@anthusai/papyrus 1.0.0-next.7 → 1.0.0-next.9

package/amplify/functions/content-actions/handler.py

@@ -130,7 +130,7 @@ def request_staging_build_action() -> dict:
 
 
 def handler(event, context):
-    field = event["info"]["fieldName"]
+    field = event["fieldName"]
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)
     try:

package/bin/papyrus-infra.mjs

@@ -11,7 +11,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { createRequire } from "node:module";
 import { buildSpecFor } from "../infra/build-specs.js";
-import { parseSiteConfig } from "../infra/site-config.js";
+import { parseSiteConfig, resolveStackName } from "../infra/site-config.js";
 
 const USAGE = [
   "Usage: papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]",
@@ -89,7 +89,7 @@ const { App } = createRequire(path.join(process.cwd(), "noop.js"))("aws-cdk-lib"
 const app = new App({ outdir: path.resolve(opt("out", "cdk.out")) });
 new AmplifyAppShellStack(app, `AmplifyAppShell-${config.siteId}`, config, {
   env: { account: opt("account", "335163751677"), region: opt("region", "us-east-1") },
-  stackName: `amplify-app-shell-${config.siteId}`,
+  stackName: resolveStackName(config),
 });
 app.synth();
-console.log(`synthesized amplify-app-shell-${config.siteId} -> ${path.resolve(opt("out", "cdk.out"))}`);
+console.log(`synthesized ${resolveStackName(config)} -> ${path.resolve(opt("out", "cdk.out"))}`);

package/infra/amplify-app-shell.js

@@ -1,9 +1,9 @@
-import { ArnFormat, CfnOutput, Duration, Stack } from "aws-cdk-lib";
+import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { resolveStagingDomainName } from "./site-config.js";
+import { isStagingEnabled, resolveStackName, resolveStagingDomainName } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -14,7 +14,10 @@ function environmentVariables(variables) {
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
  *   - for `markus-static` sites, a reader app (WEB) with branch `main`
- *   - one domain association per branch/app, IAM service and compute roles
+ *   - a domain association per branch/app when a domain is configured (without
+ *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
+ *     URL is used), IAM service and compute roles
+ *   - `cms.staging: false` omits the staging branch and its domain
  *
  * No repository and no access token are configured: the apps are manual-deploy
  * until Amplify's GitHub App is connected once in the console
@@ -27,6 +30,7 @@ export class AmplifyAppShellStack extends Stack {
     constructor(scope, id, config, props) {
         super(scope, id, props);
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+        const stagingEnabled = isStagingEnabled(config);
         const stagingDomainName = resolveStagingDomainName(config);
         const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
             assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
@@ -54,6 +58,19 @@ export class AmplifyAppShellStack extends Stack {
         const stagingMode = config.frontend === "markus-static"
             ? { PAPYRUS_STAGING_PREVIEW: "static" }
             : { PAPYRUS_CONTENT_SOURCE: "drafts" };
+        const productionOrigin = config.cms.domainName
+            ? `https://${config.cms.domainName}/`
+            : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
+        const stagingOrigin = stagingDomainName
+            ? `https://${stagingDomainName}/`
+            : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+        const defaultOriginsToAllow = [
+            ...(config.cms.domainName ? [] : [productionOrigin]),
+            ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
+        ];
+        const oauthRedirectUrls = defaultOriginsToAllow.length === 0
+            ? config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS
+            : Fn.join(",", [config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS, ...defaultOriginsToAllow]);
         const productionBranch = new amplify.CfnBranch(this, "Branch", {
             appId: cmsApp.attrAppId,
             branchName: "main",
@@ -62,44 +79,56 @@ export class AmplifyAppShellStack extends Stack {
             enablePerformanceMode: false,
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
+                PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                 PAPYRUS_SITE_BRAND: config.brand,
                 SITE_ENV: "production",
                 PAPYRUS_CONTENT_SOURCE: "published",
             }),
         });
-        const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
-            appId: cmsApp.attrAppId,
-            branchName: "staging",
-            stage: "BETA",
-            enableAutoBuild: true,
-            enablePerformanceMode: false,
-            buildSpec: cmsStagingBuildSpec(config),
-            environmentVariables: environmentVariables({
-                ...config.cms.environment,
-                PAPYRUS_SITE_BRAND: config.brand,
-                SITE_ENV: "staging",
-                ...stagingMode,
-                NEXT_PUBLIC_PAPYRUS_STAGING_URL: `https://${stagingDomainName}`,
-            }),
-        });
-        const productionDomain = new amplify.CfnDomain(this, "Domain", {
-            appId: cmsApp.attrAppId,
-            domainName: config.cms.domainName,
-            subDomainSettings: [{ branchName: "main", prefix: "" }],
-        });
-        productionDomain.addResourceDependency(productionBranch);
-        const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
-            appId: cmsApp.attrAppId,
-            domainName: stagingDomainName,
-            subDomainSettings: [{ branchName: "staging", prefix: "" }],
-        });
-        stagingDomain.addResourceDependency(stagingBranch);
+        if (stagingEnabled) {
+            const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+                appId: cmsApp.attrAppId,
+                branchName: "staging",
+                stage: "BETA",
+                enableAutoBuild: true,
+                enablePerformanceMode: false,
+                buildSpec: cmsStagingBuildSpec(config),
+                environmentVariables: environmentVariables({
+                    ...config.cms.environment,
+                    PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
+                    PAPYRUS_SITE_BRAND: config.brand,
+                    SITE_ENV: "staging",
+                    ...stagingMode,
+                    NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
+                        ? `https://${stagingDomainName}`
+                        : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
+                }),
+            });
+            if (stagingDomainName) {
+                const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
+                    appId: cmsApp.attrAppId,
+                    domainName: stagingDomainName,
+                    subDomainSettings: [{ branchName: "staging", prefix: "" }],
+                });
+                stagingDomain.addResourceDependency(stagingBranch);
+            }
+        }
+        if (config.cms.domainName) {
+            const productionDomain = new amplify.CfnDomain(this, "Domain", {
+                appId: cmsApp.attrAppId,
+                domainName: config.cms.domainName,
+                subDomainSettings: [{ branchName: "main", prefix: "" }],
+            });
+            productionDomain.addResourceDependency(productionBranch);
+        }
         this.cmsAppId = cmsApp.attrAppId;
         new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
-        new CfnOutput(this, "CmsOrigin", { value: `https://${config.cms.domainName}/` });
-        new CfnOutput(this, "StagingOrigin", { value: `https://${stagingDomainName}/` });
+        new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+        if (stagingEnabled) {
+            new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
+        }
         if (config.reader) {
-            this.readerAppId = this.addReaderApp(config, config.reader, cmsApp.attrAppId);
+            this.readerAppId = this.addReaderApp(config, config.reader);
         }
         if (config.github) {
             this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
@@ -150,27 +179,19 @@ export class AmplifyAppShellStack extends Stack {
                 sid: "DeployThisSitesAppShellStack",
                 actions: ["cloudformation:*"],
                 resources: [
-                    this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `amplify-app-shell-${config.siteId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                    this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `${resolveStackName(config)}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
                 ],
             }));
         }
         new CfnOutput(this, "GithubCiRoleArn", { value: ciRole.roleArn, description: `Role for GitHub Actions in ${github.owner}/${github.repo}` });
     }
-    addReaderApp(config, reader, cmsAppId) {
+    addReaderApp(config, reader) {
         const readerAppName = reader.appName ?? `${config.siteId}-reader`;
         const readerBranchName = reader.branchName ?? "main";
         const readerServiceRole = new iam.Role(this, "ReaderServiceRole", {
             assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
-            description: `Static reader build role for Amplify app ${readerAppName} (reads the CMS app's SSM secrets and media only)`,
+            description: `Static reader build role for Amplify app ${readerAppName} (reads published media only; content is read as a Cognito guest)`,
         });
-        readerServiceRole.addToPolicy(new iam.PolicyStatement({
-            sid: "ReadSiteSecretsForJwtMinting",
-            actions: ["ssm:GetParameter", "ssm:GetParameters"],
-            resources: [
-                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-            ],
-        }));
         readerServiceRole.addToPolicy(new iam.PolicyStatement({
             sid: "ReadMediaForExport",
             actions: ["s3:GetObject"],
@@ -194,14 +215,20 @@ export class AmplifyAppShellStack extends Stack {
                 SITE_ENV: "production",
             }),
         });
-        const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
-            appId: readerApp.attrAppId,
-            domainName: reader.domainName,
-            subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
-        });
-        readerDomain.addResourceDependency(readerBranch);
+        if (reader.domainName) {
+            const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
+                appId: readerApp.attrAppId,
+                domainName: reader.domainName,
+                subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+            });
+            readerDomain.addResourceDependency(readerBranch);
+        }
         new CfnOutput(this, "ReaderAppId", { value: readerApp.attrAppId, description: `Amplify app id for ${readerAppName}` });
-        new CfnOutput(this, "ReaderOrigin", { value: `https://${reader.domainName}/` });
+        new CfnOutput(this, "ReaderOrigin", {
+            value: reader.domainName
+                ? `https://${reader.domainName}/`
+                : Fn.join("", [`https://${readerBranchName}.`, readerApp.attrDefaultDomain, "/"]),
+        });
         return readerApp.attrAppId;
     }
 }

package/infra/amplify-app-shell.ts

@@ -1,10 +1,10 @@
 import { Construct } from "constructs";
-import { ArnFormat, CfnOutput, Duration, Stack, StackProps } from "aws-cdk-lib";
+import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, resolveStagingDomainName } from "./site-config";
+import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveStackName, resolveStagingDomainName } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -17,7 +17,10 @@ function environmentVariables(variables: Record<string, string>): amplify.CfnBra
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
  *   - for `markus-static` sites, a reader app (WEB) with branch `main`
- *   - one domain association per branch/app, IAM service and compute roles
+ *   - a domain association per branch/app when a domain is configured (without
+ *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
+ *     URL is used), IAM service and compute roles
+ *   - `cms.staging: false` omits the staging branch and its domain
  *
  * No repository and no access token are configured: the apps are manual-deploy
  * until Amplify's GitHub App is connected once in the console
@@ -32,6 +35,7 @@ export class AmplifyAppShellStack extends Stack {
     super(scope, id, props);
 
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+    const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
 
     const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
@@ -64,6 +68,20 @@ export class AmplifyAppShellStack extends Stack {
       ? { PAPYRUS_STAGING_PREVIEW: "static" }
       : { PAPYRUS_CONTENT_SOURCE: "drafts" };
 
+    const productionOrigin = config.cms.domainName
+      ? `https://${config.cms.domainName}/`
+      : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
+    const stagingOrigin = stagingDomainName
+      ? `https://${stagingDomainName}/`
+      : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+    const defaultOriginsToAllow = [
+      ...(config.cms.domainName ? [] : [productionOrigin]),
+      ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
+    ];
+    const oauthRedirectUrls = defaultOriginsToAllow.length === 0
+      ? config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS
+      : Fn.join(",", [config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS, ...defaultOriginsToAllow]);
+
     const productionBranch = new amplify.CfnBranch(this, "Branch", {
       appId: cmsApp.attrAppId,
       branchName: "main",
@@ -72,49 +90,61 @@ export class AmplifyAppShellStack extends Stack {
       enablePerformanceMode: false,
       environmentVariables: environmentVariables({
         ...config.cms.environment,
+        PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
         PAPYRUS_SITE_BRAND: config.brand,
         SITE_ENV: "production",
         PAPYRUS_CONTENT_SOURCE: "published",
       }),
     });
 
-    const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
-      appId: cmsApp.attrAppId,
-      branchName: "staging",
-      stage: "BETA",
-      enableAutoBuild: true,
-      enablePerformanceMode: false,
-      buildSpec: cmsStagingBuildSpec(config),
-      environmentVariables: environmentVariables({
-        ...config.cms.environment,
-        PAPYRUS_SITE_BRAND: config.brand,
-        SITE_ENV: "staging",
-        ...stagingMode,
-        NEXT_PUBLIC_PAPYRUS_STAGING_URL: `https://${stagingDomainName}`,
-      }),
-    });
+    if (stagingEnabled) {
+      const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+        appId: cmsApp.attrAppId,
+        branchName: "staging",
+        stage: "BETA",
+        enableAutoBuild: true,
+        enablePerformanceMode: false,
+        buildSpec: cmsStagingBuildSpec(config),
+        environmentVariables: environmentVariables({
+          ...config.cms.environment,
+          PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
+          PAPYRUS_SITE_BRAND: config.brand,
+          SITE_ENV: "staging",
+          ...stagingMode,
+          NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
+            ? `https://${stagingDomainName}`
+            : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
+        }),
+      });
 
-    const productionDomain = new amplify.CfnDomain(this, "Domain", {
-      appId: cmsApp.attrAppId,
-      domainName: config.cms.domainName,
-      subDomainSettings: [{ branchName: "main", prefix: "" }],
-    });
-    productionDomain.addResourceDependency(productionBranch);
+      if (stagingDomainName) {
+        const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
+          appId: cmsApp.attrAppId,
+          domainName: stagingDomainName,
+          subDomainSettings: [{ branchName: "staging", prefix: "" }],
+        });
+        stagingDomain.addResourceDependency(stagingBranch);
+      }
+    }
 
-    const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
-      appId: cmsApp.attrAppId,
-      domainName: stagingDomainName,
-      subDomainSettings: [{ branchName: "staging", prefix: "" }],
-    });
-    stagingDomain.addResourceDependency(stagingBranch);
+    if (config.cms.domainName) {
+      const productionDomain = new amplify.CfnDomain(this, "Domain", {
+        appId: cmsApp.attrAppId,
+        domainName: config.cms.domainName,
+        subDomainSettings: [{ branchName: "main", prefix: "" }],
+      });
+      productionDomain.addResourceDependency(productionBranch);
+    }
 
     this.cmsAppId = cmsApp.attrAppId;
     new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
-    new CfnOutput(this, "CmsOrigin", { value: `https://${config.cms.domainName}/` });
-    new CfnOutput(this, "StagingOrigin", { value: `https://${stagingDomainName}/` });
+    new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+    if (stagingEnabled) {
+      new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
+    }
 
     if (config.reader) {
-      this.readerAppId = this.addReaderApp(config, config.reader, cmsApp.attrAppId);
+      this.readerAppId = this.addReaderApp(config, config.reader);
     }
 
     if (config.github) {
@@ -186,7 +216,7 @@ export class AmplifyAppShellStack extends Stack {
           sid: "DeployThisSitesAppShellStack",
           actions: ["cloudformation:*"],
           resources: [
-            this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `amplify-app-shell-${config.siteId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+            this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `${resolveStackName(config)}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
           ],
         }),
       );
@@ -198,25 +228,14 @@ export class AmplifyAppShellStack extends Stack {
   private addReaderApp(
     config: AmplifyAppShellSiteConfig,
     reader: NonNullable<AmplifyAppShellSiteConfig["reader"]>,
-    cmsAppId: string,
   ): string {
     const readerAppName = reader.appName ?? `${config.siteId}-reader`;
     const readerBranchName = reader.branchName ?? "main";
 
     const readerServiceRole = new iam.Role(this, "ReaderServiceRole", {
       assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
-      description: `Static reader build role for Amplify app ${readerAppName} (reads the CMS app's SSM secrets and media only)`,
+      description: `Static reader build role for Amplify app ${readerAppName} (reads published media only; content is read as a Cognito guest)`,
     });
-    readerServiceRole.addToPolicy(
-      new iam.PolicyStatement({
-        sid: "ReadSiteSecretsForJwtMinting",
-        actions: ["ssm:GetParameter", "ssm:GetParameters"],
-        resources: [
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-        ],
-      }),
-    );
     readerServiceRole.addToPolicy(
       new iam.PolicyStatement({
         sid: "ReadMediaForExport",
@@ -245,15 +264,21 @@ export class AmplifyAppShellStack extends Stack {
       }),
     });
 
-    const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
-      appId: readerApp.attrAppId,
-      domainName: reader.domainName,
-      subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
-    });
-    readerDomain.addResourceDependency(readerBranch);
+    if (reader.domainName) {
+      const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
+        appId: readerApp.attrAppId,
+        domainName: reader.domainName,
+        subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+      });
+      readerDomain.addResourceDependency(readerBranch);
+    }
 
     new CfnOutput(this, "ReaderAppId", { value: readerApp.attrAppId, description: `Amplify app id for ${readerAppName}` });
-    new CfnOutput(this, "ReaderOrigin", { value: `https://${reader.domainName}/` });
+    new CfnOutput(this, "ReaderOrigin", {
+      value: reader.domainName
+        ? `https://${reader.domainName}/`
+        : Fn.join("", [`https://${readerBranchName}.`, readerApp.attrDefaultDomain, "/"]),
+    });
     return readerApp.attrAppId;
   }
 }

package/infra/build-specs.js

@@ -72,8 +72,7 @@ export function readerBuildSpec(config) {
         "version: 1",
         ...frontendSection([
             ...pythonProvisioningCommands(config),
-            "papyrus auth refresh-jwt --write-env .env",
-            "papyrus content export-published --out content-export --clean",
+            "papyrus content export-published --auth guest --out content-export --clean",
         ], [readerConfig.buildCommand], readerConfig.baseDirectory, [".uv-cache/**/*"]),
     ].join("\n") + "\n";
 }

package/infra/build-specs.ts

@@ -115,8 +115,7 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
     ...frontendSection(
       [
         ...pythonProvisioningCommands(config),
-        "papyrus auth refresh-jwt --write-env .env",
-        "papyrus content export-published --out content-export --clean",
+        "papyrus content export-published --auth guest --out content-export --clean",
       ],
       [readerConfig.buildCommand],
       readerConfig.baseDirectory,

package/infra/site-config.js

@@ -4,6 +4,7 @@ const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
+const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
 const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
@@ -46,18 +47,28 @@ function rejectUnknownKeys(record, allowed, field) {
             fail(`${field}.${key}`, `is not a known field (known: ${allowed.join(", ")})`);
     }
 }
+export function isStagingEnabled(config) {
+    return config.cms.staging !== false;
+}
 export function resolveStagingDomainName(config) {
+    if (!isStagingEnabled(config))
+        return undefined;
     if (config.cms.stagingDomainName)
         return config.cms.stagingDomainName;
+    if (!config.cms.domainName)
+        return undefined;
     const [, ...rest] = config.cms.domainName.split(".");
     return ["staging", ...rest].join(".");
 }
+export function resolveStackName(config) {
+    return config.stackName ?? `amplify-app-shell-${config.siteId}`;
+}
 export function resolveStoragePreviewPrefix(config) {
     return config.storagePreviewPrefix ?? "preview/";
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const brand = requireString(record.brand, "brand");
@@ -65,22 +76,33 @@ export function parseSiteConfig(raw) {
     if (frontend !== "pretext" && frontend !== "markus-static") {
         fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
     }
-    const hostedZoneId = requireString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
     const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
     const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
     const cmsRecord = requireObject(record.cms, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "buildComputeType", "environment", "stagingDomainName"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "buildComputeType", "environment", "stagingDomainName"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
     }
+    if (cmsRecord.staging !== undefined && typeof cmsRecord.staging !== "boolean") {
+        fail("cms.staging", `must be a boolean, got ${JSON.stringify(cmsRecord.staging)}`);
+    }
     const cms = {
         appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
-        domainName: requireString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+        domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+        staging: cmsRecord.staging,
         buildComputeType: buildComputeType,
         environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
         stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
     };
+    if (cms.staging === false && cms.stagingDomainName) {
+        fail("cms.stagingDomainName", "must not be set when cms.staging is false");
+    }
+    if (cms.stagingDomainName && !cms.domainName) {
+        fail("cms.stagingDomainName", "requires cms.domainName");
+    }
     let reader;
     if (record.reader !== undefined) {
         if (frontend !== "markus-static")
@@ -89,7 +111,7 @@ export function parseSiteConfig(raw) {
         rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
         reader = {
             appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
-            domainName: requireString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
+            domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
             branchName: optionalString(readerRecord.branchName, "reader.branchName", BRANCH_NAME_PATTERN),
             buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
             baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
@@ -108,7 +130,7 @@ export function parseSiteConfig(raw) {
         if (repository !== `https://github.com/${owner}/${repo}`) {
             fail("github", `owner/repo must match repository ${repository}`);
         }
-        let branches = DEFAULT_CI_BRANCHES;
+        let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
         if (githubRecord.branches !== undefined) {
             if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
                 fail("github.branches", "must be a non-empty array of branch names");
@@ -125,12 +147,20 @@ export function parseSiteConfig(raw) {
             fail("github.ciCanDeployInfra", "must be a boolean");
         github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra };
     }
+    const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+    if (hasDomain && hostedZoneId === undefined) {
+        fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
+    }
+    if (!hasDomain && hostedZoneId !== undefined) {
+        fail("hostedZoneId", "is only allowed when cms.domainName or reader.domainName is set");
+    }
     const config = {
         siteId,
         repository,
         brand,
         frontend,
         hostedZoneId,
+        stackName,
         cms,
         reader,
         papyrusVersion,
@@ -141,9 +171,10 @@ export function parseSiteConfig(raw) {
     if (redirectValue === undefined)
         fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
     const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+    const stagingDomainName = resolveStagingDomainName(config);
     const requiredOrigins = [
-        `https://${cms.domainName}/`,
-        `https://${resolveStagingDomainName(config)}/`,
+        ...(cms.domainName ? [`https://${cms.domainName}/`] : []),
+        ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
         LOCAL_DEVELOPMENT_ORIGIN,
     ];
     for (const origin of requiredOrigins) {

package/infra/site-config.ts

@@ -3,17 +3,19 @@ export type AmplifyAppShellSiteConfig = {
   repository: string;
   brand: string;
   frontend: "pretext" | "markus-static";
-  hostedZoneId: string;
+  hostedZoneId?: string;
+  stackName?: string;
   cms: {
     appName?: string;
-    domainName: string;
+    domainName?: string;
+    staging?: boolean;
     buildComputeType?: "STANDARD" | "STANDARD_8GB";
     environment: Record<string, string>;
     stagingDomainName?: string;
   };
   reader?: {
     appName?: string;
-    domainName: string;
+    domainName?: string;
     branchName?: string;
     buildCommand: string;
     baseDirectory: string;
@@ -36,6 +38,7 @@ const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
+const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
 const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
@@ -83,12 +86,22 @@ function rejectUnknownKeys(record: Record<string, unknown>, allowed: string[], f
   }
 }
 
-export function resolveStagingDomainName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string {
+export function isStagingEnabled(config: Pick<AmplifyAppShellSiteConfig, "cms">): boolean {
+  return config.cms.staging !== false;
+}
+
+export function resolveStagingDomainName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+  if (!isStagingEnabled(config)) return undefined;
   if (config.cms.stagingDomainName) return config.cms.stagingDomainName;
+  if (!config.cms.domainName) return undefined;
   const [, ...rest] = config.cms.domainName.split(".");
   return ["staging", ...rest].join(".");
 }
 
+export function resolveStackName(config: Pick<AmplifyAppShellSiteConfig, "siteId" | "stackName">): string {
+  return config.stackName ?? `amplify-app-shell-${config.siteId}`;
+}
+
 export function resolveStoragePreviewPrefix(config: Pick<AmplifyAppShellSiteConfig, "storagePreviewPrefix">): string {
   return config.storagePreviewPrefix ?? "preview/";
 }
@@ -97,7 +110,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
     "site",
   );
 
@@ -108,24 +121,36 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   if (frontend !== "pretext" && frontend !== "markus-static") {
     fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
   }
-  const hostedZoneId = requireString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
   const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
   const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
 
   const cmsRecord = requireObject(record.cms, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "buildComputeType", "environment", "stagingDomainName"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "buildComputeType", "environment", "stagingDomainName"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
   }
+  if (cmsRecord.staging !== undefined && typeof cmsRecord.staging !== "boolean") {
+    fail("cms.staging", `must be a boolean, got ${JSON.stringify(cmsRecord.staging)}`);
+  }
   const cms: AmplifyAppShellSiteConfig["cms"] = {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
-    domainName: requireString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+    domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+    staging: cmsRecord.staging as boolean | undefined,
     buildComputeType: buildComputeType as "STANDARD" | "STANDARD_8GB" | undefined,
     environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
     stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
   };
 
+  if (cms.staging === false && cms.stagingDomainName) {
+    fail("cms.stagingDomainName", "must not be set when cms.staging is false");
+  }
+  if (cms.stagingDomainName && !cms.domainName) {
+    fail("cms.stagingDomainName", "requires cms.domainName");
+  }
+
   let reader: AmplifyAppShellSiteConfig["reader"];
   if (record.reader !== undefined) {
     if (frontend !== "markus-static") fail("reader", `is only allowed when frontend is "markus-static"`);
@@ -133,7 +158,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
     reader = {
       appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
-      domainName: requireString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
+      domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
       branchName: optionalString(readerRecord.branchName, "reader.branchName", BRANCH_NAME_PATTERN),
       buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
       baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
@@ -152,7 +177,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     if (repository !== `https://github.com/${owner}/${repo}`) {
       fail("github", `owner/repo must match repository ${repository}`);
     }
-    let branches = DEFAULT_CI_BRANCHES;
+    let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
     if (githubRecord.branches !== undefined) {
       if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
         fail("github.branches", "must be a non-empty array of branch names");
@@ -169,12 +194,21 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean };
   }
 
+  const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+  if (hasDomain && hostedZoneId === undefined) {
+    fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
+  }
+  if (!hasDomain && hostedZoneId !== undefined) {
+    fail("hostedZoneId", "is only allowed when cms.domainName or reader.domainName is set");
+  }
+
   const config: AmplifyAppShellSiteConfig = {
     siteId,
     repository,
     brand,
     frontend,
     hostedZoneId,
+    stackName,
     cms,
     reader,
     papyrusVersion,
@@ -185,9 +219,10 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
   if (redirectValue === undefined) fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
   const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+  const stagingDomainName = resolveStagingDomainName(config);
   const requiredOrigins = [
-    `https://${cms.domainName}/`,
-    `https://${resolveStagingDomainName(config)}/`,
+    ...(cms.domainName ? [`https://${cms.domainName}/`] : []),
+    ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
     LOCAL_DEVELOPMENT_ORIGIN,
   ];
   for (const origin of requiredOrigins) {

package/lib/content-source-context.ts

@@ -3,12 +3,22 @@ import { getContentSource, type ContentSource } from "./site-env";
 
 export type ContentSourceContext = {
   source: ContentSource;
+  /** Request-scoped data client (drafts mode: carries the visitor's session cookies). */
+  client?: unknown;
 };
 
 const contentSourceStorage = new AsyncLocalStorage<ContentSourceContext>();
 
-export function runWithContentSource<T>(source: ContentSource, operation: () => Promise<T>): Promise<T> {
-  return contentSourceStorage.run({ source }, operation);
+export function runWithContentSource<T>(
+  source: ContentSource,
+  operation: () => Promise<T>,
+  client?: unknown,
+): Promise<T> {
+  return contentSourceStorage.run({ source, client }, operation);
+}
+
+export function currentRequestClient<T>(): T | undefined {
+  return contentSourceStorage.getStore()?.client as T | undefined;
 }
 
 export function currentContentSource(): ContentSource {

package/lib/graphql-content-repository.ts

@@ -1,3 +1,4 @@
+import { generateServerClientUsingCookies } from "@aws-amplify/adapter-nextjs/api";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../amplify/data/resource";
 import type { Article, ArticleImage, ArticleImageAsset, ArticleImageLayout, ArticleImageThemeVariants, ArticleVideoAsset, ArticleVideoThemeVariants } from "./articles";
@@ -17,7 +18,7 @@ import {
 } from "./publication-items";
 import { BodyIrError, matchBodyImages, projectBodyIr, type BodyProjection, type BodyProjectionImage } from "./markus-body";
 import { SITE_BRAND } from "./site-brand";
-import { currentContentSource, runWithContentSource } from "./content-source-context";
+import { currentContentSource, currentRequestClient, runWithContentSource } from "./content-source-context";
 import { getContentSource } from "./site-env";
 
 const DEFAULT_EDITION_SLUG = "current";
@@ -143,12 +144,18 @@ function isVisibleItemStatus(status: string): boolean {
 }
 
 async function withReaderGraphQLContext<T>(operation: () => Promise<T>): Promise<T> {
-  const { runWithAmplifyServerContext } = getAmplifyServerRuntime();
+  const { runWithAmplifyServerContext, config } = getAmplifyServerRuntime();
   const source = getContentSource();
-  const nextServerContext = source === "drafts" ? { cookies: (await import("next/headers")).cookies } : null;
+  if (source === "drafts") {
+    // Drafts are read as the signed-in visitor: the client reads the session from the request cookies, and it is
+    // kept in the request's async context (never a module global) so one visitor's session cannot serve another.
+    const { cookies } = await import("next/headers");
+    const client = generateServerClientUsingCookies<Schema>({ config, cookies, authMode: "userPool" });
+    return runWithContentSource(source, operation, client);
+  }
   return runWithContentSource(source, () =>
     runWithAmplifyServerContext({
-      nextServerContext,
+      nextServerContext: null,
       operation: async () => {
         readerContextClient = generateClient<Schema>({ authMode: authMode() });
         try {
@@ -241,6 +248,8 @@ export const graphqlContentRepository: ContentRepository = {
 };
 
 function getClient(): DataClient {
+  const requestClient = currentRequestClient<DataClient>();
+  if (requestClient) return requestClient;
   if (readerContextClient) return readerContextClient;
 
   if (!buildTimeClient) {

package/package.json

@@ -276,7 +276,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.7",
+  "version": "1.0.0-next.9",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.7",
+  "version": "1.0.0-next.9",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",