@anthusai/papyrus 1.0.0-next.3 → 1.0.0-next.30

package/amplify/rebuild-trigger-settings.ts

@@ -0,0 +1,42 @@
+/**
+ * Environment and IAM policy for the content-actions Lambda's site triggers.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ */
+export type RebuildTriggerInput = {
+  reader?: { amplifyAppId: string; branchName?: string };
+  stagingBuildEnabled: boolean;
+  cmsAppId: string;
+  region: string;
+  account: string;
+};
+
+export type RebuildTriggerSettings = {
+  environment: Record<string, string>;
+  actions: string[];
+  resources: string[];
+};
+
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+
+function branchJobsArn(input: RebuildTriggerInput, appId: string, branch: string): string {
+  return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+
+export function rebuildTriggerSettings(input: RebuildTriggerInput): RebuildTriggerSettings {
+  const environment: Record<string, string> = {};
+  const resources: string[] = [];
+  const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+  if (readerAppId !== "") {
+    const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+    environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+    environment.PAPYRUS_READER_BRANCH = readerBranch;
+    resources.push(branchJobsArn(input, readerAppId, readerBranch));
+  }
+  const cmsAppId = input.cmsAppId.trim();
+  if (input.stagingBuildEnabled && cmsAppId !== "") {
+    environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+    environment.PAPYRUS_STAGING_BRANCH = "staging";
+    resources.push(branchJobsArn(input, cmsAppId, "staging"));
+  }
+  return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}

package/amplify/site-backend-config.ts

@@ -7,8 +7,13 @@ export type PapyrusAuthConfig = {
   /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
   redirectUrls?: string[];
   disableGoogleOAuth?: boolean;
-  /** Stable Cognito hosted-UI domain prefix. */
+  /** Desired Cognito hosted-UI domain prefix. Only applied when `applyCognitoDomainPrefix` is true. */
   cognitoDomainPrefix?: string;
+  /**
+   * Opt in to the prefix. Off by default because changing a live pool's
+   * domain replaces it and changes the Google redirect URI.
+   */
+  applyCognitoDomainPrefix?: boolean;
 };
 
 export type PapyrusSiteBackendConfig = {
@@ -21,6 +26,12 @@ export type PapyrusSiteBackendConfig = {
    */
   productionAppId?: string;
   auth?: PapyrusAuthConfig;
+  /** Static reader app (Markus-static sites) that a publish rebuilds through IAM `amplify:StartJob`. */
+  reader?: { amplifyAppId: string; branchName?: string };
+  /** Lets the newsroom start the `staging` branch build of this CMS app. */
+  stagingBuild?: { enabled: boolean };
+  /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (authenticated by the SSM secret named in branch variable `PAPYRUS_REVALIDATE_SECRET_PARAMETER`). */
+  revalidateBaseUrl?: string;
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend.js

@@ -12,12 +12,12 @@ import { CfnEventSourceMapping, FunctionUrlAuthType } from "aws-cdk-lib/aws-lamb
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource.js";
 import { contentActions } from "./functions/content-actions/resource.js";
 import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
@@ -76,13 +76,13 @@ export function defineSiteBackend(papyrusSite) {
     const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
     const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
     const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+    const authConfig = site.auth ?? authConfigFromEnv();
     const backend = defineBackend({
         assignmentAction,
-        auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+        auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
         data,
-        graphqlJwtAuthorizer,
         knowledgeQuery,
         manageUserRole,
         modelAttachmentUpload,
@@ -95,6 +95,12 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+    if (authConfig.applyCognitoDomainPrefix === true
+        && requestedCognitoDomainPrefix !== ""
+        && authConfig.disableGoogleOAuth !== true) {
+        applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+    }
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
@@ -138,36 +144,18 @@ export function defineSiteBackend(papyrusSite) {
         const messageThreadTable = backend.data.resources.tables.MessageThread;
         const dataStack = Stack.of(messageTable);
         const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-        const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild;
-        const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-        const jwtAuthorizerVariables = jwtAuthorizerEnvironment
-            && typeof jwtAuthorizerEnvironment === "object"
-            && "variables" in jwtAuthorizerEnvironment
-            ? jwtAuthorizerEnvironment.variables
-            : undefined;
-        const jwtSsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || "";
+        const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
         if (enableConsoleResponder) {
-            const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+            new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
                 messageTable,
                 messageStreamArn,
                 threadTable: messageThreadTable,
                 projectRoot,
                 graphqlEndpoint,
-                amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
                 responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
                 model: process.env.PAPYRUS_CONSOLE_MODEL,
                 prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
             });
-            if (jwtSsmEnvConfig) {
-                consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-            }
-            const jwtSecretSsmParam = process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-                || (productionAppId !== "" && amplifyAppId === productionAppId
-                    ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-                    : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-            consoleChatResponder.responderFunction.addEnvironment("PAPYRUS_JWT_SECRET_SSM_PARAM", jwtSecretSsmParam);
         }
         if (enableSlackAgent) {
             const slackEventsLambda = backend.slackEvents.resources.lambda;
@@ -179,9 +167,9 @@ export function defineSiteBackend(papyrusSite) {
             backend.slackEvents.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackEvents.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
             backend.slackEvents.addEnvironment("PAPYRUS_SLACK_ALLOWED_USER_IDS", (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim());
-            if (jwtSsmEnvConfig) {
-                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+            if (amplifySsmEnvConfig) {
+                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
             }
             backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackDelivery.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
@@ -333,6 +321,32 @@ export function defineSiteBackend(papyrusSite) {
         actions: ["appsync:GraphQL"],
         resources: ["*"],
     }));
+    const rebuildSettings = rebuildTriggerSettings({
+        reader: site.reader,
+        stagingBuildEnabled: site.stagingBuild?.enabled === true,
+        cmsAppId: amplifyAppId,
+        region: Stack.of(contentActionsLambda).region,
+        account: Stack.of(contentActionsLambda).account,
+    });
+    for (const [name, value] of Object.entries(rebuildSettings.environment)) {
+        contentActionsLambda.addEnvironment(name, value);
+    }
+    if (rebuildSettings.resources.length > 0) {
+        contentActionsLambda.addToRolePolicy(new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }));
+    }
+    if ((site.revalidateBaseUrl ?? "").trim() !== "") {
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
+        const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+        if (!revalidateSecretParameter.startsWith("/")) {
+            throw new Error("revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.");
+        }
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+        const revalidateStack = Stack.of(contentActionsLambda);
+        contentActionsLambda.addToRolePolicy(new PolicyStatement({
+            actions: ["ssm:GetParameter"],
+            resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+        }));
+    }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     if (backend.sesInboundReceive) {

package/amplify/site-backend.ts

@@ -8,17 +8,17 @@ import * as route53 from "aws-cdk-lib/aws-route53";
 import * as ses from "aws-cdk-lib/aws-ses";
 import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { CfnEventSourceMapping, CfnFunction, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+import { CfnEventSourceMapping, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource";
 import { contentActions } from "./functions/content-actions/resource";
 import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
@@ -87,13 +87,13 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
   const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
 
+  const authConfig = site.auth ?? authConfigFromEnv();
   const backend = defineBackend({
     assignmentAction,
-    auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+    auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
     data,
-    graphqlJwtAuthorizer,
     knowledgeQuery,
     manageUserRole,
     modelAttachmentUpload,
@@ -107,6 +107,15 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+  if (
+    authConfig.applyCognitoDomainPrefix === true
+    && requestedCognitoDomainPrefix !== ""
+    && authConfig.disableGoogleOAuth !== true
+  ) {
+    applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+  }
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
@@ -159,43 +168,19 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     const messageThreadTable = backend.data.resources.tables.MessageThread;
     const dataStack = Stack.of(messageTable);
     const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-    const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild as CfnFunction | undefined;
-    const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-    const jwtAuthorizerVariables =
-      jwtAuthorizerEnvironment
-      && typeof jwtAuthorizerEnvironment === "object"
-      && "variables" in jwtAuthorizerEnvironment
-        ? (jwtAuthorizerEnvironment as { variables?: Record<string, string> }).variables
-        : undefined;
-    const jwtSsmEnvConfig =
-      process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || "";
+    const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
 
     if (enableConsoleResponder) {
-      const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+      new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
         messageTable,
         messageStreamArn,
         threadTable: messageThreadTable,
         projectRoot,
         graphqlEndpoint,
-        amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
         responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
         model: process.env.PAPYRUS_CONSOLE_MODEL,
         prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
       });
-      if (jwtSsmEnvConfig) {
-        consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-      }
-      const jwtSecretSsmParam =
-        process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-        || (productionAppId !== "" && amplifyAppId === productionAppId
-          ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-          : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-      consoleChatResponder.responderFunction.addEnvironment(
-        "PAPYRUS_JWT_SECRET_SSM_PARAM",
-        jwtSecretSsmParam,
-      );
     }
 
     if (enableSlackAgent) {
@@ -216,9 +201,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         "PAPYRUS_SLACK_ALLOWED_USER_IDS",
         (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim(),
       );
-      if (jwtSsmEnvConfig) {
-        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+      if (amplifySsmEnvConfig) {
+        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
       }
       backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
       backend.slackDelivery.addEnvironment(
@@ -414,6 +399,38 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
       resources: ["*"],
     }),
   );
+  const rebuildSettings = rebuildTriggerSettings({
+    reader: site.reader,
+    stagingBuildEnabled: site.stagingBuild?.enabled === true,
+    cmsAppId: amplifyAppId,
+    region: Stack.of(contentActionsLambda).region,
+    account: Stack.of(contentActionsLambda).account,
+  });
+  for (const [name, value] of Object.entries(rebuildSettings.environment)) {
+    contentActionsLambda.addEnvironment(name, value);
+  }
+  if (rebuildSettings.resources.length > 0) {
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }),
+    );
+  }
+  if ((site.revalidateBaseUrl ?? "").trim() !== "") {
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
+    const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+    if (!revalidateSecretParameter.startsWith("/")) {
+      throw new Error(
+        "revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.",
+      );
+    }
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+    const revalidateStack = Stack.of(contentActionsLambda);
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement({
+        actions: ["ssm:GetParameter"],
+        resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+      }),
+    );
+  }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   if (backend.sesInboundReceive) {

package/amplify/storage/resource.js

@@ -11,6 +11,9 @@ export const storage = defineStorage({
         "corpora/*": [
             allow.groups(["editor", "admin"]).to(["read"]),
         ],
+        "preview/*": [
+            allow.groups(["editor", "admin"]).to(["read"]),
+        ],
         "newsroom/*": [
             allow.groups(["editor", "admin"]).to(["read", "write", "delete"]),
         ],

package/amplify/storage/resource.ts

@@ -12,6 +12,9 @@ export const storage = defineStorage({
     "corpora/*": [
       allow.groups(["editor", "admin"]).to(["read"]),
     ],
+    "preview/*": [
+      allow.groups(["editor", "admin"]).to(["read"]),
+    ],
     "newsroom/*": [
       allow.groups(["editor", "admin"]).to(["read", "write", "delete"]),
     ],

package/app/%5F_preview/[[...path]]/route.ts

@@ -0,0 +1,8 @@
+import type { NextRequest } from "next/server";
+import { streamPreviewObject } from "../../../lib/staging-preview-object";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(request: NextRequest): Promise<Response> {
+  return streamPreviewObject(request.nextUrl.pathname);
+}

package/app/[year]/[month]/[day]/[articleSlug]/page.tsx

@@ -52,10 +52,12 @@ export default async function DateScopedArticlePage({ params }: DateScopedArticl
       editionFooter={{
         editionBasePath,
         entries: buildPresentationFooterEntries(content),
+        sections: content.sections.map((section) => ({ key: section.key, label: section.label })),
         subtitle: SITE_BRAND.footerSubtitleOverride ?? (content.description?.trim() || "Inside Papyrus"),
         title: SITE_BRAND.footerTitle,
       }}
       item={item}
+      videoScript={content.videoScripts?.[item.slug] ?? null}
       backHref={`${editionBasePath}#${item.slug}`}
     />
   );

package/app/[year]/[month]/[day]/edition-route-page.tsx

@@ -1,4 +1,5 @@
 import { notFound, redirect } from "next/navigation";
+import { siteServesNextReaderRoutes } from "../../../../lib/reader-static-params";
 import { getSiteRenderer } from "../../../../lib/site-renderer";
 import type { PresentationTarget } from "../../../../renderers/pretext";
 import { loadCachedEditionContent } from "../../../../lib/cached-content-repository";
@@ -22,6 +23,7 @@ export async function EditionRoutePage({
   lockedPresentation,
   target = { kind: "edition" },
 }: EditionRoutePageProps) {
+  if (!siteServesNextReaderRoutes()) notFound();
   const route = parseEditionDateRoute({ year, month, day });
   if (!route) notFound();
   if (!route.isCanonical) redirect(route.canonicalPath);

package/app/api/media/[...path]/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { buildMediaRouteResponse } from "../../../../lib/media-route-response";
 import { isGuestReadableStoragePath, signStorageUrl } from "../../../../lib/reader-storage-url";
 
 export const dynamic = "force-dynamic";
@@ -16,20 +17,8 @@ export async function GET(_request: Request, context: MediaRouteContext) {
     return NextResponse.json({ error: "Forbidden storage path." }, { status: 403 });
   }
 
-  const signedUrl = await signStorageUrl(storagePath);
-  const upstream = await fetch(signedUrl, { cache: "no-store" });
-  if (!upstream.ok) {
-    return NextResponse.json(
-      { error: `Upstream media fetch failed (${upstream.status}).` },
-      { status: upstream.status === 404 ? 404 : 502 },
-    );
-  }
-
-  const headers = new Headers();
-  const contentType = upstream.headers.get("content-type");
-  if (contentType) {
-    headers.set("content-type", contentType);
-  }
-  headers.set("cache-control", "public, max-age=3600, stale-while-revalidate=86400");
-  return new NextResponse(upstream.body, { status: 200, headers });
+  return buildMediaRouteResponse(storagePath, {
+    signStorageUrl,
+    fetchUpstream: (signedUrl) => fetch(signedUrl, { cache: "no-store" }),
+  });
 }

package/app/api/revalidate/route.ts

@@ -1,3 +1,4 @@
+import { toPublicReaderPath } from "../../../lib/reader-base-path";
 import { revalidatePath, revalidateTag } from "next/cache";
 import { NextResponse } from "next/server";
 import {
@@ -8,6 +9,7 @@ import {
   editionContentCacheTag,
   editionItemCacheTag,
 } from "../../../lib/cached-content-repository";
+import { isAuthorizedRevalidateRequest } from "../../../lib/revalidate-secret";
 import { getEditionArticlePath, getEditionDatePath } from "../../../lib/edition-routes";
 
 export const dynamic = "force-dynamic";
@@ -21,9 +23,8 @@ type RevalidateRequestBody = {
 };
 
 export async function POST(request: Request) {
-  const configuredSecret = process.env.PAPYRUS_REVALIDATE_SECRET?.trim();
-  const providedSecret = request.headers.get("x-papyrus-revalidate-secret")?.trim();
-  if (!configuredSecret || providedSecret !== configuredSecret) {
+  const providedSecret = request.headers.get("x-papyrus-revalidate-secret");
+  if (!(await isAuthorizedRevalidateRequest(providedSecret))) {
     return NextResponse.json({ ok: false, error: "Unauthorized." }, { status: 401 });
   }
 
@@ -44,8 +45,8 @@ export async function POST(request: Request) {
     if (!normalized) continue;
     revalidateTag(articleCacheTag(normalized));
     revalidatedTags.add(articleCacheTag(normalized));
-    revalidatePath(`/articles/${encodeURIComponent(normalized)}`);
-    revalidatedPaths.add(`/articles/${encodeURIComponent(normalized)}`);
+    revalidatePath(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
+    revalidatedPaths.add(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
     if (editionDate) {
       revalidateTag(editionItemCacheTag(editionDate, normalized));
       revalidatedTags.add(editionItemCacheTag(editionDate, normalized));
@@ -76,8 +77,8 @@ export async function POST(request: Request) {
   revalidatedTags.add(ARCHIVE_CACHE_TAG);
   revalidateTag(ARTICLES_CACHE_TAG);
   revalidatedTags.add(ARTICLES_CACHE_TAG);
-  revalidatePath("/archive");
-  revalidatedPaths.add("/archive");
+  revalidatePath(toPublicReaderPath("/archive"));
+  revalidatedPaths.add(toPublicReaderPath("/archive"));
 
   for (const path of body.paths ?? []) {
     const normalized = path.trim();

package/app/articles/[slug]/page.tsx

@@ -1,7 +1,7 @@
 import { notFound } from "next/navigation";
 import { getSiteRenderer } from "../../../lib/site-renderer";
-import { getCachedArticle } from "../../../lib/cached-content-repository";
-import { generateArticleStaticParams } from "../../../lib/reader-static-params";
+import { getCachedArticle, getCachedVideoScript } from "../../../lib/cached-content-repository";
+import { generateArticleStaticParams, siteServesNextReaderRoutes } from "../../../lib/reader-static-params";
 import { SITE_BRAND } from "../../../lib/site-brand";
 
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
@@ -16,6 +16,7 @@ type ArticlePageProps = {
 };
 
 export async function generateMetadata({ params }: ArticlePageProps) {
+  if (!siteServesNextReaderRoutes()) return {};
   const { slug } = await params;
   const article = await getCachedArticle(slug);
   if (!article) return {};
@@ -26,10 +27,11 @@ export async function generateMetadata({ params }: ArticlePageProps) {
 }
 
 export default async function ArticlePage({ params }: ArticlePageProps) {
+  if (!siteServesNextReaderRoutes()) notFound();
   const { slug } = await params;
-  const article = await getCachedArticle(slug);
+  const [article, videoScript] = await Promise.all([getCachedArticle(slug), getCachedVideoScript(slug)]);
   if (!article) notFound();
 
   const siteRenderer = getSiteRenderer();
-  return <siteRenderer.renderArticle article={article} backHref="/" />;
+  return <siteRenderer.renderArticle article={article} videoScript={videoScript} backHref="/" />;
 }