@anthusai/papyrus 1.0.0-next.4 → 1.0.0-next.40

package/infra/site-config.js

@@ -1,10 +1,29 @@
+export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
+const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
+const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
+const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+function originOfRedirectUrl(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return value;
+    }
+}
+export function resolveRevalidateSecretParameterName(config) {
+    return `/papyrus/${config.siteId}/revalidate-secret`;
+}
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 function fail(field, problem) {
     throw new Error(`site.json: ${field} ${problem}`);
@@ -43,18 +62,55 @@ function rejectUnknownKeys(record, allowed, field) {
             fail(`${field}.${key}`, `is not a known field (known: ${allowed.join(", ")})`);
     }
 }
+function parseRedirects(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("cms.redirects", "must be a non-empty array");
+    return value.map((entry, index) => {
+        const field = `cms.redirects[${index}]`;
+        const record = requireObject(entry, field);
+        rejectUnknownKeys(record, ["source", "status"], field);
+        const source = requireString(record.source, `${field}.source`, HOST_NAME_PATTERN, "host name without scheme or path");
+        const status = record.status ?? 301;
+        if (status !== 301 && status !== 302)
+            fail(`${field}.status`, `must be 301 or 302, got ${JSON.stringify(status)}`);
+        return { source, status };
+    });
+}
+export function resolveRedirectSubDomainPrefix(rootDomain, source) {
+    return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
+}
+export function isStagingEnabled(config) {
+    return config.cms.staging !== false;
+}
+export function resolveCmsHostName(config) {
+    if (!config.cms.domainName)
+        return undefined;
+    return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
+}
 export function resolveStagingDomainName(config) {
+    if (!isStagingEnabled(config))
+        return undefined;
+    if (config.cms.domainPrefix) {
+        return config.cms.stagingDomainPrefix ? `${config.cms.stagingDomainPrefix}.${config.cms.domainName}` : undefined;
+    }
     if (config.cms.stagingDomainName)
         return config.cms.stagingDomainName;
+    if (!config.cms.domainName)
+        return undefined;
     const [, ...rest] = config.cms.domainName.split(".");
     return ["staging", ...rest].join(".");
 }
+export function resolveStackName(config) {
+    return config.stackName ?? `amplify-app-shell-${config.siteId}`;
+}
 export function resolveStoragePreviewPrefix(config) {
     return config.storagePreviewPrefix ?? "preview/";
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const brand = requireString(record.brand, "brand");
@@ -62,22 +118,86 @@ export function parseSiteConfig(raw) {
     if (frontend !== "pretext" && frontend !== "markus-static") {
         fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
     }
-    const hostedZoneId = requireString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
     const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
     const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
     const cmsRecord = requireObject(record.cms, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "buildComputeType", "environment", "stagingDomainName"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
     }
+    if (cmsRecord.staging !== undefined && typeof cmsRecord.staging !== "boolean") {
+        fail("cms.staging", `must be a boolean, got ${JSON.stringify(cmsRecord.staging)}`);
+    }
+    if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
+        fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
+    }
     const cms = {
         appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
-        domainName: requireString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+        domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+        domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+        staging: cmsRecord.staging,
+        cognitoDomainPrefix: requireString(cmsRecord.cognitoDomainPrefix, "cms.cognitoDomainPrefix", COGNITO_DOMAIN_PREFIX_PATTERN, "lowercase letters, digits and hyphens; globally unique per region"),
+        applyCognitoDomainPrefix: cmsRecord.applyCognitoDomainPrefix,
         buildComputeType: buildComputeType,
         environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
         stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
+        stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+        redirects: parseRedirects(cmsRecord.redirects),
     };
+    const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
+    if (reservedWord) {
+        fail("cms.cognitoDomainPrefix", `must not contain "${reservedWord}" (Cognito reserves it): ${JSON.stringify(cms.cognitoDomainPrefix)}`);
+    }
+    for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
+        if (key in cms.environment) {
+            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
+        }
+    }
+    if (cms.staging === false && cms.stagingDomainName) {
+        fail("cms.stagingDomainName", "must not be set when cms.staging is false");
+    }
+    if (cms.stagingDomainName && !cms.domainName) {
+        fail("cms.stagingDomainName", "requires cms.domainName");
+    }
+    if (cms.domainPrefix && !cms.domainName) {
+        fail("cms.domainPrefix", "requires cms.domainName (the root domain)");
+    }
+    if (cms.stagingDomainPrefix && !cms.domainPrefix) {
+        fail("cms.stagingDomainPrefix", "requires cms.domainPrefix");
+    }
+    if (cms.domainPrefix && cms.stagingDomainName) {
+        fail("cms.stagingDomainName", "must not be set with cms.domainPrefix: use cms.stagingDomainPrefix");
+    }
+    if (cms.staging === false && cms.stagingDomainPrefix) {
+        fail("cms.stagingDomainPrefix", "must not be set when cms.staging is false");
+    }
+    if (cms.domainPrefix && cms.staging !== false && !cms.stagingDomainPrefix) {
+        fail("cms.stagingDomainPrefix", "is required when cms.domainPrefix is set and staging is enabled: the staging host is never derived under a shared root domain");
+    }
+    if (cms.domainPrefix && cms.stagingDomainPrefix === cms.domainPrefix) {
+        fail("cms.stagingDomainPrefix", "must differ from cms.domainPrefix");
+    }
+    if (cms.redirects) {
+        if (!cms.domainPrefix)
+            fail("cms.redirects", "requires cms.domainPrefix (redirects target the primary host under a shared root domain)");
+        cms.redirects.forEach((redirect, index) => {
+            const field = `cms.redirects[${index}].source`;
+            const root = cms.domainName;
+            if (redirect.source !== root && !(redirect.source.endsWith(`.${root}`) && DOMAIN_PREFIX_PATTERN.test(redirect.source.slice(0, -root.length - 1)))) {
+                fail(field, `must be the root domain ${root} or a single label under it: ${JSON.stringify(redirect.source)}`);
+            }
+            if (redirect.source === resolveCmsHostName({ cms }))
+                fail(field, "must differ from the primary host");
+            if (redirect.source === resolveStagingDomainName({ cms }))
+                fail(field, "must differ from the staging host");
+        });
+        if (new Set(cms.redirects.map((redirect) => redirect.source)).size !== cms.redirects.length) {
+            fail("cms.redirects", "must not repeat a source");
+        }
+    }
     let reader;
     if (record.reader !== undefined) {
         if (frontend !== "markus-static")
@@ -86,7 +206,7 @@ export function parseSiteConfig(raw) {
         rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
         reader = {
             appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
-            domainName: requireString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
+            domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
             branchName: optionalString(readerRecord.branchName, "reader.branchName", BRANCH_NAME_PATTERN),
             buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
             baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
@@ -96,29 +216,66 @@ export function parseSiteConfig(raw) {
     else if (frontend === "markus-static") {
         fail("reader", `is required when frontend is "markus-static"`);
     }
+    let github;
+    if (record.github !== undefined) {
+        const githubRecord = requireObject(record.github, "github");
+        rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
+        const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
+        const repo = requireString(githubRecord.repo, "github.repo", GITHUB_REPO_PATTERN);
+        if (repository !== `https://github.com/${owner}/${repo}`) {
+            fail("github", `owner/repo must match repository ${repository}`);
+        }
+        let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+        if (githubRecord.branches !== undefined) {
+            if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
+                fail("github.branches", "must be a non-empty array of branch names");
+            }
+            branches = githubRecord.branches.map((branch, index) => {
+                if (typeof branch === "string" && /[*?]/.test(branch)) {
+                    fail(`github.branches[${index}]`, `must not contain wildcards: ${JSON.stringify(branch)}`);
+                }
+                return requireString(branch, `github.branches[${index}]`, BRANCH_NAME_PATTERN);
+            });
+        }
+        const ciCanDeployInfra = githubRecord.ciCanDeployInfra ?? false;
+        if (typeof ciCanDeployInfra !== "boolean")
+            fail("github.ciCanDeployInfra", "must be a boolean");
+        github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra };
+    }
+    const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+    if (hasDomain && hostedZoneId === undefined) {
+        fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
+    }
+    if (!hasDomain && hostedZoneId !== undefined) {
+        fail("hostedZoneId", "is only allowed when cms.domainName or reader.domainName is set");
+    }
     const config = {
         siteId,
         repository,
         brand,
         frontend,
         hostedZoneId,
+        stackName,
         cms,
         reader,
         papyrusVersion,
         storagePreviewPrefix,
+        github,
     };
     const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
     if (redirectValue === undefined)
         fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
     const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+    const stagingDomainName = resolveStagingDomainName(config);
+    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
     const requiredOrigins = [
-        `https://${cms.domainName}/`,
-        `https://${resolveStagingDomainName(config)}/`,
-        LOCAL_DEVELOPMENT_ORIGIN,
+        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
     ];
     for (const origin of requiredOrigins) {
-        if (!redirectUrls.includes(origin)) {
-            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
+        if (!listedOrigins.has(origin)) {
+            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
         }
     }
     return config;

package/infra/site-config.ts

@@ -1,19 +1,31 @@
+export type CmsRedirect = {
+  source: string;
+  status: 301 | 302;
+};
+
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
   brand: string;
   frontend: "pretext" | "markus-static";
-  hostedZoneId: string;
+  hostedZoneId?: string;
+  stackName?: string;
   cms: {
     appName?: string;
-    domainName: string;
+    domainName?: string;
+    domainPrefix?: string;
+    staging?: boolean;
+    cognitoDomainPrefix: string;
+    applyCognitoDomainPrefix?: boolean;
     buildComputeType?: "STANDARD" | "STANDARD_8GB";
     environment: Record<string, string>;
     stagingDomainName?: string;
+    stagingDomainPrefix?: string;
+    redirects?: CmsRedirect[];
   };
   reader?: {
     appName?: string;
-    domainName: string;
+    domainName?: string;
     branchName?: string;
     buildCommand: string;
     baseDirectory: string;
@@ -21,15 +33,42 @@ export type AmplifyAppShellSiteConfig = {
   };
   papyrusVersion: string;
   storagePreviewPrefix?: string;
+  github?: {
+    owner: string;
+    repo: string;
+    branches: string[];
+    ciCanDeployInfra: boolean;
+  };
 };
 
+export const DEFAULT_CI_BRANCHES = ["main", "staging"];
+
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
+const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
+const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
+const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+function originOfRedirectUrl(value: string): string {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return value;
+  }
+}
+
+export function resolveRevalidateSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
+  return `/papyrus/${config.siteId}/revalidate-secret`;
+}
+
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 
 function fail(field: string, problem: string): never {
@@ -73,12 +112,48 @@ function rejectUnknownKeys(record: Record<string, unknown>, allowed: string[], f
   }
 }
 
-export function resolveStagingDomainName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string {
+function parseRedirects(value: unknown): CmsRedirect[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("cms.redirects", "must be a non-empty array");
+  return (value as unknown[]).map((entry, index) => {
+    const field = `cms.redirects[${index}]`;
+    const record = requireObject(entry, field);
+    rejectUnknownKeys(record, ["source", "status"], field);
+    const source = requireString(record.source, `${field}.source`, HOST_NAME_PATTERN, "host name without scheme or path");
+    const status = record.status ?? 301;
+    if (status !== 301 && status !== 302) fail(`${field}.status`, `must be 301 or 302, got ${JSON.stringify(status)}`);
+    return { source, status };
+  });
+}
+
+export function resolveRedirectSubDomainPrefix(rootDomain: string, source: string): string {
+  return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
+}
+
+export function isStagingEnabled(config: Pick<AmplifyAppShellSiteConfig, "cms">): boolean {
+  return config.cms.staging !== false;
+}
+
+export function resolveCmsHostName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+  if (!config.cms.domainName) return undefined;
+  return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
+}
+
+export function resolveStagingDomainName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+  if (!isStagingEnabled(config)) return undefined;
+  if (config.cms.domainPrefix) {
+    return config.cms.stagingDomainPrefix ? `${config.cms.stagingDomainPrefix}.${config.cms.domainName}` : undefined;
+  }
   if (config.cms.stagingDomainName) return config.cms.stagingDomainName;
+  if (!config.cms.domainName) return undefined;
   const [, ...rest] = config.cms.domainName.split(".");
   return ["staging", ...rest].join(".");
 }
 
+export function resolveStackName(config: Pick<AmplifyAppShellSiteConfig, "siteId" | "stackName">): string {
+  return config.stackName ?? `amplify-app-shell-${config.siteId}`;
+}
+
 export function resolveStoragePreviewPrefix(config: Pick<AmplifyAppShellSiteConfig, "storagePreviewPrefix">): string {
   return config.storagePreviewPrefix ?? "preview/";
 }
@@ -87,7 +162,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix"],
+    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
     "site",
   );
 
@@ -98,24 +173,93 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   if (frontend !== "pretext" && frontend !== "markus-static") {
     fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
   }
-  const hostedZoneId = requireString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
   const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
   const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
 
   const cmsRecord = requireObject(record.cms, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "buildComputeType", "environment", "stagingDomainName"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
   }
+  if (cmsRecord.staging !== undefined && typeof cmsRecord.staging !== "boolean") {
+    fail("cms.staging", `must be a boolean, got ${JSON.stringify(cmsRecord.staging)}`);
+  }
+  if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
+    fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
+  }
   const cms: AmplifyAppShellSiteConfig["cms"] = {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
-    domainName: requireString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+    domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+    domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+    staging: cmsRecord.staging as boolean | undefined,
+    cognitoDomainPrefix: requireString(
+      cmsRecord.cognitoDomainPrefix,
+      "cms.cognitoDomainPrefix",
+      COGNITO_DOMAIN_PREFIX_PATTERN,
+      "lowercase letters, digits and hyphens; globally unique per region",
+    ),
+    applyCognitoDomainPrefix: cmsRecord.applyCognitoDomainPrefix as boolean | undefined,
     buildComputeType: buildComputeType as "STANDARD" | "STANDARD_8GB" | undefined,
     environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
     stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
+    stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+    redirects: parseRedirects(cmsRecord.redirects),
   };
 
+  const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
+  if (reservedWord) {
+    fail("cms.cognitoDomainPrefix", `must not contain "${reservedWord}" (Cognito reserves it): ${JSON.stringify(cms.cognitoDomainPrefix)}`);
+  }
+  for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
+    if (key in cms.environment) {
+      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
+    }
+  }
+
+  if (cms.staging === false && cms.stagingDomainName) {
+    fail("cms.stagingDomainName", "must not be set when cms.staging is false");
+  }
+  if (cms.stagingDomainName && !cms.domainName) {
+    fail("cms.stagingDomainName", "requires cms.domainName");
+  }
+  if (cms.domainPrefix && !cms.domainName) {
+    fail("cms.domainPrefix", "requires cms.domainName (the root domain)");
+  }
+  if (cms.stagingDomainPrefix && !cms.domainPrefix) {
+    fail("cms.stagingDomainPrefix", "requires cms.domainPrefix");
+  }
+  if (cms.domainPrefix && cms.stagingDomainName) {
+    fail("cms.stagingDomainName", "must not be set with cms.domainPrefix: use cms.stagingDomainPrefix");
+  }
+  if (cms.staging === false && cms.stagingDomainPrefix) {
+    fail("cms.stagingDomainPrefix", "must not be set when cms.staging is false");
+  }
+  if (cms.domainPrefix && cms.staging !== false && !cms.stagingDomainPrefix) {
+    fail("cms.stagingDomainPrefix", "is required when cms.domainPrefix is set and staging is enabled: the staging host is never derived under a shared root domain");
+  }
+  if (cms.domainPrefix && cms.stagingDomainPrefix === cms.domainPrefix) {
+    fail("cms.stagingDomainPrefix", "must differ from cms.domainPrefix");
+  }
+
+  if (cms.redirects) {
+    if (!cms.domainPrefix) fail("cms.redirects", "requires cms.domainPrefix (redirects target the primary host under a shared root domain)");
+    cms.redirects.forEach((redirect, index) => {
+      const field = `cms.redirects[${index}].source`;
+      const root = cms.domainName as string;
+      if (redirect.source !== root && !(redirect.source.endsWith(`.${root}`) && DOMAIN_PREFIX_PATTERN.test(redirect.source.slice(0, -root.length - 1)))) {
+        fail(field, `must be the root domain ${root} or a single label under it: ${JSON.stringify(redirect.source)}`);
+      }
+      if (redirect.source === resolveCmsHostName({ cms })) fail(field, "must differ from the primary host");
+      if (redirect.source === resolveStagingDomainName({ cms })) fail(field, "must differ from the staging host");
+    });
+    if (new Set(cms.redirects.map((redirect) => redirect.source)).size !== cms.redirects.length) {
+      fail("cms.redirects", "must not repeat a source");
+    }
+  }
+
   let reader: AmplifyAppShellSiteConfig["reader"];
   if (record.reader !== undefined) {
     if (frontend !== "markus-static") fail("reader", `is only allowed when frontend is "markus-static"`);
@@ -123,7 +267,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
     reader = {
       appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
-      domainName: requireString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
+      domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
       branchName: optionalString(readerRecord.branchName, "reader.branchName", BRANCH_NAME_PATTERN),
       buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
       baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
@@ -133,29 +277,67 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     fail("reader", `is required when frontend is "markus-static"`);
   }
 
+  let github: AmplifyAppShellSiteConfig["github"];
+  if (record.github !== undefined) {
+    const githubRecord = requireObject(record.github, "github");
+    rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
+    const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
+    const repo = requireString(githubRecord.repo, "github.repo", GITHUB_REPO_PATTERN);
+    if (repository !== `https://github.com/${owner}/${repo}`) {
+      fail("github", `owner/repo must match repository ${repository}`);
+    }
+    let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+    if (githubRecord.branches !== undefined) {
+      if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
+        fail("github.branches", "must be a non-empty array of branch names");
+      }
+      branches = (githubRecord.branches as unknown[]).map((branch, index) => {
+        if (typeof branch === "string" && /[*?]/.test(branch)) {
+          fail(`github.branches[${index}]`, `must not contain wildcards: ${JSON.stringify(branch)}`);
+        }
+        return requireString(branch, `github.branches[${index}]`, BRANCH_NAME_PATTERN);
+      });
+    }
+    const ciCanDeployInfra = githubRecord.ciCanDeployInfra ?? false;
+    if (typeof ciCanDeployInfra !== "boolean") fail("github.ciCanDeployInfra", "must be a boolean");
+    github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean };
+  }
+
+  const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+  if (hasDomain && hostedZoneId === undefined) {
+    fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
+  }
+  if (!hasDomain && hostedZoneId !== undefined) {
+    fail("hostedZoneId", "is only allowed when cms.domainName or reader.domainName is set");
+  }
+
   const config: AmplifyAppShellSiteConfig = {
     siteId,
     repository,
     brand,
     frontend,
     hostedZoneId,
+    stackName,
     cms,
     reader,
     papyrusVersion,
     storagePreviewPrefix,
+    github,
   };
 
   const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
   if (redirectValue === undefined) fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
   const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+  const stagingDomainName = resolveStagingDomainName(config);
+  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
   const requiredOrigins = [
-    `https://${cms.domainName}/`,
-    `https://${resolveStagingDomainName(config)}/`,
-    LOCAL_DEVELOPMENT_ORIGIN,
+    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
   ];
   for (const origin of requiredOrigins) {
-    if (!redirectUrls.includes(origin)) {
-      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
+    if (!listedOrigins.has(origin)) {
+      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
     }
   }
 

package/lib/amplify-outputs-path.ts

@@ -6,7 +6,11 @@ export function getAmplifyOutputsPath(): string {
   if (explicit) {
     return path.isAbsolute(explicit) ? explicit : path.join(process.cwd(), explicit);
   }
-  return path.join(process.cwd(), "amplify_outputs.json");
+  const checkoutRootPath = path.join(process.cwd(), "amplify_outputs.json");
+  if (fs.existsSync(checkoutRootPath)) return checkoutRootPath;
+  const shippedBundlePath = path.join(process.cwd(), ".next", "amplify_outputs.json");
+  if (fs.existsSync(shippedBundlePath)) return shippedBundlePath;
+  return checkoutRootPath;
 }
 
 export function readAmplifyOutputsFile(): Record<string, unknown> | null {