@anthusai/papyrus 1.0.0-next.9 → 1.0.0

package/infra/build-specs.js

@@ -1,4 +1,4 @@
-import { resolveStoragePreviewPrefix } from "./site-config.js";
+import { hasCmsApp, resolveStoragePreviewPrefix } from "./site-config.js";
 export function papyrusVersionToPep440(version) {
     const match = /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z-]+\.(\d+))?$/.exec(version);
     if (!match)
@@ -14,6 +14,8 @@ function commandLines(commands, indent) {
 }
 const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
 const FRONTEND_ENVIRONMENT_CAPTURE = "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
+const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
+const RUNTIME_OUTPUTS_COPY = "cp amplify_outputs.json .next/amplify_outputs.json";
 function pythonProvisioningCommands(config) {
     return [
         "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -30,6 +32,9 @@ function reader(config) {
         throw new Error(`site ${config.siteId} has no reader app (frontend ${config.frontend})`);
     return config.reader;
 }
+function stagingPreviewFor(config) {
+    return config.cms?.stagingPreview ?? config.reader;
+}
 function frontendSection(preBuildCommands, buildCommands, artifactsDirectory, cachePaths) {
     const lines = ["frontend:", "  phases:"];
     if (preBuildCommands.length > 0) {
@@ -50,20 +55,28 @@ export function cmsProductionBuildSpec(config) {
             "if [ -z \"${PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI:-}\" ]; then export PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD=true; fi",
             "npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID",
         ], "        "),
-        ...frontendSection([], [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"], ".next", [".next/cache/**/*", ".npm/**/*"]),
+        ...frontendSection([], [
+            FRONTEND_ENVIRONMENT_CAPTURE,
+            "npx papyrus-app sync && npm run build",
+            ...(config.frontend === "pretext" ? [RUNTIME_OUTPUTS_COPY] : []),
+        ], ".next", [".next/cache/**/*", ".npm/**/*"]),
     ].join("\n") + "\n";
 }
 export function cmsStagingBuildSpec(config) {
     const preBuild = [NPM_CLEAN_INSTALL, "npx ampx generate outputs --branch main --app-id $AWS_APP_ID"];
     const cachePaths = [".next/cache/**/*", ".npm/**/*"];
-    if (config.frontend === "markus-static") {
-        const readerConfig = reader(config);
-        preBuild.push(...pythonProvisioningCommands(config), "papyrus auth refresh-jwt --write-env .env", "papyrus content export-published --drafts --out content-export --clean", readerConfig.buildCommand, `papyrus content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`);
+    const preview = config.frontend === "markus-static" ? stagingPreviewFor(config) : undefined;
+    if (preview !== undefined) {
+        preBuild.push(...pythonProvisioningCommands(config), `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content export-published --drafts --out content-export --clean`, preview.buildCommand, `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content upload-preview --dir ${preview.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`);
         cachePaths.push(".uv-cache/**/*");
     }
     return [
         "version: 1",
-        ...frontendSection(preBuild, [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"], ".next", cachePaths),
+        ...frontendSection(preBuild, [
+            FRONTEND_ENVIRONMENT_CAPTURE,
+            "npx papyrus-app sync && npm run build",
+            RUNTIME_OUTPUTS_COPY,
+        ], ".next", cachePaths),
     ].join("\n") + "\n";
 }
 export function readerBuildSpec(config) {
@@ -72,11 +85,14 @@ export function readerBuildSpec(config) {
         "version: 1",
         ...frontendSection([
             ...pythonProvisioningCommands(config),
-            "papyrus content export-published --auth guest --out content-export --clean",
+            ...(readerConfig.preBuildCommands ?? []),
+            ...(readerConfig.skipContentExport ? [] : ["papyrus ops content export-published --auth guest --out content-export --clean"]),
         ], [readerConfig.buildCommand], readerConfig.baseDirectory, [".uv-cache/**/*"]),
     ].join("\n") + "\n";
 }
 export function buildSpecFor(config, app) {
+    if (app !== "reader" && !hasCmsApp(config))
+        throw new Error(`site ${config.siteId} has no cms app`);
     if (app === "cms-production")
         return cmsProductionBuildSpec(config);
     if (app === "cms-staging")

package/infra/build-specs.ts

@@ -1,4 +1,4 @@
-import { AmplifyAppShellSiteConfig, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, hasCmsApp, resolveStoragePreviewPrefix } from "./site-config";
 
 export type BuildSpecAppName = "cms-production" | "cms-staging" | "reader";
 
@@ -22,6 +22,10 @@ const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
 const FRONTEND_ENVIRONMENT_CAPTURE =
   "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
 
+const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
+
+const RUNTIME_OUTPUTS_COPY = "cp amplify_outputs.json .next/amplify_outputs.json";
+
 function pythonProvisioningCommands(config: AmplifyAppShellSiteConfig): string[] {
   return [
     "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -39,6 +43,10 @@ function reader(config: AmplifyAppShellSiteConfig): NonNullable<AmplifyAppShellS
   return config.reader;
 }
 
+function stagingPreviewFor(config: AmplifyAppShellSiteConfig): { buildCommand: string; baseDirectory: string } | undefined {
+  return config.cms?.stagingPreview ?? config.reader;
+}
+
 function frontendSection(preBuildCommands: string[], buildCommands: string[], artifactsDirectory: string, cachePaths: string[]): string[] {
   const lines = ["frontend:", "  phases:"];
   if (preBuildCommands.length > 0) {
@@ -76,7 +84,11 @@ export function cmsProductionBuildSpec(config: AmplifyAppShellSiteConfig): strin
     ),
     ...frontendSection(
       [],
-      [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"],
+      [
+        FRONTEND_ENVIRONMENT_CAPTURE,
+        "npx papyrus-app sync && npm run build",
+        ...(config.frontend === "pretext" ? [RUNTIME_OUTPUTS_COPY] : []),
+      ],
       ".next",
       [".next/cache/**/*", ".npm/**/*"],
     ),
@@ -86,14 +98,13 @@ export function cmsProductionBuildSpec(config: AmplifyAppShellSiteConfig): strin
 export function cmsStagingBuildSpec(config: AmplifyAppShellSiteConfig): string {
   const preBuild = [NPM_CLEAN_INSTALL, "npx ampx generate outputs --branch main --app-id $AWS_APP_ID"];
   const cachePaths = [".next/cache/**/*", ".npm/**/*"];
-  if (config.frontend === "markus-static") {
-    const readerConfig = reader(config);
+  const preview = config.frontend === "markus-static" ? stagingPreviewFor(config) : undefined;
+  if (preview !== undefined) {
     preBuild.push(
       ...pythonProvisioningCommands(config),
-      "papyrus auth refresh-jwt --write-env .env",
-      "papyrus content export-published --drafts --out content-export --clean",
-      readerConfig.buildCommand,
-      `papyrus content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`,
+      `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content export-published --drafts --out content-export --clean`,
+      preview.buildCommand,
+      `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content upload-preview --dir ${preview.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`,
     );
     cachePaths.push(".uv-cache/**/*");
   }
@@ -101,7 +112,11 @@ export function cmsStagingBuildSpec(config: AmplifyAppShellSiteConfig): string {
     "version: 1",
     ...frontendSection(
       preBuild,
-      [FRONTEND_ENVIRONMENT_CAPTURE, "npx papyrus-app sync && npm run build"],
+      [
+        FRONTEND_ENVIRONMENT_CAPTURE,
+        "npx papyrus-app sync && npm run build",
+        RUNTIME_OUTPUTS_COPY,
+      ],
       ".next",
       cachePaths,
     ),
@@ -115,7 +130,8 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
     ...frontendSection(
       [
         ...pythonProvisioningCommands(config),
-        "papyrus content export-published --auth guest --out content-export --clean",
+        ...(readerConfig.preBuildCommands ?? []),
+        ...(readerConfig.skipContentExport ? [] : ["papyrus ops content export-published --auth guest --out content-export --clean"]),
       ],
       [readerConfig.buildCommand],
       readerConfig.baseDirectory,
@@ -125,6 +141,7 @@ export function readerBuildSpec(config: AmplifyAppShellSiteConfig): string {
 }
 
 export function buildSpecFor(config: AmplifyAppShellSiteConfig, app: BuildSpecAppName): string {
+  if (app !== "reader" && !hasCmsApp(config)) throw new Error(`site ${config.siteId} has no cms app`);
   if (app === "cms-production") return cmsProductionBuildSpec(config);
   if (app === "cms-staging") return cmsStagingBuildSpec(config);
   return readerBuildSpec(config);

package/infra/site-config.js

@@ -1,14 +1,50 @@
+export const READER_REDIRECT_STATUSES = ["301", "302", "200", "404", "404-200"];
+export function hasCmsApp(config) {
+    return config.cms !== undefined;
+}
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
+const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
 const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
 const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
+const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+/** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
+export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
+    "GET/v1/identities/me",
+    "POST/v1/identities/google/challenge",
+    "POST/v1/identities/google/resolve",
+    "GET/v1/accounts",
+    "GET/v1/accounts/*",
+    "POST/v1/accounts/*/authorize",
+    "GET/v1/account-directory",
+    "GET/v1/account-directory/*",
+];
+export function resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) {
+    const [, , , region, , apiPath] = prospectusAccountsApiStageArn.split(":");
+    const [apiId, stageName] = apiPath.split("/");
+    return `https://${apiId}.execute-api.${region}.amazonaws.com/${stageName}/`;
+}
+function originOfRedirectUrl(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return value;
+    }
+}
+export function resolveRevalidateSecretParameterName(config) {
+    return `/papyrus/${config.siteId}/revalidate-secret`;
+}
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 function fail(field, problem) {
     throw new Error(`site.json: ${field} ${problem}`);
@@ -47,12 +83,96 @@ function rejectUnknownKeys(record, allowed, field) {
             fail(`${field}.${key}`, `is not a known field (known: ${allowed.join(", ")})`);
     }
 }
+function parseRedirects(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("cms.redirects", "must be a non-empty array");
+    return value.map((entry, index) => {
+        const field = `cms.redirects[${index}]`;
+        const record = requireObject(entry, field);
+        rejectUnknownKeys(record, ["source", "status"], field);
+        const source = requireString(record.source, `${field}.source`, HOST_NAME_PATTERN, "host name without scheme or path");
+        const status = record.status ?? 301;
+        if (status !== 301 && status !== 302)
+            fail(`${field}.status`, `must be 301 or 302, got ${JSON.stringify(status)}`);
+        return { source, status };
+    });
+}
+function parseReaderDomainPrefixes(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.domainPrefixes", "must be a non-empty array");
+    const prefixes = value.map((entry, index) => {
+        const field = `reader.domainPrefixes[${index}]`;
+        if (entry === "")
+            return "";
+        return requireString(entry, field, DOMAIN_PREFIX_PATTERN, 'single DNS label, or "" for the apex');
+    });
+    if (new Set(prefixes).size !== prefixes.length)
+        fail("reader.domainPrefixes", "must not repeat a prefix");
+    return prefixes;
+}
+function parseReaderRedirects(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.redirects", "must be a non-empty array");
+    return value.map((entry, index) => {
+        const field = `reader.redirects[${index}]`;
+        const record = requireObject(entry, field);
+        rejectUnknownKeys(record, ["source", "target", "status"], field);
+        const status = record.status ?? "301";
+        if (typeof status !== "string" || !READER_REDIRECT_STATUSES.includes(status)) {
+            fail(`${field}.status`, `must be one of ${READER_REDIRECT_STATUSES.join(", ")}, got ${JSON.stringify(status)}`);
+        }
+        return {
+            source: requireString(record.source, `${field}.source`),
+            target: requireString(record.target, `${field}.target`),
+            status: status,
+        };
+    });
+}
+function parseReaderCustomHeaders(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.customHeaders", "must be a non-empty array");
+    return value.map((entry, index) => {
+        const field = `reader.customHeaders[${index}]`;
+        const record = requireObject(entry, field);
+        rejectUnknownKeys(record, ["pattern", "headers"], field);
+        const headers = requireStringRecord(record.headers, `${field}.headers`);
+        if (Object.keys(headers).length === 0)
+            fail(`${field}.headers`, "must not be empty");
+        return { pattern: requireString(record.pattern, `${field}.pattern`), headers };
+    });
+}
+function parseReaderPreBuildCommands(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0)
+        fail("reader.preBuildCommands", "must be a non-empty array of commands");
+    return value.map((command, index) => requireString(command, `reader.preBuildCommands[${index}]`));
+}
+export function resolveRedirectSubDomainPrefix(rootDomain, source) {
+    return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
+}
 export function isStagingEnabled(config) {
     return config.cms.staging !== false;
 }
+export function resolveCmsHostName(config) {
+    if (!config.cms.domainName)
+        return undefined;
+    return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
+}
 export function resolveStagingDomainName(config) {
     if (!isStagingEnabled(config))
         return undefined;
+    if (config.cms.domainPrefix) {
+        return config.cms.stagingDomainPrefix ? `${config.cms.stagingDomainPrefix}.${config.cms.domainName}` : undefined;
+    }
     if (config.cms.stagingDomainName)
         return config.cms.stagingDomainName;
     if (!config.cms.domainName)
@@ -66,22 +186,19 @@ export function resolveStackName(config) {
 export function resolveStoragePreviewPrefix(config) {
     return config.storagePreviewPrefix ?? "preview/";
 }
-export function parseSiteConfig(raw) {
-    const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
-    const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
-    const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
-    const brand = requireString(record.brand, "brand");
-    const frontend = requireString(record.frontend, "frontend");
-    if (frontend !== "pretext" && frontend !== "markus-static") {
-        fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
-    }
-    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
-    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
-    const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
-    const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
-    const cmsRecord = requireObject(record.cms, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "buildComputeType", "environment", "stagingDomainName"], "cms");
+function parseStagingPreview(value) {
+    if (value === undefined)
+        return undefined;
+    const record = requireObject(value, "cms.stagingPreview");
+    rejectUnknownKeys(record, ["buildCommand", "baseDirectory"], "cms.stagingPreview");
+    return {
+        buildCommand: requireString(record.buildCommand, "cms.stagingPreview.buildCommand"),
+        baseDirectory: requireString(record.baseDirectory, "cms.stagingPreview.baseDirectory"),
+    };
+}
+function parseCms(value) {
+    const cmsRecord = requireObject(value, "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -89,26 +206,119 @@ export function parseSiteConfig(raw) {
     if (cmsRecord.staging !== undefined && typeof cmsRecord.staging !== "boolean") {
         fail("cms.staging", `must be a boolean, got ${JSON.stringify(cmsRecord.staging)}`);
     }
+    if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
+        fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
+    }
     const cms = {
         appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
         domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+        domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
         staging: cmsRecord.staging,
+        cognitoDomainPrefix: requireString(cmsRecord.cognitoDomainPrefix, "cms.cognitoDomainPrefix", COGNITO_DOMAIN_PREFIX_PATTERN, "lowercase letters, digits and hyphens; globally unique per region"),
+        applyCognitoDomainPrefix: cmsRecord.applyCognitoDomainPrefix,
         buildComputeType: buildComputeType,
         environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
         stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
+        stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+        redirects: parseRedirects(cmsRecord.redirects),
+        stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
+        prospectusAccountsApiStageArn: optionalString(cmsRecord.prospectusAccountsApiStageArn, "cms.prospectusAccountsApiStageArn", PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN, "arn:aws:execute-api:<region>:<account>:<api id>/api"),
     };
+    const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
+    if (reservedWord) {
+        fail("cms.cognitoDomainPrefix", `must not contain "${reservedWord}" (Cognito reserves it): ${JSON.stringify(cms.cognitoDomainPrefix)}`);
+    }
+    for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
+        if (key in cms.environment) {
+            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
+        }
+    }
     if (cms.staging === false && cms.stagingDomainName) {
         fail("cms.stagingDomainName", "must not be set when cms.staging is false");
     }
     if (cms.stagingDomainName && !cms.domainName) {
         fail("cms.stagingDomainName", "requires cms.domainName");
     }
+    if (cms.domainPrefix && !cms.domainName) {
+        fail("cms.domainPrefix", "requires cms.domainName (the root domain)");
+    }
+    if (cms.stagingDomainPrefix && !cms.domainPrefix) {
+        fail("cms.stagingDomainPrefix", "requires cms.domainPrefix");
+    }
+    if (cms.domainPrefix && cms.stagingDomainName) {
+        fail("cms.stagingDomainName", "must not be set with cms.domainPrefix: use cms.stagingDomainPrefix");
+    }
+    if (cms.staging === false && cms.stagingDomainPrefix) {
+        fail("cms.stagingDomainPrefix", "must not be set when cms.staging is false");
+    }
+    if (cms.domainPrefix && cms.staging !== false && !cms.stagingDomainPrefix) {
+        fail("cms.stagingDomainPrefix", "is required when cms.domainPrefix is set and staging is enabled: the staging host is never derived under a shared root domain");
+    }
+    if (cms.domainPrefix && cms.stagingDomainPrefix === cms.domainPrefix) {
+        fail("cms.stagingDomainPrefix", "must differ from cms.domainPrefix");
+    }
+    if (cms.redirects) {
+        if (!cms.domainPrefix)
+            fail("cms.redirects", "requires cms.domainPrefix (redirects target the primary host under a shared root domain)");
+        cms.redirects.forEach((redirect, index) => {
+            const field = `cms.redirects[${index}].source`;
+            const root = cms.domainName;
+            if (redirect.source !== root && !(redirect.source.endsWith(`.${root}`) && DOMAIN_PREFIX_PATTERN.test(redirect.source.slice(0, -root.length - 1)))) {
+                fail(field, `must be the root domain ${root} or a single label under it: ${JSON.stringify(redirect.source)}`);
+            }
+            if (redirect.source === resolveCmsHostName({ cms }))
+                fail(field, "must differ from the primary host");
+            if (redirect.source === resolveStagingDomainName({ cms }))
+                fail(field, "must differ from the staging host");
+        });
+        if (new Set(cms.redirects.map((redirect) => redirect.source)).size !== cms.redirects.length) {
+            fail("cms.redirects", "must not repeat a source");
+        }
+    }
+    return cms;
+}
+function validateOauthRedirectUrls(config) {
+    const redirectValue = config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
+    if (redirectValue === undefined)
+        fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
+    const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+    const stagingDomainName = resolveStagingDomainName(config);
+    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
+    const requiredOrigins = [
+        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
+    ];
+    for (const origin of requiredOrigins) {
+        if (!listedOrigins.has(origin)) {
+            fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
+        }
+    }
+}
+export function parseSiteConfig(raw) {
+    const record = requireObject(raw, "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
+    const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+    const brand = requireString(record.brand, "brand");
+    const frontend = requireString(record.frontend, "frontend");
+    if (frontend !== "pretext" && frontend !== "markus-static") {
+        fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
+    }
+    const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+    const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+    const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
+    const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
+    const cms = record.cms === undefined && frontend === "markus-static" ? undefined : parseCms(record.cms);
     let reader;
     if (record.reader !== undefined) {
         if (frontend !== "markus-static")
             fail("reader", `is only allowed when frontend is "markus-static"`);
         const readerRecord = requireObject(record.reader, "reader");
-        rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
+        rejectUnknownKeys(readerRecord, ["appName", "domainName", "domainPrefixes", "branchName", "buildCommand", "baseDirectory", "environment", "redirects", "customHeaders", "preBuildCommands", "skipContentExport"], "reader");
+        if (readerRecord.skipContentExport !== undefined && typeof readerRecord.skipContentExport !== "boolean") {
+            fail("reader.skipContentExport", `must be a boolean, got ${JSON.stringify(readerRecord.skipContentExport)}`);
+        }
         reader = {
             appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
             domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
@@ -116,13 +326,28 @@ export function parseSiteConfig(raw) {
             buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
             baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
             environment: readerRecord.environment === undefined ? undefined : requireStringRecord(readerRecord.environment, "reader.environment"),
+            domainPrefixes: parseReaderDomainPrefixes(readerRecord.domainPrefixes),
+            redirects: parseReaderRedirects(readerRecord.redirects),
+            customHeaders: parseReaderCustomHeaders(readerRecord.customHeaders),
+            preBuildCommands: parseReaderPreBuildCommands(readerRecord.preBuildCommands),
+            skipContentExport: readerRecord.skipContentExport,
         };
+        if (reader.domainPrefixes && !reader.domainName)
+            fail("reader.domainPrefixes", "requires reader.domainName");
+    }
+    else if (frontend === "markus-static" && cms === undefined) {
+        fail("reader", `is required when frontend is "markus-static" and there is no cms section`);
+    }
+    if (cms?.stagingPreview !== undefined && frontend !== "markus-static") {
+        fail("cms.stagingPreview", `is only allowed when frontend is "markus-static"`);
     }
-    else if (frontend === "markus-static") {
-        fail("reader", `is required when frontend is "markus-static"`);
+    if (cms?.stagingPreview !== undefined && cms.staging === false) {
+        fail("cms.stagingPreview", "must not be set when cms.staging is false");
     }
     let github;
     if (record.github !== undefined) {
+        if (cms === undefined)
+            fail("github", "requires cms (the CI role is scoped to the CMS app)");
         const githubRecord = requireObject(record.github, "github");
         rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
         const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
@@ -130,7 +355,7 @@ export function parseSiteConfig(raw) {
         if (repository !== `https://github.com/${owner}/${repo}`) {
             fail("github", `owner/repo must match repository ${repository}`);
         }
-        let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+        let branches = cms?.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
         if (githubRecord.branches !== undefined) {
             if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
                 fail("github.branches", "must be a non-empty array of branch names");
@@ -147,7 +372,7 @@ export function parseSiteConfig(raw) {
             fail("github.ciCanDeployInfra", "must be a boolean");
         github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra };
     }
-    const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+    const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
     if (hasDomain && hostedZoneId === undefined) {
         fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
     }
@@ -167,20 +392,7 @@ export function parseSiteConfig(raw) {
         storagePreviewPrefix,
         github,
     };
-    const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
-    if (redirectValue === undefined)
-        fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
-    const redirectUrls = redirectValue.split(",").map((url) => url.trim());
-    const stagingDomainName = resolveStagingDomainName(config);
-    const requiredOrigins = [
-        ...(cms.domainName ? [`https://${cms.domainName}/`] : []),
-        ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
-        LOCAL_DEVELOPMENT_ORIGIN,
-    ];
-    for (const origin of requiredOrigins) {
-        if (!redirectUrls.includes(origin)) {
-            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
-        }
-    }
+    if (hasCmsApp(config))
+        validateOauthRedirectUrls(config);
     return config;
 }