@anthusai/papyrus 1.0.0-next.9 → 1.1.0

package/amplify/site-backend.ts

@@ -1,26 +1,38 @@
 import { defineBackend, secret } from "@aws-amplify/backend";
-import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
-import * as backup from "aws-cdk-lib/aws-backup";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { Stack } from "aws-cdk-lib";
+import type * as backup from "aws-cdk-lib/aws-backup";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
-import * as events from "aws-cdk-lib/aws-events";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as ses from "aws-cdk-lib/aws-ses";
-import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { CfnEventSourceMapping, CfnFunction, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
+import type { Construct } from "constructs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves";
+import { resolveSitePublication } from "./publication/default-publication";
+import { REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS, addReprojectOnDeploy, reprojectDeployToken } from "./publication/reproject-on-deploy";
+import { addProjectionRetries, addS3ProjectionPublication, type S3ProjectionPublication } from "./publication/s3-projection";
+import { planRenditions } from "./publication/renditions-settings";
+import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource";
-import { data } from "./data/resource";
+import { assertValidPublicationConfig } from "./site-backend-config";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
+import {
+  revalidateDistributionEnvironment,
+  revalidateInvalidationStatement,
+  validateRevalidateDistributionIds,
+} from "./revalidate-invalidation-settings";
+import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
+import { defineSiteData } from "./data/resource";
+import { resolvePlugins } from "./plugins/registry";
+import { wirePlugins } from "./plugins/wire";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource";
-import { contentActions } from "./functions/content-actions/resource";
+import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource";
 import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
@@ -31,7 +43,19 @@ import { emailSubmissionProcessor } from "./functions/email-submission-processor
 import { sesInboundReceive } from "./functions/ses-inbound-receive/resource";
 import { slackDelivery } from "./functions/slack-delivery/resource";
 import { slackEvents } from "./functions/slack-events/resource";
+import { addInboundEmailSesIntake } from "./inbound-email/ses-intake";
 import { InboundEmailStack } from "./inbound-email/stack";
+import {
+  deriveKnowledgeVectorIndexName,
+  deriveReceiptRuleName,
+  deriveReceiptRuleSetName,
+  deriveStorageBackupVaultName,
+  isLegacyProductionPipeline,
+  planInboundEmailSes,
+  resolveSiteBackendFeatureFlags,
+  type SiteBackendIdentity,
+} from "./site-backend-names";
+import { addStorageBackups } from "./storage-backups/construct";
 import { storage } from "./storage/resource";
 import type { PapyrusSite } from "../lib/define-site";
 
@@ -44,57 +68,48 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   const amplifyBranch = (process.env.AWS_BRANCH ?? "").trim();
   const amplifyAppId = (process.env.AWS_APP_ID ?? "").trim();
-  // Amplify app id whose `main` branch is this site's production pipeline (owns
-  // account-global resources: SES rule set, backup vault, legacy S3 Vectors name).
+  // Amplify app id whose `main` branch is the original p.apyr.us backend; only
+  // that app keeps the historical account-global names (see site-backend-names.ts).
   const productionAppId = (site.productionAppId ?? "").trim();
-  const isAmplifyProductionPipeline =
-    amplifyBranch === "main" && productionAppId !== "" && amplifyAppId === productionAppId;
-
-  function readEnvFlag(name: string, defaultValue: boolean): boolean {
-    const raw = (process.env[name] ?? "").trim().toLowerCase();
-    if (["1", "true", "yes", "on"].includes(raw)) return true;
-    if (["0", "false", "no", "off"].includes(raw)) return false;
-    return defaultValue;
-  }
-
-  function sanitizeAwsName(value: string, maxLength = 50): string {
-    return value
-      .toLowerCase()
-      .replace(/[^a-z0-9-]/g, "-")
-      .replace(/-+/g, "-")
-      .replace(/^-|-$/g, "")
-      .slice(0, maxLength);
-  }
-
-  // S3 Vectors index names are account-global. Keep the original name for the
-  // p.apyr.us production app so its existing index + data are not orphaned;
-  // namespace every other app's index by site brand so a second CMS app can
-  // deploy into the same account without colliding.
-  const papyrusSiteBrand = (
-    site.brandId
-    ?? process.env.PAPYRUS_SITE_BRAND
-    ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
-    ?? "papyrus"
-  ).trim().toLowerCase();
-  const knowledgeVectorIndexName =
-    productionAppId !== "" && amplifyAppId === productionAppId
-      ? "papyrus-knowledge"
-      : `papyrus-knowledge-${sanitizeAwsName(papyrusSiteBrand, 40)}`;
-
-  // SES active receipt rule sets and shared backup vault names are account-global.
-  // Keep them on the production pipeline only unless explicitly opted in.
-  // A feature flag in the site config wins over the environment.
-  const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
-  const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
-  const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
-
+  const siteBackendIdentity: SiteBackendIdentity = {
+    brandId: (
+      site.brandId
+      ?? process.env.PAPYRUS_SITE_BRAND
+      ?? process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND
+      ?? "papyrus"
+    ).trim().toLowerCase(),
+    amplifyAppId,
+    amplifyBranch,
+    productionAppId,
+  };
+  const isAmplifyProductionPipeline = isLegacyProductionPipeline(siteBackendIdentity);
+  const knowledgeVectorIndexName = deriveKnowledgeVectorIndexName(siteBackendIdentity);
+  const featureFlags = resolveSiteBackendFeatureFlags(site.features, process.env, siteBackendIdentity);
+  const enableInboundEmail = featureFlags.inboundEmail;
+  const enableSlackAgent = featureFlags.slack;
+  const enableStorageBackups = featureFlags.storageBackups;
+
+  const baseAuthConfig = site.auth ?? authConfigFromEnv();
+  const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+  const authConfig = {
+    ...baseAuthConfig,
+    newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+  };
+  const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
+  if (publication !== undefined) assertValidPublicationConfig(publication);
+  const publicationPlan = planS3ProjectionBackend(publication);
+  const renditionsPlan = planRenditions(publication, process.cwd());
+  setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
+  const plugins = resolvePlugins(site.plugins);
+  const pluginDefinitions = Object.assign({}, ...plugins.map(({ plugin }) => plugin.schemaDefinitions()));
+  const pluginFunctions: Record<never, never> = Object.assign({}, ...plugins.map(({ plugin }) => plugin.functions()));
   const backend = defineBackend({
+    ...pluginFunctions,
     assignmentAction,
-    auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+    auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
-    data,
-    graphqlJwtAuthorizer,
+    data: defineSiteData(pluginDefinitions),
     knowledgeQuery,
     manageUserRole,
     modelAttachmentUpload,
@@ -108,10 +123,29 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  orderModelStacksInWaves(
+    backend.data.resources.graphqlApi.node.scope as Construct,
+    Object.keys(backend.data.resources.tables),
+    site.resolverWaveSize ?? DEFAULT_RESOLVER_WAVE_SIZE,
+  );
+
+  const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+  if (
+    authConfig.applyCognitoDomainPrefix === true
+    && requestedCognitoDomainPrefix !== ""
+    && authConfig.disableGoogleOAuth !== true
+  ) {
+    applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+  }
+
+  const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+    ? undefined
+    : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
-  const enableConsoleResponder = site.features?.consoleResponder ?? readEnvFlag("PAPYRUS_ENABLE_CONSOLE_RESPONDER", true);
+  const enableConsoleResponder = featureFlags.consoleResponder;
 
   if (
     enableConsoleResponder
@@ -160,43 +194,19 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     const messageThreadTable = backend.data.resources.tables.MessageThread;
     const dataStack = Stack.of(messageTable);
     const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-    const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild as CfnFunction | undefined;
-    const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-    const jwtAuthorizerVariables =
-      jwtAuthorizerEnvironment
-      && typeof jwtAuthorizerEnvironment === "object"
-      && "variables" in jwtAuthorizerEnvironment
-        ? (jwtAuthorizerEnvironment as { variables?: Record<string, string> }).variables
-        : undefined;
-    const jwtSsmEnvConfig =
-      process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || "";
+    const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
 
     if (enableConsoleResponder) {
-      const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+      new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
         messageTable,
         messageStreamArn,
         threadTable: messageThreadTable,
         projectRoot,
         graphqlEndpoint,
-        amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
         responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
         model: process.env.PAPYRUS_CONSOLE_MODEL,
         prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
       });
-      if (jwtSsmEnvConfig) {
-        consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-      }
-      const jwtSecretSsmParam =
-        process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-        || (productionAppId !== "" && amplifyAppId === productionAppId
-          ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-          : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-      consoleChatResponder.responderFunction.addEnvironment(
-        "PAPYRUS_JWT_SECRET_SSM_PARAM",
-        jwtSecretSsmParam,
-      );
     }
 
     if (enableSlackAgent) {
@@ -217,9 +227,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         "PAPYRUS_SLACK_ALLOWED_USER_IDS",
         (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim(),
       );
-      if (jwtSsmEnvConfig) {
-        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+      if (amplifySsmEnvConfig) {
+        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
       }
       backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
       backend.slackDelivery.addEnvironment(
@@ -297,8 +307,8 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   let storageBackupVault: backup.BackupVault | undefined;
 
   const storageBucketCfn = storageBucket.node.defaultChild as s3.CfnBucket | undefined;
-  if ((enableStorageBackups || enableInboundEmail) && storageBucketCfn) {
-    // Backups and inbound-email intake both rely on S3 → EventBridge notifications.
+  if ((enableStorageBackups || enableInboundEmail || renditionsPlan.enabled) && storageBucketCfn) {
+    // Backups, inbound-email intake and upload-time renditions all rely on S3 → EventBridge notifications.
     storageBucketCfn.addPropertyOverride(
       "NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled",
       true,
@@ -307,41 +317,17 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   if (enableStorageBackups) {
     const storageBackupsStack = backend.createStack("storage-backups");
-    const storageBackupVaultName = sanitizeAwsName(
-      process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME?.trim()
-      || (isAmplifyProductionPipeline
-        ? `papyrus-${productionAppId}-main-media-backup-vault`
-        : `papyrus-${sanitizeAwsName(storageBackupsStack.stackName, 32)}-media-vault`),
+    const storageBackupVaultName = deriveStorageBackupVaultName(
+      siteBackendIdentity,
+      process.env.PAPYRUS_STORAGE_BACKUP_VAULT_NAME,
     );
 
-    storageBackupVault = new backup.BackupVault(storageBackupsStack, "PapyrusStorageBackupVault", {
+    const storageBackups = addStorageBackups(storageBackupsStack, {
+      storageBucket,
       backupVaultName: storageBackupVaultName,
-      removalPolicy: RemovalPolicy.RETAIN,
-    });
-    storageBackupPlan = new backup.BackupPlan(storageBackupsStack, "PapyrusStorageBackupPlan", {
-      backupVault: storageBackupVault,
-    });
-
-    storageBackupPlan.addRule(
-      new backup.BackupPlanRule({
-        ruleName: "papyrus-storage-pitr-35d",
-        enableContinuousBackup: true,
-        deleteAfter: Duration.days(35),
-      }),
-    );
-
-    storageBackupPlan.addRule(
-      new backup.BackupPlanRule({
-        ruleName: "papyrus-storage-daily-365d",
-        scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
-        deleteAfter: Duration.days(365),
-      }),
-    );
-
-    storageBackupPlan.addSelection("PapyrusStorageBackupSelection", {
-      allowRestores: true,
-      resources: [backup.BackupResource.fromArn(storageBucket.bucketArn)],
     });
+    storageBackupVault = storageBackups.vault;
+    storageBackupPlan = storageBackups.plan;
   }
 
   // Grant S3 access on Lambda roles only (not storage bucket policies) to avoid
@@ -430,9 +416,66 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
       new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }),
     );
   }
+  let s3ProjectionPublication: S3ProjectionPublication | undefined;
+  if (publication !== undefined) {
+    s3ProjectionPublication = addS3ProjectionPublication(backend.createStack("s3-projection"), publication, {
+      mediaBucket: storageBucket,
+      renditions: renditionsPlan,
+    });
+    (contentActionsLambda.node.defaultChild as CfnFunction).memorySize = publicationPlan.contentActionsMemorySize;
+    if (publication.reprojectOnDeploy === true) {
+      (contentActionsLambda.node.defaultChild as CfnFunction).timeout = REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS;
+      addReprojectOnDeploy(backend.createStack("reproject-on-deploy"), contentActionsLambda, reprojectDeployToken(process.env));
+    }
+  }
+  if (s3ProjectionPublication !== undefined) {
+    addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+  }
+  const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
+  for (const [name, value] of Object.entries(publicationWiring.environment)) {
+    contentActionsLambda.addEnvironment(name, value);
+  }
+  for (const statement of publicationWiring.policyStatements) {
+    contentActionsLambda.addToRolePolicy(statement);
+  }
   if ((site.revalidateBaseUrl ?? "").trim() !== "") {
     backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
-    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET", secret("PAPYRUS_REVALIDATE_SECRET"));
+    const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+    if (!revalidateSecretParameter.startsWith("/")) {
+      throw new Error(
+        "revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.",
+      );
+    }
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+    const revalidateStack = Stack.of(contentActionsLambda);
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement(
+        revalidateSecretReadStatement({
+          partition: revalidateStack.partition,
+          region: revalidateStack.region,
+          account: revalidateStack.account,
+          parameterName: revalidateSecretParameter,
+        }),
+      ),
+    );
+    const distributionProblems = validateRevalidateDistributionIds(site.revalidateDistributionIds, site.revalidateBaseUrl);
+    if (distributionProblems.length > 0) throw new Error(`Invalid backend config: ${distributionProblems.join("; ")}`);
+    const distributionIds = site.revalidateDistributionIds ?? [];
+    if (distributionIds.length > 0) {
+      for (const [name, value] of Object.entries(revalidateDistributionEnvironment(distributionIds))) {
+        backend.contentActions.addEnvironment(name, value);
+      }
+      contentActionsLambda.addToRolePolicy(
+        new PolicyStatement(
+          revalidateInvalidationStatement({ partition: revalidateStack.partition, account: revalidateStack.account, distributionIds }),
+        ),
+      );
+      for (const id of distributionIds) {
+        addInvalidationPathAlarm(revalidateStack, `ReaderEdgeInvalidationPaths${id}`, id);
+      }
+    }
+  } else if (site.revalidateDistributionIds !== undefined) {
+    throw new Error("Invalid backend config: revalidateDistributionIds requires revalidateBaseUrl");
   }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
@@ -527,86 +570,26 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
     const inboundEventStack = Stack.of(receiveLambda);
 
-    // SES receipt rule sets are account-global; only provision on the production pipeline.
-    if (isAmplifyProductionPipeline) {
-    const inboundDnsZone = route53.HostedZone.fromHostedZoneAttributes(storageStack, "PapyrusInboundDnsZone", {
-      hostedZoneId: inboundDnsZoneId,
-      zoneName: inboundDnsZoneName,
-    });
-    const verifyInboundEmailDomain = new AwsCustomResource(storageStack, "VerifyInboundEmailDomain", {
-      onCreate: {
-        service: "SES",
-        action: "verifyDomainIdentity",
-        parameters: {
-          Domain: inboundEmailDomain,
-        },
-        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-      },
-      onUpdate: {
-        service: "SES",
-        action: "verifyDomainIdentity",
-        parameters: {
-          Domain: inboundEmailDomain,
-        },
-        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${inboundEmailDomain}`),
-      },
-      policy: AwsCustomResourcePolicy.fromSdkCalls({
-        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-      }),
-      timeout: Duration.minutes(2),
-    });
-    new route53.TxtRecord(storageStack, "PapyrusInboundEmailDomainVerification", {
-      zone: inboundDnsZone,
-      recordName: `_amazonses.${inboundDnsRecordName}`,
-      ttl: Duration.minutes(5),
-      values: [verifyInboundEmailDomain.getResponseField("VerificationToken")],
-    });
-
-    const inboundRuleSet = new ses.ReceiptRuleSet(storageStack, "PapyrusInboundEmailRuleSet", {
-      receiptRuleSetName: `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`,
-    });
-    inboundRuleSet.addRule("PapyrusInboundSubmissions", {
-      recipients: inboundRecipients,
-      enabled: true,
-      scanEnabled: true,
-      tlsPolicy: ses.TlsPolicy.REQUIRE,
-      actions: [
-        new sesActions.S3({
-          bucket: storageBucket,
-          objectKeyPrefix: "inbound-email/",
-        }),
-      ],
-    });
-
-    new AwsCustomResource(storageStack, "ActivateInboundEmailRuleSet", {
-      onCreate: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: inboundRuleSet.receiptRuleSetName,
-        },
-        physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-      },
-      onUpdate: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: inboundRuleSet.receiptRuleSetName,
-        },
-        physicalResourceId: PhysicalResourceId.of(`activate-${inboundRuleSet.receiptRuleSetName}`),
-      },
-      onDelete: {
-        service: "SES",
-        action: "setActiveReceiptRuleSet",
-        parameters: {
-          RuleSetName: null,
-        },
-      },
-      policy: AwsCustomResourcePolicy.fromSdkCalls({
-        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
-      }),
-      timeout: Duration.minutes(2),
-    });
+    // SES allows one active receipt rule set per region, so a non-legacy site
+    // creates its own brand-named rule set and never activates it here.
+    const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
+    if (inboundSesPlan.createReceiptRules) {
+      addInboundEmailSesIntake(storageStack, {
+        storageBucket,
+        recipients: inboundRecipients,
+        ruleSetName: deriveReceiptRuleSetName(siteBackendIdentity, inboundEmailDomain),
+        existingRuleSetName: site.inboundEmailSes?.existingReceiptRuleSetName,
+        ruleName: deriveReceiptRuleName(siteBackendIdentity),
+        activateRuleSet: inboundSesPlan.activateReceiptRuleSet,
+        domainIdentity: inboundSesPlan.manageDomainIdentity
+          ? {
+              domain: inboundEmailDomain,
+              hostedZoneId: inboundDnsZoneId,
+              hostedZoneName: inboundDnsZoneName,
+              recordName: inboundDnsRecordName,
+            }
+          : undefined,
+      });
     }
 
     new InboundEmailStack(inboundEventStack, "InboundEmail", {
@@ -704,6 +687,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   backend.addOutput({
     custom: {
+      prospectusSignIn: prospectusGoogleOnlyClient
+        ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+        : null,
       inboundEmail: enableInboundEmail
         ? {
             domain: inboundEmailDomain,
@@ -735,5 +721,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         : null,
     },
   });
+  wirePlugins(backend, plugins, contentActionsLambda);
+
   return backend;
 }

package/amplify/storage-backups/construct.js

@@ -0,0 +1,31 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as backup from "aws-cdk-lib/aws-backup";
+import * as events from "aws-cdk-lib/aws-events";
+/**
+ * Adds the resources directly to `scope` (no wrapper construct) so the logical
+ * ids of the live p.apyr.us backup stack stay unchanged.
+ */
+export function addStorageBackups(scope, props) {
+    const vault = new backup.BackupVault(scope, "PapyrusStorageBackupVault", {
+        backupVaultName: props.backupVaultName,
+        removalPolicy: RemovalPolicy.RETAIN,
+    });
+    const plan = new backup.BackupPlan(scope, "PapyrusStorageBackupPlan", {
+        backupVault: vault,
+    });
+    plan.addRule(new backup.BackupPlanRule({
+        ruleName: "papyrus-storage-pitr-35d",
+        enableContinuousBackup: true,
+        deleteAfter: Duration.days(35),
+    }));
+    plan.addRule(new backup.BackupPlanRule({
+        ruleName: "papyrus-storage-daily-365d",
+        scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
+        deleteAfter: Duration.days(365),
+    }));
+    plan.addSelection("PapyrusStorageBackupSelection", {
+        allowRestores: true,
+        resources: [backup.BackupResource.fromArn(props.storageBucket.bucketArn)],
+    });
+    return { plan, vault };
+}

package/amplify/storage-backups/construct.ts

@@ -0,0 +1,47 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as backup from "aws-cdk-lib/aws-backup";
+import * as events from "aws-cdk-lib/aws-events";
+import type * as s3 from "aws-cdk-lib/aws-s3";
+import type { Construct } from "constructs";
+
+export type StorageBackupsProps = {
+  storageBucket: s3.IBucket;
+  backupVaultName: string;
+};
+
+/**
+ * Adds the resources directly to `scope` (no wrapper construct) so the logical
+ * ids of the live p.apyr.us backup stack stay unchanged.
+ */
+export function addStorageBackups(scope: Construct, props: StorageBackupsProps) {
+  const vault = new backup.BackupVault(scope, "PapyrusStorageBackupVault", {
+    backupVaultName: props.backupVaultName,
+    removalPolicy: RemovalPolicy.RETAIN,
+  });
+  const plan = new backup.BackupPlan(scope, "PapyrusStorageBackupPlan", {
+    backupVault: vault,
+  });
+
+  plan.addRule(
+    new backup.BackupPlanRule({
+      ruleName: "papyrus-storage-pitr-35d",
+      enableContinuousBackup: true,
+      deleteAfter: Duration.days(35),
+    }),
+  );
+
+  plan.addRule(
+    new backup.BackupPlanRule({
+      ruleName: "papyrus-storage-daily-365d",
+      scheduleExpression: events.Schedule.cron({ minute: "0", hour: "5" }),
+      deleteAfter: Duration.days(365),
+    }),
+  );
+
+  plan.addSelection("PapyrusStorageBackupSelection", {
+    allowRestores: true,
+    resources: [backup.BackupResource.fromArn(props.storageBucket.bucketArn)],
+  });
+
+  return { plan, vault };
+}

package/app/[year]/[month]/[day]/[articleSlug]/page.tsx

@@ -4,8 +4,13 @@ import { getCachedEditionItem, loadCachedEditionContent } from "../../../../../l
 import { getEditionDatePath, parseEditionArticleRoute } from "../../../../../lib/edition-routes";
 import { buildPresentationFooterEntries } from "../../../../../lib/presentation-footer";
 import { SITE_BRAND } from "../../../../../lib/site-brand";
+import { generateEditionItemStaticParams } from "../../../../../lib/reader-static-params";
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
-export const revalidate = 3600;
+export const revalidate = 60;
+
+export async function generateStaticParams() {
+  return generateEditionItemStaticParams();
+}
 
 type DateScopedArticlePageProps = {
   params: Promise<{
@@ -52,10 +57,12 @@ export default async function DateScopedArticlePage({ params }: DateScopedArticl
       editionFooter={{
         editionBasePath,
         entries: buildPresentationFooterEntries(content),
+        sections: content.sections.map((section) => ({ key: section.key, label: section.label })),
         subtitle: SITE_BRAND.footerSubtitleOverride ?? (content.description?.trim() || "Inside Papyrus"),
         title: SITE_BRAND.footerTitle,
       }}
       item={item}
+      videoScript={content.videoScripts?.[item.slug] ?? null}
       backHref={`${editionBasePath}#${item.slug}`}
     />
   );

package/app/[year]/[month]/[day]/edition-route-page.tsx

@@ -1,4 +1,5 @@
 import { notFound, redirect } from "next/navigation";
+import { siteServesNextReaderRoutes } from "../../../../lib/reader-static-params";
 import { getSiteRenderer } from "../../../../lib/site-renderer";
 import type { PresentationTarget } from "../../../../renderers/pretext";
 import { loadCachedEditionContent } from "../../../../lib/cached-content-repository";
@@ -22,6 +23,7 @@ export async function EditionRoutePage({
   lockedPresentation,
   target = { kind: "edition" },
 }: EditionRoutePageProps) {
+  if (!siteServesNextReaderRoutes()) notFound();
   const route = parseEditionDateRoute({ year, month, day });
   if (!route) notFound();
   if (!route.isCanonical) redirect(route.canonicalPath);

package/app/[year]/[month]/[day]/page/[pageNumber]/page.tsx

@@ -2,8 +2,13 @@ import { notFound, redirect } from "next/navigation";
 import { EditionRoutePage } from "../../edition-route-page";
 import { parseEditionPageRoute } from "../../../../../../lib/edition-routes";
 import { getDefaultPretextLayout, getForcedPresentation } from "../../../../../../lib/site-brand";
+import { generateEditionPageStaticParams } from "../../../../../../lib/reader-static-params";
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
-export const revalidate = 3600;
+export const revalidate = 60;
+
+export async function generateStaticParams() {
+  return generateEditionPageStaticParams();
+}
 
 type EditionPageRouteProps = {
   params: Promise<{

package/app/[year]/[month]/[day]/page.tsx

@@ -2,7 +2,7 @@ import { EditionRoutePage } from "./edition-route-page";
 import { generateEditionDateStaticParams } from "../../../../lib/reader-static-params";
 
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
-export const revalidate = 3600;
+export const revalidate = 60;
 
 export async function generateStaticParams() {
   return generateEditionDateStaticParams();