@ampless/backend 0.2.0-alpha.15 → 0.2.0-alpha.16

package/dist/functions/mcp-handler.d.ts

@@ -1,6 +1,6 @@
 /**
- * MCP HTTP endpoint Lambda. Phase 4: Bearer validation + JSON-RPC 2.0
- * tool dispatch over AppSync IAM auth.
+ * MCP HTTP endpoint Lambda. Phase 5: Bearer validation + JSON-RPC 2.0
+ * tool dispatch over AppSync IAM auth, including `upload_media`.
  *
  *   1. Reads KvStore directly (PK = 'mcp-tokens', SK = SHA-256 hex)
  *      to validate `Authorization: Bearer amk_...`. Same narrow IAM
@@ -12,14 +12,14 @@
  *      registry. The GraphqlClient implementation hits AppSync with
  *      SigV4 (`AWS_IAM` auth mode), gated by `allow.resource(mcpHandler)
  *      .to(['query', 'mutate'])` on Post / PostTag in the schema.
+ *   4. `upload_media` decodes the base64 body inline and uploads to S3
+ *      using the Lambda execution role (s3:PutObject on public/media/*).
+ *      Payload limit ~6 MB (base64-inflated) covers typical CMS images;
+ *      large files should use the stdio CLI.
  *
  * Function URL event format: Lambda Function URLs emit API Gateway
  * HTTP v2 events (https://docs.aws.amazon.com/lambda/latest/dg/urls-invocation.html#urls-payloads).
  * Headers arrive lowercased.
- *
- * Note: `upload_media` is filtered out — the StorageClient flow needs
- * presigned S3 PUT URLs (the Lambda doesn't accept the binary body
- * itself), which lands in Phase 5.
  */
 interface FunctionUrlEvent {
     headers?: Record<string, string | undefined>;

package/dist/functions/mcp-handler.js

@@ -571,6 +571,26 @@ function createMcpGraphqlClient(opts) {
   };
 }
 
+// src/functions/mcp-storage-client.ts
+import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import { formatPublicAssetUrl } from "ampless";
+function createMcpStorageClient(opts) {
+  const client = new S3Client({ region: opts.region });
+  return {
+    async putObject(key, body, contentType) {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: opts.bucket,
+          Key: key,
+          Body: body,
+          ContentType: contentType
+        })
+      );
+      return formatPublicAssetUrl(opts.bucket, opts.region, key);
+    }
+  };
+}
+
 // src/functions/mcp-handler.ts
 var TOKENS_PK = "mcp-tokens";
 var JSON_RPC_PARSE_ERROR = -32700;
@@ -586,9 +606,10 @@ function requireEnv(name) {
 }
 var KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
 var APPSYNC_URL = requireEnv("AMPLESS_APPSYNC_URL");
+var BUCKET_NAME = requireEnv("AMPLESS_BUCKET_NAME");
 var AWS_REGION = process.env["AWS_REGION"] ?? "us-east-1";
 var ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
-var HTTP_TOOLS = tools.filter((t) => t.name !== "upload_media");
+var HTTP_TOOLS = tools;
 function hashToken(plain) {
   return createHash("sha256").update(plain).digest("hex");
 }
@@ -636,12 +657,14 @@ function makeContext(meta) {
   if (cachedCtx && cachedCtx.defaultSiteId === (meta.scope.siteId ?? "default")) {
     return cachedCtx;
   }
+  let storageClient = null;
   const ctx = {
     graphql: createMcpGraphqlClient({ endpoint: APPSYNC_URL, region: AWS_REGION }),
     storage: () => {
-      throw new Error(
-        "upload_media is not available on the HTTP MCP transport in v0.2 Phase 4 \u2014 use the stdio CLI or wait for Phase 5"
-      );
+      if (!storageClient) {
+        storageClient = createMcpStorageClient({ bucket: BUCKET_NAME, region: AWS_REGION });
+      }
+      return storageClient;
     },
     defaultSiteId: meta.scope.siteId ?? "default"
   };

package/dist/index.js

@@ -182,6 +182,14 @@ function defineAmplessBackend(opts) {
     "AMPLESS_APPSYNC_URL",
     backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl
   );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject"],
+      resources: [`${backend.storage.resources.bucket.bucketArn}/public/media/*`]
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_BUCKET_NAME", backend.storage.resources.bucket.bucketName);
   const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
     authType: FunctionUrlAuthType.NONE,
     cors: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.15",
+  "version": "0.2.0-alpha.16",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",