@anthusai/papyrus 1.0.0-next.33 → 1.0.0-next.35

package/amplify/auth/redirect-urls.js

@@ -0,0 +1,54 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+function parseRedirectUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(redirectUrls, newsroomBasePath = DEFAULT_NEWSROOM_BASE_PATH) {
+    const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+    const originOrder = [];
+    const explicitByOrigin = new Map();
+    const passthrough = [];
+    for (const value of redirectUrls) {
+        const parsed = parseRedirectUrl(value);
+        if (!parsed) {
+            passthrough.push(value);
+            continue;
+        }
+        if (!explicitByOrigin.has(parsed.origin)) {
+            originOrder.push(parsed.origin);
+            explicitByOrigin.set(parsed.origin, []);
+        }
+        explicitByOrigin.get(parsed.origin)?.push(value);
+    }
+    const expanded = [];
+    for (const origin of originOrder) {
+        const explicit = explicitByOrigin.get(origin) ?? [];
+        if (newsroomPath === "") {
+            expanded.push(...explicit);
+            continue;
+        }
+        const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+        const otherEntries = explicit.filter((value) => {
+            const path = parseRedirectUrl(value)?.path;
+            return path !== newsroomPath && path !== "";
+        });
+        expanded.push(...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]), `${origin}/`, ...otherEntries);
+    }
+    expanded.push(...passthrough);
+    return [...new Set(expanded)];
+}

package/amplify/auth/redirect-urls.ts

@@ -0,0 +1,66 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+
+type ParsedRedirectUrl = { original: string; origin: string; path: string } | null;
+
+function parseRedirectUrl(value: string): ParsedRedirectUrl {
+  try {
+    const parsed = new URL(value);
+    return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(
+  redirectUrls: readonly string[],
+  newsroomBasePath: string = DEFAULT_NEWSROOM_BASE_PATH,
+): string[] {
+  const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+  const originOrder: string[] = [];
+  const explicitByOrigin = new Map<string, string[]>();
+  const passthrough: string[] = [];
+
+  for (const value of redirectUrls) {
+    const parsed = parseRedirectUrl(value);
+    if (!parsed) {
+      passthrough.push(value);
+      continue;
+    }
+    if (!explicitByOrigin.has(parsed.origin)) {
+      originOrder.push(parsed.origin);
+      explicitByOrigin.set(parsed.origin, []);
+    }
+    explicitByOrigin.get(parsed.origin)?.push(value);
+  }
+
+  const expanded: string[] = [];
+  for (const origin of originOrder) {
+    const explicit = explicitByOrigin.get(origin) ?? [];
+    if (newsroomPath === "") {
+      expanded.push(...explicit);
+      continue;
+    }
+    const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+    const otherEntries = explicit.filter((value) => {
+      const path = parseRedirectUrl(value)?.path;
+      return path !== newsroomPath && path !== "";
+    });
+    expanded.push(
+      ...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]),
+      `${origin}/`,
+      ...otherEntries,
+    );
+  }
+  expanded.push(...passthrough);
+  return [...new Set(expanded)];
+}

package/amplify/auth/resource.js

@@ -1,9 +1,11 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { expandNewsroomRedirectUrls } from "./redirect-urls.js";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
     "http://localhost:3001/",
@@ -31,7 +33,7 @@ export function authConfigFromEnv() {
     };
 }
 export function defineSiteAuth(config) {
-    const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+    const authRedirectUrls = expandNewsroomRedirectUrls(config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS, config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
     return defineAuth({
         loginWith: {

package/amplify/auth/resource.ts

@@ -3,10 +3,12 @@ import { manageUserRole } from "../functions/manage-user-role/resource";
 import { Stack } from "aws-cdk-lib";
 import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
+import { expandNewsroomRedirectUrls } from "./redirect-urls";
 
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
   "http://localhost:3001/",
@@ -36,7 +38,10 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
 }
 
 export function defineSiteAuth(config: PapyrusAuthConfig) {
-  const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+  const authRedirectUrls = expandNewsroomRedirectUrls(
+    config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS,
+    config.newsroomBasePath,
+  );
   const disableGoogleOAuth = config.disableGoogleOAuth === true;
   return defineAuth({
     loginWith: {

package/amplify/data/schema.js

@@ -1290,6 +1290,11 @@ export const schema = a.schema({
         displayName: a.string(),
         description: a.string(),
         aliases: a.string().array(),
+        authorityScore: a.float(),
+        authorityRank: a.integer(),
+        acceptedReferenceMentionCount: a.integer(),
+        distinctSourceKindCount: a.integer(),
+        relationCount: a.integer(),
         status: a.string().required(),
         importRunId: a.id(),
         createdAt: a.datetime(),

package/amplify/data/schema.ts

@@ -1379,6 +1379,11 @@ export const schema = a.schema({
       displayName: a.string(),
       description: a.string(),
       aliases: a.string().array(),
+      authorityScore: a.float(),
+      authorityRank: a.integer(),
+      acceptedReferenceMentionCount: a.integer(),
+      distinctSourceKindCount: a.integer(),
+      relationCount: a.integer(),
       status: a.string().required(),
       importRunId: a.id(),
       createdAt: a.datetime(),

package/amplify/site-backend-config.ts

@@ -7,6 +7,12 @@ export type PapyrusAuthConfig = {
   /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
   redirectUrls?: string[];
   disableGoogleOAuth?: boolean;
+  /**
+   * Public newsroom path prefix for sign-in return URLs. Default `/newsroom`;
+   * `""` on a CMS-only host where the newsroom is the root. Filled from the
+   * active brand's `newsroomBasePath` by `defineSiteBackend` when unset.
+   */
+  newsroomBasePath?: string;
   /** Desired Cognito hosted-UI domain prefix. Only applied when `applyCognitoDomainPrefix` is true. */
   cognitoDomainPrefix?: string;
   /**

package/amplify/site-backend-names.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { Token } from "aws-cdk-lib";
 export function sanitizeAwsName(value, maxLength = 50) {
     return value
         .toLowerCase()
@@ -7,6 +8,18 @@ export function sanitizeAwsName(value, maxLength = 50) {
         .replace(/^-|-$/g, "")
         .slice(0, maxLength);
 }
+/**
+ * Account-global names are immutable in AWS, so they must be built from literal
+ * synth-time inputs only. A CDK token (or text that came from one, such as
+ * `token-token-17565`) makes the name change on every synth and fail with
+ * AlreadyExists, so this throws instead.
+ */
+export function assertLiteralResourceName(label, name) {
+    if (Token.isUnresolved(name) || /token|\$\{/i.test(name)) {
+        throw new Error(`${label} "${name}" is derived from an unresolved CDK token. Build account-global names from literal site config values only.`);
+    }
+    return name;
+}
 export function readBooleanEnvFlag(environment, name, defaultValue) {
     const raw = (environment[name] ?? "").trim().toLowerCase();
     if (["1", "true", "yes", "on"].includes(raw))
@@ -36,19 +49,21 @@ export function resolveSiteBackendFeatureFlags(features, environment, identity)
     };
 }
 export function deriveKnowledgeVectorIndexName(identity) {
-    return isLegacyProductionApp(identity)
+    const name = isLegacyProductionApp(identity)
         ? "papyrus-knowledge"
         : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+    return assertLiteralResourceName("Knowledge vector index name", name);
 }
-export function deriveStorageBackupVaultName(identity, backupsStackName, explicitName) {
+export function deriveStorageBackupVaultName(identity, explicitName) {
     const explicit = (explicitName ?? "").trim();
     if (explicit !== "")
-        return sanitizeAwsName(explicit);
+        return assertLiteralResourceName("Backup vault name", sanitizeAwsName(explicit));
     if (isLegacyProductionPipeline(identity)) {
-        return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+        return assertLiteralResourceName("Backup vault name", sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`));
     }
-    const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
-    return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+    const literalSiteKey = [identity.brandId, identity.amplifyAppId, identity.amplifyBranch].join("|");
+    const siteHash = createHash("sha256").update(literalSiteKey).digest("hex").slice(0, 8);
+    return assertLiteralResourceName("Backup vault name", `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${siteHash}-media-vault`);
 }
 /**
  * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
@@ -57,16 +72,16 @@ export function deriveStorageBackupVaultName(identity, backupsStackName, explici
  * its own brand-named rule set and never activates it from CloudFormation.
  */
 export function deriveReceiptRuleSetName(identity, inboundEmailDomain) {
-    if (isLegacyProductionApp(identity)) {
-        return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
-    }
-    return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+    const name = isLegacyProductionApp(identity)
+        ? `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`
+        : `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+    return assertLiteralResourceName("Receipt rule set name", name);
 }
 /** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
 export function deriveReceiptRuleName(identity) {
     if (isLegacyProductionApp(identity))
         return undefined;
-    return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+    return assertLiteralResourceName("Receipt rule name", `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`);
 }
 export function planInboundEmailSes(identity, inboundEmailEnabled, options) {
     const legacyPipeline = isLegacyProductionPipeline(identity);
@@ -78,10 +93,10 @@ export function planInboundEmailSes(identity, inboundEmailEnabled, options) {
         manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
     };
 }
-export function deriveSiteGlobalResourceNames(identity, inboundEmailDomain, backupsStackName) {
+export function deriveSiteGlobalResourceNames(identity, inboundEmailDomain) {
     return {
         knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
-        storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+        storageBackupVaultName: deriveStorageBackupVaultName(identity),
         receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
         receiptRuleName: deriveReceiptRuleName(identity),
     };

package/amplify/site-backend-names.ts

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { Token } from "aws-cdk-lib";
 
 export type SiteBackendFeatureFlags = {
   consoleResponder: boolean;
@@ -18,6 +19,21 @@ export function sanitizeAwsName(value: string, maxLength = 50): string {
     .slice(0, maxLength);
 }
 
+/**
+ * Account-global names are immutable in AWS, so they must be built from literal
+ * synth-time inputs only. A CDK token (or text that came from one, such as
+ * `token-token-17565`) makes the name change on every synth and fail with
+ * AlreadyExists, so this throws instead.
+ */
+export function assertLiteralResourceName(label: string, name: string): string {
+  if (Token.isUnresolved(name) || /token|\$\{/i.test(name)) {
+    throw new Error(
+      `${label} "${name}" is derived from an unresolved CDK token. Build account-global names from literal site config values only.`,
+    );
+  }
+  return name;
+}
+
 export function readBooleanEnvFlag(
   environment: Record<string, string | undefined>,
   name: string,
@@ -67,23 +83,27 @@ export function resolveSiteBackendFeatureFlags(
 }
 
 export function deriveKnowledgeVectorIndexName(identity: SiteBackendIdentity): string {
-  return isLegacyProductionApp(identity)
+  const name = isLegacyProductionApp(identity)
     ? "papyrus-knowledge"
     : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+  return assertLiteralResourceName("Knowledge vector index name", name);
 }
 
-export function deriveStorageBackupVaultName(
-  identity: SiteBackendIdentity,
-  backupsStackName: string,
-  explicitName?: string,
-): string {
+export function deriveStorageBackupVaultName(identity: SiteBackendIdentity, explicitName?: string): string {
   const explicit = (explicitName ?? "").trim();
-  if (explicit !== "") return sanitizeAwsName(explicit);
+  if (explicit !== "") return assertLiteralResourceName("Backup vault name", sanitizeAwsName(explicit));
   if (isLegacyProductionPipeline(identity)) {
-    return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+    return assertLiteralResourceName(
+      "Backup vault name",
+      sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`),
+    );
   }
-  const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
-  return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+  const literalSiteKey = [identity.brandId, identity.amplifyAppId, identity.amplifyBranch].join("|");
+  const siteHash = createHash("sha256").update(literalSiteKey).digest("hex").slice(0, 8);
+  return assertLiteralResourceName(
+    "Backup vault name",
+    `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${siteHash}-media-vault`,
+  );
 }
 
 /**
@@ -93,16 +113,16 @@ export function deriveStorageBackupVaultName(
  * its own brand-named rule set and never activates it from CloudFormation.
  */
 export function deriveReceiptRuleSetName(identity: SiteBackendIdentity, inboundEmailDomain: string): string {
-  if (isLegacyProductionApp(identity)) {
-    return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
-  }
-  return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+  const name = isLegacyProductionApp(identity)
+    ? `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`
+    : `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+  return assertLiteralResourceName("Receipt rule set name", name);
 }
 
 /** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
 export function deriveReceiptRuleName(identity: SiteBackendIdentity): string | undefined {
   if (isLegacyProductionApp(identity)) return undefined;
-  return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+  return assertLiteralResourceName("Receipt rule name", `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`);
 }
 
 export type InboundEmailSesPlan = {
@@ -136,11 +156,10 @@ export type SiteGlobalResourceNames = {
 export function deriveSiteGlobalResourceNames(
   identity: SiteBackendIdentity,
   inboundEmailDomain: string,
-  backupsStackName: string,
 ): SiteGlobalResourceNames {
   return {
     knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
-    storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+    storageBackupVaultName: deriveStorageBackupVaultName(identity),
     receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
     receiptRuleName: deriveReceiptRuleName(identity),
   };

package/amplify/site-backend.js

@@ -54,7 +54,12 @@ export function defineSiteBackend(papyrusSite) {
     const enableInboundEmail = featureFlags.inboundEmail;
     const enableSlackAgent = featureFlags.slack;
     const enableStorageBackups = featureFlags.storageBackups;
-    const authConfig = site.auth ?? authConfigFromEnv();
+    const baseAuthConfig = site.auth ?? authConfigFromEnv();
+    const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+    const authConfig = {
+        ...baseAuthConfig,
+        newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+    };
     const backend = defineBackend({
         assignmentAction,
         auth: defineSiteAuth(authConfig),
@@ -215,7 +220,7 @@ export function defineSiteBackend(papyrusSite) {
     }
     if (enableStorageBackups) {
         const storageBackupsStack = backend.createStack("storage-backups");
-        const storageBackupVaultName = deriveStorageBackupVaultName(siteBackendIdentity, storageBackupsStack.stackName, process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME);
+        const storageBackupVaultName = deriveStorageBackupVaultName(siteBackendIdentity, process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME);
         const storageBackups = addStorageBackups(storageBackupsStack, {
             storageBucket,
             backupVaultName: storageBackupVaultName,

package/amplify/site-backend.ts

@@ -71,7 +71,12 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const enableSlackAgent = featureFlags.slack;
   const enableStorageBackups = featureFlags.storageBackups;
 
-  const authConfig = site.auth ?? authConfigFromEnv();
+  const baseAuthConfig = site.auth ?? authConfigFromEnv();
+  const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+  const authConfig = {
+    ...baseAuthConfig,
+    newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+  };
   const backend = defineBackend({
     assignmentAction,
     auth: defineSiteAuth(authConfig),
@@ -277,7 +282,6 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     const storageBackupsStack = backend.createStack("storage-backups");
     const storageBackupVaultName = deriveStorageBackupVaultName(
       siteBackendIdentity,
-      storageBackupsStack.stackName,
       process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME,
     );
 

package/components/amplify-client-provider.tsx

@@ -8,6 +8,8 @@ import { CookieStorage, Hub } from "aws-amplify/utils";
 import { useEffect } from "react";
 import { assertSandboxAmplifyOutputsForDev } from "../lib/amplify-outputs-guard";
 import amplifyOutputs from "papyrus-amplify-outputs";
+import { getPublicNewsroomBasePath } from "../lib/newsroom-base-path";
+import { prioritizeRedirectUrlsForOrigin } from "../lib/oauth-redirect-priority";
 
 let configured = false;
 
@@ -72,14 +74,10 @@ function prioritizeCurrentOrigin(config: ResourcesConfig): ResourcesConfig {
   const auth = (config as { auth?: { oauth?: Record<string, unknown> } }).auth;
   const oauth = auth?.oauth;
   if (!auth || !oauth) return config;
-  const origin = normalizeUrlOrigin(window.location.origin);
   const reorder = (urls: unknown) => {
     if (!Array.isArray(urls)) return urls;
-    const normalized = urls.filter((value): value is string => typeof value === "string");
-    const head = normalized.filter((value) => normalizeUrlOrigin(value) === origin);
-    if (!head.length) return normalized;
-    const tail = normalized.filter((value) => normalizeUrlOrigin(value) !== origin);
-    return [...head, ...tail];
+    const strings = urls.filter((value): value is string => typeof value === "string");
+    return prioritizeRedirectUrlsForOrigin(strings, window.location.origin, getPublicNewsroomBasePath());
   };
   return {
     ...config,
@@ -111,22 +109,6 @@ function redirectLoopbackToLocalhost(): void {
   window.location.replace(target);
 }
 
-function normalizeUrlOrigin(value: string): string {
-  const trimmed = value.replace(/\/+$/, "");
-  try {
-    const parsed = new URL(trimmed);
-    const hostname = normalizeLoopbackHostname(parsed.hostname);
-    return `${parsed.protocol}//${hostname}${parsed.port ? `:${parsed.port}` : ""}`;
-  } catch {
-    return trimmed;
-  }
-}
-
-function normalizeLoopbackHostname(hostname: string): string {
-  if (hostname === "127.0.0.1" || hostname === "::1") return "localhost";
-  return hostname;
-}
-
 function extractAuthFailureDetail(error: unknown): string | null {
   if (!error) return null;
   if (typeof error === "string") return error;

package/infra/site-config.js

@@ -13,6 +13,14 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+function originOfRedirectUrl(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return value;
+    }
+}
 export function resolveRevalidateSecretParameterName(config) {
     return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -259,14 +267,15 @@ export function parseSiteConfig(raw) {
         fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
     const redirectUrls = redirectValue.split(",").map((url) => url.trim());
     const stagingDomainName = resolveStagingDomainName(config);
+    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
     const requiredOrigins = [
-        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}/`] : []),
-        ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
-        LOCAL_DEVELOPMENT_ORIGIN,
+        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
     ];
     for (const origin of requiredOrigins) {
-        if (!redirectUrls.includes(origin)) {
-            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
+        if (!listedOrigins.has(origin)) {
+            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
         }
     }
     return config;

package/infra/site-config.ts

@@ -57,6 +57,14 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+function originOfRedirectUrl(value: string): string {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return value;
+  }
+}
+
 export function resolveRevalidateSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
   return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -321,14 +329,15 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   if (redirectValue === undefined) fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
   const redirectUrls = redirectValue.split(",").map((url) => url.trim());
   const stagingDomainName = resolveStagingDomainName(config);
+  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
   const requiredOrigins = [
-    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}/`] : []),
-    ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
-    LOCAL_DEVELOPMENT_ORIGIN,
+    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
   ];
   for (const origin of requiredOrigins) {
-    if (!redirectUrls.includes(origin)) {
-      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
+    if (!listedOrigins.has(origin)) {
+      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
     }
   }
 

package/lib/oauth-redirect-priority.ts

@@ -0,0 +1,40 @@
+function originOf(value: string): string {
+  const trimmed = value.replace(/\/+$/, "");
+  try {
+    const parsed = new URL(trimmed);
+    const hostname = parsed.hostname === "127.0.0.1" || parsed.hostname === "::1" ? "localhost" : parsed.hostname;
+    return `${parsed.protocol}//${hostname}${parsed.port ? `:${parsed.port}` : ""}`;
+  } catch {
+    return trimmed;
+  }
+}
+
+function pathOf(value: string): string | null {
+  try {
+    return new URL(value).pathname.replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Puts the redirect URLs of the current origin first; among those, the
+ * newsroom return path leads when the site has one, so Amplify (which signs in
+ * with the first entry) returns an editor to the newsroom.
+ */
+export function prioritizeRedirectUrlsForOrigin(
+  urls: readonly string[],
+  currentOrigin: string,
+  publicNewsroomBasePath: string,
+): string[] {
+  const origin = originOf(currentOrigin);
+  const newsroomPath = publicNewsroomBasePath.replace(/\/+$/, "");
+  const head = urls.filter((value) => originOf(value) === origin);
+  if (head.length === 0) return [...urls];
+  const tail = urls.filter((value) => originOf(value) !== origin);
+  const newsroomFirst =
+    newsroomPath === ""
+      ? head
+      : [...head.filter((value) => pathOf(value) === newsroomPath), ...head.filter((value) => pathOf(value) !== newsroomPath)];
+  return [...newsroomFirst, ...tail];
+}

package/package.json

@@ -186,6 +186,7 @@
     "./lib/newsroom-references": "./lib/newsroom-references.ts",
     "./lib/newsroom-sections": "./lib/newsroom-sections.ts",
     "./lib/newsroom-topics": "./lib/newsroom-topics.ts",
+    "./lib/oauth-redirect-priority": "./lib/oauth-redirect-priority.ts",
     "./lib/papyrus-object-kinds": "./lib/papyrus-object-kinds.ts",
     "./lib/papyrus-web-locations": "./lib/papyrus-web-locations.ts",
     "./lib/pilobol-sample": "./lib/pilobol-sample.ts",
@@ -299,7 +300,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.33",
+  "version": "1.0.0-next.35",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.33",
+  "version": "1.0.0-next.35",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",

package/src/with-papyrus.mjs

@@ -9,6 +9,7 @@ import { fileURLToPath } from "node:url";
  *   `papyrus-amplify-outputs` -> ./amplify_outputs.json and
  *   `papyrus-site-theme` -> ./publication/theme.css when it exists, else the shipped
  *   empty lib/empty-theme.css (both webpack and turbopack),
+ * - trace the corpora/ YAML and amplify_outputs.json that the reader reads via fs at runtime,
  * - carry Papyrus's own server-external packages and image settings.
  */
 const SERVER_EXTERNAL = [
@@ -22,6 +23,15 @@ const SERVER_EXTERNAL = [
   "@aws-amplify/data-schema",
 ];
 
+export const RUNTIME_TRACED_FILES = ["./corpora/**/*", "./amplify_outputs.json"];
+
+export function mergeOutputFileTracingIncludes(existing = {}) {
+  const merged = { ...existing };
+  const current = merged["/**"] ?? [];
+  merged["/**"] = [...new Set([...current, ...RUNTIME_TRACED_FILES])];
+  return merged;
+}
+
 const EMPTY_THEME = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../lib/empty-theme.css");
 
 export function withPapyrus(nextConfig = {}, options = {}) {
@@ -41,6 +51,7 @@ export function withPapyrus(nextConfig = {}, options = {}) {
     ...nextConfig,
     transpilePackages: [...new Set([...(nextConfig.transpilePackages ?? []), "@anthusai/papyrus"])],
     serverExternalPackages: [...new Set([...(nextConfig.serverExternalPackages ?? []), ...SERVER_EXTERNAL])],
+    outputFileTracingIncludes: mergeOutputFileTracingIncludes(nextConfig.outputFileTracingIncludes),
     images: nextConfig.images ?? { remotePatterns: [{ protocol: "https", hostname: "**" }] },
     experimental: { devtoolSegmentExplorer: false, ...nextConfig.experimental },
     turbopack: {