@anthusai/papyrus 1.0.0-next.40 → 1.0.0-next.42

package/infra/amplify-app-shell.js

@@ -3,17 +3,31 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
+function readerCustomHeaders(rules) {
+    if (!rules)
+        return undefined;
+    const lines = ["customHeaders:"];
+    for (const rule of rules) {
+        lines.push(`  - pattern: ${JSON.stringify(rule.pattern)}`, "    headers:");
+        for (const [key, value] of Object.entries(rule.headers)) {
+            lines.push(`      - key: ${JSON.stringify(key)}`, `        value: ${JSON.stringify(value)}`);
+        }
+    }
+    return lines.join("\n") + "\n";
+}
 /**
  * Provisions the Amplify *app shell* of a Papyrus publication from its
  * site.json:
  *
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
- *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`; a
+ *     `markus-static` site may omit `cms` to get the reader app alone (no CMS
+ *     app, no CMS roles, no authoring role)
  *   - a domain association per branch/app when a domain is configured (without
  *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
  *     URL is used), IAM service and compute roles
@@ -38,6 +52,12 @@ export class AmplifyAppShellStack extends Stack {
     readerAppId;
     constructor(scope, id, config, props) {
         super(scope, id, props);
+        if (!hasCmsApp(config)) {
+            if (!config.reader)
+                throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
+            this.readerAppId = this.addReaderApp(config, config.reader);
+            return;
+        }
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
         const stagingEnabled = isStagingEnabled(config);
         const stagingDomainName = resolveStagingDomainName(config);
@@ -180,7 +200,7 @@ export class AmplifyAppShellStack extends Stack {
         const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
         this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
         if (config.github) {
-            this.addGithubCiRole(config, config.github, amplifyAppIds);
+            this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
         }
     }
     authoringStatements(config, cmsAppId, amplifyAppIds) {
@@ -226,7 +246,7 @@ export class AmplifyAppShellStack extends Stack {
             description: `Role the Papyrus CLI assumes for ${config.siteId} (profile role_arn)`,
         });
     }
-    addGithubCiRole(config, github, amplifyAppIds) {
+    addGithubCiRole(config, github, cmsAppId, amplifyAppIds) {
         const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubOidcProvider", this.formatArn({
             service: "iam",
             region: "",
@@ -245,7 +265,7 @@ export class AmplifyAppShellStack extends Stack {
                 },
             }),
         });
-        for (const statement of this.authoringStatements(config, this.cmsAppId, amplifyAppIds)) {
+        for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
             ciRole.addToPolicy(statement);
         }
         ciRole.addToPolicy(new iam.PolicyStatement({
@@ -282,7 +302,11 @@ export class AmplifyAppShellStack extends Stack {
             platform: "WEB",
             iamServiceRole: readerServiceRole.roleArn,
             buildSpec: readerBuildSpec(config),
-            customRules: [{ source: "/<*>", target: "/404.html", status: "404-200" }],
+            customRules: [
+                ...(reader.redirects ?? []),
+                { source: "/<*>", target: "/404.html", status: "404-200" },
+            ],
+            customHeaders: readerCustomHeaders(reader.customHeaders),
         });
         const readerBranch = new amplify.CfnBranch(this, "ReaderBranch", {
             appId: readerApp.attrAppId,
@@ -299,7 +323,7 @@ export class AmplifyAppShellStack extends Stack {
             const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
                 appId: readerApp.attrAppId,
                 domainName: reader.domainName,
-                subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+                subDomainSettings: (reader.domainPrefixes ?? [""]).map((prefix) => ({ branchName: readerBranchName, prefix })),
             });
             readerDomain.addResourceDependency(readerBranch);
         }

package/infra/amplify-app-shell.ts

@@ -4,19 +4,33 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
 
+function readerCustomHeaders(rules: ReaderCustomHeaderRule[] | undefined): string | undefined {
+  if (!rules) return undefined;
+  const lines = ["customHeaders:"];
+  for (const rule of rules) {
+    lines.push(`  - pattern: ${JSON.stringify(rule.pattern)}`, "    headers:");
+    for (const [key, value] of Object.entries(rule.headers)) {
+      lines.push(`      - key: ${JSON.stringify(key)}`, `        value: ${JSON.stringify(value)}`);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+
 /**
  * Provisions the Amplify *app shell* of a Papyrus publication from its
  * site.json:
  *
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
- *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`; a
+ *     `markus-static` site may omit `cms` to get the reader app alone (no CMS
+ *     app, no CMS roles, no authoring role)
  *   - a domain association per branch/app when a domain is configured (without
  *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
  *     URL is used), IAM service and compute roles
@@ -37,12 +51,18 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * app by `ampx pipeline-deploy` from the production build.
  */
 export class AmplifyAppShellStack extends Stack {
-  public readonly cmsAppId: string;
+  public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
 
   constructor(scope: Construct, id: string, config: AmplifyAppShellSiteConfig, props?: StackProps) {
     super(scope, id, props);
 
+    if (!hasCmsApp(config)) {
+      if (!config.reader) throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
+      this.readerAppId = this.addReaderApp(config, config.reader);
+      return;
+    }
+
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
     const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
@@ -201,7 +221,7 @@ export class AmplifyAppShellStack extends Stack {
     this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
 
     if (config.github) {
-      this.addGithubCiRole(config, config.github, amplifyAppIds);
+      this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
     }
   }
 
@@ -255,6 +275,7 @@ export class AmplifyAppShellStack extends Stack {
   private addGithubCiRole(
     config: AmplifyAppShellSiteConfig,
     github: NonNullable<AmplifyAppShellSiteConfig["github"]>,
+    cmsAppId: string,
     amplifyAppIds: string[],
   ): void {
     const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
@@ -283,7 +304,7 @@ export class AmplifyAppShellStack extends Stack {
       }),
     });
 
-    for (const statement of this.authoringStatements(config, this.cmsAppId, amplifyAppIds)) {
+    for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
       ciRole.addToPolicy(statement);
     }
     ciRole.addToPolicy(
@@ -333,7 +354,11 @@ export class AmplifyAppShellStack extends Stack {
       platform: "WEB",
       iamServiceRole: readerServiceRole.roleArn,
       buildSpec: readerBuildSpec(config),
-      customRules: [{ source: "/<*>", target: "/404.html", status: "404-200" }],
+      customRules: [
+        ...(reader.redirects ?? []),
+        { source: "/<*>", target: "/404.html", status: "404-200" },
+      ],
+      customHeaders: readerCustomHeaders(reader.customHeaders),
     });
 
     const readerBranch = new amplify.CfnBranch(this, "ReaderBranch", {
@@ -352,7 +377,7 @@ export class AmplifyAppShellStack extends Stack {
       const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
         appId: readerApp.attrAppId,
         domainName: reader.domainName,
-        subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+        subDomainSettings: (reader.domainPrefixes ?? [""]).map((prefix) => ({ branchName: readerBranchName, prefix })),
       });
       readerDomain.addResourceDependency(readerBranch);
     }

package/infra/build-specs.js

@@ -1,4 +1,4 @@
-import { resolveStoragePreviewPrefix } from "./site-config.js";
+import { hasCmsApp, resolveStoragePreviewPrefix } from "./site-config.js";
 export function papyrusVersionToPep440(version) {
     const match = /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z-]+\.(\d+))?$/.exec(version);
     if (!match)
@@ -82,11 +82,14 @@ export function readerBuildSpec(config) {
         "version: 1",
         ...frontendSection([
             ...pythonProvisioningCommands(config),
-            "papyrus ops content export-published --auth guest --out content-export --clean",
+            ...(readerConfig.preBuildCommands ?? []),
+            ...(readerConfig.skipContentExport ? [] : ["papyrus ops content export-published --auth guest --out content-export --clean"]),
         ], [readerConfig.buildCommand], readerConfig.baseDirectory, [".uv-cache/**/*"]),
     ].join("\n") + "\n";
 }
 export function buildSpecFor(config, app) {
+    if (app !== "reader" && !hasCmsApp(config))
+        throw new Error(`site ${config.siteId} has no cms app`);
     if (app === "cms-production")
         return cmsProductionBuildSpec(config);
     if (app === "cms-staging")

package/infra/build-specs.ts

@@ -1,4 +1,4 @@
-import { AmplifyAppShellSiteConfig, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, hasCmsApp, resolveStoragePreviewPrefix } from "./site-config";
 
 export type BuildSpecAppName = "cms-production" | "cms-staging" | "reader";
 
@@ -126,7 +126,8 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
     ...frontendSection(
       [
         ...pythonProvisioningCommands(config),
-        "papyrus ops content export-published --auth guest --out content-export --clean",
+        ...(readerConfig.preBuildCommands ?? []),
+        ...(readerConfig.skipContentExport ? [] : ["papyrus ops content export-published --auth guest --out content-export --clean"]),
       ],
       [readerConfig.buildCommand],
       readerConfig.baseDirectory,
@@ -136,6 +137,7 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
 }
 
 export function buildSpecFor(config: AmplifyAppShellSiteConfig, app: BuildSpecAppName): string {
+  if (app !== "reader" && !hasCmsApp(config)) throw new Error(`site ${config.siteId} has no cms app`);
   if (app === "cms-production") return cmsProductionBuildSpec(config);
   if (app === "cms-staging") return cmsStagingBuildSpec(config);
   return readerBuildSpec(config);

package/infra/site-config.js

@@ -1,3 +1,7 @@
+export const READER_REDIRECT_STATUSES = ["301", "302", "200", "404", "404-200"];
+export function hasCmsApp(config) {
+    return config.cms !== undefined;
+}
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -78,6 +82,63 @@ function parseRedirects(value) {
         return { source, status };
     });
 }
+function parseReaderDomainPrefixes(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.domainPrefixes", "must be a non-empty array");
+    const prefixes = value.map((entry, index) => {
+        const field = `reader.domainPrefixes[${index}]`;
+        if (entry === "")
+            return "";
+        return requireString(entry, field, DOMAIN_PREFIX_PATTERN, 'single DNS label, or "" for the apex');
+    });
+    if (new Set(prefixes).size !== prefixes.length)
+        fail("reader.domainPrefixes", "must not repeat a prefix");
+    return prefixes;
+}
+function parseReaderRedirects(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.redirects", "must be a non-empty array");
+    return value.map((entry, index) => {
+        const field = `reader.redirects[${index}]`;
+        const record = requireObject(entry, field);
+        rejectUnknownKeys(record, ["source", "target", "status"], field);
+        const status = record.status ?? "301";
+        if (typeof status !== "string" || !READER_REDIRECT_STATUSES.includes(status)) {
+            fail(`${field}.status`, `must be one of ${READER_REDIRECT_STATUSES.join(", ")}, got ${JSON.stringify(status)}`);
+        }
+        return {
+            source: requireString(record.source, `${field}.source`),
+            target: requireString(record.target, `${field}.target`),
+            status: status,
+        };
+    });
+}
+function parseReaderCustomHeaders(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.customHeaders", "must be a non-empty array");
+    return value.map((entry, index) => {
+        const field = `reader.customHeaders[${index}]`;
+        const record = requireObject(entry, field);
+        rejectUnknownKeys(record, ["pattern", "headers"], field);
+        const headers = requireStringRecord(record.headers, `${field}.headers`);
+        if (Object.keys(headers).length === 0)
+            fail(`${field}.headers`, "must not be empty");
+        return { pattern: requireString(record.pattern, `${field}.pattern`), headers };
+    });
+}
+function parseReaderPreBuildCommands(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.preBuildCommands", "must be a non-empty array of commands");
+    return value.map((command, index) => requireString(command, `reader.preBuildCommands[${index}]`));
+}
 export function resolveRedirectSubDomainPrefix(rootDomain, source) {
     return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
 }
@@ -108,21 +169,8 @@ export function resolveStackName(config) {
 export function resolveStoragePreviewPrefix(config) {
     return config.storagePreviewPrefix ?? "preview/";
 }
-export function parseSiteConfig(raw) {
-    const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
-    const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
-    const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
-    const brand = requireString(record.brand, "brand");
-    const frontend = requireString(record.frontend, "frontend");
-    if (frontend !== "pretext" && frontend !== "markus-static") {
-        fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
-    }
-    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
-    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
-    const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
-    const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
-    const cmsRecord = requireObject(record.cms, "cms");
+function parseCms(value) {
+    const cmsRecord = requireObject(value, "cms");
     rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
@@ -198,12 +246,50 @@ export function parseSiteConfig(raw) {
             fail("cms.redirects", "must not repeat a source");
         }
     }
+    return cms;
+}
+function validateOauthRedirectUrls(config) {
+    const redirectValue = config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
+    if (redirectValue === undefined)
+        fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
+    const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+    const stagingDomainName = resolveStagingDomainName(config);
+    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
+    const requiredOrigins = [
+        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
+    ];
+    for (const origin of requiredOrigins) {
+        if (!listedOrigins.has(origin)) {
+            fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
+        }
+    }
+}
+export function parseSiteConfig(raw) {
+    const record = requireObject(raw, "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
+    const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+    const brand = requireString(record.brand, "brand");
+    const frontend = requireString(record.frontend, "frontend");
+    if (frontend !== "pretext" && frontend !== "markus-static") {
+        fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
+    }
+    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+    const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
+    const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
+    const cms = record.cms === undefined && frontend === "markus-static" ? undefined : parseCms(record.cms);
     let reader;
     if (record.reader !== undefined) {
         if (frontend !== "markus-static")
             fail("reader", `is only allowed when frontend is "markus-static"`);
         const readerRecord = requireObject(record.reader, "reader");
-        rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
+        rejectUnknownKeys(readerRecord, ["appName", "domainName", "domainPrefixes", "branchName", "buildCommand", "baseDirectory", "environment", "redirects", "customHeaders", "preBuildCommands", "skipContentExport"], "reader");
+        if (readerRecord.skipContentExport !== undefined && typeof readerRecord.skipContentExport !== "boolean") {
+            fail("reader.skipContentExport", `must be a boolean, got ${JSON.stringify(readerRecord.skipContentExport)}`);
+        }
         reader = {
             appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
             domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
@@ -211,13 +297,22 @@ export function parseSiteConfig(raw) {
             buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
             baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
             environment: readerRecord.environment === undefined ? undefined : requireStringRecord(readerRecord.environment, "reader.environment"),
+            domainPrefixes: parseReaderDomainPrefixes(readerRecord.domainPrefixes),
+            redirects: parseReaderRedirects(readerRecord.redirects),
+            customHeaders: parseReaderCustomHeaders(readerRecord.customHeaders),
+            preBuildCommands: parseReaderPreBuildCommands(readerRecord.preBuildCommands),
+            skipContentExport: readerRecord.skipContentExport,
         };
+        if (reader.domainPrefixes && !reader.domainName)
+            fail("reader.domainPrefixes", "requires reader.domainName");
     }
     else if (frontend === "markus-static") {
         fail("reader", `is required when frontend is "markus-static"`);
     }
     let github;
     if (record.github !== undefined) {
+        if (cms === undefined)
+            fail("github", "requires cms (the CI role is scoped to the CMS app)");
         const githubRecord = requireObject(record.github, "github");
         rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
         const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
@@ -225,7 +320,7 @@ export function parseSiteConfig(raw) {
         if (repository !== `https://github.com/${owner}/${repo}`) {
             fail("github", `owner/repo must match repository ${repository}`);
         }
-        let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+        let branches = cms?.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
         if (githubRecord.branches !== undefined) {
             if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
                 fail("github.branches", "must be a non-empty array of branch names");
@@ -242,7 +337,7 @@ export function parseSiteConfig(raw) {
             fail("github.ciCanDeployInfra", "must be a boolean");
         github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra };
     }
-    const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+    const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
     if (hasDomain && hostedZoneId === undefined) {
         fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
     }
@@ -262,21 +357,7 @@ export function parseSiteConfig(raw) {
         storagePreviewPrefix,
         github,
     };
-    const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
-    if (redirectValue === undefined)
-        fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
-    const redirectUrls = redirectValue.split(",").map((url) => url.trim());
-    const stagingDomainName = resolveStagingDomainName(config);
-    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
-    const requiredOrigins = [
-        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
-        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
-        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
-    ];
-    for (const origin of requiredOrigins) {
-        if (!listedOrigins.has(origin)) {
-            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
-        }
-    }
+    if (hasCmsApp(config))
+        validateOauthRedirectUrls(config);
     return config;
 }

package/infra/site-config.ts

@@ -3,6 +3,35 @@ export type CmsRedirect = {
   status: 301 | 302;
 };
 
+export type ReaderRedirectStatus = "301" | "302" | "200" | "404" | "404-200";
+
+export type ReaderRedirect = {
+  source: string;
+  target: string;
+  status: ReaderRedirectStatus;
+};
+
+export type ReaderCustomHeaderRule = {
+  pattern: string;
+  headers: Record<string, string>;
+};
+
+export const READER_REDIRECT_STATUSES: ReaderRedirectStatus[] = ["301", "302", "200", "404", "404-200"];
+
+export type CmsConfig = {
+  appName?: string;
+  domainName?: string;
+  domainPrefix?: string;
+  staging?: boolean;
+  cognitoDomainPrefix: string;
+  applyCognitoDomainPrefix?: boolean;
+  buildComputeType?: "STANDARD" | "STANDARD_8GB";
+  environment: Record<string, string>;
+  stagingDomainName?: string;
+  stagingDomainPrefix?: string;
+  redirects?: CmsRedirect[];
+};
+
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
@@ -10,26 +39,19 @@ export type AmplifyAppShellSiteConfig = {
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
   stackName?: string;
-  cms: {
-    appName?: string;
-    domainName?: string;
-    domainPrefix?: string;
-    staging?: boolean;
-    cognitoDomainPrefix: string;
-    applyCognitoDomainPrefix?: boolean;
-    buildComputeType?: "STANDARD" | "STANDARD_8GB";
-    environment: Record<string, string>;
-    stagingDomainName?: string;
-    stagingDomainPrefix?: string;
-    redirects?: CmsRedirect[];
-  };
+  cms?: CmsConfig;
   reader?: {
     appName?: string;
     domainName?: string;
+    domainPrefixes?: string[];
     branchName?: string;
     buildCommand: string;
     baseDirectory: string;
     environment?: Record<string, string>;
+    redirects?: ReaderRedirect[];
+    customHeaders?: ReaderCustomHeaderRule[];
+    preBuildCommands?: string[];
+    skipContentExport?: boolean;
   };
   papyrusVersion: string;
   storagePreviewPrefix?: string;
@@ -41,6 +63,12 @@ export type AmplifyAppShellSiteConfig = {
   };
 };
 
+export type CmsSiteConfig = AmplifyAppShellSiteConfig & { cms: CmsConfig };
+
+export function hasCmsApp(config: AmplifyAppShellSiteConfig): config is CmsSiteConfig {
+  return config.cms !== undefined;
+}
+
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
@@ -126,20 +154,70 @@ function parseRedirects(value: unknown): CmsRedirect[] | undefined {
   });
 }
 
+function parseReaderDomainPrefixes(value: unknown): string[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.domainPrefixes", "must be a non-empty array");
+  const prefixes = (value as unknown[]).map((entry, index) => {
+    const field = `reader.domainPrefixes[${index}]`;
+    if (entry === "") return "";
+    return requireString(entry, field, DOMAIN_PREFIX_PATTERN, 'single DNS label, or "" for the apex');
+  });
+  if (new Set(prefixes).size !== prefixes.length) fail("reader.domainPrefixes", "must not repeat a prefix");
+  return prefixes;
+}
+
+function parseReaderRedirects(value: unknown): ReaderRedirect[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.redirects", "must be a non-empty array");
+  return (value as unknown[]).map((entry, index) => {
+    const field = `reader.redirects[${index}]`;
+    const record = requireObject(entry, field);
+    rejectUnknownKeys(record, ["source", "target", "status"], field);
+    const status = record.status ?? "301";
+    if (typeof status !== "string" || !READER_REDIRECT_STATUSES.includes(status as ReaderRedirectStatus)) {
+      fail(`${field}.status`, `must be one of ${READER_REDIRECT_STATUSES.join(", ")}, got ${JSON.stringify(status)}`);
+    }
+    return {
+      source: requireString(record.source, `${field}.source`),
+      target: requireString(record.target, `${field}.target`),
+      status: status as ReaderRedirectStatus,
+    };
+  });
+}
+
+function parseReaderCustomHeaders(value: unknown): ReaderCustomHeaderRule[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.customHeaders", "must be a non-empty array");
+  return (value as unknown[]).map((entry, index) => {
+    const field = `reader.customHeaders[${index}]`;
+    const record = requireObject(entry, field);
+    rejectUnknownKeys(record, ["pattern", "headers"], field);
+    const headers = requireStringRecord(record.headers, `${field}.headers`);
+    if (Object.keys(headers).length === 0) fail(`${field}.headers`, "must not be empty");
+    return { pattern: requireString(record.pattern, `${field}.pattern`), headers };
+  });
+}
+
+function parseReaderPreBuildCommands(value: unknown): string[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.preBuildCommands", "must be a non-empty array of commands");
+  return (value as unknown[]).map((command, index) => requireString(command, `reader.preBuildCommands[${index}]`));
+}
+
 export function resolveRedirectSubDomainPrefix(rootDomain: string, source: string): string {
   return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
 }
 
-export function isStagingEnabled(config: Pick<AmplifyAppShellSiteConfig, "cms">): boolean {
+export function isStagingEnabled(config: Pick<CmsSiteConfig, "cms">): boolean {
   return config.cms.staging !== false;
 }
 
-export function resolveCmsHostName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+export function resolveCmsHostName(config: Pick<CmsSiteConfig, "cms">): string | undefined {
   if (!config.cms.domainName) return undefined;
   return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
 }
 
-export function resolveStagingDomainName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+export function resolveStagingDomainName(config: Pick<CmsSiteConfig, "cms">): string | undefined {
   if (!isStagingEnabled(config)) return undefined;
   if (config.cms.domainPrefix) {
     return config.cms.stagingDomainPrefix ? `${config.cms.stagingDomainPrefix}.${config.cms.domainName}` : undefined;
@@ -158,27 +236,8 @@ export function resolveStoragePreviewPrefix(config: Pick<AmplifyAppShellSiteConf
   return config.storagePreviewPrefix ?? "preview/";
 }
 
-export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
-  const record = requireObject(raw, "site");
-  rejectUnknownKeys(
-    record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
-    "site",
-  );
-
-  const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
-  const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
-  const brand = requireString(record.brand, "brand");
-  const frontend = requireString(record.frontend, "frontend");
-  if (frontend !== "pretext" && frontend !== "markus-static") {
-    fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
-  }
-  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
-  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
-  const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
-  const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
-
-  const cmsRecord = requireObject(record.cms, "cms");
+function parseCms(value: unknown): CmsConfig {
+  const cmsRecord = requireObject(value, "cms");
   rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
@@ -190,7 +249,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
     fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
   }
-  const cms: AmplifyAppShellSiteConfig["cms"] = {
+  const cms: CmsConfig = {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
     domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
     domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
@@ -260,11 +319,57 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     }
   }
 
+  return cms;
+}
+
+function validateOauthRedirectUrls(config: CmsSiteConfig): void {
+  const redirectValue = config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
+  if (redirectValue === undefined) fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
+  const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+  const stagingDomainName = resolveStagingDomainName(config);
+  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
+  const requiredOrigins = [
+    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
+  ];
+  for (const origin of requiredOrigins) {
+    if (!listedOrigins.has(origin)) {
+      fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
+    }
+  }
+}
+
+export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
+  const record = requireObject(raw, "site");
+  rejectUnknownKeys(
+    record,
+    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    "site",
+  );
+
+  const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
+  const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+  const brand = requireString(record.brand, "brand");
+  const frontend = requireString(record.frontend, "frontend");
+  if (frontend !== "pretext" && frontend !== "markus-static") {
+    fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
+  }
+  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+  const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
+  const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
+
+  const cms = record.cms === undefined && frontend === "markus-static" ? undefined : parseCms(record.cms);
+
   let reader: AmplifyAppShellSiteConfig["reader"];
   if (record.reader !== undefined) {
     if (frontend !== "markus-static") fail("reader", `is only allowed when frontend is "markus-static"`);
     const readerRecord = requireObject(record.reader, "reader");
-    rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
+    rejectUnknownKeys(readerRecord, ["appName", "domainName", "domainPrefixes", "branchName", "buildCommand", "baseDirectory", "environment", "redirects", "customHeaders", "preBuildCommands", "skipContentExport"], "reader");
+    if (readerRecord.skipContentExport !== undefined && typeof readerRecord.skipContentExport !== "boolean") {
+      fail("reader.skipContentExport", `must be a boolean, got ${JSON.stringify(readerRecord.skipContentExport)}`);
+    }
     reader = {
       appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
       domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
@@ -272,13 +377,20 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
       buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
       baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
       environment: readerRecord.environment === undefined ? undefined : requireStringRecord(readerRecord.environment, "reader.environment"),
+      domainPrefixes: parseReaderDomainPrefixes(readerRecord.domainPrefixes),
+      redirects: parseReaderRedirects(readerRecord.redirects),
+      customHeaders: parseReaderCustomHeaders(readerRecord.customHeaders),
+      preBuildCommands: parseReaderPreBuildCommands(readerRecord.preBuildCommands),
+      skipContentExport: readerRecord.skipContentExport as boolean | undefined,
     };
+    if (reader.domainPrefixes && !reader.domainName) fail("reader.domainPrefixes", "requires reader.domainName");
   } else if (frontend === "markus-static") {
     fail("reader", `is required when frontend is "markus-static"`);
   }
 
   let github: AmplifyAppShellSiteConfig["github"];
   if (record.github !== undefined) {
+    if (cms === undefined) fail("github", "requires cms (the CI role is scoped to the CMS app)");
     const githubRecord = requireObject(record.github, "github");
     rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
     const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
@@ -286,7 +398,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     if (repository !== `https://github.com/${owner}/${repo}`) {
       fail("github", `owner/repo must match repository ${repository}`);
     }
-    let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+    let branches = cms?.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
     if (githubRecord.branches !== undefined) {
       if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
         fail("github.branches", "must be a non-empty array of branch names");
@@ -303,7 +415,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean };
   }
 
-  const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+  const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
   if (hasDomain && hostedZoneId === undefined) {
     fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
   }
@@ -325,21 +437,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     github,
   };
 
-  const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
-  if (redirectValue === undefined) fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
-  const redirectUrls = redirectValue.split(",").map((url) => url.trim());
-  const stagingDomainName = resolveStagingDomainName(config);
-  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
-  const requiredOrigins = [
-    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
-    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
-    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
-  ];
-  for (const origin of requiredOrigins) {
-    if (!listedOrigins.has(origin)) {
-      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
-    }
-  }
+  if (hasCmsApp(config)) validateOauthRedirectUrls(config);
 
   return config;
 }

package/package.json

@@ -302,7 +302,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.40",
+  "version": "1.0.0-next.42",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.40",
+  "version": "1.0.0-next.42",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",