@anthusai/papyrus 1.0.0-next.30 → 1.0.0-next.32

package/amplify/inbound-email/ses-intake.js

@@ -0,0 +1,86 @@
+import { Duration } from "aws-cdk-lib";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sesActions from "aws-cdk-lib/aws-ses-actions";
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+/**
+ * Adds the SES receipt resources directly to `scope` (no wrapper construct) so
+ * the logical ids of the live p.apyr.us stack stay unchanged.
+ */
+export function addInboundEmailSesIntake(scope, props) {
+    if (props.domainIdentity) {
+        const { domain, hostedZoneId, hostedZoneName, recordName } = props.domainIdentity;
+        const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "PapyrusInboundDnsZone", {
+            hostedZoneId,
+            zoneName: hostedZoneName,
+        });
+        const verifyDomain = new AwsCustomResource(scope, "VerifyInboundEmailDomain", {
+            onCreate: {
+                service: "SES",
+                action: "verifyDomainIdentity",
+                parameters: { Domain: domain },
+                physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+            },
+            onUpdate: {
+                service: "SES",
+                action: "verifyDomainIdentity",
+                parameters: { Domain: domain },
+                physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+            },
+            policy: AwsCustomResourcePolicy.fromSdkCalls({
+                resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+            }),
+            timeout: Duration.minutes(2),
+        });
+        new route53.TxtRecord(scope, "PapyrusInboundEmailDomainVerification", {
+            zone,
+            recordName: `_amazonses.${recordName}`,
+            ttl: Duration.minutes(5),
+            values: [verifyDomain.getResponseField("VerificationToken")],
+        });
+    }
+    const ruleSet = props.existingRuleSetName
+        ? ses.ReceiptRuleSet.fromReceiptRuleSetName(scope, "PapyrusInboundEmailRuleSet", props.existingRuleSetName)
+        : new ses.ReceiptRuleSet(scope, "PapyrusInboundEmailRuleSet", {
+            receiptRuleSetName: props.ruleSetName,
+        });
+    ruleSet.addRule("PapyrusInboundSubmissions", {
+        receiptRuleName: props.ruleName,
+        recipients: props.recipients,
+        enabled: true,
+        scanEnabled: true,
+        tlsPolicy: ses.TlsPolicy.REQUIRE,
+        actions: [
+            new sesActions.S3({
+                bucket: props.storageBucket,
+                objectKeyPrefix: "inbound-email/",
+            }),
+        ],
+    });
+    if (props.activateRuleSet && !props.existingRuleSetName) {
+        new AwsCustomResource(scope, "ActivateInboundEmailRuleSet", {
+            onCreate: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+                physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+            },
+            onUpdate: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+                physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+            },
+            onDelete: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: null },
+            },
+            policy: AwsCustomResourcePolicy.fromSdkCalls({
+                resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+            }),
+            timeout: Duration.minutes(2),
+        });
+    }
+    return { ruleSet };
+}

package/amplify/inbound-email/ses-intake.ts

@@ -0,0 +1,110 @@
+import { Duration } from "aws-cdk-lib";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sesActions from "aws-cdk-lib/aws-ses-actions";
+import type * as s3 from "aws-cdk-lib/aws-s3";
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import type { Construct } from "constructs";
+
+export type InboundEmailSesIntakeProps = {
+  storageBucket: s3.IBucket;
+  recipients: string[];
+  ruleSetName: string;
+  /** Adds the rule to a rule set another stack owns instead of creating one. */
+  existingRuleSetName?: string;
+  /** `undefined` lets CloudFormation generate the name (the live p.apyr.us rule). */
+  ruleName?: string;
+  /** Only the legacy p.apyr.us pipeline sets this; a new site never activates a rule set. */
+  activateRuleSet: boolean;
+  domainIdentity?: {
+    domain: string;
+    hostedZoneId: string;
+    hostedZoneName: string;
+    recordName: string;
+  };
+};
+
+/**
+ * Adds the SES receipt resources directly to `scope` (no wrapper construct) so
+ * the logical ids of the live p.apyr.us stack stay unchanged.
+ */
+export function addInboundEmailSesIntake(scope: Construct, props: InboundEmailSesIntakeProps) {
+  if (props.domainIdentity) {
+    const { domain, hostedZoneId, hostedZoneName, recordName } = props.domainIdentity;
+    const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "PapyrusInboundDnsZone", {
+      hostedZoneId,
+      zoneName: hostedZoneName,
+    });
+    const verifyDomain = new AwsCustomResource(scope, "VerifyInboundEmailDomain", {
+      onCreate: {
+        service: "SES",
+        action: "verifyDomainIdentity",
+        parameters: { Domain: domain },
+        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+      },
+      onUpdate: {
+        service: "SES",
+        action: "verifyDomainIdentity",
+        parameters: { Domain: domain },
+        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+      },
+      policy: AwsCustomResourcePolicy.fromSdkCalls({
+        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+      }),
+      timeout: Duration.minutes(2),
+    });
+    new route53.TxtRecord(scope, "PapyrusInboundEmailDomainVerification", {
+      zone,
+      recordName: `_amazonses.${recordName}`,
+      ttl: Duration.minutes(5),
+      values: [verifyDomain.getResponseField("VerificationToken")],
+    });
+  }
+
+  const ruleSet = props.existingRuleSetName
+    ? ses.ReceiptRuleSet.fromReceiptRuleSetName(scope, "PapyrusInboundEmailRuleSet", props.existingRuleSetName)
+    : new ses.ReceiptRuleSet(scope, "PapyrusInboundEmailRuleSet", {
+        receiptRuleSetName: props.ruleSetName,
+      });
+  ruleSet.addRule("PapyrusInboundSubmissions", {
+    receiptRuleName: props.ruleName,
+    recipients: props.recipients,
+    enabled: true,
+    scanEnabled: true,
+    tlsPolicy: ses.TlsPolicy.REQUIRE,
+    actions: [
+      new sesActions.S3({
+        bucket: props.storageBucket,
+        objectKeyPrefix: "inbound-email/",
+      }),
+    ],
+  });
+
+  if (props.activateRuleSet && !props.existingRuleSetName) {
+    new AwsCustomResource(scope, "ActivateInboundEmailRuleSet", {
+      onCreate: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+        physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+      },
+      onUpdate: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+        physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+      },
+      onDelete: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: null },
+      },
+      policy: AwsCustomResourcePolicy.fromSdkCalls({
+        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+      }),
+      timeout: Duration.minutes(2),
+    });
+  }
+
+  return { ruleSet };
+}

package/amplify/site-backend-config.ts

@@ -32,6 +32,17 @@ export type PapyrusSiteBackendConfig = {
   stagingBuild?: { enabled: boolean };
   /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (authenticated by the SSM secret named in branch variable `PAPYRUS_REVALIDATE_SECRET_PARAMETER`). */
   revalidateBaseUrl?: string;
+  /**
+   * SES receipt options for a site that is not the legacy p.apyr.us backend.
+   * By default the site gets its own brand-named rule set that is never
+   * activated by CloudFormation (SES allows one active rule set per region).
+   */
+  inboundEmailSes?: {
+    /** Add this site's rule to a rule set another stack owns instead of creating one. */
+    existingReceiptRuleSetName?: string;
+    /** Let this stack verify the SES domain identity and write its TXT record. Default false: verify once by hand. */
+    manageDomainIdentity?: boolean;
+  };
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend-names.js

@@ -0,0 +1,88 @@
+import { createHash } from "node:crypto";
+export function sanitizeAwsName(value, maxLength = 50) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-|-$/g, "")
+        .slice(0, maxLength);
+}
+export function readBooleanEnvFlag(environment, name, defaultValue) {
+    const raw = (environment[name] ?? "").trim().toLowerCase();
+    if (["1", "true", "yes", "on"].includes(raw))
+        return true;
+    if (["0", "false", "no", "off"].includes(raw))
+        return false;
+    return defaultValue;
+}
+/**
+ * True only for the Amplify app that owns the original p.apyr.us backend. That
+ * backend keeps its historical account-global names so its live resources are
+ * never replaced. Every other site gets brand-scoped names.
+ */
+export function isLegacyProductionApp(identity) {
+    return identity.productionAppId !== "" && identity.amplifyAppId === identity.productionAppId;
+}
+export function isLegacyProductionPipeline(identity) {
+    return isLegacyProductionApp(identity) && identity.amplifyBranch === "main";
+}
+export function resolveSiteBackendFeatureFlags(features, environment, identity) {
+    const legacyPipeline = isLegacyProductionPipeline(identity);
+    return {
+        consoleResponder: features?.consoleResponder ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_CONSOLE_RESPONDER", true),
+        inboundEmail: features?.inboundEmail ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_INBOUND_EMAIL", legacyPipeline),
+        slack: features?.slack ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_SLACK", false),
+        storageBackups: features?.storageBackups ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_STORAGE_BACKUPS", legacyPipeline),
+    };
+}
+export function deriveKnowledgeVectorIndexName(identity) {
+    return isLegacyProductionApp(identity)
+        ? "papyrus-knowledge"
+        : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+export function deriveStorageBackupVaultName(identity, backupsStackName, explicitName) {
+    const explicit = (explicitName ?? "").trim();
+    if (explicit !== "")
+        return sanitizeAwsName(explicit);
+    if (isLegacyProductionPipeline(identity)) {
+        return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+    }
+    const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
+    return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+}
+/**
+ * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
+ * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
+ * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
+ * its own brand-named rule set and never activates it from CloudFormation.
+ */
+export function deriveReceiptRuleSetName(identity, inboundEmailDomain) {
+    if (isLegacyProductionApp(identity)) {
+        return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
+    }
+    return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+/** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
+export function deriveReceiptRuleName(identity) {
+    if (isLegacyProductionApp(identity))
+        return undefined;
+    return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+}
+export function planInboundEmailSes(identity, inboundEmailEnabled, options) {
+    const legacyPipeline = isLegacyProductionPipeline(identity);
+    const deployedMainBranch = identity.amplifyAppId !== "" && identity.amplifyBranch === "main";
+    const createReceiptRules = inboundEmailEnabled && (legacyPipeline || deployedMainBranch);
+    return {
+        createReceiptRules,
+        activateReceiptRuleSet: createReceiptRules && legacyPipeline,
+        manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
+    };
+}
+export function deriveSiteGlobalResourceNames(identity, inboundEmailDomain, backupsStackName) {
+    return {
+        knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
+        storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+        receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
+        receiptRuleName: deriveReceiptRuleName(identity),
+    };
+}

package/amplify/site-backend-names.ts

@@ -0,0 +1,147 @@
+import { createHash } from "node:crypto";
+
+export type SiteBackendFeatureFlags = {
+  consoleResponder: boolean;
+  inboundEmail: boolean;
+  slack: boolean;
+  storageBackups: boolean;
+};
+
+export type SiteBackendFeatureInput = Partial<SiteBackendFeatureFlags> | undefined;
+
+export function sanitizeAwsName(value: string, maxLength = 50): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "")
+    .slice(0, maxLength);
+}
+
+export function readBooleanEnvFlag(
+  environment: Record<string, string | undefined>,
+  name: string,
+  defaultValue: boolean,
+): boolean {
+  const raw = (environment[name] ?? "").trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(raw)) return true;
+  if (["0", "false", "no", "off"].includes(raw)) return false;
+  return defaultValue;
+}
+
+export type SiteBackendIdentity = {
+  brandId: string;
+  amplifyAppId: string;
+  amplifyBranch: string;
+  productionAppId: string;
+};
+
+/**
+ * True only for the Amplify app that owns the original p.apyr.us backend. That
+ * backend keeps its historical account-global names so its live resources are
+ * never replaced. Every other site gets brand-scoped names.
+ */
+export function isLegacyProductionApp(identity: SiteBackendIdentity): boolean {
+  return identity.productionAppId !== "" && identity.amplifyAppId === identity.productionAppId;
+}
+
+export function isLegacyProductionPipeline(identity: SiteBackendIdentity): boolean {
+  return isLegacyProductionApp(identity) && identity.amplifyBranch === "main";
+}
+
+export function resolveSiteBackendFeatureFlags(
+  features: SiteBackendFeatureInput,
+  environment: Record<string, string | undefined>,
+  identity: SiteBackendIdentity,
+): SiteBackendFeatureFlags {
+  const legacyPipeline = isLegacyProductionPipeline(identity);
+  return {
+    consoleResponder:
+      features?.consoleResponder ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_CONSOLE_RESPONDER", true),
+    inboundEmail:
+      features?.inboundEmail ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_INBOUND_EMAIL", legacyPipeline),
+    slack: features?.slack ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_SLACK", false),
+    storageBackups:
+      features?.storageBackups ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_STORAGE_BACKUPS", legacyPipeline),
+  };
+}
+
+export function deriveKnowledgeVectorIndexName(identity: SiteBackendIdentity): string {
+  return isLegacyProductionApp(identity)
+    ? "papyrus-knowledge"
+    : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+
+export function deriveStorageBackupVaultName(
+  identity: SiteBackendIdentity,
+  backupsStackName: string,
+  explicitName?: string,
+): string {
+  const explicit = (explicitName ?? "").trim();
+  if (explicit !== "") return sanitizeAwsName(explicit);
+  if (isLegacyProductionPipeline(identity)) {
+    return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+  }
+  const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
+  return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+}
+
+/**
+ * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
+ * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
+ * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
+ * its own brand-named rule set and never activates it from CloudFormation.
+ */
+export function deriveReceiptRuleSetName(identity: SiteBackendIdentity, inboundEmailDomain: string): string {
+  if (isLegacyProductionApp(identity)) {
+    return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
+  }
+  return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+
+/** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
+export function deriveReceiptRuleName(identity: SiteBackendIdentity): string | undefined {
+  if (isLegacyProductionApp(identity)) return undefined;
+  return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+}
+
+export type InboundEmailSesPlan = {
+  createReceiptRules: boolean;
+  activateReceiptRuleSet: boolean;
+  manageDomainIdentity: boolean;
+};
+
+export function planInboundEmailSes(
+  identity: SiteBackendIdentity,
+  inboundEmailEnabled: boolean,
+  options: { manageDomainIdentity?: boolean } | undefined,
+): InboundEmailSesPlan {
+  const legacyPipeline = isLegacyProductionPipeline(identity);
+  const deployedMainBranch = identity.amplifyAppId !== "" && identity.amplifyBranch === "main";
+  const createReceiptRules = inboundEmailEnabled && (legacyPipeline || deployedMainBranch);
+  return {
+    createReceiptRules,
+    activateReceiptRuleSet: createReceiptRules && legacyPipeline,
+    manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
+  };
+}
+
+export type SiteGlobalResourceNames = {
+  knowledgeVectorIndexName: string;
+  storageBackupVaultName: string;
+  receiptRuleSetName: string;
+  receiptRuleName: string | undefined;
+};
+
+export function deriveSiteGlobalResourceNames(
+  identity: SiteBackendIdentity,
+  inboundEmailDomain: string,
+  backupsStackName: string,
+): SiteGlobalResourceNames {
+  return {
+    knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
+    storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+    receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
+    receiptRuleName: deriveReceiptRuleName(identity),
+  };
+}

package/amplify/site-backend.js

@@ -1,12 +1,6 @@
 import { defineBackend, secret } from "@aws-amplify/backend";
-import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
-import * as backup from "aws-cdk-lib/aws-backup";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { Stack } from "aws-cdk-lib";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
-import * as events from "aws-cdk-lib/aws-events";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as ses from "aws-cdk-lib/aws-ses";
-import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { CfnEventSourceMapping, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
@@ -29,7 +23,10 @@ import { emailSubmissionProcessor } from "./functions/email-submission-processor
 import { sesInboundReceive } from "./functions/ses-inbound-receive/resource.js";
 import { slackDelivery } from "./functions/slack-delivery/resource.js";
 import { slackEvents } from "./functions/slack-events/resource.js";
+import { addInboundEmailSesIntake } from "./inbound-email/ses-intake.js";
 import { InboundEmailStack } from "./inbound-email/stack.js";
+import { deriveKnowledgeVectorIndexName, deriveReceiptRuleName, deriveReceiptRuleSetName, deriveStorageBackupVaultName, isLegacyProductionPipeline, planInboundEmailSes, resolveSiteBackendFeatureFlags, } from "./site-backend-names.js";
+import { addStorageBackups } from "./storage-backups/construct.js";
 import { storage } from "./storage/resource.js";
 export function defineSiteBackend(papyrusSite) {
     // `papyrus.config.ts`'s default export. Backend options live under `backend`;
@@ -39,43 +36,24 @@ export function defineSiteBackend(papyrusSite) {
     const knowledgeEmbeddingModel = "text-embedding-3-small";
     const amplifyBranch = (process.env.AWS_BRANCH ?? "").trim();
     const amplifyAppId = (process.env.AWS_APP_ID ?? "").trim();
-    // Amplify app id whose `main` branch is this site's production pipeline (owns
-    // account-global resources: SES rule set, backup vault, legacy S3 Vectors name).
+    // Amplify app id whose `main` branch is the original p.apyr.us backend; only
+    // that app keeps the historical account-global names (see site-backend-names.ts).
     const productionAppId = (site.productionAppId ?? "").trim();
-    const isAmplifyProductionPipeline = amplifyBranch === "main" && productionAppId !== "" && amplifyAppId === productionAppId;
-    function readEnvFlag(name, defaultValue) {
-        const raw = (process.env[name] ?? "").trim().toLowerCase();
-        if (["1", "true", "yes", "on"].includes(raw))
-            return true;
-        if (["0", "false", "no", "off"].includes(raw))
-            return false;
-        return defaultValue;
-    }
-    function sanitizeAwsName(value, maxLength = 50) {
-        return value
-            .toLowerCase()
-            .replace(/[^a-z0-9-]/g, "-")
-            .replace(/-+/g, "-")
-            .replace(/^-|-$/g, "")
-            .slice(0, maxLength);
-    }
-    // S3 Vectors index names are account-global. Keep the original name for the
-    // p.apyr.us production app so its existing index + data are not orphaned;
-    // namespace every other app's index by site brand so a second CMS app can
-    // deploy into the same account without colliding.
-    const papyrusSiteBrand = (site.brandId
-        ?? process.env.PAPYRUS_SITE_BRAND
-        ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
-        ?? "papyrus").trim().toLowerCase();
-    const knowledgeVectorIndexName = productionAppId !== "" && amplifyAppId === productionAppId
-        ? "papyrus-knowledge"
-        : `papyrus-knowledge-${sanitizeAwsName(papyrusSiteBrand, 40)}`;
-    // SES active receipt rule sets and shared backup vault names are account-global.
-    // Keep them on the production pipeline only unless explicitly opted in.
-    // A feature flag in the site config wins over the environment.
-    const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
-    const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
-    const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+    const siteBackendIdentity = {
+        brandId: (site.brandId
+            ?? process.env.PAPYRUS_SITE_BRAND
+            ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
+            ?? "papyrus").trim().toLowerCase(),
+        amplifyAppId,
+        amplifyBranch,
+        productionAppId,
+    };
+    const isAmplifyProductionPipeline = isLegacyProductionPipeline(siteBackendIdentity);
+    const knowledgeVectorIndexName = deriveKnowledgeVectorIndexName(siteBackendIdentity);
+    const featureFlags = resolveSiteBackendFeatureFlags(site.features, process.env, siteBackendIdentity);
+    const enableInboundEmail = featureFlags.inboundEmail;
+    const enableSlackAgent = featureFlags.slack;
+    const enableStorageBackups = featureFlags.storageBackups;
     const authConfig = site.auth ?? authConfigFromEnv();
     const backend = defineBackend({
         assignmentAction,
@@ -104,7 +82,7 @@ export function defineSiteBackend(papyrusSite) {
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
-    const enableConsoleResponder = site.features?.consoleResponder ?? readEnvFlag("PAPYRUS_ENABLE_CONSOLE_RESPONDER", true);
+    const enableConsoleResponder = featureFlags.consoleResponder;
     if (enableConsoleResponder
         && !process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI?.trim()
         && !process.env.PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD?.trim()
@@ -237,31 +215,13 @@ export function defineSiteBackend(papyrusSite) {
     }
     if (enableStorageBackups) {
         const storageBackupsStack = backend.createStack("storage-backups");
-        const storageBackupVaultName = sanitizeAwsName(process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME?.trim()
-            || (isAmplifyProductionPipeline
-                ? `papyrus-${productionAppId}-main-media-backup-vault`
-                : `papyrus-${sanitizeAwsName(storageBackupsStack.stackName, 32)}-media-vault`));
-        storageBackupVault = new backup.BackupVault(storageBackupsStack, "PapyrusStorageBackupVault", {
+        const storageBackupVaultName = deriveStorageBackupVaultName(siteBackendIdentity, storageBackupsStack.stackName, process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME);
+        const storageBackups = addStorageBackups(storageBackupsStack, {
+            storageBucket,
             backupVaultName: storageBackupVaultName,
-            removalPolicy: RemovalPolicy.RETAIN,
-        });
-        storageBackupPlan = new backup.BackupPlan(storageBackupsStack, "PapyrusStorageBackupPlan", {
-            backupVault: storageBackupVault,
-        });
-        storageBackupPlan.addRule(new backup.BackupPlanRule({
-            ruleName: "papyrus-storage-pitr-35d",
-            enableContinuousBackup: true,
-            deleteAfter: Duration.days(35),
-        }));
-        storageBackupPlan.addRule(new backup.BackupPlanRule({
-            ruleName: "papyrus-storage-daily-365d",
-            scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
-            deleteAfter: Duration.days(365),
-        }));
-        storageBackupPlan.addSelection("PapyrusStorageBackupSelection", {
-            allowRestores: true,
-            resources: [backup.BackupResource.fromArn(storageBucket.bucketArn)],
         });
+        storageBackupVault = storageBackups.vault;
+        storageBackupPlan = storageBackups.plan;
     }
     // Grant S3 access on Lambda roles only (not storage bucket policies) to avoid
     // storage ↔ data nested-stack circular dependencies from allow.resource().
@@ -412,83 +372,25 @@ export function defineSiteBackend(papyrusSite) {
             resources: ["*"],
         }));
         const inboundEventStack = Stack.of(receiveLambda);
-        // SES receipt rule sets are account-global; only provision on the production pipeline.
-        if (isAmplifyProductionPipeline) {
-            const inboundDnsZone = route53.HostedZone.fromHostedZoneAttributes(storageStack, "PapyrusInboundDnsZone", {
-                hostedZoneId: inboundDnsZoneId,
-                zoneName: inboundDnsZoneName,
-            });
-            const verifyInboundEmailDomain = new AwsCustomResource(storageStack, "VerifyInboundEmailDomain", {
-                onCreate: {
-                    service: "SES",
-                    action: "verifyDomainIdentity",
-                    parameters: {
-                        Domain: inboundEmailDomain,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-                },
-                onUpdate: {
-                    service: "SES",
-                    action: "verifyDomainIdentity",
-                    parameters: {
-                        Domain: inboundEmailDomain,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-                },
-                policy: AwsCustomResourcePolicy.fromSdkCalls({
-                    resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-                }),
-                timeout: Duration.minutes(2),
-            });
-            new route53.TxtRecord(storageStack, "PapyrusInboundEmailDomainVerification", {
-                zone: inboundDnsZone,
-                recordName: `_amazonses.${inboundDnsRecordName}`,
-                ttl: Duration.minutes(5),
-                values: [verifyInboundEmailDomain.getResponseField("VerificationToken")],
-            });
-            const inboundRuleSet = new ses.ReceiptRuleSet(storageStack, "PapyrusInboundEmailRuleSet", {
-                receiptRuleSetName: `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`,
-            });
-            inboundRuleSet.addRule("PapyrusInboundSubmissions", {
+        // SES allows one active receipt rule set per region, so a non-legacy site
+        // creates its own brand-named rule set and never activates it here.
+        const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
+        if (inboundSesPlan.createReceiptRules) {
+            addInboundEmailSesIntake(storageStack, {
+                storageBucket,
                 recipients: inboundRecipients,
-                enabled: true,
-                scanEnabled: true,
-                tlsPolicy: ses.TlsPolicy.REQUIRE,
-                actions: [
-                    new sesActions.S3({
-                        bucket: storageBucket,
-                        objectKeyPrefix: "inbound-email/",
-                    }),
-                ],
-            });
-            new AwsCustomResource(storageStack, "ActivateInboundEmailRuleSet", {
-                onCreate: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: inboundRuleSet.receiptRuleSetName,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-                },
-                onUpdate: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: inboundRuleSet.receiptRuleSetName,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-                },
-                onDelete: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: null,
-                    },
-                },
-                policy: AwsCustomResourcePolicy.fromSdkCalls({
-                    resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-                }),
-                timeout: Duration.minutes(2),
+                ruleSetName: deriveReceiptRuleSetName(siteBackendIdentity, inboundEmailDomain),
+                existingRuleSetName: site.inboundEmailSes?.existingReceiptRuleSetName,
+                ruleName: deriveReceiptRuleName(siteBackendIdentity),
+                activateRuleSet: inboundSesPlan.activateReceiptRuleSet,
+                domainIdentity: inboundSesPlan.manageDomainIdentity
+                    ? {
+                        domain: inboundEmailDomain,
+                        hostedZoneId: inboundDnsZoneId,
+                        hostedZoneName: inboundDnsZoneName,
+                        recordName: inboundDnsRecordName,
+                    }
+                    : undefined,
             });
         }
         new InboundEmailStack(inboundEventStack, "InboundEmail", {

package/amplify/site-backend.ts

@@ -1,12 +1,7 @@
 import { defineBackend, secret } from "@aws-amplify/backend";
-import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
-import * as backup from "aws-cdk-lib/aws-backup";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { Stack } from "aws-cdk-lib";
+import type * as backup from "aws-cdk-lib/aws-backup";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
-import * as events from "aws-cdk-lib/aws-events";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as ses from "aws-cdk-lib/aws-ses";
-import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { CfnEventSourceMapping, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import * as s3 from "aws-cdk-lib/aws-s3";
@@ -30,7 +25,19 @@ import { emailSubmissionProcessor } from "./functions/email-submission-processor
 import { sesInboundReceive } from "./functions/ses-inbound-receive/resource";
 import { slackDelivery } from "./functions/slack-delivery/resource";
 import { slackEvents } from "./functions/slack-events/resource";
+import { addInboundEmailSesIntake } from "./inbound-email/ses-intake";
 import { InboundEmailStack } from "./inbound-email/stack";
+import {
+  deriveKnowledgeVectorIndexName,
+  deriveReceiptRuleName,
+  deriveReceiptRuleSetName,
+  deriveStorageBackupVaultName,
+  isLegacyProductionPipeline,
+  planInboundEmailSes,
+  resolveSiteBackendFeatureFlags,
+  type SiteBackendIdentity,
+} from "./site-backend-names";
+import { addStorageBackups } from "./storage-backups/construct";
 import { storage } from "./storage/resource";
 import type { PapyrusSite } from "../lib/define-site";
 
@@ -43,49 +50,26 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   const amplifyBranch = (process.env.AWS_BRANCH ?? "").trim();
   const amplifyAppId = (process.env.AWS_APP_ID ?? "").trim();
-  // Amplify app id whose `main` branch is this site's production pipeline (owns
-  // account-global resources: SES rule set, backup vault, legacy S3 Vectors name).
+  // Amplify app id whose `main` branch is the original p.apyr.us backend; only
+  // that app keeps the historical account-global names (see site-backend-names.ts).
   const productionAppId = (site.productionAppId ?? "").trim();
-  const isAmplifyProductionPipeline =
-    amplifyBranch === "main" && productionAppId !== "" && amplifyAppId === productionAppId;
-
-  function readEnvFlag(name: string, defaultValue: boolean): boolean {
-    const raw = (process.env[name] ?? "").trim().toLowerCase();
-    if (["1", "true", "yes", "on"].includes(raw)) return true;
-    if (["0", "false", "no", "off"].includes(raw)) return false;
-    return defaultValue;
-  }
-
-  function sanitizeAwsName(value: string, maxLength = 50): string {
-    return value
-      .toLowerCase()
-      .replace(/[^a-z0-9-]/g, "-")
-      .replace(/-+/g, "-")
-      .replace(/^-|-$/g, "")
-      .slice(0, maxLength);
-  }
-
-  // S3 Vectors index names are account-global. Keep the original name for the
-  // p.apyr.us production app so its existing index + data are not orphaned;
-  // namespace every other app's index by site brand so a second CMS app can
-  // deploy into the same account without colliding.
-  const papyrusSiteBrand = (
-    site.brandId
-    ?? process.env.PAPYRUS_SITE_BRAND
-    ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
-    ?? "papyrus"
-  ).trim().toLowerCase();
-  const knowledgeVectorIndexName =
-    productionAppId !== "" && amplifyAppId === productionAppId
-      ? "papyrus-knowledge"
-      : `papyrus-knowledge-${sanitizeAwsName(papyrusSiteBrand, 40)}`;
-
-  // SES active receipt rule sets and shared backup vault names are account-global.
-  // Keep them on the production pipeline only unless explicitly opted in.
-  // A feature flag in the site config wins over the environment.
-  const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
-  const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
-  const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+  const siteBackendIdentity: SiteBackendIdentity = {
+    brandId: (
+      site.brandId
+      ?? process.env.PAPYRUS_SITE_BRAND
+      ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
+      ?? "papyrus"
+    ).trim().toLowerCase(),
+    amplifyAppId,
+    amplifyBranch,
+    productionAppId,
+  };
+  const isAmplifyProductionPipeline = isLegacyProductionPipeline(siteBackendIdentity);
+  const knowledgeVectorIndexName = deriveKnowledgeVectorIndexName(siteBackendIdentity);
+  const featureFlags = resolveSiteBackendFeatureFlags(site.features, process.env, siteBackendIdentity);
+  const enableInboundEmail = featureFlags.inboundEmail;
+  const enableSlackAgent = featureFlags.slack;
+  const enableStorageBackups = featureFlags.storageBackups;
 
   const authConfig = site.auth ?? authConfigFromEnv();
   const backend = defineBackend({
@@ -119,7 +103,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
-  const enableConsoleResponder = site.features?.consoleResponder ?? readEnvFlag("PAPYRUS_ENABLE_CONSOLE_RESPONDER", true);
+  const enableConsoleResponder = featureFlags.consoleResponder;
 
   if (
     enableConsoleResponder
@@ -291,41 +275,18 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   if (enableStorageBackups) {
     const storageBackupsStack = backend.createStack("storage-backups");
-    const storageBackupVaultName = sanitizeAwsName(
-      process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME?.trim()
-      || (isAmplifyProductionPipeline
-        ? `papyrus-${productionAppId}-main-media-backup-vault`
-        : `papyrus-${sanitizeAwsName(storageBackupsStack.stackName, 32)}-media-vault`),
+    const storageBackupVaultName = deriveStorageBackupVaultName(
+      siteBackendIdentity,
+      storageBackupsStack.stackName,
+      process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME,
     );
 
-    storageBackupVault = new backup.BackupVault(storageBackupsStack, "PapyrusStorageBackupVault", {
+    const storageBackups = addStorageBackups(storageBackupsStack, {
+      storageBucket,
       backupVaultName: storageBackupVaultName,
-      removalPolicy: RemovalPolicy.RETAIN,
-    });
-    storageBackupPlan = new backup.BackupPlan(storageBackupsStack, "PapyrusStorageBackupPlan", {
-      backupVault: storageBackupVault,
-    });
-
-    storageBackupPlan.addRule(
-      new backup.BackupPlanRule({
-        ruleName: "papyrus-storage-pitr-35d",
-        enableContinuousBackup: true,
-        deleteAfter: Duration.days(35),
-      }),
-    );
-
-    storageBackupPlan.addRule(
-      new backup.BackupPlanRule({
-        ruleName: "papyrus-storage-daily-365d",
-        scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
-        deleteAfter: Duration.days(365),
-      }),
-    );
-
-    storageBackupPlan.addSelection("PapyrusStorageBackupSelection", {
-      allowRestores: true,
-      resources: [backup.BackupResource.fromArn(storageBucket.bucketArn)],
     });
+    storageBackupVault = storageBackups.vault;
+    storageBackupPlan = storageBackups.plan;
   }
 
   // Grant S3 access on Lambda roles only (not storage bucket policies) to avoid
@@ -524,86 +485,26 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
     const inboundEventStack = Stack.of(receiveLambda);
 
-    // SES receipt rule sets are account-global; only provision on the production pipeline.
-    if (isAmplifyProductionPipeline) {
-    const inboundDnsZone = route53.HostedZone.fromHostedZoneAttributes(storageStack, "PapyrusInboundDnsZone", {
-      hostedZoneId: inboundDnsZoneId,
-      zoneName: inboundDnsZoneName,
-    });
-    const verifyInboundEmailDomain = new AwsCustomResource(storageStack, "VerifyInboundEmailDomain", {
-      onCreate: {
-        service: "SES",
-        action: "verifyDomainIdentity",
-        parameters: {
-          Domain: inboundEmailDomain,
-        },
-        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-      },
-      onUpdate: {
-        service: "SES",
-        action: "verifyDomainIdentity",
-        parameters: {
-          Domain: inboundEmailDomain,
-        },
-        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-      },
-      policy: AwsCustomResourcePolicy.fromSdkCalls({
-        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-      }),
-      timeout: Duration.minutes(2),
-    });
-    new route53.TxtRecord(storageStack, "PapyrusInboundEmailDomainVerification", {
-      zone: inboundDnsZone,
-      recordName: `_amazonses.${inboundDnsRecordName}`,
-      ttl: Duration.minutes(5),
-      values: [verifyInboundEmailDomain.getResponseField("VerificationToken")],
-    });
-
-    const inboundRuleSet = new ses.ReceiptRuleSet(storageStack, "PapyrusInboundEmailRuleSet", {
-      receiptRuleSetName: `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`,
-    });
-    inboundRuleSet.addRule("PapyrusInboundSubmissions", {
-      recipients: inboundRecipients,
-      enabled: true,
-      scanEnabled: true,
-      tlsPolicy: ses.TlsPolicy.REQUIRE,
-      actions: [
-        new sesActions.S3({
-          bucket: storageBucket,
-          objectKeyPrefix: "inbound-email/",
-        }),
-      ],
-    });
-
-    new AwsCustomResource(storageStack, "ActivateInboundEmailRuleSet", {
-      onCreate: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: inboundRuleSet.receiptRuleSetName,
-        },
-        physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-      },
-      onUpdate: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: inboundRuleSet.receiptRuleSetName,
-        },
-        physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-      },
-      onDelete: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: null,
-        },
-      },
-      policy: AwsCustomResourcePolicy.fromSdkCalls({
-        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-      }),
-      timeout: Duration.minutes(2),
-    });
+    // SES allows one active receipt rule set per region, so a non-legacy site
+    // creates its own brand-named rule set and never activates it here.
+    const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
+    if (inboundSesPlan.createReceiptRules) {
+      addInboundEmailSesIntake(storageStack, {
+        storageBucket,
+        recipients: inboundRecipients,
+        ruleSetName: deriveReceiptRuleSetName(siteBackendIdentity, inboundEmailDomain),
+        existingRuleSetName: site.inboundEmailSes?.existingReceiptRuleSetName,
+        ruleName: deriveReceiptRuleName(siteBackendIdentity),
+        activateRuleSet: inboundSesPlan.activateReceiptRuleSet,
+        domainIdentity: inboundSesPlan.manageDomainIdentity
+          ? {
+              domain: inboundEmailDomain,
+              hostedZoneId: inboundDnsZoneId,
+              hostedZoneName: inboundDnsZoneName,
+              recordName: inboundDnsRecordName,
+            }
+          : undefined,
+      });
     }
 
     new InboundEmailStack(inboundEventStack, "InboundEmail", {

package/amplify/storage-backups/construct.js

@@ -0,0 +1,31 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as backup from "aws-cdk-lib/aws-backup";
+import * as events from "aws-cdk-lib/aws-events";
+/**
+ * Adds the resources directly to `scope` (no wrapper construct) so the logical
+ * ids of the live p.apyr.us backup stack stay unchanged.
+ */
+export function addStorageBackups(scope, props) {
+    const vault = new backup.BackupVault(scope, "PapyrusStorageBackupVault", {
+        backupVaultName: props.backupVaultName,
+        removalPolicy: RemovalPolicy.RETAIN,
+    });
+    const plan = new backup.BackupPlan(scope, "PapyrusStorageBackupPlan", {
+        backupVault: vault,
+    });
+    plan.addRule(new backup.BackupPlanRule({
+        ruleName: "papyrus-storage-pitr-35d",
+        enableContinuousBackup: true,
+        deleteAfter: Duration.days(35),
+    }));
+    plan.addRule(new backup.BackupPlanRule({
+        ruleName: "papyrus-storage-daily-365d",
+        scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
+        deleteAfter: Duration.days(365),
+    }));
+    plan.addSelection("PapyrusStorageBackupSelection", {
+        allowRestores: true,
+        resources: [backup.BackupResource.fromArn(props.storageBucket.bucketArn)],
+    });
+    return { plan, vault };
+}

package/amplify/storage-backups/construct.ts

@@ -0,0 +1,47 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as backup from "aws-cdk-lib/aws-backup";
+import * as events from "aws-cdk-lib/aws-events";
+import type * as s3 from "aws-cdk-lib/aws-s3";
+import type { Construct } from "constructs";
+
+export type StorageBackupsProps = {
+  storageBucket: s3.IBucket;
+  backupVaultName: string;
+};
+
+/**
+ * Adds the resources directly to `scope` (no wrapper construct) so the logical
+ * ids of the live p.apyr.us backup stack stay unchanged.
+ */
+export function addStorageBackups(scope: Construct, props: StorageBackupsProps) {
+  const vault = new backup.BackupVault(scope, "PapyrusStorageBackupVault", {
+    backupVaultName: props.backupVaultName,
+    removalPolicy: RemovalPolicy.RETAIN,
+  });
+  const plan = new backup.BackupPlan(scope, "PapyrusStorageBackupPlan", {
+    backupVault: vault,
+  });
+
+  plan.addRule(
+    new backup.BackupPlanRule({
+      ruleName: "papyrus-storage-pitr-35d",
+      enableContinuousBackup: true,
+      deleteAfter: Duration.days(35),
+    }),
+  );
+
+  plan.addRule(
+    new backup.BackupPlanRule({
+      ruleName: "papyrus-storage-daily-365d",
+      scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
+      deleteAfter: Duration.days(365),
+    }),
+  );
+
+  plan.addSelection("PapyrusStorageBackupSelection", {
+    allowRestores: true,
+    resources: [backup.BackupResource.fromArn(props.storageBucket.bucketArn)],
+  });
+
+  return { plan, vault };
+}

package/lib/graphql-content-repository.ts

@@ -152,6 +152,7 @@ async function withReaderGraphQLContext<T>(operation: () => Promise<T>): Promise
     // Drafts are read as the signed-in visitor: the client reads the session from the request cookies, and it is
     // kept in the request's async context (never a module global) so one visitor's session cannot serve another.
     const { cookies } = await import("next/headers");
+    await cookies();
     const client = generateServerClientUsingCookies<Schema>({ config, cookies, authMode: "userPool" });
     return runWithContentSource(source, operation, client);
   }

package/lib/reader-static-params.ts

@@ -1,7 +1,12 @@
 import { graphqlContentRepository } from "./graphql-content-repository";
 import { SITE_BRAND } from "./site-brand";
+import { getContentSource } from "./site-env";
 import type { RendererConfig } from "./renderer-config";
 
+export function siteEnumeratesReaderRoutesAtBuild(): boolean {
+  return siteServesNextReaderRoutes() && getContentSource() !== "drafts";
+}
+
 export function siteServesNextReaderRoutes(rendererKind: RendererConfig["kind"] = SITE_BRAND.renderer.kind): boolean {
   return rendererKind !== "markus";
 }
@@ -29,7 +34,7 @@ type EditionDateStaticParam = {
 
 export async function generateEditionDateStaticParams(): Promise<EditionDateStaticParam[]> {
   if (process.env.NODE_ENV === "development") return [];
-  if (!siteServesNextReaderRoutes()) return [];
+  if (!siteEnumeratesReaderRoutesAtBuild()) return [];
 
   const { editions } = await graphqlContentRepository.listPublishedEditions({ limit: 100 });
   const params: EditionDateStaticParam[] = [];
@@ -42,7 +47,7 @@ export async function generateEditionDateStaticParams(): Promise<EditionDateStat
 
 export async function generateArticleStaticParams(): Promise<Array<{ slug: string }>> {
   if (process.env.NODE_ENV === "development") return [];
-  if (!siteServesNextReaderRoutes()) return [];
+  if (!siteEnumeratesReaderRoutesAtBuild()) return [];
 
   const slugs = await graphqlContentRepository.listArticleSlugs();
   return slugs.map((slug) => ({ slug }));

package/package.json

@@ -295,7 +295,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.30",
+  "version": "1.0.0-next.32",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.30",
+  "version": "1.0.0-next.32",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",