@ampless/mcp-server 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/index.js

@@ -452,7 +452,23 @@ var uploadMediaSchema = {
     }
   }
 };
+var MIME_TYPE_RE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$/i;
+var BLOCKED_MIME_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "application/javascript",
+  "text/javascript"
+]);
+function assertSafeMimeType(mimeType) {
+  if (!MIME_TYPE_RE.test(mimeType)) {
+    throw new Error(`upload_media: invalid mimeType: ${JSON.stringify(mimeType)}`);
+  }
+  if (BLOCKED_MIME_TYPES.has(mimeType.toLowerCase())) {
+    throw new Error(`upload_media: mimeType not allowed for public media: ${mimeType}`);
+  }
+}
 async function uploadMedia(graphql, storage, args) {
+  assertSafeMimeType(args.mimeType);
   const body = Buffer.from(args.base64Data, "base64");
   const key = buildMediaKey(args.filename);
   const putResult = await storage.putObject(key, body, args.mimeType);
@@ -645,13 +661,16 @@ var GET_BY_ID2 = (
   }
 `
 );
-var GET_BY_SRC = (
+var FIND_BY_SRC = (
   /* GraphQL */
   `
-  query GetMediaBySrc($src: String!) {
-    getMediaBySrc(src: $src) {
-      mediaId
-      src
+  query FindMediaBySrc($filter: ModelMediaFilterInput!, $nextToken: String) {
+    listMedia(filter: $filter, limit: 100, nextToken: $nextToken) {
+      items {
+        mediaId
+        src
+      }
+      nextToken
     }
   }
 `
@@ -720,12 +739,18 @@ async function deleteMedia(graphql, storage, args) {
       assertMediaPrefix(src);
     }
   } else {
-    const data = await graphql.query(GET_BY_SRC, { src: args.src });
-    if (data.getMediaBySrc) {
-      mediaId = data.getMediaBySrc.mediaId;
-      src = data.getMediaBySrc.src;
-      assertMediaPrefix(src);
-    }
+    let cursor;
+    do {
+      const data = await graphql.query(FIND_BY_SRC, { filter: { src: { eq: args.src } }, nextToken: cursor });
+      const row = data.listMedia.items[0];
+      if (row) {
+        mediaId = row.mediaId;
+        src = row.src;
+        assertMediaPrefix(src);
+        break;
+      }
+      cursor = data.listMedia.nextToken ?? void 0;
+    } while (cursor);
   }
   if (!mediaId) {
     if (args.src) {
@@ -782,7 +807,12 @@ function getSchema() {
           slug: { type: "string", required: true, description: "URL slug, unique" },
           title: { type: "string", required: true },
           excerpt: { type: "string" },
-          format: { type: "enum", values: ["tiptap", "markdown", "html"], required: true },
+          format: {
+            type: "enum",
+            values: ["tiptap", "markdown", "html", "static"],
+            required: true,
+            description: "`static` is read-only here \u2014 get_post / list_posts can return it, but it is created/edited only via the static-bundle tools (upload_static_bundle, upload_static_file, delete_static_file, commit_static_post), NOT create_post / update_post. See notes.staticFormat."
+          },
           body: {
             type: "json",
             description: "tiptap node JSON when format=tiptap; markdown source string when format=markdown; raw HTML string when format=html"
@@ -821,7 +851,7 @@ function getSchema() {
         }
       }
     ],
-    formats: ["tiptap", "markdown", "html"],
+    formats: ["tiptap", "markdown", "html", "static"],
     notes: {
       editorTrust: 'editor stores arbitrary HTML/JS verbatim \u2014 same trust shape as WordPress unfiltered_html capability. See docs/architecture/04-access-layer-mcp.md \xA7"editor \u306E\u4FE1\u983C\u30E2\u30C7\u30EB".',
       tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.',
@@ -927,13 +957,13 @@ var fdeb = new u8([
 var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
 var freb = function(eb, start) {
   var b = new u16(31);
-  for (var i = 0; i < 31; ++i) {
-    b[i] = start += 1 << eb[i - 1];
+  for (var i2 = 0; i2 < 31; ++i2) {
+    b[i2] = start += 1 << eb[i2 - 1];
   }
   var r = new i32(b[30]);
-  for (var i = 1; i < 30; ++i) {
-    for (var j = b[i]; j < b[i + 1]; ++j) {
-      r[j] = j - b[i] << 5 | i;
+  for (var i2 = 1; i2 < 30; ++i2) {
+    for (var j = b[i2]; j < b[i2 + 1]; ++j) {
+      r[j] = j - b[i2] << 5 | i2;
     }
   }
   return { b, r };
@@ -956,25 +986,25 @@ var x;
 var i;
 var hMap = (function(cd, mb, r) {
   var s = cd.length;
-  var i = 0;
+  var i2 = 0;
   var l = new u16(mb);
-  for (; i < s; ++i) {
-    if (cd[i])
-      ++l[cd[i] - 1];
+  for (; i2 < s; ++i2) {
+    if (cd[i2])
+      ++l[cd[i2] - 1];
   }
   var le = new u16(mb);
-  for (i = 1; i < mb; ++i) {
-    le[i] = le[i - 1] + l[i - 1] << 1;
+  for (i2 = 1; i2 < mb; ++i2) {
+    le[i2] = le[i2 - 1] + l[i2 - 1] << 1;
   }
   var co;
   if (r) {
     co = new u16(1 << mb);
     var rvb = 15 - mb;
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        var sv = i << 4 | cd[i];
-        var r_1 = mb - cd[i];
-        var v = le[cd[i] - 1]++ << r_1;
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        var sv = i2 << 4 | cd[i2];
+        var r_1 = mb - cd[i2];
+        var v = le[cd[i2] - 1]++ << r_1;
         for (var m = v | (1 << r_1) - 1; v <= m; ++v) {
           co[rev[v] >> rvb] = sv;
         }
@@ -982,9 +1012,9 @@ var hMap = (function(cd, mb, r) {
     }
   } else {
     co = new u16(s);
-    for (i = 0; i < s; ++i) {
-      if (cd[i]) {
-        co[i] = rev[le[cd[i] - 1]++] >> 15 - cd[i];
+    for (i2 = 0; i2 < s; ++i2) {
+      if (cd[i2]) {
+        co[i2] = rev[le[cd[i2] - 1]++] >> 15 - cd[i2];
       }
     }
   }
@@ -1011,9 +1041,9 @@ var flrm = /* @__PURE__ */ hMap(flt, 9, 1);
 var fdrm = /* @__PURE__ */ hMap(fdt, 5, 1);
 var max = function(a) {
   var m = a[0];
-  for (var i = 1; i < a.length; ++i) {
-    if (a[i] > m)
-      m = a[i];
+  for (var i2 = 1; i2 < a.length; ++i2) {
+    if (a[i2] > m)
+      m = a[i2];
   }
   return m;
 };
@@ -1106,28 +1136,28 @@ var inflt = function(dat, st, buf, dict) {
         pos += 14;
         var ldt = new u8(tl);
         var clt = new u8(19);
-        for (var i = 0; i < hcLen; ++i) {
-          clt[clim[i]] = bits(dat, pos + i * 3, 7);
+        for (var i2 = 0; i2 < hcLen; ++i2) {
+          clt[clim[i2]] = bits(dat, pos + i2 * 3, 7);
         }
         pos += hcLen * 3;
         var clb = max(clt), clbmsk = (1 << clb) - 1;
         var clm = hMap(clt, clb, 1);
-        for (var i = 0; i < tl; ) {
+        for (var i2 = 0; i2 < tl; ) {
           var r = clm[bits(dat, pos, clbmsk)];
           pos += r & 15;
           var s = r >> 4;
           if (s < 16) {
-            ldt[i++] = s;
+            ldt[i2++] = s;
           } else {
             var c = 0, n = 0;
             if (s == 16)
-              n = 3 + bits(dat, pos, 3), pos += 2, c = ldt[i - 1];
+              n = 3 + bits(dat, pos, 3), pos += 2, c = ldt[i2 - 1];
             else if (s == 17)
               n = 3 + bits(dat, pos, 7), pos += 3;
             else if (s == 18)
               n = 11 + bits(dat, pos, 127), pos += 7;
             while (n--)
-              ldt[i++] = c;
+              ldt[i2++] = c;
           }
         }
         var lt = ldt.subarray(0, hLit), dt = ldt.subarray(hLit);
@@ -1165,8 +1195,8 @@ var inflt = function(dat, st, buf, dict) {
       } else {
         var add = sym - 254;
         if (sym > 264) {
-          var i = sym - 257, b = fleb[i];
-          add = bits(dat, pos, (1 << b) - 1) + fl[i];
+          var i2 = sym - 257, b = fleb[i2];
+          add = bits(dat, pos, (1 << b) - 1) + fl[i2];
           pos += b;
         }
         var d = dm[bits16(dat, pos) & dms], dsym = d >> 4;
@@ -1224,26 +1254,26 @@ try {
 } catch (e) {
 }
 var dutf8 = function(d) {
-  for (var r = "", i = 0; ; ) {
-    var c = d[i++];
+  for (var r = "", i2 = 0; ; ) {
+    var c = d[i2++];
     var eb = (c > 127) + (c > 223) + (c > 239);
-    if (i + eb > d.length)
-      return { s: r, r: slc(d, i - 1) };
+    if (i2 + eb > d.length)
+      return { s: r, r: slc(d, i2 - 1) };
     if (!eb)
       r += String.fromCharCode(c);
     else if (eb == 3) {
-      c = ((c & 15) << 18 | (d[i++] & 63) << 12 | (d[i++] & 63) << 6 | d[i++] & 63) - 65536, r += String.fromCharCode(55296 | c >> 10, 56320 | c & 1023);
+      c = ((c & 15) << 18 | (d[i2++] & 63) << 12 | (d[i2++] & 63) << 6 | d[i2++] & 63) - 65536, r += String.fromCharCode(55296 | c >> 10, 56320 | c & 1023);
     } else if (eb & 1)
-      r += String.fromCharCode((c & 31) << 6 | d[i++] & 63);
+      r += String.fromCharCode((c & 31) << 6 | d[i2++] & 63);
     else
-      r += String.fromCharCode((c & 15) << 12 | (d[i++] & 63) << 6 | d[i++] & 63);
+      r += String.fromCharCode((c & 15) << 12 | (d[i2++] & 63) << 6 | d[i2++] & 63);
   }
 };
 function strFromU8(dat, latin1) {
   if (latin1) {
     var r = "";
-    for (var i = 0; i < dat.length; i += 16384)
-      r += String.fromCharCode.apply(null, dat.subarray(i, i + 16384));
+    for (var i2 = 0; i2 < dat.length; i2 += 16384)
+      r += String.fromCharCode.apply(null, dat.subarray(i2, i2 + 16384));
     return r;
   } else if (td) {
     return td.decode(dat);
@@ -1303,7 +1333,7 @@ function unzipSync(data, opts) {
     }
   }
   var fltr = opts && opts.filter;
-  for (var i = 0; i < c; ++i) {
+  for (var i2 = 0; i2 < c; ++i2) {
     var _a2 = zh(data, o, z), c_2 = _a2[0], sc = _a2[1], su = _a2[2], fn = _a2[3], no = _a2[4], off = _a2[5], b = slzh(data, off);
     o = no;
     if (!fltr || fltr({
@@ -1473,7 +1503,7 @@ async function uploadStaticBundle(graphql, storage, args) {
   const { files, issues } = extractZipFromBuffer(zipBytes);
   if (issues.length > 0) {
     throw new Error(
-      `upload_static_bundle: rejected bundle path(s): ${issues.map((i) => `${i.path} (${i.reason})`).join("; ")}`
+      `upload_static_bundle: rejected bundle path(s): ${issues.map((i2) => `${i2.path} (${i2.reason})`).join("; ")}`
     );
   }
   if (files.length === 0) {
@@ -1482,7 +1512,7 @@ async function uploadStaticBundle(graphql, storage, args) {
   const contentIssues = validateBundle(files);
   if (contentIssues.length > 0) {
     throw new Error(
-      `upload_static_bundle: bundle contains absolute / protocol-relative refs: ${contentIssues.map((i) => `${i.path}: ${i.reason}`).join("; ")}`
+      `upload_static_bundle: bundle contains absolute / protocol-relative refs: ${contentIssues.map((i2) => `${i2.path}: ${i2.reason}`).join("; ")}`
     );
   }
   const entrypoint = args.entrypoint ?? pickDefaultEntrypoint(files);
@@ -1493,8 +1523,10 @@ async function uploadStaticBundle(graphql, storage, args) {
   }
   const prefix = bundlePrefix(slug);
   const existing = await storage.listObjects(prefix).catch((err2) => {
-    console.error("[upload_static_bundle] listObjects failed (proceeding)", err2);
-    return [];
+    console.error("[upload_static_bundle] listObjects failed", err2);
+    throw new Error(
+      `upload_static_bundle: failed to list existing bundle objects for full-prefix wipe: ${err2 instanceof Error ? err2.message : String(err2)}`
+    );
   });
   for (const obj of existing) {
     await storage.deleteObject(obj.key);
@@ -1571,7 +1603,7 @@ async function uploadStaticFile(storage, args) {
     const issues = findAbsolutePathRefs(filename, text);
     if (issues.length > 0) {
       throw new Error(
-        `upload_static_file: ${filename} contains absolute / protocol-relative refs: ${issues.map((i) => i.reason).join("; ")}`
+        `upload_static_file: ${filename} contains absolute / protocol-relative refs: ${issues.map((i2) => i2.reason).join("; ")}`
       );
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/mcp-server",
-  "version": "1.0.0-beta.58",
+  "version": "1.0.0-beta.60",
   "description": "MCP tool registry shared by @ampless/backend mcp-handler Lambda. Installed transitively via @ampless/admin / @ampless/backend; no direct install needed.",
   "publishConfig": {
     "access": "public"
@@ -26,7 +26,7 @@
   "bugs": "https://github.com/heavymoons/ampless/issues",
   "dependencies": {
     "fflate": "^0.8.3",
-    "ampless": "1.0.0-beta.52"
+    "ampless": "1.0.0-beta.54"
   },
   "keywords": [
     "ampless",