({ ok: false, error: "Unauthorized." }, { status: 401 });
   }
 

package/infra/amplify-app-shell.js

@@ -3,7 +3,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { isStagingEnabled, resolveCmsHostName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -55,6 +55,16 @@ export class AmplifyAppShellStack extends Stack {
                 iam.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchLogsFullAccess"),
             ],
         });
+        const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
+        if (revalidateSecretParameterName) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "ReadRevalidateSecret",
+                actions: ["ssm:GetParameter"],
+                resources: [
+                    this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                ],
+            }));
+        }
         const cmsApp = new amplify.CfnApp(this, "App", {
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -63,7 +73,14 @@ export class AmplifyAppShellStack extends Stack {
             computeRoleArn: computeRole.roleArn,
             buildSpec: cmsProductionBuildSpec(config),
             jobConfig: config.cms.buildComputeType ? { buildComputeType: config.cms.buildComputeType } : undefined,
-            customRules: [{ source: "/<*>", target: "/index.html", status: "404-200" }],
+            customRules: [
+                ...(config.cms.redirects ?? []).map((redirect) => ({
+                    source: `https://${redirect.source}`,
+                    target: `https://${resolveCmsHostName(config)}`,
+                    status: String(redirect.status),
+                })),
+                { source: "/<*>", target: "/index.html", status: "404-200" },
+            ],
         });
         const stagingMode = config.frontend === "markus-static"
             ? { PAPYRUS_STAGING_PREVIEW: "static" }
@@ -96,6 +113,7 @@ export class AmplifyAppShellStack extends Stack {
                 PAPYRUS_SITE_BRAND: config.brand,
                 SITE_ENV: "production",
                 PAPYRUS_CONTENT_SOURCE: "published",
+                ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
             }),
         });
         let stagingBranch;
@@ -133,6 +151,10 @@ export class AmplifyAppShellStack extends Stack {
             const subDomainSettings = sharedRootDomain
                 ? [
                     { branchName: "main", prefix: config.cms.domainPrefix },
+                    ...(config.cms.redirects ?? []).map((redirect) => ({
+                        branchName: "main",
+                        prefix: resolveRedirectSubDomainPrefix(config.cms.domainName, redirect.source),
+                    })),
                     ...(stagingBranch ? [{ branchName: "staging", prefix: config.cms.stagingDomainPrefix }] : []),
                 ]
                 : [{ branchName: "main", prefix: "" }];

package/infra/amplify-app-shell.ts

@@ -4,7 +4,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveCmsHostName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -63,6 +63,19 @@ export class AmplifyAppShellStack extends Stack {
       ],
     });
 
+    const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
+    if (revalidateSecretParameterName) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "ReadRevalidateSecret",
+          actions: ["ssm:GetParameter"],
+          resources: [
+            this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          ],
+        }),
+      );
+    }
+
     const cmsApp = new amplify.CfnApp(this, "App", {
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -71,7 +84,14 @@ export class AmplifyAppShellStack extends Stack {
       computeRoleArn: computeRole.roleArn,
       buildSpec: cmsProductionBuildSpec(config),
       jobConfig: config.cms.buildComputeType ? { buildComputeType: config.cms.buildComputeType } : undefined,
-      customRules: [{ source: "/<*>", target: "/index.html", status: "404-200" }],
+      customRules: [
+        ...(config.cms.redirects ?? []).map((redirect) => ({
+          source: `https://${redirect.source}`,
+          target: `https://${resolveCmsHostName(config)}`,
+          status: String(redirect.status),
+        })),
+        { source: "/<*>", target: "/index.html", status: "404-200" },
+      ],
     });
 
     const stagingMode: Record<string, string> = config.frontend === "markus-static"
@@ -107,6 +127,7 @@ export class AmplifyAppShellStack extends Stack {
         PAPYRUS_SITE_BRAND: config.brand,
         SITE_ENV: "production",
         PAPYRUS_CONTENT_SOURCE: "published",
+        ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
       }),
     });
 
@@ -147,6 +168,10 @@ export class AmplifyAppShellStack extends Stack {
       const subDomainSettings = sharedRootDomain
         ? [
             { branchName: "main", prefix: config.cms.domainPrefix as string },
+            ...(config.cms.redirects ?? []).map((redirect) => ({
+              branchName: "main",
+              prefix: resolveRedirectSubDomainPrefix(config.cms.domainName as string, redirect.source),
+            })),
             ...(stagingBranch ? [{ branchName: "staging", prefix: config.cms.stagingDomainPrefix as string }] : []),
           ]
         : [{ branchName: "main", prefix: "" }];

package/infra/build-specs.js

@@ -15,6 +15,10 @@ function commandLines(commands, indent) {
 const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
 const FRONTEND_ENVIRONMENT_CAPTURE = "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
 const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
+const STAGING_RUNTIME_OUTPUTS_COMMANDS = [
+    "cp amplify_outputs.json .next/amplify_outputs.json",
+    "echo PAPYRUS_AMPLIFY_OUTPUTS=.next/amplify_outputs.json >> .env.production",
+];
 function pythonProvisioningCommands(config) {
     return [
         "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -64,7 +68,11 @@ export function cmsStagingBuildSpec(config) {
     }
     return [
         "version: 1",
-        ...frontendSection(preBuild, [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"], ".next", cachePaths),
+        ...frontendSection(preBuild, [
+            FRONTEND_ENVIRONMENT_CAPTURE,
+            "npx papyrus-app sync && npm run build",
+            ...STAGING_RUNTIME_OUTPUTS_COMMANDS,
+        ], ".next", cachePaths),
     ].join("\n") + "\n";
 }
 export function readerBuildSpec(config) {

package/infra/build-specs.ts

@@ -24,6 +24,11 @@ const FRONTEND_ENVIRONMENT_CAPTURE =
 
 const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
 
+const STAGING_RUNTIME_OUTPUTS_COMMANDS = [
+  "cp amplify_outputs.json .next/amplify_outputs.json",
+  "echo PAPYRUS_AMPLIFY_OUTPUTS=.next/amplify_outputs.json >> .env.production",
+];
+
 function pythonProvisioningCommands(config: AmplifyAppShellSiteConfig): string[] {
   return [
     "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -102,7 +107,11 @@ export function cmsStagingBuildSpec(config: AmplifyAppShellSiteConfig): string {
     "version: 1",
     ...frontendSection(
       preBuild,
-      [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"],
+      [
+        FRONTEND_ENVIRONMENT_CAPTURE,
+        "npx papyrus-app sync && npm run build",
+        ...STAGING_RUNTIME_OUTPUTS_COMMANDS,
+      ],
       ".next",
       cachePaths,
     ),

package/infra/site-config.js

@@ -12,7 +12,10 @@ const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+export function resolveRevalidateSecretParameterName(config) {
+    return `/papyrus/${config.siteId}/revalidate-secret`;
+}
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 function fail(field, problem) {
     throw new Error(`site.json: ${field} ${problem}`);
@@ -51,6 +54,25 @@ function rejectUnknownKeys(record, allowed, field) {
             fail(`${field}.${key}`, `is not a known field (known: ${allowed.join(", ")})`);
     }
 }
+function parseRedirects(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("cms.redirects", "must be a non-empty array");
+    return value.map((entry, index) => {
+        const field = `cms.redirects[${index}]`;
+        const record = requireObject(entry, field);
+        rejectUnknownKeys(record, ["source", "status"], field);
+        const source = requireString(record.source, `${field}.source`, HOST_NAME_PATTERN, "host name without scheme or path");
+        const status = record.status ?? 301;
+        if (status !== 301 && status !== 302)
+            fail(`${field}.status`, `must be 301 or 302, got ${JSON.stringify(status)}`);
+        return { source, status };
+    });
+}
+export function resolveRedirectSubDomainPrefix(rootDomain, source) {
+    return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
+}
 export function isStagingEnabled(config) {
     return config.cms.staging !== false;
 }
@@ -93,7 +115,7 @@ export function parseSiteConfig(raw) {
     const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
     const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
     const cmsRecord = requireObject(record.cms, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -115,6 +137,7 @@ export function parseSiteConfig(raw) {
         environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
         stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
         stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+        redirects: parseRedirects(cmsRecord.redirects),
     };
     const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
     if (reservedWord) {
@@ -122,7 +145,7 @@ export function parseSiteConfig(raw) {
     }
     for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
         if (key in cms.environment) {
-            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on and the Cognito domain comes from cms.cognitoDomainPrefix");
+            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
         }
     }
     if (cms.staging === false && cms.stagingDomainName) {
@@ -149,6 +172,24 @@ export function parseSiteConfig(raw) {
     if (cms.domainPrefix && cms.stagingDomainPrefix === cms.domainPrefix) {
         fail("cms.stagingDomainPrefix", "must differ from cms.domainPrefix");
     }
+    if (cms.redirects) {
+        if (!cms.domainPrefix)
+            fail("cms.redirects", "requires cms.domainPrefix (redirects target the primary host under a shared root domain)");
+        cms.redirects.forEach((redirect, index) => {
+            const field = `cms.redirects[${index}].source`;
+            const root = cms.domainName;
+            if (redirect.source !== root && !(redirect.source.endsWith(`.${root}`) && DOMAIN_PREFIX_PATTERN.test(redirect.source.slice(0, -root.length - 1)))) {
+                fail(field, `must be the root domain ${root} or a single label under it: ${JSON.stringify(redirect.source)}`);
+            }
+            if (redirect.source === resolveCmsHostName({ cms }))
+                fail(field, "must differ from the primary host");
+            if (redirect.source === resolveStagingDomainName({ cms }))
+                fail(field, "must differ from the staging host");
+        });
+        if (new Set(cms.redirects.map((redirect) => redirect.source)).size !== cms.redirects.length) {
+            fail("cms.redirects", "must not repeat a source");
+        }
+    }
     let reader;
     if (record.reader !== undefined) {
         if (frontend !== "markus-static")

package/infra/site-config.ts

@@ -1,3 +1,8 @@
+export type CmsRedirect = {
+  source: string;
+  status: 301 | 302;
+};
+
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
@@ -16,6 +21,7 @@ export type AmplifyAppShellSiteConfig = {
     environment: Record<string, string>;
     stagingDomainName?: string;
     stagingDomainPrefix?: string;
+    redirects?: CmsRedirect[];
   };
   reader?: {
     appName?: string;
@@ -50,7 +56,11 @@ const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+export function resolveRevalidateSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
+  return `/papyrus/${config.siteId}/revalidate-secret`;
+}
+
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 
 function fail(field: string, problem: string): never {
@@ -94,6 +104,24 @@ function rejectUnknownKeys(record: Record<string, unknown>, allowed: string[], f
   }
 }
 
+function parseRedirects(value: unknown): CmsRedirect[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("cms.redirects", "must be a non-empty array");
+  return (value as unknown[]).map((entry, index) => {
+    const field = `cms.redirects[${index}]`;
+    const record = requireObject(entry, field);
+    rejectUnknownKeys(record, ["source", "status"], field);
+    const source = requireString(record.source, `${field}.source`, HOST_NAME_PATTERN, "host name without scheme or path");
+    const status = record.status ?? 301;
+    if (status !== 301 && status !== 302) fail(`${field}.status`, `must be 301 or 302, got ${JSON.stringify(status)}`);
+    return { source, status };
+  });
+}
+
+export function resolveRedirectSubDomainPrefix(rootDomain: string, source: string): string {
+  return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
+}
+
 export function isStagingEnabled(config: Pick<AmplifyAppShellSiteConfig, "cms">): boolean {
   return config.cms.staging !== false;
 }
@@ -143,7 +171,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
 
   const cmsRecord = requireObject(record.cms, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -170,6 +198,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
     stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
     stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+    redirects: parseRedirects(cmsRecord.redirects),
   };
 
   const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
@@ -178,7 +207,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   }
   for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
     if (key in cms.environment) {
-      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on and the Cognito domain comes from cms.cognitoDomainPrefix");
+      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
     }
   }
 
@@ -207,6 +236,22 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     fail("cms.stagingDomainPrefix", "must differ from cms.domainPrefix");
   }
 
+  if (cms.redirects) {
+    if (!cms.domainPrefix) fail("cms.redirects", "requires cms.domainPrefix (redirects target the primary host under a shared root domain)");
+    cms.redirects.forEach((redirect, index) => {
+      const field = `cms.redirects[${index}].source`;
+      const root = cms.domainName as string;
+      if (redirect.source !== root && !(redirect.source.endsWith(`.${root}`) && DOMAIN_PREFIX_PATTERN.test(redirect.source.slice(0, -root.length - 1)))) {
+        fail(field, `must be the root domain ${root} or a single label under it: ${JSON.stringify(redirect.source)}`);
+      }
+      if (redirect.source === resolveCmsHostName({ cms })) fail(field, "must differ from the primary host");
+      if (redirect.source === resolveStagingDomainName({ cms })) fail(field, "must differ from the staging host");
+    });
+    if (new Set(cms.redirects.map((redirect) => redirect.source)).size !== cms.redirects.length) {
+      fail("cms.redirects", "must not repeat a source");
+    }
+  }
+
   let reader: AmplifyAppShellSiteConfig["reader"];
   if (record.reader !== undefined) {
     if (frontend !== "markus-static") fail("reader", `is only allowed when frontend is "markus-static"`);

package/lib/revalidate-secret.ts

@@ -0,0 +1,59 @@
+import { timingSafeEqual } from "node:crypto";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+
+export const REVALIDATE_SECRET_PARAMETER_ENV = "PAPYRUS_REVALIDATE_SECRET_PARAMETER";
+export const REVALIDATE_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
+
+export type RevalidateSecretReader = (parameterName: string) => Promise<string | null>;
+
+type CachedSecret = { parameterName: string; value: string; expiresAt: number };
+
+let cachedSecret: CachedSecret | null = null;
+let defaultSsmClient: SSMClient | null = null;
+
+export function resetRevalidateSecretCache(): void {
+  cachedSecret = null;
+}
+
+async function readSecretFromSsm(parameterName: string): Promise<string | null> {
+  defaultSsmClient ??= new SSMClient({});
+  const response = await defaultSsmClient.send(new GetParameterCommand({ Name: parameterName, WithDecryption: true }));
+  const value = response.Parameter?.Value?.trim();
+  return value ? value : null;
+}
+
+export async function loadRevalidateSecret(
+  options: { environment?: Record<string, string | undefined>; readSecret?: RevalidateSecretReader; now?: number } = {},
+): Promise<string | null> {
+  const environment = options.environment ?? process.env;
+  const parameterName = environment[REVALIDATE_SECRET_PARAMETER_ENV]?.trim();
+  if (!parameterName) return null;
+  const now = options.now ?? Date.now();
+  if (cachedSecret && cachedSecret.parameterName === parameterName && cachedSecret.expiresAt > now) {
+    return cachedSecret.value;
+  }
+  try {
+    const value = (await (options.readSecret ?? readSecretFromSsm)(parameterName))?.trim();
+    if (!value) return null;
+    cachedSecret = { parameterName, value, expiresAt: now + REVALIDATE_SECRET_CACHE_MILLISECONDS };
+    return value;
+  } catch (error) {
+    console.error(`Revalidate secret parameter could not be read (${error instanceof Error ? error.name : "error"}).`);
+    return null;
+  }
+}
+
+export function secretsMatch(provided: string | null | undefined, expected: string): boolean {
+  const providedBytes = Buffer.from((provided ?? "").trim());
+  const expectedBytes = Buffer.from(expected);
+  return providedBytes.length === expectedBytes.length && timingSafeEqual(providedBytes, expectedBytes);
+}
+
+export async function isAuthorizedRevalidateRequest(
+  providedSecret: string | null | undefined,
+  options: Parameters<typeof loadRevalidateSecret>[0] = {},
+): Promise<boolean> {
+  const expected = await loadRevalidateSecret(options);
+  if (!expected) return false;
+  return secretsMatch(providedSecret, expected);
+}

package/package.json

@@ -198,6 +198,7 @@
     "./lib/renderer-config": "./lib/renderer-config.ts",
     "./lib/renderer": "./lib/renderer.ts",
     "./lib/reporting-story-budget": "./lib/reporting-story-budget.ts",
+    "./lib/revalidate-secret": "./lib/revalidate-secret.ts",
     "./lib/root-route-redirect": "./lib/root-route-redirect.ts",
     "./lib/semantic-graph": "./lib/semantic-graph.ts",
     "./lib/site-brand-tenant": "./lib/site-brand-tenant.ts",
@@ -291,7 +292,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.19",
+  "version": "1.0.0-next.20",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.19",
+  "version": "1.0.0-next.20",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",