@anthusai/papyrus 1.0.0-next.9 → 1.1.0

package/amplify/functions/content-actions/handler.py

@@ -4,8 +4,17 @@ import json
 import os
 from typing import Any
 
+from papyrus_content.edge_invalidation import distribution_ids_from_environment, invalidate_revalidated_paths
 from papyrus_content.graphql_authoring import create_authoring_client
 from papyrus_content.markus_renderer.derive import derive_body
+from papyrus_content.projection.deploy_render import deploy_render, drift_metric_line
+from papyrus_content.projection.engine import project, project_all, project_item_pages
+from papyrus_content.projection.runtime import (
+    DEAD_LETTER_QUEUE_ENV,
+    context_from_environment,
+    projection_configured,
+    public_item_url,
+)
 from papyrus_content.rebuild_trigger import (
     DEFAULT_STAGING_BRANCH,
     reader_target_from_environment,
@@ -56,6 +65,127 @@ def derive_markus_action(arguments: dict) -> dict:
     return response
 
 
+PROJECTION_TASK_KEY = "projectionTask"
+
+
+class ProjectionTaskFailed(Exception):
+    """Raised by an asynchronous projection task so Lambda retries it and, finally, sends it to the dead letter queue."""
+
+
+def send_to_projection_dead_letter_queue(task: dict, error: str) -> None:
+    queue_url = (os.environ.get(DEAD_LETTER_QUEUE_ENV) or "").strip()
+    if not queue_url:
+        return
+    try:
+        import boto3
+
+        boto3.client("sqs").send_message(
+            QueueUrl=queue_url, MessageBody=json.dumps({PROJECTION_TASK_KEY: task, "error": error})
+        )
+    except Exception:  # noqa: BLE001 - the dead letter is best effort; the response already reports the failure
+        pass
+
+
+def schedule_projection_task(task: dict, error: str) -> bool:
+    """Run a projection task later, in this same function, as an asynchronous invocation.
+
+    The function has an on-failure destination (the dead letter queue), so a task
+    that keeps failing ends up there for ``papyrus ops content project --reconcile``.
+    """
+    function_name = (os.environ.get("AWS_LAMBDA_FUNCTION_NAME") or "").strip()
+    if not function_name:
+        send_to_projection_dead_letter_queue(task, error)
+        return False
+    try:
+        import boto3
+
+        boto3.client("lambda").invoke(
+            FunctionName=function_name, InvocationType="Event", Payload=json.dumps({PROJECTION_TASK_KEY: task}).encode("utf-8")
+        )
+        return True
+    except Exception as scheduling_error:  # noqa: BLE001 - fall back to the dead letter queue
+        send_to_projection_dead_letter_queue(task, f"{error}; scheduling failed: {scheduling_error}")
+        return False
+
+
+def projection_context(client):
+    context = context_from_environment(client)
+    context.defer_follow_up = True
+    return context
+
+
+def project_item_action(client, item_id: str, *, unpublished: bool) -> dict:
+    if not projection_configured():
+        return {}
+    liveness = {} if unpublished else {"live": False}
+    task = {"task": "item", "itemId": item_id, "unpublished": unpublished}
+    try:
+        report = project(projection_context(client), item_id, unpublished=unpublished)
+    except Exception as error:  # noqa: BLE001 - a projection failure never fails the save
+        message = f"{type(error).__name__}: {error}"
+        schedule_projection_task(task, message)
+        return {**liveness, "projected": False, "paths": [], "error": message}
+    response = {"projected": report.ok, "paths": [*report.written, *report.deleted]}
+    if not unpublished:
+        response["live"] = report.ok
+        url = public_item_url(os.environ, report.item_paths)
+        if url:
+            response["url"] = url
+    if not report.ok:
+        message = "; ".join(report.errors)
+        schedule_projection_task(task, message)
+        response["error"] = message
+    if report.unpurged:
+        response["edgePurged"] = False
+        schedule_unpurged_invalidation(report.unpurged)
+    if report.follow_up_item_pages:
+        schedule_projection_task({"task": "item-pages", "exceptItemId": item_id}, "follow-up")
+    return response
+
+
+def schedule_unpurged_invalidation(keys: list[str]) -> None:
+    schedule_projection_task({"task": "invalidate", "keys": keys}, "edge invalidation failed")
+
+
+def run_deploy_render_task(client) -> dict:
+    """Render every published page after a backend deploy, then report drift (a dry run: nothing is deleted)."""
+    context = projection_context(client)
+    report = deploy_render(context)
+    print(drift_metric_line(report))
+    if report.render.unpurged:
+        schedule_unpurged_invalidation(report.render.unpurged)
+    if not report.ok:
+        raise ProjectionTaskFailed("; ".join([*report.render.errors, *report.drift.errors]))
+    return report.to_dict()
+
+
+def run_projection_task(task: dict) -> dict:
+    """An asynchronous projection task. Raising makes Lambda retry it, then send the event to the dead letter queue."""
+    client, _claims = create_authoring_client()
+    if task.get("task") == "item-pages":
+        report = project_item_pages(projection_context(client), except_item_id=task.get("exceptItemId"))
+    elif task.get("task") == "item":
+        report = project(projection_context(client), task["itemId"], unpublished=bool(task.get("unpublished")))
+        if report.follow_up_item_pages:
+            schedule_projection_task({"task": "item-pages", "exceptItemId": task["itemId"]}, "follow-up")
+    elif task.get("task") == "all":
+        report = project_all(projection_context(client))
+    elif task.get("task") == "deploy-render":
+        return run_deploy_render_task(client)
+    elif task.get("task") == "invalidate":
+        invalidate = projection_context(client).invalidate
+        if invalidate is None:
+            return {"ok": True, "paths": []}
+        return {"ok": True, "paths": invalidate(list(task["keys"]))}
+    else:
+        raise ProjectionTaskFailed(f"Unknown projection task {task.get('task')!r}")
+    if report.unpurged:
+        schedule_unpurged_invalidation(report.unpurged)
+    if not report.ok:
+        raise ProjectionTaskFailed("; ".join(report.errors))
+    return {"ok": True, "paths": [*report.written, *report.deleted]}
+
+
 def save_item_draft_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
     fields = ItemFields(
@@ -68,7 +198,7 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
         id=arguments.get("id"),
     )
     record = save_item(client, fields, actor=actor, expected_content_hash=arguments.get("expectedContentHash"))
-    return {
+    response = {
         "ok": True,
         "item": {
             "id": record["id"],
@@ -78,6 +208,11 @@ def save_item_draft_action(arguments: dict, actor: str) -> dict:
             "versionNumber": record.get("versionNumber"),
         },
     }
+    if record["status"] == "published" and projection_configured():
+        published = publish_item(client, record["id"], actor=actor)
+        response["item"]["versionNumber"] = published.version_number
+        response.update(project_item_action(client, record["id"], unpublished=False))
+    return response
 
 
 def site_triggers_for(client, item_id: str) -> dict:
@@ -90,6 +225,9 @@ def site_triggers_for(client, item_id: str) -> dict:
             slugs = [item["slug"]] if item.get("slug") else []
             revalidated = trigger_pretext_revalidation(slugs, None, base_url=revalidate_base_url)
             triggers["revalidated"] = revalidated if revalidated is not None else {"ok": False, "reason": "not-configured"}
+            distribution_ids = distribution_ids_from_environment(os.environ)
+            if distribution_ids and revalidated is not None:
+                triggers["edgeInvalidated"] = invalidate_revalidated_paths(distribution_ids, revalidated)
         except Exception as error:  # noqa: BLE001 - a trigger failure never fails the publish
             triggers["revalidated"] = {"ok": False, "error": f"{type(error).__name__}: {error}"}
     if reader_app_id:
@@ -108,6 +246,7 @@ def publish_item_action(arguments: dict, actor: str) -> dict:
     }
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
+    response.update(project_item_action(client, arguments["id"], unpublished=False))
     return response
 
 
@@ -117,6 +256,7 @@ def unpublish_item_action(arguments: dict, actor: str) -> dict:
     response = {"ok": True, "changed": result.changed}
     if result.changed:
         response.update(site_triggers_for(client, arguments["id"]))
+    response.update(project_item_action(client, arguments["id"], unpublished=True))
     return response
 
 
@@ -130,6 +270,8 @@ def request_staging_build_action() -> dict:
 
 
 def handler(event, context):
+    if PROJECTION_TASK_KEY in event:
+        return run_projection_task(event[PROJECTION_TASK_KEY])
     field = event["fieldName"]
     arguments = parse_input(event["arguments"]["input"])
     actor = actor_from_event(event)

package/amplify/functions/content-actions/requirements.txt

@@ -1,4 +1,5 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
 anthus-markus==0.5.1
-Pillow>=10,<12
+Pillow>=11.3,<12
+awscrt>=0.23,<1

package/amplify/functions/content-actions/resource.js

@@ -7,11 +7,15 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });
 }
+let siteFilesForNextContentActionsBundle;
+export function setSiteFilesForContentActionsBundle(siteFiles) {
+    siteFilesForNextContentActionsBundle = siteFiles;
+}
 export const contentActions = defineFunction((scope) => {
     return new Function(scope, "papyrus-content-actions", {
         runtime: Runtime.PYTHON_3_12,
@@ -25,6 +29,7 @@ export const contentActions = defineFunction((scope) => {
             requirements: contentActionsRequirements,
             noDeps: true,
             checkoutExtras: installCheckoutRequirements,
+            ...(siteFilesForNextContentActionsBundle !== undefined ? { siteFiles: siteFilesForNextContentActionsBundle } : {}),
         }, [
             "bash",
             "-c",

package/amplify/functions/content-actions/resource.ts

@@ -5,12 +5,12 @@ import { Construct } from "constructs";
 import { execSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { pythonLambdaCode } from "../shared/python-bundle";
+import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=10,<12"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
@@ -20,6 +20,12 @@ function installCheckoutRequirements(outputDir: string): void {
   );
 }
 
+let siteFilesForNextContentActionsBundle: SiteBundleFile[] | undefined;
+
+export function setSiteFilesForContentActionsBundle(siteFiles: SiteBundleFile[] | undefined): void {
+  siteFilesForNextContentActionsBundle = siteFiles;
+}
+
 export const contentActions = defineFunction(
   (scope: Construct) => {
     return new Function(scope, "papyrus-content-actions", {
@@ -35,6 +41,7 @@ export const contentActions = defineFunction(
           requirements: contentActionsRequirements,
           noDeps: true,
           checkoutExtras: installCheckoutRequirements,
+          ...(siteFilesForNextContentActionsBundle !== undefined ? { siteFiles: siteFilesForNextContentActionsBundle } : {}),
         },
         [
           "bash",

package/amplify/functions/email-submission-processor/handler.py

@@ -30,8 +30,10 @@ def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
         event.get("corpusKey")
         or event.get("corpus_key")
         or os.environ.get("PAPYRUS_INBOUND_EMAIL_CORPUS_KEY")
-        or "AI-ML-research"
+        or ""
     ).strip()
+    if not corpus_key:
+        raise ValueError("corpusKey or PAPYRUS_INBOUND_EMAIL_CORPUS_KEY is required.")
 
     from papyrus_content.graphql_authoring import PapyrusGraphQLAuthoringClient
     from papyrus_newsroom.email_submissions import process_email_submission_message

package/amplify/functions/renditions/handler.py

@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from typing import Any
+
+from papyrus_content.projection.runtime import SITE_BUCKET_ENV, SITE_STATIC_DIRECTORY_ENV
+from papyrus_content.renditions import (
+    RenditionSettings,
+    S3RenditionStore,
+    make_renditions,
+    media_originals_enabled,
+    meta_key,
+    original_site_key,
+    ORIGINAL_CACHE_CONTROL,
+    settings_from_static_directory,
+    source_from_media_key,
+)
+
+_loaded: dict[str, Any] = {}
+
+
+def configured_settings() -> RenditionSettings | None:
+    if "settings" not in _loaded:
+        static_directory = (os.environ.get(SITE_STATIC_DIRECTORY_ENV) or "").strip()
+        _loaded["settings"] = settings_from_static_directory(Path(static_directory) if static_directory else None)
+    return _loaded["settings"]
+
+
+def originals_enabled() -> bool:
+    if "originals" not in _loaded:
+        static_directory = (os.environ.get(SITE_STATIC_DIRECTORY_ENV) or "").strip()
+        _loaded["originals"] = media_originals_enabled(Path(static_directory) if static_directory else None)
+    return _loaded["originals"]
+
+
+def site_store() -> S3RenditionStore:
+    if "store" not in _loaded:
+        _loaded["store"] = S3RenditionStore(os.environ[SITE_BUCKET_ENV])
+    return _loaded["store"]
+
+
+def s3_client():
+    if "s3" not in _loaded:
+        import boto3
+
+        _loaded["s3"] = boto3.client("s3")
+    return _loaded["s3"]
+
+
+def media_objects(event: dict) -> list[tuple[str, str]]:
+    if event.get("source") == "aws.s3" and "detail" in event:
+        detail = event["detail"]
+        return [(detail["bucket"]["name"], detail["object"]["key"])]
+    if "bucket" in event and "key" in event:
+        return [(event["bucket"], event["key"])]
+    raise ValueError("The event is neither an S3 object event nor a {bucket, key} request.")
+
+
+def render_media_object(
+    settings: RenditionSettings | None,
+    bucket: str,
+    key: str,
+    *,
+    originals: bool = False,
+    skip_existing: bool = False,
+    dry_run: bool = False,
+) -> dict:
+    source = source_from_media_key(key) if settings is not None else None
+    original_key = original_site_key(key) if originals else None
+    if source is None and original_key is None:
+        return {"key": key, "action": "ignored", "reason": "not an image under media/"}
+    if skip_existing:
+        renditions_exist = source is None or site_store().get(meta_key(settings.pipeline, source)) is not None
+        original_exists = original_key is None or site_store().get(original_key) is not None
+        if renditions_exist and original_exists:
+            return {"key": key, "source": source or original_key, "action": "skipped-existing"}
+    if dry_run:
+        return {"key": key, "source": source or original_key, "action": "would-render" if source else "would-copy"}
+    started = time.perf_counter()
+    data = s3_client().get_object(Bucket=bucket, Key=key)["Body"].read()
+    downloaded = time.perf_counter()
+    if original_key is not None:
+        site_store().put(original_key, data, cache_control=ORIGINAL_CACHE_CONTROL)
+    if source is None:
+        return {"key": key, "source": original_key, "action": "copied", "written": 1, "sourceBytes": len(data)}
+    result = make_renditions(settings, site_store(), source, data)
+    finished = time.perf_counter()
+    return {
+        "key": key,
+        "source": source,
+        "action": "rendered",
+        "kind": result["kind"],
+        "written": result["written"] + (1 if original_key is not None else 0),
+        "sourceBytes": len(data),
+        "downloadMilliseconds": round((downloaded - started) * 1000),
+        "renditionMilliseconds": round((finished - downloaded) * 1000),
+    }
+
+
+def handler(event, context):
+    settings = configured_settings()
+    originals = originals_enabled()
+    if settings is None and not originals:
+        return {"ok": True, "results": [], "skipped": "this site has no images or media settings in projection.json"}
+    results = [
+        render_media_object(
+            settings,
+            bucket,
+            key,
+            originals=originals,
+            skip_existing=event.get("skipExisting") is True,
+            dry_run=event.get("dryRun") is True,
+        )
+        for bucket, key in media_objects(event)
+    ]
+    print(json.dumps({"renditions": results}))
+    return {"ok": True, "results": results}

package/amplify/functions/renditions/requirements.txt

@@ -0,0 +1,4 @@
+PyYAML>=6.0.2,<7
+citeproc-py>=0.8.2,<1
+anthus-markus==0.5.1
+Pillow>=11.3,<12

package/amplify/functions/ses-inbound-receive/handler.ts

@@ -2,6 +2,13 @@ import { InvokeCommand, LambdaClient } from "@aws-sdk/client-lambda";
 import { GetObjectCommand, ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
 import {
   buildEmailSubmissionMessageInput,
+  isInboundSenderAuthenticated,
+  readInboundSenderAuthenticationFromRawMime,
+  readInboundScanVerdictsFromSesReceipt,
+  REJECTION_KIND_UNAUTHENTICATED_SENDER,
+  UNAUTHENTICATED_SENDER_RESPONSE_ERROR,
+  UNVERIFIED_SENDER_AUTHENTICATION,
+  type InboundSenderAuthentication,
   classifyInboundEmailIntake,
   countInboundAttachments,
   extractDirectCitations,
@@ -49,6 +56,7 @@ type InboundPayload = {
   attachmentCount: number;
   userComposedText: string;
   parentSubmissionMessageId: string | null;
+  senderAuthentication: InboundSenderAuthentication;
 };
 
 type ExistingMessage = {
@@ -123,7 +131,8 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
   const resolvedMessageId = messageId ?? `message-email-submission-${crypto.randomUUID().replace(/-/g, "").slice(0, 20)}`;
   const dataClient = await getLambdaDataClient();
   const profileId = await lookupRegisteredUserProfileId(dataClient, inbound.senderEmail);
-  const authorized = Boolean(profileId);
+  const senderAuthenticated = isInboundSenderAuthenticated(inbound.senderAuthentication, inbound.senderEmail);
+  const authorized = Boolean(profileId) && senderAuthenticated;
   const citations = authorized
     ? (inbound.citations.length > 0
       ? inbound.citations
@@ -143,7 +152,9 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
 
   let status = authorized ? "received" : "rejected";
   let responseStatus = authorized ? "PENDING" : "REJECTED";
-  let responseError: string | null = authorized ? null : UNREGISTERED_SENDER_RESPONSE_ERROR;
+  let responseError: string | null = authorized
+    ? null
+    : (senderAuthenticated ? UNREGISTERED_SENDER_RESPONSE_ERROR : UNAUTHENTICATED_SENDER_RESPONSE_ERROR);
 
   if (authorized && looksLikeResearchAssignmentRequest(inbound.bodyText, citations.length)) {
     status = "rejected";
@@ -173,7 +184,8 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
     s3Bucket: inbound.s3Bucket,
     s3Key: inbound.s3Key,
     authorized,
-    authorUserProfileId: profileId,
+    rejectionKind: senderAuthenticated ? undefined : REJECTION_KIND_UNAUTHENTICATED_SENDER,
+    authorUserProfileId: authorized ? profileId : null,
     authorLabel: inbound.senderEmail || "unknown-sender",
     citations,
     status,
@@ -205,7 +217,7 @@ async function processInboundSubmission(inbound: InboundPayload): Promise<Record
 
   if (authorized && responseStatus === "PENDING" && PROCESSOR_FUNCTION_NAME) {
     await invokeEmailProcessor(resolvedMessageId);
-  } else if (responseStatus === "REJECTED" && PROCESSOR_FUNCTION_NAME) {
+  } else if (responseStatus === "REJECTED" && senderAuthenticated && PROCESSOR_FUNCTION_NAME) {
     await invokeEmailProcessor(resolvedMessageId, { sendFeedbackOnly: true });
   }
 
@@ -390,6 +402,7 @@ async function resolveFromSesMail(
       senderEmail: loaded.senderEmail || senderEmail,
       recipients: loaded.recipients.length > 0 ? loaded.recipients : recipients,
       subject: loaded.subject !== "(no subject)" ? loaded.subject : subject,
+      senderAuthentication: mergeScanVerdicts(loaded.senderAuthentication, readInboundScanVerdictsFromSesReceipt(receipt)),
     };
   }
 
@@ -407,6 +420,7 @@ async function resolveFromSesMail(
     attachmentCount: 0,
     userComposedText: "",
     parentSubmissionMessageId: null,
+    senderAuthentication: { ...UNVERIFIED_SENDER_AUTHENTICATION, ...readInboundScanVerdictsFromSesReceipt(receipt) },
   });
 }
 
@@ -433,6 +447,7 @@ async function loadInboundFromS3Object(
     attachmentCount: countInboundAttachments(rawBytes),
     userComposedText: extractUserComposedReplyText(intake.bodyText),
     parentSubmissionMessageId: null,
+    senderAuthentication: readInboundSenderAuthenticationFromRawMime(rawBytes),
   });
 }
 
@@ -446,6 +461,19 @@ function enrichInboundPayload(payload: InboundPayload): InboundPayload {
   };
 }
 
+function mergeScanVerdicts(
+  authentication: InboundSenderAuthentication,
+  receiptVerdicts: Pick<InboundSenderAuthentication, "spamVerdict" | "virusVerdict">,
+): InboundSenderAuthentication {
+  const worst = (fromMime: string, fromReceipt: string) =>
+    fromMime === "fail" || fromReceipt === "fail" ? "fail" : fromMime !== "unknown" ? fromMime : fromReceipt;
+  return {
+    ...authentication,
+    spamVerdict: worst(authentication.spamVerdict, receiptVerdicts.spamVerdict),
+    virusVerdict: worst(authentication.virusVerdict, receiptVerdicts.virusVerdict),
+  };
+}
+
 function sesMessageIdFromObjectKey(key: string): string | null {
   const basename = key.split("/").pop() ?? "";
   const match = basename.match(/^[A-Za-z0-9_-]+$/);

package/amplify/functions/shared/email-submission.ts

@@ -11,6 +11,113 @@ export const REJECTION_KIND_UNREGISTERED_SENDER = "unregistered_sender";
 export const UNREGISTERED_SENDER_RESPONSE_ERROR =
   "This submission was not accepted because only registered Papyrus users may send reference submissions by email.";
 
+export const UNAUTHENTICATED_SENDER_RESPONSE_ERROR =
+  "This submission was not accepted because the sender could not be authenticated (SPF or DKIM must pass).";
+export const REJECTION_KIND_UNAUTHENTICATED_SENDER = "unauthenticated_sender";
+
+export type InboundSenderAuthentication = {
+  spfPassDomains: string[];
+  dkimPassDomains: string[];
+  spamVerdict: string;
+  virusVerdict: string;
+};
+
+const TRUSTED_AUTHENTICATION_RESULTS_SERVER_ID = "amazonses.com";
+
+export const UNVERIFIED_SENDER_AUTHENTICATION: InboundSenderAuthentication = {
+  spfPassDomains: [],
+  dkimPassDomains: [],
+  spamVerdict: "unknown",
+  virusVerdict: "unknown",
+};
+
+function domainOfAddress(address: string): string {
+  return normalizeEmailAddress(address).split("@")[1] ?? "";
+}
+
+function domainsAreAligned(authenticatedDomain: string, fromDomain: string): boolean {
+  if (!authenticatedDomain || !fromDomain) return false;
+  return authenticatedDomain === fromDomain
+    || fromDomain.endsWith(`.${authenticatedDomain}`)
+    || authenticatedDomain.endsWith(`.${fromDomain}`);
+}
+
+export function isInboundSenderAuthenticated(
+  authentication: InboundSenderAuthentication,
+  fromAddress: string,
+): boolean {
+  if (authentication.spamVerdict === "fail" || authentication.virusVerdict === "fail") return false;
+  const fromDomain = domainOfAddress(fromAddress);
+  return [...authentication.spfPassDomains, ...authentication.dkimPassDomains]
+    .some((domain) => domainsAreAligned(domain, fromDomain));
+}
+
+export function readInboundScanVerdictsFromSesReceipt(
+  receipt: Record<string, unknown> | undefined,
+): Pick<InboundSenderAuthentication, "spamVerdict" | "virusVerdict"> {
+  const verdictStatus = (key: string): string => {
+    const verdict = receipt?.[key];
+    const status = verdict && typeof verdict === "object" ? (verdict as { status?: unknown }).status : null;
+    return typeof status === "string" ? status.trim().toLowerCase() : "unknown";
+  };
+  return { spamVerdict: verdictStatus("spamVerdict"), virusVerdict: verdictStatus("virusVerdict") };
+}
+
+function readHeaderBlock(rawBytes: Uint8Array): string[] {
+  const raw = Buffer.from(rawBytes).toString("utf8");
+  const headerBlockEnd = raw.search(/\r?\n\r?\n/);
+  const headerBlock = headerBlockEnd === -1 ? raw : raw.slice(0, headerBlockEnd);
+  return headerBlock.replace(/\r?\n[ \t]+/g, " ").split(/\r?\n/);
+}
+
+function firstHeaderValue(headerLines: string[], name: string): string | null {
+  const prefix = new RegExp(`^${name}:\\s*`, "i");
+  const line = headerLines.find((entry) => prefix.test(entry));
+  return line ? line.replace(prefix, "") : null;
+}
+
+export function readInboundSenderAuthenticationFromRawMime(rawBytes: Uint8Array): InboundSenderAuthentication {
+  const headerLines = readHeaderBlock(rawBytes);
+  const verdictHeader = (name: string): string =>
+    (firstHeaderValue(headerLines, name) ?? "unknown").trim().toLowerCase();
+  const scanVerdicts = {
+    spamVerdict: verdictHeader("X-SES-Spam-Verdict"),
+    virusVerdict: verdictHeader("X-SES-Virus-Verdict"),
+  };
+  const topmostResults = firstHeaderValue(headerLines, "Authentication-Results");
+  if (!topmostResults) return { ...UNVERIFIED_SENDER_AUTHENTICATION, ...scanVerdicts };
+  const [serverId, ...parts] = topmostResults.replace(/\([^)]*\)/g, "").split(";").map((part) => part.trim());
+  if (serverId.toLowerCase() !== TRUSTED_AUTHENTICATION_RESULTS_SERVER_ID) {
+    return { ...UNVERIFIED_SENDER_AUTHENTICATION, ...scanVerdicts };
+  }
+
+  const spfPassDomains: string[] = [];
+  const dkimPassDomains: string[] = [];
+  let spfPassed = false;
+  let envelopeFromDomain = "";
+  let heloDomain = "";
+  for (const part of parts) {
+    const result = /^(spf|dkim)\s*=\s*([a-z]+)/i.exec(part);
+    if (result) {
+      const passed = result[2].toLowerCase() === "pass";
+      if (result[1].toLowerCase() === "spf") spfPassed = spfPassed || passed;
+      else if (passed) {
+        const signingDomain = /header\.(?:i|d)\s*=\s*@?([^\s;]+)/i.exec(part)?.[1];
+        if (signingDomain) dkimPassDomains.push(signingDomain.toLowerCase().replace(/^.*@/, ""));
+      }
+    }
+    const envelopeFrom = /^(?:envelope-from|smtp\.mailfrom)\s*=\s*(\S+)/i.exec(part)?.[1];
+    if (envelopeFrom) envelopeFromDomain = domainOfAddress(envelopeFrom.replace(/^<|>$/g, ""));
+    const helo = /^(?:helo|smtp\.helo)\s*=\s*(\S+)/i.exec(part)?.[1];
+    if (helo) heloDomain = helo.toLowerCase();
+  }
+  if (spfPassed) {
+    const spfDomain = envelopeFromDomain || heloDomain;
+    if (spfDomain) spfPassDomains.push(spfDomain);
+  }
+  return { spfPassDomains, dkimPassDomains, ...scanVerdicts };
+}
+
 const URL_PATTERN = /https?:\/\/[^\s<>"')\]]+/gi;
 const DOI_PATTERN = /\b10\.\d{4,9}\/[-._;()/:A-Z0-9]+/gi;
 const RESEARCH_ASSIGNMENT_PHRASES = [
@@ -337,6 +444,7 @@ export function buildEmailSubmissionMessageInput(input: {
   s3Bucket: string | null;
   s3Key: string | null;
   authorized: boolean;
+  rejectionKind?: string;
   authorUserProfileId: string | null;
   authorLabel: string;
   citations: Array<Record<string, unknown>>;
@@ -378,7 +486,7 @@ export function buildEmailSubmissionMessageInput(input: {
       ...(input.authorized
         ? {}
         : {
-            rejectionKind: REJECTION_KIND_UNREGISTERED_SENDER,
+            rejectionKind: input.rejectionKind ?? REJECTION_KIND_UNREGISTERED_SENDER,
           }),
       directCitationCount: input.citations.length,
       directCitations: input.citations,