@anthusai/papyrus 1.0.0-next.16 → 1.0.0-next.18

package/amplify/auth/resource.js

@@ -1,5 +1,6 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
@@ -25,15 +26,13 @@ export function authConfigFromEnv() {
     return {
         redirectUrls: resolveAuthRedirectUrls(),
         disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-        // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-        // See docs/google-oauth-setup.md.
         cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+        applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
 export function defineSiteAuth(config) {
     const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
-    const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
     return defineAuth({
         loginWith: {
             email: true,
@@ -49,7 +48,6 @@ export function defineSiteAuth(config) {
                         scopes: ["EMAIL", "PROFILE", "OPENID"],
                         callbackUrls: authRedirectUrls,
                         logoutUrls: authRedirectUrls,
-                        ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
                     },
                 }),
         },
@@ -59,3 +57,18 @@ export function defineSiteAuth(config) {
         ],
     });
 }
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack, cognitoDomainPrefix) {
+    const domainResources = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolDomain);
+    if (domainResources.length !== 1) {
+        throw new Error(`Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`);
+    }
+    domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/auth/resource.ts

@@ -1,5 +1,7 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource";
+import { Stack } from "aws-cdk-lib";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
 
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
@@ -28,16 +30,14 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   return {
     redirectUrls: resolveAuthRedirectUrls(),
     disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-    // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-    // See docs/google-oauth-setup.md.
     cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+    applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
   };
 }
 
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
   const disableGoogleOAuth = config.disableGoogleOAuth === true;
-  const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
   return defineAuth({
     loginWith: {
       email: true,
@@ -53,7 +53,6 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
               scopes: ["EMAIL", "PROFILE", "OPENID"],
               callbackUrls: authRedirectUrls,
               logoutUrls: authRedirectUrls,
-              ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
             },
           }),
     },
@@ -63,3 +62,21 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
     ],
   });
 }
+
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack: Stack, cognitoDomainPrefix: string): void {
+  const domainResources = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolDomain => construct instanceof CfnUserPoolDomain);
+  if (domainResources.length !== 1) {
+    throw new Error(
+      `Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`,
+    );
+  }
+  domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/site-backend-config.ts

@@ -7,8 +7,13 @@ export type PapyrusAuthConfig = {
   /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
   redirectUrls?: string[];
   disableGoogleOAuth?: boolean;
-  /** Stable Cognito hosted-UI domain prefix. */
+  /** Desired Cognito hosted-UI domain prefix. Only applied when `applyCognitoDomainPrefix` is true. */
   cognitoDomainPrefix?: string;
+  /**
+   * Opt in to the prefix. Off by default because changing a live pool's
+   * domain replaces it and changes the Google redirect URI.
+   */
+  applyCognitoDomainPrefix?: boolean;
 };
 
 export type PapyrusSiteBackendConfig = {

package/amplify/site-backend.js

@@ -13,7 +13,7 @@ import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aw
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
@@ -76,9 +76,10 @@ export function defineSiteBackend(papyrusSite) {
     const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
     const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
     const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+    const authConfig = site.auth ?? authConfigFromEnv();
     const backend = defineBackend({
         assignmentAction,
-        auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+        auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
         data,
@@ -94,6 +95,12 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+    if (authConfig.applyCognitoDomainPrefix === true
+        && requestedCognitoDomainPrefix !== ""
+        && authConfig.disableGoogleOAuth !== true) {
+        applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+    }
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");

package/amplify/site-backend.ts

@@ -14,7 +14,7 @@ import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aw
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
@@ -87,9 +87,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
   const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
 
+  const authConfig = site.auth ?? authConfigFromEnv();
   const backend = defineBackend({
     assignmentAction,
-    auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+    auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
     data,
@@ -106,6 +107,15 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+  if (
+    authConfig.applyCognitoDomainPrefix === true
+    && requestedCognitoDomainPrefix !== ""
+    && authConfig.disableGoogleOAuth !== true
+  ) {
+    applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+  }
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");

package/app/api/revalidate/route.ts

@@ -1,3 +1,4 @@
+import { toPublicReaderPath } from "../../../lib/reader-base-path";
 import { revalidatePath, revalidateTag } from "next/cache";
 import { NextResponse } from "next/server";
 import {
@@ -44,8 +45,8 @@ export async function POST(request: Request) {
     if (!normalized) continue;
     revalidateTag(articleCacheTag(normalized));
     revalidatedTags.add(articleCacheTag(normalized));
-    revalidatePath(`/articles/${encodeURIComponent(normalized)}`);
-    revalidatedPaths.add(`/articles/${encodeURIComponent(normalized)}`);
+    revalidatePath(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
+    revalidatedPaths.add(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
     if (editionDate) {
       revalidateTag(editionItemCacheTag(editionDate, normalized));
       revalidatedTags.add(editionItemCacheTag(editionDate, normalized));
@@ -76,8 +77,8 @@ export async function POST(request: Request) {
   revalidatedTags.add(ARCHIVE_CACHE_TAG);
   revalidateTag(ARTICLES_CACHE_TAG);
   revalidatedTags.add(ARTICLES_CACHE_TAG);
-  revalidatePath("/archive");
-  revalidatedPaths.add("/archive");
+  revalidatePath(toPublicReaderPath("/archive"));
+  revalidatedPaths.add(toPublicReaderPath("/archive"));
 
   for (const path of body.paths ?? []) {
     const normalized = path.trim();

package/app/page.tsx

@@ -16,6 +16,7 @@ import {
 import type { PublicationItem } from "../lib/publication-items";
 import { SITE_BRAND, rootRoute } from "../lib/site-brand";
 import { notFound, redirect } from "next/navigation";
+import { getReaderBasePath } from "../lib/reader-base-path";
 import { buildRootRedirectTarget } from "../lib/root-route-redirect";
 import NewsDeskRootPage, { type NewsDeskRootSearchParams } from "./newsroom/page";
 
@@ -38,11 +39,13 @@ export default async function Home({ searchParams }: HomePageProps) {
   // co-hosts reader + CMS uses the default "reader" (render the publication
   // home page here). A CMS-only site points the root at the newsroom or
   // anywhere else. Preserve the scenario and OAuth-callback paths.
-  if (rootRoute.kind === "newsroom" && !scenarioId) {
+  const publicationOwnsRoot = getReaderBasePath() !== "";
+
+  if (!publicationOwnsRoot && rootRoute.kind === "newsroom" && !scenarioId) {
     return <NewsDeskRootPage searchParams={searchParams} />;
   }
 
-  if (rootRoute.kind === "redirect") {
+  if (!publicationOwnsRoot && rootRoute.kind === "redirect") {
     redirect(buildRootRedirectTarget(rootRoute.destination, resolvedSearchParams));
   }
 

package/components/newspaper.tsx

@@ -12,6 +12,7 @@ import { ARCHIVE_PREVIEW_HEIGHT, ARCHIVE_PREVIEW_WIDTH } from "../lib/archive-ty
 import type { EditionContent, NewsDeskAppendix, NewsDeskCategoryTreeNode } from "../lib/content-types";
 import { shouldBypassImageOptimization } from "../lib/image-url";
 import type { PublicationItem } from "../lib/publication-items";
+import { toPublicReaderPath } from "../lib/reader-base-path";
 import { SITE_BRAND } from "../lib/site-brand";
 import { resolveThemedImageSrc, type ResolvedTheme } from "../lib/themed-image";
 import { loadEditorCategoryTreeState } from "./news-desk-taxonomy-client";
@@ -1877,7 +1878,7 @@ function getPageHref(pageNumber: number, editionBasePath?: string): string {
 }
 
 function getArticleHref(articleSlug: string, editionBasePath?: string): string {
-  return editionBasePath ? `${normalizePath(editionBasePath)}/${encodeURIComponent(articleSlug)}` : `/articles/${articleSlug}`;
+  return editionBasePath ? `${normalizePath(editionBasePath)}/${encodeURIComponent(articleSlug)}` : toPublicReaderPath(`/articles/${articleSlug}`);
 }
 
 function getItemAnchorHref(articleSlug: string, pageNumber: number, editionBasePath?: string): string {

package/components/newsroom-ops-overview.tsx

@@ -3,8 +3,13 @@
 import {
   BookOpenIcon,
   ClipboardListIcon,
+  FileTextIcon,
   LayersIcon,
+  LightbulbIcon,
   MessageSquareIcon,
+  NetworkIcon,
+  SearchIcon,
+  SettingsIcon,
 } from "lucide-react";
 import Link from "next/link";
 import { usePathname } from "next/navigation";
@@ -12,7 +17,7 @@ import { useMemo } from "react";
 import { Badge } from "./ui/badge";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card";
 import type { AssignmentRecord, MessageRecord, NewsroomSectionRecord, ReferenceRecord } from "../lib/category-repository";
-import { getNewsroomNavHref } from "../lib/newsroom-nav";
+import { getNewsroomNavHref, NEWSROOM_OPS_NAV, type NewsroomNavTabId } from "../lib/newsroom-nav";
 import {
   countReferencesByStatus,
   filterReferencesByStatus,
@@ -37,15 +42,28 @@ type NewsroomOpsOverviewProps = {
   references: ReferenceRecord[];
 };
 
-type DestinationKey = "references" | "assignments" | "messages" | "topics";
+type DestinationKey = Exclude<NewsroomNavTabId, "overview" | "desks">;
 
-const DESTINATION_META: Record<DestinationKey, { label: string; detail: string; href: string; icon: typeof BookOpenIcon }> = {
-  references: { label: "References", detail: "Source intake", href: "/newsroom/references", icon: BookOpenIcon },
-  assignments: { label: "Assignments", detail: "Work queue", href: "/newsroom/assignments", icon: ClipboardListIcon },
-  messages: { label: "Messages", detail: "Team threads", href: "/newsroom/messages", icon: MessageSquareIcon },
-  topics: { label: "Topics", detail: "Taxonomy", href: "/newsroom/topics", icon: LayersIcon },
+const DESTINATION_ICONS: Record<DestinationKey, typeof BookOpenIcon> = {
+  articles: FileTextIcon,
+  assignments: ClipboardListIcon,
+  references: BookOpenIcon,
+  messages: MessageSquareIcon,
+  insights: LightbulbIcon,
+  topics: LayersIcon,
+  concepts: NetworkIcon,
+  administration: SettingsIcon,
+  search: SearchIcon,
 };
 
+const DESTINATIONS = NEWSROOM_OPS_NAV.filter((item) => item.id !== "overview").map((item) => ({
+  key: item.id as DestinationKey,
+  label: item.label,
+  detail: item.detail,
+  href: item.href,
+  icon: DESTINATION_ICONS[item.id as DestinationKey],
+}));
+
 function openAssignmentCount(assignments: AssignmentRecord[]): number {
   return assignments.filter((assignment) => {
     const status = assignment.status?.trim().toLowerCase() ?? "";
@@ -85,11 +103,10 @@ export function NewsroomOpsOverview({
     [newsroomSections],
   );
 
-  const destinationCounts: Record<DestinationKey, number | null> = {
+  const destinationCounts: Partial<Record<DestinationKey, number | null>> = {
     references: referenceCounts.pending ?? 0,
     assignments: openAssignmentCount(assignments),
     messages: recentMessageCount(messages),
-    topics: null,
   };
 
   return (
@@ -102,8 +119,8 @@ export function NewsroomOpsOverview({
         <section aria-label="Destinations" className="space-y-3">
           <h2 className="text-sm font-medium text-muted-foreground">Go to</h2>
           <div className="grid grid-cols-2 gap-3 sm:grid-cols-4">
-            {(Object.keys(DESTINATION_META) as DestinationKey[]).map((key) => {
-              const meta = DESTINATION_META[key];
+            {DESTINATIONS.map((meta) => {
+              const key = meta.key;
               const Icon = meta.icon;
               const count = destinationCounts[key];
               const href = getNewsroomNavHref(meta.href, demo);

package/components/settings-page.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { toPublicReaderPath } from "../lib/reader-base-path";
 import { signOut } from "aws-amplify/auth";
 import Link from "next/link";
 import { useCallback, useEffect, useRef, useState } from "react";
@@ -114,7 +115,7 @@ export function SettingsPage() {
   return (
     <main className="settings-page">
       <nav className="edition-progress edition-progress--newsroom settings-progress" aria-label="Settings navigation">
-        <Link className="edition-progress__button edition-progress__button--previous" href="/">
+        <Link className="edition-progress__button edition-progress__button--previous" href={toPublicReaderPath("/")}>
           <svg aria-hidden="true" className="edition-progress__icon" focusable="false" viewBox="0 0 10 10">
             <path d="M7.5 1 2.5 5 7.5 9Z" fill="currentColor" />
           </svg>

package/infra/amplify-app-shell.js

@@ -3,7 +3,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { isStagingEnabled, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { isStagingEnabled, resolveCmsHostName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -20,8 +20,9 @@ function environmentVariables(variables) {
  *   - `cms.staging: false` omits the staging branch and its domain
  *
  * Google sign-in is always on: the branches never set PAPYRUS_DISABLE_GOOGLE_OAUTH,
-and `cms.cognitoDomainPrefix` becomes the stable hosted-UI domain
-(PAPYRUS_COGNITO_DOMAIN_PREFIX). The secrets GOOGLE_CLIENT_ID and
+and `cms.cognitoDomainPrefix` becomes the hosted-UI domain
+(PAPYRUS_COGNITO_DOMAIN_PREFIX) only when `cms.applyCognitoDomainPrefix` is true
+(PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX); otherwise Amplify's generated domain is kept. The secrets GOOGLE_CLIENT_ID and
 GOOGLE_CLIENT_SECRET are Amplify backend secrets set in the console, never here.
 The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
@@ -40,6 +41,7 @@ export class AmplifyAppShellStack extends Stack {
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
         const stagingEnabled = isStagingEnabled(config);
         const stagingDomainName = resolveStagingDomainName(config);
+        const cmsHostName = resolveCmsHostName(config);
         const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
             assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
             description: `Backend deploy and staging build service role for Amplify app ${cmsAppName} (AdministratorAccess: documented risk)`,
@@ -66,12 +68,13 @@ export class AmplifyAppShellStack extends Stack {
         const stagingMode = config.frontend === "markus-static"
             ? { PAPYRUS_STAGING_PREVIEW: "static" }
             : { PAPYRUS_CONTENT_SOURCE: "drafts" };
-        const productionOrigin = config.cms.domainName
-            ? `https://${config.cms.domainName}/`
+        const productionOrigin = cmsHostName
+            ? `https://${cmsHostName}/`
             : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
         const stagingOrigin = stagingDomainName
             ? `https://${stagingDomainName}/`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+        const sharedRootDomain = config.cms.domainPrefix !== undefined;
         const defaultOriginsToAllow = [
             ...(config.cms.domainName ? [] : [productionOrigin]),
             ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
@@ -88,14 +91,16 @@ export class AmplifyAppShellStack extends Stack {
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
                 PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+                ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                 PAPYRUS_SITE_BRAND: config.brand,
                 SITE_ENV: "production",
                 PAPYRUS_CONTENT_SOURCE: "published",
             }),
         });
+        let stagingBranch;
         if (stagingEnabled) {
-            const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+            stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
                 appId: cmsApp.attrAppId,
                 branchName: "staging",
                 stage: "BETA",
@@ -105,6 +110,7 @@ export class AmplifyAppShellStack extends Stack {
                 environmentVariables: environmentVariables({
                     ...config.cms.environment,
                     PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+                    ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
                     PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                     PAPYRUS_SITE_BRAND: config.brand,
                     SITE_ENV: "staging",
@@ -114,7 +120,7 @@ export class AmplifyAppShellStack extends Stack {
                         : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
                 }),
             });
-            if (stagingDomainName) {
+            if (stagingDomainName && !sharedRootDomain) {
                 const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
                     appId: cmsApp.attrAppId,
                     domainName: stagingDomainName,
@@ -124,12 +130,21 @@ export class AmplifyAppShellStack extends Stack {
             }
         }
         if (config.cms.domainName) {
+            const subDomainSettings = sharedRootDomain
+                ? [
+                    { branchName: "main", prefix: config.cms.domainPrefix },
+                    ...(stagingBranch ? [{ branchName: "staging", prefix: config.cms.stagingDomainPrefix }] : []),
+                ]
+                : [{ branchName: "main", prefix: "" }];
             const productionDomain = new amplify.CfnDomain(this, "Domain", {
                 appId: cmsApp.attrAppId,
                 domainName: config.cms.domainName,
-                subDomainSettings: [{ branchName: "main", prefix: "" }],
+                subDomainSettings,
             });
             productionDomain.addResourceDependency(productionBranch);
+            if (sharedRootDomain && stagingBranch) {
+                productionDomain.addResourceDependency(stagingBranch);
+            }
         }
         this.cmsAppId = cmsApp.attrAppId;
         new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });

package/infra/amplify-app-shell.ts

@@ -4,7 +4,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveCmsHostName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -23,8 +23,9 @@ function environmentVariables(variables: Record<string, string>): amplify.CfnBra
  *   - `cms.staging: false` omits the staging branch and its domain
  *
  * Google sign-in is always on: the branches never set PAPYRUS_DISABLE_GOOGLE_OAUTH,
-and `cms.cognitoDomainPrefix` becomes the stable hosted-UI domain
-(PAPYRUS_COGNITO_DOMAIN_PREFIX). The secrets GOOGLE_CLIENT_ID and
+and `cms.cognitoDomainPrefix` becomes the hosted-UI domain
+(PAPYRUS_COGNITO_DOMAIN_PREFIX) only when `cms.applyCognitoDomainPrefix` is true
+(PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX); otherwise Amplify's generated domain is kept. The secrets GOOGLE_CLIENT_ID and
 GOOGLE_CLIENT_SECRET are Amplify backend secrets set in the console, never here.
 The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
@@ -45,6 +46,7 @@ export class AmplifyAppShellStack extends Stack {
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
     const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
+    const cmsHostName = resolveCmsHostName(config);
 
     const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
       assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
@@ -76,12 +78,13 @@ export class AmplifyAppShellStack extends Stack {
       ? { PAPYRUS_STAGING_PREVIEW: "static" }
       : { PAPYRUS_CONTENT_SOURCE: "drafts" };
 
-    const productionOrigin = config.cms.domainName
-      ? `https://${config.cms.domainName}/`
+    const productionOrigin = cmsHostName
+      ? `https://${cmsHostName}/`
       : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
     const stagingOrigin = stagingDomainName
       ? `https://${stagingDomainName}/`
       : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+    const sharedRootDomain = config.cms.domainPrefix !== undefined;
     const defaultOriginsToAllow = [
       ...(config.cms.domainName ? [] : [productionOrigin]),
       ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
@@ -99,6 +102,7 @@ export class AmplifyAppShellStack extends Stack {
       environmentVariables: environmentVariables({
         ...config.cms.environment,
         PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+        ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
         PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
         PAPYRUS_SITE_BRAND: config.brand,
         SITE_ENV: "production",
@@ -106,8 +110,9 @@ export class AmplifyAppShellStack extends Stack {
       }),
     });
 
+    let stagingBranch: amplify.CfnBranch | undefined;
     if (stagingEnabled) {
-      const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+      stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
         appId: cmsApp.attrAppId,
         branchName: "staging",
         stage: "BETA",
@@ -117,6 +122,7 @@ export class AmplifyAppShellStack extends Stack {
         environmentVariables: environmentVariables({
           ...config.cms.environment,
           PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+          ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
           PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
           PAPYRUS_SITE_BRAND: config.brand,
           SITE_ENV: "staging",
@@ -127,7 +133,7 @@ export class AmplifyAppShellStack extends Stack {
         }),
       });
 
-      if (stagingDomainName) {
+      if (stagingDomainName && !sharedRootDomain) {
         const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
           appId: cmsApp.attrAppId,
           domainName: stagingDomainName,
@@ -138,12 +144,21 @@ export class AmplifyAppShellStack extends Stack {
     }
 
     if (config.cms.domainName) {
+      const subDomainSettings = sharedRootDomain
+        ? [
+            { branchName: "main", prefix: config.cms.domainPrefix as string },
+            ...(stagingBranch ? [{ branchName: "staging", prefix: config.cms.stagingDomainPrefix as string }] : []),
+          ]
+        : [{ branchName: "main", prefix: "" }];
       const productionDomain = new amplify.CfnDomain(this, "Domain", {
         appId: cmsApp.attrAppId,
         domainName: config.cms.domainName,
-        subDomainSettings: [{ branchName: "main", prefix: "" }],
+        subDomainSettings,
       });
       productionDomain.addResourceDependency(productionBranch);
+      if (sharedRootDomain && stagingBranch) {
+        productionDomain.addResourceDependency(stagingBranch);
+      }
     }
 
     this.cmsAppId = cmsApp.attrAppId;

package/infra/build-specs.js

@@ -14,6 +14,7 @@ function commandLines(commands, indent) {
 }
 const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
 const FRONTEND_ENVIRONMENT_CAPTURE = "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
+const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
 function pythonProvisioningCommands(config) {
     return [
         "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -58,7 +59,7 @@ export function cmsStagingBuildSpec(config) {
     const cachePaths = [".next/cache/**/*", ".npm/**/*"];
     if (config.frontend === "markus-static") {
         const readerConfig = reader(config);
-        preBuild.push(...pythonProvisioningCommands(config), "papyrus ops content export-published --drafts --out content-export --clean", readerConfig.buildCommand, `papyrus ops content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`);
+        preBuild.push(...pythonProvisioningCommands(config), `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content export-published --drafts --out content-export --clean`, readerConfig.buildCommand, `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`);
         cachePaths.push(".uv-cache/**/*");
     }
     return [

package/infra/build-specs.ts

@@ -22,6 +22,8 @@ const NPM_CLEAN_INSTALL = "npm ci --cache .npm --prefer-offline";
 const FRONTEND_ENVIRONMENT_CAPTURE =
   "env | grep -e '^PAPYRUS_' -e '^SITE_ENV=' -e '^NEXT_PUBLIC_' >> .env.production";
 
+const CHECKOUT_AS_PAPYRUS_ROOT = "PAPYRUS_ROOT=\"$PWD\"";
+
 function pythonProvisioningCommands(config: AmplifyAppShellSiteConfig): string[] {
   return [
     "export UV_CACHE_DIR=\"$PWD/.uv-cache\"",
@@ -90,9 +92,9 @@ export function cmsStagingBuildSpec(config: AmplifyAppShellSiteConfig): string {
     const readerConfig = reader(config);
     preBuild.push(
       ...pythonProvisioningCommands(config),
-      "papyrus ops content export-published --drafts --out content-export --clean",
+      `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content export-published --drafts --out content-export --clean`,
       readerConfig.buildCommand,
-      `papyrus ops content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`,
+      `${CHECKOUT_AS_PAPYRUS_ROOT} papyrus ops content upload-preview --dir ${readerConfig.baseDirectory} --prefix ${resolveStoragePreviewPrefix(config)}`,
     );
     cachePaths.push(".uv-cache/**/*");
   }