@ampless/mcp-server 0.2.0-alpha.7 → 0.2.0-alpha.9

package/dist/index.js

@@ -7,7 +7,7 @@ import {
 } from "./chunk-IW52OUIR.js";
 import {
   tools
-} from "./chunk-6LH275IC.js";
+} from "./chunk-4PTNHZO4.js";
 import {
   AwsCrc32,
   __awaiter,
@@ -32067,6 +32067,32 @@ function isValidBase64EncodedSSECustomerKey(str, options) {
   }
 }
 
+// ../../node_modules/.pnpm/@aws-sdk+client-s3@3.1048.0/node_modules/@aws-sdk/client-s3/dist-es/commands/DeleteObjectCommand.js
+var DeleteObjectCommand = class extends Command.classBuilder().ep({
+  ...commonParams,
+  Bucket: { type: "contextParams", name: "Bucket" },
+  Key: { type: "contextParams", name: "Key" }
+}).m(function(Command2, cs, config2, o2) {
+  return [
+    getEndpointPlugin(config2, Command2.getEndpointParameterInstructions()),
+    getThrow200ExceptionsPlugin(config2)
+  ];
+}).s("AmazonS3", "DeleteObject", {}).n("S3Client", "DeleteObjectCommand").sc(DeleteObject$).build() {
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+client-s3@3.1048.0/node_modules/@aws-sdk/client-s3/dist-es/commands/ListObjectsV2Command.js
+var ListObjectsV2Command = class extends Command.classBuilder().ep({
+  ...commonParams,
+  Bucket: { type: "contextParams", name: "Bucket" },
+  Prefix: { type: "contextParams", name: "Prefix" }
+}).m(function(Command2, cs, config2, o2) {
+  return [
+    getEndpointPlugin(config2, Command2.getEndpointParameterInstructions()),
+    getThrow200ExceptionsPlugin(config2)
+  ];
+}).s("AmazonS3", "ListObjectsV2", {}).n("S3Client", "ListObjectsV2Command").sc(ListObjectsV2$).build() {
+};
+
 // ../../node_modules/.pnpm/@aws-sdk+client-s3@3.1048.0/node_modules/@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js
 var PutObjectCommand = class extends Command.classBuilder().ep({
   ...commonParams,
@@ -32113,6 +32139,34 @@ var StorageClient = class {
     );
     return formatPublicAssetUrl(this.bucket, this.region, key);
   }
+  async deleteObject(key) {
+    await this.client.send(
+      new DeleteObjectCommand({ Bucket: this.bucket, Key: key })
+    );
+  }
+  async listObjects(prefix) {
+    const out = [];
+    let token;
+    do {
+      const res = await this.client.send(
+        new ListObjectsV2Command({
+          Bucket: this.bucket,
+          Prefix: prefix,
+          ContinuationToken: token
+        })
+      );
+      for (const obj of res.Contents ?? []) {
+        if (!obj.Key) continue;
+        out.push({
+          key: obj.Key,
+          size: obj.Size ?? 0,
+          lastModified: obj.LastModified?.toISOString()
+        });
+      }
+      token = res.IsTruncated ? res.NextContinuationToken : void 0;
+    } while (token);
+    return out;
+  }
 };
 
 // src/server.ts

package/dist/tools/index.d.ts

@@ -1,3 +1,5 @@
+import { BundleExtractResult } from 'ampless';
+
 /**
  * Abstract contracts each tool handler depends on. Concrete
  * implementations live elsewhere:
@@ -15,6 +17,14 @@
 interface GraphqlClient {
     query<T>(operation: string, variables?: Record<string, unknown>): Promise<T>;
 }
+interface StorageObject {
+    /** Full S3 key including any prefix. */
+    key: string;
+    /** Object size in bytes (0 when the backend can't supply it). */
+    size: number;
+    /** ISO 8601 timestamp of the last write, when the backend supplies it. */
+    lastModified?: string;
+}
 interface StorageClient {
     /**
      * Upload `body` to the bucket at `key` with `contentType`. Returns
@@ -22,6 +32,18 @@ interface StorageClient {
      * https://{bucket}.s3.{region}.amazonaws.com/{key}).
      */
     putObject(key: string, body: Uint8Array, contentType: string): Promise<string>;
+    /**
+     * Remove the object at `key`. Implementations should treat a missing
+     * key as success (S3 DeleteObject is idempotent by default).
+     */
+    deleteObject(key: string): Promise<void>;
+    /**
+     * List every object under `prefix`. Implementations are expected to
+     * paginate internally so the caller gets the full set in a single
+     * resolved promise — the static-bundle tools never expect more than
+     * a few hundred entries per bundle in practice.
+     */
+    listObjects(prefix: string): Promise<StorageObject[]>;
 }
 interface ToolContext {
     graphql: GraphqlClient;
@@ -29,6 +51,51 @@ interface ToolContext {
     defaultSiteId: string;
 }
 
+/**
+ * Server-side zip extractor used by the static-bundle MCP tools. Both
+ * the stdio CLI and the Lambda HTTP transport run this — `fflate` is
+ * a workspace dependency of `@ampless/mcp-server`, so the import
+ * resolves identically in both. The browser-side admin uploader has
+ * its own `extractZip(File)` based on JSZip (works on a `File`, not a
+ * `Buffer`).
+ *
+ * Behaviour parity with the admin extractor:
+ *  - Skip directory entries (fflate gives byte arrays only, so this
+ *    is naturally satisfied unless the zip has empty-byte directory
+ *    placeholders — those still get filtered out by validateBundlePath
+ *    returning "directory entry" for any path ending with `/`).
+ *  - Silently drop OS-specific junk (`__MACOSX/*`, `.DS_Store`,
+ *    `Thumbs.db`) so callers don't see them as bundle entries.
+ *  - Surface structural issues (absolute paths, parent traversal, null
+ *    bytes) so the tool can reject the upload.
+ *  - Strip a common single top-level directory (macOS Finder zips
+ *    wrap their contents in a folder).
+ */
+
+interface ExtractZipOptions {
+    /**
+     * Hard ceiling on uncompressed bundle bytes. Defaults to 50 MB,
+     * matching the browser uploader's MAX_BUNDLE_BYTES. Callers running
+     * inside a tight Lambda envelope (Function URL payload cap ~6 MB
+     * post-base64) can tighten this; setting it lower than the bundle
+     * causes `extractZipFromBuffer` to throw before fully populating
+     * `files`.
+     */
+    maxBytes?: number;
+}
+/**
+ * Unzip `buffer` in memory and return the same shape the browser
+ * `extractZip(File)` helper returns. Throws if the unzip itself fails
+ * (corrupt archive) or if the uncompressed size exceeds `maxBytes`.
+ */
+declare function extractZipFromBuffer(buffer: Uint8Array, opts?: ExtractZipOptions): BundleExtractResult;
+/**
+ * Decode an extracted file's bytes as UTF-8 text. Used by the tool
+ * handler before running cross-file `validateBundle` so we don't
+ * instantiate a TextDecoder per entry. fflate provides a fast helper.
+ */
+declare function decodeUtf8(data: Uint8Array): string;
+
 interface ToolDefinition {
     name: string;
     description: string;
@@ -49,4 +116,4 @@ declare function dispatchToolCall(name: string, args: Record<string, unknown>, c
  */
 declare function getTools(): readonly ToolDefinition[];
 
-export { type GraphqlClient, type StorageClient, type ToolContext, type ToolDefinition, dispatchToolCall, getTools, tools };
+export { type ExtractZipOptions, type GraphqlClient, type StorageClient, type StorageObject, type ToolContext, type ToolDefinition, decodeUtf8, dispatchToolCall, extractZipFromBuffer, getTools, tools };

package/dist/tools/index.js

@@ -1,12 +1,16 @@
 #!/usr/bin/env node
 import {
+  decodeUtf8,
   dispatchToolCall,
+  extractZipFromBuffer,
   getTools,
   tools
-} from "../chunk-6LH275IC.js";
+} from "../chunk-4PTNHZO4.js";
 import "../chunk-LMMQX4CK.js";
 export {
+  decodeUtf8,
   dispatchToolCall,
+  extractZipFromBuffer,
   getTools,
   tools
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/mcp-server",
-  "version": "0.2.0-alpha.7",
+  "version": "0.2.0-alpha.9",
   "description": "MCP server for ampless — lets AI agents (Claude Desktop, Cursor, Claude Code) read and write posts and media via AppSync",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,8 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@aws-sdk/client-s3": "^3.1048.0",
     "amazon-cognito-identity-js": "^6.3.12",
-    "ampless": "0.2.0-alpha.7"
+    "fflate": "^0.8.2",
+    "ampless": "0.2.0-alpha.8"
   },
   "keywords": [
     "ampless",