@anthusai/papyrus 5.16.0 → 5.17.0

package/infra/amplify-app-shell.ts

@@ -120,7 +120,7 @@ export class AmplifyAppShellStack extends Stack {
         description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
       })
       : undefined;
-    const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealing
+    const prospectusEnvironment: Record<string, string> = prospectusAccountsApiStageArn && prospectusSessionSealing
       ? {
         PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
         PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER: prospectusSessionSealing.parameterName,

package/infra/site-config.js

@@ -452,3 +452,17 @@ export function parseSiteConfig(raw) {
         validateOauthRedirectUrls(config);
     return config;
 }
+/**
+ * The CDK environment for a site's app-shell stack, taken only from the site's own `aws` block. There is
+ * deliberately no default account: a deploy that guesses an account can land in, or fail against, the wrong
+ * one.
+ */
+export function resolveDeployEnvironment(config) {
+    const account = config.aws?.accountId;
+    const region = config.aws?.region;
+    const missing = [account ? "" : "aws.accountId", region ? "" : "aws.region"].filter(Boolean);
+    if (!account || !region) {
+        throw new Error(`site "${config.siteId}" does not say where it deploys: add ${missing.join(" and ")} to its site.json, e.g. "aws": { "accountId": "<12-digit account>", "region": "us-east-1" }. No account is assumed.`);
+    }
+    return { account, region };
+}

package/infra/site-config.ts

@@ -93,8 +93,8 @@ export type AmplifyAppShellSiteConfig = {
 };
 
 /**
- * Where the site's AWS resources live, for operator tooling (`papyrus site google-secrets`). Not read by the
- * stack: the deploy account comes from the CDK environment. `accountId` is what the CLI asserts with STS
+ * Where the site's AWS resources live. `bin/app-shell.ts` deploys the stack into exactly this account and
+ * region (see `resolveDeployEnvironment`), and `papyrus site google-secrets` asserts `accountId` with STS
  * before it writes anything.
  */
 export type SiteAwsConfig = {
@@ -578,3 +578,20 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
 
   return config;
 }
+
+/**
+ * The CDK environment for a site's app-shell stack, taken only from the site's own `aws` block. There is
+ * deliberately no default account: a deploy that guesses an account can land in, or fail against, the wrong
+ * one.
+ */
+export function resolveDeployEnvironment(config: Pick<AmplifyAppShellSiteConfig, "siteId" | "aws">): { account: string; region: string } {
+  const account = config.aws?.accountId;
+  const region = config.aws?.region;
+  const missing = [account ? "" : "aws.accountId", region ? "" : "aws.region"].filter(Boolean);
+  if (!account || !region) {
+    throw new Error(
+      `site "${config.siteId}" does not say where it deploys: add ${missing.join(" and ")} to its site.json, e.g. "aws": { "accountId": "<12-digit account>", "region": "us-east-1" }. No account is assumed.`,
+    );
+  }
+  return { account, region };
+}

package/package.json

@@ -407,7 +407,7 @@
       "optional": true
     }
   },
-  "version": "5.16.0",
+  "version": "5.17.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.16.0",
+  "version": "5.17.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",