@anthusai/papyrus 2.0.0-next.50 → 2.0.0-next.52

package/amplify/plugins/reader-steering/function/ai_moderation.py

@@ -38,6 +38,20 @@ REASON_PREFIX = "AI: "
 PARAMETER_NAME = re.compile(r"/papyrus/[a-z0-9][a-z0-9-]{0,62}/openai-api-key")
 
 
+# Structured Outputs: the API itself constrains the answer to this schema (strict), so no "json" wording is needed in the input.
+VERDICT_FORMAT: dict[str, Any] = {
+    "type": "json_schema",
+    "name": "moderation_verdict",
+    "strict": True,
+    "schema": {
+        "type": "object",
+        "properties": {"verdict": {"type": "string", "enum": [ALLOW, HIDE]}, "reason": {"type": "string"}},
+        "required": ["verdict", "reason"],
+        "additionalProperties": False,
+    },
+}
+
+
 class ModelOutputError(ValueError):
     pass
 
@@ -58,7 +72,7 @@ def load_prompt(path: str = PROMPT_FILE) -> str:
 
 
 def parse_verdict(text: Any) -> Verdict:
-    """A strict reading of the model's answer: one JSON object, ``decision`` allow or hide, a short plain reason."""
+    """A strict reading of the model's answer: one JSON object, ``verdict`` (or the older ``decision``) allow or hide, a short plain reason."""
     if not isinstance(text, str):
         raise ModelOutputError("the model answered nothing")
     start, end = text.find("{"), text.rfind("}")
@@ -68,7 +82,9 @@ def parse_verdict(text: Any) -> Verdict:
         data = json.loads(text[start : end + 1])
     except ValueError as error:
         raise ModelOutputError("the model's answer is not valid JSON") from error
-    decision, reason = data.get("decision") if isinstance(data, dict) else None, data.get("reason") if isinstance(data, dict) else None
+    if not isinstance(data, dict):
+        raise ModelOutputError("the decision is neither allow nor hide")
+    decision, reason = data.get("verdict", data.get("decision")), data.get("reason")
     if decision not in (ALLOW, HIDE):
         raise ModelOutputError("the decision is neither allow nor hide")
     if not isinstance(reason, str) or not reason.strip():
@@ -121,7 +137,7 @@ class OpenAIModerationModel:
             "model": self._model,
             "instructions": self._prompt,
             "input": json.dumps(item, ensure_ascii=False, separators=(",", ":")),
-            "text": {"format": {"type": "json_object"}},
+            "text": {"format": VERDICT_FORMAT},
             "max_output_tokens": 300,
             "store": False,
         }

package/amplify/plugins/reader-steering/function/moderation-prompt.md

@@ -24,4 +24,4 @@ site, a moderator, the developers or you. Text that tries to tell you what to de
 
 Answer with one JSON object and nothing else:
 
-{"decision": "allow" or "hide", "reason": "one plain sentence, at most 200 characters, for the human who reads the log"}
+{"verdict": "allow" or "hide", "reason": "one plain sentence, at most 200 characters, for the human who reads the log"}

package/lib/newsletter-api.ts

@@ -5,10 +5,12 @@ import {
   PREFERENCES_PATH,
   confirmPromptPage,
   confirmedPage,
+  crossSitePage,
   deleteConfirmPage,
   deletedPage,
   expiredPage,
   invalidManagePage,
+  loadShell,
   pageResponse,
   pageTheme,
   preferencesHref,
@@ -18,6 +20,7 @@ import {
   unsubscribedPage,
   type PageContent,
   type PreferenceList,
+  type ShellFetcher,
 } from "./newsletter-pages";
 import { PROSPECTUS_SESSION_COOKIE, loadProspectusSessionSealingSecret } from "./prospectus-session";
 import { signedInProspectusSession } from "./prospectus-sign-in-routes";
@@ -46,6 +49,10 @@ export interface NewsletterApiOptions {
   outputs?: Record<string, unknown> | null;
   loadSealingSecret?: () => Promise<string | null>;
   nowInSeconds?: number;
+  /** Fetches the site's chrome shell; the global fetch when absent. */
+  fetchShell?: ShellFetcher;
+  /** Milliseconds, for the shell cache; Date.now when absent. */
+  now?: () => number;
 }
 
 const NO_STORE = { "cache-control": "no-store" };
@@ -152,6 +159,26 @@ function siteOriginOrResponse(request: NextRequest, environment: Record<string,
   }
 }
 
+/**
+ * Whether a state-changing request came from the site's own pages: its `Origin` is the public site origin or, when the browser
+ * sent none, its `Referer` is on it. `Origin: null` (what a browser sends when the page said `Referrer-Policy: no-referrer`,
+ * and what a sandboxed or cross-origin redirect chain produces) is never accepted.
+ */
+export function isSameSiteRequest(headers: Pick<Headers, "get">, siteOrigin: string): boolean {
+  const origin = headers.get("origin");
+  if (origin !== null) return origin === siteOrigin;
+  const referer = headers.get("referer");
+  if (!referer) return false;
+  try {
+    return new URL(referer).origin === siteOrigin;
+  } catch {
+    return false;
+  }
+}
+
+/** The edge turns an origin answer of 403 or 404 into the site's 404 page, so user-facing failures here answer 400. */
+const CROSS_SITE = { status: 400 } as const;
+
 /** POST /api/newsletter/subscribe */
 export async function handleNewsletterSubscribe(request: NextRequest, options: NewsletterApiOptions = {}): Promise<NextResponse> {
   const environment = options.environment ?? process.env;
@@ -159,7 +186,7 @@ export async function handleNewsletterSubscribe(request: NextRequest, options: N
   if (!plugin) return notFoundJson();
   const site = siteOriginOrResponse(request, environment);
   if ("response" in site) return site.response;
-  if (request.headers.get("origin") !== site.origin) return failure(403, "origin_mismatch", "This request did not come from this site.");
+  if (!isSameSiteRequest(request.headers, site.origin)) return failure(CROSS_SITE.status, "origin_mismatch", "This request did not come from this site.");
   const body = await readBody(request, NEWSLETTER_SUBSCRIBE_MAXIMUM_BODY_BYTES, ["application/json"]);
   if ("response" in body) return body.response;
   let payload: Record<string, unknown>;
@@ -201,6 +228,19 @@ function pageBase(plugin: Enabled): Pick<PageContent, "siteName" | "theme"> {
   return { siteName: typeof fromName === "string" && fromName ? fromName : "this site", theme: pageTheme(plugin.settings.theme) };
 }
 
+/** Sends a page inside the site's chrome shell, or as the self-contained page when the shell is not available. */
+function replier(request: NextRequest, options: NewsletterApiOptions, environment: Record<string, string | undefined>) {
+  return async (page: PageContent, status = 200): Promise<NextResponse> => {
+    let shell: string | null = null;
+    try {
+      shell = await loadShell(publicSiteOrigin(request, environment), { fetchShell: options.fetchShell, now: options.now });
+    } catch {
+      shell = null;
+    }
+    return pageResponse(page, status, shell);
+  };
+}
+
 function configuredListNames(plugin: Enabled, ids: string[]): string[] {
   const known = Array.isArray(plugin.settings.lists) ? (plugin.settings.lists as Array<{ id?: unknown; name?: unknown }>) : [];
   return ids.flatMap((id) => {
@@ -215,25 +255,26 @@ export async function handleNewsletterConfirmPage(request: NextRequest, options:
   const plugin = enabledPlugin(options, environment);
   if (!plugin) return notFoundPage();
   const base = pageBase(plugin);
+  const reply = replier(request, options, environment);
   const params = request.nextUrl.searchParams;
   if (params.get("done") === "1") {
     const manage = params.get("m") ?? "";
-    return pageResponse(
+    return reply(
       confirmedPage(base, configuredListNames(plugin, listIds(params.get("l") ?? "")), NEWSLETTER_TOKEN.test(manage) ? preferencesHref(manage) : undefined),
     );
   }
   const token = params.get("t") ?? "";
-  if (!NEWSLETTER_TOKEN.test(token)) return pageResponse(expiredPage(base), 410);
-  if (!plugin.functionName) return pageResponse(unavailablePage(base), 503);
+  if (!NEWSLETTER_TOKEN.test(token)) return reply(expiredPage(base), 410);
+  if (!plugin.functionName) return reply(unavailablePage(base), 503);
   try {
     const result = await (options.invoke ?? invokeNewsletterLambda)(plugin.functionName, { action: "confirm_page_state", token });
-    if (result.body.status !== "ready") return pageResponse(expiredPage(base), 410);
+    if (result.body.status !== "ready") return reply(expiredPage(base), 410);
     const lists = Array.isArray(result.body.lists) ? (result.body.lists as Array<{ name?: unknown }>) : [];
     const names = lists.flatMap((entry) => (typeof entry.name === "string" ? [entry.name] : []));
-    return pageResponse(confirmPromptPage(base, names, token));
+    return reply(confirmPromptPage(base, names, token));
   } catch (error) {
     console.error(`Newsletter confirm page failed (${error instanceof Error ? error.name : "error"}).`);
-    return pageResponse(unavailablePage(base), 502);
+    return reply(unavailablePage(base), 502);
   }
 }
 
@@ -243,14 +284,15 @@ export async function handleNewsletterConfirmPost(request: NextRequest, options:
   const plugin = enabledPlugin(options, environment);
   if (!plugin) return notFoundPage();
   const base = pageBase(plugin);
+  const reply = replier(request, options, environment);
   const site = siteOriginOrResponse(request, environment);
   if ("response" in site) return site.response;
-  if (request.headers.get("origin") !== site.origin) return failure(403, "origin_mismatch", "This request did not come from this site.");
+  if (!isSameSiteRequest(request.headers, site.origin)) return reply(crossSitePage(base), CROSS_SITE.status);
   const body = await readBody(request, NEWSLETTER_CONFIRM_MAXIMUM_BODY_BYTES, ["application/x-www-form-urlencoded"]);
   if ("response" in body) return body.response;
   const token = new URLSearchParams(body.text).get("t") ?? "";
-  if (!NEWSLETTER_TOKEN.test(token)) return pageResponse(expiredPage(base), 410);
-  if (!plugin.functionName) return pageResponse(unavailablePage(base), 503);
+  if (!NEWSLETTER_TOKEN.test(token)) return reply(expiredPage(base), 410);
+  if (!plugin.functionName) return reply(unavailablePage(base), 503);
   try {
     const result = await (options.invoke ?? invokeNewsletterLambda)(plugin.functionName, {
       action: "confirm",
@@ -258,7 +300,7 @@ export async function handleNewsletterConfirmPost(request: NextRequest, options:
       ip: clientAddress(request.headers),
       userAgent: limited(request.headers.get("user-agent"), NEWSLETTER_USER_AGENT_CHARACTERS),
     });
-    if (result.body.status !== "confirmed") return pageResponse(expiredPage(base), 410);
+    if (result.body.status !== "confirmed") return reply(expiredPage(base), 410);
     const lists = Array.isArray(result.body.lists) ? (result.body.lists as Array<{ id?: unknown }>) : [];
     const ids = lists.flatMap((entry) => (typeof entry.id === "string" && LIST_ID.test(entry.id) ? [entry.id] : []));
     const manage = typeof result.body.manageToken === "string" && NEWSLETTER_TOKEN.test(result.body.manageToken) ? result.body.manageToken : "";
@@ -270,7 +312,7 @@ export async function handleNewsletterConfirmPost(request: NextRequest, options:
     return NextResponse.redirect(target, { status: 303, headers: { ...NO_STORE, "referrer-policy": "no-referrer" } });
   } catch (error) {
     console.error(`Newsletter confirm failed (${error instanceof Error ? error.name : "error"}).`);
-    return pageResponse(unavailablePage(base), 502);
+    return reply(unavailablePage(base), 502);
   }
 }
 
@@ -301,13 +343,14 @@ export async function handleNewsletterUnsubscribe(request: NextRequest, options:
   const plugin = enabledPlugin(options, environment);
   if (!plugin) return notFoundPage();
   const base = pageBase(plugin);
+  const reply = replier(request, options, environment);
   const query = request.nextUrl.searchParams;
   if (request.method === "GET") {
     const token = manageTokenFrom(query.get("t"));
-    if (!token) return pageResponse(invalidManagePage(base), 400);
+    if (!token) return reply(invalidManagePage(base), 400);
     const listId = listParameter(query.get("l"));
     const listName = listId ? configuredListNames(plugin, [listId])[0] ?? null : null;
-    return pageResponse(unsubscribePromptPage(base, token, listName ? listId : null, listName));
+    return reply(unsubscribePromptPage(base, token, listName ? listId : null, listName));
   }
   const body = await readBody(request, NEWSLETTER_CONFIRM_MAXIMUM_BODY_BYTES, null);
   if ("response" in body) return body.response;
@@ -317,19 +360,19 @@ export async function handleNewsletterUnsubscribe(request: NextRequest, options:
   if (!oneClick && !fromPage) return textResponse("Send List-Unsubscribe=One-Click.", 400);
   const token = manageTokenFrom(query.get("t"), form.get("t"));
   const listId = listParameter(query.get("l") ?? form.get("l"));
-  const rejected = () => (fromPage ? pageResponse(invalidManagePage(base), 400) : textResponse("Invalid link.", 400));
+  const rejected = () => (fromPage ? reply(invalidManagePage(base), 400) : textResponse("Invalid link.", 400));
   if (!token) return rejected();
-  if (!plugin.functionName) return fromPage ? pageResponse(unavailablePage(base), 503) : textResponse("Unavailable.", 503);
+  if (!plugin.functionName) return fromPage ? reply(unavailablePage(base), 503) : textResponse("Unavailable.", 503);
   try {
     const result = await call(options, plugin.functionName, { action: "unsubscribe", token, ...(listId ? { list: listId } : {}) });
     if (result.body.status !== "unsubscribed") return rejected();
     if (!fromPage) return textResponse("Unsubscribed.", 200);
     const lists = Array.isArray(result.body.lists) ? (result.body.lists as Array<{ name?: unknown }>) : [];
     const names = lists.flatMap((entry) => (typeof entry.name === "string" ? [entry.name] : []));
-    return pageResponse(unsubscribedPage(base, names, token));
+    return reply(unsubscribedPage(base, names, token));
   } catch (error) {
     console.error(`Newsletter unsubscribe failed (${error instanceof Error ? error.name : "error"}).`);
-    return fromPage ? pageResponse(unavailablePage(base), 502) : textResponse("Try again later.", 502);
+    return fromPage ? reply(unavailablePage(base), 502) : textResponse("Try again later.", 502);
   }
 }
 
@@ -341,33 +384,34 @@ export async function handleNewsletterPreferences(request: NextRequest, options:
   const plugin = enabledPlugin(options, environment);
   if (!plugin) return notFoundPage();
   const base = pageBase(plugin);
+  const reply = replier(request, options, environment);
   if (request.method === "GET") {
     const token = manageTokenFrom(request.nextUrl.searchParams.get("t"));
-    if (!token) return pageResponse(invalidManagePage(base), 400);
-    if (!plugin.functionName) return pageResponse(unavailablePage(base), 503);
+    if (!token) return reply(invalidManagePage(base), 400);
+    if (!plugin.functionName) return reply(unavailablePage(base), 503);
     try {
       const result = await call(options, plugin.functionName, { action: "preferences_state", token });
-      if (result.body.status !== "ready") return pageResponse(invalidManagePage(base), 400);
+      if (result.body.status !== "ready") return reply(invalidManagePage(base), 400);
       const lists = (Array.isArray(result.body.lists) ? result.body.lists : []) as PreferenceList[];
       const email = typeof result.body.email === "string" ? result.body.email : "";
       const notice = PREFERENCE_NOTICES[request.nextUrl.searchParams.get("msg") ?? ""];
-      return pageResponse(preferencesPage(base, { token, email, notice, lists: lists.map(({ id, name, description, subscribed }) => ({ id, name, description, subscribed })) }));
+      return reply(preferencesPage(base, { token, email, notice, lists: lists.map(({ id, name, description, subscribed }) => ({ id, name, description, subscribed })) }));
     } catch (error) {
       console.error(`Newsletter preferences failed (${error instanceof Error ? error.name : "error"}).`);
-      return pageResponse(unavailablePage(base), 502);
+      return reply(unavailablePage(base), 502);
     }
   }
   const site = siteOriginOrResponse(request, environment);
   if ("response" in site) return site.response;
-  if (request.headers.get("origin") !== site.origin) return failure(403, "origin_mismatch", "This request did not come from this site.");
+  if (!isSameSiteRequest(request.headers, site.origin)) return reply(crossSitePage(base), CROSS_SITE.status);
   const body = await readBody(request, NEWSLETTER_CONFIRM_MAXIMUM_BODY_BYTES, ["application/x-www-form-urlencoded"]);
   if ("response" in body) return body.response;
   const form = new URLSearchParams(body.text);
   const token = manageTokenFrom(form.get("t"));
-  if (!token) return pageResponse(invalidManagePage(base), 400);
-  if (!plugin.functionName) return pageResponse(unavailablePage(base), 503);
+  if (!token) return reply(invalidManagePage(base), 400);
+  if (!plugin.functionName) return reply(unavailablePage(base), 503);
   const action = form.get("action");
-  if (action === "delete" && form.get("confirm") !== "1") return pageResponse(deleteConfirmPage(base, token));
+  if (action === "delete" && form.get("confirm") !== "1") return reply(deleteConfirmPage(base, token));
   const operation =
     action === "save"
       ? { action: "update_preferences", token, lists: form.getAll("l").slice(0, MAXIMUM_LISTS).filter((id) => LIST_ID.test(id)) }
@@ -380,12 +424,12 @@ export async function handleNewsletterPreferences(request: NextRequest, options:
   try {
     const result = await call(options, plugin.functionName, operation);
     const status = result.body.status;
-    if (status === "deleted") return pageResponse(deletedPage(base));
-    if (status !== "saved" && status !== "unsubscribed") return pageResponse(invalidManagePage(base), 400);
+    if (status === "deleted") return reply(deletedPage(base));
+    if (status !== "saved" && status !== "unsubscribed") return reply(invalidManagePage(base), 400);
     const target = publicSiteUrl(`${PREFERENCES_PATH}?t=${encodeURIComponent(token)}&msg=${status}`, request, environment);
     return NextResponse.redirect(target, { status: 303, headers: { ...NO_STORE, "referrer-policy": "no-referrer" } });
   } catch (error) {
     console.error(`Newsletter preferences save failed (${error instanceof Error ? error.name : "error"}).`);
-    return pageResponse(unavailablePage(base), 502);
+    return reply(unavailablePage(base), 502);
   }
 }

package/lib/newsletter-pages.ts

@@ -2,8 +2,9 @@ import { NextResponse } from "next/server";
 
 /**
  * The small server-rendered pages of the newsletter plugin (confirm prompt, confirmed, expired).
- * Plain HTML, no scripts, themed from the plugin's public settings. Every dynamic value is escaped, the token never
- * reaches a link, and the pages are never cached or indexed.
+ * Plain HTML, no scripts. They are drawn inside the site's own chrome (the projected newsletter shell: the site's head,
+ * stylesheets, header and footer) and fall back to a self-contained page themed from the plugin's public settings. Every
+ * dynamic value is escaped, the token never reaches a link, and the pages are never cached or indexed.
  */
 export type NewsletterPageTheme = { accent: string; text: string; background: string; surface: string; muted: string; fontFamily: string };
 
@@ -62,61 +63,151 @@ function renderForm(form: FormSpec): string {
   const boxes = (form.checkboxes ?? [])
     .map(
       (box, index) =>
-        `<p class="box"><input type="checkbox" id="c${index}" name="${escapeHtml(box.name)}" value="${escapeHtml(box.value)}"${box.checked ? " checked" : ""}> <label for="c${index}">${escapeHtml(box.label)}</label></p>`,
+        `<p class="markus-newsletter-list"><input type="checkbox" id="c${index}" name="${escapeHtml(box.name)}" value="${escapeHtml(box.value)}"${box.checked ? " checked" : ""}> <label for="c${index}">${escapeHtml(box.label)}</label></p>`,
     )
     .join("");
   const buttons = form.buttons
     .map(
       (button) =>
-        `<button type="submit"${button.name ? ` name="${escapeHtml(button.name)}" value="${escapeHtml(button.value ?? "")}"` : ""}${button.secondary ? ' class="secondary"' : ""}>${escapeHtml(button.label)}</button>`,
+        `<button type="submit" class="markus-button"${button.secondary ? ' data-variant="secondary"' : ""}${button.name ? ` name="${escapeHtml(button.name)}" value="${escapeHtml(button.value ?? "")}"` : ""}>${escapeHtml(button.label)}</button>`,
     )
     .join(" ");
-  return `<form method="post" action="${escapeHtml(form.action)}">${hidden}${boxes}<p class="actions">${buttons}</p></form>`;
+  return `<form class="markus-newsletter-form" method="post" action="${escapeHtml(form.action)}">${hidden}${boxes}<p class="markus-actions">${buttons}</p></form>`;
 }
 
-export function renderPage(page: PageContent): string {
-  const { theme } = page;
+/**
+ * The content of a page, in the standard front end's own classes (`markus-document`, `markus-button`, `markus-actions`), so
+ * inside the site's chrome it takes the site's typography, colours, buttons and focus rings from the site's stylesheets.
+ */
+export function renderBody(page: PageContent): string {
   const lists = (page.lists ?? []).slice(0, MAXIMUM_LISTS_SHOWN);
   const links = (page.links ?? []).map((link) => `<p><a href="${escapeHtml(link.href)}">${escapeHtml(link.label)}</a></p>`).join("\n");
+  return `<div class="markus-document markus-newsletter-page" data-newsletter-page>
+<h1>${escapeHtml(page.heading)}</h1>
+${page.notice ? `<p class="markus-newsletter-notice" role="status">${escapeHtml(page.notice)}</p>` : ""}
+${page.paragraphs.map((paragraph) => `<p>${escapeHtml(paragraph)}</p>`).join("\n")}
+${lists.length > 0 ? `<ul>${lists.map((name) => `<li>${escapeHtml(name)}</li>`).join("")}</ul>` : ""}
+${(page.forms ?? []).map(renderForm).join("\n")}
+${links}
+</div>`;
+}
+
+/** The self-contained page, for a site whose chrome shell cannot be fetched. Themed from the plugin's settings. */
+export function renderPage(page: PageContent): string {
+  const { theme } = page;
   return `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex"><meta name="referrer" content="no-referrer">
+<meta name="robots" content="noindex">
 <title>${escapeHtml(page.heading)} - ${escapeHtml(page.siteName)}</title>
 <style>
 body{margin:0;background:${theme.background};color:${theme.text};font-family:${theme.fontFamily};line-height:1.5}
 main{max-width:34rem;margin:0 auto;padding:3rem 1.25rem}
 .site{color:${theme.muted};font-size:.95rem;margin:0 0 1.5rem}
 h1{font-size:1.6rem;line-height:1.2;margin:0 0 1rem}
-.notice{background:${theme.surface};border-left:4px solid ${theme.accent};padding:.5rem .75rem;font-weight:bold}
+.markus-newsletter-notice{background:${theme.surface};border-left:4px solid ${theme.accent};padding:.5rem .75rem;font-weight:bold}
 ul{background:${theme.surface};margin:1rem 0;padding:.75rem 1.25rem 1rem 2rem}
-.box{margin:.6rem 0}
+.markus-newsletter-list{margin:.6rem 0}
 input[type=checkbox]{width:1.1rem;height:1.1rem;vertical-align:middle}
-.actions{margin:1.25rem 0}
-button{background:${theme.accent};color:#fff;border:2px solid ${theme.accent};font:inherit;font-weight:bold;padding:.7rem 1.4rem;cursor:pointer;border-radius:4px;margin:0 .5rem .5rem 0}
-button.secondary{background:${theme.background};color:${theme.accent}}
-button:focus-visible,a:focus-visible,input:focus-visible{outline:3px solid ${theme.text};outline-offset:2px}
+.markus-actions{margin:1.25rem 0}
+.markus-button{background:${theme.accent};color:#fff;border:2px solid ${theme.accent};font:inherit;font-weight:bold;padding:.7rem 1.4rem;cursor:pointer;border-radius:4px;margin:0 .5rem .5rem 0}
+.markus-button[data-variant=secondary]{background:${theme.background};color:${theme.accent}}
+.markus-button:focus-visible,a:focus-visible,input:focus-visible{outline:3px solid ${theme.text};outline-offset:2px}
 a{color:${theme.accent}}
 </style></head><body><main>
 <p class="site">${escapeHtml(page.siteName)}</p>
-<h1>${escapeHtml(page.heading)}</h1>
-${page.notice ? `<p class="notice" role="status">${escapeHtml(page.notice)}</p>` : ""}
-${page.paragraphs.map((paragraph) => `<p>${escapeHtml(paragraph)}</p>`).join("\n")}
-${lists.length > 0 ? `<ul>${lists.map((name) => `<li>${escapeHtml(name)}</li>`).join("")}</ul>` : ""}
-${(page.forms ?? []).map(renderForm).join("\n")}
-${links}
+${renderBody(page)}
 </main></body></html>`;
 }
 
+/** Where the standard projector writes the chrome shell when the newsletter plugin is enabled. */
+export const SHELL_PATH = "/_plugins/newsletter-shell/index.html";
+export const SHELL_MARKER = "<!--papyrus:newsletter-content-->";
+export const SHELL_TTL_MS = 5 * 60 * 1000;
+const SHELL_FAILURE_TTL_MS = 30 * 1000;
+const SHELL_MAXIMUM_CHARACTERS = 512 * 1024;
+const SHELL_TIMEOUT_MS = 3000;
+
+export type ShellFetcher = (url: string) => Promise<{ status: number; contentType: string; text: string }>;
+
+export interface ShellOptions {
+  fetchShell?: ShellFetcher;
+  /** Milliseconds; for tests. */
+  now?: () => number;
+}
+
+async function fetchOverHttp(url: string): Promise<{ status: number; contentType: string; text: string }> {
+  const response = await fetch(url, { headers: { accept: "text/html" }, redirect: "manual", signal: AbortSignal.timeout(SHELL_TIMEOUT_MS) });
+  return { status: response.status, contentType: response.headers.get("content-type") ?? "", text: await response.text() };
+}
+
+/**
+ * The shell as a template: the site's own page (full head, header, footer) with one content marker. Scripts are removed
+ * (these pages run none, and their content security policy forbids them), and the canonical and og:url links, which name
+ * the shell, are removed. Null when the page is not a usable shell.
+ */
+export function prepareShell(html: string): string | null {
+  if (html.length > SHELL_MAXIMUM_CHARACTERS || html.split(SHELL_MARKER).length !== 2) return null;
+  return html
+    .replace(/<script\b[\s\S]*?<\/script\s*>/gi, "")
+    .replace(/<link\b[^>]*\brel=["']canonical["'][^>]*>\s*/gi, "")
+    .replace(/<meta\b[^>]*\bproperty=["']og:url["'][^>]*>\s*/gi, "");
+}
+
+type ShellEntry = { template: string | null; at: number };
+const shells = new Map<string, ShellEntry>();
+const fetching = new Map<string, Promise<string | null>>();
+
+export function clearShellCache(): void {
+  shells.clear();
+  fetching.clear();
+}
+
+/**
+ * The prepared shell of the site at `origin`, cached in memory for five minutes. A failed fetch keeps serving the last good
+ * shell, or answers null (the caller falls back to the self-contained page), and is not retried for 30 seconds.
+ */
+export async function loadShell(origin: string, options: ShellOptions = {}): Promise<string | null> {
+  const now = (options.now ?? Date.now)();
+  const cached = shells.get(origin);
+  if (cached && now - cached.at < (cached.template ? SHELL_TTL_MS : SHELL_FAILURE_TTL_MS)) return cached.template;
+  const running = fetching.get(origin);
+  if (running) return running;
+  const attempt = (async () => {
+    let template: string | null = null;
+    try {
+      const response = await (options.fetchShell ?? fetchOverHttp)(new URL(SHELL_PATH, origin).toString());
+      if (response.status === 200 && /html/i.test(response.contentType)) template = prepareShell(response.text);
+    } catch {
+      template = null;
+    }
+    // A failure keeps the last good shell; the retry clock restarts either way.
+    const kept = template ?? cached?.template ?? null;
+    shells.set(origin, { template: kept, at: now });
+    return kept;
+  })().finally(() => fetching.delete(origin));
+  fetching.set(origin, attempt);
+  return attempt;
+}
+
+/** The page inside the site's chrome: the shell's title replaced and its marker replaced by the page content. */
+export function renderShellPage(template: string, page: PageContent): string {
+  const title = `${escapeHtml(page.heading)} - ${escapeHtml(page.siteName)}`;
+  return template.replace(/<title>[\s\S]*?<\/title>/i, () => `<title>${title}</title>`).replace(SHELL_MARKER, () => renderBody(page));
+}
+
 export const PAGE_HEADERS = {
   "content-type": "text/html; charset=utf-8",
   "cache-control": "no-store",
-  "referrer-policy": "no-referrer",
+  "referrer-policy": "same-origin",
   "x-content-type-options": "nosniff",
-  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+  "x-robots-tag": "noindex",
+  "content-security-policy":
+    "default-src 'none'; style-src 'self' 'unsafe-inline' https:; font-src 'self' data: https:; img-src 'self' data: https:; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
 } as const;
 
-export function pageResponse(page: PageContent, status = 200): NextResponse {
-  return new NextResponse(renderPage(page), { status, headers: PAGE_HEADERS });
+/** `shell` is the prepared shell of the site (see `loadShell`); without one the self-contained page is sent. */
+export function pageResponse(page: PageContent, status = 200, shell: string | null = null): NextResponse {
+  return new NextResponse(shell ? renderShellPage(shell, page) : renderPage(page), { status, headers: PAGE_HEADERS });
 }
 
 export const CONFIRM_PATH = "/api/newsletter/confirm";
@@ -156,6 +247,15 @@ export function expiredPage(base: Base): PageContent {
   };
 }
 
+export function crossSitePage(base: Base): PageContent {
+  return {
+    ...base,
+    heading: "That did not go through",
+    paragraphs: ["This form was not sent from this site, so nothing was changed. Open the link in your email again and use the button on the page."],
+    links: [home(base)],
+  };
+}
+
 export function unavailablePage(base: Base): PageContent {
   return {
     ...base,

package/package.json

@@ -433,7 +433,7 @@
       "optional": true
     }
   },
-  "version": "2.0.0-next.50",
+  "version": "2.0.0-next.52",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.0-next.50",
+  "version": "2.0.0-next.52",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",