@ampless/backend 0.2.0-alpha.14 → 0.2.0-alpha.16

package/dist/functions/mcp-handler.d.ts

@@ -1,6 +1,6 @@
 /**
- * MCP HTTP endpoint Lambda. Phase 4: Bearer validation + JSON-RPC 2.0
- * tool dispatch over AppSync IAM auth.
+ * MCP HTTP endpoint Lambda. Phase 5: Bearer validation + JSON-RPC 2.0
+ * tool dispatch over AppSync IAM auth, including `upload_media`.
  *
  *   1. Reads KvStore directly (PK = 'mcp-tokens', SK = SHA-256 hex)
  *      to validate `Authorization: Bearer amk_...`. Same narrow IAM
@@ -12,14 +12,14 @@
  *      registry. The GraphqlClient implementation hits AppSync with
  *      SigV4 (`AWS_IAM` auth mode), gated by `allow.resource(mcpHandler)
  *      .to(['query', 'mutate'])` on Post / PostTag in the schema.
+ *   4. `upload_media` decodes the base64 body inline and uploads to S3
+ *      using the Lambda execution role (s3:PutObject on public/media/*).
+ *      Payload limit ~6 MB (base64-inflated) covers typical CMS images;
+ *      large files should use the stdio CLI.
  *
  * Function URL event format: Lambda Function URLs emit API Gateway
  * HTTP v2 events (https://docs.aws.amazon.com/lambda/latest/dg/urls-invocation.html#urls-payloads).
  * Headers arrive lowercased.
- *
- * Note: `upload_media` is filtered out — the StorageClient flow needs
- * presigned S3 PUT URLs (the Lambda doesn't accept the binary body
- * itself), which lands in Phase 5.
  */
 interface FunctionUrlEvent {
     headers?: Record<string, string | undefined>;

package/dist/functions/mcp-handler.js

@@ -4,10 +4,12 @@ import "../chunk-BYXBJQAS.js";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";
 import { createHash } from "crypto";
+import { decodeAwsJson as decodeAwsJson2 } from "ampless";
 
-// ../mcp-server/dist/chunk-KM6F5QJH.js
-import { composeSiteIdStatus, composeSiteIdSlug } from "ampless";
-import { composeSiteIdStatus as composeSiteIdStatus2, composeSiteIdSlug as composeSiteIdSlug2 } from "ampless";
+// ../mcp-server/dist/chunk-6LH275IC.js
+import { decodeAwsJson } from "ampless";
+import { composeSiteIdStatus, composeSiteIdSlug, encodeAwsJson } from "ampless";
+import { composeSiteIdStatus as composeSiteIdStatus2, composeSiteIdSlug as composeSiteIdSlug2, encodeAwsJson as encodeAwsJson2 } from "ampless";
 var POST_FIELDS = (
   /* GraphQL */
   `
@@ -25,18 +27,6 @@ var POST_FIELDS = (
   }
 `
 );
-function decodeBody(value) {
-  if (typeof value !== "string") return value;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-}
-function encodeBody(value) {
-  if (typeof value === "string") return value;
-  return JSON.stringify(value ?? null);
-}
 function toCorePost(p) {
   return {
     siteId: p.siteId,
@@ -45,7 +35,7 @@ function toCorePost(p) {
     title: p.title,
     excerpt: p.excerpt ?? void 0,
     format: p.format ?? "markdown",
-    body: decodeBody(p.body),
+    body: decodeAwsJson(p.body),
     status: p.status ?? "draft",
     publishedAt: p.publishedAt ?? void 0,
     tags: (p.tags ?? []).filter((t) => typeof t === "string")
@@ -266,7 +256,7 @@ async function createPost(client, defaultSiteId, args) {
       title: args.title,
       excerpt: args.excerpt,
       format: args.format,
-      body: encodeBody(args.body),
+      body: encodeAwsJson(args.body),
       status,
       publishedAt,
       tags: args.tags,
@@ -314,7 +304,7 @@ async function updatePost(client, defaultSiteId, args) {
   if (args.title !== void 0) input.title = args.title;
   if (args.excerpt !== void 0) input.excerpt = args.excerpt;
   if (args.format !== void 0) input.format = args.format;
-  if (args.body !== void 0) input.body = encodeBody(args.body);
+  if (args.body !== void 0) input.body = encodeAwsJson2(args.body);
   if (args.status !== void 0) input.status = args.status;
   if (args.publishedAt !== void 0) input.publishedAt = args.publishedAt;
   if (args.tags !== void 0) input.tags = args.tags;
@@ -581,6 +571,26 @@ function createMcpGraphqlClient(opts) {
   };
 }
 
+// src/functions/mcp-storage-client.ts
+import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import { formatPublicAssetUrl } from "ampless";
+function createMcpStorageClient(opts) {
+  const client = new S3Client({ region: opts.region });
+  return {
+    async putObject(key, body, contentType) {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: opts.bucket,
+          Key: key,
+          Body: body,
+          ContentType: contentType
+        })
+      );
+      return formatPublicAssetUrl(opts.bucket, opts.region, key);
+    }
+  };
+}
+
 // src/functions/mcp-handler.ts
 var TOKENS_PK = "mcp-tokens";
 var JSON_RPC_PARSE_ERROR = -32700;
@@ -596,9 +606,10 @@ function requireEnv(name) {
 }
 var KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
 var APPSYNC_URL = requireEnv("AMPLESS_APPSYNC_URL");
+var BUCKET_NAME = requireEnv("AMPLESS_BUCKET_NAME");
 var AWS_REGION = process.env["AWS_REGION"] ?? "us-east-1";
 var ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
-var HTTP_TOOLS = tools.filter((t) => t.name !== "upload_media");
+var HTTP_TOOLS = tools;
 function hashToken(plain) {
   return createHash("sha256").update(plain).digest("hex");
 }
@@ -637,27 +648,23 @@ async function validateBearer(plaintext) {
   return meta;
 }
 function decodeTokenMeta(value) {
-  if (typeof value === "object") return value;
-  if (typeof value === "string") {
-    try {
-      return JSON.parse(value);
-    } catch {
-      return null;
-    }
-  }
-  return null;
+  const parsed = decodeAwsJson2(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  return parsed;
 }
 var cachedCtx = null;
 function makeContext(meta) {
   if (cachedCtx && cachedCtx.defaultSiteId === (meta.scope.siteId ?? "default")) {
     return cachedCtx;
   }
+  let storageClient = null;
   const ctx = {
     graphql: createMcpGraphqlClient({ endpoint: APPSYNC_URL, region: AWS_REGION }),
     storage: () => {
-      throw new Error(
-        "upload_media is not available on the HTTP MCP transport in v0.2 Phase 4 \u2014 use the stdio CLI or wait for Phase 5"
-      );
+      if (!storageClient) {
+        storageClient = createMcpStorageClient({ bucket: BUCKET_NAME, region: AWS_REGION });
+      }
+      return storageClient;
     },
     defaultSiteId: meta.scope.siteId ?? "default"
   };

package/dist/index.js

@@ -182,6 +182,14 @@ function defineAmplessBackend(opts) {
     "AMPLESS_APPSYNC_URL",
     backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl
   );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject"],
+      resources: [`${backend.storage.resources.bucket.bucketArn}/public/media/*`]
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_BUCKET_NAME", backend.storage.resources.bucket.bucketName);
   const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
     authType: FunctionUrlAuthType.NONE,
     cors: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.14",
+  "version": "0.2.0-alpha.16",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -64,8 +64,8 @@
     "@aws-sdk/util-dynamodb": "^3.717.0",
     "@smithy/protocol-http": "^5.3.0",
     "@smithy/signature-v4": "^5.4.0",
-    "ampless": "0.2.0-alpha.6",
-    "@ampless/mcp-server": "0.2.0-alpha.6"
+    "ampless": "0.2.0-alpha.7",
+    "@ampless/mcp-server": "0.2.0-alpha.7"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",