@ampless/backend 1.0.0-beta.88 → 1.0.0-beta.90

package/dist/functions/mcp-handler.js

@@ -3,7 +3,7 @@ import { ConditionalCheckFailedException, DynamoDBClient } from "@aws-sdk/client
 import { DynamoDBDocumentClient, GetCommand, UpdateCommand } from "@aws-sdk/lib-dynamodb";
 import { createHash } from "crypto";
 
-// ../mcp-server/dist/index.js
+// ../mcp-server/dist/tools/index.js
 import { filterSortPostSummaries } from "ampless";
 import {
   decodeAwsJson
@@ -1683,50 +1683,66 @@ var tools = [
     name: "list_posts",
     description: "Returns lightweight post summaries (no body \u2014 use get_post for content) with search / sort / filters. `total` reflects the filtered count. Supports query (substring over title/slug/tags), tag (exact), status, sort, limit (1\u2013100, default 20), offset (default 0).",
     inputSchema: listPostsSchema,
-    handler: (args, ctx) => listPosts(ctx.graphql, args)
+    handler: (args, ctx) => listPosts(ctx.graphql, args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "get_post",
     description: "Fetch a single post by slug or postId. Returns null if not found.",
     inputSchema: getPostSchema,
-    handler: (args, ctx) => getPost(ctx.graphql, args)
+    handler: (args, ctx) => getPost(ctx.graphql, args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "create_post",
     description: 'Create a new post. Title and slug are required. Body shape depends on format: tiptap=JSON node tree, markdown=source string, html=raw HTML string. Defaults to status=draft. Pass `metadata: { no_layout: true }` alongside format=html to publish the body as a bare HTML page with no theme chrome (middleware rewrites the /<slug> request to the internal bare-HTML handler). Pass `metadata: { cache: "deep" | "hot" }` to override the default cooldown-based cache strategy \u2014 see get_schema.notes.cacheStrategy for details.',
     inputSchema: createPostSchema,
-    handler: (args, ctx) => createPost(ctx.graphql, args)
+    handler: (args, ctx) => createPost(ctx.graphql, args),
+    readOnly: false,
+    destructive: false
   },
   {
     name: "update_post",
     description: "Update an existing post by postId. Only the fields you pass are changed. Tag list / publishedAt changes also update the PostTag denormalized index. Passing `metadata` REPLACES the existing object \u2014 call get_post first if you only want to add or change one key.",
     inputSchema: updatePostSchema,
-    handler: (args, ctx) => updatePost(ctx.graphql, args)
+    handler: (args, ctx) => updatePost(ctx.graphql, args),
+    readOnly: false,
+    // Overwrites an existing post's fields — not a pure additive write.
+    destructive: true
   },
   {
     name: "delete_post",
     description: "Delete a post by postId. Also drops associated PostTag index entries.",
     inputSchema: deletePostSchema,
     handler: (args, ctx) => deletePost(ctx.graphql, args),
+    readOnly: false,
     destructive: true
   },
   {
     name: "upload_media",
     description: "Upload a file to the site's media S3 bucket. Pass base64-encoded bytes; the server stores them verbatim under public/media/YYYY/MM/. Returns the public URL and Media record. The server does not transcode \u2014 pre-process (e.g. resize/webp) on the client.",
     inputSchema: uploadMediaSchema,
-    handler: (args, ctx) => uploadMedia(ctx.graphql, ctx.storage(), args)
+    handler: (args, ctx) => uploadMedia(ctx.graphql, ctx.storage(), args),
+    readOnly: false,
+    destructive: false
   },
   {
     name: "list_media",
     description: 'List media files in the CMS. Optional filters: `mimeType` (prefix match \u2014 "image/" matches all images, "image/png" only PNG), `prefix` (S3 key prefix on `src`, e.g. "public/media/2024/"), `createdAfter` / `createdBefore` (ISO 8601 date range). Returns up to `limit` rows (default 20) \u2014 each `{ mediaId, src, url, mimeType, size, createdAt, updatedAt }` \u2014 plus a `nextToken` cursor. Note: filters apply after the page read, so a page may return fewer than `limit` rows while a `nextToken` remains \u2014 follow the cursor. Use this to find media to delete without remembering `upload_media` responses.',
     inputSchema: listMediaSchema,
-    handler: (args, ctx) => listMedia(ctx.graphql, ctx.storage(), args)
+    handler: (args, ctx) => listMedia(ctx.graphql, ctx.storage(), args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "search_media",
     description: 'Search media by substring (case-sensitive `contains`) across `src` (which includes the filename) and `mimeType`. Pass `query` (e.g. "logo", ".png", "image/png"). Walks DynamoDB pages internally until it collects at least `limit` matches (default 20), exhausts the table, or hits its page cap \u2014 so `limit` is a soft target and the result may run slightly past it. Returns the same row shape as `list_media` plus `nextToken`; `truncated: true` means the page cap was hit with more to scan (pass `nextToken` back to continue).',
     inputSchema: searchMediaSchema,
-    handler: (args, ctx) => searchMedia(ctx.graphql, ctx.storage(), args)
+    handler: (args, ctx) => searchMedia(ctx.graphql, ctx.storage(), args),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "delete_media",
@@ -1737,13 +1753,16 @@ var tools = [
       ctx.storage(),
       args
     ),
+    readOnly: false,
     destructive: true
   },
   {
     name: "get_schema",
     description: "Returns the CMS content schema (Post/Page/Media field shapes, format enum, notes). Useful as the first call to understand what fields are available.",
     inputSchema: getSchemaSchema,
-    handler: async () => getSchema()
+    handler: async () => getSchema(),
+    readOnly: true,
+    destructive: false
   },
   {
     name: "upload_static_bundle",
@@ -1754,6 +1773,7 @@ var tools = [
       ctx.storage(),
       args
     ),
+    readOnly: false,
     destructive: true
   },
   {
@@ -1763,7 +1783,10 @@ var tools = [
     handler: (args, ctx) => uploadStaticFile(
       ctx.storage(),
       args
-    )
+    ),
+    readOnly: false,
+    // Overwrites whatever file currently sits at that S3 key.
+    destructive: true
   },
   {
     name: "delete_static_file",
@@ -1773,6 +1796,7 @@ var tools = [
       ctx.storage(),
       args
     ),
+    readOnly: false,
     destructive: true
   },
   {
@@ -1783,13 +1807,191 @@ var tools = [
       ctx.graphql,
       ctx.storage(),
       args
-    )
+    ),
+    readOnly: false,
+    // Rebuilds (overwrites) the existing Post row's manifest.
+    destructive: true
   }
 ];
-async function dispatchToolCall(name, args, ctx) {
-  const tool = tools.find((t) => t.name === name);
-  if (!tool) return null;
-  return tool.handler(args, ctx);
+
+// ../mcp-server/dist/jsonrpc/index.js
+var JSON_RPC_PARSE_ERROR = -32700;
+var JSON_RPC_INVALID_REQUEST = -32600;
+var JSON_RPC_METHOD_NOT_FOUND = -32601;
+var JSON_RPC_INVALID_PARAMS = -32602;
+var JSON_RPC_INTERNAL_ERROR = -32603;
+var SUPPORTED_PROTOCOL_VERSIONS = ["2025-03-26", "2024-11-05"];
+var LATEST_SUPPORTED_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0];
+function jsonRpcResult(id, result) {
+  return { jsonrpc: "2.0", id, result };
+}
+function jsonRpcError(id, code, message, data) {
+  const error = { code, message };
+  if (data !== void 0) error.data = data;
+  return { jsonrpc: "2.0", id, error };
+}
+function isNotification(req) {
+  return req.id === void 0;
+}
+function hasValidJsonRpcId(req) {
+  const id = req.id;
+  if (id === void 0) return true;
+  return typeof id === "string" || typeof id === "number" && Number.isInteger(id);
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var MAX_BATCH = 50;
+function idForError(input) {
+  if (isPlainObject(input) && hasValidJsonRpcId(input)) {
+    return input.id ?? null;
+  }
+  return null;
+}
+function validateEnvelope(input, inBatch) {
+  if (!isPlainObject(input)) {
+    return { ok: false, error: jsonRpcError(null, JSON_RPC_INVALID_REQUEST, "Invalid Request") };
+  }
+  const jsonrpc = input.jsonrpc;
+  const method = input.method;
+  if (jsonrpc !== "2.0" || typeof method !== "string" || !hasValidJsonRpcId(input)) {
+    return {
+      ok: false,
+      error: jsonRpcError(idForError(input), JSON_RPC_INVALID_REQUEST, "Invalid Request")
+    };
+  }
+  if (inBatch && method === "initialize") {
+    return {
+      ok: false,
+      error: jsonRpcError(
+        idForError(input),
+        JSON_RPC_INVALID_REQUEST,
+        "Invalid Request: `initialize` is not allowed in a batch"
+      )
+    };
+  }
+  return { ok: true, req: input };
+}
+async function dispatchJsonRpcMessage(input, opts) {
+  const maxBatch = opts.maxBatch ?? MAX_BATCH;
+  if (Array.isArray(input)) {
+    if (input.length === 0 || input.length > maxBatch) {
+      return {
+        status: "invalid",
+        body: jsonRpcError(
+          null,
+          JSON_RPC_INVALID_REQUEST,
+          input.length === 0 ? "Invalid Request: empty batch" : `Invalid Request: batch exceeds the maximum of ${maxBatch} elements`
+        )
+      };
+    }
+    const responses = [];
+    for (const element of input) {
+      const validated2 = validateEnvelope(element, true);
+      if (!validated2.ok) {
+        responses.push(validated2.error);
+        continue;
+      }
+      const res2 = await dispatchJsonRpc(validated2.req, opts);
+      if (res2 !== null) responses.push(res2);
+    }
+    return responses.length === 0 ? { status: "no-content" } : { status: "ok", body: responses };
+  }
+  const validated = validateEnvelope(input, false);
+  if (!validated.ok) {
+    return { status: "invalid", body: validated.error };
+  }
+  const res = await dispatchJsonRpc(validated.req, opts);
+  return res === null ? { status: "no-content" } : { status: "ok", body: res };
+}
+function toolAnnotations(t) {
+  const annotations = {};
+  if (typeof t.readOnly === "boolean") annotations.readOnlyHint = t.readOnly;
+  if (typeof t.destructive === "boolean") annotations.destructiveHint = t.destructive;
+  return annotations;
+}
+async function dispatchJsonRpc(req, opts) {
+  if (!hasValidJsonRpcId(req)) {
+    return jsonRpcError(
+      null,
+      JSON_RPC_INVALID_REQUEST,
+      "Invalid Request: `id` must be a string or an integer"
+    );
+  }
+  const response = await dispatchMethod(req, opts);
+  return isNotification(req) ? null : response;
+}
+async function dispatchMethod(req, opts) {
+  const id = req.id ?? null;
+  switch (req.method) {
+    case "initialize": {
+      const requested = req.params?.protocolVersion;
+      if (typeof requested !== "string") {
+        return jsonRpcError(
+          id,
+          JSON_RPC_INVALID_PARAMS,
+          "initialize requires a string `protocolVersion` parameter"
+        );
+      }
+      const protocolVersion = SUPPORTED_PROTOCOL_VERSIONS.includes(
+        requested
+      ) ? requested : LATEST_SUPPORTED_PROTOCOL_VERSION;
+      return jsonRpcResult(id, {
+        protocolVersion,
+        capabilities: { tools: {} },
+        serverInfo: opts.serverInfo
+      });
+    }
+    case "notifications/initialized":
+      return jsonRpcResult(id, {});
+    case "tools/list":
+      return jsonRpcResult(id, {
+        tools: opts.tools.map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema,
+          annotations: toolAnnotations(t)
+        }))
+      });
+    case "tools/call": {
+      const params = req.params;
+      if (!params || typeof params.name !== "string") {
+        return jsonRpcError(id, JSON_RPC_INVALID_PARAMS, "tools/call requires a `name` parameter");
+      }
+      const rawArgs = params.arguments;
+      if (rawArgs !== void 0 && !isPlainObject(rawArgs)) {
+        return jsonRpcError(
+          id,
+          JSON_RPC_INVALID_PARAMS,
+          "tools/call `arguments` must be an object"
+        );
+      }
+      const tool = opts.tools.find((t) => t.name === params.name);
+      if (!tool) {
+        return jsonRpcError(id, JSON_RPC_METHOD_NOT_FOUND, `unknown tool: ${params.name}`);
+      }
+      const ctx = opts.getContext();
+      try {
+        const result = await tool.handler(rawArgs ?? {}, ctx);
+        return jsonRpcResult(id, {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        });
+      } catch (err2) {
+        const rawMessage = err2 instanceof Error ? err2.message : String(err2);
+        console.error("[mcp-jsonrpc] tool dispatch failed", {
+          tool: params.name,
+          message: rawMessage
+        });
+        const message = opts.formatToolError ? opts.formatToolError(err2) : rawMessage;
+        return jsonRpcResult(id, {
+          isError: true,
+          content: [{ type: "text", text: message }]
+        });
+      }
+    }
+    default:
+      return jsonRpcError(id, JSON_RPC_METHOD_NOT_FOUND, `Method not found: ${req.method}`);
+  }
 }
 
 // src/functions/mcp-graphql-client.ts
@@ -1909,12 +2111,6 @@ function createMcpStorageClient(opts) {
 }
 
 // src/functions/mcp-handler.ts
-var JSON_RPC_PARSE_ERROR = -32700;
-var JSON_RPC_INVALID_REQUEST = -32600;
-var JSON_RPC_METHOD_NOT_FOUND = -32601;
-var JSON_RPC_INVALID_PARAMS = -32602;
-var JSON_RPC_INTERNAL_ERROR = -32603;
-var MCP_PROTOCOL_VERSION = "2024-11-05";
 var LAST_USED_THROTTLE_MS = 6e4;
 function requireEnv(name) {
   const v = process.env[name];
@@ -1937,14 +2133,6 @@ function jsonResponse(statusCode, body) {
     body: JSON.stringify(body)
   };
 }
-function jsonRpcResult(id, result) {
-  return { jsonrpc: "2.0", id, result };
-}
-function jsonRpcError(id, code, message, data) {
-  const error = { code, message };
-  if (data !== void 0) error.data = data;
-  return { jsonrpc: "2.0", id, error };
-}
 async function validateBearer(plaintext) {
   const hash = hashToken(plaintext);
   const res = await ddb.send(
@@ -1997,55 +2185,6 @@ function makeContext() {
   cachedCtx = ctx;
   return ctx;
 }
-async function dispatchJsonRpc(req) {
-  switch (req.method) {
-    case "initialize":
-      return jsonRpcResult(req.id, {
-        protocolVersion: MCP_PROTOCOL_VERSION,
-        capabilities: { tools: {} },
-        serverInfo: { name: "ampless-mcp", version: "0.2" }
-      });
-    case "notifications/initialized":
-      return jsonRpcResult(req.id, null);
-    case "tools/list":
-      return jsonRpcResult(req.id, {
-        tools: HTTP_TOOLS.map((t) => ({
-          name: t.name,
-          description: t.description,
-          inputSchema: t.inputSchema
-        }))
-      });
-    case "tools/call": {
-      const params = req.params;
-      if (!params?.name || typeof params.name !== "string") {
-        return jsonRpcError(req.id, JSON_RPC_INVALID_PARAMS, "tools/call requires a `name` parameter");
-      }
-      const tool = HTTP_TOOLS.find((t) => t.name === params.name);
-      if (!tool) {
-        return jsonRpcError(req.id, JSON_RPC_METHOD_NOT_FOUND, `unknown tool: ${params.name}`);
-      }
-      const ctx = makeContext();
-      try {
-        const result = await dispatchToolCall(params.name, params.arguments ?? {}, ctx);
-        return jsonRpcResult(req.id, {
-          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
-        });
-      } catch (err2) {
-        const message = err2 instanceof Error ? err2.message : String(err2);
-        console.error("[mcp-handler] tool dispatch failed", {
-          tool: params.name,
-          message
-        });
-        return jsonRpcResult(req.id, {
-          isError: true,
-          content: [{ type: "text", text: message }]
-        });
-      }
-    }
-    default:
-      return jsonRpcError(req.id, JSON_RPC_METHOD_NOT_FOUND, `Method not found: ${req.method}`);
-  }
-}
 var handler = async (event) => {
   if (event.requestContext?.http?.method === "OPTIONS") {
     return { statusCode: 204, body: "" };
@@ -2064,32 +2203,37 @@ var handler = async (event) => {
     return jsonResponse(401, { error: "invalid_token" });
   }
   await touchLastUsedAt(meta.hash);
-  let req;
+  let parsed;
   try {
     const body = event.isBase64Encoded ? Buffer.from(event.body ?? "", "base64").toString("utf8") : event.body ?? "";
     if (!body) {
       return jsonResponse(400, jsonRpcError(null, JSON_RPC_INVALID_REQUEST, "Empty body"));
     }
-    req = JSON.parse(body);
+    parsed = JSON.parse(body);
   } catch {
     return jsonResponse(400, jsonRpcError(null, JSON_RPC_PARSE_ERROR, "Parse error"));
   }
-  if (req.jsonrpc !== "2.0" || typeof req.method !== "string") {
-    return jsonResponse(
-      400,
-      jsonRpcError(req?.id ?? null, JSON_RPC_INVALID_REQUEST, "Invalid Request")
-    );
-  }
   try {
-    const response = await dispatchJsonRpc(req);
-    return jsonResponse(200, response);
+    const result = await dispatchJsonRpcMessage(parsed, {
+      tools: HTTP_TOOLS,
+      getContext: makeContext,
+      serverInfo: { name: "ampless-mcp", version: "0.2" }
+    });
+    if (result.status === "invalid") {
+      return jsonResponse(400, result.body);
+    }
+    if (result.status === "no-content") {
+      return { statusCode: 202, body: "" };
+    }
+    return jsonResponse(200, result.body);
   } catch (err2) {
+    const method = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed.method : void 0;
     const message = err2 instanceof Error ? err2.message : String(err2);
-    console.error("[mcp-handler] dispatch threw", { method: req.method, message });
-    return jsonResponse(
-      500,
-      jsonRpcError(req.id ?? null, JSON_RPC_INTERNAL_ERROR, message)
-    );
+    console.error("[mcp-handler] dispatch threw", {
+      method: typeof method === "string" ? method : void 0,
+      message
+    });
+    return jsonResponse(500, jsonRpcError(null, JSON_RPC_INTERNAL_ERROR, message));
   }
 };
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-beta.88",
+  "version": "1.0.0-beta.90",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -69,8 +69,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "@ampless/mcp-server": "1.0.0-beta.65",
-    "ampless": "1.0.0-beta.58"
+    "@ampless/mcp-server": "1.0.0-beta.67",
+    "ampless": "1.0.0-beta.60"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1.19.0",