@ampless/backend 1.0.0-alpha.30 → 1.0.0-alpha.31

package/dist/functions/mcp-handler.js

@@ -13,6 +13,7 @@ import {
 import {
   encodeAwsJson as encodeAwsJson2
 } from "ampless";
+import { encodeAwsJson as encodeAwsJson3 } from "ampless";
 import {
   bundlePrefix,
   mimeTypeFor,
@@ -25,7 +26,7 @@ import {
   stripCommonPrefix
 } from "ampless";
 import {
-  encodeAwsJson as encodeAwsJson3
+  encodeAwsJson as encodeAwsJson4
 } from "ampless";
 import {
   bundlePrefix as bundlePrefix2,
@@ -37,6 +38,7 @@ import {
 import { bundlePrefix as bundlePrefix3, validateBundlePath as validateBundlePath3 } from "ampless";
 import {
   bundlePrefix as bundlePrefix4,
+  mimeTypeFor as mimeTypeFor3,
   pickDefaultEntrypoint as pickDefaultEntrypoint2
 } from "ampless";
 var POST_FIELDS = (
@@ -327,6 +329,7 @@ var MUTATION4 = (
       mimeType
       size
       delivery
+      metadata
     }
   }
 `
@@ -349,7 +352,9 @@ var uploadMediaSchema = {
 async function uploadMedia(graphql, storage, args) {
   const body = Buffer.from(args.base64Data, "base64");
   const key = buildMediaKey(args.filename);
-  const url = await storage.putObject(key, body, args.mimeType);
+  const putResult = await storage.putObject(key, body, args.mimeType);
+  const metadata = {};
+  if (putResult.etag) metadata.etag = putResult.etag;
   const mediaId = `media-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   const data = await graphql.query(MUTATION4, {
     input: {
@@ -357,10 +362,11 @@ async function uploadMedia(graphql, storage, args) {
       src: key,
       mimeType: args.mimeType,
       size: body.length,
-      delivery: "nextjs"
+      delivery: "nextjs",
+      metadata: encodeAwsJson3(metadata)
     }
   });
-  return { media: data.createMedia, url };
+  return { media: data.createMedia, url: putResult.url };
 }
 var getSchemaSchema = {
   type: "object",
@@ -959,7 +965,7 @@ async function upsertStaticPost(graphql, slug, body, fields) {
     const input2 = {
       postId: existing.postId,
       format: "static",
-      body: encodeAwsJson3(body)
+      body: encodeAwsJson4(body)
     };
     if (fields.title !== void 0) input2.title = fields.title;
     if (fields.excerpt !== void 0) input2.excerpt = fields.excerpt;
@@ -967,7 +973,7 @@ async function upsertStaticPost(graphql, slug, body, fields) {
     if (fields.publishedAt !== void 0) input2.publishedAt = fields.publishedAt;
     if (fields.tags !== void 0) input2.tags = fields.tags;
     if (fields.metadata !== void 0) {
-      input2.metadata = encodeAwsJson3(fields.metadata);
+      input2.metadata = encodeAwsJson4(fields.metadata);
     }
     const data2 = await graphql.query(UPDATE_MUTATION, { input: input2 });
     const updated = toCorePost(data2.updatePost);
@@ -986,13 +992,13 @@ async function upsertStaticPost(graphql, slug, body, fields) {
     slug,
     title: fields.title,
     format: "static",
-    body: encodeAwsJson3(body),
+    body: encodeAwsJson4(body),
     status
   };
   if (fields.excerpt !== void 0) input.excerpt = fields.excerpt;
   if (publishedAt !== void 0) input.publishedAt = publishedAt;
   if (fields.tags !== void 0) input.tags = fields.tags;
-  if (fields.metadata !== void 0) input.metadata = encodeAwsJson3(fields.metadata);
+  if (fields.metadata !== void 0) input.metadata = encodeAwsJson4(fields.metadata);
   const data = await graphql.query(CREATE_MUTATION, { input });
   const created = toCorePost(data.createPost);
   return { post: created, created: true };
@@ -1062,8 +1068,11 @@ async function uploadStaticBundle(graphql, storage, args) {
     await storage.deleteObject(obj.key);
   }
   let uploadedFiles = 0;
+  const filesMeta = {};
   for (const f of files) {
-    await storage.putObject(`${prefix}${f.path}`, f.data, mimeTypeFor(f.path));
+    const mimeType = mimeTypeFor(f.path);
+    await storage.putObject(`${prefix}${f.path}`, f.data, mimeType);
+    filesMeta[f.path] = { size: f.data.byteLength, mimeType };
     uploadedFiles += 1;
   }
   const body = {
@@ -1071,6 +1080,10 @@ async function uploadStaticBundle(graphql, storage, args) {
     files: files.map((f) => f.path).sort(),
     uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
+  const mergedMetadata = {
+    ...args.metadata ?? {},
+    files: filesMeta
+  };
   const { post } = await upsertStaticPost(graphql, slug, body, {
     title: args.title,
     postId: args.postId,
@@ -1078,7 +1091,7 @@ async function uploadStaticBundle(graphql, storage, args) {
     publishedAt: args.publishedAt,
     excerpt: args.excerpt,
     tags: args.tags,
-    metadata: args.metadata
+    metadata: mergedMetadata
   });
   return { post, bundle: body, uploadedFiles };
 }
@@ -1123,8 +1136,8 @@ async function uploadStaticFile(storage, args) {
   }
   const contentType = args.contentType ?? mimeTypeFor2(filename);
   const key = `${bundlePrefix2(args.slug)}${filename}`;
-  const url = await storage.putObject(key, body, contentType);
-  return { key, url, size: body.length };
+  const { url } = await storage.putObject(key, body, contentType);
+  return { key, url, size: body.length, contentType };
 }
 var deleteStaticFileSchema = {
   type: "object",
@@ -1189,7 +1202,15 @@ async function commitStaticPost(graphql, storage, args) {
       `commit_static_post: no files found under "${prefix}". Upload at least one file via upload_static_file or upload_static_bundle before committing.`
     );
   }
-  const relPaths = objects.map((o) => o.key.slice(prefix.length)).filter((p) => p !== "").sort();
+  const filesMeta = {};
+  const relPaths = [];
+  for (const obj of objects) {
+    const rel = obj.key.slice(prefix.length);
+    if (rel === "") continue;
+    relPaths.push(rel);
+    filesMeta[rel] = { size: obj.size, mimeType: mimeTypeFor3(rel) };
+  }
+  relPaths.sort();
   const entrypoint = args.entrypoint ?? pickDefaultEntrypoint2(relPaths.map((p) => ({ path: p })));
   if (!relPaths.includes(entrypoint)) {
     throw new Error(
@@ -1201,6 +1222,10 @@ async function commitStaticPost(graphql, storage, args) {
     files: relPaths,
     uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
+  const mergedMetadata = {
+    ...args.metadata ?? {},
+    files: filesMeta
+  };
   const { post, created } = await upsertStaticPost(graphql, slug, body, {
     title: args.title,
     postId: args.postId,
@@ -1208,7 +1233,7 @@ async function commitStaticPost(graphql, storage, args) {
     status: args.status,
     publishedAt: args.publishedAt,
     tags: args.tags,
-    metadata: args.metadata
+    metadata: mergedMetadata
   });
   return { post, bundle: body, created };
 }
@@ -1371,7 +1396,7 @@ function createMcpStorageClient(opts) {
   const client = new S3Client({ region: opts.region });
   return {
     async putObject(key, body, contentType) {
-      await client.send(
+      const res = await client.send(
         new PutObjectCommand({
           Bucket: opts.bucket,
           Key: key,
@@ -1379,7 +1404,11 @@ function createMcpStorageClient(opts) {
           ContentType: contentType
         })
       );
-      return formatPublicAssetUrl(opts.bucket, opts.region, key);
+      const etag = res.ETag ? res.ETag.replace(/^"|"$/g, "") : void 0;
+      return {
+        url: formatPublicAssetUrl(opts.bucket, opts.region, key),
+        etag
+      };
     },
     async deleteObject(key) {
       await client.send(

package/dist/index.d.ts

@@ -116,12 +116,13 @@ interface AmplessResolverPaths {
     listPublishedPosts: string;
     getPublishedPost: string;
     listPostsByTag: string;
+    getMediaBySrc: string;
 }
 /**
  * Default AppSync JS resolver paths. AppSync resolves these strings at
  * CDK synth time relative to the file that calls `defineData` — i.e.
- * the user's `amplify/data/resource.ts`. Templates ship the three
- * resolver files at exactly these paths.
+ * the user's `amplify/data/resource.ts`. Templates ship the resolver
+ * files at exactly these paths.
  *
  * Users with a non-default layout (e.g. moving the resolvers under a
  * `resolvers/` subdir) pass overrides through `amplessSchemaModels(a, {
@@ -176,9 +177,11 @@ declare function amplessSchemaModels(a: any, opts?: AmplessSchemaModelsOpts): {
     McpToken: any;
     PublicPost: any;
     PublicPostConnection: any;
+    PublicMedia: any;
     listPublishedPosts: any;
     getPublishedPost: any;
     listPostsByTag: any;
+    getMediaBySrc: any;
 };
 /**
  * Convenience helper: build a fully-instantiated `a.schema(...)`

package/dist/index.js

@@ -264,7 +264,8 @@ function amplessStorageConfig() {
 var DEFAULT_RESOLVER_PATHS = {
   listPublishedPosts: "./list-published-posts.js",
   getPublishedPost: "./get-published-post.js",
-  listPostsByTag: "./list-posts-by-tag.js"
+  listPostsByTag: "./list-posts-by-tag.js",
+  getMediaBySrc: "./get-media-by-src.js"
 };
 function amplessSchemaModels(a, opts = {}) {
   const resolverPaths = {
@@ -312,8 +313,14 @@ function amplessSchemaModels(a, opts = {}) {
       src: a.string().required(),
       mimeType: a.string().required(),
       size: a.integer(),
-      delivery: a.string()
-    }).identifier(["mediaId"]).authorization((allow) => [
+      delivery: a.string(),
+      // Free-form per-asset metadata (JSON). Currently used to
+      // memoise the S3 ETag for stream-back routes; future use
+      // for image dimensions, EXIF strip status, etc. Kept loose
+      // because the field is read by routes that only need a few
+      // hints (no schema-level commitment).
+      metadata: a.json()
+    }).identifier(["mediaId"]).secondaryIndexes((index) => [index("src").name("bySrc")]).authorization((allow) => [
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
     Taxonomy: a.model({
@@ -415,6 +422,18 @@ function amplessSchemaModels(a, opts = {}) {
       items: a.ref("PublicPost").array(),
       nextToken: a.string()
     }),
+    // Minimal Media projection for the public-facing `getMediaBySrc`
+    // query. Decoupling from the `Media` model lets the custom
+    // resolver bypass the model-level (admin/editor only) auth check
+    // on fields, and intentionally keeps `mediaId` / `delivery` /
+    // anything else off the wire — guests only need `size` /
+    // `mimeType` / `metadata` for the stream-back read path.
+    PublicMedia: a.customType({
+      src: a.string().required(),
+      size: a.integer(),
+      mimeType: a.string(),
+      metadata: a.json()
+    }),
     // Public read endpoints — guard against draft leakage via custom resolvers.
     // Custom handlers (`a.handler.custom`) only support apiKey / userPool /
     // lambda / group / owner auth. `allow.guest()` (Cognito Identity Pool
@@ -466,6 +485,28 @@ function amplessSchemaModels(a, opts = {}) {
       allow.publicApiKey(),
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
+    // Public Media lookup by S3 key. Called by the `/api/media/...`
+    // route handler so guests can resolve `{ size, mimeType, metadata }`
+    // and the route can stream the bytes back with the right headers
+    // (and skip a HEAD round-trip on cold reads). The custom JS
+    // resolver targets the Media table's `bySrc` GSI directly so the
+    // lookup is one O(1) Query.
+    //
+    // Auth: `allow.publicApiKey()` — same model as the post queries
+    // above. `a.handler.custom` doesn't accept `allow.guest()` in
+    // Amplify Gen 2, so the API key (auto-renewed every 365 days) is
+    // the standard public-read channel. The resolver returns only the
+    // narrow `PublicMedia` projection — no `mediaId` / `delivery` /
+    // anything else leaks to guests.
+    getMediaBySrc: a.query().arguments({ src: a.string().required() }).returns(a.ref("PublicMedia")).handler(
+      a.handler.custom({
+        dataSource: a.ref("Media"),
+        entry: resolverPaths.getMediaBySrc
+      })
+    ).authorization((allow) => [
+      allow.publicApiKey(),
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
     // User management ops, only wired when the caller supplies a
     // Lambda function ref. Conditionally spread because
     // `a.handler.function(undefined)` is not a valid call — projects

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.30",
+  "version": "1.0.0-alpha.31",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -65,8 +65,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "ampless": "1.0.0-alpha.15",
-    "@ampless/mcp-server": "1.0.0-alpha.19"
+    "ampless": "1.0.0-alpha.16",
+    "@ampless/mcp-server": "1.0.0-alpha.20"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",