@anthusai/papyrus 1.0.0-next.9 → 1.0.0

package/infra/site-config.ts

@@ -1,3 +1,49 @@
+export type CmsRedirect = {
+  source: string;
+  status: 301 | 302;
+};
+
+export type ReaderRedirectStatus = "301" | "302" | "200" | "404" | "404-200";
+
+export type ReaderRedirect = {
+  source: string;
+  target: string;
+  status: ReaderRedirectStatus;
+};
+
+export type ReaderCustomHeaderRule = {
+  pattern: string;
+  headers: Record<string, string>;
+};
+
+export const READER_REDIRECT_STATUSES: ReaderRedirectStatus[] = ["301", "302", "200", "404", "404-200"];
+
+/**
+ * What the CMS `staging` branch builds to preview drafts of a markus-static site: the site build
+ * command and the directory it writes. Without it, and without a `reader` to borrow them from,
+ * the staging branch builds the newsroom only.
+ */
+export type StagingPreviewConfig = {
+  buildCommand: string;
+  baseDirectory: string;
+};
+
+export type CmsConfig = {
+  appName?: string;
+  domainName?: string;
+  domainPrefix?: string;
+  staging?: boolean;
+  stagingPreview?: StagingPreviewConfig;
+  cognitoDomainPrefix: string;
+  applyCognitoDomainPrefix?: boolean;
+  buildComputeType?: "STANDARD" | "STANDARD_8GB";
+  environment: Record<string, string>;
+  stagingDomainName?: string;
+  stagingDomainPrefix?: string;
+  redirects?: CmsRedirect[];
+  prospectusAccountsApiStageArn?: string;
+};
+
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
@@ -5,21 +51,19 @@ export type AmplifyAppShellSiteConfig = {
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
   stackName?: string;
-  cms: {
-    appName?: string;
-    domainName?: string;
-    staging?: boolean;
-    buildComputeType?: "STANDARD" | "STANDARD_8GB";
-    environment: Record<string, string>;
-    stagingDomainName?: string;
-  };
+  cms?: CmsConfig;
   reader?: {
     appName?: string;
     domainName?: string;
+    domainPrefixes?: string[];
     branchName?: string;
     buildCommand: string;
     baseDirectory: string;
     environment?: Record<string, string>;
+    redirects?: ReaderRedirect[];
+    customHeaders?: ReaderCustomHeaderRule[];
+    preBuildCommands?: string[];
+    skipContentExport?: boolean;
   };
   papyrusVersion: string;
   storagePreviewPrefix?: string;
@@ -31,18 +75,59 @@ export type AmplifyAppShellSiteConfig = {
   };
 };
 
+export type CmsSiteConfig = AmplifyAppShellSiteConfig & { cms: CmsConfig };
+
+export function hasCmsApp(config: AmplifyAppShellSiteConfig): config is CmsSiteConfig {
+  return config.cms !== undefined;
+}
+
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
+const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
 const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
 const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
+const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+
+/** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
+export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
+  "GET/v1/identities/me",
+  "POST/v1/identities/google/challenge",
+  "POST/v1/identities/google/resolve",
+  "GET/v1/accounts",
+  "GET/v1/accounts/*",
+  "POST/v1/accounts/*/authorize",
+  "GET/v1/account-directory",
+  "GET/v1/account-directory/*",
+];
+
+export function resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn: string): string {
+  const [, , , region, , apiPath] = prospectusAccountsApiStageArn.split(":");
+  const [apiId, stageName] = apiPath.split("/");
+  return `https://${apiId}.execute-api.${region}.amazonaws.com/${stageName}/`;
+}
+function originOfRedirectUrl(value: string): string {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return value;
+  }
+}
+
+export function resolveRevalidateSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
+  return `/papyrus/${config.siteId}/revalidate-secret`;
+}
+
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 
 function fail(field: string, problem: string): never {
@@ -86,12 +171,88 @@ function rejectUnknownKeys(record: Record<string, unknown>, allowed: string[], f
   }
 }
 
-export function isStagingEnabled(config: Pick<AmplifyAppShellSiteConfig, "cms">): boolean {
+function parseRedirects(value: unknown): CmsRedirect[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("cms.redirects", "must be a non-empty array");
+  return (value as unknown[]).map((entry, index) => {
+    const field = `cms.redirects[${index}]`;
+    const record = requireObject(entry, field);
+    rejectUnknownKeys(record, ["source", "status"], field);
+    const source = requireString(record.source, `${field}.source`, HOST_NAME_PATTERN, "host name without scheme or path");
+    const status = record.status ?? 301;
+    if (status !== 301 && status !== 302) fail(`${field}.status`, `must be 301 or 302, got ${JSON.stringify(status)}`);
+    return { source, status };
+  });
+}
+
+function parseReaderDomainPrefixes(value: unknown): string[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.domainPrefixes", "must be a non-empty array");
+  const prefixes = (value as unknown[]).map((entry, index) => {
+    const field = `reader.domainPrefixes[${index}]`;
+    if (entry === "") return "";
+    return requireString(entry, field, DOMAIN_PREFIX_PATTERN, 'single DNS label, or "" for the apex');
+  });
+  if (new Set(prefixes).size !== prefixes.length) fail("reader.domainPrefixes", "must not repeat a prefix");
+  return prefixes;
+}
+
+function parseReaderRedirects(value: unknown): ReaderRedirect[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.redirects", "must be a non-empty array");
+  return (value as unknown[]).map((entry, index) => {
+    const field = `reader.redirects[${index}]`;
+    const record = requireObject(entry, field);
+    rejectUnknownKeys(record, ["source", "target", "status"], field);
+    const status = record.status ?? "301";
+    if (typeof status !== "string" || !READER_REDIRECT_STATUSES.includes(status as ReaderRedirectStatus)) {
+      fail(`${field}.status`, `must be one of ${READER_REDIRECT_STATUSES.join(", ")}, got ${JSON.stringify(status)}`);
+    }
+    return {
+      source: requireString(record.source, `${field}.source`),
+      target: requireString(record.target, `${field}.target`),
+      status: status as ReaderRedirectStatus,
+    };
+  });
+}
+
+function parseReaderCustomHeaders(value: unknown): ReaderCustomHeaderRule[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.customHeaders", "must be a non-empty array");
+  return (value as unknown[]).map((entry, index) => {
+    const field = `reader.customHeaders[${index}]`;
+    const record = requireObject(entry, field);
+    rejectUnknownKeys(record, ["pattern", "headers"], field);
+    const headers = requireStringRecord(record.headers, `${field}.headers`);
+    if (Object.keys(headers).length === 0) fail(`${field}.headers`, "must not be empty");
+    return { pattern: requireString(record.pattern, `${field}.pattern`), headers };
+  });
+}
+
+function parseReaderPreBuildCommands(value: unknown): string[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || value.length === 0) fail("reader.preBuildCommands", "must be a non-empty array of commands");
+  return (value as unknown[]).map((command, index) => requireString(command, `reader.preBuildCommands[${index}]`));
+}
+
+export function resolveRedirectSubDomainPrefix(rootDomain: string, source: string): string {
+  return source === rootDomain ? "" : source.slice(0, -rootDomain.length - 1);
+}
+
+export function isStagingEnabled(config: Pick<CmsSiteConfig, "cms">): boolean {
   return config.cms.staging !== false;
 }
 
-export function resolveStagingDomainName(config: Pick<AmplifyAppShellSiteConfig, "cms">): string | undefined {
+export function resolveCmsHostName(config: Pick<CmsSiteConfig, "cms">): string | undefined {
+  if (!config.cms.domainName) return undefined;
+  return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
+}
+
+export function resolveStagingDomainName(config: Pick<CmsSiteConfig, "cms">): string | undefined {
   if (!isStagingEnabled(config)) return undefined;
+  if (config.cms.domainPrefix) {
+    return config.cms.stagingDomainPrefix ? `${config.cms.stagingDomainPrefix}.${config.cms.domainName}` : undefined;
+  }
   if (config.cms.stagingDomainName) return config.cms.stagingDomainName;
   if (!config.cms.domainName) return undefined;
   const [, ...rest] = config.cms.domainName.split(".");
@@ -106,28 +267,19 @@ export function resolveStoragePreviewPrefix(config: Pick<AmplifyAppShellSiteConf
   return config.storagePreviewPrefix ?? "preview/";
 }
 
-export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
-  const record = requireObject(raw, "site");
-  rejectUnknownKeys(
-    record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
-    "site",
-  );
-
-  const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
-  const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
-  const brand = requireString(record.brand, "brand");
-  const frontend = requireString(record.frontend, "frontend");
-  if (frontend !== "pretext" && frontend !== "markus-static") {
-    fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
-  }
-  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
-  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
-  const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
-  const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
+function parseStagingPreview(value: unknown): StagingPreviewConfig | undefined {
+  if (value === undefined) return undefined;
+  const record = requireObject(value, "cms.stagingPreview");
+  rejectUnknownKeys(record, ["buildCommand", "baseDirectory"], "cms.stagingPreview");
+  return {
+    buildCommand: requireString(record.buildCommand, "cms.stagingPreview.buildCommand"),
+    baseDirectory: requireString(record.baseDirectory, "cms.stagingPreview.baseDirectory"),
+  };
+}
 
-  const cmsRecord = requireObject(record.cms, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "buildComputeType", "environment", "stagingDomainName"], "cms");
+function parseCms(value: unknown): CmsConfig {
+  const cmsRecord = requireObject(value, "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -135,27 +287,137 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   if (cmsRecord.staging !== undefined && typeof cmsRecord.staging !== "boolean") {
     fail("cms.staging", `must be a boolean, got ${JSON.stringify(cmsRecord.staging)}`);
   }
-  const cms: AmplifyAppShellSiteConfig["cms"] = {
+  if (cmsRecord.applyCognitoDomainPrefix !== undefined && typeof cmsRecord.applyCognitoDomainPrefix !== "boolean") {
+    fail("cms.applyCognitoDomainPrefix", `must be a boolean, got ${JSON.stringify(cmsRecord.applyCognitoDomainPrefix)}`);
+  }
+  const cms: CmsConfig = {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
     domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
+    domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
     staging: cmsRecord.staging as boolean | undefined,
+    cognitoDomainPrefix: requireString(
+      cmsRecord.cognitoDomainPrefix,
+      "cms.cognitoDomainPrefix",
+      COGNITO_DOMAIN_PREFIX_PATTERN,
+      "lowercase letters, digits and hyphens; globally unique per region",
+    ),
+    applyCognitoDomainPrefix: cmsRecord.applyCognitoDomainPrefix as boolean | undefined,
     buildComputeType: buildComputeType as "STANDARD" | "STANDARD_8GB" | undefined,
     environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
     stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
+    stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+    redirects: parseRedirects(cmsRecord.redirects),
+    stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
+    prospectusAccountsApiStageArn: optionalString(
+      cmsRecord.prospectusAccountsApiStageArn,
+      "cms.prospectusAccountsApiStageArn",
+      PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN,
+      "arn:aws:execute-api:<region>:<account>:<api id>/api",
+    ),
   };
 
+  const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
+  if (reservedWord) {
+    fail("cms.cognitoDomainPrefix", `must not contain "${reservedWord}" (Cognito reserves it): ${JSON.stringify(cms.cognitoDomainPrefix)}`);
+  }
+  for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
+    if (key in cms.environment) {
+      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
+    }
+  }
+
   if (cms.staging === false && cms.stagingDomainName) {
     fail("cms.stagingDomainName", "must not be set when cms.staging is false");
   }
   if (cms.stagingDomainName && !cms.domainName) {
     fail("cms.stagingDomainName", "requires cms.domainName");
   }
+  if (cms.domainPrefix && !cms.domainName) {
+    fail("cms.domainPrefix", "requires cms.domainName (the root domain)");
+  }
+  if (cms.stagingDomainPrefix && !cms.domainPrefix) {
+    fail("cms.stagingDomainPrefix", "requires cms.domainPrefix");
+  }
+  if (cms.domainPrefix && cms.stagingDomainName) {
+    fail("cms.stagingDomainName", "must not be set with cms.domainPrefix: use cms.stagingDomainPrefix");
+  }
+  if (cms.staging === false && cms.stagingDomainPrefix) {
+    fail("cms.stagingDomainPrefix", "must not be set when cms.staging is false");
+  }
+  if (cms.domainPrefix && cms.staging !== false && !cms.stagingDomainPrefix) {
+    fail("cms.stagingDomainPrefix", "is required when cms.domainPrefix is set and staging is enabled: the staging host is never derived under a shared root domain");
+  }
+  if (cms.domainPrefix && cms.stagingDomainPrefix === cms.domainPrefix) {
+    fail("cms.stagingDomainPrefix", "must differ from cms.domainPrefix");
+  }
+
+  if (cms.redirects) {
+    if (!cms.domainPrefix) fail("cms.redirects", "requires cms.domainPrefix (redirects target the primary host under a shared root domain)");
+    cms.redirects.forEach((redirect, index) => {
+      const field = `cms.redirects[${index}].source`;
+      const root = cms.domainName as string;
+      if (redirect.source !== root && !(redirect.source.endsWith(`.${root}`) && DOMAIN_PREFIX_PATTERN.test(redirect.source.slice(0, -root.length - 1)))) {
+        fail(field, `must be the root domain ${root} or a single label under it: ${JSON.stringify(redirect.source)}`);
+      }
+      if (redirect.source === resolveCmsHostName({ cms })) fail(field, "must differ from the primary host");
+      if (redirect.source === resolveStagingDomainName({ cms })) fail(field, "must differ from the staging host");
+    });
+    if (new Set(cms.redirects.map((redirect) => redirect.source)).size !== cms.redirects.length) {
+      fail("cms.redirects", "must not repeat a source");
+    }
+  }
+
+  return cms;
+}
+
+function validateOauthRedirectUrls(config: CmsSiteConfig): void {
+  const redirectValue = config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
+  if (redirectValue === undefined) fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
+  const redirectUrls = redirectValue.split(",").map((url) => url.trim());
+  const stagingDomainName = resolveStagingDomainName(config);
+  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
+  const requiredOrigins = [
+    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
+  ];
+  for (const origin of requiredOrigins) {
+    if (!listedOrigins.has(origin)) {
+      fail("config.cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
+    }
+  }
+}
+
+export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
+  const record = requireObject(raw, "site");
+  rejectUnknownKeys(
+    record,
+    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    "site",
+  );
+
+  const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
+  const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+  const brand = requireString(record.brand, "brand");
+  const frontend = requireString(record.frontend, "frontend");
+  if (frontend !== "pretext" && frontend !== "markus-static") {
+    fail("frontend", `must be "pretext" or "markus-static", got ${JSON.stringify(frontend)}`);
+  }
+  const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
+  const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+  const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
+  const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
+
+  const cms = record.cms === undefined && frontend === "markus-static" ? undefined : parseCms(record.cms);
 
   let reader: AmplifyAppShellSiteConfig["reader"];
   if (record.reader !== undefined) {
     if (frontend !== "markus-static") fail("reader", `is only allowed when frontend is "markus-static"`);
     const readerRecord = requireObject(record.reader, "reader");
-    rejectUnknownKeys(readerRecord, ["appName", "domainName", "branchName", "buildCommand", "baseDirectory", "environment"], "reader");
+    rejectUnknownKeys(readerRecord, ["appName", "domainName", "domainPrefixes", "branchName", "buildCommand", "baseDirectory", "environment", "redirects", "customHeaders", "preBuildCommands", "skipContentExport"], "reader");
+    if (readerRecord.skipContentExport !== undefined && typeof readerRecord.skipContentExport !== "boolean") {
+      fail("reader.skipContentExport", `must be a boolean, got ${JSON.stringify(readerRecord.skipContentExport)}`);
+    }
     reader = {
       appName: optionalString(readerRecord.appName, "reader.appName", APP_NAME_PATTERN),
       domainName: optionalString(readerRecord.domainName, "reader.domainName", HOST_NAME_PATTERN, "host name"),
@@ -163,13 +425,26 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
       buildCommand: requireString(readerRecord.buildCommand, "reader.buildCommand"),
       baseDirectory: requireString(readerRecord.baseDirectory, "reader.baseDirectory"),
       environment: readerRecord.environment === undefined ? undefined : requireStringRecord(readerRecord.environment, "reader.environment"),
+      domainPrefixes: parseReaderDomainPrefixes(readerRecord.domainPrefixes),
+      redirects: parseReaderRedirects(readerRecord.redirects),
+      customHeaders: parseReaderCustomHeaders(readerRecord.customHeaders),
+      preBuildCommands: parseReaderPreBuildCommands(readerRecord.preBuildCommands),
+      skipContentExport: readerRecord.skipContentExport as boolean | undefined,
     };
-  } else if (frontend === "markus-static") {
-    fail("reader", `is required when frontend is "markus-static"`);
+    if (reader.domainPrefixes && !reader.domainName) fail("reader.domainPrefixes", "requires reader.domainName");
+  } else if (frontend === "markus-static" && cms === undefined) {
+    fail("reader", `is required when frontend is "markus-static" and there is no cms section`);
+  }
+  if (cms?.stagingPreview !== undefined && frontend !== "markus-static") {
+    fail("cms.stagingPreview", `is only allowed when frontend is "markus-static"`);
+  }
+  if (cms?.stagingPreview !== undefined && cms.staging === false) {
+    fail("cms.stagingPreview", "must not be set when cms.staging is false");
   }
 
   let github: AmplifyAppShellSiteConfig["github"];
   if (record.github !== undefined) {
+    if (cms === undefined) fail("github", "requires cms (the CI role is scoped to the CMS app)");
     const githubRecord = requireObject(record.github, "github");
     rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
     const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
@@ -177,7 +452,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     if (repository !== `https://github.com/${owner}/${repo}`) {
       fail("github", `owner/repo must match repository ${repository}`);
     }
-    let branches = cms.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
+    let branches = cms?.staging === false ? DEFAULT_CI_BRANCHES.filter((branch) => branch !== "staging") : DEFAULT_CI_BRANCHES;
     if (githubRecord.branches !== undefined) {
       if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
         fail("github.branches", "must be a non-empty array of branch names");
@@ -194,7 +469,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean };
   }
 
-  const hasDomain = cms.domainName !== undefined || reader?.domainName !== undefined;
+  const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
   if (hasDomain && hostedZoneId === undefined) {
     fail("hostedZoneId", "is required when cms.domainName or reader.domainName is set");
   }
@@ -216,20 +491,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     github,
   };
 
-  const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
-  if (redirectValue === undefined) fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
-  const redirectUrls = redirectValue.split(",").map((url) => url.trim());
-  const stagingDomainName = resolveStagingDomainName(config);
-  const requiredOrigins = [
-    ...(cms.domainName ? [`https://${cms.domainName}/`] : []),
-    ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
-    LOCAL_DEVELOPMENT_ORIGIN,
-  ];
-  for (const origin of requiredOrigins) {
-    if (!redirectUrls.includes(origin)) {
-      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
-    }
-  }
+  if (hasCmsApp(config)) validateOauthRedirectUrls(config);
 
   return config;
 }

package/lib/amplify-outputs-path.ts

@@ -6,7 +6,11 @@ export function getAmplifyOutputsPath(): string {
   if (explicit) {
     return path.isAbsolute(explicit) ? explicit : path.join(process.cwd(), explicit);
   }
-  return path.join(process.cwd(), "amplify_outputs.json");
+  const checkoutRootPath = path.join(process.cwd(), "amplify_outputs.json");
+  if (fs.existsSync(checkoutRootPath)) return checkoutRootPath;
+  const shippedBundlePath = path.join(process.cwd(), ".next", "amplify_outputs.json");
+  if (fs.existsSync(shippedBundlePath)) return shippedBundlePath;
+  return checkoutRootPath;
 }
 
 export function readAmplifyOutputsFile(): Record<string, unknown> | null {

package/lib/amplify-server-runtime.ts

@@ -1,6 +1,13 @@
 import fs from "node:fs";
 import { createServerRunner } from "@aws-amplify/adapter-nextjs";
 import { Amplify, type ResourcesConfig } from "aws-amplify";
+import {
+  createAWSCredentialsAndIdentityIdProvider,
+  createUserPoolsTokenProvider,
+  runWithAmplifyServerContext as runWithAmplifyContext,
+} from "aws-amplify/adapter-core";
+import { sharedInMemoryStorage } from "aws-amplify/utils";
+import { createSharedCredentialsProvider } from "./shared-credentials-provider";
 import { assertSandboxAmplifyOutputsForDev } from "./amplify-outputs-guard";
 import { getAmplifyOutputsPath } from "./amplify-outputs-path";
 
@@ -14,14 +21,42 @@ export function getAmplifyServerRuntime(): AmplifyServerRuntime {
   if (cachedRuntime) return cachedRuntime;
 
   const config = loadAmplifyOutputs();
-  Amplify.configure(config, { ssr: true });
   cachedRuntime = {
     ...createServerRunner({ config }),
     config,
   };
+  Amplify.configure(config, config.Auth ? { ssr: true, Auth: getGuestProviders(config) } : { ssr: true });
   return cachedRuntime;
 }
 
+type GuestProviders = {
+  credentialsProvider: ReturnType<typeof createAWSCredentialsAndIdentityIdProvider>;
+  tokenProvider: ReturnType<typeof createUserPoolsTokenProvider>;
+};
+
+const GUEST_PROVIDERS_KEY = Symbol.for("papyrus.guestAmplifyProviders");
+
+function getGuestProviders(config: ResourcesConfig): GuestProviders {
+  const holder = globalThis as unknown as Record<symbol, GuestProviders | undefined>;
+  const existing = holder[GUEST_PROVIDERS_KEY];
+  if (existing) return existing;
+  const auth = config.Auth as NonNullable<ResourcesConfig["Auth"]>;
+  const created: GuestProviders = {
+    credentialsProvider: createSharedCredentialsProvider(
+      createAWSCredentialsAndIdentityIdProvider(auth, sharedInMemoryStorage),
+    ),
+    tokenProvider: createUserPoolsTokenProvider(auth, sharedInMemoryStorage),
+  };
+  holder[GUEST_PROVIDERS_KEY] = created;
+  return created;
+}
+
+export function runWithGuestAmplifyContext<T>(operation: (contextSpec: Parameters<Parameters<typeof runWithAmplifyContext>[2]>[0]) => Promise<T>): Promise<T> {
+  const { config } = getAmplifyServerRuntime();
+  if (!config.Auth) return runWithAmplifyContext(config, {}, operation) as Promise<T>;
+  return runWithAmplifyContext(config, { Auth: getGuestProviders(config) }, operation) as Promise<T>;
+}
+
 export function hasAmplifyOutputs(): boolean {
   return fs.existsSync(getAmplifyOutputsPath());
 }

package/lib/approved-priming-proof-reports.ts

@@ -0,0 +1,6 @@
+/**
+ * Priming proof reports a publication owner approved for visitors, keyed by site brand id.
+ * A report reaches this map only through a reviewed commit of its
+ * `publications/priming-proofs/<brand id>.json` file; see docs/priming-proof.md.
+ */
+export const APPROVED_PRIMING_PROOF_REPORTS: Record<string, unknown> = {};