@anthusai/papyrus 1.0.0-next.4 → 1.0.0-next.41

package/amplify/site-backend.ts

@@ -1,24 +1,21 @@
 import { defineBackend, secret } from "@aws-amplify/backend";
-import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
-import * as backup from "aws-cdk-lib/aws-backup";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { Stack } from "aws-cdk-lib";
+import type * as backup from "aws-cdk-lib/aws-backup";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
-import * as events from "aws-cdk-lib/aws-events";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as ses from "aws-cdk-lib/aws-ses";
-import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { CfnEventSourceMapping, CfnFunction, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+import { CfnEventSourceMapping, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
+import type { Construct } from "constructs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves";
+import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource";
 import { contentActions } from "./functions/content-actions/resource";
 import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
@@ -30,7 +27,19 @@ import { emailSubmissionProcessor } from "./functions/email-submission-processor
 import { sesInboundReceive } from "./functions/ses-inbound-receive/resource";
 import { slackDelivery } from "./functions/slack-delivery/resource";
 import { slackEvents } from "./functions/slack-events/resource";
+import { addInboundEmailSesIntake } from "./inbound-email/ses-intake";
 import { InboundEmailStack } from "./inbound-email/stack";
+import {
+  deriveKnowledgeVectorIndexName,
+  deriveReceiptRuleName,
+  deriveReceiptRuleSetName,
+  deriveStorageBackupVaultName,
+  isLegacyProductionPipeline,
+  planInboundEmailSes,
+  resolveSiteBackendFeatureFlags,
+  type SiteBackendIdentity,
+} from "./site-backend-names";
+import { addStorageBackups } from "./storage-backups/construct";
 import { storage } from "./storage/resource";
 import type { PapyrusSite } from "../lib/define-site";
 
@@ -43,57 +52,39 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   const amplifyBranch = (process.env.AWS_BRANCH ?? "").trim();
   const amplifyAppId = (process.env.AWS_APP_ID ?? "").trim();
-  // Amplify app id whose `main` branch is this site's production pipeline (owns
-  // account-global resources: SES rule set, backup vault, legacy S3 Vectors name).
+  // Amplify app id whose `main` branch is the original p.apyr.us backend; only
+  // that app keeps the historical account-global names (see site-backend-names.ts).
   const productionAppId = (site.productionAppId ?? "").trim();
-  const isAmplifyProductionPipeline =
-    amplifyBranch === "main" && productionAppId !== "" && amplifyAppId === productionAppId;
-
-  function readEnvFlag(name: string, defaultValue: boolean): boolean {
-    const raw = (process.env[name] ?? "").trim().toLowerCase();
-    if (["1", "true", "yes", "on"].includes(raw)) return true;
-    if (["0", "false", "no", "off"].includes(raw)) return false;
-    return defaultValue;
-  }
-
-  function sanitizeAwsName(value: string, maxLength = 50): string {
-    return value
-      .toLowerCase()
-      .replace(/[^a-z0-9-]/g, "-")
-      .replace(/-+/g, "-")
-      .replace(/^-|-$/g, "")
-      .slice(0, maxLength);
-  }
-
-  // S3 Vectors index names are account-global. Keep the original name for the
-  // p.apyr.us production app so its existing index + data are not orphaned;
-  // namespace every other app's index by site brand so a second CMS app can
-  // deploy into the same account without colliding.
-  const papyrusSiteBrand = (
-    site.brandId
-    ?? process.env.PAPYRUS_SITE_BRAND
-    ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
-    ?? "papyrus"
-  ).trim().toLowerCase();
-  const knowledgeVectorIndexName =
-    productionAppId !== "" && amplifyAppId === productionAppId
-      ? "papyrus-knowledge"
-      : `papyrus-knowledge-${sanitizeAwsName(papyrusSiteBrand, 40)}`;
-
-  // SES active receipt rule sets and shared backup vault names are account-global.
-  // Keep them on the production pipeline only unless explicitly opted in.
-  // A feature flag in the site config wins over the environment.
-  const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
-  const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
-  const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
-
+  const siteBackendIdentity: SiteBackendIdentity = {
+    brandId: (
+      site.brandId
+      ?? process.env.PAPYRUS_SITE_BRAND
+      ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
+      ?? "papyrus"
+    ).trim().toLowerCase(),
+    amplifyAppId,
+    amplifyBranch,
+    productionAppId,
+  };
+  const isAmplifyProductionPipeline = isLegacyProductionPipeline(siteBackendIdentity);
+  const knowledgeVectorIndexName = deriveKnowledgeVectorIndexName(siteBackendIdentity);
+  const featureFlags = resolveSiteBackendFeatureFlags(site.features, process.env, siteBackendIdentity);
+  const enableInboundEmail = featureFlags.inboundEmail;
+  const enableSlackAgent = featureFlags.slack;
+  const enableStorageBackups = featureFlags.storageBackups;
+
+  const baseAuthConfig = site.auth ?? authConfigFromEnv();
+  const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+  const authConfig = {
+    ...baseAuthConfig,
+    newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+  };
   const backend = defineBackend({
     assignmentAction,
-    auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+    auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
     data,
-    graphqlJwtAuthorizer,
     knowledgeQuery,
     manageUserRole,
     modelAttachmentUpload,
@@ -107,10 +98,25 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  orderModelStacksInWaves(
+    backend.data.resources.graphqlApi.node.scope as Construct,
+    Object.keys(backend.data.resources.tables),
+    site.resolverWaveSize ?? DEFAULT_RESOLVER_WAVE_SIZE,
+  );
+
+  const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+  if (
+    authConfig.applyCognitoDomainPrefix === true
+    && requestedCognitoDomainPrefix !== ""
+    && authConfig.disableGoogleOAuth !== true
+  ) {
+    applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+  }
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
-  const enableConsoleResponder = site.features?.consoleResponder ?? readEnvFlag("PAPYRUS_ENABLE_CONSOLE_RESPONDER", true);
+  const enableConsoleResponder = featureFlags.consoleResponder;
 
   if (
     enableConsoleResponder
@@ -159,43 +165,19 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     const messageThreadTable = backend.data.resources.tables.MessageThread;
     const dataStack = Stack.of(messageTable);
     const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-    const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild as CfnFunction | undefined;
-    const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-    const jwtAuthorizerVariables =
-      jwtAuthorizerEnvironment
-      && typeof jwtAuthorizerEnvironment === "object"
-      && "variables" in jwtAuthorizerEnvironment
-        ? (jwtAuthorizerEnvironment as { variables?: Record<string, string> }).variables
-        : undefined;
-    const jwtSsmEnvConfig =
-      process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || "";
+    const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
 
     if (enableConsoleResponder) {
-      const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+      new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
         messageTable,
         messageStreamArn,
         threadTable: messageThreadTable,
         projectRoot,
         graphqlEndpoint,
-        amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
         responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
         model: process.env.PAPYRUS_CONSOLE_MODEL,
         prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
       });
-      if (jwtSsmEnvConfig) {
-        consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-      }
-      const jwtSecretSsmParam =
-        process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-        || (productionAppId !== "" && amplifyAppId === productionAppId
-          ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-          : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-      consoleChatResponder.responderFunction.addEnvironment(
-        "PAPYRUS_JWT_SECRET_SSM_PARAM",
-        jwtSecretSsmParam,
-      );
     }
 
     if (enableSlackAgent) {
@@ -216,9 +198,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         "PAPYRUS_SLACK_ALLOWED_USER_IDS",
         (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim(),
       );
-      if (jwtSsmEnvConfig) {
-        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+      if (amplifySsmEnvConfig) {
+        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
       }
       backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
       backend.slackDelivery.addEnvironment(
@@ -306,41 +288,17 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   if (enableStorageBackups) {
     const storageBackupsStack = backend.createStack("storage-backups");
-    const storageBackupVaultName = sanitizeAwsName(
-      process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME?.trim()
-      || (isAmplifyProductionPipeline
-        ? `papyrus-${productionAppId}-main-media-backup-vault`
-        : `papyrus-${sanitizeAwsName(storageBackupsStack.stackName, 32)}-media-vault`),
+    const storageBackupVaultName = deriveStorageBackupVaultName(
+      siteBackendIdentity,
+      process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME,
     );
 
-    storageBackupVault = new backup.BackupVault(storageBackupsStack, "PapyrusStorageBackupVault", {
+    const storageBackups = addStorageBackups(storageBackupsStack, {
+      storageBucket,
       backupVaultName: storageBackupVaultName,
-      removalPolicy: RemovalPolicy.RETAIN,
-    });
-    storageBackupPlan = new backup.BackupPlan(storageBackupsStack, "PapyrusStorageBackupPlan", {
-      backupVault: storageBackupVault,
-    });
-
-    storageBackupPlan.addRule(
-      new backup.BackupPlanRule({
-        ruleName: "papyrus-storage-pitr-35d",
-        enableContinuousBackup: true,
-        deleteAfter: Duration.days(35),
-      }),
-    );
-
-    storageBackupPlan.addRule(
-      new backup.BackupPlanRule({
-        ruleName: "papyrus-storage-daily-365d",
-        scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
-        deleteAfter: Duration.days(365),
-      }),
-    );
-
-    storageBackupPlan.addSelection("PapyrusStorageBackupSelection", {
-      allowRestores: true,
-      resources: [backup.BackupResource.fromArn(storageBucket.bucketArn)],
     });
+    storageBackupVault = storageBackups.vault;
+    storageBackupPlan = storageBackups.plan;
   }
 
   // Grant S3 access on Lambda roles only (not storage bucket policies) to avoid
@@ -414,6 +372,38 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
       resources: ["*"],
     }),
   );
+  const rebuildSettings = rebuildTriggerSettings({
+    reader: site.reader,
+    stagingBuildEnabled: site.stagingBuild?.enabled === true,
+    cmsAppId: amplifyAppId,
+    region: Stack.of(contentActionsLambda).region,
+    account: Stack.of(contentActionsLambda).account,
+  });
+  for (const [name, value] of Object.entries(rebuildSettings.environment)) {
+    contentActionsLambda.addEnvironment(name, value);
+  }
+  if (rebuildSettings.resources.length > 0) {
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }),
+    );
+  }
+  if ((site.revalidateBaseUrl ?? "").trim() !== "") {
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
+    const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+    if (!revalidateSecretParameter.startsWith("/")) {
+      throw new Error(
+        "revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.",
+      );
+    }
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+    const revalidateStack = Stack.of(contentActionsLambda);
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement({
+        actions: ["ssm:GetParameter"],
+        resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+      }),
+    );
+  }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   if (backend.sesInboundReceive) {
@@ -507,86 +497,26 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
     const inboundEventStack = Stack.of(receiveLambda);
 
-    // SES receipt rule sets are account-global; only provision on the production pipeline.
-    if (isAmplifyProductionPipeline) {
-    const inboundDnsZone = route53.HostedZone.fromHostedZoneAttributes(storageStack, "PapyrusInboundDnsZone", {
-      hostedZoneId: inboundDnsZoneId,
-      zoneName: inboundDnsZoneName,
-    });
-    const verifyInboundEmailDomain = new AwsCustomResource(storageStack, "VerifyInboundEmailDomain", {
-      onCreate: {
-        service: "SES",
-        action: "verifyDomainIdentity",
-        parameters: {
-          Domain: inboundEmailDomain,
-        },
-        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-      },
-      onUpdate: {
-        service: "SES",
-        action: "verifyDomainIdentity",
-        parameters: {
-          Domain: inboundEmailDomain,
-        },
-        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-      },
-      policy: AwsCustomResourcePolicy.fromSdkCalls({
-        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-      }),
-      timeout: Duration.minutes(2),
-    });
-    new route53.TxtRecord(storageStack, "PapyrusInboundEmailDomainVerification", {
-      zone: inboundDnsZone,
-      recordName: `_amazonses.${inboundDnsRecordName}`,
-      ttl: Duration.minutes(5),
-      values: [verifyInboundEmailDomain.getResponseField("VerificationToken")],
-    });
-
-    const inboundRuleSet = new ses.ReceiptRuleSet(storageStack, "PapyrusInboundEmailRuleSet", {
-      receiptRuleSetName: `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`,
-    });
-    inboundRuleSet.addRule("PapyrusInboundSubmissions", {
-      recipients: inboundRecipients,
-      enabled: true,
-      scanEnabled: true,
-      tlsPolicy: ses.TlsPolicy.REQUIRE,
-      actions: [
-        new sesActions.S3({
-          bucket: storageBucket,
-          objectKeyPrefix: "inbound-email/",
-        }),
-      ],
-    });
-
-    new AwsCustomResource(storageStack, "ActivateInboundEmailRuleSet", {
-      onCreate: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: inboundRuleSet.receiptRuleSetName,
-        },
-        physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-      },
-      onUpdate: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: inboundRuleSet.receiptRuleSetName,
-        },
-        physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-      },
-      onDelete: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: null,
-        },
-      },
-      policy: AwsCustomResourcePolicy.fromSdkCalls({
-        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-      }),
-      timeout: Duration.minutes(2),
-    });
+    // SES allows one active receipt rule set per region, so a non-legacy site
+    // creates its own brand-named rule set and never activates it here.
+    const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
+    if (inboundSesPlan.createReceiptRules) {
+      addInboundEmailSesIntake(storageStack, {
+        storageBucket,
+        recipients: inboundRecipients,
+        ruleSetName: deriveReceiptRuleSetName(siteBackendIdentity, inboundEmailDomain),
+        existingRuleSetName: site.inboundEmailSes?.existingReceiptRuleSetName,
+        ruleName: deriveReceiptRuleName(siteBackendIdentity),
+        activateRuleSet: inboundSesPlan.activateReceiptRuleSet,
+        domainIdentity: inboundSesPlan.manageDomainIdentity
+          ? {
+              domain: inboundEmailDomain,
+              hostedZoneId: inboundDnsZoneId,
+              hostedZoneName: inboundDnsZoneName,
+              recordName: inboundDnsRecordName,
+            }
+          : undefined,
+      });
     }
 
     new InboundEmailStack(inboundEventStack, "InboundEmail", {

package/amplify/storage/resource.js

@@ -11,6 +11,9 @@ export const storage = defineStorage({
         "corpora/*": [
             allow.groups(["editor", "admin"]).to(["read"]),
         ],
+        "preview/*": [
+            allow.groups(["editor", "admin"]).to(["read"]),
+        ],
         "newsroom/*": [
             allow.groups(["editor", "admin"]).to(["read", "write", "delete"]),
         ],

package/amplify/storage/resource.ts

@@ -12,6 +12,9 @@ export const storage = defineStorage({
     "corpora/*": [
       allow.groups(["editor", "admin"]).to(["read"]),
     ],
+    "preview/*": [
+      allow.groups(["editor", "admin"]).to(["read"]),
+    ],
     "newsroom/*": [
       allow.groups(["editor", "admin"]).to(["read", "write", "delete"]),
     ],

package/amplify/storage-backups/construct.js

@@ -0,0 +1,31 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as backup from "aws-cdk-lib/aws-backup";
+import * as events from "aws-cdk-lib/aws-events";
+/**
+ * Adds the resources directly to `scope` (no wrapper construct) so the logical
+ * ids of the live p.apyr.us backup stack stay unchanged.
+ */
+export function addStorageBackups(scope, props) {
+    const vault = new backup.BackupVault(scope, "PapyrusStorageBackupVault", {
+        backupVaultName: props.backupVaultName,
+        removalPolicy: RemovalPolicy.RETAIN,
+    });
+    const plan = new backup.BackupPlan(scope, "PapyrusStorageBackupPlan", {
+        backupVault: vault,
+    });
+    plan.addRule(new backup.BackupPlanRule({
+        ruleName: "papyrus-storage-pitr-35d",
+        enableContinuousBackup: true,
+        deleteAfter: Duration.days(35),
+    }));
+    plan.addRule(new backup.BackupPlanRule({
+        ruleName: "papyrus-storage-daily-365d",
+        scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
+        deleteAfter: Duration.days(365),
+    }));
+    plan.addSelection("PapyrusStorageBackupSelection", {
+        allowRestores: true,
+        resources: [backup.BackupResource.fromArn(props.storageBucket.bucketArn)],
+    });
+    return { plan, vault };
+}

package/amplify/storage-backups/construct.ts

@@ -0,0 +1,47 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as backup from "aws-cdk-lib/aws-backup";
+import * as events from "aws-cdk-lib/aws-events";
+import type * as s3 from "aws-cdk-lib/aws-s3";
+import type { Construct } from "constructs";
+
+export type StorageBackupsProps = {
+  storageBucket: s3.IBucket;
+  backupVaultName: string;
+};
+
+/**
+ * Adds the resources directly to `scope` (no wrapper construct) so the logical
+ * ids of the live p.apyr.us backup stack stay unchanged.
+ */
+export function addStorageBackups(scope: Construct, props: StorageBackupsProps) {
+  const vault = new backup.BackupVault(scope, "PapyrusStorageBackupVault", {
+    backupVaultName: props.backupVaultName,
+    removalPolicy: RemovalPolicy.RETAIN,
+  });
+  const plan = new backup.BackupPlan(scope, "PapyrusStorageBackupPlan", {
+    backupVault: vault,
+  });
+
+  plan.addRule(
+    new backup.BackupPlanRule({
+      ruleName: "papyrus-storage-pitr-35d",
+      enableContinuousBackup: true,
+      deleteAfter: Duration.days(35),
+    }),
+  );
+
+  plan.addRule(
+    new backup.BackupPlanRule({
+      ruleName: "papyrus-storage-daily-365d",
+      scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
+      deleteAfter: Duration.days(365),
+    }),
+  );
+
+  plan.addSelection("PapyrusStorageBackupSelection", {
+    allowRestores: true,
+    resources: [backup.BackupResource.fromArn(props.storageBucket.bucketArn)],
+  });
+
+  return { plan, vault };
+}

package/app/%5F_preview/[[...path]]/route.ts

@@ -0,0 +1,8 @@
+import type { NextRequest } from "next/server";
+import { streamPreviewObject } from "../../../lib/staging-preview-object";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(request: NextRequest): Promise<Response> {
+  return streamPreviewObject(request.nextUrl.pathname);
+}

package/app/[year]/[month]/[day]/[articleSlug]/page.tsx

@@ -52,10 +52,12 @@ export default async function DateScopedArticlePage({ params }: DateScopedArticl
       editionFooter={{
         editionBasePath,
         entries: buildPresentationFooterEntries(content),
+        sections: content.sections.map((section) => ({ key: section.key, label: section.label })),
         subtitle: SITE_BRAND.footerSubtitleOverride ?? (content.description?.trim() || "Inside Papyrus"),
         title: SITE_BRAND.footerTitle,
       }}
       item={item}
+      videoScript={content.videoScripts?.[item.slug] ?? null}
       backHref={`${editionBasePath}#${item.slug}`}
     />
   );

package/app/[year]/[month]/[day]/edition-route-page.tsx

@@ -1,4 +1,5 @@
 import { notFound, redirect } from "next/navigation";
+import { siteServesNextReaderRoutes } from "../../../../lib/reader-static-params";
 import { getSiteRenderer } from "../../../../lib/site-renderer";
 import type { PresentationTarget } from "../../../../renderers/pretext";
 import { loadCachedEditionContent } from "../../../../lib/cached-content-repository";
@@ -22,6 +23,7 @@ export async function EditionRoutePage({
   lockedPresentation,
   target = { kind: "edition" },
 }: EditionRoutePageProps) {
+  if (!siteServesNextReaderRoutes()) notFound();
   const route = parseEditionDateRoute({ year, month, day });
   if (!route) notFound();
   if (!route.isCanonical) redirect(route.canonicalPath);

package/app/api/media/[...path]/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { buildMediaRouteResponse } from "../../../../lib/media-route-response";
 import { isGuestReadableStoragePath, signStorageUrl } from "../../../../lib/reader-storage-url";
 
 export const dynamic = "force-dynamic";
@@ -16,20 +17,8 @@ export async function GET(_request: Request, context: MediaRouteContext) {
     return NextResponse.json({ error: "Forbidden storage path." }, { status: 403 });
   }
 
-  const signedUrl = await signStorageUrl(storagePath);
-  const upstream = await fetch(signedUrl, { cache: "no-store" });
-  if (!upstream.ok) {
-    return NextResponse.json(
-      { error: `Upstream media fetch failed (${upstream.status}).` },
-      { status: upstream.status === 404 ? 404 : 502 },
-    );
-  }
-
-  const headers = new Headers();
-  const contentType = upstream.headers.get("content-type");
-  if (contentType) {
-    headers.set("content-type", contentType);
-  }
-  headers.set("cache-control", "public, max-age=3600, stale-while-revalidate=86400");
-  return new NextResponse(upstream.body, { status: 200, headers });
+  return buildMediaRouteResponse(storagePath, {
+    signStorageUrl,
+    fetchUpstream: (signedUrl) => fetch(signedUrl, { cache: "no-store" }),
+  });
 }

package/app/api/revalidate/route.ts

@@ -1,3 +1,4 @@
+import { toPublicReaderPath } from "../../../lib/reader-base-path";
 import { revalidatePath, revalidateTag } from "next/cache";
 import { NextResponse } from "next/server";
 import {
@@ -8,6 +9,7 @@ import {
   editionContentCacheTag,
   editionItemCacheTag,
 } from "../../../lib/cached-content-repository";
+import { isAuthorizedRevalidateRequest } from "../../../lib/revalidate-secret";
 import { getEditionArticlePath, getEditionDatePath } from "../../../lib/edition-routes";
 
 export const dynamic = "force-dynamic";
@@ -21,9 +23,8 @@ type RevalidateRequestBody = {
 };
 
 export async function POST(request: Request) {
-  const configuredSecret = process.env.PAPYRUS_REVALIDATE_SECRET?.trim();
-  const providedSecret = request.headers.get("x-papyrus-revalidate-secret")?.trim();
-  if (!configuredSecret || providedSecret !== configuredSecret) {
+  const providedSecret = request.headers.get("x-papyrus-revalidate-secret");
+  if (!(await isAuthorizedRevalidateRequest(providedSecret))) {
     return NextResponse.json({ ok: false, error: "Unauthorized." }, { status: 401 });
   }
 
@@ -44,8 +45,8 @@ export async function POST(request: Request) {
     if (!normalized) continue;
     revalidateTag(articleCacheTag(normalized));
     revalidatedTags.add(articleCacheTag(normalized));
-    revalidatePath(`/articles/${encodeURIComponent(normalized)}`);
-    revalidatedPaths.add(`/articles/${encodeURIComponent(normalized)}`);
+    revalidatePath(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
+    revalidatedPaths.add(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
     if (editionDate) {
       revalidateTag(editionItemCacheTag(editionDate, normalized));
       revalidatedTags.add(editionItemCacheTag(editionDate, normalized));
@@ -76,8 +77,8 @@ export async function POST(request: Request) {
   revalidatedTags.add(ARCHIVE_CACHE_TAG);
   revalidateTag(ARTICLES_CACHE_TAG);
   revalidatedTags.add(ARTICLES_CACHE_TAG);
-  revalidatePath("/archive");
-  revalidatedPaths.add("/archive");
+  revalidatePath(toPublicReaderPath("/archive"));
+  revalidatedPaths.add(toPublicReaderPath("/archive"));
 
   for (const path of body.paths ?? []) {
     const normalized = path.trim();