@anthusai/papyrus 1.0.0-next.4 → 1.0.0-next.40

package/amplify/site-backend-names.ts

@@ -0,0 +1,166 @@
+import { createHash } from "node:crypto";
+import { Token } from "aws-cdk-lib";
+
+export type SiteBackendFeatureFlags = {
+  consoleResponder: boolean;
+  inboundEmail: boolean;
+  slack: boolean;
+  storageBackups: boolean;
+};
+
+export type SiteBackendFeatureInput = Partial<SiteBackendFeatureFlags> | undefined;
+
+export function sanitizeAwsName(value: string, maxLength = 50): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "")
+    .slice(0, maxLength);
+}
+
+/**
+ * Account-global names are immutable in AWS, so they must be built from literal
+ * synth-time inputs only. A CDK token (or text that came from one, such as
+ * `token-token-17565`) makes the name change on every synth and fail with
+ * AlreadyExists, so this throws instead.
+ */
+export function assertLiteralResourceName(label: string, name: string): string {
+  if (Token.isUnresolved(name) || /token|\$\{/i.test(name)) {
+    throw new Error(
+      `${label} "${name}" is derived from an unresolved CDK token. Build account-global names from literal site config values only.`,
+    );
+  }
+  return name;
+}
+
+export function readBooleanEnvFlag(
+  environment: Record<string, string | undefined>,
+  name: string,
+  defaultValue: boolean,
+): boolean {
+  const raw = (environment[name] ?? "").trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(raw)) return true;
+  if (["0", "false", "no", "off"].includes(raw)) return false;
+  return defaultValue;
+}
+
+export type SiteBackendIdentity = {
+  brandId: string;
+  amplifyAppId: string;
+  amplifyBranch: string;
+  productionAppId: string;
+};
+
+/**
+ * True only for the Amplify app that owns the original p.apyr.us backend. That
+ * backend keeps its historical account-global names so its live resources are
+ * never replaced. Every other site gets brand-scoped names.
+ */
+export function isLegacyProductionApp(identity: SiteBackendIdentity): boolean {
+  return identity.productionAppId !== "" && identity.amplifyAppId === identity.productionAppId;
+}
+
+export function isLegacyProductionPipeline(identity: SiteBackendIdentity): boolean {
+  return isLegacyProductionApp(identity) && identity.amplifyBranch === "main";
+}
+
+export function resolveSiteBackendFeatureFlags(
+  features: SiteBackendFeatureInput,
+  environment: Record<string, string | undefined>,
+  identity: SiteBackendIdentity,
+): SiteBackendFeatureFlags {
+  const legacyPipeline = isLegacyProductionPipeline(identity);
+  return {
+    consoleResponder:
+      features?.consoleResponder ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_CONSOLE_RESPONDER", true),
+    inboundEmail:
+      features?.inboundEmail ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_INBOUND_EMAIL", legacyPipeline),
+    slack: features?.slack ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_SLACK", false),
+    storageBackups:
+      features?.storageBackups ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_STORAGE_BACKUPS", legacyPipeline),
+  };
+}
+
+export function deriveKnowledgeVectorIndexName(identity: SiteBackendIdentity): string {
+  const name = isLegacyProductionApp(identity)
+    ? "papyrus-knowledge"
+    : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+  return assertLiteralResourceName("Knowledge vector index name", name);
+}
+
+export function deriveStorageBackupVaultName(identity: SiteBackendIdentity, explicitName?: string): string {
+  const explicit = (explicitName ?? "").trim();
+  if (explicit !== "") return assertLiteralResourceName("Backup vault name", sanitizeAwsName(explicit));
+  if (isLegacyProductionPipeline(identity)) {
+    return assertLiteralResourceName(
+      "Backup vault name",
+      sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`),
+    );
+  }
+  const literalSiteKey = [identity.brandId, identity.amplifyAppId, identity.amplifyBranch].join("|");
+  const siteHash = createHash("sha256").update(literalSiteKey).digest("hex").slice(0, 8);
+  return assertLiteralResourceName(
+    "Backup vault name",
+    `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${siteHash}-media-vault`,
+  );
+}
+
+/**
+ * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
+ * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
+ * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
+ * its own brand-named rule set and never activates it from CloudFormation.
+ */
+export function deriveReceiptRuleSetName(identity: SiteBackendIdentity, inboundEmailDomain: string): string {
+  const name = isLegacyProductionApp(identity)
+    ? `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`
+    : `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+  return assertLiteralResourceName("Receipt rule set name", name);
+}
+
+/** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
+export function deriveReceiptRuleName(identity: SiteBackendIdentity): string | undefined {
+  if (isLegacyProductionApp(identity)) return undefined;
+  return assertLiteralResourceName("Receipt rule name", `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`);
+}
+
+export type InboundEmailSesPlan = {
+  createReceiptRules: boolean;
+  activateReceiptRuleSet: boolean;
+  manageDomainIdentity: boolean;
+};
+
+export function planInboundEmailSes(
+  identity: SiteBackendIdentity,
+  inboundEmailEnabled: boolean,
+  options: { manageDomainIdentity?: boolean } | undefined,
+): InboundEmailSesPlan {
+  const legacyPipeline = isLegacyProductionPipeline(identity);
+  const deployedMainBranch = identity.amplifyAppId !== "" && identity.amplifyBranch === "main";
+  const createReceiptRules = inboundEmailEnabled && (legacyPipeline || deployedMainBranch);
+  return {
+    createReceiptRules,
+    activateReceiptRuleSet: createReceiptRules && legacyPipeline,
+    manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
+  };
+}
+
+export type SiteGlobalResourceNames = {
+  knowledgeVectorIndexName: string;
+  storageBackupVaultName: string;
+  receiptRuleSetName: string;
+  receiptRuleName: string | undefined;
+};
+
+export function deriveSiteGlobalResourceNames(
+  identity: SiteBackendIdentity,
+  inboundEmailDomain: string,
+): SiteGlobalResourceNames {
+  return {
+    knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
+    storageBackupVaultName: deriveStorageBackupVaultName(identity),
+    receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
+    receiptRuleName: deriveReceiptRuleName(identity),
+  };
+}

package/amplify/site-backend.js

@@ -1,23 +1,18 @@
 import { defineBackend, secret } from "@aws-amplify/backend";
-import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
-import * as backup from "aws-cdk-lib/aws-backup";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { Stack } from "aws-cdk-lib";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
-import * as events from "aws-cdk-lib/aws-events";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as ses from "aws-cdk-lib/aws-ses";
-import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { CfnEventSourceMapping, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves.js";
+import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource.js";
 import { contentActions } from "./functions/content-actions/resource.js";
 import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
@@ -29,7 +24,10 @@ import { emailSubmissionProcessor } from "./functions/email-submission-processor
 import { sesInboundReceive } from "./functions/ses-inbound-receive/resource.js";
 import { slackDelivery } from "./functions/slack-delivery/resource.js";
 import { slackEvents } from "./functions/slack-events/resource.js";
+import { addInboundEmailSesIntake } from "./inbound-email/ses-intake.js";
 import { InboundEmailStack } from "./inbound-email/stack.js";
+import { deriveKnowledgeVectorIndexName, deriveReceiptRuleName, deriveReceiptRuleSetName, deriveStorageBackupVaultName, isLegacyProductionPipeline, planInboundEmailSes, resolveSiteBackendFeatureFlags, } from "./site-backend-names.js";
+import { addStorageBackups } from "./storage-backups/construct.js";
 import { storage } from "./storage/resource.js";
 export function defineSiteBackend(papyrusSite) {
     // `papyrus.config.ts`'s default export. Backend options live under `backend`;
@@ -39,50 +37,36 @@ export function defineSiteBackend(papyrusSite) {
     const knowledgeEmbeddingModel = "text-embedding-3-small";
     const amplifyBranch = (process.env.AWS_BRANCH ?? "").trim();
     const amplifyAppId = (process.env.AWS_APP_ID ?? "").trim();
-    // Amplify app id whose `main` branch is this site's production pipeline (owns
-    // account-global resources: SES rule set, backup vault, legacy S3 Vectors name).
+    // Amplify app id whose `main` branch is the original p.apyr.us backend; only
+    // that app keeps the historical account-global names (see site-backend-names.ts).
     const productionAppId = (site.productionAppId ?? "").trim();
-    const isAmplifyProductionPipeline = amplifyBranch === "main" && productionAppId !== "" && amplifyAppId === productionAppId;
-    function readEnvFlag(name, defaultValue) {
-        const raw = (process.env[name] ?? "").trim().toLowerCase();
-        if (["1", "true", "yes", "on"].includes(raw))
-            return true;
-        if (["0", "false", "no", "off"].includes(raw))
-            return false;
-        return defaultValue;
-    }
-    function sanitizeAwsName(value, maxLength = 50) {
-        return value
-            .toLowerCase()
-            .replace(/[^a-z0-9-]/g, "-")
-            .replace(/-+/g, "-")
-            .replace(/^-|-$/g, "")
-            .slice(0, maxLength);
-    }
-    // S3 Vectors index names are account-global. Keep the original name for the
-    // p.apyr.us production app so its existing index + data are not orphaned;
-    // namespace every other app's index by site brand so a second CMS app can
-    // deploy into the same account without colliding.
-    const papyrusSiteBrand = (site.brandId
-        ?? process.env.PAPYRUS_SITE_BRAND
-        ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
-        ?? "papyrus").trim().toLowerCase();
-    const knowledgeVectorIndexName = productionAppId !== "" && amplifyAppId === productionAppId
-        ? "papyrus-knowledge"
-        : `papyrus-knowledge-${sanitizeAwsName(papyrusSiteBrand, 40)}`;
-    // SES active receipt rule sets and shared backup vault names are account-global.
-    // Keep them on the production pipeline only unless explicitly opted in.
-    // A feature flag in the site config wins over the environment.
-    const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
-    const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
-    const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+    const siteBackendIdentity = {
+        brandId: (site.brandId
+            ?? process.env.PAPYRUS_SITE_BRAND
+            ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
+            ?? "papyrus").trim().toLowerCase(),
+        amplifyAppId,
+        amplifyBranch,
+        productionAppId,
+    };
+    const isAmplifyProductionPipeline = isLegacyProductionPipeline(siteBackendIdentity);
+    const knowledgeVectorIndexName = deriveKnowledgeVectorIndexName(siteBackendIdentity);
+    const featureFlags = resolveSiteBackendFeatureFlags(site.features, process.env, siteBackendIdentity);
+    const enableInboundEmail = featureFlags.inboundEmail;
+    const enableSlackAgent = featureFlags.slack;
+    const enableStorageBackups = featureFlags.storageBackups;
+    const baseAuthConfig = site.auth ?? authConfigFromEnv();
+    const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+    const authConfig = {
+        ...baseAuthConfig,
+        newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+    };
     const backend = defineBackend({
         assignmentAction,
-        auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+        auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
         data,
-        graphqlJwtAuthorizer,
         knowledgeQuery,
         manageUserRole,
         modelAttachmentUpload,
@@ -95,10 +79,17 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    orderModelStacksInWaves(backend.data.resources.graphqlApi.node.scope, Object.keys(backend.data.resources.tables), site.resolverWaveSize ?? DEFAULT_RESOLVER_WAVE_SIZE);
+    const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+    if (authConfig.applyCognitoDomainPrefix === true
+        && requestedCognitoDomainPrefix !== ""
+        && authConfig.disableGoogleOAuth !== true) {
+        applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+    }
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
-    const enableConsoleResponder = site.features?.consoleResponder ?? readEnvFlag("PAPYRUS_ENABLE_CONSOLE_RESPONDER", true);
+    const enableConsoleResponder = featureFlags.consoleResponder;
     if (enableConsoleResponder
         && !process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI?.trim()
         && !process.env.PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD?.trim()
@@ -138,36 +129,18 @@ export function defineSiteBackend(papyrusSite) {
         const messageThreadTable = backend.data.resources.tables.MessageThread;
         const dataStack = Stack.of(messageTable);
         const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-        const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild;
-        const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-        const jwtAuthorizerVariables = jwtAuthorizerEnvironment
-            && typeof jwtAuthorizerEnvironment === "object"
-            && "variables" in jwtAuthorizerEnvironment
-            ? jwtAuthorizerEnvironment.variables
-            : undefined;
-        const jwtSsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || "";
+        const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
         if (enableConsoleResponder) {
-            const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+            new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
                 messageTable,
                 messageStreamArn,
                 threadTable: messageThreadTable,
                 projectRoot,
                 graphqlEndpoint,
-                amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
                 responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
                 model: process.env.PAPYRUS_CONSOLE_MODEL,
                 prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
             });
-            if (jwtSsmEnvConfig) {
-                consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-            }
-            const jwtSecretSsmParam = process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-                || (productionAppId !== "" && amplifyAppId === productionAppId
-                    ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-                    : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-            consoleChatResponder.responderFunction.addEnvironment("PAPYRUS_JWT_SECRET_SSM_PARAM", jwtSecretSsmParam);
         }
         if (enableSlackAgent) {
             const slackEventsLambda = backend.slackEvents.resources.lambda;
@@ -179,9 +152,9 @@ export function defineSiteBackend(papyrusSite) {
             backend.slackEvents.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackEvents.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
             backend.slackEvents.addEnvironment("PAPYRUS_SLACK_ALLOWED_USER_IDS", (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim());
-            if (jwtSsmEnvConfig) {
-                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+            if (amplifySsmEnvConfig) {
+                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
             }
             backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackDelivery.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
@@ -249,31 +222,13 @@ export function defineSiteBackend(papyrusSite) {
     }
     if (enableStorageBackups) {
         const storageBackupsStack = backend.createStack("storage-backups");
-        const storageBackupVaultName = sanitizeAwsName(process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME?.trim()
-            || (isAmplifyProductionPipeline
-                ? `papyrus-${productionAppId}-main-media-backup-vault`
-                : `papyrus-${sanitizeAwsName(storageBackupsStack.stackName, 32)}-media-vault`));
-        storageBackupVault = new backup.BackupVault(storageBackupsStack, "PapyrusStorageBackupVault", {
+        const storageBackupVaultName = deriveStorageBackupVaultName(siteBackendIdentity, process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME);
+        const storageBackups = addStorageBackups(storageBackupsStack, {
+            storageBucket,
             backupVaultName: storageBackupVaultName,
-            removalPolicy: RemovalPolicy.RETAIN,
-        });
-        storageBackupPlan = new backup.BackupPlan(storageBackupsStack, "PapyrusStorageBackupPlan", {
-            backupVault: storageBackupVault,
-        });
-        storageBackupPlan.addRule(new backup.BackupPlanRule({
-            ruleName: "papyrus-storage-pitr-35d",
-            enableContinuousBackup: true,
-            deleteAfter: Duration.days(35),
-        }));
-        storageBackupPlan.addRule(new backup.BackupPlanRule({
-            ruleName: "papyrus-storage-daily-365d",
-            scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
-            deleteAfter: Duration.days(365),
-        }));
-        storageBackupPlan.addSelection("PapyrusStorageBackupSelection", {
-            allowRestores: true,
-            resources: [backup.BackupResource.fromArn(storageBucket.bucketArn)],
         });
+        storageBackupVault = storageBackups.vault;
+        storageBackupPlan = storageBackups.plan;
     }
     // Grant S3 access on Lambda roles only (not storage bucket policies) to avoid
     // storage ↔ data nested-stack circular dependencies from allow.resource().
@@ -333,6 +288,32 @@ export function defineSiteBackend(papyrusSite) {
         actions: ["appsync:GraphQL"],
         resources: ["*"],
     }));
+    const rebuildSettings = rebuildTriggerSettings({
+        reader: site.reader,
+        stagingBuildEnabled: site.stagingBuild?.enabled === true,
+        cmsAppId: amplifyAppId,
+        region: Stack.of(contentActionsLambda).region,
+        account: Stack.of(contentActionsLambda).account,
+    });
+    for (const [name, value] of Object.entries(rebuildSettings.environment)) {
+        contentActionsLambda.addEnvironment(name, value);
+    }
+    if (rebuildSettings.resources.length > 0) {
+        contentActionsLambda.addToRolePolicy(new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }));
+    }
+    if ((site.revalidateBaseUrl ?? "").trim() !== "") {
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
+        const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+        if (!revalidateSecretParameter.startsWith("/")) {
+            throw new Error("revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.");
+        }
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+        const revalidateStack = Stack.of(contentActionsLambda);
+        contentActionsLambda.addToRolePolicy(new PolicyStatement({
+            actions: ["ssm:GetParameter"],
+            resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+        }));
+    }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     if (backend.sesInboundReceive) {
@@ -398,83 +379,25 @@ export function defineSiteBackend(papyrusSite) {
             resources: ["*"],
         }));
         const inboundEventStack = Stack.of(receiveLambda);
-        // SES receipt rule sets are account-global; only provision on the production pipeline.
-        if (isAmplifyProductionPipeline) {
-            const inboundDnsZone = route53.HostedZone.fromHostedZoneAttributes(storageStack, "PapyrusInboundDnsZone", {
-                hostedZoneId: inboundDnsZoneId,
-                zoneName: inboundDnsZoneName,
-            });
-            const verifyInboundEmailDomain = new AwsCustomResource(storageStack, "VerifyInboundEmailDomain", {
-                onCreate: {
-                    service: "SES",
-                    action: "verifyDomainIdentity",
-                    parameters: {
-                        Domain: inboundEmailDomain,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-                },
-                onUpdate: {
-                    service: "SES",
-                    action: "verifyDomainIdentity",
-                    parameters: {
-                        Domain: inboundEmailDomain,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-                },
-                policy: AwsCustomResourcePolicy.fromSdkCalls({
-                    resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-                }),
-                timeout: Duration.minutes(2),
-            });
-            new route53.TxtRecord(storageStack, "PapyrusInboundEmailDomainVerification", {
-                zone: inboundDnsZone,
-                recordName: `_amazonses.${inboundDnsRecordName}`,
-                ttl: Duration.minutes(5),
-                values: [verifyInboundEmailDomain.getResponseField("VerificationToken")],
-            });
-            const inboundRuleSet = new ses.ReceiptRuleSet(storageStack, "PapyrusInboundEmailRuleSet", {
-                receiptRuleSetName: `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`,
-            });
-            inboundRuleSet.addRule("PapyrusInboundSubmissions", {
+        // SES allows one active receipt rule set per region, so a non-legacy site
+        // creates its own brand-named rule set and never activates it here.
+        const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
+        if (inboundSesPlan.createReceiptRules) {
+            addInboundEmailSesIntake(storageStack, {
+                storageBucket,
                 recipients: inboundRecipients,
-                enabled: true,
-                scanEnabled: true,
-                tlsPolicy: ses.TlsPolicy.REQUIRE,
-                actions: [
-                    new sesActions.S3({
-                        bucket: storageBucket,
-                        objectKeyPrefix: "inbound-email/",
-                    }),
-                ],
-            });
-            new AwsCustomResource(storageStack, "ActivateInboundEmailRuleSet", {
-                onCreate: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: inboundRuleSet.receiptRuleSetName,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-                },
-                onUpdate: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: inboundRuleSet.receiptRuleSetName,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-                },
-                onDelete: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: null,
-                    },
-                },
-                policy: AwsCustomResourcePolicy.fromSdkCalls({
-                    resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-                }),
-                timeout: Duration.minutes(2),
+                ruleSetName: deriveReceiptRuleSetName(siteBackendIdentity, inboundEmailDomain),
+                existingRuleSetName: site.inboundEmailSes?.existingReceiptRuleSetName,
+                ruleName: deriveReceiptRuleName(siteBackendIdentity),
+                activateRuleSet: inboundSesPlan.activateReceiptRuleSet,
+                domainIdentity: inboundSesPlan.manageDomainIdentity
+                    ? {
+                        domain: inboundEmailDomain,
+                        hostedZoneId: inboundDnsZoneId,
+                        hostedZoneName: inboundDnsZoneName,
+                        recordName: inboundDnsRecordName,
+                    }
+                    : undefined,
             });
         }
         new InboundEmailStack(inboundEventStack, "InboundEmail", {