@anthusai/papyrus 2.0.0-next.11 → 2.0.0-next.110

package/amplify/functions/editorial-checks/schema.ts

@@ -1,12 +1,13 @@
 import { a } from "@aws-amplify/backend";
 import { editorialChecks } from "./resource";
+import { functionHandler } from "../../data/function-handler";
 
 const editors = ["editor", "admin"];
 
 /**
- * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Limatus checks
+ * Core to every site's data API. Policies, settings and editors' decisions live in Papyrus; Humanus checks
  * content against them. Editors read policies and record decisions; admins
- * manage policies and settings. Only the function (IAM) calls Limatus.
+ * manage policies and settings. Only the function (IAM) calls Humanus.
  */
 export const editorialChecksSchemaDefinitions = {
     EditorialPolicy: a
@@ -49,12 +50,41 @@ export const editorialChecksSchemaDefinitions = {
       .disableOperations(["subscriptions"])
       .secondaryIndexes((index) => [index("itemId").queryField("listEditorialFeedbackByItem")])
       .authorization((allow) => [allow.group("editor").to(["create", "read"]), allow.group("admin")]),
+    EditorialCheckRun: a
+      .model({
+        id: a.id().required(),
+        itemId: a.string().required(),
+        lineageId: a.string().required(),
+        versionNumber: a.integer().required(),
+        section: a.string(),
+        contentHash: a.string(),
+        packVersion: a.string(),
+        violations: a.integer().required(),
+        reviews: a.integer().required(),
+        findings: a.json().required(),
+        lanes: a.json(),
+        checkedAt: a.datetime().required(),
+      })
+      .disableOperations(["subscriptions"])
+      .secondaryIndexes((index) => [index("lineageId").sortKeys(["versionNumber"]).queryField("listEditorialCheckRunsByLineage")])
+      .authorization((allow) => [allow.group("editor").to(["read"]), allow.group("admin")]),
+    listEditorialStarterPacks: a
+      .query()
+      .returns(a.json())
+      .authorization((allow) => [allow.groups(editors)])
+      .handler(functionHandler("editorialChecks", editorialChecks)),
+    checkItemVersion: a
+      .mutation()
+      .arguments({ itemId: a.id().required() })
+      .returns(a.json())
+      .authorization((allow) => [allow.groups(editors)])
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     checkEditorial: a
       .query()
       .arguments({ body: a.string().required(), format: a.string(), section: a.string() })
       .returns(a.json())
       .authorization((allow) => [allow.groups(editors)])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     suggestEditorialRewrite: a
       .query()
       .arguments({
@@ -67,28 +97,28 @@ export const editorialChecksSchemaDefinitions = {
       })
       .returns(a.json())
       .authorization((allow) => [allow.groups(editors)])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     draftEditorialQuestions: a
       .query()
       .arguments({ title: a.string().required(), guidance: a.string().required(), examples: a.json() })
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     tryEditorialPolicy: a
       .query()
       .arguments({ policy: a.json().required(), text: a.string().required(), format: a.string() })
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     importEditorialStarterPack: a
       .mutation()
       .arguments({ name: a.string().required() })
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
     recalibrateEditorialPolicies: a
       .mutation()
       .returns(a.json())
       .authorization((allow) => [allow.group("admin")])
-      .handler(a.handler.function(editorialChecks)),
+      .handler(functionHandler("editorialChecks", editorialChecks)),
   };

package/amplify/functions/editorial-checks/wire.js

@@ -10,6 +10,10 @@ export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
     "Query/fields/listEditorialFeedbacks",
     "Mutation/fields/createEditorialPolicy",
     "Mutation/fields/updateEditorialPolicy",
+    "Query/fields/getItem",
+    "Query/fields/getEditorialCheckRun",
+    "Mutation/fields/createEditorialCheckRun",
+    "Mutation/fields/updateEditorialCheckRun",
 ];
 export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];
 /**

package/amplify/functions/editorial-checks/wire.ts

@@ -12,6 +12,10 @@ export const EDITORIAL_CHECKS_FUNCTION_FIELDS = [
   "Query/fields/listEditorialFeedbacks",
   "Mutation/fields/createEditorialPolicy",
   "Mutation/fields/updateEditorialPolicy",
+  "Query/fields/getItem",
+  "Query/fields/getEditorialCheckRun",
+  "Mutation/fields/createEditorialCheckRun",
+  "Mutation/fields/updateEditorialCheckRun",
 ];
 
 export const EDITORIAL_CHECKS_SECRETS = ["TYPESAFE_API_KEY", "OPENAI_API_KEY"];

package/amplify/functions/monitoring-view/handler.py

@@ -0,0 +1,11 @@
+"""The monitoring-view function: `monitoringOverview` for editors and admins, read-only."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from papyrus_content.monitoring_view import handle
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    return handle(event)

package/amplify/functions/monitoring-view/resource.js

@@ -0,0 +1,24 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction((scope) => new Function(scope, "papyrus-monitoring-view", {
+    runtime: Runtime.PYTHON_3_12,
+    architecture: Architecture.ARM_64,
+    handler: "handler.handler",
+    timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+    memorySize: 256,
+    code: pythonLambdaCode({ functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true }, [
+        "bash",
+        "-c",
+        [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+        ].join(" && "),
+    ]),
+}), { resourceGroupName: "data" });

package/amplify/functions/monitoring-view/resource.ts

@@ -0,0 +1,34 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+/** AppSync gives a resolver 30 seconds; a read of one small table needs a few. */
+export const MONITORING_VIEW_TIMEOUT_SECONDS = 15;
+
+/** stdlib plus the runtime's boto3: the bundle is `papyrus_content` and nothing else. */
+export const monitoringView = defineFunction(
+  (scope: Construct) =>
+    new Function(scope, "papyrus-monitoring-view", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(MONITORING_VIEW_TIMEOUT_SECONDS),
+      memorySize: 256,
+      code: pythonLambdaCode(
+        { functionDir: "monitoring-view", modules: ["papyrus_content"], noDeps: true },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_content",
+            "cp amplify/functions/monitoring-view/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+          ].join(" && "),
+        ],
+      ),
+    }),
+  { resourceGroupName: "data" },
+);

package/amplify/functions/monitoring-view/schema.js

@@ -0,0 +1,29 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource.js";
+import { functionHandler } from "../../data/function-handler.js";
+const editors = ["editor", "admin"];
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+    monitoringOverview: a
+        .query()
+        .arguments({ scope: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
+    monitoringEmailSubmission: a
+        .query()
+        .arguments({ receiptId: a.string().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
+    monitoringResolveEmailArticleLink: a
+        .mutation()
+        .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
+};

package/amplify/functions/monitoring-view/schema.ts

@@ -0,0 +1,31 @@
+import { a } from "@aws-amplify/backend";
+import { monitoringView } from "./resource";
+import { functionHandler } from "../../data/function-handler";
+
+const editors = ["editor", "admin"];
+
+/**
+ * Core to every site's data API. The Monitoring page reads the shared monitoring pipeline through
+ * this one query. AppSync admits editors and admins only; the function checks the groups again,
+ * and returns the whole shared pipeline to admins alone.
+ */
+export const monitoringViewSchemaDefinitions = {
+  monitoringOverview: a
+    .query()
+    .arguments({ scope: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
+  monitoringEmailSubmission: a
+    .query()
+    .arguments({ receiptId: a.string().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
+  monitoringResolveEmailArticleLink: a
+    .mutation()
+    .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
+};

package/amplify/functions/monitoring-view/wire.js

@@ -0,0 +1,64 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region, account) {
+    const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+    return [table, `${table}/index/routing`];
+}
+export function monitoringViewParameterArn(region, account) {
+    return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend, emailMonitorId = "hn") {
+    const lambda = backend.monitoringView.resources.lambda;
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account),
+    }));
+    // Resolving a selected newsletter article records its destination in the
+    // same receipt partition. The editor-facing resolver validates the receipt
+    // and candidate before this single-key write.
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["dynamodb:PutItem"],
+        resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
+    }));
+}
+/** Lets the authenticated Reference-intake action verify a selected email receipt. */
+export function wireEmailReferenceIntake(lambda, emailMonitorId = "hn") {
+    const stack = Stack.of(lambda);
+    lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: MONITORING_VIEW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
+    }));
+}

package/amplify/functions/monitoring-view/wire.ts

@@ -0,0 +1,81 @@
+import { Stack } from "aws-cdk-lib";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { Function as LambdaFunction } from "aws-cdk-lib/aws-lambda";
+
+/** The monitoring stack writes the table's name here (infra/monitoring/papyrus-monitoring.yaml). */
+export const MONITORING_TABLE_PARAMETER = "/papyrus/monitoring/table-name";
+
+/** Reads only: a single item or a key-range query. No Scan, no writes, no other table. */
+export const MONITORING_VIEW_TABLE_ACTIONS = ["dynamodb:GetItem", "dynamodb:Query"];
+
+/**
+ * The monitoring table is auto-named by CloudFormation (`papyrus-monitoring-MonitoringTable-<id>`), so
+ * the grant is the stack's table name prefix, not a wildcard on the account.
+ */
+export function monitoringViewTableArns(region: string, account: string): string[] {
+  const table = `arn:aws:dynamodb:${region}:${account}:table/papyrus-monitoring-MonitoringTable-*`;
+  return [table, `${table}/index/routing`];
+}
+
+export function monitoringViewParameterArn(region: string, account: string): string {
+  return `arn:aws:ssm:${region}:${account}:parameter${MONITORING_TABLE_PARAMETER}`;
+}
+
+/**
+ * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
+ * account simply finds no parameter and the page says monitoring is not configured.
+ */
+export function wireMonitoringView(backend: any, emailMonitorId = "hn"): void {
+  const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account),
+    }),
+  );
+  // Resolving a selected newsletter article records its destination in the
+  // same receipt partition. The editor-facing resolver validates the receipt
+  // and candidate before this single-key write.
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["dynamodb:PutItem"],
+      resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
+    }),
+  );
+}
+
+/** Lets the authenticated Reference-intake action verify a selected email receipt. */
+export function wireEmailReferenceIntake(lambda: LambdaFunction, emailMonitorId = "hn"): void {
+  const stack = Stack.of(lambda);
+  lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["ssm:GetParameter"],
+      resources: [monitoringViewParameterArn(stack.region, stack.account)],
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: MONITORING_VIEW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
+    }),
+  );
+}

package/amplify/functions/public-forms/core.js

@@ -0,0 +1,247 @@
+import { createHash, randomUUID } from "node:crypto";
+/**
+ * The public form receiving endpoint, without any AWS in it: `handlePublicFormRequest` takes the Function URL
+ * event plus a store and a rate limiter, so every rule here is exercised by `scripts/test-public-forms.ts`.
+ *
+ * Contract (docs/public-forms.md): POST JSON from one of the site's own origins; the answer never reflects input.
+ */
+export const FORM_SUBMISSION_MESSAGE_KIND = "form_submission";
+export const FORM_SUBMISSION_MESSAGE_DOMAIN = "inbox";
+export const FORM_SUBMISSION_FEED_KEY = "messages";
+export const NEWSLETTER_FORM_ID = "newsletter";
+export const NEWSLETTER_MESSAGE_TYPE = "newsletter_signup";
+export const DEFAULT_FORM_ID = "contact";
+export const DEFAULT_HONEYPOT_FIELDS = ["website"];
+export const DEFAULT_PUBLIC_FORMS_CONFIG = {
+    allowedOrigins: [],
+    honeypotFields: DEFAULT_HONEYPOT_FIELDS,
+    maxBodyBytes: 16 * 1024,
+    maxFields: 20,
+    maxValueLength: 5000,
+    ipLimit: 10,
+    ipWindowSeconds: 600,
+    formLimitPerHour: 120,
+    siteLimitPerHour: 400,
+};
+const FORM_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const FIELD_NAME = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const EMAIL = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
+export function parseOrigins(value) {
+    const origins = [];
+    for (const entry of (value ?? "").split(",")) {
+        const trimmed = entry.trim();
+        if (trimmed === "")
+            continue;
+        try {
+            const url = new URL(trimmed);
+            if (url.protocol === "https:" || url.hostname === "localhost")
+                origins.push(url.origin);
+        }
+        catch {
+            // An unparsable origin is dropped: the allow-list can only get stricter.
+        }
+    }
+    return [...new Set(origins)];
+}
+function positiveInteger(value, fallback) {
+    const parsed = Number.parseInt(value ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+export function configFromEnvironment(env) {
+    const honeypots = (env.PAPYRUS_PUBLIC_FORMS_HONEYPOTS ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+    return {
+        ...DEFAULT_PUBLIC_FORMS_CONFIG,
+        allowedOrigins: parseOrigins(env.PAPYRUS_PUBLIC_FORMS_ORIGINS),
+        honeypotFields: [...new Set([...DEFAULT_HONEYPOT_FIELDS, ...honeypots])],
+        ipLimit: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_IP_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.ipLimit),
+        formLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_FORM_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.formLimitPerHour),
+        siteLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_SITE_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.siteLimitPerHour),
+    };
+}
+function reply(statusCode, body, headers = {}) {
+    return {
+        statusCode,
+        headers: { "Cache-Control": "no-store", "Content-Type": "application/json", "X-Content-Type-Options": "nosniff", ...headers },
+        body: body === null ? "" : JSON.stringify(body),
+    };
+}
+function header(event, name) {
+    const headers = event.headers ?? {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === name && typeof value === "string")
+            return value;
+    }
+    return "";
+}
+function clean(value, multiline) {
+    const stripped = value.replace(CONTROL, "").replace(/\r\n?/g, "\n");
+    return (multiline ? stripped : stripped.replace(/\n/g, " ")).trim();
+}
+function parseSubmission(event, config) {
+    const raw = event.isBase64Encoded === true ? Buffer.from(event.body ?? "", "base64").toString("utf8") : (event.body ?? "");
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, error: "invalid-json" };
+    }
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+        return { ok: false, error: "invalid-body" };
+    const entries = Object.entries(payload);
+    if (entries.length > config.maxFields)
+        return { ok: false, error: "too-many-fields" };
+    const fields = {};
+    let formId = "";
+    let page = "";
+    let honeypotFilled = false;
+    for (const [name, value] of entries) {
+        if (!FIELD_NAME.test(name))
+            return { ok: false, error: "invalid-field" };
+        if (value === null || value === undefined)
+            continue;
+        if (typeof value !== "string")
+            return { ok: false, error: "invalid-field" };
+        if (value.length > config.maxValueLength)
+            return { ok: false, error: "field-too-long" };
+        if (config.honeypotFields.includes(name)) {
+            if (value.trim() !== "")
+                honeypotFilled = true;
+            continue;
+        }
+        if (name === "form")
+            formId = value.trim().toLowerCase();
+        else if (name === "page")
+            page = clean(value, false).slice(0, 500);
+        else
+            fields[name] = clean(value, name === "message");
+    }
+    return { ok: true, formId, fields, page, honeypotFilled };
+}
+function queryFormId(event) {
+    const match = /(?:^|&)form=([^&]*)/.exec(event.rawQueryString ?? "");
+    if (match === null)
+        return "";
+    try {
+        return decodeURIComponent(match[1]).trim().toLowerCase();
+    }
+    catch {
+        return "";
+    }
+}
+function ipSubject(ip) {
+    return createHash("sha256").update(`papyrus-public-forms:${ip}`).digest("hex").slice(0, 32);
+}
+export function buildSubmissionRecord(input) {
+    const { formId, fields } = input;
+    const newsletter = formId === NEWSLETTER_FORM_ID;
+    const name = fields.name ?? "";
+    const email = fields.email ?? "";
+    const topic = fields.topic ?? "";
+    const message = fields.message ?? "";
+    const who = name !== "" ? (email !== "" ? `${name} <${email}>` : name) : email;
+    const headline = newsletter ? "Newsletter signup" : topic !== "" ? `${formId}: ${topic}` : formId;
+    const lines = [`Form: ${formId}`];
+    for (const [key, value] of Object.entries(fields)) {
+        if (key === "message" || value === "")
+            continue;
+        lines.push(`${key}: ${value}`);
+    }
+    if (input.page !== "")
+        lines.push(`page: ${input.page}`);
+    const content = message !== "" ? `${lines.join("\n")}\n\n${message}` : lines.join("\n");
+    const summarySource = message !== "" ? message.replace(/\s+/g, " ") : "";
+    const summary = `${headline}${who !== "" ? ` from ${who}` : ""}${summarySource !== "" ? `: ${summarySource}` : ""}`.slice(0, 200);
+    return {
+        id: input.id,
+        messageKind: FORM_SUBMISSION_MESSAGE_KIND,
+        messageDomain: FORM_SUBMISSION_MESSAGE_DOMAIN,
+        messageType: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+        status: "active",
+        summary,
+        content,
+        source: "public-form",
+        authorLabel: who !== "" ? who.slice(0, 200) : "Anonymous visitor",
+        searchVisibility: "private",
+        responseTarget: "none",
+        responseStatus: "COMPLETED",
+        metadata: JSON.stringify({
+            kind: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+            formId,
+            topic,
+            fields,
+            page: input.page,
+            origin: input.origin,
+            receivedAt: input.receivedAt,
+        }),
+        createdAt: input.receivedAt,
+        updatedAt: input.receivedAt,
+        newsroomFeedKey: FORM_SUBMISSION_FEED_KEY,
+    };
+}
+export async function handlePublicFormRequest(event, config, deps) {
+    const method = (event.requestContext?.http?.method ?? "").toUpperCase();
+    const origin = header(event, "origin");
+    const allowed = origin !== "" && config.allowedOrigins.includes(origin);
+    const cors = allowed
+        ? {
+            "Access-Control-Allow-Origin": origin,
+            "Access-Control-Allow-Methods": "POST, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type",
+            "Access-Control-Max-Age": "600",
+            Vary: "Origin",
+        }
+        : { Vary: "Origin" };
+    if (method === "OPTIONS")
+        return allowed ? reply(204, null, cors) : reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+    if (method !== "POST")
+        return reply(405, { ok: false, error: "method-not-allowed" }, { ...cors, Allow: "POST, OPTIONS" });
+    if (!allowed)
+        return reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+    if (!/^application\/json\s*(;|$)/i.test(header(event, "content-type")))
+        return reply(415, { ok: false, error: "unsupported-media-type" }, cors);
+    const bodyBytes = Buffer.byteLength(event.body ?? "", event.isBase64Encoded === true ? "base64" : "utf8");
+    if (bodyBytes > config.maxBodyBytes)
+        return reply(413, { ok: false, error: "payload-too-large" }, cors);
+    const parsed = parseSubmission(event, config);
+    if (!parsed.ok)
+        return reply(400, { ok: false, error: parsed.error }, cors);
+    // A filled honeypot looks like success to the bot and stores nothing.
+    if (parsed.honeypotFilled)
+        return reply(200, { ok: true }, cors);
+    const formId = parsed.formId || queryFormId(event) || DEFAULT_FORM_ID;
+    if (!FORM_ID.test(formId))
+        return reply(400, { ok: false, error: "invalid-form" }, cors);
+    const { fields } = parsed;
+    const email = fields.email ?? "";
+    if (email !== "" && (email.length > 254 || !EMAIL.test(email)))
+        return reply(400, { ok: false, error: "invalid-email" }, cors);
+    if (formId === NEWSLETTER_FORM_ID && email === "")
+        return reply(400, { ok: false, error: "email-required" }, cors);
+    if (email === "" && (fields.message ?? "") === "")
+        return reply(400, { ok: false, error: "empty-submission" }, cors);
+    const subject = ipSubject(event.requestContext?.http?.sourceIp ?? "unknown");
+    let within;
+    try {
+        within =
+            (await deps.limiter.hit("ip", subject, config.ipWindowSeconds, config.ipLimit))
+                && (await deps.limiter.hit("form", formId, 3600, config.formLimitPerHour))
+                && (await deps.limiter.hit("site", "all", 3600, config.siteLimitPerHour));
+    }
+    catch {
+        return reply(503, { ok: false, error: "unavailable" }, cors);
+    }
+    if (!within)
+        return reply(429, { ok: false, error: "rate-limited" }, { ...cors, "Retry-After": "600" });
+    const receivedAt = (deps.now ?? (() => new Date()))().toISOString();
+    const id = (deps.newId ?? (() => `form-${randomUUID().replace(/-/g, "")}`))();
+    try {
+        await deps.store.save(buildSubmissionRecord({ id, formId, fields, page: parsed.page, origin, receivedAt }));
+    }
+    catch {
+        // Never pretend a submission was received when it was not.
+        return reply(500, { ok: false, error: "store-failed" }, cors);
+    }
+    return reply(200, { ok: true }, cors);
+}