@ampless/backend 1.0.0-beta.87 → 1.0.0-beta.89

package/dist/functions/mcp-handler.js

@@ -3,7 +3,7 @@ import { ConditionalCheckFailedException, DynamoDBClient } from "@aws-sdk/client
 import { DynamoDBDocumentClient, GetCommand, UpdateCommand } from "@aws-sdk/lib-dynamodb";
 import { createHash } from "crypto";
 
-// ../mcp-server/dist/index.js
+// ../mcp-server/dist/tools/index.js
 import { filterSortPostSummaries } from "ampless";
 import {
   decodeAwsJson
@@ -1683,50 +1683,66 @@ var tools = [
     name: "list_posts",
     description: "Returns lightweight post summaries (no body \u2014 use get_post for content) with search / sort / filters. `total` reflects the filtered count. Supports query (substring over title/slug/tags), tag (exact), status, sort, limit (1\u2013100, default 20), offset (default 0).",
     inputSchema: listPostsSchema,
-    handler: (args, ctx) => listPosts(ctx.graphql, args)
+    handler: (args, ctx) => listPosts(ctx.graphql, args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "get_post",
     description: "Fetch a single post by slug or postId. Returns null if not found.",
     inputSchema: getPostSchema,
-    handler: (args, ctx) => getPost(ctx.graphql, args)
+    handler: (args, ctx) => getPost(ctx.graphql, args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "create_post",
     description: 'Create a new post. Title and slug are required. Body shape depends on format: tiptap=JSON node tree, markdown=source string, html=raw HTML string. Defaults to status=draft. Pass `metadata: { no_layout: true }` alongside format=html to publish the body as a bare HTML page with no theme chrome (middleware rewrites the /<slug> request to the internal bare-HTML handler). Pass `metadata: { cache: "deep" | "hot" }` to override the default cooldown-based cache strategy \u2014 see get_schema.notes.cacheStrategy for details.',
     inputSchema: createPostSchema,
-    handler: (args, ctx) => createPost(ctx.graphql, args)
+    handler: (args, ctx) => createPost(ctx.graphql, args),
+    readOnly: false,
+    destructive: false
   },
   {
     name: "update_post",
     description: "Update an existing post by postId. Only the fields you pass are changed. Tag list / publishedAt changes also update the PostTag denormalized index. Passing `metadata` REPLACES the existing object \u2014 call get_post first if you only want to add or change one key.",
     inputSchema: updatePostSchema,
-    handler: (args, ctx) => updatePost(ctx.graphql, args)
+    handler: (args, ctx) => updatePost(ctx.graphql, args),
+    readOnly: false,
+    // Overwrites an existing post's fields — not a pure additive write.
+    destructive: true
   },
   {
     name: "delete_post",
     description: "Delete a post by postId. Also drops associated PostTag index entries.",
     inputSchema: deletePostSchema,
     handler: (args, ctx) => deletePost(ctx.graphql, args),
+    readOnly: false,
     destructive: true
   },
   {
     name: "upload_media",
     description: "Upload a file to the site's media S3 bucket. Pass base64-encoded bytes; the server stores them verbatim under public/media/YYYY/MM/. Returns the public URL and Media record. The server does not transcode \u2014 pre-process (e.g. resize/webp) on the client.",
     inputSchema: uploadMediaSchema,
-    handler: (args, ctx) => uploadMedia(ctx.graphql, ctx.storage(), args)
+    handler: (args, ctx) => uploadMedia(ctx.graphql, ctx.storage(), args),
+    readOnly: false,
+    destructive: false
   },
   {
     name: "list_media",
     description: 'List media files in the CMS. Optional filters: `mimeType` (prefix match \u2014 "image/" matches all images, "image/png" only PNG), `prefix` (S3 key prefix on `src`, e.g. "public/media/2024/"), `createdAfter` / `createdBefore` (ISO 8601 date range). Returns up to `limit` rows (default 20) \u2014 each `{ mediaId, src, url, mimeType, size, createdAt, updatedAt }` \u2014 plus a `nextToken` cursor. Note: filters apply after the page read, so a page may return fewer than `limit` rows while a `nextToken` remains \u2014 follow the cursor. Use this to find media to delete without remembering `upload_media` responses.',
     inputSchema: listMediaSchema,
-    handler: (args, ctx) => listMedia(ctx.graphql, ctx.storage(), args)
+    handler: (args, ctx) => listMedia(ctx.graphql, ctx.storage(), args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "search_media",
     description: 'Search media by substring (case-sensitive `contains`) across `src` (which includes the filename) and `mimeType`. Pass `query` (e.g. "logo", ".png", "image/png"). Walks DynamoDB pages internally until it collects at least `limit` matches (default 20), exhausts the table, or hits its page cap \u2014 so `limit` is a soft target and the result may run slightly past it. Returns the same row shape as `list_media` plus `nextToken`; `truncated: true` means the page cap was hit with more to scan (pass `nextToken` back to continue).',
     inputSchema: searchMediaSchema,
-    handler: (args, ctx) => searchMedia(ctx.graphql, ctx.storage(), args)
+    handler: (args, ctx) => searchMedia(ctx.graphql, ctx.storage(), args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "delete_media",
@@ -1737,13 +1753,16 @@ var tools = [
       ctx.storage(),
       args
     ),
+    readOnly: false,
     destructive: true
   },
   {
     name: "get_schema",
     description: "Returns the CMS content schema (Post/Page/Media field shapes, format enum, notes). Useful as the first call to understand what fields are available.",
     inputSchema: getSchemaSchema,
-    handler: async () => getSchema()
+    handler: async () => getSchema(),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "upload_static_bundle",
@@ -1754,6 +1773,7 @@ var tools = [
       ctx.storage(),
       args
     ),
+    readOnly: false,
     destructive: true
   },
   {
@@ -1763,7 +1783,10 @@ var tools = [
     handler: (args, ctx) => uploadStaticFile(
       ctx.storage(),
       args
-    )
+    ),
+    readOnly: false,
+    // Overwrites whatever file currently sits at that S3 key.
+    destructive: true
   },
   {
     name: "delete_static_file",
@@ -1773,6 +1796,7 @@ var tools = [
       ctx.storage(),
       args
     ),
+    readOnly: false,
     destructive: true
   },
   {
@@ -1783,13 +1807,128 @@ var tools = [
       ctx.graphql,
       ctx.storage(),
       args
-    )
+    ),
+    readOnly: false,
+    // Rebuilds (overwrites) the existing Post row's manifest.
+    destructive: true
   }
 ];
-async function dispatchToolCall(name, args, ctx) {
-  const tool = tools.find((t) => t.name === name);
-  if (!tool) return null;
-  return tool.handler(args, ctx);
+
+// ../mcp-server/dist/jsonrpc/index.js
+var JSON_RPC_PARSE_ERROR = -32700;
+var JSON_RPC_INVALID_REQUEST = -32600;
+var JSON_RPC_METHOD_NOT_FOUND = -32601;
+var JSON_RPC_INVALID_PARAMS = -32602;
+var JSON_RPC_INTERNAL_ERROR = -32603;
+var SUPPORTED_PROTOCOL_VERSIONS = ["2025-03-26", "2024-11-05"];
+var LATEST_SUPPORTED_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0];
+function jsonRpcResult(id, result) {
+  return { jsonrpc: "2.0", id, result };
+}
+function jsonRpcError(id, code, message, data) {
+  const error = { code, message };
+  if (data !== void 0) error.data = data;
+  return { jsonrpc: "2.0", id, error };
+}
+function isNotification(req) {
+  return req.id === void 0;
+}
+function hasValidJsonRpcId(req) {
+  const id = req.id;
+  if (id === void 0) return true;
+  return typeof id === "string" || typeof id === "number" && Number.isInteger(id);
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function toolAnnotations(t) {
+  const annotations = {};
+  if (typeof t.readOnly === "boolean") annotations.readOnlyHint = t.readOnly;
+  if (typeof t.destructive === "boolean") annotations.destructiveHint = t.destructive;
+  return annotations;
+}
+async function dispatchJsonRpc(req, opts) {
+  if (!hasValidJsonRpcId(req)) {
+    return jsonRpcError(
+      null,
+      JSON_RPC_INVALID_REQUEST,
+      "Invalid Request: `id` must be a string or an integer"
+    );
+  }
+  const response = await dispatchMethod(req, opts);
+  return isNotification(req) ? null : response;
+}
+async function dispatchMethod(req, opts) {
+  const id = req.id ?? null;
+  switch (req.method) {
+    case "initialize": {
+      const requested = req.params?.protocolVersion;
+      if (typeof requested !== "string") {
+        return jsonRpcError(
+          id,
+          JSON_RPC_INVALID_PARAMS,
+          "initialize requires a string `protocolVersion` parameter"
+        );
+      }
+      const protocolVersion = SUPPORTED_PROTOCOL_VERSIONS.includes(
+        requested
+      ) ? requested : LATEST_SUPPORTED_PROTOCOL_VERSION;
+      return jsonRpcResult(id, {
+        protocolVersion,
+        capabilities: { tools: {} },
+        serverInfo: opts.serverInfo
+      });
+    }
+    case "notifications/initialized":
+      return jsonRpcResult(id, {});
+    case "tools/list":
+      return jsonRpcResult(id, {
+        tools: opts.tools.map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema,
+          annotations: toolAnnotations(t)
+        }))
+      });
+    case "tools/call": {
+      const params = req.params;
+      if (!params || typeof params.name !== "string") {
+        return jsonRpcError(id, JSON_RPC_INVALID_PARAMS, "tools/call requires a `name` parameter");
+      }
+      const rawArgs = params.arguments;
+      if (rawArgs !== void 0 && !isPlainObject(rawArgs)) {
+        return jsonRpcError(
+          id,
+          JSON_RPC_INVALID_PARAMS,
+          "tools/call `arguments` must be an object"
+        );
+      }
+      const tool = opts.tools.find((t) => t.name === params.name);
+      if (!tool) {
+        return jsonRpcError(id, JSON_RPC_METHOD_NOT_FOUND, `unknown tool: ${params.name}`);
+      }
+      const ctx = opts.getContext();
+      try {
+        const result = await tool.handler(rawArgs ?? {}, ctx);
+        return jsonRpcResult(id, {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        });
+      } catch (err2) {
+        const rawMessage = err2 instanceof Error ? err2.message : String(err2);
+        console.error("[mcp-jsonrpc] tool dispatch failed", {
+          tool: params.name,
+          message: rawMessage
+        });
+        const message = opts.formatToolError ? opts.formatToolError(err2) : rawMessage;
+        return jsonRpcResult(id, {
+          isError: true,
+          content: [{ type: "text", text: message }]
+        });
+      }
+    }
+    default:
+      return jsonRpcError(id, JSON_RPC_METHOD_NOT_FOUND, `Method not found: ${req.method}`);
+  }
 }
 
 // src/functions/mcp-graphql-client.ts
@@ -1909,12 +2048,6 @@ function createMcpStorageClient(opts) {
 }
 
 // src/functions/mcp-handler.ts
-var JSON_RPC_PARSE_ERROR = -32700;
-var JSON_RPC_INVALID_REQUEST = -32600;
-var JSON_RPC_METHOD_NOT_FOUND = -32601;
-var JSON_RPC_INVALID_PARAMS = -32602;
-var JSON_RPC_INTERNAL_ERROR = -32603;
-var MCP_PROTOCOL_VERSION = "2024-11-05";
 var LAST_USED_THROTTLE_MS = 6e4;
 function requireEnv(name) {
   const v = process.env[name];
@@ -1937,14 +2070,6 @@ function jsonResponse(statusCode, body) {
     body: JSON.stringify(body)
   };
 }
-function jsonRpcResult(id, result) {
-  return { jsonrpc: "2.0", id, result };
-}
-function jsonRpcError(id, code, message, data) {
-  const error = { code, message };
-  if (data !== void 0) error.data = data;
-  return { jsonrpc: "2.0", id, error };
-}
 async function validateBearer(plaintext) {
   const hash = hashToken(plaintext);
   const res = await ddb.send(
@@ -1997,55 +2122,6 @@ function makeContext() {
   cachedCtx = ctx;
   return ctx;
 }
-async function dispatchJsonRpc(req) {
-  switch (req.method) {
-    case "initialize":
-      return jsonRpcResult(req.id, {
-        protocolVersion: MCP_PROTOCOL_VERSION,
-        capabilities: { tools: {} },
-        serverInfo: { name: "ampless-mcp", version: "0.2" }
-      });
-    case "notifications/initialized":
-      return jsonRpcResult(req.id, null);
-    case "tools/list":
-      return jsonRpcResult(req.id, {
-        tools: HTTP_TOOLS.map((t) => ({
-          name: t.name,
-          description: t.description,
-          inputSchema: t.inputSchema
-        }))
-      });
-    case "tools/call": {
-      const params = req.params;
-      if (!params?.name || typeof params.name !== "string") {
-        return jsonRpcError(req.id, JSON_RPC_INVALID_PARAMS, "tools/call requires a `name` parameter");
-      }
-      const tool = HTTP_TOOLS.find((t) => t.name === params.name);
-      if (!tool) {
-        return jsonRpcError(req.id, JSON_RPC_METHOD_NOT_FOUND, `unknown tool: ${params.name}`);
-      }
-      const ctx = makeContext();
-      try {
-        const result = await dispatchToolCall(params.name, params.arguments ?? {}, ctx);
-        return jsonRpcResult(req.id, {
-          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
-        });
-      } catch (err2) {
-        const message = err2 instanceof Error ? err2.message : String(err2);
-        console.error("[mcp-handler] tool dispatch failed", {
-          tool: params.name,
-          message
-        });
-        return jsonRpcResult(req.id, {
-          isError: true,
-          content: [{ type: "text", text: message }]
-        });
-      }
-    }
-    default:
-      return jsonRpcError(req.id, JSON_RPC_METHOD_NOT_FOUND, `Method not found: ${req.method}`);
-  }
-}
 var handler = async (event) => {
   if (event.requestContext?.http?.method === "OPTIONS") {
     return { statusCode: 204, body: "" };
@@ -2074,14 +2150,25 @@ var handler = async (event) => {
   } catch {
     return jsonResponse(400, jsonRpcError(null, JSON_RPC_PARSE_ERROR, "Parse error"));
   }
-  if (req.jsonrpc !== "2.0" || typeof req.method !== "string") {
+  if (typeof req !== "object" || req === null || Array.isArray(req)) {
+    return jsonResponse(400, jsonRpcError(null, JSON_RPC_INVALID_REQUEST, "Invalid Request"));
+  }
+  if (req.jsonrpc !== "2.0" || typeof req.method !== "string" || !hasValidJsonRpcId(req)) {
+    const responseId = hasValidJsonRpcId(req) ? req.id ?? null : null;
     return jsonResponse(
       400,
-      jsonRpcError(req?.id ?? null, JSON_RPC_INVALID_REQUEST, "Invalid Request")
+      jsonRpcError(responseId, JSON_RPC_INVALID_REQUEST, "Invalid Request")
     );
   }
   try {
-    const response = await dispatchJsonRpc(req);
+    const response = await dispatchJsonRpc(req, {
+      tools: HTTP_TOOLS,
+      getContext: makeContext,
+      serverInfo: { name: "ampless-mcp", version: "0.2" }
+    });
+    if (response === null) {
+      return { statusCode: 202, body: "" };
+    }
     return jsonResponse(200, response);
   } catch (err2) {
     const message = err2 instanceof Error ? err2.message : String(err2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-beta.87",
+  "version": "1.0.0-beta.89",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -69,8 +69,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "@ampless/mcp-server": "1.0.0-beta.64",
-    "ampless": "1.0.0-beta.57"
+    "@ampless/mcp-server": "1.0.0-beta.66",
+    "ampless": "1.0.0-beta.59"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1.19.0",