@anthusai/papyrus 5.43.0-next.43 → 5.43.0-next.46

package/amplify/data/resource.js

@@ -1670,6 +1670,9 @@ const schema = a.schema({
         authorSub: a.string(),
         authorUserProfileId: a.id(),
         authorLabel: a.string(),
+        editedAt: a.datetime(),
+        deletedAt: a.datetime(),
+        deletedBySub: a.string(),
         threadId: a.id(),
         parentMessageId: a.id(),
         sequenceNumber: a.integer(),
@@ -1704,8 +1707,12 @@ const schema = a.schema({
         index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
         .authorization((allow) => [
-        allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+        // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+        allow.group("editor").to(categoryAppendOnlyOperations),
+        allow.group(adminGroup).to(["read", "create", "delete"]),
         allow.authenticated("identityPool").to(["read", "create", "update"]),
+        // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+        allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
     MessageThread: a
         .model({

package/amplify/data/resource.ts

@@ -1786,6 +1786,9 @@ const schema = a.schema({
       authorSub: a.string(),
       authorUserProfileId: a.id(),
       authorLabel: a.string(),
+      editedAt: a.datetime(),
+      deletedAt: a.datetime(),
+      deletedBySub: a.string(),
       threadId: a.id(),
       parentMessageId: a.id(),
       sequenceNumber: a.integer(),
@@ -1820,8 +1823,12 @@ const schema = a.schema({
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+      allow.group("editor").to(categoryAppendOnlyOperations),
+      allow.group(adminGroup).to(["read", "create", "delete"]),
       allow.authenticated("identityPool").to(["read", "create", "update"]),
+      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
 
   MessageThread: a

package/amplify/data/schema.js

@@ -1573,6 +1573,9 @@ function buildBaseDefinitions(includeEditions) {
             authorSub: a.string(),
             authorUserProfileId: a.id(),
             authorLabel: a.string(),
+            editedAt: a.datetime(),
+            deletedAt: a.datetime(),
+            deletedBySub: a.string(),
             threadId: a.id(),
             parentMessageId: a.id(),
             sequenceNumber: a.integer(),
@@ -1607,7 +1610,11 @@ function buildBaseDefinitions(includeEditions) {
             index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
         ])
             .authorization((allow) => [
-            allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+            // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+            allow.group("editor").to(categoryAppendOnlyOperations),
+            allow.group(adminGroup).to(["read", "create", "delete"]),
+            // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+            allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
         ]),
         MessageThread: realtimeModel({
             id: a.id().required(),

package/amplify/data/schema.ts

@@ -1687,6 +1687,9 @@ const definitions = {
       authorSub: a.string(),
       authorUserProfileId: a.id(),
       authorLabel: a.string(),
+      editedAt: a.datetime(),
+      deletedAt: a.datetime(),
+      deletedBySub: a.string(),
       threadId: a.id(),
       parentMessageId: a.id(),
       sequenceNumber: a.integer(),
@@ -1721,7 +1724,11 @@ const definitions = {
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+      allow.group("editor").to(categoryAppendOnlyOperations),
+      allow.group(adminGroup).to(["read", "create", "delete"]),
+      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
 
   MessageThread: realtimeModel({

package/components/news-desk-taxonomy-client.ts

@@ -1431,7 +1431,9 @@ async function appendMessageToThread(thread: MessageThreadRecord, build: (sequen
     list: () => listMessagesByThreadId(threadId, 1000),
     create: (sequenceNumber) => {
       now = new Date().toISOString();
-      built = build(sequenceNumber, now);
+      // `createdAt` is part of the composite sort key of messagesByResponseTargetStatusCreatedAt, so AppSync refuses a Message that
+      // sets it without `responseStatus`. A person's message waits on no responder: COMPLETED, as the Python message contract writes.
+      built = { responseStatus: "COMPLETED", ...build(sequenceNumber, now) };
       return runGraphql<{ createMessage?: MessageRecord | null }>(CREATE_MESSAGE_MUTATION, { input: built });
     },
   });
@@ -1905,10 +1907,17 @@ async function runGraphql<T extends Record<string, unknown>>(
   const client = generateClient<Schema>() as unknown as {
     graphql: (options: Record<string, unknown>) => Promise<{ data?: T | null; errors?: unknown[] | null }>;
   };
+  // The Amplify client rejects with the raw `{ data, errors }` response when the API returns errors; turn that into an
+  // Error carrying the API's own words, so a refusal is said in words instead of as an unknown failure.
   const response = await client.graphql({
     query,
     variables,
     authMode: USER_POOL_AUTH_MODE,
+  }).catch((failure: unknown) => {
+    if (failure && typeof failure === "object" && Array.isArray((failure as { errors?: unknown }).errors)) {
+      assertNoGraphQLErrors((failure as { errors: unknown[] }).errors);
+    }
+    throw failure;
   });
   assertNoGraphQLErrors(response.errors);
   return (response.data ?? {}) as T;

package/components/story-reporting-trail-client.ts

@@ -4,7 +4,7 @@ import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../amplify/data/resource";
 import { isLocalPreviewEnabled } from "../lib/local-preview";
 import { createLocalPreviewReportingTrail, createLocalPreviewStoriesForReference } from "../lib/local-preview-seed";
-import { EMPTY_STORY_REPORTING_TRAIL, referencesByRole, siteNameOf, type ReferenceStory, type StoryReportingTrail, type TrailAssignment, type TrailAttachment, type TrailReference, type TrailThread, type TrailVersion } from "../lib/story-reporting-trail";
+import { EMPTY_STORY_REPORTING_TRAIL, referencesByRole, siteNameOf, stageMovesOf, type ReferenceStory, type StoryReportingTrail, type TrailAssignment, type TrailAttachment, type TrailReference, type TrailThread, type TrailVersion } from "../lib/story-reporting-trail";
 import { configureAmplifyClient } from "./amplify-client-provider";
 
 type GraphqlResponse = { data?: Record<string, { items?: Record<string, unknown>[] | null; nextToken?: string | null } | null> | null; errors?: { message?: string }[] | null };
@@ -89,7 +89,7 @@ export async function loadStoryReportingTrail(lineageId: string, itemId: string,
   configureAmplifyClient();
   const client = generateClient<Schema>() as unknown as GraphqlClient;
   const [versionRows, assignmentRows, attachmentRows, relationRows] = await Promise.all([
-    listAll(client, "listItemsByLineageAndVersion", "id versionNumber versionState status stage headline title changeReason versionCreatedBy versionCreatedAt updatedAt", ", $lineageId: ID!", ", lineageId: $lineageId", { lineageId }).catch(() => []),
+    listAll(client, "listItemsByLineageAndVersion", "id versionNumber versionState status stage headline title changeReason versionCreatedBy versionCreatedAt updatedAt metadata", ", $lineageId: ID!", ", lineageId: $lineageId", { lineageId }).catch(() => []),
     listAll(client, "listAssignmentsByItemLineageAndCreatedAt", "id title assignmentTypeKey status assigneeKey summary createdAt", ", $itemLineageId: ID!", ", itemLineageId: $itemLineageId", { itemLineageId: lineageId }).catch(() => []),
     listAll(client, "listModelAttachmentsByOwnerRoleAndSortKey", "id role filename mediaType byteSize", ", $ownerId: ID!", ", ownerId: $ownerId", { ownerId: itemId }).catch(() => []),
     listAll(client, "listSemanticRelations", "id predicate subjectKind subjectLineageId objectKind objectId objectLineageId metadata", ", $filter: ModelSemanticRelationFilterInput", ", filter: $filter", { filter: { or: [{ subjectLineageId: { eq: lineageId } }, { objectLineageId: { eq: lineageId } }] } }).catch(() => []),
@@ -124,5 +124,6 @@ export async function loadStoryReportingTrail(lineageId: string, itemId: string,
     };
   })));
   const attachments: TrailAttachment[] = attachmentRows.map(row => ({ id: String(row.id), role: text(row.role), filename: text(row.filename), mediaType: text(row.mediaType), byteSize: typeof row.byteSize === "number" ? row.byteSize : null }));
-  return { ...EMPTY_STORY_REPORTING_TRAIL, versions, assignments, threads, references, attachments };
+  const latestRow = [...versionRows].sort((left, right) => Number(right.versionNumber ?? 0) - Number(left.versionNumber ?? 0))[0];
+  return { ...EMPTY_STORY_REPORTING_TRAIL, versions, assignments, threads, references, attachments, stageMoves: stageMovesOf(latestRow?.metadata) };
 }

package/components/story-reporting-trail.tsx

@@ -91,6 +91,14 @@ export function StoryReportingTrailView({ citedKeys = [], demo = false, focusedR
           </li>)}
       </ol>
     </TrailSection>
+    {trail.stageMoves.length > 0 && <TrailSection count={trail.stageMoves.length} title="Stage moves">
+      <ol className="story-trail-list" data-story-trail-stage-moves>
+        {[...trail.stageMoves].reverse().map(move => <li key={`${move.at}-${move.to}`}>
+          <div className="story-trail-row"><strong>{move.from ?? "start"} → {move.to}</strong>{move.by && <span className="story-trail-chip">{move.by}</span>}<span className="story-trail-meta">{formatTimestamp(move.at)}</span></div>
+          {move.reason && <p className="story-trail-meta">{move.reason}</p>}
+        </li>)}
+      </ol>
+    </TrailSection>}
     <TrailSection count={trail.versions.length} title="Draft versions">
       <ol className="story-trail-list">
         {trail.versions.map((version, versionIndex) => <li key={version.id}>

package/lib/story-reporting-trail.ts

@@ -17,6 +17,15 @@ export type TrailVersion = {
   updatedAt: string | null;
 };
 
+/** One stage move of the story, read from the latest Item version's `metadata.stageMoves` (not from Messages). */
+export type TrailStageMove = {
+  at: string;
+  from: string | null;
+  to: string;
+  by: string | null;
+  reason: string | null;
+};
+
 export type TrailAssignmentEvent = {
   id: string;
   eventType: string;
@@ -89,12 +98,29 @@ export type StoryReportingTrail = {
   threads: TrailThread[];
   references: TrailReference[];
   attachments: TrailAttachment[];
+  stageMoves: TrailStageMove[];
 };
 
-export const EMPTY_STORY_REPORTING_TRAIL: StoryReportingTrail = { versions: [], assignments: [], threads: [], references: [], attachments: [] };
+export const EMPTY_STORY_REPORTING_TRAIL: StoryReportingTrail = { versions: [], assignments: [], threads: [], references: [], attachments: [], stageMoves: [] };
+
+/** The stage moves recorded on an Item version's metadata, oldest first. Anything that is not a well-formed move is skipped. */
+export function stageMovesOf(metadata: unknown): TrailStageMove[] {
+  let parsed: unknown = metadata;
+  if (typeof metadata === "string") {
+    try { parsed = JSON.parse(metadata); } catch { return []; }
+  }
+  const moves = typeof parsed === "object" && parsed ? (parsed as Record<string, unknown>).stageMoves : null;
+  if (!Array.isArray(moves)) return [];
+  return moves.flatMap(entry => {
+    if (typeof entry !== "object" || !entry) return [];
+    const move = entry as Record<string, unknown>;
+    if (typeof move.at !== "string" || typeof move.to !== "string") return [];
+    return [{ at: move.at, from: typeof move.from === "string" ? move.from : null, to: move.to, by: typeof move.by === "string" ? move.by : null, reason: typeof move.reason === "string" ? move.reason : null }];
+  });
+}
 
 export function storyReportingTrailIsEmpty(trail: StoryReportingTrail): boolean {
-  return trail.assignments.length === 0 && trail.threads.length === 0 && trail.references.length === 0 && trail.attachments.length === 0 && trail.versions.length <= 1;
+  return trail.assignments.length === 0 && trail.threads.length === 0 && trail.stageMoves.length === 0 && trail.references.length === 0 && trail.attachments.length === 0 && trail.versions.length <= 1;
 }
 
 export type StoryFeedEntry =

package/package.json

@@ -516,7 +516,7 @@
       "optional": true
     }
   },
-  "version": "5.43.0-next.43",
+  "version": "5.43.0-next.46",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.43.0-next.43",
+  "version": "5.43.0-next.46",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",