@ampless/backend 0.2.0-alpha.16 → 0.2.0-alpha.18

package/dist/functions/mcp-handler.js

@@ -6,10 +6,48 @@ import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";
 import { createHash } from "crypto";
 import { decodeAwsJson as decodeAwsJson2 } from "ampless";
 
-// ../mcp-server/dist/chunk-6LH275IC.js
-import { decodeAwsJson } from "ampless";
-import { composeSiteIdStatus, composeSiteIdSlug, encodeAwsJson } from "ampless";
-import { composeSiteIdStatus as composeSiteIdStatus2, composeSiteIdSlug as composeSiteIdSlug2, encodeAwsJson as encodeAwsJson2 } from "ampless";
+// ../mcp-server/dist/chunk-4PTNHZO4.js
+import {
+  decodeAwsJson
+} from "ampless";
+import {
+  composeSiteIdStatus,
+  composeSiteIdSlug,
+  encodeAwsJson
+} from "ampless";
+import {
+  composeSiteIdStatus as composeSiteIdStatus2,
+  composeSiteIdSlug as composeSiteIdSlug2,
+  encodeAwsJson as encodeAwsJson2
+} from "ampless";
+import {
+  bundlePrefix,
+  mimeTypeFor,
+  pickDefaultEntrypoint,
+  validateBundle
+} from "ampless";
+import { unzipSync, strFromU8 } from "fflate";
+import {
+  validateBundlePath,
+  stripCommonPrefix
+} from "ampless";
+import {
+  composeSiteIdStatus as composeSiteIdStatus3,
+  composeSiteIdSlug as composeSiteIdSlug3,
+  encodeAwsJson as encodeAwsJson3
+} from "ampless";
+import {
+  bundlePrefix as bundlePrefix2,
+  findAbsolutePathRefs,
+  mimeTypeFor as mimeTypeFor2,
+  validateBundlePath as validateBundlePath2,
+  TEXT_EXTENSIONS
+} from "ampless";
+import { bundlePrefix as bundlePrefix3, validateBundlePath as validateBundlePath3 } from "ampless";
+import {
+  bundlePrefix as bundlePrefix4,
+  pickDefaultEntrypoint as pickDefaultEntrypoint2
+} from "ampless";
 var POST_FIELDS = (
   /* GraphQL */
   `
@@ -24,10 +62,12 @@ var POST_FIELDS = (
     status
     publishedAt
     tags
+    metadata
   }
 `
 );
 function toCorePost(p) {
+  const metadata = decodeAwsJson(p.metadata);
   return {
     siteId: p.siteId,
     postId: p.postId,
@@ -38,7 +78,8 @@ function toCorePost(p) {
     body: decodeAwsJson(p.body),
     status: p.status ?? "draft",
     publishedAt: p.publishedAt ?? void 0,
-    tags: (p.tags ?? []).filter((t) => typeof t === "string")
+    tags: (p.tags ?? []).filter((t) => typeof t === "string"),
+    metadata: metadata && typeof metadata === "object" && !Array.isArray(metadata) ? metadata : void 0
   };
 }
 var QUERY = (
@@ -233,14 +274,29 @@ var createPostSchema = {
     postId: { type: "string", description: "Optional explicit id; auto-generated if omitted" },
     slug: { type: "string" },
     title: { type: "string" },
-    format: { type: "string", enum: ["tiptap", "markdown", "html"] },
+    format: {
+      type: "string",
+      enum: ["tiptap", "markdown", "html"],
+      description: "tiptap = rich text JSON tree; markdown = source string (GFM extensions enabled); html = raw HTML string (rendered verbatim, no sanitization)."
+    },
     body: {
-      description: "tiptap JSON (when format=tiptap), markdown source string, or raw HTML string"
+      description: "tiptap JSON (when format=tiptap), markdown source string (format=markdown), or raw HTML string (format=html)."
     },
     status: { type: "string", enum: ["draft", "published"], default: "draft" },
     excerpt: { type: "string" },
     publishedAt: { type: "string", description: "ISO 8601 timestamp; required when status=published" },
-    tags: { type: "array", items: { type: "string" } }
+    tags: { type: "array", items: { type: "string" } },
+    metadata: {
+      type: "object",
+      description: "Free-form per-post metadata. Reserved well-known keys: `no_layout` (boolean) \u2014 when true, the public page is served as bare HTML with no theme chrome (the route redirects to /raw/<slug>); meaningful only with format=html. Other keys pass through unchanged for themes/plugins.",
+      properties: {
+        no_layout: {
+          type: "boolean",
+          description: "Serve the post as bare HTML with no theme chrome. Only meaningful when format=html; ignored otherwise."
+        }
+      },
+      additionalProperties: true
+    }
   }
 };
 async function createPost(client, defaultSiteId, args) {
@@ -260,6 +316,7 @@ async function createPost(client, defaultSiteId, args) {
       status,
       publishedAt,
       tags: args.tags,
+      metadata: args.metadata !== void 0 ? encodeAwsJson(args.metadata) : void 0,
       // Denormalized GSI keys.
       siteIdStatus: composeSiteIdStatus(siteId, status),
       siteIdSlug: composeSiteIdSlug(siteId, args.slug)
@@ -289,11 +346,26 @@ var updatePostSchema = {
     slug: { type: "string" },
     title: { type: "string" },
     excerpt: { type: "string" },
-    format: { type: "string", enum: ["tiptap", "markdown", "html"] },
-    body: { description: "tiptap JSON, markdown source, or raw HTML" },
+    format: {
+      type: "string",
+      enum: ["tiptap", "markdown", "html"],
+      description: "tiptap = rich text JSON tree; markdown = source string; html = raw HTML string (no sanitization)."
+    },
+    body: { description: "tiptap JSON, markdown source, or raw HTML string" },
     status: { type: "string", enum: ["draft", "published"] },
     publishedAt: { type: "string", description: "ISO 8601 timestamp" },
-    tags: { type: "array", items: { type: "string" } }
+    tags: { type: "array", items: { type: "string" } },
+    metadata: {
+      type: "object",
+      description: "Free-form per-post metadata. Reserved well-known keys: `no_layout` (boolean) \u2014 when true, the public page is served as bare HTML with no theme chrome (the route redirects to /raw/<slug>); meaningful only with format=html. Passing metadata replaces the existing metadata object \u2014 read the current post first if you only want to add a key.",
+      properties: {
+        no_layout: {
+          type: "boolean",
+          description: "Serve the post as bare HTML with no theme chrome. Only meaningful when format=html; ignored otherwise."
+        }
+      },
+      additionalProperties: true
+    }
   }
 };
 async function updatePost(client, defaultSiteId, args) {
@@ -308,6 +380,7 @@ async function updatePost(client, defaultSiteId, args) {
   if (args.status !== void 0) input.status = args.status;
   if (args.publishedAt !== void 0) input.publishedAt = args.publishedAt;
   if (args.tags !== void 0) input.tags = args.tags;
+  if (args.metadata !== void 0) input.metadata = encodeAwsJson2(args.metadata);
   if (args.status !== void 0) {
     input.siteIdStatus = composeSiteIdStatus2(siteId, args.status);
   }
@@ -428,7 +501,11 @@ function getSchema() {
           },
           status: { type: "enum", values: ["draft", "published"], default: "draft" },
           publishedAt: { type: "datetime", description: "ISO 8601" },
-          tags: { type: "string[]" }
+          tags: { type: "string[]" },
+          metadata: {
+            type: "json",
+            description: "Free-form per-post key/value bag. Reserved well-known keys (owned by ampless): `no_layout` (boolean). Other keys pass through unchanged for themes/plugins."
+          }
         }
       },
       {
@@ -461,9 +538,334 @@ function getSchema() {
     formats: ["tiptap", "markdown", "html"],
     notes: {
       editorTrust: 'editor stores arbitrary HTML/JS verbatim \u2014 same trust shape as WordPress unfiltered_html capability. See docs/architecture/04-access-layer-mcp.md \xA7"editor \u306E\u4FE1\u983C\u30E2\u30C7\u30EB".',
-      tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.'
+      tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.',
+      noLayout: "metadata.no_layout=true serves the post as bare HTML with no theme chrome \u2014 the public route at /<slug> 302-redirects to /raw/<slug>, and that route renders the body verbatim with no wrapping <html>/<head>/layout. Use this for landing pages, embeds, or any post whose body is a full HTML document. Only meaningful with format=html (the other formats need the theme renderer).",
+      staticFormat: "A fourth format value `static` exists on the underlying data model for posts whose body is a JSON manifest pointing to a pre-uploaded HTML/CSS/JS bundle in S3 at public/static/<siteId>/<slug>/. Static posts are created/edited through the dedicated tools `upload_static_bundle` (zip in one shot), `upload_static_file` / `delete_static_file` (incremental per-file ops), and `commit_static_post` (rebuild the manifest from the current S3 prefix). `create_post` / `update_post` intentionally do NOT accept format=static \u2014 the bundle tools are the only supported entry point so the Post manifest stays in sync with the S3 prefix."
+    }
+  };
+}
+var DEFAULT_MAX_BYTES = 50 * 1024 * 1024;
+function extractZipFromBuffer(buffer, opts = {}) {
+  const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+  const entries2 = unzipSync(buffer);
+  const files = [];
+  const issues = [];
+  let totalBytes = 0;
+  for (const [name, data] of Object.entries(entries2)) {
+    if (name.endsWith("/")) continue;
+    const reason = validateBundlePath(name);
+    if (reason) {
+      const silent = reason === "macOS resource fork" || reason === ".DS_Store junk" || reason === "Thumbs.db junk" || reason === "directory entry";
+      if (!silent) issues.push({ path: name, reason });
+      continue;
+    }
+    totalBytes += data.byteLength;
+    if (totalBytes > maxBytes) {
+      throw new Error(
+        `Bundle too large: uncompressed size exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB ceiling.`
+      );
+    }
+    files.push({ path: name, data });
+  }
+  return { files: stripCommonPrefix(files), issues, totalBytes };
+}
+var CREATE_MUTATION = (
+  /* GraphQL */
+  `
+  ${POST_FIELDS}
+  mutation CreatePost($input: CreatePostInput!) {
+    createPost(input: $input) {
+      ...PostFields
+    }
+  }
+`
+);
+var UPDATE_MUTATION = (
+  /* GraphQL */
+  `
+  ${POST_FIELDS}
+  mutation UpdatePost($input: UpdatePostInput!) {
+    updatePost(input: $input) {
+      ...PostFields
+    }
+  }
+`
+);
+async function upsertStaticPost(graphql, siteId, slug, body, fields) {
+  const existing = await getPost(graphql, siteId, { siteId, slug });
+  if (existing) {
+    const input2 = {
+      siteId,
+      postId: existing.postId,
+      format: "static",
+      body: encodeAwsJson3(body)
+    };
+    if (fields.title !== void 0) input2.title = fields.title;
+    if (fields.excerpt !== void 0) input2.excerpt = fields.excerpt;
+    if (fields.status !== void 0) {
+      input2.status = fields.status;
+      input2.siteIdStatus = composeSiteIdStatus3(siteId, fields.status);
     }
+    if (fields.publishedAt !== void 0) input2.publishedAt = fields.publishedAt;
+    if (fields.tags !== void 0) input2.tags = fields.tags;
+    if (fields.metadata !== void 0) {
+      input2.metadata = encodeAwsJson3(fields.metadata);
+    }
+    const data2 = await graphql.query(UPDATE_MUTATION, { input: input2 });
+    const updated = toCorePost(data2.updatePost);
+    await syncPostTags(graphql, updated, existing);
+    return { post: updated, created: false };
+  }
+  if (!fields.title) {
+    throw new Error(
+      `commit_static_post: cannot create a new post at slug "${slug}" without a title. Pass \`title\` or commit against an existing post.`
+    );
+  }
+  const status = fields.status ?? "draft";
+  const publishedAt = fields.publishedAt ?? (status === "published" ? (/* @__PURE__ */ new Date()).toISOString() : void 0);
+  const postId = fields.postId ?? `post-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const input = {
+    siteId,
+    postId,
+    slug,
+    title: fields.title,
+    format: "static",
+    body: encodeAwsJson3(body),
+    status,
+    siteIdStatus: composeSiteIdStatus3(siteId, status),
+    siteIdSlug: composeSiteIdSlug3(siteId, slug)
   };
+  if (fields.excerpt !== void 0) input.excerpt = fields.excerpt;
+  if (publishedAt !== void 0) input.publishedAt = publishedAt;
+  if (fields.tags !== void 0) input.tags = fields.tags;
+  if (fields.metadata !== void 0) input.metadata = encodeAwsJson3(fields.metadata);
+  const data = await graphql.query(CREATE_MUTATION, { input });
+  const created = toCorePost(data.createPost);
+  await syncPostTags(graphql, created, null);
+  return { post: created, created: true };
+}
+var uploadStaticBundleSchema = {
+  type: "object",
+  required: ["slug", "title", "zipBase64"],
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    postId: {
+      type: "string",
+      description: "Optional explicit Post id when creating a new post. Ignored if a post at this slug already exists."
+    },
+    slug: { type: "string", description: "URL slug. Doubles as the S3 bundle path key." },
+    title: { type: "string" },
+    zipBase64: {
+      type: "string",
+      description: "Base64-encoded zip archive. NO `data:` URL prefix. Every entry must reference others by RELATIVE path; absolute paths (`/foo`) and protocol-relative URLs (`//cdn/foo`) inside HTML / CSS / SVG are rejected as the bundle would not be portable across URL prefixes."
+    },
+    entrypoint: {
+      type: "string",
+      description: "Relative path to the file served at the post URL (default `index.html`, or the first `.html` at root if `index.html` is absent)."
+    },
+    status: { type: "string", enum: ["draft", "published"], default: "draft" },
+    excerpt: { type: "string" },
+    publishedAt: { type: "string", description: 'ISO 8601 timestamp; defaults to "now" when status=published.' },
+    tags: { type: "array", items: { type: "string" } },
+    metadata: {
+      type: "object",
+      description: "Free-form per-post metadata. NOTE: `no_layout` is irrelevant for static posts (the bundle is already served raw).",
+      additionalProperties: true
+    }
+  }
+};
+async function uploadStaticBundle(graphql, storage, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const slug = args.slug;
+  const zipBytes = Buffer.from(args.zipBase64, "base64");
+  if (zipBytes.length === 0) {
+    throw new Error("upload_static_bundle: zipBase64 decoded to zero bytes.");
+  }
+  const { files, issues } = extractZipFromBuffer(zipBytes);
+  if (issues.length > 0) {
+    throw new Error(
+      `upload_static_bundle: rejected bundle path(s): ${issues.map((i) => `${i.path} (${i.reason})`).join("; ")}`
+    );
+  }
+  if (files.length === 0) {
+    throw new Error("upload_static_bundle: zip contained no files.");
+  }
+  const contentIssues = validateBundle(files);
+  if (contentIssues.length > 0) {
+    throw new Error(
+      `upload_static_bundle: bundle contains absolute / protocol-relative refs: ${contentIssues.map((i) => `${i.path}: ${i.reason}`).join("; ")}`
+    );
+  }
+  const entrypoint = args.entrypoint ?? pickDefaultEntrypoint(files);
+  if (!files.some((f) => f.path === entrypoint)) {
+    throw new Error(
+      `upload_static_bundle: entrypoint "${entrypoint}" is not present in the bundle.`
+    );
+  }
+  const prefix = bundlePrefix(siteId, slug);
+  const existing = await storage.listObjects(prefix).catch((err) => {
+    console.error("[upload_static_bundle] listObjects failed (proceeding)", err);
+    return [];
+  });
+  for (const obj of existing) {
+    await storage.deleteObject(obj.key);
+  }
+  let uploadedFiles = 0;
+  for (const f of files) {
+    await storage.putObject(`${prefix}${f.path}`, f.data, mimeTypeFor(f.path));
+    uploadedFiles += 1;
+  }
+  const body = {
+    entrypoint,
+    files: files.map((f) => f.path).sort(),
+    uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const { post } = await upsertStaticPost(graphql, siteId, slug, body, {
+    title: args.title,
+    postId: args.postId,
+    status: args.status,
+    publishedAt: args.publishedAt,
+    excerpt: args.excerpt,
+    tags: args.tags,
+    metadata: args.metadata
+  });
+  return { post, bundle: body, uploadedFiles };
+}
+var uploadStaticFileSchema = {
+  type: "object",
+  required: ["slug", "filename", "base64Data"],
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    slug: { type: "string", description: "Bundle slug. Files land at public/static/<siteId>/<slug>/<filename>." },
+    filename: {
+      type: "string",
+      description: "Relative path inside the bundle. Must NOT start with `/`, contain `..`, or include null bytes. macOS / Windows zip junk (`.DS_Store`, `__MACOSX/*`, `Thumbs.db`) is also rejected."
+    },
+    contentType: {
+      type: "string",
+      description: "IANA media type. Omit to derive from the filename extension (text/html, text/css, application/javascript, image/* \u2026; falls back to application/octet-stream)."
+    },
+    base64Data: {
+      type: "string",
+      description: "Base64-encoded file bytes. NO `data:` URL prefix. Text files (HTML/CSS/SVG) are linted for absolute / protocol-relative URL refs \u2014 failures throw."
+    }
+  }
+};
+async function uploadStaticFile(storage, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const filename = args.filename;
+  const reason = validateBundlePath2(filename);
+  if (reason) {
+    throw new Error(`upload_static_file: invalid filename "${filename}" (${reason})`);
+  }
+  const body = Buffer.from(args.base64Data, "base64");
+  if (body.length === 0) {
+    throw new Error("upload_static_file: base64Data decoded to zero bytes.");
+  }
+  const ext = filename.toLowerCase().slice(filename.lastIndexOf("."));
+  if (TEXT_EXTENSIONS.has(ext)) {
+    const text = body.toString("utf8");
+    const issues = findAbsolutePathRefs(filename, text);
+    if (issues.length > 0) {
+      throw new Error(
+        `upload_static_file: ${filename} contains absolute / protocol-relative refs: ${issues.map((i) => i.reason).join("; ")}`
+      );
+    }
+  }
+  const contentType = args.contentType ?? mimeTypeFor2(filename);
+  const key = `${bundlePrefix2(siteId, args.slug)}${filename}`;
+  const url = await storage.putObject(key, body, contentType);
+  return { key, url, size: body.length };
+}
+var deleteStaticFileSchema = {
+  type: "object",
+  required: ["slug", "filename"],
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    slug: { type: "string" },
+    filename: {
+      type: "string",
+      description: "Relative path inside the bundle to delete. Same path rules as `upload_static_file` apply (no `..`, no absolute paths, no null bytes)."
+    }
+  }
+};
+async function deleteStaticFile(storage, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const reason = validateBundlePath3(args.filename);
+  if (reason) {
+    throw new Error(`delete_static_file: invalid filename "${args.filename}" (${reason})`);
+  }
+  const prefix = bundlePrefix3(siteId, args.slug);
+  const key = `${prefix}${args.filename}`;
+  const existing = await storage.listObjects(key);
+  const found = existing.some((o) => o.key === key);
+  if (!found) {
+    return { key, deleted: false };
+  }
+  await storage.deleteObject(key);
+  return { key, deleted: true };
+}
+var commitStaticPostSchema = {
+  type: "object",
+  required: ["slug"],
+  properties: {
+    siteId: { type: "string", description: 'Site identifier (defaults to "default")' },
+    slug: { type: "string" },
+    title: {
+      type: "string",
+      description: "Required when this is a brand-new post (no existing row at the slug). On update, falls back to the current title."
+    },
+    entrypoint: {
+      type: "string",
+      description: "Relative path of the entry file (defaults to `index.html`, or the first `.html` at root if absent). Must exist under the current S3 prefix."
+    },
+    postId: {
+      type: "string",
+      description: "Optional explicit Post id when creating a new post. Ignored if a row at this slug already exists."
+    },
+    status: { type: "string", enum: ["draft", "published"] },
+    publishedAt: { type: "string", description: "ISO 8601 timestamp." },
+    excerpt: { type: "string" },
+    tags: { type: "array", items: { type: "string" } },
+    metadata: {
+      type: "object",
+      description: "Free-form per-post metadata. Passing this REPLACES the existing object on update.",
+      additionalProperties: true
+    }
+  }
+};
+async function commitStaticPost(graphql, storage, defaultSiteId, args) {
+  const siteId = args.siteId ?? defaultSiteId;
+  const slug = args.slug;
+  const prefix = bundlePrefix4(siteId, slug);
+  const objects = await storage.listObjects(prefix);
+  if (objects.length === 0) {
+    throw new Error(
+      `commit_static_post: no files found under "${prefix}". Upload at least one file via upload_static_file or upload_static_bundle before committing.`
+    );
+  }
+  const relPaths = objects.map((o) => o.key.slice(prefix.length)).filter((p) => p !== "").sort();
+  const entrypoint = args.entrypoint ?? pickDefaultEntrypoint2(relPaths.map((p) => ({ path: p })));
+  if (!relPaths.includes(entrypoint)) {
+    throw new Error(
+      `commit_static_post: entrypoint "${entrypoint}" is not present under "${prefix}".`
+    );
+  }
+  const body = {
+    entrypoint,
+    files: relPaths,
+    uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const { post, created } = await upsertStaticPost(graphql, siteId, slug, body, {
+    title: args.title,
+    postId: args.postId,
+    excerpt: args.excerpt,
+    status: args.status,
+    publishedAt: args.publishedAt,
+    tags: args.tags,
+    metadata: args.metadata
+  });
+  return { post, bundle: body, created };
 }
 var tools = [
   {
@@ -480,13 +882,13 @@ var tools = [
   },
   {
     name: "create_post",
-    description: "Create a new post. Title and slug are required. Body shape depends on format: tiptap=JSON node tree, markdown=source string, html=raw HTML string. Defaults to status=draft.",
+    description: "Create a new post. Title and slug are required. Body shape depends on format: tiptap=JSON node tree, markdown=source string, html=raw HTML string. Defaults to status=draft. Pass `metadata: { no_layout: true }` alongside format=html to publish the body as a bare HTML page with no theme chrome (the public route redirects to /raw/<slug>).",
     inputSchema: createPostSchema,
     handler: (args, ctx) => createPost(ctx.graphql, ctx.defaultSiteId, args)
   },
   {
     name: "update_post",
-    description: "Update an existing post by postId. Only the fields you pass are changed. Tag list / publishedAt changes also update the PostTag denormalized index.",
+    description: "Update an existing post by postId. Only the fields you pass are changed. Tag list / publishedAt changes also update the PostTag denormalized index. Passing `metadata` REPLACES the existing object \u2014 call get_post first if you only want to add or change one key.",
     inputSchema: updatePostSchema,
     handler: (args, ctx) => updatePost(ctx.graphql, ctx.defaultSiteId, args)
   },
@@ -507,6 +909,48 @@ var tools = [
     description: "Returns the CMS content schema (Post/Page/Media field shapes, format enum, notes). Useful as the first call to understand what fields are available.",
     inputSchema: getSchemaSchema,
     handler: async () => getSchema()
+  },
+  {
+    name: "upload_static_bundle",
+    description: "Create or replace a `format: 'static'` post in one shot. Pass a base64-encoded zip; the server unpacks it, validates every path + lints HTML/CSS/SVG for absolute path refs (bundles must be self-contained via relative paths), wipes the existing S3 prefix at public/static/<siteId>/<slug>/, uploads every file, and upserts the Post row with a manifest pointing at the entrypoint. Use this when you have the whole bundle to submit at once. For incremental edits use upload_static_file / delete_static_file followed by commit_static_post.",
+    inputSchema: uploadStaticBundleSchema,
+    handler: (args, ctx) => uploadStaticBundle(
+      ctx.graphql,
+      ctx.storage(),
+      ctx.defaultSiteId,
+      args
+    )
+  },
+  {
+    name: "upload_static_file",
+    description: "Upload a single file into an existing static bundle's S3 prefix. The Post row is NOT modified \u2014 its `body` manifest will be out of sync with the prefix until you call `commit_static_post`. Use this for incremental edits (one CSS swap, single image change) where rebuilding the entire zip would be overkill. Text files (HTML/CSS/SVG) are linted for absolute / protocol-relative URL refs the same as the zip flow.",
+    inputSchema: uploadStaticFileSchema,
+    handler: (args, ctx) => uploadStaticFile(
+      ctx.storage(),
+      ctx.defaultSiteId,
+      args
+    )
+  },
+  {
+    name: "delete_static_file",
+    description: "Delete a single file from a static bundle's S3 prefix. The Post row is NOT modified \u2014 its `body` manifest will list the deleted file until you call `commit_static_post`. Idempotent: returns `{ deleted: false }` instead of throwing if the file isn't there.",
+    inputSchema: deleteStaticFileSchema,
+    handler: (args, ctx) => deleteStaticFile(
+      ctx.storage(),
+      ctx.defaultSiteId,
+      args
+    )
+  },
+  {
+    name: "commit_static_post",
+    description: 'Rebuild a static post\'s Post row from whatever is currently in its S3 prefix. Scans `public/static/<siteId>/<slug>/`, picks the entrypoint (default `index.html` or override), and upserts the Post with a fresh manifest (sorted file list + uploadedAt timestamp). Use this as the "save" step after a series of `upload_static_file` / `delete_static_file` calls. `title` is required when creating a brand-new post; on update, existing fields are preserved unless explicitly overridden.',
+    inputSchema: commitStaticPostSchema,
+    handler: (args, ctx) => commitStaticPost(
+      ctx.graphql,
+      ctx.storage(),
+      ctx.defaultSiteId,
+      args
+    )
   }
 ];
 async function dispatchToolCall(name, args, ctx) {
@@ -572,7 +1016,12 @@ function createMcpGraphqlClient(opts) {
 }
 
 // src/functions/mcp-storage-client.ts
-import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import {
+  S3Client,
+  PutObjectCommand,
+  DeleteObjectCommand,
+  ListObjectsV2Command
+} from "@aws-sdk/client-s3";
 import { formatPublicAssetUrl } from "ampless";
 function createMcpStorageClient(opts) {
   const client = new S3Client({ region: opts.region });
@@ -587,6 +1036,34 @@ function createMcpStorageClient(opts) {
         })
       );
       return formatPublicAssetUrl(opts.bucket, opts.region, key);
+    },
+    async deleteObject(key) {
+      await client.send(
+        new DeleteObjectCommand({ Bucket: opts.bucket, Key: key })
+      );
+    },
+    async listObjects(prefix) {
+      const out = [];
+      let token;
+      do {
+        const res = await client.send(
+          new ListObjectsV2Command({
+            Bucket: opts.bucket,
+            Prefix: prefix,
+            ContinuationToken: token
+          })
+        );
+        for (const obj of res.Contents ?? []) {
+          if (!obj.Key) continue;
+          out.push({
+            key: obj.Key,
+            size: obj.Size ?? 0,
+            lastModified: obj.LastModified?.toISOString()
+          });
+        }
+        token = res.IsTruncated ? res.NextContinuationToken : void 0;
+      } while (token);
+      return out;
     }
   };
 }

package/dist/index.js

@@ -189,6 +189,23 @@ function defineAmplessBackend(opts) {
       resources: [`${backend.storage.resources.bucket.bucketArn}/public/media/*`]
     })
   );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject", "s3:DeleteObject"],
+      resources: [`${backend.storage.resources.bucket.bucketArn}/public/static/*`]
+    })
+  );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:ListBucket"],
+      resources: [backend.storage.resources.bucket.bucketArn],
+      conditions: {
+        StringLike: { "s3:prefix": ["public/static/*"] }
+      }
+    })
+  );
   mcpHandlerFn.addEnvironment("AMPLESS_BUCKET_NAME", backend.storage.resources.bucket.bucketName);
   const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
     authType: FunctionUrlAuthType.NONE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.16",
+  "version": "0.2.0-alpha.18",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -64,8 +64,9 @@
     "@aws-sdk/util-dynamodb": "^3.717.0",
     "@smithy/protocol-http": "^5.3.0",
     "@smithy/signature-v4": "^5.4.0",
-    "ampless": "0.2.0-alpha.7",
-    "@ampless/mcp-server": "0.2.0-alpha.7"
+    "fflate": "^0.8.2",
+    "ampless": "0.2.0-alpha.8",
+    "@ampless/mcp-server": "0.2.0-alpha.9"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",