@anthusai/papyrus 1.0.0-next.8 → 1.0.0

package/infra/amplify-app-shell.ts

@@ -1,23 +1,49 @@
 import { Construct } from "constructs";
-import { ArnFormat, CfnOutput, Duration, Stack, StackProps } from "aws-cdk-lib";
+import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, resolveStagingDomainName } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
 
+function readerCustomHeaders(rules: ReaderCustomHeaderRule[] | undefined): string | undefined {
+  if (!rules) return undefined;
+  const lines = ["customHeaders:"];
+  for (const rule of rules) {
+    lines.push(`  - pattern: ${JSON.stringify(rule.pattern)}`, "    headers:");
+    for (const [key, value] of Object.entries(rule.headers)) {
+      lines.push(`      - key: ${JSON.stringify(key)}`, `        value: ${JSON.stringify(value)}`);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+
 /**
  * Provisions the Amplify *app shell* of a Papyrus publication from its
  * site.json:
  *
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
- *   - for `markus-static` sites, a reader app (WEB) with branch `main`
- *   - one domain association per branch/app, IAM service and compute roles
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`; a
+ *     `markus-static` site may omit `cms` to get the reader app alone (no CMS
+ *     app, no CMS roles, no authoring role)
+ *   - a domain association per branch/app when a domain is configured (without
+ *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
+ *     URL is used), IAM service and compute roles
+ *   - `cms.staging: false` omits the staging branch and its domain
+ *
+ * Google sign-in is always on: the branches never set PAPYRUS_DISABLE_GOOGLE_OAUTH,
+and `cms.cognitoDomainPrefix` becomes the hosted-UI domain
+(PAPYRUS_COGNITO_DOMAIN_PREFIX) only when `cms.applyCognitoDomainPrefix` is true
+(PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX); otherwise Amplify's generated domain is kept. The secrets GOOGLE_CLIENT_ID and
+GOOGLE_CLIENT_SECRET are Amplify backend secrets set in the console, never here.
+The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
+ * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
+ * principal in the account that may assume it); no token is stored anywhere.
  *
  * No repository and no access token are configured: the apps are manual-deploy
  * until Amplify's GitHub App is connected once in the console
@@ -25,14 +51,22 @@ function environmentVariables(variables: Record<string, string>): amplify.CfnBra
  * app by `ampx pipeline-deploy` from the production build.
  */
 export class AmplifyAppShellStack extends Stack {
-  public readonly cmsAppId: string;
+  public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
 
   constructor(scope: Construct, id: string, config: AmplifyAppShellSiteConfig, props?: StackProps) {
     super(scope, id, props);
 
+    if (!hasCmsApp(config)) {
+      if (!config.reader) throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
+      this.readerAppId = this.addReaderApp(config, config.reader);
+      return;
+    }
+
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
+    const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
+    const cmsHostName = resolveCmsHostName(config);
 
     const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
       assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
@@ -49,6 +83,33 @@ export class AmplifyAppShellStack extends Stack {
       ],
     });
 
+    const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
+    if (revalidateSecretParameterName) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "ReadRevalidateSecret",
+          actions: ["ssm:GetParameter"],
+          resources: [
+            this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          ],
+        }),
+      );
+    }
+
+    const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
+    const prospectusEnvironment = prospectusAccountsApiStageArn
+      ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+      : {};
+    if (prospectusAccountsApiStageArn) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "InvokeProspectusAccountsAsRegisteredSite",
+          actions: ["execute-api:Invoke"],
+          resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
+        }),
+      );
+    }
+
     const cmsApp = new amplify.CfnApp(this, "App", {
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -57,13 +118,35 @@ export class AmplifyAppShellStack extends Stack {
       computeRoleArn: computeRole.roleArn,
       buildSpec: cmsProductionBuildSpec(config),
       jobConfig: config.cms.buildComputeType ? { buildComputeType: config.cms.buildComputeType } : undefined,
-      customRules: [{ source: "/<*>", target: "/index.html", status: "404-200" }],
+      customRules: [
+        ...(config.cms.redirects ?? []).map((redirect) => ({
+          source: `https://${redirect.source}`,
+          target: `https://${resolveCmsHostName(config)}`,
+          status: String(redirect.status),
+        })),
+        { source: "/<*>", target: "/index.html", status: "404-200" },
+      ],
     });
 
     const stagingMode: Record<string, string> = config.frontend === "markus-static"
       ? { PAPYRUS_STAGING_PREVIEW: "static" }
       : { PAPYRUS_CONTENT_SOURCE: "drafts" };
 
+    const productionOrigin = cmsHostName
+      ? `https://${cmsHostName}/`
+      : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
+    const stagingOrigin = stagingDomainName
+      ? `https://${stagingDomainName}/`
+      : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+    const sharedRootDomain = config.cms.domainPrefix !== undefined;
+    const defaultOriginsToAllow = [
+      ...(config.cms.domainName ? [] : [productionOrigin]),
+      ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
+    ];
+    const oauthRedirectUrls = defaultOriginsToAllow.length === 0
+      ? config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS
+      : Fn.join(",", [config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS, ...defaultOriginsToAllow]);
+
     const productionBranch = new amplify.CfnBranch(this, "Branch", {
       appId: cmsApp.attrAppId,
       branchName: "main",
@@ -72,59 +155,147 @@ export class AmplifyAppShellStack extends Stack {
       enablePerformanceMode: false,
       environmentVariables: environmentVariables({
         ...config.cms.environment,
+        PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+        ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
+        PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
         PAPYRUS_SITE_BRAND: config.brand,
         SITE_ENV: "production",
         PAPYRUS_CONTENT_SOURCE: "published",
+        ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
+        ...prospectusEnvironment,
       }),
     });
 
-    const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
-      appId: cmsApp.attrAppId,
-      branchName: "staging",
-      stage: "BETA",
-      enableAutoBuild: true,
-      enablePerformanceMode: false,
-      buildSpec: cmsStagingBuildSpec(config),
-      environmentVariables: environmentVariables({
-        ...config.cms.environment,
-        PAPYRUS_SITE_BRAND: config.brand,
-        SITE_ENV: "staging",
-        ...stagingMode,
-        NEXT_PUBLIC_PAPYRUS_STAGING_URL: `https://${stagingDomainName}`,
-      }),
-    });
+    let stagingBranch: amplify.CfnBranch | undefined;
+    if (stagingEnabled) {
+      stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+        appId: cmsApp.attrAppId,
+        branchName: "staging",
+        stage: "BETA",
+        enableAutoBuild: true,
+        enablePerformanceMode: false,
+        buildSpec: cmsStagingBuildSpec(config),
+        environmentVariables: environmentVariables({
+          ...config.cms.environment,
+          PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+          ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
+          PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
+          PAPYRUS_SITE_BRAND: config.brand,
+          SITE_ENV: "staging",
+          ...stagingMode,
+          ...prospectusEnvironment,
+          NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
+            ? `https://${stagingDomainName}`
+            : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
+        }),
+      });
 
-    const productionDomain = new amplify.CfnDomain(this, "Domain", {
-      appId: cmsApp.attrAppId,
-      domainName: config.cms.domainName,
-      subDomainSettings: [{ branchName: "main", prefix: "" }],
-    });
-    productionDomain.addResourceDependency(productionBranch);
+      if (stagingDomainName && !sharedRootDomain) {
+        const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
+          appId: cmsApp.attrAppId,
+          domainName: stagingDomainName,
+          subDomainSettings: [{ branchName: "staging", prefix: "" }],
+        });
+        stagingDomain.addResourceDependency(stagingBranch);
+      }
+    }
 
-    const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
-      appId: cmsApp.attrAppId,
-      domainName: stagingDomainName,
-      subDomainSettings: [{ branchName: "staging", prefix: "" }],
-    });
-    stagingDomain.addResourceDependency(stagingBranch);
+    if (config.cms.domainName) {
+      const subDomainSettings = sharedRootDomain
+        ? [
+            { branchName: "main", prefix: config.cms.domainPrefix as string },
+            ...(config.cms.redirects ?? []).map((redirect) => ({
+              branchName: "main",
+              prefix: resolveRedirectSubDomainPrefix(config.cms.domainName as string, redirect.source),
+            })),
+            ...(stagingBranch ? [{ branchName: "staging", prefix: config.cms.stagingDomainPrefix as string }] : []),
+          ]
+        : [{ branchName: "main", prefix: "" }];
+      const productionDomain = new amplify.CfnDomain(this, "Domain", {
+        appId: cmsApp.attrAppId,
+        domainName: config.cms.domainName,
+        subDomainSettings,
+      });
+      productionDomain.addResourceDependency(productionBranch);
+      if (sharedRootDomain && stagingBranch) {
+        productionDomain.addResourceDependency(stagingBranch);
+      }
+    }
 
     this.cmsAppId = cmsApp.attrAppId;
     new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
-    new CfnOutput(this, "CmsOrigin", { value: `https://${config.cms.domainName}/` });
-    new CfnOutput(this, "StagingOrigin", { value: `https://${stagingDomainName}/` });
+    new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+    new CfnOutput(this, "CmsComputeRoleArn", {
+      value: computeRole.roleArn,
+      description: `SSR compute role for ${cmsAppName}; the roleArn of its Prospectus site registration`,
+    });
+    if (stagingEnabled) {
+      new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
+    }
 
     if (config.reader) {
-      this.readerAppId = this.addReaderApp(config, config.reader, cmsApp.attrAppId);
+      this.readerAppId = this.addReaderApp(config, config.reader);
     }
 
+    const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
+    this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
+
     if (config.github) {
-      this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
+      this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
+    }
+  }
+
+  private authoringStatements(config: AmplifyAppShellSiteConfig, cmsAppId: string, amplifyAppIds: string[]): iam.PolicyStatement[] {
+    const mediaBucketArn = `arn:${this.partition}:s3:::amplify-${cmsAppId}-*`;
+    return [
+      new iam.PolicyStatement({
+        sid: "SignAppSyncAuthoringRequests",
+        actions: ["appsync:GraphQL"],
+        resources: ["Query", "Mutation"].map((typeName) =>
+          this.formatArn({ service: "appsync", resource: "apis", resourceName: `*/types/${typeName}/fields/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ),
+      }),
+      new iam.PolicyStatement({
+        sid: "ReadWriteMediaAndPreview",
+        actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+        resources: [`${mediaBucketArn}/media/*`, `${mediaBucketArn}/${resolveStoragePreviewPrefix(config)}*`],
+      }),
+      new iam.PolicyStatement({
+        sid: "ListMediaAndPreview",
+        actions: ["s3:ListBucket"],
+        resources: [mediaBucketArn],
+        conditions: { StringLike: { "s3:prefix": ["media/*", `${resolveStoragePreviewPrefix(config)}*`] } },
+      }),
+      new iam.PolicyStatement({
+        sid: "StartAndInspectAmplifyJobs",
+        actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
+        resources: amplifyAppIds.flatMap((appId) => [
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ]),
+      }),
+    ];
+  }
+
+  private addAuthoringRole(config: AmplifyAppShellSiteConfig, cmsAppId: string, amplifyAppIds: string[]): void {
+    const authoringRole = new iam.Role(this, "PapyrusAuthoringRole", {
+      roleName: `${config.siteId}-papyrus-authoring`,
+      description: `Papyrus CLI authoring role for ${config.siteId}: AppSync (SigV4), media and preview storage, rebuild jobs. Assumable by principals in this account that are allowed sts:AssumeRole on it.`,
+      assumedBy: new iam.AccountRootPrincipal(),
+    });
+    for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
+      authoringRole.addToPolicy(statement);
     }
+    new CfnOutput(this, "PapyrusAuthoringRoleArn", {
+      value: authoringRole.roleArn,
+      description: `Role the Papyrus CLI assumes for ${config.siteId} (profile role_arn)`,
+    });
   }
 
   private addGithubCiRole(
     config: AmplifyAppShellSiteConfig,
     github: NonNullable<AmplifyAppShellSiteConfig["github"]>,
+    cmsAppId: string,
     amplifyAppIds: string[],
   ): void {
     const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
@@ -153,26 +324,9 @@ export class AmplifyAppShellStack extends Stack {
       }),
     });
 
-    ciRole.addToPolicy(
-      new iam.PolicyStatement({
-        sid: "StartAndInspectAmplifyJobs",
-        actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
-        resources: amplifyAppIds.flatMap((appId) => [
-          this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-          this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-        ]),
-      }),
-    );
-    ciRole.addToPolicy(
-      new iam.PolicyStatement({
-        sid: "ReadSiteSecretsForJwtMinting",
-        actions: ["ssm:GetParameter", "ssm:GetParameters"],
-        resources: [
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-        ],
-      }),
-    );
+    for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
+      ciRole.addToPolicy(statement);
+    }
     ciRole.addToPolicy(
       new iam.PolicyStatement({
         sid: "WhoAmI",
@@ -186,7 +340,7 @@ export class AmplifyAppShellStack extends Stack {
           sid: "DeployThisSitesAppShellStack",
           actions: ["cloudformation:*"],
           resources: [
-            this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `amplify-app-shell-${config.siteId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+            this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `${resolveStackName(config)}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
           ],
         }),
       );
@@ -198,25 +352,14 @@ export class AmplifyAppShellStack extends Stack {
   private addReaderApp(
     config: AmplifyAppShellSiteConfig,
     reader: NonNullable<AmplifyAppShellSiteConfig["reader"]>,
-    cmsAppId: string,
   ): string {
     const readerAppName = reader.appName ?? `${config.siteId}-reader`;
     const readerBranchName = reader.branchName ?? "main";
 
     const readerServiceRole = new iam.Role(this, "ReaderServiceRole", {
       assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
-      description: `Static reader build role for Amplify app ${readerAppName} (reads the CMS app's SSM secrets and media only)`,
+      description: `Static reader build role for Amplify app ${readerAppName} (reads published media only; content is read as a Cognito guest)`,
     });
-    readerServiceRole.addToPolicy(
-      new iam.PolicyStatement({
-        sid: "ReadSiteSecretsForJwtMinting",
-        actions: ["ssm:GetParameter", "ssm:GetParameters"],
-        resources: [
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-        ],
-      }),
-    );
     readerServiceRole.addToPolicy(
       new iam.PolicyStatement({
         sid: "ReadMediaForExport",
@@ -231,6 +374,11 @@ export class AmplifyAppShellStack extends Stack {
       platform: "WEB",
       iamServiceRole: readerServiceRole.roleArn,
       buildSpec: readerBuildSpec(config),
+      customRules: [
+        ...(reader.redirects ?? []),
+        { source: "/<*>", target: "/404.html", status: "404-200" },
+      ],
+      customHeaders: readerCustomHeaders(reader.customHeaders),
     });
 
     const readerBranch = new amplify.CfnBranch(this, "ReaderBranch", {
@@ -245,15 +393,21 @@ export class AmplifyAppShellStack extends Stack {
       }),
     });
 
-    const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
-      appId: readerApp.attrAppId,
-      domainName: reader.domainName,
-      subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
-    });
-    readerDomain.addResourceDependency(readerBranch);
+    if (reader.domainName) {
+      const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
+        appId: readerApp.attrAppId,
+        domainName: reader.domainName,
+        subDomainSettings: (reader.domainPrefixes ?? [""]).map((prefix) => ({ branchName: readerBranchName, prefix })),
+      });
+      readerDomain.addResourceDependency(readerBranch);
+    }
 
     new CfnOutput(this, "ReaderAppId", { value: readerApp.attrAppId, description: `Amplify app id for ${readerAppName}` });
-    new CfnOutput(this, "ReaderOrigin", { value: `https://${reader.domainName}/` });
+    new CfnOutput(this, "ReaderOrigin", {
+      value: reader.domainName
+        ? `https://${reader.domainName}/`
+        : Fn.join("", [`https://${readerBranchName}.`, readerApp.attrDefaultDomain, "/"]),
+    });
     return readerApp.attrAppId;
   }
 }

package/infra/build-specs.js

@@ -1,4 +1,4 @@
-import { resolveStoragePreviewPrefix } from "./site-config.js";
+import { hasCmsApp, resolveStoragePreviewPrefix } from "./site-config.js";
 export function papyrusVersionToPep440(version) {
     const match = /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z-]+\.(\d+))?$/.exec(version);
     if (!match)
@@ -14,6 +14,8 @@ function commandLines(commands, indent) {
 }
 const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
 const FRONTEND_ENVIRONMENT_CAPTURE = "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
+const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
+const RUNTIME_OUTPUTS_COPY = "cp amplify_outputs.json .next/amplify_outputs.json";
 function pythonProvisioningCommands(config) {
     return [
         "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -30,6 +32,9 @@ function reader(config) {
         throw new Error(`site ${config.siteId} has no reader app (frontend ${config.frontend})`);
     return config.reader;
 }
+function stagingPreviewFor(config) {
+    return config.cms?.stagingPreview ?? config.reader;
+}
 function frontendSection(preBuildCommands, buildCommands, artifactsDirectory, cachePaths) {
     const lines = ["frontend:", "  phases:"];
     if (preBuildCommands.length > 0) {
@@ -50,20 +55,28 @@ export function cmsProductionBuildSpec(config) {
             "if [ -z \"${PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI:-}\" ]; then export PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD=true; fi",
             "npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID",
         ], "        "),
-        ...frontendSection([], [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"], ".next", [".next/cache/**/*", ".npm/**/*"]),
+        ...frontendSection([], [
+            FRONTEND_ENVIRONMENT_CAPTURE,
+            "npx papyrus-app sync && npm run build",
+            ...(config.frontend === "pretext" ? [RUNTIME_OUTPUTS_COPY] : []),
+        ], ".next", [".next/cache/**/*", ".npm/**/*"]),
     ].join("\n") + "\n";
 }
 export function cmsStagingBuildSpec(config) {
     const preBuild = [NPM_CLEAN_INSTALL, "npx ampx generate outputs --branch main --app-id $AWS_APP_ID"];
     const cachePaths = [".next/cache/**/*", ".npm/**/*"];
-    if (config.frontend === "markus-static") {
-        const readerConfig = reader(config);
-        preBuild.push(...pythonProvisioningCommands(config), "papyrus auth refresh-jwt --write-env .env", "papyrus content export-published --drafts --out content-export --clean", readerConfig.buildCommand, `papyrus content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`);
+    const preview = config.frontend === "markus-static" ? stagingPreviewFor(config) : undefined;
+    if (preview !== undefined) {
+        preBuild.push(...pythonProvisioningCommands(config), `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content export-published --drafts --out content-export --clean`, preview.buildCommand, `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content upload-preview --dir ${preview.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`);
         cachePaths.push(".uv-cache/**/*");
     }
     return [
         "version: 1",
-        ...frontendSection(preBuild, [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"], ".next", cachePaths),
+        ...frontendSection(preBuild, [
+            FRONTEND_ENVIRONMENT_CAPTURE,
+            "npx papyrus-app sync && npm run build",
+            RUNTIME_OUTPUTS_COPY,
+        ], ".next", cachePaths),
     ].join("\n") + "\n";
 }
 export function readerBuildSpec(config) {
@@ -72,12 +85,14 @@ export function readerBuildSpec(config) {
         "version: 1",
         ...frontendSection([
             ...pythonProvisioningCommands(config),
-            "papyrus auth refresh-jwt --write-env .env",
-            "papyrus content export-published --out content-export --clean",
+            ...(readerConfig.preBuildCommands ?? []),
+            ...(readerConfig.skipContentExport ? [] : ["papyrus ops content export-published --auth guest --out content-export --clean"]),
         ], [readerConfig.buildCommand], readerConfig.baseDirectory, [".uv-cache/**/*"]),
     ].join("\n") + "\n";
 }
 export function buildSpecFor(config, app) {
+    if (app !== "reader" && !hasCmsApp(config))
+        throw new Error(`site ${config.siteId} has no cms app`);
     if (app === "cms-production")
         return cmsProductionBuildSpec(config);
     if (app === "cms-staging")

package/infra/build-specs.ts

@@ -1,4 +1,4 @@
-import { AmplifyAppShellSiteConfig, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, hasCmsApp, resolveStoragePreviewPrefix } from "./site-config";
 
 export type BuildSpecAppName = "cms-production" | "cms-staging" | "reader";
 
@@ -22,6 +22,10 @@ const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
 const FRONTEND_ENVIRONMENT_CAPTURE =
   "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
 
+const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
+
+const RUNTIME_OUTPUTS_COPY = "cp amplify_outputs.json .next/amplify_outputs.json";
+
 function pythonProvisioningCommands(config: AmplifyAppShellSiteConfig): string[] {
   return [
     "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -39,6 +43,10 @@ function reader(config: AmplifyAppShellSiteConfig): NonNullable<AmplifyAppShellS
   return config.reader;
 }
 
+function stagingPreviewFor(config: AmplifyAppShellSiteConfig): { buildCommand: string; baseDirectory: string } | undefined {
+  return config.cms?.stagingPreview ?? config.reader;
+}
+
 function frontendSection(preBuildCommands: string[], buildCommands: string[], artifactsDirectory: string, cachePaths: string[]): string[] {
   const lines = ["frontend:", "  phases:"];
   if (preBuildCommands.length > 0) {
@@ -76,7 +84,11 @@ export function cmsProductionBuildSpec(config: AmplifyAppShellSiteConfig): strin
     ),
     ...frontendSection(
       [],
-      [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"],
+      [
+        FRONTEND_ENVIRONMENT_CAPTURE,
+        "npx papyrus-app sync && npm run build",
+        ...(config.frontend === "pretext" ? [RUNTIME_OUTPUTS_COPY] : []),
+      ],
       ".next",
       [".next/cache/**/*", ".npm/**/*"],
     ),
@@ -86,14 +98,13 @@ export function cmsProductionBuildSpec(config: AmplifyAppShellSiteConfig): strin
 export function cmsStagingBuildSpec(config: AmplifyAppShellSiteConfig): string {
   const preBuild = [NPM_CLEAN_INSTALL, "npx ampx generate outputs --branch main --app-id $AWS_APP_ID"];
   const cachePaths = [".next/cache/**/*", ".npm/**/*"];
-  if (config.frontend === "markus-static") {
-    const readerConfig = reader(config);
+  const preview = config.frontend === "markus-static" ? stagingPreviewFor(config) : undefined;
+  if (preview !== undefined) {
     preBuild.push(
       ...pythonProvisioningCommands(config),
-      "papyrus auth refresh-jwt --write-env .env",
-      "papyrus content export-published --drafts --out content-export --clean",
-      readerConfig.buildCommand,
-      `papyrus content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`,
+      `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content export-published --drafts --out content-export --clean`,
+      preview.buildCommand,
+      `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content upload-preview --dir ${preview.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`,
     );
     cachePaths.push(".uv-cache/**/*");
   }
@@ -101,7 +112,11 @@ export function cmsStagingBuildSpec(config: AmplifyAppShellSiteConfig): string {
     "version: 1",
     ...frontendSection(
       preBuild,
-      [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"],
+      [
+        FRONTEND_ENVIRONMENT_CAPTURE,
+        "npx papyrus-app sync && npm run build",
+        RUNTIME_OUTPUTS_COPY,
+      ],
       ".next",
       cachePaths,
     ),
@@ -115,8 +130,8 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
     ...frontendSection(
       [
         ...pythonProvisioningCommands(config),
-        "papyrus auth refresh-jwt --write-env .env",
-        "papyrus content export-published --out content-export --clean",
+        ...(readerConfig.preBuildCommands ?? []),
+        ...(readerConfig.skipContentExport ? [] : ["papyrus ops content export-published --auth guest --out content-export --clean"]),
       ],
       [readerConfig.buildCommand],
       readerConfig.baseDirectory,
@@ -126,6 +141,7 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
 }
 
 export function buildSpecFor(config: AmplifyAppShellSiteConfig, app: BuildSpecAppName): string {
+  if (app !== "reader" && !hasCmsApp(config)) throw new Error(`site ${config.siteId} has no cms app`);
   if (app === "cms-production") return cmsProductionBuildSpec(config);
   if (app === "cms-staging") return cmsStagingBuildSpec(config);
   return readerBuildSpec(config);