@anthusai/papyrus 1.0.0-next.9 → 1.1.0

package/amplify/site-backend.js

@@ -1,25 +1,31 @@
 import { defineBackend, secret } from "@aws-amplify/backend";
-import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
-import * as backup from "aws-cdk-lib/aws-backup";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { Stack } from "aws-cdk-lib";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
-import * as events from "aws-cdk-lib/aws-events";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as ses from "aws-cdk-lib/aws-ses";
-import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { CfnEventSourceMapping, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves.js";
+import { resolveSitePublication } from "./publication/default-publication.js";
+import { REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS, addReprojectOnDeploy, reprojectDeployToken } from "./publication/reproject-on-deploy.js";
+import { addProjectionRetries, addS3ProjectionPublication } from "./publication/s3-projection.js";
+import { planRenditions } from "./publication/renditions-settings.js";
+import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
-import { data } from "./data/resource.js";
+import { assertValidPublicationConfig } from "./site-backend-config.js";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
+import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
+import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
+import { defineSiteData } from "./data/resource.js";
+import { resolvePlugins } from "./plugins/registry.js";
+import { wirePlugins } from "./plugins/wire.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource.js";
-import { contentActions } from "./functions/content-actions/resource.js";
+import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource.js";
 import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
@@ -30,7 +36,10 @@ import { emailSubmissionProcessor } from "./functions/email-submission-processor
 import { sesInboundReceive } from "./functions/ses-inbound-receive/resource.js";
 import { slackDelivery } from "./functions/slack-delivery/resource.js";
 import { slackEvents } from "./functions/slack-events/resource.js";
+import { addInboundEmailSesIntake } from "./inbound-email/ses-intake.js";
 import { InboundEmailStack } from "./inbound-email/stack.js";
+import { deriveKnowledgeVectorIndexName, deriveReceiptRuleName, deriveReceiptRuleSetName, deriveStorageBackupVaultName, isLegacyProductionPipeline, planInboundEmailSes, resolveSiteBackendFeatureFlags, } from "./site-backend-names.js";
+import { addStorageBackups } from "./storage-backups/construct.js";
 import { storage } from "./storage/resource.js";
 export function defineSiteBackend(papyrusSite) {
     // `papyrus.config.ts`'s default export. Backend options live under `backend`;
@@ -40,50 +49,46 @@ export function defineSiteBackend(papyrusSite) {
     const knowledgeEmbeddingModel = "text-embedding-3-small";
     const amplifyBranch = (process.env.AWS_BRANCH ?? "").trim();
     const amplifyAppId = (process.env.AWS_APP_ID ?? "").trim();
-    // Amplify app id whose `main` branch is this site's production pipeline (owns
-    // account-global resources: SES rule set, backup vault, legacy S3 Vectors name).
+    // Amplify app id whose `main` branch is the original p.apyr.us backend; only
+    // that app keeps the historical account-global names (see site-backend-names.ts).
     const productionAppId = (site.productionAppId ?? "").trim();
-    const isAmplifyProductionPipeline = amplifyBranch === "main" && productionAppId !== "" && amplifyAppId === productionAppId;
-    function readEnvFlag(name, defaultValue) {
-        const raw = (process.env[name] ?? "").trim().toLowerCase();
-        if (["1", "true", "yes", "on"].includes(raw))
-            return true;
-        if (["0", "false", "no", "off"].includes(raw))
-            return false;
-        return defaultValue;
-    }
-    function sanitizeAwsName(value, maxLength = 50) {
-        return value
-            .toLowerCase()
-            .replace(/[^a-z0-9-]/g, "-")
-            .replace(/-+/g, "-")
-            .replace(/^-|-$/g, "")
-            .slice(0, maxLength);
-    }
-    // S3 Vectors index names are account-global. Keep the original name for the
-    // p.apyr.us production app so its existing index + data are not orphaned;
-    // namespace every other app's index by site brand so a second CMS app can
-    // deploy into the same account without colliding.
-    const papyrusSiteBrand = (site.brandId
-        ?? process.env.PAPYRUS_SITE_BRAND
-        ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
-        ?? "papyrus").trim().toLowerCase();
-    const knowledgeVectorIndexName = productionAppId !== "" && amplifyAppId === productionAppId
-        ? "papyrus-knowledge"
-        : `papyrus-knowledge-${sanitizeAwsName(papyrusSiteBrand, 40)}`;
-    // SES active receipt rule sets and shared backup vault names are account-global.
-    // Keep them on the production pipeline only unless explicitly opted in.
-    // A feature flag in the site config wins over the environment.
-    const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
-    const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
-    const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+    const siteBackendIdentity = {
+        brandId: (site.brandId
+            ?? process.env.PAPYRUS_SITE_BRAND
+            ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
+            ?? "papyrus").trim().toLowerCase(),
+        amplifyAppId,
+        amplifyBranch,
+        productionAppId,
+    };
+    const isAmplifyProductionPipeline = isLegacyProductionPipeline(siteBackendIdentity);
+    const knowledgeVectorIndexName = deriveKnowledgeVectorIndexName(siteBackendIdentity);
+    const featureFlags = resolveSiteBackendFeatureFlags(site.features, process.env, siteBackendIdentity);
+    const enableInboundEmail = featureFlags.inboundEmail;
+    const enableSlackAgent = featureFlags.slack;
+    const enableStorageBackups = featureFlags.storageBackups;
+    const baseAuthConfig = site.auth ?? authConfigFromEnv();
+    const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+    const authConfig = {
+        ...baseAuthConfig,
+        newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+    };
+    const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
+    if (publication !== undefined)
+        assertValidPublicationConfig(publication);
+    const publicationPlan = planS3ProjectionBackend(publication);
+    const renditionsPlan = planRenditions(publication, process.cwd());
+    setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
+    const plugins = resolvePlugins(site.plugins);
+    const pluginDefinitions = Object.assign({}, ...plugins.map(({ plugin }) => plugin.schemaDefinitions()));
+    const pluginFunctions = Object.assign({}, ...plugins.map(({ plugin }) => plugin.functions()));
     const backend = defineBackend({
+        ...pluginFunctions,
         assignmentAction,
-        auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+        auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
-        data,
-        graphqlJwtAuthorizer,
+        data: defineSiteData(pluginDefinitions),
         knowledgeQuery,
         manageUserRole,
         modelAttachmentUpload,
@@ -96,10 +101,20 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    orderModelStacksInWaves(backend.data.resources.graphqlApi.node.scope, Object.keys(backend.data.resources.tables), site.resolverWaveSize ?? DEFAULT_RESOLVER_WAVE_SIZE);
+    const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+    if (authConfig.applyCognitoDomainPrefix === true
+        && requestedCognitoDomainPrefix !== ""
+        && authConfig.disableGoogleOAuth !== true) {
+        applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+    }
+    const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+        ? undefined
+        : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
-    const enableConsoleResponder = site.features?.consoleResponder ?? readEnvFlag("PAPYRUS_ENABLE_CONSOLE_RESPONDER", true);
+    const enableConsoleResponder = featureFlags.consoleResponder;
     if (enableConsoleResponder
         && !process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI?.trim()
         && !process.env.PAPYRUS_CONSOLE_RESPONDER_ALLOW_LOCAL_BUILD?.trim()
@@ -139,36 +154,18 @@ export function defineSiteBackend(papyrusSite) {
         const messageThreadTable = backend.data.resources.tables.MessageThread;
         const dataStack = Stack.of(messageTable);
         const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-        const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild;
-        const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-        const jwtAuthorizerVariables = jwtAuthorizerEnvironment
-            && typeof jwtAuthorizerEnvironment === "object"
-            && "variables" in jwtAuthorizerEnvironment
-            ? jwtAuthorizerEnvironment.variables
-            : undefined;
-        const jwtSsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-            || "";
+        const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
         if (enableConsoleResponder) {
-            const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+            new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
                 messageTable,
                 messageStreamArn,
                 threadTable: messageThreadTable,
                 projectRoot,
                 graphqlEndpoint,
-                amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
                 responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
                 model: process.env.PAPYRUS_CONSOLE_MODEL,
                 prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
             });
-            if (jwtSsmEnvConfig) {
-                consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-            }
-            const jwtSecretSsmParam = process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-                || (productionAppId !== "" && amplifyAppId === productionAppId
-                    ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-                    : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-            consoleChatResponder.responderFunction.addEnvironment("PAPYRUS_JWT_SECRET_SSM_PARAM", jwtSecretSsmParam);
         }
         if (enableSlackAgent) {
             const slackEventsLambda = backend.slackEvents.resources.lambda;
@@ -180,9 +177,9 @@ export function defineSiteBackend(papyrusSite) {
             backend.slackEvents.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackEvents.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
             backend.slackEvents.addEnvironment("PAPYRUS_SLACK_ALLOWED_USER_IDS", (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim());
-            if (jwtSsmEnvConfig) {
-                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+            if (amplifySsmEnvConfig) {
+                backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+                backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
             }
             backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
             backend.slackDelivery.addEnvironment("PAPYRUS_CONSOLE_RESPONSE_TARGET", (process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET ?? "cloud").trim() || "cloud");
@@ -244,37 +241,19 @@ export function defineSiteBackend(papyrusSite) {
     let storageBackupPlan;
     let storageBackupVault;
     const storageBucketCfn = storageBucket.node.defaultChild;
-    if ((enableStorageBackups || enableInboundEmail) && storageBucketCfn) {
-        // Backups and inbound-email intake both rely on S3 → EventBridge notifications.
+    if ((enableStorageBackups || enableInboundEmail || renditionsPlan.enabled) && storageBucketCfn) {
+        // Backups, inbound-email intake and upload-time renditions all rely on S3 → EventBridge notifications.
         storageBucketCfn.addPropertyOverride("NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled", true);
     }
     if (enableStorageBackups) {
         const storageBackupsStack = backend.createStack("storage-backups");
-        const storageBackupVaultName = sanitizeAwsName(process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME?.trim()
-            || (isAmplifyProductionPipeline
-                ? `papyrus-${productionAppId}-main-media-backup-vault`
-                : `papyrus-${sanitizeAwsName(storageBackupsStack.stackName, 32)}-media-vault`));
-        storageBackupVault = new backup.BackupVault(storageBackupsStack, "PapyrusStorageBackupVault", {
+        const storageBackupVaultName = deriveStorageBackupVaultName(siteBackendIdentity, process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME);
+        const storageBackups = addStorageBackups(storageBackupsStack, {
+            storageBucket,
             backupVaultName: storageBackupVaultName,
-            removalPolicy: RemovalPolicy.RETAIN,
-        });
-        storageBackupPlan = new backup.BackupPlan(storageBackupsStack, "PapyrusStorageBackupPlan", {
-            backupVault: storageBackupVault,
-        });
-        storageBackupPlan.addRule(new backup.BackupPlanRule({
-            ruleName: "papyrus-storage-pitr-35d",
-            enableContinuousBackup: true,
-            deleteAfter: Duration.days(35),
-        }));
-        storageBackupPlan.addRule(new backup.BackupPlanRule({
-            ruleName: "papyrus-storage-daily-365d",
-            scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
-            deleteAfter: Duration.days(365),
-        }));
-        storageBackupPlan.addSelection("PapyrusStorageBackupSelection", {
-            allowRestores: true,
-            resources: [backup.BackupResource.fromArn(storageBucket.bucketArn)],
         });
+        storageBackupVault = storageBackups.vault;
+        storageBackupPlan = storageBackups.plan;
     }
     // Grant S3 access on Lambda roles only (not storage bucket policies) to avoid
     // storage ↔ data nested-stack circular dependencies from allow.resource().
@@ -347,9 +326,58 @@ export function defineSiteBackend(papyrusSite) {
     if (rebuildSettings.resources.length > 0) {
         contentActionsLambda.addToRolePolicy(new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }));
     }
+    let s3ProjectionPublication;
+    if (publication !== undefined) {
+        s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), publication, {
+            mediaBucket: storageBucket,
+            renditions: renditionsPlan,
+        });
+        contentActionsLambda.node.defaultChild.memorySize = publicationPlan.contentActionsMemorySize;
+        if (publication.reprojectOnDeploy === true) {
+            contentActionsLambda.node.defaultChild.timeout = REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS;
+            addReprojectOnDeploy(backend.createStack("reproject-on-deploy"), contentActionsLambda, reprojectDeployToken(process.env));
+        }
+    }
+    if (s3ProjectionPublication !== undefined) {
+        addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+    }
+    const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
+    for (const [name, value] of Object.entries(publicationWiring.environment)) {
+        contentActionsLambda.addEnvironment(name, value);
+    }
+    for (const statement of publicationWiring.policyStatements) {
+        contentActionsLambda.addToRolePolicy(statement);
+    }
     if ((site.revalidateBaseUrl ?? "").trim() !== "") {
         backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
-        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET", secret("PAPYRUS_REVALIDATE_SECRET"));
+        const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+        if (!revalidateSecretParameter.startsWith("/")) {
+            throw new Error("revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.");
+        }
+        backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+        const revalidateStack = Stack.of(contentActionsLambda);
+        contentActionsLambda.addToRolePolicy(new PolicyStatement(revalidateSecretReadStatement({
+            partition: revalidateStack.partition,
+            region: revalidateStack.region,
+            account: revalidateStack.account,
+            parameterName: revalidateSecretParameter,
+        })));
+        const distributionProblems = validateRevalidateDistributionIds(site.revalidateDistributionIds, site.revalidateBaseUrl);
+        if (distributionProblems.length > 0)
+            throw new Error(`Invalid backend config: ${distributionProblems.join("; ")}`);
+        const distributionIds = site.revalidateDistributionIds ?? [];
+        if (distributionIds.length > 0) {
+            for (const [name, value] of Object.entries(revalidateDistributionEnvironment(distributionIds))) {
+                backend.contentActions.addEnvironment(name, value);
+            }
+            contentActionsLambda.addToRolePolicy(new PolicyStatement(revalidateInvalidationStatement({ partition: revalidateStack.partition, account: revalidateStack.account, distributionIds })));
+            for (const id of distributionIds) {
+                addInvalidationPathAlarm(revalidateStack, `ReaderEdgeInvalidationPaths${id}`, id);
+            }
+        }
+    }
+    else if (site.revalidateDistributionIds !== undefined) {
+        throw new Error("Invalid backend config: revalidateDistributionIds requires revalidateBaseUrl");
     }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
@@ -416,83 +444,25 @@ export function defineSiteBackend(papyrusSite) {
             resources: ["*"],
         }));
         const inboundEventStack = Stack.of(receiveLambda);
-        // SES receipt rule sets are account-global; only provision on the production pipeline.
-        if (isAmplifyProductionPipeline) {
-            const inboundDnsZone = route53.HostedZone.fromHostedZoneAttributes(storageStack, "PapyrusInboundDnsZone", {
-                hostedZoneId: inboundDnsZoneId,
-                zoneName: inboundDnsZoneName,
-            });
-            const verifyInboundEmailDomain = new AwsCustomResource(storageStack, "VerifyInboundEmailDomain", {
-                onCreate: {
-                    service: "SES",
-                    action: "verifyDomainIdentity",
-                    parameters: {
-                        Domain: inboundEmailDomain,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-                },
-                onUpdate: {
-                    service: "SES",
-                    action: "verifyDomainIdentity",
-                    parameters: {
-                        Domain: inboundEmailDomain,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-                },
-                policy: AwsCustomResourcePolicy.fromSdkCalls({
-                    resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-                }),
-                timeout: Duration.minutes(2),
-            });
-            new route53.TxtRecord(storageStack, "PapyrusInboundEmailDomainVerification", {
-                zone: inboundDnsZone,
-                recordName: `_amazonses.${inboundDnsRecordName}`,
-                ttl: Duration.minutes(5),
-                values: [verifyInboundEmailDomain.getResponseField("VerificationToken")],
-            });
-            const inboundRuleSet = new ses.ReceiptRuleSet(storageStack, "PapyrusInboundEmailRuleSet", {
-                receiptRuleSetName: `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`,
-            });
-            inboundRuleSet.addRule("PapyrusInboundSubmissions", {
+        // SES allows one active receipt rule set per region, so a non-legacy site
+        // creates its own brand-named rule set and never activates it here.
+        const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
+        if (inboundSesPlan.createReceiptRules) {
+            addInboundEmailSesIntake(storageStack, {
+                storageBucket,
                 recipients: inboundRecipients,
-                enabled: true,
-                scanEnabled: true,
-                tlsPolicy: ses.TlsPolicy.REQUIRE,
-                actions: [
-                    new sesActions.S3({
-                        bucket: storageBucket,
-                        objectKeyPrefix: "inbound-email/",
-                    }),
-                ],
-            });
-            new AwsCustomResource(storageStack, "ActivateInboundEmailRuleSet", {
-                onCreate: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: inboundRuleSet.receiptRuleSetName,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-                },
-                onUpdate: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: inboundRuleSet.receiptRuleSetName,
-                    },
-                    physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-                },
-                onDelete: {
-                    service: "SES",
-                    action: "setActiveReceiptRuleSet",
-                    parameters: {
-                        RuleSetName: null,
-                    },
-                },
-                policy: AwsCustomResourcePolicy.fromSdkCalls({
-                    resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-                }),
-                timeout: Duration.minutes(2),
+                ruleSetName: deriveReceiptRuleSetName(siteBackendIdentity, inboundEmailDomain),
+                existingRuleSetName: site.inboundEmailSes?.existingReceiptRuleSetName,
+                ruleName: deriveReceiptRuleName(siteBackendIdentity),
+                activateRuleSet: inboundSesPlan.activateReceiptRuleSet,
+                domainIdentity: inboundSesPlan.manageDomainIdentity
+                    ? {
+                        domain: inboundEmailDomain,
+                        hostedZoneId: inboundDnsZoneId,
+                        hostedZoneName: inboundDnsZoneName,
+                        recordName: inboundDnsRecordName,
+                    }
+                    : undefined,
             });
         }
         new InboundEmailStack(inboundEventStack, "InboundEmail", {
@@ -580,6 +550,9 @@ export function defineSiteBackend(papyrusSite) {
     }));
     backend.addOutput({
         custom: {
+            prospectusSignIn: prospectusGoogleOnlyClient
+                ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+                : null,
             inboundEmail: enableInboundEmail
                 ? {
                     domain: inboundEmailDomain,
@@ -611,5 +584,6 @@ export function defineSiteBackend(papyrusSite) {
                 : null,
         },
     });
+    wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }