@ampless/mcp-server 1.0.0-beta.59 → 1.0.0-beta.60

package/dist/index.js

@@ -452,7 +452,23 @@ var uploadMediaSchema = {
     }
   }
 };
+var MIME_TYPE_RE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$/i;
+var BLOCKED_MIME_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "application/javascript",
+  "text/javascript"
+]);
+function assertSafeMimeType(mimeType) {
+  if (!MIME_TYPE_RE.test(mimeType)) {
+    throw new Error(`upload_media: invalid mimeType: ${JSON.stringify(mimeType)}`);
+  }
+  if (BLOCKED_MIME_TYPES.has(mimeType.toLowerCase())) {
+    throw new Error(`upload_media: mimeType not allowed for public media: ${mimeType}`);
+  }
+}
 async function uploadMedia(graphql, storage, args) {
+  assertSafeMimeType(args.mimeType);
   const body = Buffer.from(args.base64Data, "base64");
   const key = buildMediaKey(args.filename);
   const putResult = await storage.putObject(key, body, args.mimeType);
@@ -645,13 +661,16 @@ var GET_BY_ID2 = (
   }
 `
 );
-var GET_BY_SRC = (
+var FIND_BY_SRC = (
   /* GraphQL */
   `
-  query GetMediaBySrc($src: String!) {
-    getMediaBySrc(src: $src) {
-      mediaId
-      src
+  query FindMediaBySrc($filter: ModelMediaFilterInput!, $nextToken: String) {
+    listMedia(filter: $filter, limit: 100, nextToken: $nextToken) {
+      items {
+        mediaId
+        src
+      }
+      nextToken
     }
   }
 `
@@ -720,12 +739,18 @@ async function deleteMedia(graphql, storage, args) {
       assertMediaPrefix(src);
     }
   } else {
-    const data = await graphql.query(GET_BY_SRC, { src: args.src });
-    if (data.getMediaBySrc) {
-      mediaId = data.getMediaBySrc.mediaId;
-      src = data.getMediaBySrc.src;
-      assertMediaPrefix(src);
-    }
+    let cursor;
+    do {
+      const data = await graphql.query(FIND_BY_SRC, { filter: { src: { eq: args.src } }, nextToken: cursor });
+      const row = data.listMedia.items[0];
+      if (row) {
+        mediaId = row.mediaId;
+        src = row.src;
+        assertMediaPrefix(src);
+        break;
+      }
+      cursor = data.listMedia.nextToken ?? void 0;
+    } while (cursor);
   }
   if (!mediaId) {
     if (args.src) {
@@ -782,7 +807,12 @@ function getSchema() {
           slug: { type: "string", required: true, description: "URL slug, unique" },
           title: { type: "string", required: true },
           excerpt: { type: "string" },
-          format: { type: "enum", values: ["tiptap", "markdown", "html"], required: true },
+          format: {
+            type: "enum",
+            values: ["tiptap", "markdown", "html", "static"],
+            required: true,
+            description: "`static` is read-only here \u2014 get_post / list_posts can return it, but it is created/edited only via the static-bundle tools (upload_static_bundle, upload_static_file, delete_static_file, commit_static_post), NOT create_post / update_post. See notes.staticFormat."
+          },
           body: {
             type: "json",
             description: "tiptap node JSON when format=tiptap; markdown source string when format=markdown; raw HTML string when format=html"
@@ -821,7 +851,7 @@ function getSchema() {
         }
       }
     ],
-    formats: ["tiptap", "markdown", "html"],
+    formats: ["tiptap", "markdown", "html", "static"],
     notes: {
       editorTrust: 'editor stores arbitrary HTML/JS verbatim \u2014 same trust shape as WordPress unfiltered_html capability. See docs/architecture/04-access-layer-mcp.md \xA7"editor \u306E\u4FE1\u983C\u30E2\u30C7\u30EB".',
       tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.',
@@ -1493,8 +1523,10 @@ async function uploadStaticBundle(graphql, storage, args) {
   }
   const prefix = bundlePrefix(slug);
   const existing = await storage.listObjects(prefix).catch((err2) => {
-    console.error("[upload_static_bundle] listObjects failed (proceeding)", err2);
-    return [];
+    console.error("[upload_static_bundle] listObjects failed", err2);
+    throw new Error(
+      `upload_static_bundle: failed to list existing bundle objects for full-prefix wipe: ${err2 instanceof Error ? err2.message : String(err2)}`
+    );
   });
   for (const obj of existing) {
     await storage.deleteObject(obj.key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/mcp-server",
-  "version": "1.0.0-beta.59",
+  "version": "1.0.0-beta.60",
   "description": "MCP tool registry shared by @ampless/backend mcp-handler Lambda. Installed transitively via @ampless/admin / @ampless/backend; no direct install needed.",
   "publishConfig": {
     "access": "public"
@@ -26,7 +26,7 @@
   "bugs": "https://github.com/heavymoons/ampless/issues",
   "dependencies": {
     "fflate": "^0.8.3",
-    "ampless": "1.0.0-beta.53"
+    "ampless": "1.0.0-beta.54"
   },
   "keywords": [
     "ampless",