Stacked on feat/shoc-wo-webhook. Gives the SHOC-facing read API a stable,
brandable endpoint instead of the opaque execute-api URL.
- procurement_api_stack.py: REGIONAL API Gateway DomainName (TLS 1.2) +
empty base-path mapping to the prod stage, so callers hit
https://procurement-api.seahaven.com/work-orders (no /prod segment). The
ACM cert ARN is read from SSM (/procurement-api/custom-domain/certificate-arn)
via value_for_string_parameter, because the seahaven.com zone is in the
mgmt account (cross-account DNS) and the cert is issued out of band. Outputs
expose the regional alias target + hosted-zone id for the mgmt A-record.
- scripts/setup_procurement_api_domain.sh: idempotent two-step runbook
(cert: request + mgmt-zone validation + wait + SSM; alias: post-deploy
A-record from stack outputs). Verifies both account identities.
- handler._base_url: omit the /{stage} segment for a custom-domain request
(the base-path mapping serves the stage at the root) so the docs never
advertise a broken server URL; execute-api hosts keep /{stage}.
- openapi.json: custom domain added as servers[0] (recommended), execute-api
kept as the direct fallback + the per-request injection target.
No IAM/auth/policy change (same API id + resource policy), so the SigV4
surface and the mandatory cross-family gates are unaffected. 751 pytest,
ruff, cdk synth, redocly lint all green.
