@anthusai/papyrus 1.0.0-next.31 → 1.0.0-next.33

package/amplify/data/resource.js

@@ -287,6 +287,8 @@ const schema = a.schema({
         actorLabel: a.string(),
         note: a.string(),
         reasonCode: a.string(),
+        decisionRelationId: a.id(),
+        shareable: a.boolean(),
     })
         .returns(a.ref("ReferenceCurationActionResult"))
         .authorization((allow) => [

package/amplify/data/resource.ts

@@ -312,6 +312,8 @@ const schema = a.schema({
       actorLabel: a.string(),
       note: a.string(),
       reasonCode: a.string(),
+      decisionRelationId: a.id(),
+      shareable: a.boolean(),
     })
     .returns(a.ref("ReferenceCurationActionResult"))
     .authorization((allow) => [

package/amplify/data/schema.js

@@ -245,6 +245,8 @@ export const schema = a.schema({
         actorLabel: a.string(),
         note: a.string(),
         reasonCode: a.string(),
+        decisionRelationId: a.id(),
+        shareable: a.boolean(),
     })
         .returns(a.ref("ReferenceCurationActionResult"))
         .authorization((allow) => [

package/amplify/data/schema.ts

@@ -268,6 +268,8 @@ export const schema = a.schema({
       actorLabel: a.string(),
       note: a.string(),
       reasonCode: a.string(),
+      decisionRelationId: a.id(),
+      shareable: a.boolean(),
     })
     .returns(a.ref("ReferenceCurationActionResult"))
     .authorization((allow) => [

package/amplify/functions/category-action/handler.ts

@@ -4,6 +4,7 @@ import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
 import { putJsonModelPayload, putTextModelPayload, readJsonModelPayload } from "../shared/model-payloads";
+import { referenceCurationMetadata } from "../shared/reference-curation-metadata";
 
 type ReviewHandler = Schema["reviewSteeringProposal"]["functionHandler"];
 type ReferenceCurationHandler = Schema["reviewReferenceCuration"]["functionHandler"];
@@ -225,14 +226,15 @@ async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandle
     { ownerKind: "message", ownerId: messageId, ownerLineageId: messageId },
     "metadata",
     "metadata",
-    {
+    referenceCurationMetadata({
       action,
       curationStatus: nextStatus,
       reasonCode,
-      curationReasonCode: reasonCode,
       referenceId,
       referenceLineageId,
-    },
+      decisionRelationId: normalizeOptionalString(event.arguments.decisionRelationId),
+      shareable: event.arguments.shareable ?? null,
+    }),
     { filename: "metadata.json", now },
   );
 

package/amplify/functions/shared/reference-curation-metadata.ts

@@ -0,0 +1,29 @@
+/**
+ * Metadata stored with an editor's reference curation Message. When the
+ * relevance cyclotron decided the reference, the review records which
+ * decision it answered and whether its explanation may be shared (for the
+ * Cyclotron marketing recording). Both are optional.
+ */
+export type ReferenceCurationMetadataInput = {
+  action: string
+  curationStatus: string
+  reasonCode: string | null
+  referenceId: string
+  referenceLineageId: string
+  decisionRelationId?: string | null
+  shareable?: boolean | null
+}
+
+export function referenceCurationMetadata(input: ReferenceCurationMetadataInput): Record<string, unknown> {
+  const decisionRelationId = input.decisionRelationId?.trim() || null
+  return {
+    action: input.action,
+    curationStatus: input.curationStatus,
+    reasonCode: input.reasonCode,
+    curationReasonCode: input.reasonCode,
+    referenceId: input.referenceId,
+    referenceLineageId: input.referenceLineageId,
+    ...(decisionRelationId ? {decisionRelationId} : {}),
+    ...(decisionRelationId ? {shareable: input.shareable === true} : {}),
+  }
+}

package/amplify/inbound-email/ses-intake.js

@@ -0,0 +1,86 @@
+import { Duration } from "aws-cdk-lib";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sesActions from "aws-cdk-lib/aws-ses-actions";
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+/**
+ * Adds the SES receipt resources directly to `scope` (no wrapper construct) so
+ * the logical ids of the live p.apyr.us stack stay unchanged.
+ */
+export function addInboundEmailSesIntake(scope, props) {
+    if (props.domainIdentity) {
+        const { domain, hostedZoneId, hostedZoneName, recordName } = props.domainIdentity;
+        const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "PapyrusInboundDnsZone", {
+            hostedZoneId,
+            zoneName: hostedZoneName,
+        });
+        const verifyDomain = new AwsCustomResource(scope, "VerifyInboundEmailDomain", {
+            onCreate: {
+                service: "SES",
+                action: "verifyDomainIdentity",
+                parameters: { Domain: domain },
+                physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+            },
+            onUpdate: {
+                service: "SES",
+                action: "verifyDomainIdentity",
+                parameters: { Domain: domain },
+                physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+            },
+            policy: AwsCustomResourcePolicy.fromSdkCalls({
+                resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+            }),
+            timeout: Duration.minutes(2),
+        });
+        new route53.TxtRecord(scope, "PapyrusInboundEmailDomainVerification", {
+            zone,
+            recordName: `_amazonses.${recordName}`,
+            ttl: Duration.minutes(5),
+            values: [verifyDomain.getResponseField("VerificationToken")],
+        });
+    }
+    const ruleSet = props.existingRuleSetName
+        ? ses.ReceiptRuleSet.fromReceiptRuleSetName(scope, "PapyrusInboundEmailRuleSet", props.existingRuleSetName)
+        : new ses.ReceiptRuleSet(scope, "PapyrusInboundEmailRuleSet", {
+            receiptRuleSetName: props.ruleSetName,
+        });
+    ruleSet.addRule("PapyrusInboundSubmissions", {
+        receiptRuleName: props.ruleName,
+        recipients: props.recipients,
+        enabled: true,
+        scanEnabled: true,
+        tlsPolicy: ses.TlsPolicy.REQUIRE,
+        actions: [
+            new sesActions.S3({
+                bucket: props.storageBucket,
+                objectKeyPrefix: "inbound-email/",
+            }),
+        ],
+    });
+    if (props.activateRuleSet && !props.existingRuleSetName) {
+        new AwsCustomResource(scope, "ActivateInboundEmailRuleSet", {
+            onCreate: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+                physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+            },
+            onUpdate: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+                physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+            },
+            onDelete: {
+                service: "SES",
+                action: "setActiveReceiptRuleSet",
+                parameters: { RuleSetName: null },
+            },
+            policy: AwsCustomResourcePolicy.fromSdkCalls({
+                resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+            }),
+            timeout: Duration.minutes(2),
+        });
+    }
+    return { ruleSet };
+}

package/amplify/inbound-email/ses-intake.ts

@@ -0,0 +1,110 @@
+import { Duration } from "aws-cdk-lib";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sesActions from "aws-cdk-lib/aws-ses-actions";
+import type * as s3 from "aws-cdk-lib/aws-s3";
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import type { Construct } from "constructs";
+
+export type InboundEmailSesIntakeProps = {
+  storageBucket: s3.IBucket;
+  recipients: string[];
+  ruleSetName: string;
+  /** Adds the rule to a rule set another stack owns instead of creating one. */
+  existingRuleSetName?: string;
+  /** `undefined` lets CloudFormation generate the name (the live p.apyr.us rule). */
+  ruleName?: string;
+  /** Only the legacy p.apyr.us pipeline sets this; a new site never activates a rule set. */
+  activateRuleSet: boolean;
+  domainIdentity?: {
+    domain: string;
+    hostedZoneId: string;
+    hostedZoneName: string;
+    recordName: string;
+  };
+};
+
+/**
+ * Adds the SES receipt resources directly to `scope` (no wrapper construct) so
+ * the logical ids of the live p.apyr.us stack stay unchanged.
+ */
+export function addInboundEmailSesIntake(scope: Construct, props: InboundEmailSesIntakeProps) {
+  if (props.domainIdentity) {
+    const { domain, hostedZoneId, hostedZoneName, recordName } = props.domainIdentity;
+    const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "PapyrusInboundDnsZone", {
+      hostedZoneId,
+      zoneName: hostedZoneName,
+    });
+    const verifyDomain = new AwsCustomResource(scope, "VerifyInboundEmailDomain", {
+      onCreate: {
+        service: "SES",
+        action: "verifyDomainIdentity",
+        parameters: { Domain: domain },
+        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+      },
+      onUpdate: {
+        service: "SES",
+        action: "verifyDomainIdentity",
+        parameters: { Domain: domain },
+        physicalResourceId: PhysicalResourceId.of(`ses-domain-verify-${domain}`),
+      },
+      policy: AwsCustomResourcePolicy.fromSdkCalls({
+        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+      }),
+      timeout: Duration.minutes(2),
+    });
+    new route53.TxtRecord(scope, "PapyrusInboundEmailDomainVerification", {
+      zone,
+      recordName: `_amazonses.${recordName}`,
+      ttl: Duration.minutes(5),
+      values: [verifyDomain.getResponseField("VerificationToken")],
+    });
+  }
+
+  const ruleSet = props.existingRuleSetName
+    ? ses.ReceiptRuleSet.fromReceiptRuleSetName(scope, "PapyrusInboundEmailRuleSet", props.existingRuleSetName)
+    : new ses.ReceiptRuleSet(scope, "PapyrusInboundEmailRuleSet", {
+        receiptRuleSetName: props.ruleSetName,
+      });
+  ruleSet.addRule("PapyrusInboundSubmissions", {
+    receiptRuleName: props.ruleName,
+    recipients: props.recipients,
+    enabled: true,
+    scanEnabled: true,
+    tlsPolicy: ses.TlsPolicy.REQUIRE,
+    actions: [
+      new sesActions.S3({
+        bucket: props.storageBucket,
+        objectKeyPrefix: "inbound-email/",
+      }),
+    ],
+  });
+
+  if (props.activateRuleSet && !props.existingRuleSetName) {
+    new AwsCustomResource(scope, "ActivateInboundEmailRuleSet", {
+      onCreate: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+        physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+      },
+      onUpdate: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: ruleSet.receiptRuleSetName },
+        physicalResourceId: PhysicalResourceId.of(`activate-${ruleSet.receiptRuleSetName}`),
+      },
+      onDelete: {
+        service: "SES",
+        action: "setActiveReceiptRuleSet",
+        parameters: { RuleSetName: null },
+      },
+      policy: AwsCustomResourcePolicy.fromSdkCalls({
+        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+      }),
+      timeout: Duration.minutes(2),
+    });
+  }
+
+  return { ruleSet };
+}

package/amplify/site-backend-config.ts

@@ -32,6 +32,17 @@ export type PapyrusSiteBackendConfig = {
   stagingBuild?: { enabled: boolean };
   /** Base URL of a Pretext reader whose `/api/revalidate` a publish calls (authenticated by the SSM secret named in branch variable `PAPYRUS_REVALIDATE_SECRET_PARAMETER`). */
   revalidateBaseUrl?: string;
+  /**
+   * SES receipt options for a site that is not the legacy p.apyr.us backend.
+   * By default the site gets its own brand-named rule set that is never
+   * activated by CloudFormation (SES allows one active rule set per region).
+   */
+  inboundEmailSes?: {
+    /** Add this site's rule to a rule set another stack owns instead of creating one. */
+    existingReceiptRuleSetName?: string;
+    /** Let this stack verify the SES domain identity and write its TXT record. Default false: verify once by hand. */
+    manageDomainIdentity?: boolean;
+  };
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend-names.js

@@ -0,0 +1,88 @@
+import { createHash } from "node:crypto";
+export function sanitizeAwsName(value, maxLength = 50) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-|-$/g, "")
+        .slice(0, maxLength);
+}
+export function readBooleanEnvFlag(environment, name, defaultValue) {
+    const raw = (environment[name] ?? "").trim().toLowerCase();
+    if (["1", "true", "yes", "on"].includes(raw))
+        return true;
+    if (["0", "false", "no", "off"].includes(raw))
+        return false;
+    return defaultValue;
+}
+/**
+ * True only for the Amplify app that owns the original p.apyr.us backend. That
+ * backend keeps its historical account-global names so its live resources are
+ * never replaced. Every other site gets brand-scoped names.
+ */
+export function isLegacyProductionApp(identity) {
+    return identity.productionAppId !== "" && identity.amplifyAppId === identity.productionAppId;
+}
+export function isLegacyProductionPipeline(identity) {
+    return isLegacyProductionApp(identity) && identity.amplifyBranch === "main";
+}
+export function resolveSiteBackendFeatureFlags(features, environment, identity) {
+    const legacyPipeline = isLegacyProductionPipeline(identity);
+    return {
+        consoleResponder: features?.consoleResponder ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_CONSOLE_RESPONDER", true),
+        inboundEmail: features?.inboundEmail ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_INBOUND_EMAIL", legacyPipeline),
+        slack: features?.slack ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_SLACK", false),
+        storageBackups: features?.storageBackups ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_STORAGE_BACKUPS", legacyPipeline),
+    };
+}
+export function deriveKnowledgeVectorIndexName(identity) {
+    return isLegacyProductionApp(identity)
+        ? "papyrus-knowledge"
+        : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+export function deriveStorageBackupVaultName(identity, backupsStackName, explicitName) {
+    const explicit = (explicitName ?? "").trim();
+    if (explicit !== "")
+        return sanitizeAwsName(explicit);
+    if (isLegacyProductionPipeline(identity)) {
+        return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+    }
+    const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
+    return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+}
+/**
+ * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
+ * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
+ * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
+ * its own brand-named rule set and never activates it from CloudFormation.
+ */
+export function deriveReceiptRuleSetName(identity, inboundEmailDomain) {
+    if (isLegacyProductionApp(identity)) {
+        return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
+    }
+    return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+/** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
+export function deriveReceiptRuleName(identity) {
+    if (isLegacyProductionApp(identity))
+        return undefined;
+    return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+}
+export function planInboundEmailSes(identity, inboundEmailEnabled, options) {
+    const legacyPipeline = isLegacyProductionPipeline(identity);
+    const deployedMainBranch = identity.amplifyAppId !== "" && identity.amplifyBranch === "main";
+    const createReceiptRules = inboundEmailEnabled && (legacyPipeline || deployedMainBranch);
+    return {
+        createReceiptRules,
+        activateReceiptRuleSet: createReceiptRules && legacyPipeline,
+        manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
+    };
+}
+export function deriveSiteGlobalResourceNames(identity, inboundEmailDomain, backupsStackName) {
+    return {
+        knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
+        storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+        receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
+        receiptRuleName: deriveReceiptRuleName(identity),
+    };
+}

package/amplify/site-backend-names.ts

@@ -0,0 +1,147 @@
+import { createHash } from "node:crypto";
+
+export type SiteBackendFeatureFlags = {
+  consoleResponder: boolean;
+  inboundEmail: boolean;
+  slack: boolean;
+  storageBackups: boolean;
+};
+
+export type SiteBackendFeatureInput = Partial<SiteBackendFeatureFlags> | undefined;
+
+export function sanitizeAwsName(value: string, maxLength = 50): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "")
+    .slice(0, maxLength);
+}
+
+export function readBooleanEnvFlag(
+  environment: Record<string, string | undefined>,
+  name: string,
+  defaultValue: boolean,
+): boolean {
+  const raw = (environment[name] ?? "").trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(raw)) return true;
+  if (["0", "false", "no", "off"].includes(raw)) return false;
+  return defaultValue;
+}
+
+export type SiteBackendIdentity = {
+  brandId: string;
+  amplifyAppId: string;
+  amplifyBranch: string;
+  productionAppId: string;
+};
+
+/**
+ * True only for the Amplify app that owns the original p.apyr.us backend. That
+ * backend keeps its historical account-global names so its live resources are
+ * never replaced. Every other site gets brand-scoped names.
+ */
+export function isLegacyProductionApp(identity: SiteBackendIdentity): boolean {
+  return identity.productionAppId !== "" && identity.amplifyAppId === identity.productionAppId;
+}
+
+export function isLegacyProductionPipeline(identity: SiteBackendIdentity): boolean {
+  return isLegacyProductionApp(identity) && identity.amplifyBranch === "main";
+}
+
+export function resolveSiteBackendFeatureFlags(
+  features: SiteBackendFeatureInput,
+  environment: Record<string, string | undefined>,
+  identity: SiteBackendIdentity,
+): SiteBackendFeatureFlags {
+  const legacyPipeline = isLegacyProductionPipeline(identity);
+  return {
+    consoleResponder:
+      features?.consoleResponder ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_CONSOLE_RESPONDER", true),
+    inboundEmail:
+      features?.inboundEmail ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_INBOUND_EMAIL", legacyPipeline),
+    slack: features?.slack ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_SLACK", false),
+    storageBackups:
+      features?.storageBackups ?? readBooleanEnvFlag(environment, "PAPYRUS_ENABLE_STORAGE_BACKUPS", legacyPipeline),
+  };
+}
+
+export function deriveKnowledgeVectorIndexName(identity: SiteBackendIdentity): string {
+  return isLegacyProductionApp(identity)
+    ? "papyrus-knowledge"
+    : `papyrus-knowledge-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+
+export function deriveStorageBackupVaultName(
+  identity: SiteBackendIdentity,
+  backupsStackName: string,
+  explicitName?: string,
+): string {
+  const explicit = (explicitName ?? "").trim();
+  if (explicit !== "") return sanitizeAwsName(explicit);
+  if (isLegacyProductionPipeline(identity)) {
+    return sanitizeAwsName(`papyrus-${identity.productionAppId}-main-media-backup-vault`);
+  }
+  const stackHash = createHash("sha256").update(backupsStackName).digest("hex").slice(0, 8);
+  return `papyrus-${sanitizeAwsName(identity.brandId, 20)}-${stackHash}-media-vault`;
+}
+
+/**
+ * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
+ * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
+ * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
+ * its own brand-named rule set and never activates it from CloudFormation.
+ */
+export function deriveReceiptRuleSetName(identity: SiteBackendIdentity, inboundEmailDomain: string): string {
+  if (isLegacyProductionApp(identity)) {
+    return `papyrus-inbound-${inboundEmailDomain.replace(/\./g, "-")}`;
+  }
+  return `papyrus-site-inbound-${sanitizeAwsName(identity.brandId, 40)}`;
+}
+
+/** `undefined` keeps the legacy auto-generated rule name of the live p.apyr.us rule. */
+export function deriveReceiptRuleName(identity: SiteBackendIdentity): string | undefined {
+  if (isLegacyProductionApp(identity)) return undefined;
+  return `${sanitizeAwsName(identity.brandId, 40)}-inbound-submissions`;
+}
+
+export type InboundEmailSesPlan = {
+  createReceiptRules: boolean;
+  activateReceiptRuleSet: boolean;
+  manageDomainIdentity: boolean;
+};
+
+export function planInboundEmailSes(
+  identity: SiteBackendIdentity,
+  inboundEmailEnabled: boolean,
+  options: { manageDomainIdentity?: boolean } | undefined,
+): InboundEmailSesPlan {
+  const legacyPipeline = isLegacyProductionPipeline(identity);
+  const deployedMainBranch = identity.amplifyAppId !== "" && identity.amplifyBranch === "main";
+  const createReceiptRules = inboundEmailEnabled && (legacyPipeline || deployedMainBranch);
+  return {
+    createReceiptRules,
+    activateReceiptRuleSet: createReceiptRules && legacyPipeline,
+    manageDomainIdentity: createReceiptRules && (legacyPipeline || options?.manageDomainIdentity === true),
+  };
+}
+
+export type SiteGlobalResourceNames = {
+  knowledgeVectorIndexName: string;
+  storageBackupVaultName: string;
+  receiptRuleSetName: string;
+  receiptRuleName: string | undefined;
+};
+
+export function deriveSiteGlobalResourceNames(
+  identity: SiteBackendIdentity,
+  inboundEmailDomain: string,
+  backupsStackName: string,
+): SiteGlobalResourceNames {
+  return {
+    knowledgeVectorIndexName: deriveKnowledgeVectorIndexName(identity),
+    storageBackupVaultName: deriveStorageBackupVaultName(identity, backupsStackName),
+    receiptRuleSetName: deriveReceiptRuleSetName(identity, inboundEmailDomain),
+    receiptRuleName: deriveReceiptRuleName(identity),
+  };
+}