@anthusai/papyrus 2.0.0-next.1 → 2.0.0-next.100

package/amplify/publication/redirect-rules.ts

@@ -0,0 +1,93 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+/** One pattern redirect as the edge function reads it: regex, target with $1..$9, status, excluded paths. */
+export type EdgeRedirectRule = { p: string; t: string; s: number; x: string[] };
+
+/** Mirrors DIRECTORY_HTML_PATTERN and DIRECTORY_SLASH_PATTERN in standard/config.py. */
+const DIRECTORY_HTML_PATTERN = "^/(?!(?:.*/)?index\\.html$)(.+)\\.html$";
+const DIRECTORY_SLASH_PATTERN = "^/((?:[^/]+/)*[^/.]+)$";
+
+const START_MARKER = "/*PAPYRUS_PATTERN_RULES*/";
+const END_MARKER = "/*END_PAPYRUS_PATTERN_RULES*/";
+
+type ProjectionRedirects = { patterns?: { pattern: string; to: string; status?: number; except?: string[] }[] };
+type ProjectionSettings = { site?: unknown; urls?: { style?: string }; redirects?: ProjectionRedirects; agents?: { markdown?: boolean } };
+
+/**
+ * The pattern rules a site declares in projection.json: its `redirects.patterns`, plus, for
+ * `urls.style: "directory"`, `/x.html` to `/x/`. Mirrors `StandardSettings.edge_rules` in Python.
+ */
+export function edgeRulesFromSettings(settings: ProjectionSettings): EdgeRedirectRule[] {
+  const rules = (settings.redirects?.patterns ?? []).map((rule) => ({
+    p: rule.pattern,
+    t: rule.to,
+    s: rule.status ?? 301,
+    x: rule.except ?? [],
+  }));
+  if (settings.urls?.style === "directory") {
+    // /x.html to /x/ (a directory index file such as /x/index.html is served as it is), then /x to /x/.
+    rules.push({ p: DIRECTORY_HTML_PATTERN, t: "/$1/", s: 301, x: ["/404.html"] });
+    rules.push({ p: DIRECTORY_SLASH_PATTERN, t: "/$1/", s: 301, x: ["/404"] });
+  }
+  return rules;
+}
+
+/** A standard-front-end site publishes Markdown twins unless it turns `agents.markdown` off. */
+export function negotiatesMarkdown(settings: ProjectionSettings): boolean {
+  return settings.site !== undefined && settings.agents?.markdown !== false;
+}
+
+/** A directory-style site keeps a page's Markdown twin at `/x/index.md`; the edge then serves a bare `/x.md` from there. */
+export function usesDirectoryTwins(settings: ProjectionSettings): boolean {
+  return negotiatesMarkdown(settings) && settings.urls?.style === "directory";
+}
+
+export type EdgeConfig = { rules: EdgeRedirectRule[]; negotiateMarkdown: boolean; directoryTwins: boolean };
+
+export function readEdgeConfig(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeConfig {
+  if (staticDir === undefined) return { rules: [], negotiateMarkdown: false, directoryTwins: false };
+  const settingsPath = resolve(baseDirectory, staticDir, "projection.json");
+  if (!existsSync(settingsPath)) return { rules: [], negotiateMarkdown: false, directoryTwins: false };
+  const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as ProjectionSettings;
+  return { rules: edgeRulesFromSettings(settings), negotiateMarkdown: negotiatesMarkdown(settings), directoryTwins: usesDirectoryTwins(settings) };
+}
+
+export function readEdgeRules(staticDir: string | undefined, baseDirectory: string = process.cwd()): EdgeRedirectRule[] {
+  return readEdgeConfig(staticDir, baseDirectory).rules;
+}
+
+const NEGOTIATE_START = "/*PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const NEGOTIATE_END = "/*END_PAPYRUS_NEGOTIATE_MARKDOWN*/";
+const TWINS_START = "/*PAPYRUS_DIRECTORY_TWINS*/";
+const TWINS_END = "/*END_PAPYRUS_DIRECTORY_TWINS*/";
+
+function spliceFlag(source: string, start: string, end: string, label: string): string {
+  const from = source.indexOf(start);
+  const to = source.indexOf(end);
+  if (from === -1 || to === -1 || to < from) {
+    throw new Error(`redirect function source has no ${label} markers`);
+  }
+  return source.slice(0, from + start.length) + "true" + source.slice(to);
+}
+
+/** The CloudFront Function source with the site's pattern rules and Markdown negotiation flag spliced in. */
+export function compileRedirectFunctionSource(
+  source: string,
+  rules: EdgeRedirectRule[],
+  options: { negotiateMarkdown?: boolean; directoryTwins?: boolean } = {},
+): string {
+  const start = source.indexOf(START_MARKER);
+  const end = source.indexOf(END_MARKER);
+  if (start === -1 || end === -1 || end < start) {
+    throw new Error("redirect function source has no pattern-rule markers");
+  }
+  let compiled = rules.length === 0 ? source : source.slice(0, start + START_MARKER.length) + JSON.stringify(rules) + source.slice(end);
+  if (options.negotiateMarkdown === true) {
+    compiled = spliceFlag(compiled, NEGOTIATE_START, NEGOTIATE_END, "markdown negotiation");
+  }
+  if (options.directoryTwins === true) {
+    compiled = spliceFlag(compiled, TWINS_START, TWINS_END, "directory twin");
+  }
+  return compiled;
+}

package/amplify/publication/s3-projection.js

@@ -7,11 +7,13 @@ import { SqsDestination } from "aws-cdk-lib/aws-lambda-destinations";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig } from "../site-backend-config.js";
 import { addRenditionsFunction } from "./renditions-function.js";
 import { RENDITIONS_FUNCTION_NAME_ENV } from "./renditions-settings.js";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules.js";
 import { addInvalidationPathAlarm } from "./invalidation-alarm.js";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
 const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
@@ -68,9 +70,13 @@ export function addS3ProjectionPublication(scope, props, media) {
     assertValidPublicationConfig({ kind: "s3-projection", ...props });
     const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
     const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+    const edgeConfig = readEdgeConfig(props.staticDir);
     const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
         runtime: cloudfront.FunctionRuntime.JS_2_0,
-        code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), edgeConfig.rules, {
+            negotiateMarkdown: edgeConfig.negotiateMarkdown,
+            directoryTwins: edgeConfig.directoryTwins,
+        })),
         keyValueStore,
     });
     const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/publication/s3-projection.ts

@@ -10,11 +10,13 @@ import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import type { Construct } from "constructs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
 import { addRenditionsFunction, type RenditionsFunction } from "./renditions-function";
 import { RENDITIONS_FUNCTION_NAME_ENV, type RenditionsPlan } from "./renditions-settings";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules";
 import { addInvalidationPathAlarm } from "./invalidation-alarm";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
 
@@ -110,9 +112,15 @@ export function addS3ProjectionPublication(
   const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
 
   const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+  const edgeConfig = readEdgeConfig(props.staticDir);
   const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
     runtime: cloudfront.FunctionRuntime.JS_2_0,
-    code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+    code: cloudfront.FunctionCode.fromInline(
+      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), edgeConfig.rules, {
+        negotiateMarkdown: edgeConfig.negotiateMarkdown,
+        directoryTwins: edgeConfig.directoryTwins,
+      }),
+    ),
     keyValueStore,
   });
   const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/site-backend-config.js

@@ -1,4 +1,23 @@
 export const MAXIMUM_HTML_S_MAXAGE_SECONDS = 86400;
+const MONITOR_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+export function validateMonitoringConfig(monitoring) {
+    if (monitoring === undefined)
+        return [];
+    if (typeof monitoring !== "object" || monitoring === null || Array.isArray(monitoring)) {
+        return ["monitoring must be an object"];
+    }
+    const config = monitoring;
+    if (config.emailMonitorId !== undefined
+        && (typeof config.emailMonitorId !== "string" || !MONITOR_ID_PATTERN.test(config.emailMonitorId))) {
+        return ["monitoring.emailMonitorId must be a lowercase monitor id (1-63 letters, digits, or hyphens)"];
+    }
+    return [];
+}
+export function assertValidMonitoringConfig(monitoring) {
+    const problems = validateMonitoringConfig(monitoring);
+    if (problems.length > 0)
+        throw new Error(`Invalid backend.monitoring: ${problems.join("; ")}`);
+}
 const CLOUDFRONT_DISTRIBUTION_ARN = /^arn:aws[a-z-]*:cloudfront::\d{12}:distribution\/[A-Z0-9]+$/;
 function isRelativePathWithoutParentSegments(value) {
     if (value === "" || value.startsWith("/") || value.includes("\\"))

package/amplify/site-backend-config.ts

@@ -40,6 +40,31 @@ export type PapyrusPublicationCacheConfig = {
 
 export const MAXIMUM_HTML_S_MAXAGE_SECONDS = 86400;
 
+export type PapyrusMonitoringConfig = {
+  /** Existing shared Monitoring partition that stores this site's private email receipts. */
+  emailMonitorId?: string;
+};
+
+const MONITOR_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+
+export function validateMonitoringConfig(monitoring: unknown): string[] {
+  if (monitoring === undefined) return [];
+  if (typeof monitoring !== "object" || monitoring === null || Array.isArray(monitoring)) {
+    return ["monitoring must be an object"];
+  }
+  const config = monitoring as { emailMonitorId?: unknown };
+  if (config.emailMonitorId !== undefined
+    && (typeof config.emailMonitorId !== "string" || !MONITOR_ID_PATTERN.test(config.emailMonitorId))) {
+    return ["monitoring.emailMonitorId must be a lowercase monitor id (1-63 letters, digits, or hyphens)"];
+  }
+  return [];
+}
+
+export function assertValidMonitoringConfig(monitoring: unknown): void {
+  const problems = validateMonitoringConfig(monitoring);
+  if (problems.length > 0) throw new Error(`Invalid backend.monitoring: ${problems.join("; ")}`);
+}
+
 export type PapyrusPublicationConfig = {
   kind: "s3-projection";
   /** Site repo path (relative, `.py`) of the SiteProjector bundled into content-actions as `site_projector`. */
@@ -138,6 +163,8 @@ export type PapyrusSiteBackendConfig = {
    */
   productionAppId?: string;
   auth?: PapyrusAuthConfig;
+  /** Shared Monitoring partition used by private email intake for this publication. */
+  monitoring?: PapyrusMonitoringConfig;
   /**
    * Maximum number of data model nested stacks CloudFormation creates at once.
    * Stacks are chained in waves of this size so a new AWS account is not hit
@@ -145,6 +172,13 @@ export type PapyrusSiteBackendConfig = {
    * DependsOn ordering; no resource changes. Default 12; 0 turns it off.
    */
   resolverWaveSize?: number;
+  /**
+   * Optional model groups to leave out of the data API (see `OPTIONAL_MODEL_GROUPS`; today `editions`).
+   * CloudFormation allows 2,500 resources per stack operation, nested stacks included, and a fresh create of the full
+   * model set exceeds it. Deploy a new site once with a group excluded, then remove the exclusion and deploy again:
+   * the second deploy is an ordinary update that adds the models.
+   */
+  excludeModelGroups?: string[];
   /** Static reader app (Markus-static sites) that a publish rebuilds through IAM `amplify:StartJob`. */
   reader?: { amplifyAppId: string; branchName?: string };
   /** Lets the newsroom start the `staging` branch build of this CMS app. */
@@ -159,7 +193,7 @@ export type PapyrusSiteBackendConfig = {
   /**
    * SES receipt options for a site that is not the legacy p.apyr.us backend.
    * By default the site gets its own brand-named rule set that is never
-   * activated by CloudFormation (SES allows one active rule set per region).
+   * activated by CloudFormation (SES allows one active rule set per account/region).
    */
   inboundEmailSes?: {
     /** Add this site's rule to a rule set another stack owns instead of creating one. */
@@ -178,6 +212,16 @@ export type PapyrusSiteBackendConfig = {
    * Unset: no plugin, and the synthesized backend is exactly what it was before plugins existed.
    */
   plugins?: PluginRequest[];
+  /**
+   * The public form receiving endpoint every site gets (docs/public-forms.md). It accepts posts only from the site's
+   * own public hosts (distribution aliases, reader domain, revalidate URL, sign-in redirect URLs) plus these.
+   */
+  publicForms?: {
+    /** Extra https origins (or http://localhost) allowed to post, for example `https://www.example.org`. */
+    allowedOrigins?: string[];
+    /** Extra honeypot field names besides `website`. */
+    honeypotFields?: string[];
+  };
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend-names.js

@@ -68,8 +68,10 @@ export function deriveStorageBackupVaultName(identity, explicitName) {
 /**
  * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
  * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
- * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
- * its own brand-named rule set and never activates it from CloudFormation.
+ * SES allows one ACTIVE receipt rule set per account and region. A non-legacy
+ * site creates its own brand-named rule set and never activates it from
+ * CloudFormation. SES accounts that receive the same domain process their
+ * matching rules independently; the limit does not span accounts.
  */
 export function deriveReceiptRuleSetName(identity, inboundEmailDomain) {
     const name = isLegacyProductionApp(identity)

package/amplify/site-backend-names.ts

@@ -109,8 +109,10 @@ export function deriveStorageBackupVaultName(identity: SiteBackendIdentity, expl
 /**
  * The `papyrus-site-inbound-` prefix keeps a brand named `p-apyr-us` from
  * colliding with the legacy `papyrus-inbound-p-apyr-us` set.
- * SES allows one ACTIVE receipt rule set per region. A non-legacy site creates
- * its own brand-named rule set and never activates it from CloudFormation.
+ * SES allows one ACTIVE receipt rule set per account and region. A non-legacy
+ * site creates its own brand-named rule set and never activates it from
+ * CloudFormation. SES accounts that receive the same domain process their
+ * matching rules independently; the limit does not span accounts.
  */
 export function deriveReceiptRuleSetName(identity: SiteBackendIdentity, inboundEmailDomain: string): string {
   const name = isLegacyProductionApp(identity)

package/amplify/site-backend.js

@@ -11,18 +11,26 @@ import { resolveSitePublication } from "./publication/default-publication.js";
 import { REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS, addReprojectOnDeploy, reprojectDeployToken } from "./publication/reproject-on-deploy.js";
 import { addProjectionRetries, addS3ProjectionPublication } from "./publication/s3-projection.js";
 import { planRenditions } from "./publication/renditions-settings.js";
+import { addProjectionLeaseAccess } from "./publication/projection-lease.js";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
-import { assertValidPublicationConfig } from "./site-backend-config.js";
+import { assertValidMonitoringConfig, assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
+import { applyCognitoDomainPrefix, applyGoogleEmailVerifiedMapping, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
+import { editorialChecks } from "./functions/editorial-checks/resource.js";
+import { automationView } from "./functions/automation-view/resource.js";
+import { wireAutomationView } from "./functions/automation-view/wire.js";
+import { monitoringView } from "./functions/monitoring-view/resource.js";
+import { wireEmailReferenceIntake, wireMonitoringView } from "./functions/monitoring-view/wire.js";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
+import { scopeAssignmentDataAccess } from "./functions/assignment-action/data-access.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
 import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource.js";
@@ -30,6 +38,9 @@ import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
 import { newsroomSummary } from "./functions/newsroom-summary/resource.js";
+import { derivePublicFormOrigins } from "./functions/public-forms/origins.js";
+import { publicForms } from "./functions/public-forms/resource.js";
+import { wirePublicForms } from "./functions/public-forms/wire.js";
 import { procedureAction } from "./functions/procedure-action/resource.js";
 import { readerSettings } from "./functions/reader-settings/resource.js";
 import { emailSubmissionProcessor } from "./functions/email-submission-processor/resource.js";
@@ -76,6 +87,8 @@ export function defineSiteBackend(papyrusSite) {
     const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
     if (publication !== undefined)
         assertValidPublicationConfig(publication);
+    assertValidMonitoringConfig(site.monitoring);
+    const emailMonitorId = site.monitoring?.emailMonitorId ?? "hn";
     const publicationPlan = planS3ProjectionBackend(publication);
     const renditionsPlan = planRenditions(publication, process.cwd());
     setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
@@ -85,15 +98,19 @@ export function defineSiteBackend(papyrusSite) {
     const backend = defineBackend({
         ...pluginFunctions,
         assignmentAction,
+        automationView,
         auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
-        data: defineSiteData(pluginDefinitions),
+        editorialChecks,
+        data: defineSiteData(pluginDefinitions, site.excludeModelGroups ?? []),
         knowledgeQuery,
         manageUserRole,
+        monitoringView,
         modelAttachmentUpload,
         newsroomSummary,
         procedureAction,
+        publicForms,
         readerSettings,
         emailSubmissionProcessor,
         sesInboundReceive,
@@ -101,6 +118,9 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    if (authConfig.disableGoogleOAuth !== true) {
+        applyGoogleEmailVerifiedMapping(backend.auth.stack);
+    }
     orderModelStacksInWaves(backend.data.resources.graphqlApi.node.scope, Object.keys(backend.data.resources.tables), site.resolverWaveSize ?? DEFAULT_RESOLVER_WAVE_SIZE);
     const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
     if (authConfig.applyCognitoDomainPrefix === true
@@ -304,11 +324,21 @@ export function defineSiteBackend(papyrusSite) {
     }
     grantCorporaRead(backend.knowledgeQuery.resources.lambda);
     grantNewsroomReadWrite(backend.assignmentAction.resources.lambda);
+    scopeAssignmentDataAccess(backend.assignmentAction.resources.lambda, backend.data.resources.graphqlApi.arn);
     grantNewsroomReadWrite(backend.categoryAction.resources.lambda);
     grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda);
     const contentActionsLambda = backend.contentActions.resources.lambda;
     grantNewsroomReadWriteDelete(contentActionsLambda);
+    if ((activeBrand?.corpusKey ?? "").trim() !== "") {
+        // A deploy creates the publication's canonical corpus from the brand when the backend has none.
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_CORPUS_KEY", (activeBrand?.corpusKey ?? "").trim());
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_NAME", (activeBrand?.publicationName ?? activeBrand?.corpusKey ?? "").trim());
+    }
+    // AppSync validates the token; pending intake additionally binds its actor
+    // and publication to this deployment's pool and existing API endpoint.
+    contentActionsLambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
     contentActionsLambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    wireEmailReferenceIntake(contentActionsLambda, emailMonitorId);
     contentActionsLambda.addToRolePolicy(new PolicyStatement({
         actions: ["appsync:GraphQL"],
         resources: ["*"],
@@ -340,6 +370,7 @@ export function defineSiteBackend(papyrusSite) {
     }
     if (s3ProjectionPublication !== undefined) {
         addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+        addProjectionLeaseAccess(contentActionsLambda);
     }
     const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
     for (const [name, value] of Object.entries(publicationWiring.environment)) {
@@ -444,7 +475,7 @@ export function defineSiteBackend(papyrusSite) {
             resources: ["*"],
         }));
         const inboundEventStack = Stack.of(receiveLambda);
-        // SES allows one active receipt rule set per region, so a non-legacy site
+        // SES allows one active receipt rule set per account and region, so a non-legacy site
         // creates its own brand-named rule set and never activates it here.
         const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
         if (inboundSesPlan.createReceiptRules) {
@@ -548,8 +579,21 @@ export function defineSiteBackend(papyrusSite) {
                 : []),
         ],
     }));
+    const publicFormsEndpoint = wirePublicForms(backend, {
+        allowedOrigins: derivePublicFormOrigins({
+            explicit: site.publicForms?.allowedOrigins,
+            hosts: [activeBrand?.readerDeployment?.domain, ...(publication?.distribution?.aliases ?? [])],
+            urls: [site.revalidateBaseUrl, ...siteAuthRedirectUrls(authConfig)],
+        }),
+        honeypotFields: site.publicForms?.honeypotFields,
+    });
     backend.addOutput({
         custom: {
+            publicForms: { endpoint: publicFormsEndpoint },
+            // Lets the operator CLI re-project on publish without PAPYRUS_PUBLICATION_KIND / PAPYRUS_CONTENT_ACTIONS_FUNCTION (PPY-0c0b75).
+            publication: s3ProjectionPublication !== undefined
+                ? { kind: "s3-projection", contentActionsFunction: contentActionsLambda.functionName }
+                : null,
             prospectusSignIn: prospectusGoogleOnlyClient
                 ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
                 : null,
@@ -584,6 +628,9 @@ export function defineSiteBackend(papyrusSite) {
                 : null,
         },
     });
+    wireEditorialChecks(backend);
+    wireMonitoringView(backend, emailMonitorId);
+    wireAutomationView(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }

package/amplify/site-backend.ts

@@ -14,9 +14,10 @@ import { resolveSitePublication } from "./publication/default-publication";
 import { REPROJECT_ON_DEPLOY_TIMEOUT_SECONDS, addReprojectOnDeploy, reprojectDeployToken } from "./publication/reproject-on-deploy";
 import { addProjectionRetries, addS3ProjectionPublication, type S3ProjectionPublication } from "./publication/s3-projection";
 import { planRenditions } from "./publication/renditions-settings";
+import { addProjectionLeaseAccess } from "./publication/projection-lease";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
-import { assertValidPublicationConfig } from "./site-backend-config";
+import { assertValidMonitoringConfig, assertValidPublicationConfig } from "./site-backend-config";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
 import {
   revalidateDistributionEnvironment,
@@ -24,12 +25,19 @@ import {
   validateRevalidateDistributionIds,
 } from "./revalidate-invalidation-settings";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
+import { applyCognitoDomainPrefix, applyGoogleEmailVerifiedMapping, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
+import { editorialChecks } from "./functions/editorial-checks/resource";
+import { automationView } from "./functions/automation-view/resource";
+import { wireAutomationView } from "./functions/automation-view/wire";
+import { monitoringView } from "./functions/monitoring-view/resource";
+import { wireEmailReferenceIntake, wireMonitoringView } from "./functions/monitoring-view/wire";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
 import { assignmentAction } from "./functions/assignment-action/resource";
+import { scopeAssignmentDataAccess } from "./functions/assignment-action/data-access";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
 import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource";
@@ -37,6 +45,9 @@ import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
 import { newsroomSummary } from "./functions/newsroom-summary/resource";
+import { derivePublicFormOrigins } from "./functions/public-forms/origins";
+import { publicForms } from "./functions/public-forms/resource";
+import { wirePublicForms } from "./functions/public-forms/wire";
 import { procedureAction } from "./functions/procedure-action/resource";
 import { readerSettings } from "./functions/reader-settings/resource";
 import { emailSubmissionProcessor } from "./functions/email-submission-processor/resource";
@@ -97,6 +108,8 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   };
   const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
   if (publication !== undefined) assertValidPublicationConfig(publication);
+  assertValidMonitoringConfig(site.monitoring);
+  const emailMonitorId = site.monitoring?.emailMonitorId ?? "hn";
   const publicationPlan = planS3ProjectionBackend(publication);
   const renditionsPlan = planRenditions(publication, process.cwd());
   setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
@@ -106,15 +119,19 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const backend = defineBackend({
     ...pluginFunctions,
     assignmentAction,
+    automationView,
     auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
-    data: defineSiteData(pluginDefinitions),
+    editorialChecks,
+    data: defineSiteData(pluginDefinitions, site.excludeModelGroups ?? []),
     knowledgeQuery,
     manageUserRole,
+    monitoringView,
     modelAttachmentUpload,
     newsroomSummary,
     procedureAction,
+    publicForms,
     readerSettings,
     emailSubmissionProcessor,
     sesInboundReceive,
@@ -123,6 +140,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  if (authConfig.disableGoogleOAuth !== true) {
+    applyGoogleEmailVerifiedMapping(backend.auth.stack);
+  }
+
   orderModelStacksInWaves(
     backend.data.resources.graphqlApi.node.scope as Construct,
     Object.keys(backend.data.resources.tables),
@@ -387,14 +408,30 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   }
   grantCorporaRead(backend.knowledgeQuery.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.assignmentAction.resources.lambda as LambdaFunction);
+  scopeAssignmentDataAccess(
+    backend.assignmentAction.resources.lambda as LambdaFunction,
+    backend.data.resources.graphqlApi.arn,
+  );
   grantNewsroomReadWrite(backend.categoryAction.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda as LambdaFunction);
   const contentActionsLambda = backend.contentActions.resources.lambda as LambdaFunction;
   grantNewsroomReadWriteDelete(contentActionsLambda);
+  if ((activeBrand?.corpusKey ?? "").trim() !== "") {
+    // A deploy creates the publication's canonical corpus from the brand when the backend has none.
+    contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_CORPUS_KEY", (activeBrand?.corpusKey ?? "").trim());
+    contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_NAME", (activeBrand?.publicationName ?? activeBrand?.corpusKey ?? "").trim());
+  }
+  // AppSync validates the token; pending intake additionally binds its actor
+  // and publication to this deployment's pool and existing API endpoint.
+  contentActionsLambda.addEnvironment(
+    "PAPYRUS_USER_POOL_ISSUER",
+    `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`,
+  );
   contentActionsLambda.addEnvironment(
     "PAPYRUS_GRAPHQL_ENDPOINT",
     backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
   );
+  wireEmailReferenceIntake(contentActionsLambda, emailMonitorId);
   contentActionsLambda.addToRolePolicy(
     new PolicyStatement({
       actions: ["appsync:GraphQL"],
@@ -430,6 +467,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   }
   if (s3ProjectionPublication !== undefined) {
     addProjectionRetries(contentActionsLambda, s3ProjectionPublication.deadLetterQueue);
+    addProjectionLeaseAccess(contentActionsLambda);
   }
   const publicationWiring = contentActionsPublicationWiring(s3ProjectionPublication);
   for (const [name, value] of Object.entries(publicationWiring.environment)) {
@@ -570,7 +608,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
     const inboundEventStack = Stack.of(receiveLambda);
 
-    // SES allows one active receipt rule set per region, so a non-legacy site
+    // SES allows one active receipt rule set per account and region, so a non-legacy site
     // creates its own brand-named rule set and never activates it here.
     const inboundSesPlan = planInboundEmailSes(siteBackendIdentity, enableInboundEmail, site.inboundEmailSes);
     if (inboundSesPlan.createReceiptRules) {
@@ -685,8 +723,23 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     }),
   );
 
+  const publicFormsEndpoint = wirePublicForms(backend, {
+    allowedOrigins: derivePublicFormOrigins({
+      explicit: site.publicForms?.allowedOrigins,
+      hosts: [activeBrand?.readerDeployment?.domain, ...(publication?.distribution?.aliases ?? [])],
+      urls: [site.revalidateBaseUrl, ...siteAuthRedirectUrls(authConfig)],
+    }),
+    honeypotFields: site.publicForms?.honeypotFields,
+  });
+
   backend.addOutput({
     custom: {
+      publicForms: { endpoint: publicFormsEndpoint },
+      // Lets the operator CLI re-project on publish without PAPYRUS_PUBLICATION_KIND / PAPYRUS_CONTENT_ACTIONS_FUNCTION (PPY-0c0b75).
+      publication:
+        s3ProjectionPublication !== undefined
+          ? { kind: "s3-projection", contentActionsFunction: contentActionsLambda.functionName }
+          : null,
       prospectusSignIn: prospectusGoogleOnlyClient
         ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
         : null,
@@ -721,6 +774,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         : null,
     },
   });
+  wireEditorialChecks(backend);
+  wireMonitoringView(backend, emailMonitorId);
+  wireAutomationView(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 
   return backend;

package/app/api/auth/prospectus/sign-in/route.ts

@@ -7,3 +7,7 @@ export const runtime = "nodejs";
 export function GET(request: NextRequest) {
   return handleProspectusSignInStart(request);
 }
+
+export function POST(request: NextRequest) {
+  return handleProspectusSignInStart(request);
+}

package/app/api/newsletter/confirm/route.ts

@@ -0,0 +1,13 @@
+import type { NextRequest } from "next/server";
+import { handleNewsletterConfirm } from "../../../../lib/newsletter-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleNewsletterConfirm(request);
+}
+
+export function POST(request: NextRequest) {
+  return handleNewsletterConfirm(request);
+}

package/app/api/newsletter/preferences/route.ts

@@ -0,0 +1,13 @@
+import type { NextRequest } from "next/server";
+import { handleNewsletterPreferences } from "../../../../lib/newsletter-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleNewsletterPreferences(request);
+}
+
+export function POST(request: NextRequest) {
+  return handleNewsletterPreferences(request);
+}

package/app/api/newsletter/state/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleNewsletterState } from "../../../../lib/newsletter-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleNewsletterState(request);
+}