@anthusai/papyrus 5.17.0 → 5.19.0

package/amplify/publication/redirect-and-index.js

@@ -91,6 +91,22 @@ function markdownTwin(uri) {
   return uri.substring(0, uri.length - 5) + ".md";
 }
 
+// Directory-style sites keep a page's twin at /x/index.md, so a bare /x.md is rewritten there. The edge cannot test for
+// existence, hence the rule: a last segment <name>.md with a name other than index. A path prefix (a base path) is just
+// part of <path>. The flag is spliced in by redirect-rules.ts at deploy time from urls.style.
+const directoryTwins = /*PAPYRUS_DIRECTORY_TWINS*/false/*END_PAPYRUS_DIRECTORY_TWINS*/;
+
+function directoryTwin(uri) {
+  if (uri.length < 5 || uri.substring(uri.length - 3) !== ".md") {
+    return null;
+  }
+  const lastSegment = uri.substring(uri.lastIndexOf("/") + 1);
+  if (lastSegment === "index.md" || lastSegment === ".md") {
+    return null;
+  }
+  return uri.substring(0, uri.length - 3) + "/index.md";
+}
+
 async function handler(event) {
   const request = event.request;
   const redirectTarget = await lookUpRedirectTarget(request.uri);
@@ -110,6 +126,12 @@ async function handler(event) {
     };
   }
   request.uri = rewriteToIndexDocument(request.uri);
+  if (directoryTwins) {
+    const bareTwin = directoryTwin(request.uri);
+    if (bareTwin !== null) {
+      request.uri = bareTwin;
+    }
+  }
   if (negotiateMarkdown && prefersMarkdown(request)) {
     const twin = markdownTwin(request.uri);
     if (twin !== null) {

package/amplify/publication/redirect-rules.js

@@ -27,20 +27,34 @@ export function edgeRulesFromSettings(settings) {
 export function negotiatesMarkdown(settings) {
     return settings.site !== undefined && settings.agents?.markdown !== false;
 }
+/** A directory-style site keeps a page's Markdown twin at `/x/index.md`; the edge then serves a bare `/x.md` from there. */
+export function usesDirectoryTwins(settings) {
+    return negotiatesMarkdown(settings) && settings.urls?.style === "directory";
+}
 export function readEdgeConfig(staticDir, baseDirectory = process.cwd()) {
     if (staticDir === undefined)
-        return { rules: [], negotiateMarkdown: false };
+        return { rules: [], negotiateMarkdown: false, directoryTwins: false };
     const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
     if (!existsSync(settingsPath))
-        return { rules: [], negotiateMarkdown: false };
+        return { rules: [], negotiateMarkdown: false, directoryTwins: false };
     const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
-    return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings) };
+    return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings), directoryTwins: usesDirectoryTwins(settings) };
 }
 export function readEdgeRules(staticDir, baseDirectory = process.cwd()) {
     return readEdgeConfig(staticDir, baseDirectory).rules;
 }
 const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
 const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const TWINS_START = "/*PAPYRUS_DIRECTORY_TWINS*/";
+const TWINS_END = "/*END_PAPYRUS_DIRECTORY_TWINS*/";
+function spliceFlag(source, start, end, label) {
+    const from = source.indexOf(start);
+    const to = source.indexOf(end);
+    if (from === -1 || to === -1 || to < from) {
+        throw new Error(`redirect function source has no ${label} markers`);
+    }
+    return source.slice(0, from + start.length) + "true" + source.slice(to);
+}
 /** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
 export function compileRedirectFunctionSource(source, rules, options = {}) {
     const start = source.indexOf(START_MARKER);
@@ -50,12 +64,10 @@ export function compileRedirectFunctionSource(source, rules, options = {}) {
     }
     let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
     if (options.negotiateMarkdown === true) {
-        const from = compiled.indexOf(NEGOTIATE_START);
-        const to = compiled.indexOf(NEGOTIATE_END);
-        if (from === -1 || to === -1 || to < from) {
-            throw new Error("redirect function source has no markdown negotiation markers");
-        }
-        compiled = compiled.slice(0, from + NEGOTIATE_START.length) + "true" + compiled.slice(to);
+        compiled = spliceFlag(compiled, NEGOTIATE_START, NEGOTIATE_END, "markdown negotiation");
+    }
+    if (options.directoryTwins === true) {
+        compiled = spliceFlag(compiled, TWINS_START, TWINS_END, "directory twin");
     }
     return compiled;
 }

package/amplify/publication/redirect-rules.ts

@@ -38,14 +38,19 @@ export function negotiatesMarkdown(settings: ProjectionSettings): boolean {
   return settings.site !== undefined && settings.agents?.markdown !== false;
 }
 
-export type EdgeConfig = { rules: EdgeRedirectRule[]; negotiateMarkdown: boolean };
+/** A directory-style site keeps a page's Markdown twin at `/x/index.md`; the edge then serves a bare `/x.md` from there. */
+export function usesDirectoryTwins(settings: ProjectionSettings): boolean {
+  return negotiatesMarkdown(settings) && settings.urls?.style === "directory";
+}
+
+export type EdgeConfig = { rules: EdgeRedirectRule[]; negotiateMarkdown: boolean; directoryTwins: boolean };
 
 export function readEdgeConfig(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeConfig {
-  if (staticDir === undefined) return { rules: [], negotiateMarkdown: false };
+  if (staticDir === undefined) return { rules: [], negotiateMarkdown: false, directoryTwins: false };
   const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
-  if (!existsSync(settingsPath)) return { rules: [], negotiateMarkdown: false };
+  if (!existsSync(settingsPath)) return { rules: [], negotiateMarkdown: false, directoryTwins: false };
   const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as ProjectionSettings;
-  return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings) };
+  return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings), directoryTwins: usesDirectoryTwins(settings) };
 }
 
 export function readEdgeRules(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeRedirectRule[] {
@@ -54,12 +59,23 @@ export function readEdgeRules(staticDir: string | undefined, baseDirectory: stri
 
 const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
 const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const TWINS_START = "/*PAPYRUS_DIRECTORY_TWINS*/";
+const TWINS_END = "/*END_PAPYRUS_DIRECTORY_TWINS*/";
+
+function spliceFlag(source: string, start: string, end: string, label: string): string {
+  const from = source.indexOf(start);
+  const to = source.indexOf(end);
+  if (from === -1 || to === -1 || to < from) {
+    throw new Error(`redirect function source has no ${label} markers`);
+  }
+  return source.slice(0, from + start.length) + "true" + source.slice(to);
+}
 
 /** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
 export function compileRedirectFunctionSource(
   source: string,
   rules: EdgeRedirectRule[],
-  options: { negotiateMarkdown?: boolean } = {},
+  options: { negotiateMarkdown?: boolean; directoryTwins?: boolean } = {},
 ): string {
   const start = source.indexOf(START_MARKER);
   const end = source.indexOf(END_MARKER);
@@ -68,12 +84,10 @@ export function compileRedirectFunctionSource(
   }
   let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
   if (options.negotiateMarkdown === true) {
-    const from = compiled.indexOf(NEGOTIATE_START);
-    const to = compiled.indexOf(NEGOTIATE_END);
-    if (from === -1 || to === -1 || to < from) {
-      throw new Error("redirect function source has no markdown negotiation markers");
-    }
-    compiled = compiled.slice(0, from + NEGOTIATE_START.length) + "true" + compiled.slice(to);
+    compiled = spliceFlag(compiled, NEGOTIATE_START, NEGOTIATE_END, "markdown negotiation");
+  }
+  if (options.directoryTwins === true) {
+    compiled = spliceFlag(compiled, TWINS_START, TWINS_END, "directory twin");
   }
   return compiled;
 }

package/amplify/publication/s3-projection.js

@@ -70,10 +70,12 @@ export function addS3ProjectionPublication(scope, props, media) {
     assertValidPublicationConfig({ kind: "s3-projection", ...props });
     const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
     const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+    const edgeConfig = readEdgeConfig(props.staticDir);
     const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
         runtime: cloudfront.FunctionRuntime.JS_2_0,
-        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeConfig(props.staticDir).rules, {
-            negotiateMarkdown: readEdgeConfig(props.staticDir).negotiateMarkdown,
+        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), edgeConfig.rules, {
+            negotiateMarkdown: edgeConfig.negotiateMarkdown,
+            directoryTwins: edgeConfig.directoryTwins,
         })),
         keyValueStore,
     });

package/amplify/publication/s3-projection.ts

@@ -112,11 +112,13 @@ export function addS3ProjectionPublication(
   const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
 
   const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+  const edgeConfig = readEdgeConfig(props.staticDir);
   const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
     runtime: cloudfront.FunctionRuntime.JS_2_0,
     code: cloudfront.FunctionCode.fromInline(
-      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), readEdgeConfig(props.staticDir).rules, {
-        negotiateMarkdown: readEdgeConfig(props.staticDir).negotiateMarkdown,
+      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), edgeConfig.rules, {
+        negotiateMarkdown: edgeConfig.negotiateMarkdown,
+        directoryTwins: edgeConfig.directoryTwins,
       }),
     ),
     keyValueStore,

package/bin/papyrus-infra.mjs

@@ -53,7 +53,7 @@ if (command === "compile-edge-function") {
   const { compileRedirectFunctionSource, readEdgeConfig } = await import("../amplify/publication/redirect-rules.js");
   const functionSource = fs.readFileSync(new URL("../amplify/publication/redirect-and-index.js", import.meta.url), "utf8");
   const config = readEdgeConfig(staticDir);
-  const compiled = compileRedirectFunctionSource(functionSource, config.rules, { negotiateMarkdown: config.negotiateMarkdown });
+  const compiled = compileRedirectFunctionSource(functionSource, config.rules, { negotiateMarkdown: config.negotiateMarkdown, directoryTwins: config.directoryTwins });
   const out = opt("out");
   if (out) fs.writeFileSync(path.resolve(out), compiled);
   else process.stdout.write(compiled);

package/infra/amplify-app-shell.js

@@ -4,7 +4,7 @@ import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter.js";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -159,11 +159,14 @@ export class AmplifyAppShellStack extends Stack {
             ? `https://${stagingDomainName}/`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
         // The compute adapter's request URL is https://localhost:3000, so the site names its own public origin.
-        const productionSiteOrigin = cmsHostName ? `https://${cmsHostName}` : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain]);
+        // A site served by its own edge (cms.siteOrigin) has no Amplify domain, so the edge host is its origin.
+        const siteOrigin = resolveSiteOrigin(config);
+        const productionSiteOrigin = cmsHostName ? `https://${cmsHostName}` : siteOrigin ?? Fn.join("", ["https://main.", cmsApp.attrDefaultDomain]);
         const stagingSiteOrigin = stagingDomainName ? `https://${stagingDomainName}` : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]);
         const sharedRootDomain = config.cms.domainPrefix !== undefined;
         const defaultOriginsToAllow = [
             ...(config.cms.domainName ? [] : [productionOrigin]),
+            ...(siteOrigin ? [`${siteOrigin}/`] : []),
             ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
         ];
         const oauthRedirectUrls = defaultOriginsToAllow.length === 0

package/infra/amplify-app-shell.ts

@@ -5,7 +5,7 @@ import * as amplify from "aws-cdk-lib/aws-amplify";
 import { SecureStringParameter } from "./secure-string-parameter";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -178,11 +178,14 @@ export class AmplifyAppShellStack extends Stack {
       ? `https://${stagingDomainName}/`
       : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
     // The compute adapter's request URL is https://localhost:3000, so the site names its own public origin.
-    const productionSiteOrigin = cmsHostName ? `https://${cmsHostName}` : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain]);
+    // A site served by its own edge (cms.siteOrigin) has no Amplify domain, so the edge host is its origin.
+    const siteOrigin = resolveSiteOrigin(config);
+    const productionSiteOrigin = cmsHostName ? `https://${cmsHostName}` : siteOrigin ?? Fn.join("", ["https://main.", cmsApp.attrDefaultDomain]);
     const stagingSiteOrigin = stagingDomainName ? `https://${stagingDomainName}` : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]);
     const sharedRootDomain = config.cms.domainPrefix !== undefined;
     const defaultOriginsToAllow = [
       ...(config.cms.domainName ? [] : [productionOrigin]),
+      ...(siteOrigin ? [`${siteOrigin}/`] : []),
       ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
     ];
     const oauthRedirectUrls = defaultOriginsToAllow.length === 0

package/infra/site-config.js

@@ -24,6 +24,7 @@ const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_
 const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
+const SITE_ORIGIN_PATTERN = /^https:\/\/([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}(:\d{1,5})?$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
 const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
@@ -187,6 +188,9 @@ export function resolveCmsHostName(config) {
         return undefined;
     return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
 }
+export function resolveSiteOrigin(config) {
+    return config.cms.siteOrigin;
+}
 export function resolveStagingDomainName(config) {
     if (!isStagingEnabled(config))
         return undefined;
@@ -218,7 +222,7 @@ function parseStagingPreview(value) {
 }
 function parseCms(value) {
     const cmsRecord = requireObject(value, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "siteOrigin", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -236,6 +240,7 @@ function parseCms(value) {
         appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
         domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
         domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+        siteOrigin: optionalString(cmsRecord.siteOrigin, "cms.siteOrigin", SITE_ORIGIN_PATTERN, "https origin with no path, query or trailing slash, such as https://shipped.anth.us"),
         staging: cmsRecord.staging,
         cognitoDomainPrefix: requireString(cmsRecord.cognitoDomainPrefix, "cms.cognitoDomainPrefix", COGNITO_DOMAIN_PREFIX_PATTERN, "lowercase letters, digits and hyphens; globally unique per region"),
         applyCognitoDomainPrefix: cmsRecord.applyCognitoDomainPrefix,
@@ -257,6 +262,9 @@ function parseCms(value) {
             fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn and the public site origin comes from the site host");
         }
     }
+    if (cms.siteOrigin && cms.domainName) {
+        fail("cms.siteOrigin", "is for sites whose host is served by their own edge; remove it when cms.domainName is set");
+    }
     if (cms.staging === false && cms.stagingDomainName) {
         fail("cms.stagingDomainName", "must not be set when cms.staging is false");
     }

package/infra/site-config.ts

@@ -32,6 +32,8 @@ export type CmsConfig = {
   appName?: string;
   domainName?: string;
   domainPrefix?: string;
+  /** Public https origin of a site whose host is served by its own edge (no Amplify domain association). */
+  siteOrigin?: string;
   staging?: boolean;
   stagingPreview?: StagingPreviewConfig;
   cognitoDomainPrefix: string;
@@ -133,6 +135,7 @@ const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_
 const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
+const SITE_ORIGIN_PATTERN = /^https:\/\/([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}(:\d{1,5})?$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
 const STACK_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,127}$/;
@@ -298,6 +301,10 @@ export function resolveCmsHostName(config: Pick<CmsSiteConfig, "cms">): string |
   return config.cms.domainPrefix ? `${config.cms.domainPrefix}.${config.cms.domainName}` : config.cms.domainName;
 }
 
+export function resolveSiteOrigin(config: Pick<CmsSiteConfig, "cms">): string | undefined {
+  return config.cms.siteOrigin;
+}
+
 export function resolveStagingDomainName(config: Pick<CmsSiteConfig, "cms">): string | undefined {
   if (!isStagingEnabled(config)) return undefined;
   if (config.cms.domainPrefix) {
@@ -329,7 +336,7 @@ function parseStagingPreview(value: unknown): StagingPreviewConfig | undefined {
 
 function parseCms(value: unknown): CmsConfig {
   const cmsRecord = requireObject(value, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "siteOrigin", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn", "deployStackInBuild"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -347,6 +354,7 @@ function parseCms(value: unknown): CmsConfig {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
     domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
     domainPrefix: optionalString(cmsRecord.domainPrefix, "cms.domainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
+    siteOrigin: optionalString(cmsRecord.siteOrigin, "cms.siteOrigin", SITE_ORIGIN_PATTERN, "https origin with no path, query or trailing slash, such as https://shipped.anth.us"),
     staging: cmsRecord.staging as boolean | undefined,
     cognitoDomainPrefix: requireString(
       cmsRecord.cognitoDomainPrefix,
@@ -380,6 +388,9 @@ function parseCms(value: unknown): CmsConfig {
     }
   }
 
+  if (cms.siteOrigin && cms.domainName) {
+    fail("cms.siteOrigin", "is for sites whose host is served by their own edge; remove it when cms.domainName is set");
+  }
   if (cms.staging === false && cms.stagingDomainName) {
     fail("cms.stagingDomainName", "must not be set when cms.staging is false");
   }

package/package.json

@@ -407,7 +407,7 @@
       "optional": true
     }
   },
-  "version": "5.17.0",
+  "version": "5.19.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.17.0",
+  "version": "5.19.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",