@ampless/backend 1.0.0-alpha.36 → 1.0.0-alpha.37

package/dist/functions/mcp-handler.js

@@ -368,6 +368,161 @@ async function uploadMedia(graphql, storage, args) {
   });
   return { media: data.createMedia, url: putResult.url };
 }
+var MEDIA_FIELDS = (
+  /* GraphQL */
+  `
+  fragment MediaFields on Media {
+    mediaId
+    src
+    mimeType
+    size
+    createdAt
+    updatedAt
+  }
+`
+);
+function toMediaResult(row, storage) {
+  return {
+    mediaId: row.mediaId,
+    src: row.src,
+    url: storage.publicUrl(row.src),
+    mimeType: row.mimeType,
+    size: row.size,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+var QUERY2 = (
+  /* GraphQL */
+  `
+  ${MEDIA_FIELDS}
+  query ListMedia($filter: ModelMediaFilterInput, $limit: Int, $nextToken: String) {
+    listMedia(filter: $filter, limit: $limit, nextToken: $nextToken) {
+      items {
+        ...MediaFields
+      }
+      nextToken
+    }
+  }
+`
+);
+var listMediaSchema = {
+  type: "object",
+  properties: {
+    limit: {
+      type: "integer",
+      minimum: 1,
+      maximum: 100,
+      description: "Max results (default 20)"
+    },
+    nextToken: { type: "string", description: "Pagination cursor from a previous call" },
+    mimeType: {
+      type: "string",
+      description: 'Filter by MIME type prefix (beginsWith): "image/" matches all images, "image/png" matches PNG only.'
+    },
+    prefix: {
+      type: "string",
+      description: 'Filter by S3 key prefix (beginsWith) on `src`, e.g. "public/media/2024/" to find files from a given year.'
+    },
+    createdAfter: {
+      type: "string",
+      description: "ISO 8601 timestamp; only return media created at or after this."
+    },
+    createdBefore: {
+      type: "string",
+      description: "ISO 8601 timestamp; only return media created at or before this."
+    }
+  }
+};
+function buildMediaFilter(args) {
+  const conditions = [];
+  if (args.mimeType) conditions.push({ mimeType: { beginsWith: args.mimeType } });
+  if (args.prefix) conditions.push({ src: { beginsWith: args.prefix } });
+  if (args.createdAfter && args.createdBefore) {
+    conditions.push({ createdAt: { between: [args.createdAfter, args.createdBefore] } });
+  } else if (args.createdAfter) {
+    conditions.push({ createdAt: { ge: args.createdAfter } });
+  } else if (args.createdBefore) {
+    conditions.push({ createdAt: { le: args.createdBefore } });
+  }
+  if (conditions.length === 0) return void 0;
+  if (conditions.length === 1) return conditions[0];
+  return { and: conditions };
+}
+async function listMedia(graphql, storage, args = {}) {
+  const filter = buildMediaFilter(args);
+  const data = await graphql.query(QUERY2, {
+    filter,
+    limit: args.limit ?? 20,
+    nextToken: args.nextToken
+  });
+  return {
+    media: data.listMedia.items.map((row) => toMediaResult(row, storage)),
+    nextToken: data.listMedia.nextToken
+  };
+}
+var QUERY3 = (
+  /* GraphQL */
+  `
+  ${MEDIA_FIELDS}
+  query SearchMedia($filter: ModelMediaFilterInput, $limit: Int, $nextToken: String) {
+    listMedia(filter: $filter, limit: $limit, nextToken: $nextToken) {
+      items {
+        ...MediaFields
+      }
+      nextToken
+    }
+  }
+`
+);
+var MAX_PAGES = 20;
+var searchMediaSchema = {
+  type: "object",
+  required: ["query"],
+  properties: {
+    query: {
+      type: "string",
+      description: 'Substring matched (case-sensitive `contains`) against `src` (which includes the filename) and `mimeType`. e.g. "logo", ".png", "image/png".'
+    },
+    limit: {
+      type: "integer",
+      minimum: 1,
+      maximum: 100,
+      description: "Target number of matches to collect before stopping (default 20). A soft target \u2014 the last page may push the result slightly past it."
+    },
+    nextToken: { type: "string", description: "Pagination cursor from a previous call" }
+  }
+};
+async function searchMedia(graphql, storage, args) {
+  if (!args.query) {
+    throw new Error("search_media: `query` is required");
+  }
+  const limit = args.limit ?? 20;
+  const filter = {
+    or: [{ src: { contains: args.query } }, { mimeType: { contains: args.query } }]
+  };
+  const media = [];
+  let token = args.nextToken ?? null;
+  let pages = 0;
+  do {
+    const data = await graphql.query(QUERY3, {
+      filter,
+      limit,
+      nextToken: token ?? void 0
+    });
+    pages += 1;
+    for (const row of data.listMedia.items) {
+      media.push(toMediaResult(row, storage));
+    }
+    token = data.listMedia.nextToken;
+  } while (media.length < limit && token && pages < MAX_PAGES);
+  const truncated = media.length < limit && token !== null && pages >= MAX_PAGES;
+  return {
+    media,
+    nextToken: token,
+    ...truncated ? { truncated: true } : {}
+  };
+}
 var GET_BY_ID2 = (
   /* GraphQL */
   `
@@ -410,6 +565,10 @@ var deleteMediaSchema = {
     src: {
       type: "string",
       description: "Full S3 key including `public/` (e.g. 'public/media/2026/05/1714400000000-photo.jpg'). Use when you only have the public URL \u2014 strip `/api/media/` and prepend `public/`. Provide either `mediaId` or `src`."
+    },
+    dryRun: {
+      type: "boolean",
+      description: "When true, resolve the target but delete nothing (no S3 delete, no row delete). Returns `{ deleted: false, dryRun: true, ... }` previewing what would be removed. Use it to confirm before the real delete."
     }
   }
 };
@@ -417,6 +576,7 @@ async function deleteMedia(graphql, storage, args) {
   if (!args.mediaId && !args.src) {
     throw new Error("delete_media: provide `mediaId` or `src`");
   }
+  const dryRun = args.dryRun === true;
   let mediaId;
   let src;
   if (args.mediaId) {
@@ -434,6 +594,14 @@ async function deleteMedia(graphql, storage, args) {
   }
   if (!mediaId) {
     if (args.src) {
+      if (dryRun) {
+        return {
+          deleted: false,
+          dryRun: true,
+          reason: "dry run \u2014 media row not found; would attempt S3 object delete",
+          src: args.src
+        };
+      }
       await storage.deleteObject(args.src);
       return {
         deleted: false,
@@ -443,7 +611,17 @@ async function deleteMedia(graphql, storage, args) {
     }
     return {
       deleted: false,
-      reason: "media row not found for mediaId"
+      ...dryRun ? { dryRun: true } : {},
+      reason: dryRun ? "dry run \u2014 media row not found for mediaId; nothing to delete" : "media row not found for mediaId"
+    };
+  }
+  if (dryRun) {
+    return {
+      deleted: false,
+      dryRun: true,
+      reason: "dry run \u2014 nothing deleted",
+      mediaId,
+      src
     };
   }
   await storage.deleteObject(src);
@@ -1359,9 +1537,21 @@ var tools = [
     inputSchema: uploadMediaSchema,
     handler: (args, ctx) => uploadMedia(ctx.graphql, ctx.storage(), args)
   },
+  {
+    name: "list_media",
+    description: 'List media files in the CMS. Optional filters: `mimeType` (prefix match \u2014 "image/" matches all images, "image/png" only PNG), `prefix` (S3 key prefix on `src`, e.g. "public/media/2024/"), `createdAfter` / `createdBefore` (ISO 8601 date range). Returns up to `limit` rows (default 20) \u2014 each `{ mediaId, src, url, mimeType, size, createdAt, updatedAt }` \u2014 plus a `nextToken` cursor. Note: filters apply after the page read, so a page may return fewer than `limit` rows while a `nextToken` remains \u2014 follow the cursor. Use this to find media to delete without remembering `upload_media` responses.',
+    inputSchema: listMediaSchema,
+    handler: (args, ctx) => listMedia(ctx.graphql, ctx.storage(), args)
+  },
+  {
+    name: "search_media",
+    description: 'Search media by substring (case-sensitive `contains`) across `src` (which includes the filename) and `mimeType`. Pass `query` (e.g. "logo", ".png", "image/png"). Walks DynamoDB pages internally until it collects at least `limit` matches (default 20), exhausts the table, or hits its page cap \u2014 so `limit` is a soft target and the result may run slightly past it. Returns the same row shape as `list_media` plus `nextToken`; `truncated: true` means the page cap was hit with more to scan (pass `nextToken` back to continue).',
+    inputSchema: searchMediaSchema,
+    handler: (args, ctx) => searchMedia(ctx.graphql, ctx.storage(), args)
+  },
   {
     name: "delete_media",
-    description: "Delete a media file: removes the S3 object and the Media row. Pass `mediaId` (from `upload_media`'s response) or `src` (full S3 key like `public/media/2026/05/...`). When only `src` is given, looks up the Media row via `getMediaBySrc`. S3 delete runs first, then the DDB row delete \u2014 both are idempotent so re-running converges on missing-key cases. Returns `{ deleted: false }` instead of throwing when no Media row matches; if `src` was supplied directly the S3 object is still removed (use this to sweep orphan files).",
+    description: "Delete a media file: removes the S3 object and the Media row. Pass `mediaId` (from `upload_media`'s response, or `list_media` / `search_media`) or `src` (full S3 key like `public/media/2026/05/...`). When only `src` is given, looks up the Media row via `getMediaBySrc`. S3 delete runs first, then the DDB row delete \u2014 both are idempotent so re-running converges on missing-key cases. Pass `dryRun: true` to preview what would be deleted without touching anything (returns `{ deleted: false, dryRun: true, ... }`). Returns `{ deleted: false }` instead of throwing when no Media row matches; if `src` was supplied directly the S3 object is still removed (use this to sweep orphan files).",
     inputSchema: deleteMediaSchema,
     handler: (args, ctx) => deleteMedia(
       ctx.graphql,
@@ -1532,6 +1722,9 @@ function createMcpStorageClient(opts) {
         token = res.IsTruncated ? res.NextContinuationToken : void 0;
       } while (token);
       return out;
+    },
+    publicUrl(key) {
+      return formatPublicAssetUrl(opts.bucket, opts.region, key);
     }
   };
 }

package/dist/index.js

@@ -188,7 +188,7 @@ function defineAmplessBackend(opts) {
   mcpHandlerFn.addToRolePolicy(
     new PolicyStatement({
       effect: Effect.ALLOW,
-      actions: ["s3:PutObject"],
+      actions: ["s3:PutObject", "s3:DeleteObject"],
       resources: [`${backend.storage.resources.bucket.bucketArn}/public/media/*`]
     })
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.36",
+  "version": "1.0.0-alpha.37",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -65,8 +65,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "ampless": "1.0.0-alpha.20",
-    "@ampless/mcp-server": "1.0.0-alpha.25"
+    "@ampless/mcp-server": "1.0.0-alpha.26",
+    "ampless": "1.0.0-alpha.20"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",