@ampless/backend 0.2.0-alpha.9 → 1.0.0-alpha.20

package/dist/auth/post-confirmation.js

@@ -1,3 +1,5 @@
+import "../chunk-BYXBJQAS.js";
+
 // src/auth/post-confirmation.ts
 import {
   CognitoIdentityProviderClient,

package/dist/auth/user-admin.js

@@ -1,3 +1,5 @@
+import "../chunk-BYXBJQAS.js";
+
 // src/auth/user-admin.ts
 import {
   CognitoIdentityProviderClient,

package/dist/events/dispatcher.js

@@ -1,3 +1,5 @@
+import "../chunk-BYXBJQAS.js";
+
 // src/events/dispatcher.ts
 import { unmarshall } from "@aws-sdk/util-dynamodb";
 import {
@@ -29,7 +31,6 @@ function emitContentEvents(record, timestamp) {
   if (types.length === 0) return [];
   const item = newItem ?? oldItem ?? {};
   const payload = {
-    siteId: item.siteId,
     postId: item.postId,
     slug: item.slug,
     title: item.title,
@@ -43,13 +44,11 @@ function emitKvEvents(record, timestamp) {
   const item = record.dynamodb?.NewImage ?? record.dynamodb?.OldImage ? unmarshall(record.dynamodb.NewImage ?? record.dynamodb.OldImage) : {};
   const pk = item.pk;
   if (!pk) return [];
-  if (!pk.startsWith("siteconfig:")) return [];
-  const siteId = pk.slice("siteconfig:".length);
-  if (!siteId) return [];
+  if (pk !== "siteconfig") return [];
   return [
     {
       type: "site.settings.updated",
-      payload: { siteId },
+      payload: {},
       timestamp
     }
   ];

package/dist/events/processor-trusted.d.ts

@@ -23,13 +23,13 @@ interface CreateProcessorTrustedHandlerOpts {
 }
 /**
  * SQS-driven trusted plugin executor. Trusted plugins get a runtime
- * context with `listPublishedPosts` (one Query per site partition)
- * and `writePublicAsset` (S3 PutObject under
- * `public/plugins/{name}/{siteId}/{key}`).
+ * context with `listPublishedPosts` (one Query against the byStatus
+ * GSI) and `writePublicAsset` (S3 PutObject under
+ * `public/plugins/{name}/{key}`).
  *
  * Built-in: rebuilds the site-settings JSON cache at
- * `public/site-settings/{siteId}.json` whenever a
- * `site.settings.updated` event arrives.
+ * `public/site-settings.json` whenever a `site.settings.updated`
+ * event arrives.
  *
  * Re-exported by the template's thin shell
  * `amplify/events/processor-trusted/handler.ts` which supplies the

package/dist/events/processor-trusted.js

@@ -1,3 +1,5 @@
+import "../chunk-BYXBJQAS.js";
+
 // src/events/processor-trusted.ts
 import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
@@ -10,7 +12,7 @@ function requireEnv(name) {
   if (!v) throw new Error(`processor-trusted: missing required env var ${name}`);
   return v;
 }
-var POST_BY_SITE_STATUS_INDEX = "bySiteIdStatus";
+var POST_BY_STATUS_INDEX = "byStatus";
 function safeParse(s) {
   try {
     return JSON.parse(s);
@@ -29,18 +31,17 @@ function createProcessorTrustedHandler(opts) {
   const POST_TABLE = requireEnv("AMPLESS_POST_TABLE");
   const KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
   const REGION = requireEnv("AWS_REGION");
-  async function listPublished(siteId) {
+  async function listPublished() {
     const items = [];
     let exclusiveStartKey;
-    const partition = `${siteId}#published`;
     do {
       const res = await ddb.send(
         new QueryCommand({
           TableName: POST_TABLE,
-          IndexName: POST_BY_SITE_STATUS_INDEX,
-          KeyConditionExpression: "#siteIdStatus = :siteIdStatus",
-          ExpressionAttributeNames: { "#siteIdStatus": "siteIdStatus" },
-          ExpressionAttributeValues: { ":siteIdStatus": partition },
+          IndexName: POST_BY_STATUS_INDEX,
+          KeyConditionExpression: "#status = :status",
+          ExpressionAttributeNames: { "#status": "status" },
+          ExpressionAttributeValues: { ":status": "published" },
           ScanIndexForward: false,
           ExclusiveStartKey: exclusiveStartKey
         })
@@ -48,7 +49,6 @@ function createProcessorTrustedHandler(opts) {
       for (const row of res.Items ?? []) {
         items.push({
           postId: row.postId,
-          siteId: row.siteId,
           slug: row.slug,
           title: row.title,
           excerpt: row.excerpt ?? void 0,
@@ -63,13 +63,12 @@ function createProcessorTrustedHandler(opts) {
     } while (exclusiveStartKey);
     return items;
   }
-  function makeContext(plugin, siteId) {
+  function makeContext(plugin) {
     return {
-      siteId,
       site: opts.site,
-      listPublishedPosts: () => listPublished(siteId),
+      listPublishedPosts: () => listPublished(),
       async writePublicAsset(key, body, contentType) {
-        const objectKey = `public/plugins/${plugin.name}/${siteId}/${key}`;
+        const objectKey = `public/plugins/${plugin.name}/${key}`;
         await s3.send(
           new PutObjectCommand({
             Bucket: BUCKET,
@@ -83,7 +82,7 @@ function createProcessorTrustedHandler(opts) {
       }
     };
   }
-  async function rebuildSiteSettingsCache(siteId) {
+  async function rebuildSiteSettingsCache() {
     const settings = {};
     let exclusiveStartKey;
     do {
@@ -92,7 +91,7 @@ function createProcessorTrustedHandler(opts) {
           TableName: KV_TABLE,
           KeyConditionExpression: "#pk = :pk",
           ExpressionAttributeNames: { "#pk": "pk" },
-          ExpressionAttributeValues: { ":pk": `siteconfig:${siteId}` },
+          ExpressionAttributeValues: { ":pk": "siteconfig" },
           ExclusiveStartKey: exclusiveStartKey
         })
       );
@@ -104,7 +103,7 @@ function createProcessorTrustedHandler(opts) {
       }
       exclusiveStartKey = res.LastEvaluatedKey;
     } while (exclusiveStartKey);
-    const objectKey = `public/site-settings/${siteId}.json`;
+    const objectKey = "public/site-settings.json";
     await s3.send(
       new PutObjectCommand({
         Bucket: BUCKET,
@@ -129,15 +128,11 @@ function createProcessorTrustedHandler(opts) {
         console.error("[trusted-processor] bad message", record.body, err);
         continue;
       }
-      const siteId = parsed.payload.siteId ?? "default";
       if (parsed.type === "site.settings.updated") {
         try {
-          await rebuildSiteSettingsCache(siteId);
+          await rebuildSiteSettingsCache();
         } catch (err) {
-          console.error(
-            `[trusted-processor] site-settings-cache rebuild failed for ${siteId}`,
-            err
-          );
+          console.error("[trusted-processor] site-settings-cache rebuild failed", err);
           throw err;
         }
       }
@@ -145,7 +140,7 @@ function createProcessorTrustedHandler(opts) {
         const hook = plugin.hooks?.[parsed.type];
         if (!hook) continue;
         try {
-          await hook(parsed, makeContext(plugin, siteId));
+          await hook(parsed, makeContext(plugin));
         } catch (err) {
           console.error(`[trusted-processor] ${plugin.name}.${parsed.type} failed`, err);
           throw err;

package/dist/events/processor-untrusted.js

@@ -1,11 +1,12 @@
+import "../chunk-BYXBJQAS.js";
+
 // src/events/processor-untrusted.ts
 function createProcessorUntrustedHandler(opts) {
   const untrustedPlugins = (opts.plugins ?? []).filter(
     (p) => typeof p === "object" && p.trust_level === "untrusted"
   );
-  function makeContext(siteId) {
+  function makeContext() {
     return {
-      siteId,
       site: opts.site,
       async listPublishedPosts() {
         throw new Error("untrusted plugins cannot list posts");
@@ -25,12 +26,11 @@ function createProcessorUntrustedHandler(opts) {
         console.error("[untrusted-processor] bad message", record.body, err);
         continue;
       }
-      const siteId = parsed.payload.siteId ?? "default";
       for (const plugin of untrustedPlugins) {
         const hook = plugin.hooks?.[parsed.type];
         if (!hook) continue;
         try {
-          await hook(parsed, makeContext(siteId));
+          await hook(parsed, makeContext());
         } catch (err) {
           console.error(`[untrusted-processor] ${plugin.name}.${parsed.type} failed`, err);
           throw err;

package/dist/functions/api-key-renewer.js

@@ -1,3 +1,5 @@
+import "../chunk-BYXBJQAS.js";
+
 // src/functions/api-key-renewer.ts
 import {
   AppSyncClient,

package/dist/functions/mcp-handler.d.ts

@@ -1,13 +1,21 @@
 /**
- * MCP HTTP endpoint Lambda. Phase 3: Bearer token validation only.
+ * MCP HTTP endpoint Lambda. Phase 5: Bearer validation + JSON-RPC 2.0
+ * tool dispatch over AppSync IAM auth, including `upload_media`.
  *
- * Reads the KvStore table directly (PK = 'mcp-tokens', SK = SHA-256
- * hash of the plaintext token) instead of going through AppSync — the
- * Lambda IAM role only needs `dynamodb:GetItem` on that one table,
- * which is much narrower than `appsync:GraphQL` and avoids the
- * IAM-auth-mode complexity of letting Lambdas call AppSync as
- * privileged identity. Phase 4 will add AppSync IAM auth when tool
- * dispatch actually needs schema-aware access.
+ *   1. Reads KvStore directly (PK = 'mcp-tokens', SK = SHA-256 hex)
+ *      to validate `Authorization: Bearer amk_...`. Same narrow IAM
+ *      grant as Phase 3 (`dynamodb:GetItem` on the KvStore table).
+ *   2. Parses the incoming JSON-RPC envelope by hand (no MCP SDK
+ *      stdio transport in a Lambda runtime — overkill for the three
+ *      verbs we actually need).
+ *   3. Dispatches `tools/call` through the shared `@ampless/mcp-server/tools`
+ *      registry. The GraphqlClient implementation hits AppSync with
+ *      SigV4 (`AWS_IAM` auth mode), gated by `allow.resource(mcpHandler)
+ *      .to(['query', 'mutate'])` on Post / PostTag in the schema.
+ *   4. `upload_media` decodes the base64 body inline and uploads to S3
+ *      using the Lambda execution role (s3:PutObject on public/media/*).
+ *      Payload limit ~6 MB (base64-inflated) covers typical CMS images;
+ *      large files should use the stdio CLI.
  *
  * Function URL event format: Lambda Function URLs emit API Gateway
  * HTTP v2 events (https://docs.aws.amazon.com/lambda/latest/dg/urls-invocation.html#urls-payloads).