@everystack/mcp 0.2.0

package/README.md

@@ -0,0 +1,100 @@
+# @everystack/mcp
+
+MCP server that makes Claude an everystack expert. Provides architecture knowledge, project introspection tools, and guided workflow prompts so Claude can help build apps from V1 (static) to V3 (full platform).
+
+## Setup
+
+Add to your project's `.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "everystack": {
+      "command": "npx",
+      "args": ["@everystack/mcp"]
+    }
+  }
+}
+```
+
+Or for a monorepo workspace:
+
+```json
+{
+  "mcpServers": {
+    "everystack": {
+      "command": "npx",
+      "args": ["tsx", "packages/mcp/src/index.ts"]
+    }
+  }
+}
+```
+
+## What It Provides
+
+### Resources (Knowledge)
+
+Claude reads these to understand everystack architecture and conventions.
+
+**Core (loaded first):**
+- `everystack://core` — Architecture, package map, tiers, conventions, handler reference
+- `everystack://security` — Three-layer security model, AWS IAM profiles, RLS policies
+
+**Detail (loaded on demand):**
+- `everystack://handler-options` — Complete createHandler() options reference
+- `everystack://query-protocol` — PostgREST filter syntax, embedding, aggregates
+- `everystack://client-api` — Typed client, query builder, mutations
+- `everystack://auth` — JWT auth flows, OAuth, token lifecycle
+- `everystack://schema-patterns` — Drizzle schema design, migrations, RLS
+- `everystack://deployment` — SST config, secrets, stages, resource linking
+- `everystack://admin` — Declarative admin dashboard
+- `everystack://jobs` — SQS background workers
+- `everystack://storage` — S3 file uploads, presigned URLs
+- `everystack://logging` — Structured logging, crash reports, analytics
+- `everystack://security-device` — Device attestation, biometric auth
+- `everystack://testing` — Jest setup, TDD workflow, mocking patterns
+- `everystack://plugins` — Plugin system for composing handlers
+- `everystack://ssr` — Server-side rendering, loaders, SEO
+- `everystack://images` — Sharp image processing, CDN delivery
+- `everystack://events` — Real-time events via LISTEN/NOTIFY + WebSocket
+- `everystack://cli` — CLI command reference
+
+### Tools (Project Introspection)
+
+Read-only tools that analyze your project and return structured data.
+
+| Tool | Purpose |
+|------|---------|
+| `project_status` | Detect tier (V1/V2/V3), installed packages, project structure, deployment state |
+| `schema_analyze` | Parse Drizzle schema, cross-reference handler config, detect misconfigurations |
+| `project_validate` | Check for security gaps, missing dependencies, convention violations |
+
+### Prompts (Guided Workflows)
+
+Structured prompts that guide Claude through multi-step tasks.
+
+| Prompt | Purpose |
+|--------|---------|
+| `new-app` | Scaffold a new everystack app (V1/V2/V3) |
+| `add-feature` | Add auth, jobs, storage, images, admin, logging, security, SSR, or events |
+| `design-schema` | Plain English → Drizzle schema + RLS policies + handler config |
+| `deploy` | Stage-specific deployment walkthrough |
+| `debug` | Systematic debugging based on symptoms |
+| `secure` | AWS IAM profiles + RLS + JWT auth setup |
+
+## Design
+
+**Standalone.** Zero everystack peer dependencies. Only depends on `@modelcontextprotocol/sdk` and `zod`. Works even when the project is broken or partially set up.
+
+**Local-only.** Runs via stdio transport. No network access, no AWS calls. The everystack CLI handles remote infrastructure — the MCP teaches Claude how to use it.
+
+**Read-only tools.** Tools read files and return structured data. Claude does the reasoning. No file writes, no imports from other packages.
+
+**Curated resources.** The markdown files are optimized for Claude consumption — organized by task, not by package. Each follows a consistent structure: When to Use, Setup, API Reference, Common Patterns, Gotchas.
+
+## Development
+
+```bash
+pnpm --filter @everystack/mcp test     # Run tests (58 passing)
+pnpm --filter @everystack/mcp lint     # Type check
+```

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@everystack/mcp",
+  "version": "0.2.0",
+  "description": "MCP server that makes Claude an everystack expert",
+  "license": "AGPL-3.0-only",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "src",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    }
+  },
+  "bin": {
+    "everystack-mcp": "./src/index.ts"
+  },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "zod": "3.25.67"
+  },
+  "devDependencies": {
+    "@types/jest": "29.5.14",
+    "@types/node": "22.19.18",
+    "jest": "29.7.0",
+    "ts-jest": "29.4.9",
+    "tsx": "4.21.0",
+    "typescript": "5.9.3"
+  }
+}

package/src/index.ts

@@ -0,0 +1,58 @@
+#!/usr/bin/env tsx
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { registerResources } from './resources/index.js';
+import { registerTools } from './tools/index.js';
+import { registerPrompts } from './prompts/index.js';
+
+const server = new McpServer(
+  { name: '@everystack/mcp', version: '0.2.0' },
+  {
+    instructions: [
+      'You are an everystack expert. everystack is a self-hosted application stack for Expo apps on AWS.',
+      '',
+      '## Beginner Detection',
+      '',
+      'Detect the user\'s experience level from context:',
+      '- If the user describes an app idea without technical terms, has no existing project, or asks basic questions ("how do I start?", "I want to build..."), treat them as a BEGINNER.',
+      '- If the user references specific packages, tiers (V1/V2/V3), tools (Drizzle, PostgREST, SST), or has an existing everystack project, treat them as a DEVELOPER.',
+      '',
+      '## Beginner Flow',
+      '',
+      'For beginners:',
+      '1. Read everystack://getting-started first. This is your guide for how to talk to beginners.',
+      '2. Ask what they want to build. Listen to their idea before anything technical. Do NOT categorize into tiers or ask them to choose V1/V2/V3.',
+      '3. Run check_environment with phase "local". Only V1 prerequisites matter now (Node.js, git, pnpm). PostgreSQL is NOT needed yet.',
+      '   Do NOT require AWS tools (AWS CLI, credentials, SST) upfront. The user will build and run locally first.',
+      '4. Walk through installing missing prerequisites ONE AT A TIME. Do not list them all at once. Install the first missing tool, confirm it works, then move to the next.',
+      '5. Create a stock Expo app: `npx create-expo-app@latest`, install V1 packages (`@everystack/server`, `@everystack/cli`, `@everystack/ui`), and `pnpm add -D sst`.',
+      '6. Run `npx expo start`. Read everystack://first-run for the walkthrough. The first milestone is seeing the app running in a browser.',
+      '7. Build together. Discuss what the app should look like. Create screens, navigation, components. Everything is static and visual.',
+      '8. When a feature needs user accounts or saved data, read everystack://adding-database. This introduces PostgreSQL, the API handler, auth, and database setup step by step.',
+      '9. When a feature needs file uploads or background tasks, add the relevant packages incrementally (everystack://storage, everystack://jobs, everystack://images).',
+      '10. When the user is ready to deploy to the internet, run check_environment with phase "deploy" and walk through AWS setup.',
+      '    For AWS credentials specifically, read everystack://aws-setup and walk them through account creation and IAM setup step by step.',
+      '11. Never use jargon without explaining it. "Lambda" is "the server that runs your code." "S3" is "file storage." "RDS" is "the database server." "CloudFront" is "the CDN that makes your app fast worldwide."',
+      '',
+      '## Developer Flow',
+      '',
+      'For experienced developers:',
+      '1. Read everystack://core for architecture and conventions.',
+      '2. Read everystack://security before any deployment or auth guidance.',
+      '3. Load detail resources on demand when the user asks about specific features.',
+      '4. Use the project_status tool to understand the user\'s current project state.',
+      '5. Use the schema_analyze tool when helping with database schema or RLS.',
+      '6. Use the project_validate tool to check for common mistakes before deployment.',
+      '7. When the user wants to start a new project, run check_environment (phase "local" for dev, "deploy" for deployment) to verify prerequisites.',
+      '8. When the user needs to interact with deployed infrastructure, guide them to use the everystack CLI.',
+    ].join('\n'),
+  },
+);
+
+registerResources(server);
+registerTools(server);
+registerPrompts(server);
+
+const transport = new StdioServerTransport();
+server.connect(transport).catch(console.error);

package/src/prompts/add-feature.ts

@@ -0,0 +1,163 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+
+const FEATURES: Record<string, { resource: string; packages: string[]; steps: string[] }> = {
+  auth: {
+    resource: 'everystack://auth',
+    packages: ['@everystack/auth'],
+    steps: [
+      'Install @everystack/auth',
+      'Create auth handlers with createAuthHandlers(db, schema, jwtSecret)',
+      'Add auth routes to Lambda handler (signup, signin, refresh, verify, signout)',
+      'Create lib/auth-context.tsx with AuthProvider and useAuth hook',
+      'Add pgSettings to handler config for RLS claim injection',
+      'Add signup and signin screens in app/',
+      'Set JwtSecret via SST secrets: `pnpm sst secret set JwtSecret "$(openssl rand -base64 32)" --stage dev`',
+    ],
+  },
+  jobs: {
+    resource: 'everystack://jobs',
+    packages: ['@everystack/jobs'],
+    steps: [
+      'Install @everystack/jobs',
+      'Create server/worker.ts with createWorkerHandler',
+      'Define job types and handlers',
+      'Add SQS queue to sst.config.ts',
+      'Create job adapter: createJobAdapter({ type: "sqs", queueUrl: Resource.Jobs.url })',
+      'Publish jobs from API handlers: jobClient.publish(type, payload)',
+      'Add dead letter queue for failed jobs',
+    ],
+  },
+  storage: {
+    resource: 'everystack://storage',
+    packages: ['@everystack/storage'],
+    steps: [
+      'Install @everystack/storage',
+      'Add S3 bucket for uploads to sst.config.ts',
+      'Add storagePlugin to handler plugins with MIME type validation',
+      'Add uploads table to schema (or use @everystack/storage/schema)',
+      'Client flow: request presigned URL → upload to S3 → confirm upload',
+      'Configure CDN delivery for public files',
+    ],
+  },
+  images: {
+    resource: 'everystack://images',
+    packages: ['@everystack/images'],
+    steps: [
+      'Install @everystack/images',
+      'Create server/image.ts with createImageHandler',
+      'Add image Lambda to sst.config.ts (needs sharp layer)',
+      'Add image_variants table to schema',
+      'Configure variant generation (thumb, medium, large)',
+      'Set up CDN delivery with format negotiation (WebP, AVIF)',
+    ],
+  },
+  admin: {
+    resource: 'everystack://admin',
+    packages: ['@everystack/admin'],
+    steps: [
+      'Install @everystack/admin',
+      'Create admin page in app/ using AdminRoot and AdminLayout',
+      'Define resource configs for each table (fields, columns, actions)',
+      'Use EverystackAdapter for API integration',
+      'Add admin role check to protect admin routes',
+      'Add dashboard RPCs via createAllDashboardRpcs',
+    ],
+  },
+  logging: {
+    resource: 'everystack://logging',
+    packages: ['@everystack/logging'],
+    steps: [
+      'Install @everystack/logging',
+      'Add loggingPlugin to handler plugins',
+      'Add logging schema tables to your schema exports',
+      'Configure S3 log storage in sst.config.ts',
+      'Add client SDK: createLoggingClient for crash reports and analytics',
+      'Add admin dashboard RPCs for log viewing',
+    ],
+  },
+  security: {
+    resource: 'everystack://security-device',
+    packages: ['@everystack/security'],
+    steps: [
+      'Install @everystack/security',
+      'Set up Apple App Attest (requires iOS 14+, real device)',
+      'Set up Google Play Integrity (requires Google Play Services)',
+      'Generate RS256 device keys on client',
+      'Add device attestation verification to auth flow',
+      'Store device keys in secure enclave/keystore',
+    ],
+  },
+  ssr: {
+    resource: 'everystack://ssr',
+    packages: [],
+    steps: [
+      'SSR is built into @everystack/server — no extra packages needed',
+      'Create SSR loader functions that query Drizzle directly',
+      'Add getWebHandler to Lambda for HTML rendering',
+      'Set up JSON-LD structured data for SEO',
+      'Add OG meta tags for social sharing',
+      'Configure cache headers per route',
+    ],
+  },
+  events: {
+    resource: 'everystack://events',
+    packages: [],
+    steps: [
+      'Events use PostgreSQL LISTEN/NOTIFY — built into the database',
+      'Create database trigger functions for table change notifications',
+      'Set up a listener Lambda with persistent database connection',
+      'Add WebSocket fan-out for client delivery',
+      'Use the useSignal hook in React components for real-time updates',
+    ],
+  },
+};
+
+export function registerAddFeaturePrompt(server: McpServer): void {
+  server.prompt(
+    'add-feature',
+    'Add an everystack feature to an existing project. Provides step-by-step instructions for auth, jobs, storage, images, admin, logging, security, SSR, or events.',
+    {
+      feature: z.enum(['auth', 'jobs', 'storage', 'images', 'admin', 'logging', 'security', 'ssr', 'events'])
+        .describe('Feature to add'),
+      projectPath: z.string().optional().describe('Absolute path to project root'),
+    },
+    async ({ feature, projectPath }) => {
+      const f = FEATURES[feature];
+
+      return {
+        messages: [
+          {
+            role: 'user' as const,
+            content: {
+              type: 'text' as const,
+              text: [
+                `Add ${feature} to ${projectPath ? 'the project at ' + projectPath : 'my everystack project'}.`,
+                '',
+                '## Instructions',
+                '',
+                `1. Read the ${f.resource} resource for full documentation.`,
+                '2. Read everystack://core for architecture context.',
+                feature === 'auth' || feature === 'security' ? '3. Read everystack://security for the security model.' : '',
+                projectPath ? `4. Run the project_status tool with projectPath="${projectPath}" to understand the current state.` : '',
+                projectPath ? `5. Run the project_validate tool with projectPath="${projectPath}" after making changes.` : '',
+                '',
+                '## Steps',
+                '',
+                ...f.steps.map((s, i) => `${i + 1}. ${s}`),
+                '',
+                f.packages.length > 0 ? `## Install\n\n\`\`\`bash\npnpm add ${f.packages.join(' ')}\n\`\`\`` : '',
+                '',
+                '## After Setup',
+                '',
+                '- Run tests to verify the integration',
+                '- Run project_validate to check for configuration issues',
+                '- Read the relevant resource docs for advanced configuration',
+              ].filter(Boolean).join('\n'),
+            },
+          },
+        ],
+      };
+    },
+  );
+}

package/src/prompts/debug.ts

@@ -0,0 +1,136 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+
+export function registerDebugPrompt(server: McpServer): void {
+  server.prompt(
+    'debug',
+    'Systematic debugging for common everystack issues. Provides diagnostic steps based on the symptom.',
+    {
+      symptom: z.string().describe('Description of the problem (e.g., "401 on all API requests", "RLS blocking reads", "Lambda timeout")'),
+      projectPath: z.string().optional().describe('Absolute path to project root'),
+    },
+    async ({ symptom, projectPath }) => {
+      return {
+        messages: [
+          {
+            role: 'user' as const,
+            content: {
+              type: 'text' as const,
+              text: [
+                `Debug this issue: ${symptom}`,
+                '',
+                '## Instructions',
+                '',
+                '1. Read everystack://core for architecture context.',
+                projectPath ? `2. Run project_status with projectPath="${projectPath}" to understand the project.` : '',
+                projectPath ? `3. Run project_validate with projectPath="${projectPath}" to find configuration issues.` : '',
+                projectPath ? `4. Run schema_analyze with projectPath="${projectPath}" to check schema/handler alignment.` : '',
+                '',
+                '## Diagnostic Framework',
+                '',
+                'Work through these categories systematically:',
+                '',
+                '### 1. Authentication Issues (401/403)',
+                '',
+                'If the symptom involves authentication or authorization:',
+                '',
+                '- **Check token flow:**',
+                '  - Is the JWT being sent in the Authorization header?',
+                '  - Is the token expired? Decode at jwt.io and check `exp`',
+                '  - Does `auth.verifyToken` return a valid payload?',
+                '',
+                '- **Check publicRoutes:**',
+                '  - Is the route supposed to be public? Check `auth.publicRoutes` in handler config',
+                '  - Is the RPC in `auth.publicRpc`?',
+                '',
+                '- **Check pgSettings:**',
+                '  - Is `pgSettings` configured in the handler?',
+                '  - Does it set `role` and `request.jwt.claims`?',
+                '  - Test with: `SELECT current_setting(\'request.jwt.claims\', true);`',
+                '',
+                '### 2. RLS Issues (empty results, permission denied)',
+                '',
+                'Read everystack://security for RLS debugging.',
+                '',
+                '- **Check RLS is enabled:**',
+                '  ```sql',
+                '  SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = \'public\';',
+                '  ```',
+                '',
+                '- **Check policies exist:**',
+                '  ```sql',
+                '  SELECT * FROM pg_policies WHERE schemaname = \'public\';',
+                '  ```',
+                '',
+                '- **Test as specific role:**',
+                '  ```sql',
+                '  SET LOCAL ROLE authenticated;',
+                '  SELECT set_config(\'request.jwt.claims\', \'{"sub":"user-id","role":"authenticated"}\', true);',
+                '  SELECT * FROM your_table;',
+                '  ```',
+                '',
+                '- **Common RLS mistakes:**',
+                '  - Policy references wrong claim path (sub vs user_id)',
+                '  - USING clause doesn\'t match the data (e.g., UUID vs text comparison)',
+                '  - Missing policy for the operation (SELECT exists but not INSERT)',
+                '  - Forgot `WITH CHECK` on INSERT/UPDATE policies',
+                '',
+                '### 3. Query Issues (wrong data, missing relations)',
+                '',
+                'Read everystack://query-protocol for filter syntax.',
+                '',
+                '- **Check relations config:**',
+                '  - Does the handler `relations` config match the Drizzle schema relations?',
+                '  - Is the relation direction correct (from/to)?',
+                '',
+                '- **Check column names:**',
+                '  - Handler uses camelCase by default. Database uses snake_case.',
+                '  - Check `naming` option in handler config.',
+                '',
+                '### 4. Deployment Issues',
+                '',
+                'Read everystack://deployment and everystack://cli.',
+                '',
+                '- **Lambda errors:**',
+                '  ```bash',
+                '  everystack logs:errors --stage dev',
+                '  everystack logs:tail --stage dev',
+                '  ```',
+                '',
+                '- **Database connection:**',
+                '  ```bash',
+                '  everystack db:psql --stage dev',
+                '  everystack diag --stage dev',
+                '  ```',
+                '',
+                '- **Common deployment issues:**',
+                '  - Missing secrets: `pnpm sst secret list --stage dev`',
+                '  - VPC configuration: Lambda can\'t reach RDS without proper VPC setup',
+                '  - Bundle size: Check if unnecessary packages are bundled',
+                '',
+                '### 5. Performance Issues',
+                '',
+                '- **Slow queries:**',
+                '  - Check for missing indexes on filtered/joined columns',
+                '  - Check `maxLimit` and `maxEmbedDepth` in handler config',
+                '  - Use `EXPLAIN ANALYZE` on slow queries',
+                '',
+                '- **Cold starts:**',
+                '  - Minimize Lambda bundle size',
+                '  - Use provisioned concurrency for production',
+                '',
+                '## Resolution',
+                '',
+                'After diagnosing:',
+                '1. Identify the root cause',
+                '2. Propose a fix with the specific code change',
+                '3. Verify the fix resolves the issue',
+                '4. Run project_validate to ensure no new issues were introduced',
+              ].filter(Boolean).join('\n'),
+            },
+          },
+        ],
+      };
+    },
+  );
+}

package/src/prompts/deploy.ts

@@ -0,0 +1,131 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+
+export function registerDeployPrompt(server: McpServer): void {
+  server.prompt(
+    'deploy',
+    'Step-by-step deployment walkthrough for a specific stage. Covers AWS credentials, SST deploy, migrations, and verification.',
+    {
+      stage: z.enum(['dev', 'staging', 'production']).describe('Deployment stage'),
+      projectPath: z.string().optional().describe('Absolute path to project root'),
+    },
+    async ({ stage, projectPath }) => {
+      const isProduction = stage === 'production';
+
+      return {
+        messages: [
+          {
+            role: 'user' as const,
+            content: {
+              type: 'text' as const,
+              text: [
+                `Deploy to ${stage}.`,
+                '',
+                '## Instructions',
+                '',
+                '1. Read everystack://deployment for infrastructure setup.',
+                '2. Read everystack://security for AWS credential setup and deployment checklist.',
+                projectPath ? `3. Run project_validate with projectPath="${projectPath}" to check for issues before deploying.` : '',
+                projectPath ? `4. Run project_status with projectPath="${projectPath}" to see current deployment state.` : '',
+                '',
+                '## Pre-Deploy Checklist',
+                '',
+                '### AWS Credentials',
+                '',
+                '1. Verify the correct AWS profile is configured:',
+                `   - ${stage === 'dev' ? '`everystack-manage` — for development deploys and CLI operations' : ''}`,
+                `   - ${isProduction ? '`everystack-deploy` — for CI/CD production deploys (limited permissions)' : ''}`,
+                '2. Run `aws sts get-caller-identity` to verify the active profile',
+                '3. Ensure `everystack-create` profile is DISABLED unless first deploy',
+                '',
+                '### Secrets',
+                '',
+                'Set required secrets for this stage:',
+                '```bash',
+                `pnpm sst secret set JwtSecret "$(openssl rand -base64 32)" --stage ${stage}`,
+                '```',
+                '',
+                isProduction ? [
+                  '### Production Safety',
+                  '',
+                  '- [ ] All tests pass: `pnpm test`',
+                  '- [ ] No security warnings: run project_validate',
+                  '- [ ] RLS policies are in place for all tables',
+                  '- [ ] pgSettings is configured in handler',
+                  '- [ ] No hardcoded secrets in source',
+                  '- [ ] .env files are not committed',
+                  '',
+                ].join('\n') : '',
+                '## Deploy Steps',
+                '',
+                '### 1. Build',
+                '```bash',
+                'pnpm export  # Expo export (builds dist/)',
+                '```',
+                '',
+                '### 2. Deploy Infrastructure',
+                '```bash',
+                `pnpm sst deploy --stage ${stage}`,
+                '```',
+                '',
+                'This creates/updates:',
+                '- S3 bucket for static assets',
+                '- CloudFront distribution',
+                '- Lambda functions',
+                '- RDS Aurora Serverless (V2+)',
+                '- SQS queues (V3)',
+                '- IAM roles and policies',
+                '',
+                '### 3. Database Setup (V2+)',
+                '```bash',
+                `everystack db:migrate --stage ${stage}`,
+                stage === 'dev' ? `everystack db:seed --stage ${stage}  # dev only` : '',
+                '```',
+                '',
+                '### 4. Verify',
+                '```bash',
+                '# Check Lambda logs',
+                `everystack logs:tail --stage ${stage}`,
+                '',
+                '# Test the API',
+                `curl https://your-domain/api/health`,
+                '',
+                `# Connect to database (${stage})`,
+                `everystack db:psql --stage ${stage}`,
+                '```',
+                '',
+                '## Post-Deploy',
+                '',
+                '### OTA Updates (no redeploy needed)',
+                '```bash',
+                `everystack update --channel ${stage === 'production' ? 'production' : stage} --message "Description"`,
+                '```',
+                '',
+                isProduction ? [
+                  '### Production Monitoring',
+                  '',
+                  '- Check CloudWatch for Lambda errors',
+                  '- Monitor RDS connection count',
+                  '- Verify CDN cache hit rates',
+                  '- Set up CloudWatch alarms for error rates',
+                ].join('\n') : '',
+                '',
+                '## Rollback',
+                '',
+                'If something goes wrong:',
+                '```bash',
+                '# Revert to previous OTA update',
+                `everystack update --channel ${stage === 'production' ? 'production' : stage} --rollback`,
+                '',
+                '# For infrastructure changes, redeploy from a known good commit',
+                'git checkout <good-commit>',
+                `pnpm sst deploy --stage ${stage}`,
+                '```',
+              ].filter(Boolean).join('\n'),
+            },
+          },
+        ],
+      };
+    },
+  );
+}