@ampless/runtime 1.0.0-beta.74 → 1.0.0-beta.78

package/README.ja.md

@@ -121,7 +121,7 @@ CORS（匿名・読み取り専用）、64KB のボディ上限、粗い warm-in
 また、`post.metadata.cache`（auto / deep / hot）+ `post.updatedAt` +
 `cms.config.cache.{cooldownMs, freshTtlSeconds, deepTtlSeconds}` から
 `Cache-Control` を算出してレスポンスに付与します。キャッシュ戦略の
-契約については `docs/CONTENT.md` を参照してください。
+契約については `https://github.com/heavymoons/ampless/wiki/CONTENT` を参照してください。
 
 ## サブパス
 

package/README.md

@@ -119,7 +119,7 @@ returns `{ POST, OPTIONS }`; the template destructures both (a single
 It also computes `Cache-Control` from `post.metadata.cache` (auto /
 deep / hot) + `post.updatedAt` + `cms.config.cache.{cooldownMs,
 freshTtlSeconds, deepTtlSeconds}` and sets the header on the response.
-See `docs/CONTENT.md` for the cache strategy contract.
+See `https://github.com/heavymoons/ampless/wiki/CONTENT` for the cache strategy contract.
 
 ## Sub-paths
 

package/dist/{chunk-5BLMLMZU.js → chunk-PK7Q7YJX.js}

@@ -1,6 +1,5 @@
 // src/stream-s3.ts
 import { getProperties } from "aws-amplify/storage/server";
-import { cookies } from "next/headers";
 var DEFAULT_THRESHOLD_BYTES = 6 * 1024 * 1024;
 var META_CACHE_MAX = 1e3;
 var META_CACHE_TTL_MS = 5 * 6e4;
@@ -111,7 +110,7 @@ async function streamS3Object(amplifyServerContext, key, options) {
 }
 async function streamS3ObjectWithRunner(runWithAmplifyServerContext, key, options) {
   return runWithAmplifyServerContext({
-    nextServerContext: { cookies },
+    nextServerContext: null,
     operation: (ctx) => streamS3Object(ctx, key, options)
   });
 }

package/dist/dispatchers/index.d.ts

@@ -3,7 +3,6 @@ import { Metadata } from 'next';
 import { Ampless } from '../index.js';
 import 'ampless';
 import 'aws-amplify/storage/server';
-import 'next/headers';
 
 interface Props$2 {
     params: Promise<Record<string, never>>;

package/dist/index.d.ts

@@ -3,7 +3,6 @@ export { Config, Post, ThemeManifest } from 'ampless';
 import { Metadata } from 'next';
 import { ReactNode } from 'react';
 import { getProperties } from 'aws-amplify/storage/server';
-import { cookies } from 'next/headers';
 
 interface StorageOutput {
     bucket_name: string;
@@ -625,16 +624,17 @@ declare function _resetStreamS3Cache(): void;
  */
 declare function streamS3Object(amplifyServerContext: AmplifyServerContext, key: string, options: StreamS3Options): Promise<Response>;
 /**
- * Convenience wrapper that pulls in the standard Amplify SSR cookie
- * adapter so route handlers don't have to duplicate the
+ * Convenience wrapper so route handlers don't have to duplicate the
  * `runWithAmplifyServerContext` plumbing. Pass the runner from
  * `createServerRunner({ config: outputs })` and the rest is the same
  * shape as `streamS3Object`.
+ *
+ * Runs with `nextServerContext: null` (Amplify's stateless guest path):
+ * no cookie read or write, so the public-cacheable response can never
+ * carry a Set-Cookie.
  */
 declare function streamS3ObjectWithRunner(runWithAmplifyServerContext: <T>(args: {
-    nextServerContext: {
-        cookies: typeof cookies;
-    };
+    nextServerContext: null;
     operation: (ctx: AmplifyServerContext) => Promise<T>;
 }) => Promise<T>, key: string, options: StreamS3Options): Promise<Response>;
 

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   _resetStreamS3Cache,
   streamS3Object,
   streamS3ObjectWithRunner
-} from "./chunk-5BLMLMZU.js";
+} from "./chunk-PK7Q7YJX.js";
 
 // src/storage.ts
 import { formatPublicAssetUrl } from "ampless";

package/dist/middleware.js

@@ -144,7 +144,13 @@ var RESERVED_PREFIXES = /* @__PURE__ */ new Set([
   // internal rewrite targets — direct hits should not be middleware-driven
   "raw",
   "static",
-  "md"
+  "md",
+  // `/.well-known/*` is passed through to Next (RFC 8615 registry paths):
+  // the exact `/.well-known/mcp/catalog.json` is rewritten below when MCP
+  // discovery is on; everything else (e.g. a future
+  // `/.well-known/mcp-registry-auth` an operator drops in) is served by
+  // Next without a wasted AppSync flag fetch or a middleware 404.
+  ".well-known"
 ]);
 function createAmplessMiddleware(opts) {
   return async function middleware(request) {
@@ -160,6 +166,10 @@ function createAmplessMiddleware(opts) {
     }
     requestHeaders.set(AMPLESS_PATHNAME_HEADER, url.pathname);
     const passthrough = () => NextResponse.next({ request: { headers: requestHeaders } });
+    if (url.pathname === "/.well-known/mcp/catalog.json" && opts.cmsConfig.ai?.publicMcp === true && opts.cmsConfig.ai?.mcpDiscovery === true) {
+      url.pathname = "/api/mcp/catalog.json";
+      return NextResponse.rewrite(url, { request: { headers: requestHeaders } });
+    }
     const segments = url.pathname.split("/").filter(Boolean);
     if (segments.length === 0) {
       return passthrough();

package/dist/routes/index.d.ts

@@ -3,7 +3,6 @@ import 'ampless';
 import 'next';
 import 'react';
 import 'aws-amplify/storage/server';
-import 'next/headers';
 
 interface Ctx$6 {
     params: Promise<{
@@ -55,7 +54,7 @@ type RawRouteHandler = (req: Request, ctx: Ctx$3) => Promise<Response>;
  *
  * Trust model: the body is emitted verbatim, same trust shape as
  * regular `format: 'html'` posts on the themed route. See
- * docs/architecture/04-access-layer-mcp.md §"editor の信頼モデル".
+ * https://github.com/heavymoons/ampless/wiki/architecture-04-access-layer-mcp §"editor の信頼モデル".
  *
  * Cache-Control: deliberately omitted from the response. Middleware
  * computes the strategy from `post.metadata.cache` + `post.updatedAt`
@@ -148,4 +147,21 @@ declare function _resetPublicMcpRateLimit(): void;
  */
 declare function createPublicMcpRouteHandler(ampless: Ampless): PublicMcpRouteHandlers;
 
-export { type FeedRouteHandler, type LlmsTxtRouteHandler, type MarkdownRouteHandler, type OgRouteHandler, type PublicMcpRouteHandlers, type RawRouteHandler, type SitemapRouteHandler, type StaticRouteHandler, _resetPublicMcpRateLimit, createFeedRouteHandler, createLlmsTxtRouteHandler, createMarkdownRouteHandler, createOgRouteHandler, createPublicMcpRouteHandler, createRawRouteHandler, createSitemapRouteHandler, createStaticRouteHandler };
+interface McpDiscoveryRouteHandlers {
+    catalog: {
+        GET: (request: Request) => Promise<Response>;
+        OPTIONS: (request: Request) => Promise<Response>;
+    };
+    serverCard: {
+        GET: (request: Request) => Promise<Response>;
+        OPTIONS: (request: Request) => Promise<Response>;
+    };
+}
+/**
+ * Build the discovery handlers. The template mounts the catalog handlers
+ * at `app/api/mcp/catalog.json/route.ts` (middleware rewrite target) and
+ * the server-card handlers at `app/api/mcp/server-card/route.ts`.
+ */
+declare function createMcpDiscoveryRouteHandlers(ampless: Ampless): McpDiscoveryRouteHandlers;
+
+export { type FeedRouteHandler, type LlmsTxtRouteHandler, type MarkdownRouteHandler, type McpDiscoveryRouteHandlers, type OgRouteHandler, type PublicMcpRouteHandlers, type RawRouteHandler, type SitemapRouteHandler, type StaticRouteHandler, _resetPublicMcpRateLimit, createFeedRouteHandler, createLlmsTxtRouteHandler, createMarkdownRouteHandler, createMcpDiscoveryRouteHandlers, createOgRouteHandler, createPublicMcpRouteHandler, createRawRouteHandler, createSitemapRouteHandler, createStaticRouteHandler };

package/dist/routes/index.js

@@ -1,6 +1,6 @@
 import {
   streamS3Object
-} from "../chunk-5BLMLMZU.js";
+} from "../chunk-PK7Q7YJX.js";
 
 // src/routes/og.ts
 import { ImageResponse } from "next/og";
@@ -92,7 +92,6 @@ function createRawRouteHandler(ampless) {
 
 // src/routes/static.ts
 import { createServerRunner } from "@aws-amplify/adapter-nextjs";
-import { cookies } from "next/headers";
 import { getUrl } from "aws-amplify/storage/server";
 function createStaticRouteHandler(ampless) {
   const { runWithAmplifyServerContext } = createServerRunner({
@@ -160,7 +159,7 @@ async function serveStaticAsset({
     presignedUrlFor: (k) => signStaticAsset({ runWithAmplifyServerContext, key: k })
   };
   return runWithAmplifyServerContext({
-    nextServerContext: { cookies },
+    nextServerContext: null,
     operation: (ctx) => streamS3Object(ctx, key, opts)
   });
 }
@@ -170,7 +169,7 @@ async function signStaticAsset({
 }) {
   try {
     return await runWithAmplifyServerContext({
-      nextServerContext: { cookies },
+      nextServerContext: null,
       operation: async (amplifyContext) => {
         const result = await getUrl(amplifyContext, {
           path: key,
@@ -344,6 +343,42 @@ import {
   MAX_BATCH
 } from "@ampless/mcp-server/jsonrpc";
 import { publicTools } from "@ampless/mcp-server/public";
+
+// src/routes/_mcp-shared.ts
+var PUBLIC_MCP_SERVER_VERSION = "0.2.0";
+function corsHeaders(methods, extra = {}) {
+  return {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": methods,
+    "Access-Control-Allow-Headers": "content-type, mcp-protocol-version",
+    "Access-Control-Max-Age": "86400",
+    ...extra
+  };
+}
+var CARD_NAME_PATTERN = /^[a-zA-Z0-9.-]+\/[a-zA-Z0-9._-]+$/;
+var CARD_NAME_MIN = 3;
+var CARD_NAME_MAX = 200;
+var SERVER_NAME_SUFFIX = "ampless-mcp";
+function resolvePublicMcpIdentity(siteUrl) {
+  if (!siteUrl?.trim()) return null;
+  let hostname;
+  try {
+    const parsed = new URL(siteUrl);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+    hostname = parsed.hostname;
+  } catch {
+    return null;
+  }
+  const labels = hostname.split(".").filter(Boolean);
+  if (labels.length === 0) return null;
+  const namespace = labels.reverse().join(".");
+  const name = `${namespace}/${SERVER_NAME_SUFFIX}`;
+  if (name.length < CARD_NAME_MIN || name.length > CARD_NAME_MAX) return null;
+  if (!CARD_NAME_PATTERN.test(name)) return null;
+  return { name, version: PUBLIC_MCP_SERVER_VERSION };
+}
+
+// src/routes/public-mcp.ts
 var MAX_BODY_BYTES = 64 * 1024;
 var RATE_WINDOW_MS = 6e4;
 var RATE_MAX = 600;
@@ -363,28 +398,23 @@ function retryAfterSeconds() {
 function _resetPublicMcpRateLimit() {
   rateState = { count: 0, windowExpires: 0 };
 }
-function corsHeaders(extra = {}) {
-  return {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "POST, OPTIONS",
-    "Access-Control-Allow-Headers": "content-type, mcp-protocol-version",
-    "Access-Control-Max-Age": "86400",
-    ...extra
-  };
+function corsHeaders2(extra = {}) {
+  return corsHeaders("POST, OPTIONS", extra);
 }
+var STATIC_SERVER_INFO = { name: "ampless-mcp", version: "0.2" };
 function jsonResponse(status, body) {
   return new Response(JSON.stringify(body), {
     status,
-    headers: corsHeaders({ "Content-Type": "application/json", "Cache-Control": "no-store" })
+    headers: corsHeaders2({ "Content-Type": "application/json", "Cache-Control": "no-store" })
   });
 }
 function notFound() {
-  return new Response("Not Found", { status: 404, headers: corsHeaders() });
+  return new Response("Not Found", { status: 404, headers: corsHeaders2() });
 }
 function rateLimited() {
   return new Response(JSON.stringify(jsonRpcError(null, -32e3, "Rate limit exceeded")), {
     status: 429,
-    headers: corsHeaders({
+    headers: corsHeaders2({
       "Content-Type": "application/json",
       "Cache-Control": "no-store",
       "Retry-After": String(retryAfterSeconds())
@@ -396,7 +426,7 @@ function payloadTooLarge() {
     JSON.stringify(jsonRpcError(null, JSON_RPC_INVALID_REQUEST, "Payload too large")),
     {
       status: 413,
-      headers: corsHeaders({ "Content-Type": "application/json", "Cache-Control": "no-store" })
+      headers: corsHeaders2({ "Content-Type": "application/json", "Cache-Control": "no-store" })
     }
   );
 }
@@ -439,6 +469,11 @@ function createPublicMcpRouteHandler(ampless) {
   function gateOpen() {
     return ampless.cmsConfig.ai?.publicMcp === true;
   }
+  async function resolveServerInfo() {
+    if (ampless.cmsConfig.ai?.mcpDiscovery !== true) return STATIC_SERVER_INFO;
+    const settings = await ampless.loadSiteSettings();
+    return resolvePublicMcpIdentity(settings.site.url) ?? STATIC_SERVER_INFO;
+  }
   async function POST(request) {
     try {
       if (!gateOpen()) return notFound();
@@ -467,7 +502,7 @@ function createPublicMcpRouteHandler(ampless) {
       const result = await dispatchJsonRpcMessage(parsed, {
         tools: publicTools,
         getContext: () => publicCtx,
-        serverInfo: { name: "ampless-mcp", version: "0.2" },
+        serverInfo: await resolveServerInfo(),
         formatToolError,
         maxBatch: MAX_BATCH
       });
@@ -477,7 +512,7 @@ function createPublicMcpRouteHandler(ampless) {
       if (result.status === "no-content") {
         return new Response(null, {
           status: 202,
-          headers: corsHeaders({ "Cache-Control": "no-store" })
+          headers: corsHeaders2({ "Cache-Control": "no-store" })
         });
       }
       return jsonResponse(200, result.body);
@@ -488,15 +523,128 @@ function createPublicMcpRouteHandler(ampless) {
   }
   async function OPTIONS(_request) {
     if (!gateOpen()) return notFound();
-    return new Response(null, { status: 204, headers: corsHeaders() });
+    return new Response(null, { status: 204, headers: corsHeaders2() });
   }
   return { POST, OPTIONS };
 }
+
+// src/routes/mcp-discovery.ts
+import { resolvePublicMcpEndpoint as resolvePublicMcpEndpoint2 } from "ampless";
+import { SUPPORTED_PROTOCOL_VERSIONS } from "@ampless/mcp-server/jsonrpc";
+var CARD_SCHEMA_URL = "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json";
+var CARD_CONTENT_TYPE = "application/mcp-server-card+json";
+var CATALOG_ENTRY_TYPE = "application/mcp-server-card+json";
+var CARD_TEXT_MAX = 100;
+var DESCRIPTION_TEXT = "read-only MCP endpoint for published posts (list, get, search, tags).";
+var CONTROL_CHARS_RE2 = /[\x00-\x1f\x7f]/g;
+function normalizeText2(s) {
+  return s.replace(CONTROL_CHARS_RE2, " ").replace(/\s+/g, " ").trim();
+}
+function truncate(s, max) {
+  const codePoints = [...s];
+  return codePoints.length > max ? codePoints.slice(0, max).join("") : s;
+}
+function discoveryEnabled(ampless) {
+  return ampless.cmsConfig.ai?.publicMcp === true && ampless.cmsConfig.ai?.mcpDiscovery === true;
+}
+async function resolveContext(ampless) {
+  const settings = await ampless.loadSiteSettings();
+  const endpoint = resolvePublicMcpEndpoint2(true, settings.site.url);
+  if (typeof endpoint !== "string") return null;
+  const identity = resolvePublicMcpIdentity(settings.site.url);
+  if (!identity) return null;
+  const url = new URL(endpoint);
+  const { origin, hostname } = url;
+  return {
+    origin,
+    hostname,
+    endpoint: `${origin}/api/mcp`,
+    identity,
+    siteName: settings.site.name ?? ""
+  };
+}
+function notFound2() {
+  return new Response("Not Found", {
+    status: 404,
+    headers: corsHeaders("GET, OPTIONS")
+  });
+}
+function jsonResponse2(body, contentType) {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: corsHeaders("GET, OPTIONS", {
+      "Content-Type": contentType,
+      // Spec SHOULD value — discovery documents are cheap and stable.
+      "Cache-Control": "public, max-age=3600"
+    })
+  });
+}
+function createMcpDiscoveryRouteHandlers(ampless) {
+  async function catalogGET(_request) {
+    if (!discoveryEnabled(ampless)) return notFound2();
+    const ctx = await resolveContext(ampless);
+    if (!ctx) {
+      console.warn(
+        "[ampless] MCP discovery catalog: site.url is unset or unresolvable \u2014 skipping (404)"
+      );
+      return notFound2();
+    }
+    const body = {
+      specVersion: "draft",
+      entries: [
+        {
+          // URN tail matches the Card name's `/`-suffix (`ampless-mcp`).
+          identifier: `urn:air:${ctx.hostname}:ampless-mcp`,
+          type: CATALOG_ENTRY_TYPE,
+          url: `${ctx.origin}/api/mcp/server-card`
+        }
+      ]
+    };
+    return jsonResponse2(body, "application/json");
+  }
+  async function serverCardGET(_request) {
+    if (!discoveryEnabled(ampless)) return notFound2();
+    const ctx = await resolveContext(ampless);
+    if (!ctx) {
+      console.warn(
+        "[ampless] MCP discovery server-card: site.url is unset or unresolvable \u2014 skipping (404)"
+      );
+      return notFound2();
+    }
+    const normalizedName = normalizeText2(ctx.siteName);
+    const rawDescription = normalizedName ? `${normalizedName} \u2014 ${DESCRIPTION_TEXT}` : DESCRIPTION_TEXT;
+    const card = {
+      $schema: CARD_SCHEMA_URL,
+      name: ctx.identity.name,
+      version: ctx.identity.version,
+      description: truncate(rawDescription, CARD_TEXT_MAX)
+    };
+    if (normalizedName) card.title = truncate(normalizedName, CARD_TEXT_MAX);
+    card.websiteUrl = ctx.origin;
+    card.remotes = [
+      {
+        type: "streamable-http",
+        url: ctx.endpoint,
+        supportedProtocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS]
+      }
+    ];
+    return jsonResponse2(card, CARD_CONTENT_TYPE);
+  }
+  async function optionsHandler(_request) {
+    if (!discoveryEnabled(ampless)) return notFound2();
+    return new Response(null, { status: 204, headers: corsHeaders("GET, OPTIONS") });
+  }
+  return {
+    catalog: { GET: catalogGET, OPTIONS: optionsHandler },
+    serverCard: { GET: serverCardGET, OPTIONS: optionsHandler }
+  };
+}
 export {
   _resetPublicMcpRateLimit,
   createFeedRouteHandler,
   createLlmsTxtRouteHandler,
   createMarkdownRouteHandler,
+  createMcpDiscoveryRouteHandlers,
   createOgRouteHandler,
   createPublicMcpRouteHandler,
   createRawRouteHandler,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/runtime",
-  "version": "1.0.0-beta.74",
+  "version": "1.0.0-beta.78",
   "description": "Public-side runtime for ampless: post fetching, theme dispatch, middleware, public route handlers",
   "license": "MIT",
   "type": "module",
@@ -49,11 +49,11 @@
     "htmlparser2": "^10.1.0",
     "lucide-react": "^1.16.0",
     "marked": "^18.0.4",
-    "sanitize-html": "^2.17.4",
+    "sanitize-html": "^2.18.1",
     "tailwind-merge": "^3.6.0",
-    "@ampless/mcp-server": "1.0.0-beta.68",
-    "ampless": "1.0.0-beta.61",
-    "@ampless/plugin-og-image": "0.2.0-beta.61"
+    "@ampless/mcp-server": "1.0.0-beta.70",
+    "@ampless/plugin-og-image": "0.2.0-beta.63",
+    "ampless": "1.0.0-beta.63"
   },
   "peerDependencies": {
     "@aws-amplify/adapter-nextjs": "^1",
@@ -66,6 +66,8 @@
     "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@types/sanitize-html": "^2.16.1",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
     "next": "^16.2.6",
     "react": "^19.2.6",
     "react-dom": "^19.2.6"