@anthusai/papyrus 2.0.0-next.82 → 2.0.0-next.83

package/amplify/plugins/reader-steering/function/handler.py

@@ -1501,7 +1501,7 @@ def run_ai_worker(
 
 def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSettings, now_seconds: float, account_id: str | None = None) -> dict[str, Any]:
     """``moderateReader`` from AppSync: an editor or admin hides, approves, promotes, bans or undoes. Answers a receipt, never an exception."""
-    if (event.get("info") or {}).get("fieldName") in proposal_rules.MUTATIONS:
+    if proposal_rules.event_field_name(event) in proposal_rules.MUTATIONS:
         return proposal_rules.handle_proposal_event(event, store, now_iso=iso(now_seconds), account_id=account_id)
     identity = event.get("identity") or {}
     claims = identity.get("claims") or {}
@@ -1539,7 +1539,7 @@ def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
     settings = settings_from_environment()
     store = store_from_environment()
     now_seconds = time.time()
-    if "arguments" in event and "info" in event:
+    if proposal_rules.is_appsync_event(event):
         return handle_staff_event(event, store=store, settings=settings, now_seconds=now_seconds, account_id=function_account(_context))
     target = snapshot_target_from_environment()
     if settings.moderation_mode == "ai" and target is not None and _context is not None:

package/amplify/plugins/reader-steering/function/proposals.py

@@ -57,6 +57,22 @@ TARGET_COUNTS: dict[str, tuple[int, int]] = {
 TARGET_TYPES = ("concept", "entity", "column", "story", "cluster")
 
 MUTATIONS = ("fileProposal", "transitionProposal")
+
+
+def event_field_name(event: dict[str, Any]) -> str | None:
+    """The GraphQL field an AppSync invocation is for.
+
+    The Amplify Gen 2 Lambda data source sends ``fieldName`` at the top level with no ``info`` key; a direct resolver nests it
+    under ``info``. Accept both.
+    """
+    info = event.get("info")
+    name = (info.get("fieldName") if isinstance(info, dict) else None) or event.get("fieldName")
+    return name if isinstance(name, str) and name else None
+
+
+def is_appsync_event(event: dict[str, Any]) -> bool:
+    """True for an AppSync invocation (arguments plus ``info`` or a top-level ``fieldName``); the public path sends siteSubject, action and payload."""
+    return "arguments" in event and ("info" in event or event_field_name(event) is not None)
 PROPOSER_AI = "ai"
 STAFF_GROUPS = frozenset({"editor", "admin"})
 #: The only moves an operator's IAM role may make, as (from, to). Everything after the draft is an editor's decision.
@@ -282,7 +298,7 @@ def handle_proposal_event(event: dict[str, Any], store: ProposalStore, *, now_is
     if actor is None:
         return refused("not_staff", "Only editors, admins and operators of this account can file proposals; only editors and admins decide them.").to_dict()
     arguments = event.get("arguments") or {}
-    field = (event.get("info") or {}).get("fieldName")
+    field = event_field_name(event)
     if field == "fileProposal":
         row, problem = file_proposal(arguments, actor_sub=actor, now_iso=now_iso)
         if problem is not None:

package/lib/automation-overview.ts

@@ -72,6 +72,10 @@ export type AutomationRecord = {
   enabled: boolean;
   enabledNote: string;
   trigger: { kind: "monitor" | "schedule" | "event" | "manual"; config: Record<string, unknown> };
+  /** Story-stage automations only: the stage that fires it, where the engine moves the story after, and the bot-hop limit. */
+  onStage?: string | null;
+  nextStage?: string | null;
+  maxHops?: number | null;
   supported: boolean;
   supportNote: string | null;
   procedureKey: string;
@@ -106,6 +110,10 @@ export function triggerText(trigger: AutomationRecord["trigger"]): string {
   if (trigger.kind === "monitor") {
     return `${kind} ${String(trigger.config.monitorId ?? "?")}, delivering to ${String(trigger.config.publicationId ?? "?")}`;
   }
+  if (trigger.kind === "event" && trigger.config.event === "story.stage_entered") {
+    const next = trigger.config.nextStage ? `, then moves it to ${String(trigger.config.nextStage)}` : "";
+    return `${kind}: a story enters ${String(trigger.config.onStage ?? "?")}${next}`;
+  }
   return kind;
 }
 

package/lib/prospectus-sign-in-routes.ts

@@ -41,6 +41,8 @@ export interface ProspectusSignInRouteOptions {
   nowInSeconds?: () => number;
   /** Trusted configuration the public site origin is read from; defaults to process.env. */
   environment?: Record<string, string | undefined>;
+  /** Receives each sign-in failure line; defaults to console.error so it reaches the compute log. */
+  log?: (line: string) => void;
 }
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
@@ -91,6 +93,21 @@ function signInFailedResponse(status: number, code: string, message: string): Ne
  * A failed sign-in never leaves the browser on /api/auth/prospectus/callback: it answers 303 to the page the reader started from
  * (or the home page when that is not known) with `sign_in_error=<code>`, which the reader plugin turns into a short message.
  */
+/** Which callback step failed; with the code it tells an operator where a reader's sign-in stopped. */
+type SignInFailureBranch = "pending_cookie" | "provider_error" | "missing_parameters" | "completion" | "unexpected";
+
+/**
+ * One structured line per failed callback: `prospectus_sign_in_failed {"code":...,"branch":...}`. It carries only the
+ * code, the branch, and (for errors from completing the sign-in) the HTTP status, Prospectus error code and error name.
+ * Never tokens, authorization codes, state, emails or subjects.
+ */
+function logSignInFailure(
+  options: ProspectusSignInRouteOptions,
+  entry: { code: string; branch: SignInFailureBranch; httpStatus?: number; prospectusError?: string; errorName?: string },
+): void {
+  (options.log ?? console.error)(`prospectus_sign_in_failed ${JSON.stringify(entry)}`);
+}
+
 function signInFailedRedirect(request: NextRequest, options: ProspectusSignInRouteOptions, returnPath: string | null, code: string): NextResponse {
   const target = new URL(returnPath ?? "/", siteOriginFor(request, options));
   target.searchParams.set("sign_in_error", /^[a-z0-9_]{1,60}$/.test(code) ? code : "sign_in_failed");
@@ -169,13 +186,16 @@ async function completeCallback(
   options: ProspectusSignInRouteOptions,
   nowInSeconds: number,
 ): Promise<NextResponse> {
-  const failed = (code: string) => signInFailedRedirect(request, options, pendingSignIn?.returnPath ?? null, code);
-  if (!pendingSignIn) return failed("sign_in_expired");
+  const failed = (code: string, branch: SignInFailureBranch, detail: { httpStatus?: number; prospectusError?: string; errorName?: string } = {}) => {
+    logSignInFailure(options, { code, branch, ...detail });
+    return signInFailedRedirect(request, options, pendingSignIn?.returnPath ?? null, code);
+  };
+  if (!pendingSignIn) return failed("sign_in_expired", "pending_cookie");
   const searchParams = request.nextUrl.searchParams;
-  if (searchParams.get("error")) return failed("sign_in_declined");
+  if (searchParams.get("error")) return failed("sign_in_declined", "provider_error");
   const authorizationCode = searchParams.get("code");
   const returnedState = searchParams.get("state");
-  if (!authorizationCode || !returnedState) return failed("sign_in_incomplete");
+  if (!authorizationCode || !returnedState) return failed("sign_in_incomplete", "missing_parameters");
   try {
     const signedIn = await completeProspectusGoogleSignIn({
       accounts: runtime.accounts,
@@ -200,9 +220,8 @@ async function completeCallback(
     );
     return response;
   } catch (error) {
-    if (error instanceof ProspectusAccountsError) return failed(error.code);
-    console.error(`Prospectus sign-in failed (${error instanceof Error ? error.name : "error"}).`);
-    return failed("sign_in_failed");
+    if (error instanceof ProspectusAccountsError) return failed(error.code, "completion", { httpStatus: error.status, prospectusError: error.code });
+    return failed("sign_in_failed", "unexpected", { errorName: error instanceof Error ? error.name : "error" });
   }
 }
 

package/package.json

@@ -448,7 +448,7 @@
       "optional": true
     }
   },
-  "version": "2.0.0-next.82",
+  "version": "2.0.0-next.83",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.0-next.82",
+  "version": "2.0.0-next.83",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",