@anthusai/papyrus 1.0.0-next.41 → 1.0.0-next.43

package/amplify/revalidate-secret-policy.js

@@ -0,0 +1,13 @@
+/**
+ * IAM statement for the content-actions Lambda's read of the revalidate secret.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ * The Lambda reads the parameter through boto3 get_parameters (plural), so the
+ * plural action must be granted alongside the singular one.
+ */
+export const REVALIDATE_SECRET_READ_ACTIONS = ["ssm:GetParameter", "ssm:GetParameters"];
+export function revalidateSecretReadStatement(input) {
+    return {
+        actions: REVALIDATE_SECRET_READ_ACTIONS,
+        resources: [`arn:${input.partition}:ssm:${input.region}:${input.account}:parameter${input.parameterName}`],
+    };
+}

package/amplify/revalidate-secret-policy.ts

@@ -0,0 +1,19 @@
+/**
+ * IAM statement for the content-actions Lambda's read of the revalidate secret.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ * The Lambda reads the parameter through boto3 get_parameters (plural), so the
+ * plural action must be granted alongside the singular one.
+ */
+export const REVALIDATE_SECRET_READ_ACTIONS = ["ssm:GetParameter", "ssm:GetParameters"];
+
+export function revalidateSecretReadStatement(input: {
+  partition: string;
+  region: string;
+  account: string;
+  parameterName: string;
+}): { actions: string[]; resources: string[] } {
+  return {
+    actions: REVALIDATE_SECRET_READ_ACTIONS,
+    resources: [`arn:${input.partition}:ssm:${input.region}:${input.account}:parameter${input.parameterName}`],
+  };
+}

package/amplify/site-backend.js

@@ -8,6 +8,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
@@ -309,10 +310,12 @@ export function defineSiteBackend(papyrusSite) {
         }
         backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
         const revalidateStack = Stack.of(contentActionsLambda);
-        contentActionsLambda.addToRolePolicy(new PolicyStatement({
-            actions: ["ssm:GetParameter"],
-            resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
-        }));
+        contentActionsLambda.addToRolePolicy(new PolicyStatement(revalidateSecretReadStatement({
+            partition: revalidateStack.partition,
+            region: revalidateStack.region,
+            account: revalidateStack.account,
+            parameterName: revalidateSecretParameter,
+        })));
     }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);

package/amplify/site-backend.ts

@@ -11,6 +11,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
@@ -398,10 +399,14 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
     const revalidateStack = Stack.of(contentActionsLambda);
     contentActionsLambda.addToRolePolicy(
-      new PolicyStatement({
-        actions: ["ssm:GetParameter"],
-        resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
-      }),
+      new PolicyStatement(
+        revalidateSecretReadStatement({
+          partition: revalidateStack.partition,
+          region: revalidateStack.region,
+          account: revalidateStack.account,
+          parameterName: revalidateSecretParameter,
+        }),
+      ),
     );
   }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);

package/infra/amplify-app-shell.js

@@ -3,7 +3,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -25,7 +25,9 @@ function readerCustomHeaders(rules) {
  *
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
- *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`; a
+ *     `markus-static` site may omit `cms` to get the reader app alone (no CMS
+ *     app, no CMS roles, no authoring role)
  *   - a domain association per branch/app when a domain is configured (without
  *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
  *     URL is used), IAM service and compute roles
@@ -50,6 +52,12 @@ export class AmplifyAppShellStack extends Stack {
     readerAppId;
     constructor(scope, id, config, props) {
         super(scope, id, props);
+        if (!hasCmsApp(config)) {
+            if (!config.reader)
+                throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
+            this.readerAppId = this.addReaderApp(config, config.reader);
+            return;
+        }
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
         const stagingEnabled = isStagingEnabled(config);
         const stagingDomainName = resolveStagingDomainName(config);
@@ -192,7 +200,7 @@ export class AmplifyAppShellStack extends Stack {
         const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
         this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
         if (config.github) {
-            this.addGithubCiRole(config, config.github, amplifyAppIds);
+            this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
         }
     }
     authoringStatements(config, cmsAppId, amplifyAppIds) {
@@ -238,7 +246,7 @@ export class AmplifyAppShellStack extends Stack {
             description: `Role the Papyrus CLI assumes for ${config.siteId} (profile role_arn)`,
         });
     }
-    addGithubCiRole(config, github, amplifyAppIds) {
+    addGithubCiRole(config, github, cmsAppId, amplifyAppIds) {
         const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubOidcProvider", this.formatArn({
             service: "iam",
             region: "",
@@ -257,7 +265,7 @@ export class AmplifyAppShellStack extends Stack {
                 },
             }),
         });
-        for (const statement of this.authoringStatements(config, this.cmsAppId, amplifyAppIds)) {
+        for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
             ciRole.addToPolicy(statement);
         }
         ciRole.addToPolicy(new iam.PolicyStatement({

package/infra/amplify-app-shell.ts

@@ -4,7 +4,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, ReaderCustomHeaderRule, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -28,7 +28,9 @@ function readerCustomHeaders(rules: ReaderCustomHeaderRule[] | undefined): strin
  *
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
- *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`; a
+ *     `markus-static` site may omit `cms` to get the reader app alone (no CMS
+ *     app, no CMS roles, no authoring role)
  *   - a domain association per branch/app when a domain is configured (without
  *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
  *     URL is used), IAM service and compute roles
@@ -49,12 +51,18 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * app by `ampx pipeline-deploy` from the production build.
  */
 export class AmplifyAppShellStack extends Stack {
-  public readonly cmsAppId: string;
+  public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
 
   constructor(scope: Construct, id: string, config: AmplifyAppShellSiteConfig, props?: StackProps) {
     super(scope, id, props);
 
+    if (!hasCmsApp(config)) {
+      if (!config.reader) throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
+      this.readerAppId = this.addReaderApp(config, config.reader);
+      return;
+    }
+
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
     const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
@@ -213,7 +221,7 @@ export class AmplifyAppShellStack extends Stack {
     this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
 
     if (config.github) {
-      this.addGithubCiRole(config, config.github, amplifyAppIds);
+      this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
     }
   }
 
@@ -267,6 +275,7 @@ export class AmplifyAppShellStack extends Stack {
   private addGithubCiRole(
     config: AmplifyAppShellSiteConfig,
     github: NonNullable<AmplifyAppShellSiteConfig["github"]>,
+    cmsAppId: string,
     amplifyAppIds: string[],
   ): void {
     const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
@@ -295,7 +304,7 @@ export class AmplifyAppShellStack extends Stack {
       }),
     });
 
-    for (const statement of this.authoringStatements(config, this.cmsAppId, amplifyAppIds)) {
+    for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
       ciRole.addToPolicy(statement);
     }
     ciRole.addToPolicy(

package/infra/build-specs.js

@@ -1,4 +1,4 @@
-import { resolveStoragePreviewPrefix } from "./site-config.js";
+import { hasCmsApp, resolveStoragePreviewPrefix } from "./site-config.js";
 export function papyrusVersionToPep440(version) {
     const match = /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z-]+\.(\d+))?$/.exec(version);
     if (!match)
@@ -88,6 +88,8 @@ export function readerBuildSpec(config) {
     ].join("\n") + "\n";
 }
 export function buildSpecFor(config, app) {
+    if (app !== "reader" && !hasCmsApp(config))
+        throw new Error(`site ${config.siteId} has no cms app`);
     if (app === "cms-production")
         return cmsProductionBuildSpec(config);
     if (app === "cms-staging")

package/infra/build-specs.ts

@@ -1,4 +1,4 @@
-import { AmplifyAppShellSiteConfig, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, hasCmsApp, resolveStoragePreviewPrefix } from "./site-config";
 
 export type BuildSpecAppName = "cms-production" | "cms-staging" | "reader";
 
@@ -137,6 +137,7 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
 }
 
 export function buildSpecFor(config: AmplifyAppShellSiteConfig, app: BuildSpecAppName): string {
+  if (app !== "reader" && !hasCmsApp(config)) throw new Error(`site ${config.siteId} has no cms app`);
   if (app === "cms-production") return cmsProductionBuildSpec(config);
   if (app === "cms-staging") return cmsStagingBuildSpec(config);
   return readerBuildSpec(config);

package/infra/site-config.js

@@ -1,4 +1,7 @@
 export const READER_REDIRECT_STATUSES = ["301", "302", "200", "404", "404-200"];
+export function hasCmsApp(config) {
+    return config.cms !== undefined;
+}
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -166,21 +169,8 @@ export function resolveStackName(config) {
 export function resolveStoragePreviewPrefix(config) {
     return config.storagePreviewPrefix ?? "preview/";
 }
-export function parseSiteConfig(raw) {
-    const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
-    const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
-    const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
-    const brand = requireString(record.brand, "brand");
-    const frontend = requireString(record.frontend, "frontend");
-    if (frontend !== "pretext" && frontend !== "markus-static") {
-        fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
-    }
-    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
-    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
-    const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
-    const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
-    const cmsRecord = requireObject(record.cms, "cms");
+function parseCms(value) {
+    const cmsRecord = requireObject(value, "cms");
     rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
@@ -256,6 +246,41 @@ export function parseSiteConfig(raw) {
             fail("cms.redirects", "must not repeat a source");
         }
     }
+    return cms;
+}
+function validateOauthRedirectUrls(config) {
+    const redirectValue = config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
+    if (redirectValue === undefined)
+        fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
+    const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+    const stagingDomainName = resolveStagingDomainName(config);
+    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
+    const requiredOrigins = [
+        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
+    ];
+    for (const origin of requiredOrigins) {
+        if (!listedOrigins.has(origin)) {
+            fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
+        }
+    }
+}
+export function parseSiteConfig(raw) {
+    const record = requireObject(raw, "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
+    const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+    const brand = requireString(record.brand, "brand");
+    const frontend = requireString(record.frontend, "frontend");
+    if (frontend !== "pretext" && frontend !== "markus-static") {
+        fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
+    }
+    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+    const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
+    const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
+    const cms = record.cms === undefined && frontend === "markus-static" ? undefined : parseCms(record.cms);
     let reader;
     if (record.reader !== undefined) {
         if (frontend !== "markus-static")
@@ -286,6 +311,8 @@ export function parseSiteConfig(raw) {
     }
     let github;
     if (record.github !== undefined) {
+        if (cms === undefined)
+            fail("github", "requires cms (the CI role is scoped to the CMS app)");
         const githubRecord = requireObject(record.github, "github");
         rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
         const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
@@ -293,7 +320,7 @@ export function parseSiteConfig(raw) {
         if (repository !== `https://github.com/${owner}/${repo}`) {
             fail("github", `owner/repo must match repository ${repository}`);
         }
-        let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+        let branches = cms?.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
         if (githubRecord.branches !== undefined) {
             if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
                 fail("github.branches", "must be a non-empty array of branch names");
@@ -310,7 +337,7 @@ export function parseSiteConfig(raw) {
             fail("github.ciCanDeployInfra", "must be a boolean");
         github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra };
     }
-    const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+    const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
     if (hasDomain && hostedZoneId === undefined) {
         fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
     }
@@ -330,21 +357,7 @@ export function parseSiteConfig(raw) {
         storagePreviewPrefix,
         github,
     };
-    const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
-    if (redirectValue === undefined)
-        fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
-    const redirectUrls = redirectValue.split(",").map((url) => url.trim());
-    const stagingDomainName = resolveStagingDomainName(config);
-    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
-    const requiredOrigins = [
-        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
-        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
-        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
-    ];
-    for (const origin of requiredOrigins) {
-        if (!listedOrigins.has(origin)) {
-            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
-        }
-    }
+    if (hasCmsApp(config))
+        validateOauthRedirectUrls(config);
     return config;
 }

package/infra/site-config.ts

@@ -18,6 +18,20 @@ export type ReaderCustomHeaderRule = {
 
 export const READER_REDIRECT_STATUSES: ReaderRedirectStatus[] = ["301", "302", "200", "404", "404-200"];
 
+export type CmsConfig = {
+  appName?: string;
+  domainName?: string;
+  domainPrefix?: string;
+  staging?: boolean;
+  cognitoDomainPrefix: string;
+  applyCognitoDomainPrefix?: boolean;
+  buildComputeType?: "STANDARD" | "STANDARD_8GB";
+  environment: Record<string, string>;
+  stagingDomainName?: string;
+  stagingDomainPrefix?: string;
+  redirects?: CmsRedirect[];
+};
+
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
@@ -25,19 +39,7 @@ export type AmplifyAppShellSiteConfig = {
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
   stackName?: string;
-  cms: {
-    appName?: string;
-    domainName?: string;
-    domainPrefix?: string;
-    staging?: boolean;
-    cognitoDomainPrefix: string;
-    applyCognitoDomainPrefix?: boolean;
-    buildComputeType?: "STANDARD" | "STANDARD_8GB";
-    environment: Record<string, string>;
-    stagingDomainName?: string;
-    stagingDomainPrefix?: string;
-    redirects?: CmsRedirect[];
-  };
+  cms?: CmsConfig;
   reader?: {
     appName?: string;
     domainName?: string;
@@ -61,6 +63,12 @@ export type AmplifyAppShellSiteConfig = {
   };
 };
 
+export type CmsSiteConfig = AmplifyAppShellSiteConfig & { cms: CmsConfig };
+
+export function hasCmsApp(config: AmplifyAppShellSiteConfig): config is CmsSiteConfig {
+  return config.cms !== undefined;
+}
+
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
@@ -200,16 +208,16 @@ export function resolveRedirectSubDomainPrefix(rootDomain: string, source: strin
   return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
 }
 
-export function isStagingEnabled(config: Pick<AmplifyAppShellSiteConfig, "cms">): boolean {
+export function isStagingEnabled(config: Pick<CmsSiteConfig, "cms">): boolean {
   return config.cms.staging !== false;
 }
 
-export function resolveCmsHostName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+export function resolveCmsHostName(config: Pick<CmsSiteConfig, "cms">): string | undefined {
   if (!config.cms.domainName) return undefined;
   return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
 }
 
-export function resolveStagingDomainName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+export function resolveStagingDomainName(config: Pick<CmsSiteConfig, "cms">): string | undefined {
   if (!isStagingEnabled(config)) return undefined;
   if (config.cms.domainPrefix) {
     return config.cms.stagingDomainPrefix ? `${config.cms.stagingDomainPrefix}.${config.cms.domainName}` : undefined;
@@ -228,27 +236,8 @@ export function resolveStoragePreviewPrefix(config: Pick<AmplifyAppShellSiteConf
   return config.storagePreviewPrefix ?? "preview/";
 }
 
-export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
-  const record = requireObject(raw, "site");
-  rejectUnknownKeys(
-    record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
-    "site",
-  );
-
-  const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
-  const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
-  const brand = requireString(record.brand, "brand");
-  const frontend = requireString(record.frontend, "frontend");
-  if (frontend !== "pretext" && frontend !== "markus-static") {
-    fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
-  }
-  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
-  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
-  const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
-  const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
-
-  const cmsRecord = requireObject(record.cms, "cms");
+function parseCms(value: unknown): CmsConfig {
+  const cmsRecord = requireObject(value, "cms");
   rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
@@ -260,7 +249,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
     fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
   }
-  const cms: AmplifyAppShellSiteConfig["cms"] = {
+  const cms: CmsConfig = {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
     domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
     domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
@@ -330,6 +319,49 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     }
   }
 
+  return cms;
+}
+
+function validateOauthRedirectUrls(config: CmsSiteConfig): void {
+  const redirectValue = config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
+  if (redirectValue === undefined) fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
+  const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+  const stagingDomainName = resolveStagingDomainName(config);
+  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
+  const requiredOrigins = [
+    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
+  ];
+  for (const origin of requiredOrigins) {
+    if (!listedOrigins.has(origin)) {
+      fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
+    }
+  }
+}
+
+export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
+  const record = requireObject(raw, "site");
+  rejectUnknownKeys(
+    record,
+    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    "site",
+  );
+
+  const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
+  const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+  const brand = requireString(record.brand, "brand");
+  const frontend = requireString(record.frontend, "frontend");
+  if (frontend !== "pretext" && frontend !== "markus-static") {
+    fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
+  }
+  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+  const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
+  const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
+
+  const cms = record.cms === undefined && frontend === "markus-static" ? undefined : parseCms(record.cms);
+
   let reader: AmplifyAppShellSiteConfig["reader"];
   if (record.reader !== undefined) {
     if (frontend !== "markus-static") fail("reader", `is only allowed when frontend is "markus-static"`);
@@ -358,6 +390,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
 
   let github: AmplifyAppShellSiteConfig["github"];
   if (record.github !== undefined) {
+    if (cms === undefined) fail("github", "requires cms (the CI role is scoped to the CMS app)");
     const githubRecord = requireObject(record.github, "github");
     rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
     const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
@@ -365,7 +398,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     if (repository !== `https://github.com/${owner}/${repo}`) {
       fail("github", `owner/repo must match repository ${repository}`);
     }
-    let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+    let branches = cms?.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
     if (githubRecord.branches !== undefined) {
       if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
         fail("github.branches", "must be a non-empty array of branch names");
@@ -382,7 +415,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean };
   }
 
-  const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+  const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
   if (hasDomain && hostedZoneId === undefined) {
     fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
   }
@@ -404,21 +437,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     github,
   };
 
-  const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
-  if (redirectValue === undefined) fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
-  const redirectUrls = redirectValue.split(",").map((url) => url.trim());
-  const stagingDomainName = resolveStagingDomainName(config);
-  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
-  const requiredOrigins = [
-    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
-    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
-    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
-  ];
-  for (const origin of requiredOrigins) {
-    if (!listedOrigins.has(origin)) {
-      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
-    }
-  }
+  if (hasCmsApp(config)) validateOauthRedirectUrls(config);
 
   return config;
 }

package/package.json

@@ -302,7 +302,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.41",
+  "version": "1.0.0-next.43",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.41",
+  "version": "1.0.0-next.43",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",