@anthusai/papyrus 1.0.0-next.4 → 1.0.0-next.41

package/amplify/functions/content-actions/handler.py

@@ -1,10 +1,18 @@
 from __future__ import annotations
 
 import json
+import os
 from typing import Any
 
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.rebuild_trigger import (
+    DEFAULT_STAGING_BRANCH,
+    reader_target_from_environment,
+    trigger_pretext_revalidation,
+    trigger_rebuild,
+    trigger_staging_build,
+)
 from papyrus_content.publishing import (
     ItemFields,
     PublishError,
@@ -72,25 +80,57 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
     }
 
 
+def site_triggers_for(client, item_id: str) -> dict:
+    triggers: dict = {}
+    reader_app_id, reader_branch = reader_target_from_environment()
+    revalidate_base_url = (os.environ.get("PAPYRUS_REVALIDATE_BASE_URL") or "").strip()
+    if revalidate_base_url:
+        try:
+            item = client.get_record("Item", item_id) or {}
+            slugs = [item["slug"]] if item.get("slug") else []
+            revalidated = trigger_pretext_revalidation(slugs, None, base_url=revalidate_base_url)
+            triggers["revalidated"] = revalidated if revalidated is not None else {"ok": False, "reason": "not-configured"}
+        except Exception as error:  # noqa: BLE001 - a trigger failure never fails the publish
+            triggers["revalidated"] = {"ok": False, "error": f"{type(error).__name__}: {error}"}
+    if reader_app_id:
+        triggers["rebuild"] = trigger_rebuild(reader_app_id=reader_app_id, reader_branch=reader_branch)
+    return triggers
+
+
 def publish_item_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     result = publish_item(client, arguments["id"], actor=actor)
-    return {
+    response = {
         "ok": True,
         "changed": result.changed,
         "publishedId": result.published_item_id,
         "versionNumber": result.version_number,
     }
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
 
 
 def unpublish_item_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     result = unpublish_item(client, arguments["id"], actor=actor)
-    return {"ok": True, "changed": result.changed}
+    response = {"ok": True, "changed": result.changed}
+    if result.changed:
+        response.update(site_triggers_for(client, arguments["id"]))
+    return response
+
+
+def request_staging_build_action() -> dict:
+    cms_app_id = (os.environ.get("PAPYRUS_CMS_AMPLIFY_APP_ID") or "").strip()
+    if not cms_app_id:
+        return {"ok": False, "errors": [{"code": "staging-build-not-configured", "message": "This site has no staging build configured.", "line": None}]}
+    staging_branch = (os.environ.get("PAPYRUS_STAGING_BRANCH") or "").strip() or DEFAULT_STAGING_BRANCH
+    build = trigger_staging_build(cms_app_id=cms_app_id, staging_branch=staging_branch)
+    return {"ok": True, "build": build}
 
 
 def handler(event, context):
-    field = event["info"]["fieldName"]
+    field = event["fieldName"]
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)
     try:
@@ -102,6 +142,8 @@ def handler(event, context):
             return publish_item_action(arguments, actor)
         if field == "unpublishItem":
             return unpublish_item_action(arguments, actor)
+        if field == "requestStagingBuild":
+            return request_staging_build_action()
     except PublishError as error:
         return failure_response(error)
     raise ValueError(f"Unsupported field {field}")

package/amplify/functions/shared/reference-curation-metadata.ts

@@ -0,0 +1,29 @@
+/**
+ * Metadata stored with an editor's reference curation Message. When the
+ * relevance cyclotron decided the reference, the review records which
+ * decision it answered and whether its explanation may be shared (for the
+ * Cyclotron marketing recording). Both are optional.
+ */
+export type ReferenceCurationMetadataInput = {
+  action: string
+  curationStatus: string
+  reasonCode: string | null
+  referenceId: string
+  referenceLineageId: string
+  decisionRelationId?: string | null
+  shareable?: boolean | null
+}
+
+export function referenceCurationMetadata(input: ReferenceCurationMetadataInput): Record<string, unknown> {
+  const decisionRelationId = input.decisionRelationId?.trim() || null
+  return {
+    action: input.action,
+    curationStatus: input.curationStatus,
+    reasonCode: input.reasonCode,
+    curationReasonCode: input.reasonCode,
+    referenceId: input.referenceId,
+    referenceLineageId: input.referenceLineageId,
+    ...(decisionRelationId ? {decisionRelationId} : {}),
+    ...(decisionRelationId ? {shareable: input.shareable === true} : {}),
+  }
+}

package/amplify/inbound-email/ses-intake.js

@@ -0,0 +1,86 @@
+import { Duration } from "aws-cdk-lib";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sesActions from "aws-cdk-lib/aws-ses-actions";
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+/**
+ * Adds the SES receipt resources directly to `scope` (no wrapper construct) so
+ * the logical ids of the live p.apyr.us stack stay unchanged.
+ */
+export function addInboundEmailSesIntake(scope, props) {
+    if (props.domainIdentity) {
+        const { domain, hostedZoneId, hostedZoneName, recordName } = props.domainIdentity;
+        const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "PapyrusInboundDnsZone", {
+            hostedZoneId,
+            zoneName: hostedZoneName,
+        });
+        const verifyDomain = new AwsCustomResource(scope, "VerifyInboundEmailDomain", {
+            onCreate: {
+                service: "SES",
+                action: "verifyDomainIdentity",
+                parameters: { Domain: domain },
+                physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+            },
+            onUpdate: {
+                service: "SES",
+                action: "verifyDomainIdentity",
+                parameters: { Domain: domain },
+                physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+            },
+            policy: AwsCustomResourcePolicy.fromSdkCalls({
+                resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+            }),
+            timeout: Duration.minutes(2),
+        });
+        new route53.TxtRecord(scope, "PapyrusInboundEmailDomainVerification", {
+            zone,
+            recordName: `_amazonses.${recordName}`,
+            ttl: Duration.minutes(5),
+            values: [verifyDomain.getResponseField("VerificationToken")],
+        });
+    }
+    const ruleSet = props.existingRuleSetName
+        ? ses.ReceiptRuleSet.fromReceiptRuleSetName(scope, "PapyrusInboundEmailRuleSet", props.existingRuleSetName)
+        : new ses.ReceiptRuleSet(scope, "PapyrusInboundEmailRuleSet", {
+            receiptRuleSetName: props.ruleSetName,
+        });
+    ruleSet.addRule("PapyrusInboundSubmissions", {
+        receiptRuleName: props.ruleName,
+        recipients: props.recipients,
+        enabled: true,
+        scanEnabled: true,
+        tlsPolicy: ses.TlsPolicy.REQUIRE,
+        actions: [
+            new sesActions.S3({
+                bucket: props.storageBucket,
+                objectKeyPrefix: "inbound-email/",
+            }),
+        ],
+    });
+    if (props.activateRuleSet && !props.existingRuleSetName) {
+        new AwsCustomResource(scope, "ActivateInboundEmailRuleSet", {
+            onCreate: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+                physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+            },
+            onUpdate: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+                physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+            },
+            onDelete: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: null },
+            },
+            policy: AwsCustomResourcePolicy.fromSdkCalls({
+                resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+            }),
+            timeout: Duration.minutes(2),
+        });
+    }
+    return { ruleSet };
+}

package/amplify/inbound-email/ses-intake.ts

@@ -0,0 +1,110 @@
+import { Duration } from "aws-cdk-lib";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sesActions from "aws-cdk-lib/aws-ses-actions";
+import type * as s3 from "aws-cdk-lib/aws-s3";
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import type { Construct } from "constructs";
+
+export type InboundEmailSesIntakeProps = {
+  storageBucket: s3.IBucket;
+  recipients: string[];
+  ruleSetName: string;
+  /** Adds the rule to a rule set another stack owns instead of creating one. */
+  existingRuleSetName?: string;
+  /** `undefined` lets CloudFormation generate the name (the live p.apyr.us rule). */
+  ruleName?: string;
+  /** Only the legacy p.apyr.us pipeline sets this; a new site never activates a rule set. */
+  activateRuleSet: boolean;
+  domainIdentity?: {
+    domain: string;
+    hostedZoneId: string;
+    hostedZoneName: string;
+    recordName: string;
+  };
+};
+
+/**
+ * Adds the SES receipt resources directly to `scope` (no wrapper construct) so
+ * the logical ids of the live p.apyr.us stack stay unchanged.
+ */
+export function addInboundEmailSesIntake(scope: Construct, props: InboundEmailSesIntakeProps) {
+  if (props.domainIdentity) {
+    const { domain, hostedZoneId, hostedZoneName, recordName } = props.domainIdentity;
+    const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "PapyrusInboundDnsZone", {
+      hostedZoneId,
+      zoneName: hostedZoneName,
+    });
+    const verifyDomain = new AwsCustomResource(scope, "VerifyInboundEmailDomain", {
+      onCreate: {
+        service: "SES",
+        action: "verifyDomainIdentity",
+        parameters: { Domain: domain },
+        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+      },
+      onUpdate: {
+        service: "SES",
+        action: "verifyDomainIdentity",
+        parameters: { Domain: domain },
+        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+      },
+      policy: AwsCustomResourcePolicy.fromSdkCalls({
+        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+      }),
+      timeout: Duration.minutes(2),
+    });
+    new route53.TxtRecord(scope, "PapyrusInboundEmailDomainVerification", {
+      zone,
+      recordName: `_amazonses.${recordName}`,
+      ttl: Duration.minutes(5),
+      values: [verifyDomain.getResponseField("VerificationToken")],
+    });
+  }
+
+  const ruleSet = props.existingRuleSetName
+    ? ses.ReceiptRuleSet.fromReceiptRuleSetName(scope, "PapyrusInboundEmailRuleSet", props.existingRuleSetName)
+    : new ses.ReceiptRuleSet(scope, "PapyrusInboundEmailRuleSet", {
+        receiptRuleSetName: props.ruleSetName,
+      });
+  ruleSet.addRule("PapyrusInboundSubmissions", {
+    receiptRuleName: props.ruleName,
+    recipients: props.recipients,
+    enabled: true,
+    scanEnabled: true,
+    tlsPolicy: ses.TlsPolicy.REQUIRE,
+    actions: [
+      new sesActions.S3({
+        bucket: props.storageBucket,
+        objectKeyPrefix: "inbound-email/",
+      }),
+    ],
+  });
+
+  if (props.activateRuleSet && !props.existingRuleSetName) {
+    new AwsCustomResource(scope, "ActivateInboundEmailRuleSet", {
+      onCreate: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+        physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+      },
+      onUpdate: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+        physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+      },
+      onDelete: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: null },
+      },
+      policy: AwsCustomResourcePolicy.fromSdkCalls({
+        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+      }),
+      timeout: Duration.minutes(2),
+    });
+  }
+
+  return { ruleSet };
+}

package/amplify/rebuild-trigger-settings.js

@@ -0,0 +1,22 @@
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+function branchJobsArn(input, appId, branch) {
+    return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+export function rebuildTriggerSettings(input) {
+    const environment = {};
+    const resources = [];
+    const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+    if (readerAppId !== "") {
+        const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+        environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+        environment.PAPYRUS_READER_BRANCH = readerBranch;
+        resources.push(branchJobsArn(input, readerAppId, readerBranch));
+    }
+    const cmsAppId = input.cmsAppId.trim();
+    if (input.stagingBuildEnabled && cmsAppId !== "") {
+        environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+        environment.PAPYRUS_STAGING_BRANCH = "staging";
+        resources.push(branchJobsArn(input, cmsAppId, "staging"));
+    }
+    return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}

package/amplify/rebuild-trigger-settings.ts

@@ -0,0 +1,42 @@
+/**
+ * Environment and IAM policy for the content-actions Lambda's site triggers.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ */
+export type RebuildTriggerInput = {
+  reader?: { amplifyAppId: string; branchName?: string };
+  stagingBuildEnabled: boolean;
+  cmsAppId: string;
+  region: string;
+  account: string;
+};
+
+export type RebuildTriggerSettings = {
+  environment: Record<string, string>;
+  actions: string[];
+  resources: string[];
+};
+
+export const REBUILD_TRIGGER_ACTIONS = ["amplify:StartJob", "amplify:ListJobs"];
+
+function branchJobsArn(input: RebuildTriggerInput, appId: string, branch: string): string {
+  return `arn:aws:amplify:${input.region}:${input.account}:apps/${appId}/branches/${branch}/jobs/*`;
+}
+
+export function rebuildTriggerSettings(input: RebuildTriggerInput): RebuildTriggerSettings {
+  const environment: Record<string, string> = {};
+  const resources: string[] = [];
+  const readerAppId = (input.reader?.amplifyAppId ?? "").trim();
+  if (readerAppId !== "") {
+    const readerBranch = (input.reader?.branchName ?? "").trim() || "main";
+    environment.PAPYRUS_READER_AMPLIFY_APP_ID = readerAppId;
+    environment.PAPYRUS_READER_BRANCH = readerBranch;
+    resources.push(branchJobsArn(input, readerAppId, readerBranch));
+  }
+  const cmsAppId = input.cmsAppId.trim();
+  if (input.stagingBuildEnabled && cmsAppId !== "") {
+    environment.PAPYRUS_CMS_AMPLIFY_APP_ID = cmsAppId;
+    environment.PAPYRUS_STAGING_BRANCH = "staging";
+    resources.push(branchJobsArn(input, cmsAppId, "staging"));
+  }
+  return { environment, actions: REBUILD_TRIGGER_ACTIONS, resources };
+}

package/amplify/resolver-waves.js

@@ -0,0 +1,26 @@
+import { NestedStack } from "aws-cdk-lib";
+export const DEFAULT_RESOLVER_WAVE_SIZE = 12;
+export function planResolverWaves(items, waveSize) {
+    if (!Number.isInteger(waveSize) || waveSize < 1) {
+        return [];
+    }
+    const waves = [];
+    for (let start = 0; start < items.length; start += waveSize) {
+        waves.push(items.slice(start, start + waveSize));
+    }
+    return waves;
+}
+export function orderModelStacksInWaves(graphqlApi, modelNames, waveSize) {
+    const modelStacks = modelNames
+        .map((modelName) => graphqlApi.node.tryFindChild(modelName))
+        .filter((child) => child instanceof NestedStack);
+    const waves = planResolverWaves(modelStacks, waveSize);
+    for (let waveIndex = 1; waveIndex < waves.length; waveIndex += 1) {
+        for (const stack of waves[waveIndex]) {
+            for (const previousStack of waves[waveIndex - 1]) {
+                stack.addDependency(previousStack);
+            }
+        }
+    }
+    return waves.length;
+}

package/amplify/resolver-waves.ts

@@ -0,0 +1,34 @@
+import { NestedStack } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+
+export const DEFAULT_RESOLVER_WAVE_SIZE = 12;
+
+export function planResolverWaves<T>(items: T[], waveSize: number): T[][] {
+  if (!Number.isInteger(waveSize) || waveSize < 1) {
+    return [];
+  }
+  const waves: T[][] = [];
+  for (let start = 0; start < items.length; start += waveSize) {
+    waves.push(items.slice(start, start + waveSize));
+  }
+  return waves;
+}
+
+export function orderModelStacksInWaves(
+  graphqlApi: IConstruct,
+  modelNames: string[],
+  waveSize: number,
+): number {
+  const modelStacks = modelNames
+    .map((modelName) => graphqlApi.node.tryFindChild(modelName))
+    .filter((child): child is NestedStack => child instanceof NestedStack);
+  const waves = planResolverWaves(modelStacks, waveSize);
+  for (let waveIndex = 1; waveIndex < waves.length; waveIndex += 1) {
+    for (const stack of waves[waveIndex]) {
+      for (const previousStack of waves[waveIndex - 1]) {
+        stack.addDependency(previousStack);
+      }
+    }
+  }
+  return waves.length;
+}

package/amplify/site-backend-config.ts

@@ -7,8 +7,19 @@ export type PapyrusAuthConfig = {
   /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
   redirectUrls?: string[];
   disableGoogleOAuth?: boolean;
-  /** Stable Cognito hosted-UI domain prefix. */
+  /**
+   * Public newsroom path prefix for sign-in return URLs. Default `/newsroom`;
+   * `""` on a CMS-only host where the newsroom is the root. Filled from the
+   * active brand's `newsroomBasePath` by `defineSiteBackend` when unset.
+   */
+  newsroomBasePath?: string;
+  /** Desired Cognito hosted-UI domain prefix. Only applied when `applyCognitoDomainPrefix` is true. */
   cognitoDomainPrefix?: string;
+  /**
+   * Opt in to the prefix. Off by default because changing a live pool's
+   * domain replaces it and changes the Google redirect URI.
+   */
+  applyCognitoDomainPrefix?: boolean;
 };
 
 export type PapyrusSiteBackendConfig = {
@@ -21,6 +32,30 @@ export type PapyrusSiteBackendConfig = {
    */
   productionAppId?: string;
   auth?: PapyrusAuthConfig;
+  /**
+   * Maximum number of data model nested stacks CloudFormation creates at once.
+   * Stacks are chained in waves of this size so a new AWS account is not hit
+   * with every AppSync CreateResolver call in parallel (429). Only adds
+   * DependsOn ordering; no resource changes. Default 12; 0 turns it off.
+   */
+  resolverWaveSize?: number;
+  /** Static reader app (Markus-static sites) that a publish rebuilds through IAM `amplify:StartJob`. */
+  reader?: { amplifyAppId: string; branchName?: string };
+  /** Lets the newsroom start the `staging` branch build of this CMS app. */
+  stagingBuild?: { enabled: boolean };
+  /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (authenticated by the SSM secret named in branch variable `PAPYRUS_REVALIDATE_SECRET_PARAMETER`). */
+  revalidateBaseUrl?: string;
+  /**
+   * SES receipt options for a site that is not the legacy p.apyr.us backend.
+   * By default the site gets its own brand-named rule set that is never
+   * activated by CloudFormation (SES allows one active rule set per region).
+   */
+  inboundEmailSes?: {
+    /** Add this site's rule to a rule set another stack owns instead of creating one. */
+    existingReceiptRuleSetName?: string;
+    /** Let this stack verify the SES domain identity and write its TXT record. Default false: verify once by hand. */
+    manageDomainIdentity?: boolean;
+  };
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend-names.js

@@ -0,0 +1,103 @@
+import { createHash } from "node:crypto";
+import { Token } from "aws-cdk-lib";
+export function sanitizeAwsName(value, maxLength = 50) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-|-$/g, "")
+        .slice(0, maxLength);
+}
+/**
+ * Account-global names are immutable in AWS, so they must be built from literal
+ * synth-time inputs only. A CDK token (or text that came from one, such as
+ * `token-token-17565`) makes the name change on every synth and fail with
+ * AlreadyExists, so this throws instead.
+ */
+export function assertLiteralResourceName(label, name) {
+    if (Token.isUnresolved(name) || /token|\$\{/i.test(name)) {
+        throw new Error(`${label} "${name}" is derived from an unresolved CDK token. Build account-global names from literal site config values only.`);
+    }
+    return name;
+}
+export function readBooleanEnvFlag(environment, name, defaultValue) {
+    const raw = (environment[name] ?? "").trim().toLowerCase();
+    if (["1", "true", "yes", "on"].includes(raw))
+        return true;
+    if (["0", "false", "no", "off"].includes(raw))
+        return false;
+    return defaultValue;
+}
+/**
+ * True only for the Amplify app that owns the original p.apyr.us backend. That
+ * backend keeps its historical account-global names so its live resources are
+ * never replaced. Every other site gets brand-scoped names.
+ */
+export function isLegacyProductionApp(identity) {
+    return identity.productionAppId !== "" && identity.amplifyAppId === identity.productionAppId;
+}
+export function isLegacyProductionPipeline(identity) {
+    return isLegacyProductionApp(identity) && identity.amplifyBranch === "main";
+}
+export function resolveSiteBackendFeatureFlags(features, environment, identity) {
+    const legacyPipeline = isLegacyProductionPipeline(identity);
+    return {
+        consoleResponder: features?.consoleResponder ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_CONSOLE_RESPONDER", true),
+        inboundEmail: features?.inboundEmail ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_INBOUND_EMAIL", legacyPipeline),
+        slack: features?.slack ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_SLACK", false),
+        storageBackups: features?.storageBackups ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_STORAGE_BACKUPS", legacyPipeline),
+    };
+}
+export function deriveKnowledgeVectorIndexName(identity) {
+    const name = isLegacyProductionApp(identity)
+        ? "papyrus-knowledge"
+        : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+    return assertLiteralResourceName("Knowledge vector index name", name);
+}
+export function deriveStorageBackupVaultName(identity, explicitName) {
+    const explicit = (explicitName ?? "").trim();
+    if (explicit !== "")
+        return assertLiteralResourceName("Backup vault name", sanitizeAwsName(explicit));
+    if (isLegacyProductionPipeline(identity)) {
+        return assertLiteralResourceName("Backup vault name", sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`));
+    }
+    const literalSiteKey = [identity.brandId, identity.amplifyAppId, identity.amplifyBranch].join("|");
+    const siteHash = createHash("sha256").update(literalSiteKey).digest("hex").slice(0, 8);
+    return assertLiteralResourceName("Backup vault name", `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${siteHash}-media-vault`);
+}
+/**
+ * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
+ * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
+ * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
+ * its own brand-named rule set and never activates it from CloudFormation.
+ */
+export function deriveReceiptRuleSetName(identity, inboundEmailDomain) {
+    const name = isLegacyProductionApp(identity)
+        ? `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`
+        : `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+    return assertLiteralResourceName("Receipt rule set name", name);
+}
+/** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
+export function deriveReceiptRuleName(identity) {
+    if (isLegacyProductionApp(identity))
+        return undefined;
+    return assertLiteralResourceName("Receipt rule name", `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`);
+}
+export function planInboundEmailSes(identity, inboundEmailEnabled, options) {
+    const legacyPipeline = isLegacyProductionPipeline(identity);
+    const deployedMainBranch = identity.amplifyAppId !== "" && identity.amplifyBranch === "main";
+    const createReceiptRules = inboundEmailEnabled && (legacyPipeline || deployedMainBranch);
+    return {
+        createReceiptRules,
+        activateReceiptRuleSet: createReceiptRules && legacyPipeline,
+        manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
+    };
+}
+export function deriveSiteGlobalResourceNames(identity, inboundEmailDomain) {
+    return {
+        knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
+        storageBackupVaultName: deriveStorageBackupVaultName(identity),
+        receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
+        receiptRuleName: deriveReceiptRuleName(identity),
+    };
+}