@ampless/backend 0.2.0-alpha.15 → 0.2.0-alpha.17

package/dist/functions/mcp-handler.d.ts

@@ -1,6 +1,6 @@
 /**
- * MCP HTTP endpoint Lambda. Phase 4: Bearer validation + JSON-RPC 2.0
- * tool dispatch over AppSync IAM auth.
+ * MCP HTTP endpoint Lambda. Phase 5: Bearer validation + JSON-RPC 2.0
+ * tool dispatch over AppSync IAM auth, including `upload_media`.
  *
  *   1. Reads KvStore directly (PK = 'mcp-tokens', SK = SHA-256 hex)
  *      to validate `Authorization: Bearer amk_...`. Same narrow IAM
@@ -12,14 +12,14 @@
  *      registry. The GraphqlClient implementation hits AppSync with
  *      SigV4 (`AWS_IAM` auth mode), gated by `allow.resource(mcpHandler)
  *      .to(['query', 'mutate'])` on Post / PostTag in the schema.
+ *   4. `upload_media` decodes the base64 body inline and uploads to S3
+ *      using the Lambda execution role (s3:PutObject on public/media/*).
+ *      Payload limit ~6 MB (base64-inflated) covers typical CMS images;
+ *      large files should use the stdio CLI.
  *
  * Function URL event format: Lambda Function URLs emit API Gateway
  * HTTP v2 events (https://docs.aws.amazon.com/lambda/latest/dg/urls-invocation.html#urls-payloads).
  * Headers arrive lowercased.
- *
- * Note: `upload_media` is filtered out — the StorageClient flow needs
- * presigned S3 PUT URLs (the Lambda doesn't accept the binary body
- * itself), which lands in Phase 5.
  */
 interface FunctionUrlEvent {
     headers?: Record<string, string | undefined>;

package/dist/functions/mcp-handler.js

@@ -6,10 +6,20 @@ import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";
 import { createHash } from "crypto";
 import { decodeAwsJson as decodeAwsJson2 } from "ampless";
 
-// ../mcp-server/dist/chunk-6LH275IC.js
-import { decodeAwsJson } from "ampless";
-import { composeSiteIdStatus, composeSiteIdSlug, encodeAwsJson } from "ampless";
-import { composeSiteIdStatus as composeSiteIdStatus2, composeSiteIdSlug as composeSiteIdSlug2, encodeAwsJson as encodeAwsJson2 } from "ampless";
+// ../mcp-server/dist/chunk-EGQ7Q3Y3.js
+import {
+  decodeAwsJson
+} from "ampless";
+import {
+  composeSiteIdStatus,
+  composeSiteIdSlug,
+  encodeAwsJson
+} from "ampless";
+import {
+  composeSiteIdStatus as composeSiteIdStatus2,
+  composeSiteIdSlug as composeSiteIdSlug2,
+  encodeAwsJson as encodeAwsJson2
+} from "ampless";
 var POST_FIELDS = (
   /* GraphQL */
   `
@@ -24,10 +34,12 @@ var POST_FIELDS = (
     status
     publishedAt
     tags
+    metadata
   }
 `
 );
 function toCorePost(p) {
+  const metadata = decodeAwsJson(p.metadata);
   return {
     siteId: p.siteId,
     postId: p.postId,
@@ -38,7 +50,8 @@ function toCorePost(p) {
     body: decodeAwsJson(p.body),
     status: p.status ?? "draft",
     publishedAt: p.publishedAt ?? void 0,
-    tags: (p.tags ?? []).filter((t) => typeof t === "string")
+    tags: (p.tags ?? []).filter((t) => typeof t === "string"),
+    metadata: metadata && typeof metadata === "object" && !Array.isArray(metadata) ? metadata : void 0
   };
 }
 var QUERY = (
@@ -233,14 +246,29 @@ var createPostSchema = {
     postId: { type: "string", description: "Optional explicit id; auto-generated if omitted" },
     slug: { type: "string" },
     title: { type: "string" },
-    format: { type: "string", enum: ["tiptap", "markdown", "html"] },
+    format: {
+      type: "string",
+      enum: ["tiptap", "markdown", "html"],
+      description: "tiptap = rich text JSON tree; markdown = source string (GFM extensions enabled); html = raw HTML string (rendered verbatim, no sanitization)."
+    },
     body: {
-      description: "tiptap JSON (when format=tiptap), markdown source string, or raw HTML string"
+      description: "tiptap JSON (when format=tiptap), markdown source string (format=markdown), or raw HTML string (format=html)."
     },
     status: { type: "string", enum: ["draft", "published"], default: "draft" },
     excerpt: { type: "string" },
     publishedAt: { type: "string", description: "ISO 8601 timestamp; required when status=published" },
-    tags: { type: "array", items: { type: "string" } }
+    tags: { type: "array", items: { type: "string" } },
+    metadata: {
+      type: "object",
+      description: "Free-form per-post metadata. Reserved well-known keys: `no_layout` (boolean) \u2014 when true, the public page is served as bare HTML with no theme chrome (the route redirects to /raw/<slug>); meaningful only with format=html. Other keys pass through unchanged for themes/plugins.",
+      properties: {
+        no_layout: {
+          type: "boolean",
+          description: "Serve the post as bare HTML with no theme chrome. Only meaningful when format=html; ignored otherwise."
+        }
+      },
+      additionalProperties: true
+    }
   }
 };
 async function createPost(client, defaultSiteId, args) {
@@ -260,6 +288,7 @@ async function createPost(client, defaultSiteId, args) {
       status,
       publishedAt,
       tags: args.tags,
+      metadata: args.metadata !== void 0 ? encodeAwsJson(args.metadata) : void 0,
       // Denormalized GSI keys.
       siteIdStatus: composeSiteIdStatus(siteId, status),
       siteIdSlug: composeSiteIdSlug(siteId, args.slug)
@@ -289,11 +318,26 @@ var updatePostSchema = {
     slug: { type: "string" },
     title: { type: "string" },
     excerpt: { type: "string" },
-    format: { type: "string", enum: ["tiptap", "markdown", "html"] },
-    body: { description: "tiptap JSON, markdown source, or raw HTML" },
+    format: {
+      type: "string",
+      enum: ["tiptap", "markdown", "html"],
+      description: "tiptap = rich text JSON tree; markdown = source string; html = raw HTML string (no sanitization)."
+    },
+    body: { description: "tiptap JSON, markdown source, or raw HTML string" },
     status: { type: "string", enum: ["draft", "published"] },
     publishedAt: { type: "string", description: "ISO 8601 timestamp" },
-    tags: { type: "array", items: { type: "string" } }
+    tags: { type: "array", items: { type: "string" } },
+    metadata: {
+      type: "object",
+      description: "Free-form per-post metadata. Reserved well-known keys: `no_layout` (boolean) \u2014 when true, the public page is served as bare HTML with no theme chrome (the route redirects to /raw/<slug>); meaningful only with format=html. Passing metadata replaces the existing metadata object \u2014 read the current post first if you only want to add a key.",
+      properties: {
+        no_layout: {
+          type: "boolean",
+          description: "Serve the post as bare HTML with no theme chrome. Only meaningful when format=html; ignored otherwise."
+        }
+      },
+      additionalProperties: true
+    }
   }
 };
 async function updatePost(client, defaultSiteId, args) {
@@ -308,6 +352,7 @@ async function updatePost(client, defaultSiteId, args) {
   if (args.status !== void 0) input.status = args.status;
   if (args.publishedAt !== void 0) input.publishedAt = args.publishedAt;
   if (args.tags !== void 0) input.tags = args.tags;
+  if (args.metadata !== void 0) input.metadata = encodeAwsJson2(args.metadata);
   if (args.status !== void 0) {
     input.siteIdStatus = composeSiteIdStatus2(siteId, args.status);
   }
@@ -428,7 +473,11 @@ function getSchema() {
           },
           status: { type: "enum", values: ["draft", "published"], default: "draft" },
           publishedAt: { type: "datetime", description: "ISO 8601" },
-          tags: { type: "string[]" }
+          tags: { type: "string[]" },
+          metadata: {
+            type: "json",
+            description: "Free-form per-post key/value bag. Reserved well-known keys (owned by ampless): `no_layout` (boolean). Other keys pass through unchanged for themes/plugins."
+          }
         }
       },
       {
@@ -461,7 +510,9 @@ function getSchema() {
     formats: ["tiptap", "markdown", "html"],
     notes: {
       editorTrust: 'editor stores arbitrary HTML/JS verbatim \u2014 same trust shape as WordPress unfiltered_html capability. See docs/architecture/04-access-layer-mcp.md \xA7"editor \u306E\u4FE1\u983C\u30E2\u30C7\u30EB".',
-      tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.'
+      tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.',
+      noLayout: "metadata.no_layout=true serves the post as bare HTML with no theme chrome \u2014 the public route at /<slug> 302-redirects to /raw/<slug>, and that route renders the body verbatim with no wrapping <html>/<head>/layout. Use this for landing pages, embeds, or any post whose body is a full HTML document. Only meaningful with format=html (the other formats need the theme renderer).",
+      staticFormat: "A fourth format value `static` exists on the underlying data model for posts whose body is a JSON manifest pointing to a pre-uploaded HTML/CSS/JS bundle in S3 at public/static/<siteId>/<slug>/. Static uploads currently only flow through the admin UI; the MCP `upload_media` tool writes to public/media/ and does not handle static bundles. Use the admin StaticUploader for now."
     }
   };
 }
@@ -480,13 +531,13 @@ var tools = [
   },
   {
     name: "create_post",
-    description: "Create a new post. Title and slug are required. Body shape depends on format: tiptap=JSON node tree, markdown=source string, html=raw HTML string. Defaults to status=draft.",
+    description: "Create a new post. Title and slug are required. Body shape depends on format: tiptap=JSON node tree, markdown=source string, html=raw HTML string. Defaults to status=draft. Pass `metadata: { no_layout: true }` alongside format=html to publish the body as a bare HTML page with no theme chrome (the public route redirects to /raw/<slug>).",
     inputSchema: createPostSchema,
     handler: (args, ctx) => createPost(ctx.graphql, ctx.defaultSiteId, args)
   },
   {
     name: "update_post",
-    description: "Update an existing post by postId. Only the fields you pass are changed. Tag list / publishedAt changes also update the PostTag denormalized index.",
+    description: "Update an existing post by postId. Only the fields you pass are changed. Tag list / publishedAt changes also update the PostTag denormalized index. Passing `metadata` REPLACES the existing object \u2014 call get_post first if you only want to add or change one key.",
     inputSchema: updatePostSchema,
     handler: (args, ctx) => updatePost(ctx.graphql, ctx.defaultSiteId, args)
   },
@@ -571,6 +622,26 @@ function createMcpGraphqlClient(opts) {
   };
 }
 
+// src/functions/mcp-storage-client.ts
+import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import { formatPublicAssetUrl } from "ampless";
+function createMcpStorageClient(opts) {
+  const client = new S3Client({ region: opts.region });
+  return {
+    async putObject(key, body, contentType) {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: opts.bucket,
+          Key: key,
+          Body: body,
+          ContentType: contentType
+        })
+      );
+      return formatPublicAssetUrl(opts.bucket, opts.region, key);
+    }
+  };
+}
+
 // src/functions/mcp-handler.ts
 var TOKENS_PK = "mcp-tokens";
 var JSON_RPC_PARSE_ERROR = -32700;
@@ -586,9 +657,10 @@ function requireEnv(name) {
 }
 var KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
 var APPSYNC_URL = requireEnv("AMPLESS_APPSYNC_URL");
+var BUCKET_NAME = requireEnv("AMPLESS_BUCKET_NAME");
 var AWS_REGION = process.env["AWS_REGION"] ?? "us-east-1";
 var ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
-var HTTP_TOOLS = tools.filter((t) => t.name !== "upload_media");
+var HTTP_TOOLS = tools;
 function hashToken(plain) {
   return createHash("sha256").update(plain).digest("hex");
 }
@@ -636,12 +708,14 @@ function makeContext(meta) {
   if (cachedCtx && cachedCtx.defaultSiteId === (meta.scope.siteId ?? "default")) {
     return cachedCtx;
   }
+  let storageClient = null;
   const ctx = {
     graphql: createMcpGraphqlClient({ endpoint: APPSYNC_URL, region: AWS_REGION }),
     storage: () => {
-      throw new Error(
-        "upload_media is not available on the HTTP MCP transport in v0.2 Phase 4 \u2014 use the stdio CLI or wait for Phase 5"
-      );
+      if (!storageClient) {
+        storageClient = createMcpStorageClient({ bucket: BUCKET_NAME, region: AWS_REGION });
+      }
+      return storageClient;
     },
     defaultSiteId: meta.scope.siteId ?? "default"
   };

package/dist/index.js

@@ -182,6 +182,14 @@ function defineAmplessBackend(opts) {
     "AMPLESS_APPSYNC_URL",
     backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl
   );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject"],
+      resources: [`${backend.storage.resources.bucket.bucketArn}/public/media/*`]
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_BUCKET_NAME", backend.storage.resources.bucket.bucketName);
   const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
     authType: FunctionUrlAuthType.NONE,
     cors: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.15",
+  "version": "0.2.0-alpha.17",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -65,7 +65,7 @@
     "@smithy/protocol-http": "^5.3.0",
     "@smithy/signature-v4": "^5.4.0",
     "ampless": "0.2.0-alpha.7",
-    "@ampless/mcp-server": "0.2.0-alpha.7"
+    "@ampless/mcp-server": "0.2.0-alpha.8"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",