@ampless/backend 0.2.0-alpha.1 → 0.2.0-alpha.11

package/dist/functions/mcp-handler.js

@@ -0,0 +1,754 @@
+import "../chunk-BYXBJQAS.js";
+
+// src/functions/mcp-handler.ts
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";
+import { createHash } from "crypto";
+
+// ../mcp-server/dist/chunk-KM6F5QJH.js
+import { composeSiteIdStatus, composeSiteIdSlug } from "ampless";
+import { composeSiteIdStatus as composeSiteIdStatus2, composeSiteIdSlug as composeSiteIdSlug2 } from "ampless";
+var POST_FIELDS = (
+  /* GraphQL */
+  `
+  fragment PostFields on Post {
+    siteId
+    postId
+    slug
+    title
+    excerpt
+    format
+    body
+    status
+    publishedAt
+    tags
+  }
+`
+);
+function decodeBody(value) {
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function encodeBody(value) {
+  if (typeof value === "string") return value;
+  return JSON.stringify(value ?? null);
+}
+function toCorePost(p) {
+  return {
+    siteId: p.siteId,
+    postId: p.postId,
+    slug: p.slug,
+    title: p.title,
+    excerpt: p.excerpt ?? void 0,
+    format: p.format ?? "markdown",
+    body: decodeBody(p.body),
+    status: p.status ?? "draft",
+    publishedAt: p.publishedAt ?? void 0,
+    tags: (p.tags ?? []).filter((t) => typeof t === "string")
+  };
+}
+var QUERY = (
+  /* GraphQL */
+  `
+  ${POST_FIELDS}
+  query ListPosts($filter: ModelPostFilterInput, $limit: Int, $nextToken: String) {
+    listPosts(filter: $filter, limit: $limit, nextToken: $nextToken) {
+      items {
+        ...PostFields
+      }
+      nextToken
+    }
+  }
+`
+);
+var listPostsSchema = {
+  type: "object",
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    status: {
+      type: "string",
+      enum: ["draft", "published", "all"],
+      description: 'Filter by status (default "all")'
+    },
+    limit: { type: "integer", minimum: 1, maximum: 100, description: "Max results (default 20)" },
+    nextToken: { type: "string", description: "Pagination cursor from a previous call" }
+  }
+};
+async function listPosts(client, defaultSiteId, args = {}) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const status = args.status ?? "all";
+  const filter = { siteId: { eq: siteId } };
+  if (status !== "all") filter.status = { eq: status };
+  const data = await client.query(QUERY, { filter, limit: args.limit ?? 20, nextToken: args.nextToken });
+  return {
+    posts: data.listPosts.items.map(toCorePost),
+    nextToken: data.listPosts.nextToken
+  };
+}
+var GET_BY_ID = (
+  /* GraphQL */
+  `
+  ${POST_FIELDS}
+  query GetPost($siteId: String!, $postId: ID!) {
+    getPost(siteId: $siteId, postId: $postId) {
+      ...PostFields
+    }
+  }
+`
+);
+var LIST_BY_SLUG = (
+  /* GraphQL */
+  `
+  ${POST_FIELDS}
+  query GetPostBySlug($filter: ModelPostFilterInput!) {
+    listPosts(filter: $filter, limit: 1) {
+      items {
+        ...PostFields
+      }
+    }
+  }
+`
+);
+var getPostSchema = {
+  type: "object",
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    slug: { type: "string", description: "Post slug" },
+    postId: { type: "string", description: "Post id (used when slug is omitted)" }
+  }
+};
+async function getPost(client, defaultSiteId, args) {
+  if (!args.slug && !args.postId) {
+    throw new Error("get_post requires either `slug` or `postId`");
+  }
+  const siteId = args.siteId ?? defaultSiteId;
+  if (args.postId) {
+    const data2 = await client.query(GET_BY_ID, { siteId, postId: args.postId });
+    return data2.getPost ? toCorePost(data2.getPost) : null;
+  }
+  const data = await client.query(LIST_BY_SLUG, {
+    filter: { siteId: { eq: siteId }, slug: { eq: args.slug } }
+  });
+  const item = data.listPosts.items[0];
+  return item ? toCorePost(item) : null;
+}
+function entries(post) {
+  if (post.status !== "published" || !post.publishedAt || !post.tags?.length) return [];
+  return post.tags.map((tag) => ({
+    siteIdTag: `${post.siteId}#${tag}`,
+    publishedAtPostId: `${post.publishedAt}#${post.postId}`
+  }));
+}
+function entryKey(e) {
+  return `${e.siteIdTag}|${e.publishedAtPostId}`;
+}
+var CREATE_POST_TAG = (
+  /* GraphQL */
+  `
+  mutation CreatePostTag($input: CreatePostTagInput!) {
+    createPostTag(input: $input) {
+      siteIdTag
+      publishedAtPostId
+    }
+  }
+`
+);
+var UPDATE_POST_TAG = (
+  /* GraphQL */
+  `
+  mutation UpdatePostTag($input: UpdatePostTagInput!) {
+    updatePostTag(input: $input) {
+      siteIdTag
+      publishedAtPostId
+    }
+  }
+`
+);
+var DELETE_POST_TAG = (
+  /* GraphQL */
+  `
+  mutation DeletePostTag($input: DeletePostTagInput!) {
+    deletePostTag(input: $input) {
+      siteIdTag
+      publishedAtPostId
+    }
+  }
+`
+);
+async function syncPostTags(client, post, oldPost) {
+  const oldEntries = oldPost ? entries(oldPost) : [];
+  const newEntries = entries(post);
+  const oldKeys = new Set(oldEntries.map(entryKey));
+  const newKeys = new Set(newEntries.map(entryKey));
+  await Promise.all(
+    oldEntries.filter((e) => !newKeys.has(entryKey(e))).map(
+      (e) => client.query(DELETE_POST_TAG, {
+        input: { siteIdTag: e.siteIdTag, publishedAtPostId: e.publishedAtPostId }
+      })
+    )
+  );
+  await Promise.all(
+    newEntries.filter((e) => !oldKeys.has(entryKey(e))).map(
+      (e) => client.query(CREATE_POST_TAG, {
+        input: {
+          siteIdTag: e.siteIdTag,
+          publishedAtPostId: e.publishedAtPostId,
+          siteId: post.siteId,
+          tag: e.siteIdTag.slice(post.siteId.length + 1),
+          postId: post.postId,
+          publishedAt: post.publishedAt,
+          slug: post.slug,
+          title: post.title,
+          excerpt: post.excerpt,
+          tags: post.tags ?? []
+        }
+      })
+    )
+  );
+  await Promise.all(
+    newEntries.filter((e) => oldKeys.has(entryKey(e))).map(
+      (e) => client.query(UPDATE_POST_TAG, {
+        input: {
+          siteIdTag: e.siteIdTag,
+          publishedAtPostId: e.publishedAtPostId,
+          slug: post.slug,
+          title: post.title,
+          excerpt: post.excerpt,
+          tags: post.tags ?? []
+        }
+      })
+    )
+  );
+}
+var MUTATION = (
+  /* GraphQL */
+  `
+  ${POST_FIELDS}
+  mutation CreatePost($input: CreatePostInput!) {
+    createPost(input: $input) {
+      ...PostFields
+    }
+  }
+`
+);
+var createPostSchema = {
+  type: "object",
+  required: ["slug", "title", "format", "body"],
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    postId: { type: "string", description: "Optional explicit id; auto-generated if omitted" },
+    slug: { type: "string" },
+    title: { type: "string" },
+    format: { type: "string", enum: ["tiptap", "markdown", "html"] },
+    body: {
+      description: "tiptap JSON (when format=tiptap), markdown source string, or raw HTML string"
+    },
+    status: { type: "string", enum: ["draft", "published"], default: "draft" },
+    excerpt: { type: "string" },
+    publishedAt: { type: "string", description: "ISO 8601 timestamp; required when status=published" },
+    tags: { type: "array", items: { type: "string" } }
+  }
+};
+async function createPost(client, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const postId = args.postId ?? `post-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const status = args.status ?? "draft";
+  const publishedAt = args.publishedAt ?? (status === "published" ? (/* @__PURE__ */ new Date()).toISOString() : void 0);
+  const data = await client.query(MUTATION, {
+    input: {
+      siteId,
+      postId,
+      slug: args.slug,
+      title: args.title,
+      excerpt: args.excerpt,
+      format: args.format,
+      body: encodeBody(args.body),
+      status,
+      publishedAt,
+      tags: args.tags,
+      // Denormalized GSI keys.
+      siteIdStatus: composeSiteIdStatus(siteId, status),
+      siteIdSlug: composeSiteIdSlug(siteId, args.slug)
+    }
+  });
+  const created = toCorePost(data.createPost);
+  await syncPostTags(client, created, null);
+  return created;
+}
+var MUTATION2 = (
+  /* GraphQL */
+  `
+  ${POST_FIELDS}
+  mutation UpdatePost($input: UpdatePostInput!) {
+    updatePost(input: $input) {
+      ...PostFields
+    }
+  }
+`
+);
+var updatePostSchema = {
+  type: "object",
+  required: ["postId"],
+  properties: {
+    postId: { type: "string" },
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    slug: { type: "string" },
+    title: { type: "string" },
+    excerpt: { type: "string" },
+    format: { type: "string", enum: ["tiptap", "markdown", "html"] },
+    body: { description: "tiptap JSON, markdown source, or raw HTML" },
+    status: { type: "string", enum: ["draft", "published"] },
+    publishedAt: { type: "string", description: "ISO 8601 timestamp" },
+    tags: { type: "array", items: { type: "string" } }
+  }
+};
+async function updatePost(client, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const oldPost = await getPost(client, defaultSiteId, { postId: args.postId, siteId });
+  const input = { siteId, postId: args.postId };
+  if (args.slug !== void 0) input.slug = args.slug;
+  if (args.title !== void 0) input.title = args.title;
+  if (args.excerpt !== void 0) input.excerpt = args.excerpt;
+  if (args.format !== void 0) input.format = args.format;
+  if (args.body !== void 0) input.body = encodeBody(args.body);
+  if (args.status !== void 0) input.status = args.status;
+  if (args.publishedAt !== void 0) input.publishedAt = args.publishedAt;
+  if (args.tags !== void 0) input.tags = args.tags;
+  if (args.status !== void 0) {
+    input.siteIdStatus = composeSiteIdStatus2(siteId, args.status);
+  }
+  if (args.slug !== void 0) {
+    input.siteIdSlug = composeSiteIdSlug2(siteId, args.slug);
+  }
+  const data = await client.query(MUTATION2, { input });
+  const updated = toCorePost(data.updatePost);
+  await syncPostTags(client, updated, oldPost);
+  return updated;
+}
+var MUTATION3 = (
+  /* GraphQL */
+  `
+  mutation DeletePost($input: DeletePostInput!) {
+    deletePost(input: $input) {
+      siteId
+      postId
+    }
+  }
+`
+);
+var deletePostSchema = {
+  type: "object",
+  required: ["postId"],
+  properties: {
+    postId: { type: "string" },
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' }
+  }
+};
+async function deletePost(client, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const oldPost = await getPost(client, defaultSiteId, { postId: args.postId, siteId });
+  if (oldPost) {
+    await syncPostTags(client, { ...oldPost, status: "draft" }, oldPost);
+  }
+  const data = await client.query(MUTATION3, { input: { siteId, postId: args.postId } });
+  return { deleted: data.deletePost };
+}
+function sanitizeName(name) {
+  return name.replace(/[\x00-\x1f\x7f]/g, "").replace(/[\\/:*?"<>|]/g, "_").replace(/\s+/g, "_").replace(/^\.+/, "_").slice(0, 200) || "upload";
+}
+function buildMediaKey(filename, now = /* @__PURE__ */ new Date()) {
+  const safe = sanitizeName(filename);
+  const yyyy = now.getFullYear();
+  const mm = String(now.getMonth() + 1).padStart(2, "0");
+  return `public/media/${yyyy}/${mm}/${now.getTime()}-${safe}`;
+}
+var MUTATION4 = (
+  /* GraphQL */
+  `
+  mutation CreateMedia($input: CreateMediaInput!) {
+    createMedia(input: $input) {
+      siteId
+      mediaId
+      src
+      mimeType
+      size
+      delivery
+    }
+  }
+`
+);
+var uploadMediaSchema = {
+  type: "object",
+  required: ["filename", "mimeType", "base64Data"],
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    filename: { type: "string", description: "Original filename; sanitized server-side" },
+    mimeType: {
+      type: "string",
+      description: "IANA media type (e.g. image/webp, image/jpeg). The MCP server does not transcode \u2014 pass the MIME of the bytes you actually send."
+    },
+    base64Data: {
+      type: "string",
+      description: "Base64-encoded file contents. NO data:URL prefix. The MCP server uploads bytes verbatim \u2014 resize/encode client-side first if needed."
+    }
+  }
+};
+async function uploadMedia(graphql, storage, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const body = Buffer.from(args.base64Data, "base64");
+  const key = buildMediaKey(args.filename);
+  const url = await storage.putObject(key, body, args.mimeType);
+  const mediaId = `media-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const data = await graphql.query(MUTATION4, {
+    input: {
+      siteId,
+      mediaId,
+      src: key,
+      mimeType: args.mimeType,
+      size: body.length,
+      delivery: "nextjs"
+    }
+  });
+  return { media: data.createMedia, url };
+}
+var getSchemaSchema = {
+  type: "object",
+  properties: {}
+};
+function getSchema() {
+  return {
+    contentTypes: [
+      {
+        name: "post",
+        identifier: ["siteId", "postId"],
+        fields: {
+          siteId: { type: "string", required: true },
+          postId: { type: "string", required: true, description: "auto-generated if omitted on create" },
+          slug: { type: "string", required: true, description: "URL slug, unique per site" },
+          title: { type: "string", required: true },
+          excerpt: { type: "string" },
+          format: { type: "enum", values: ["tiptap", "markdown", "html"], required: true },
+          body: {
+            type: "json",
+            description: "tiptap node JSON when format=tiptap; markdown source string when format=markdown; raw HTML string when format=html"
+          },
+          status: { type: "enum", values: ["draft", "published"], default: "draft" },
+          publishedAt: { type: "datetime", description: "ISO 8601" },
+          tags: { type: "string[]" }
+        }
+      },
+      {
+        name: "page",
+        identifier: ["siteId", "pageId"],
+        fields: {
+          siteId: { type: "string", required: true },
+          pageId: { type: "string", required: true },
+          slug: { type: "string", required: true },
+          title: { type: "string", required: true },
+          format: { type: "enum", values: ["tiptap", "markdown", "html"], required: true },
+          body: { type: "json" },
+          status: { type: "enum", values: ["draft", "published"] },
+          publishedAt: { type: "datetime" }
+        }
+      },
+      {
+        name: "media",
+        identifier: ["siteId", "mediaId"],
+        fields: {
+          siteId: { type: "string", required: true },
+          mediaId: { type: "string", required: true },
+          src: { type: "string", required: true, description: "S3 key" },
+          mimeType: { type: "string", required: true },
+          size: { type: "integer" },
+          delivery: { type: "string" }
+        }
+      }
+    ],
+    formats: ["tiptap", "markdown", "html"],
+    notes: {
+      editorTrust: 'editor stores arbitrary HTML/JS verbatim \u2014 same trust shape as WordPress unfiltered_html capability. See docs/architecture/04-access-layer-mcp.md \xA7"editor \u306E\u4FE1\u983C\u30E2\u30C7\u30EB".',
+      tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.'
+    }
+  };
+}
+var tools = [
+  {
+    name: "list_posts",
+    description: "List posts in the CMS with optional filters by status. Returns up to `limit` posts (default 20) plus a `nextToken` cursor for pagination.",
+    inputSchema: listPostsSchema,
+    handler: (args, ctx) => listPosts(ctx.graphql, ctx.defaultSiteId, args)
+  },
+  {
+    name: "get_post",
+    description: "Fetch a single post by slug or postId. Returns null if not found.",
+    inputSchema: getPostSchema,
+    handler: (args, ctx) => getPost(ctx.graphql, ctx.defaultSiteId, args)
+  },
+  {
+    name: "create_post",
+    description: "Create a new post. Title and slug are required. Body shape depends on format: tiptap=JSON node tree, markdown=source string, html=raw HTML string. Defaults to status=draft.",
+    inputSchema: createPostSchema,
+    handler: (args, ctx) => createPost(ctx.graphql, ctx.defaultSiteId, args)
+  },
+  {
+    name: "update_post",
+    description: "Update an existing post by postId. Only the fields you pass are changed. Tag list / publishedAt changes also update the PostTag denormalized index.",
+    inputSchema: updatePostSchema,
+    handler: (args, ctx) => updatePost(ctx.graphql, ctx.defaultSiteId, args)
+  },
+  {
+    name: "delete_post",
+    description: "Delete a post by postId. Also drops associated PostTag index entries.",
+    inputSchema: deletePostSchema,
+    handler: (args, ctx) => deletePost(ctx.graphql, ctx.defaultSiteId, args)
+  },
+  {
+    name: "upload_media",
+    description: "Upload a file to the site's media S3 bucket. Pass base64-encoded bytes; the server stores them verbatim under public/media/YYYY/MM/. Returns the public URL and Media record. The server does not transcode \u2014 pre-process (e.g. resize/webp) on the client.",
+    inputSchema: uploadMediaSchema,
+    handler: (args, ctx) => uploadMedia(ctx.graphql, ctx.storage(), ctx.defaultSiteId, args)
+  },
+  {
+    name: "get_schema",
+    description: "Returns the CMS content schema (Post/Page/Media field shapes, format enum, notes). Useful as the first call to understand what fields are available.",
+    inputSchema: getSchemaSchema,
+    handler: async () => getSchema()
+  }
+];
+async function dispatchToolCall(name, args, ctx) {
+  const tool = tools.find((t) => t.name === name);
+  if (!tool) return null;
+  return tool.handler(args, ctx);
+}
+
+// src/functions/mcp-graphql-client.ts
+import { Sha256 } from "@aws-crypto/sha256-js";
+import { HttpRequest } from "@smithy/protocol-http";
+import { SignatureV4 } from "@smithy/signature-v4";
+import { defaultProvider } from "@aws-sdk/credential-provider-node";
+function createMcpGraphqlClient(opts) {
+  const url = new URL(opts.endpoint);
+  const signer = new SignatureV4({
+    service: "appsync",
+    region: opts.region,
+    credentials: defaultProvider(),
+    sha256: Sha256
+  });
+  return {
+    async query(operation, variables = {}) {
+      const body = JSON.stringify({ query: operation, variables });
+      const request = new HttpRequest({
+        method: "POST",
+        protocol: url.protocol,
+        hostname: url.hostname,
+        path: url.pathname,
+        headers: {
+          // `host` is required for SigV4 canonicalisation.
+          host: url.hostname,
+          "content-type": "application/json"
+        },
+        body
+      });
+      const signed = await signer.sign(request);
+      const response = await fetch(opts.endpoint, {
+        method: "POST",
+        headers: signed.headers,
+        body
+      });
+      if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        console.error("[mcp-graphql-client] AppSync HTTP error", {
+          status: response.status,
+          body: text.slice(0, 1e3)
+        });
+        throw new Error(`AppSync ${response.status}: ${text || response.statusText}`);
+      }
+      const json = await response.json();
+      if (json.errors && json.errors.length > 0) {
+        const msg = json.errors.map((e) => e.message).join("; ");
+        console.error("[mcp-graphql-client] AppSync GraphQL errors", { errors: json.errors });
+        throw new Error(`AppSync GraphQL error: ${msg}`);
+      }
+      if (!json.data) {
+        throw new Error("AppSync returned an empty response");
+      }
+      return json.data;
+    }
+  };
+}
+
+// src/functions/mcp-handler.ts
+var TOKENS_PK = "mcp-tokens";
+var JSON_RPC_PARSE_ERROR = -32700;
+var JSON_RPC_INVALID_REQUEST = -32600;
+var JSON_RPC_METHOD_NOT_FOUND = -32601;
+var JSON_RPC_INVALID_PARAMS = -32602;
+var JSON_RPC_INTERNAL_ERROR = -32603;
+var MCP_PROTOCOL_VERSION = "2024-11-05";
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) throw new Error(`[mcp-handler] missing required env var ${name}`);
+  return v;
+}
+var KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
+var APPSYNC_URL = requireEnv("AMPLESS_APPSYNC_URL");
+var AWS_REGION = process.env["AWS_REGION"] ?? "us-east-1";
+var ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+var HTTP_TOOLS = tools.filter((t) => t.name !== "upload_media");
+function hashToken(plain) {
+  return createHash("sha256").update(plain).digest("hex");
+}
+function jsonResponse(statusCode, body) {
+  return {
+    statusCode,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  };
+}
+function jsonRpcResult(id, result) {
+  return { jsonrpc: "2.0", id, result };
+}
+function jsonRpcError(id, code, message, data) {
+  const error = { code, message };
+  if (data !== void 0) error.data = data;
+  return { jsonrpc: "2.0", id, error };
+}
+async function validateBearer(plaintext) {
+  const hash = hashToken(plaintext);
+  const res = await ddb.send(
+    new GetCommand({
+      TableName: KV_TABLE,
+      Key: { pk: TOKENS_PK, sk: hash }
+    })
+  );
+  const row = res.Item;
+  if (!row?.value) return null;
+  let meta;
+  try {
+    meta = JSON.parse(row.value);
+  } catch {
+    console.error("[mcp-handler] could not parse token row", { hash });
+    return null;
+  }
+  if (meta.revokedAt) return null;
+  if (meta.expiresAt && new Date(meta.expiresAt).getTime() <= Date.now()) return null;
+  return meta;
+}
+var cachedCtx = null;
+function makeContext(meta) {
+  if (cachedCtx && cachedCtx.defaultSiteId === (meta.scope.siteId ?? "default")) {
+    return cachedCtx;
+  }
+  const ctx = {
+    graphql: createMcpGraphqlClient({ endpoint: APPSYNC_URL, region: AWS_REGION }),
+    storage: () => {
+      throw new Error(
+        "upload_media is not available on the HTTP MCP transport in v0.2 Phase 4 \u2014 use the stdio CLI or wait for Phase 5"
+      );
+    },
+    defaultSiteId: meta.scope.siteId ?? "default"
+  };
+  cachedCtx = ctx;
+  return ctx;
+}
+async function dispatchJsonRpc(req, meta) {
+  switch (req.method) {
+    case "initialize":
+      return jsonRpcResult(req.id, {
+        protocolVersion: MCP_PROTOCOL_VERSION,
+        capabilities: { tools: {} },
+        serverInfo: { name: "ampless-mcp", version: "0.2" }
+      });
+    case "notifications/initialized":
+      return jsonRpcResult(req.id, null);
+    case "tools/list":
+      return jsonRpcResult(req.id, {
+        tools: HTTP_TOOLS.map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema
+        }))
+      });
+    case "tools/call": {
+      const params = req.params;
+      if (!params?.name || typeof params.name !== "string") {
+        return jsonRpcError(req.id, JSON_RPC_INVALID_PARAMS, "tools/call requires a `name` parameter");
+      }
+      const tool = HTTP_TOOLS.find((t) => t.name === params.name);
+      if (!tool) {
+        return jsonRpcError(req.id, JSON_RPC_METHOD_NOT_FOUND, `unknown tool: ${params.name}`);
+      }
+      const ctx = makeContext(meta);
+      try {
+        const result = await dispatchToolCall(params.name, params.arguments ?? {}, ctx);
+        return jsonRpcResult(req.id, {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error("[mcp-handler] tool dispatch failed", {
+          tool: params.name,
+          message
+        });
+        return jsonRpcResult(req.id, {
+          isError: true,
+          content: [{ type: "text", text: message }]
+        });
+      }
+    }
+    default:
+      return jsonRpcError(req.id, JSON_RPC_METHOD_NOT_FOUND, `Method not found: ${req.method}`);
+  }
+}
+var handler = async (event) => {
+  if (event.requestContext?.http?.method === "OPTIONS") {
+    return { statusCode: 204, body: "" };
+  }
+  const authHeader = event.headers?.authorization ?? event.headers?.Authorization;
+  if (!authHeader) {
+    return jsonResponse(401, { error: "missing_authorization" });
+  }
+  const match = /^Bearer\s+(amk_[A-Za-z0-9_-]+)$/.exec(authHeader);
+  if (!match) {
+    return jsonResponse(401, { error: "invalid_authorization" });
+  }
+  const plaintext = match[1];
+  const meta = await validateBearer(plaintext);
+  if (!meta) {
+    return jsonResponse(401, { error: "invalid_token" });
+  }
+  let req;
+  try {
+    const body = event.isBase64Encoded ? Buffer.from(event.body ?? "", "base64").toString("utf8") : event.body ?? "";
+    if (!body) {
+      return jsonResponse(400, jsonRpcError(null, JSON_RPC_INVALID_REQUEST, "Empty body"));
+    }
+    req = JSON.parse(body);
+  } catch {
+    return jsonResponse(400, jsonRpcError(null, JSON_RPC_PARSE_ERROR, "Parse error"));
+  }
+  if (req.jsonrpc !== "2.0" || typeof req.method !== "string") {
+    return jsonResponse(
+      400,
+      jsonRpcError(req?.id ?? null, JSON_RPC_INVALID_REQUEST, "Invalid Request")
+    );
+  }
+  try {
+    const response = await dispatchJsonRpc(req, meta);
+    return jsonResponse(200, response);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error("[mcp-handler] dispatch threw", { method: req.method, message });
+    return jsonResponse(
+      500,
+      jsonRpcError(req.id ?? null, JSON_RPC_INTERNAL_ERROR, message)
+    );
+  }
+};
+export {
+  handler
+};