@everystack/mcp 0.3.2 → 0.4.0

package/dist/project-claude-md.md

@@ -19,12 +19,21 @@ These are enforced (everystack cheat gates) and load-bearing. Do not work around
 - **Data lives in PostgreSQL, served through the API — never bundle data into the app.** A
   large `.json`/`.csv` of computed data in the bundle is wrong; model it and serve it, or
   render an empty state if it does not exist yet.
-- **Schema changes have two homes; neither is a hand-written migration.** Tables and authz
-  are generated from Models: declare with `defineModel` (in `db/models/`), run
-  `everystack db:generate` — never hand-write a SQL migration, never edit the generated
-  `db/schema.ts`; after any change `db:generate` must be a clean no-op. Functions, views,
-  and matviews are **authored** in `db/sql/` and **deployed** with `everystack db:reconcile`
-  — edit the SQL file, reconcile, done; `db:reconcile --check` must exit 0.
+- **Nobody authors migrations. Schema work has two homes.** The WHOLE declared database
+  lives in `db/models/`: tables and authz with `defineModel`, and the derived layer —
+  functions, views, matviews — as descriptors (`defineView` / `defineMaterializedView` /
+  `defineFunction` / `defineSql`, triggers via `trigger()` on the model). Edit the
+  declaration, then `everystack db:sync` moves the dev database to your checkout (state +
+  authz + derived, fingerprint-verified). One-shot DATA moves are authored in
+  `db/backfills/*.sql` and run via `everystack db:backfill` — deliberately, never as a
+  schema side effect. Never hand-write a SQL
+  migration, never edit `db/schema.generated.ts`; `everystack db:check` must pass (the CI
+  gate: the declared state composes, generated artifacts match regeneration).
+- **Protected stages take plans, not syncs.** `everystack db:plan` mints a reviewable edge
+  pinned by fingerprints at both ends; `db:apply` verifies before and after, requires the
+  checkout to descend from the commit declaring the target's state ("rebase first"), and
+  gates destructive plans: `--confirm` always, snapshot always, the stage's approver set
+  (`db:approvers`) when declared.
 - **Authorization is declared, not hand-written.** Use `can()` abilities on the Model; they
   compile to RLS + grants. Never hand-write `CREATE POLICY`/`GRANT`. RLS is required.
 - **Reuse `@everystack/ui`.** Do not hand-roll a component that already exists there. Style
@@ -35,11 +44,12 @@ These are enforced (everystack cheat gates) and load-bearing. Do not work around
 
 ## Start Here
 
-- `db/models/` — `defineModel` tables (the source of truth for schema + authz)
-- `db/sql/` — functions, views, matviews (authored SQL; deploys via `db:reconcile`)
+- `db/models/` — the declared database: `defineModel` tables + derived descriptors
+  (`defineView`/`defineMaterializedView`/`defineFunction`/`defineSql`; deploys via `db:reconcile`/`db:sync`)
+- `db/backfills/` — one-shot data jobs (authored SQL; run via `db:backfill`, own record)
 - `app/` — Expo Router pages (screens, navigation, API routes)
 - `server/` — Lambda handlers (api.ts, worker.ts, image.ts)
-- `db/schema.generated.ts`, `drizzle/` — generated artifacts (do not edit by hand)
+- `db/schema.generated.ts` — generated artifact (never edit; `db:check` refuses drift)
 - `lib/` — shared code (auth context, API client)
 - `sst.config.ts` — AWS infrastructure definition
 - `docs/RUNBOOK.md` — how to operate this app; regenerate with `everystack runbook`
@@ -54,9 +64,12 @@ These are enforced (everystack cheat gates) and load-bearing. Do not work around
 pnpm install                                 # Install dependencies
 pnpm dev                                     # Start the Expo dev server
 pnpm test                                    # Run all tests (TDD)
-everystack db:generate                       # Models → next migration (data + authz)
-everystack db:reconcile --apply              # Deploy functions/views/matviews from db/sql (no migrations)
-everystack db:migrate                        # Apply migrations on the deployed Lambda
+everystack db:sync                           # Dev edit loop: the database follows your checkout (state + authz + derived)
+everystack db:check                          # CI gate: declared state composes; generated artifacts match regeneration
+everystack db:plan | db:apply                # Protected stages: reviewable, fingerprint-verified edges
+everystack db:branch                         # Per-git-branch dev DB from the seeded template (db:template:refresh builds it)
+everystack db:backfill --apply               # Run one-shot data jobs from db/backfills/ (own record)
+everystack db:generate                       # Models → the diff as SQL (review surface)
 everystack db:seed                           # Seed the database (dev only)
 everystack deploy --stage dev                # Deploy infrastructure (SST)
 everystack update --channel production        # OTA update (no redeploy)
@@ -69,12 +82,15 @@ everystack bundle:audit <url>                # Audit a deployed bundle (weight +
 ### Models are the source of truth (v3)
 
 Declare tables with `defineModel` (`field`, `can`, relations). A package's full DB slice is a
-`defineModule`; the app composes Modules. `everystack db:generate` compiles them to one
-migration (schema + RLS + grants); `deriveHandlerConfig(models)` derives the API config. You
+`defineModule`; the app composes Modules. The database's own schema is the authority — the
+live state is content-addressed (`db:fingerprint`), and every apply verifies against it. You
 never hand-write migrations, RLS, or handler access-control — they are derived, so they cannot
-drift. The derived layer (functions, views, matviews) is the exception that proves the rule:
-that SQL is authored, in `db/sql/`, and *deployed* with `db:reconcile` — hand-edits straight
-against the database surface as drift, and a comment-only edit is a no-op.
+drift; `deriveHandlerConfig(models)` derives the API config. The derived layer (functions,
+views, matviews) follows the same rule: descriptors declare the structure (identity, deps,
+authz, security posture), the body stays `sql\`\``, and reconcile *deploys* it — hand-edits
+straight against the database surface as drift, and a comment-only edit is a no-op. Contraction is a two-step ceremony: `field.deprecated()` first
+(the column stays readable, new writes are rejected, generated types strike it through), the
+physical drop later — a destructive plan, confirmed, snapshotted, approver-gated.
 
 ### Security over all else
 
@@ -104,7 +120,8 @@ Every feature starts with a failing test. Tests in `__tests__/` mirroring source
 
 - Don't bundle large data into the app — it lives in the DB, served by the API.
 - Don't hand-write migrations or edit `db/schema.ts` — edit the Model, run `db:generate`;
-  for functions/views/matviews edit `db/sql/` and run `db:reconcile`.
+  for functions/views/matviews edit the descriptors in `db/models/` and run `db:reconcile`
+  (`db/sql/` is retired — the verbs fail on it with the migration path).
 - Don't hand-write RLS — declare `can()` abilities.
 - Don't hand-roll a component that exists in `@everystack/ui`; don't use inline `StyleSheet`.
 - Don't put a secret behind `EXPO_PUBLIC_*` — that ships to the client.

package/dist/prompts/add-feature.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerAddFeaturePrompt(server: McpServer): void;
+//# sourceMappingURL=add-feature.d.ts.map

package/dist/prompts/add-feature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-feature.d.ts","sourceRoot":"","sources":["../../src/prompts/add-feature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAmHzE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+ChE"}

package/dist/prompts/add-feature.js

@@ -0,0 +1,154 @@
+import { z } from 'zod';
+const FEATURES = {
+    auth: {
+        resource: 'everystack://auth',
+        packages: ['@everystack/auth'],
+        steps: [
+            'Install @everystack/auth',
+            'Create auth handlers with createAuthHandlers(db, schema, jwtSecret)',
+            'Add auth routes to Lambda handler (signup, signin, refresh, verify, signout)',
+            'Create lib/auth-context.tsx with AuthProvider and useAuth hook',
+            'Add pgSettings to handler config for RLS claim injection',
+            'Add signup and signin screens in app/',
+            'Set JwtSecret via SST secrets: `pnpm sst secret set JwtSecret "$(openssl rand -base64 32)" --stage dev`',
+        ],
+    },
+    jobs: {
+        resource: 'everystack://jobs',
+        packages: ['@everystack/jobs'],
+        steps: [
+            'Install @everystack/jobs',
+            'Create server/worker.ts with createWorkerHandler',
+            'Define job types and handlers',
+            'Add SQS queue to sst.config.ts',
+            'Create job adapter: createJobAdapter({ type: "sqs", queueUrl: Resource.Jobs.url })',
+            'Publish jobs from API handlers: jobClient.publish(type, payload)',
+            'Add dead letter queue for failed jobs',
+        ],
+    },
+    storage: {
+        resource: 'everystack://storage',
+        packages: ['@everystack/storage'],
+        steps: [
+            'Install @everystack/storage',
+            'Add S3 bucket for uploads to sst.config.ts',
+            'Add storagePlugin to handler plugins with MIME type validation',
+            'Add uploads table to schema (or use @everystack/storage/schema)',
+            'Client flow: request presigned URL → upload to S3 → confirm upload',
+            'Configure CDN delivery for public files',
+        ],
+    },
+    images: {
+        resource: 'everystack://images',
+        packages: ['@everystack/images'],
+        steps: [
+            'Install @everystack/images',
+            'Create server/image.ts with createImageHandler',
+            'Add image Lambda to sst.config.ts (needs sharp layer)',
+            'Add image_variants table to schema',
+            'Configure variant generation (thumb, medium, large)',
+            'Set up CDN delivery with format negotiation (WebP, AVIF)',
+        ],
+    },
+    admin: {
+        resource: 'everystack://admin',
+        packages: ['@everystack/admin'],
+        steps: [
+            'Install @everystack/admin',
+            'Create admin page in app/ using AdminRoot and AdminLayout',
+            'Define resource configs for each table (fields, columns, actions)',
+            'Use EverystackAdapter for API integration',
+            'Add admin role check to protect admin routes',
+            'Add dashboard RPCs via createAllDashboardRpcs',
+        ],
+    },
+    logging: {
+        resource: 'everystack://logging',
+        packages: ['@everystack/logging'],
+        steps: [
+            'Install @everystack/logging',
+            'Add loggingPlugin to handler plugins',
+            'Add logging schema tables to your schema exports',
+            'Configure S3 log storage in sst.config.ts',
+            'Add client SDK: createLoggingClient for crash reports and analytics',
+            'Add admin dashboard RPCs for log viewing',
+        ],
+    },
+    security: {
+        resource: 'everystack://security-device',
+        packages: ['@everystack/security'],
+        steps: [
+            'Install @everystack/security',
+            'Set up Apple App Attest (requires iOS 14+, real device)',
+            'Set up Google Play Integrity (requires Google Play Services)',
+            'Generate RS256 device keys on client',
+            'Add device attestation verification to auth flow',
+            'Store device keys in secure enclave/keystore',
+        ],
+    },
+    ssr: {
+        resource: 'everystack://ssr',
+        packages: [],
+        steps: [
+            'SSR is built into @everystack/server — no extra packages needed',
+            'Create SSR loader functions that query Drizzle directly',
+            'Add getWebHandler to Lambda for HTML rendering',
+            'Set up JSON-LD structured data for SEO',
+            'Add OG meta tags for social sharing',
+            'Configure cache headers per route',
+        ],
+    },
+    events: {
+        resource: 'everystack://events',
+        packages: [],
+        steps: [
+            'Events use PostgreSQL LISTEN/NOTIFY — built into the database',
+            'Create database trigger functions for table change notifications',
+            'Set up a listener Lambda with persistent database connection',
+            'Add WebSocket fan-out for client delivery',
+            'Use the useSignal hook in React components for real-time updates',
+        ],
+    },
+};
+export function registerAddFeaturePrompt(server) {
+    server.prompt('add-feature', 'Add an everystack feature to an existing project. Provides step-by-step instructions for auth, jobs, storage, images, admin, logging, security, SSR, or events.', {
+        feature: z.enum(['auth', 'jobs', 'storage', 'images', 'admin', 'logging', 'security', 'ssr', 'events'])
+            .describe('Feature to add'),
+        projectPath: z.string().optional().describe('Absolute path to project root'),
+    }, async ({ feature, projectPath }) => {
+        const f = FEATURES[feature];
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Add ${feature} to ${projectPath ? 'the project at ' + projectPath : 'my everystack project'}.`,
+                            '',
+                            '## Instructions',
+                            '',
+                            `1. Read the ${f.resource} resource for full documentation.`,
+                            '2. Read everystack://core for architecture context.',
+                            feature === 'auth' || feature === 'security' ? '3. Read everystack://security for the security model.' : '',
+                            projectPath ? `4. Run the project_status tool with projectPath="${projectPath}" to understand the current state.` : '',
+                            projectPath ? `5. Run the project_validate tool with projectPath="${projectPath}" after making changes.` : '',
+                            '',
+                            '## Steps',
+                            '',
+                            ...f.steps.map((s, i) => `${i + 1}. ${s}`),
+                            '',
+                            f.packages.length > 0 ? `## Install\n\n\`\`\`bash\npnpm add ${f.packages.join(' ')}\n\`\`\`` : '',
+                            '',
+                            '## After Setup',
+                            '',
+                            '- Run tests to verify the integration',
+                            '- Run project_validate to check for configuration issues',
+                            '- Read the relevant resource docs for advanced configuration',
+                        ].filter(Boolean).join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/claude-md.d.ts

@@ -0,0 +1,12 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * `claude_md` — create or reconcile the project's CLAUDE.md.
+ *
+ * The CLAUDE.md is the project contract. Writing it activates the grounding gate
+ * (the nearest project CLAUDE.md is auto-required). But a contract is a living
+ * document — it drifts from reality as the project grows. So this prompt is
+ * bidirectional: scaffold it when missing, and review + suggest updates when it
+ * exists (a drift check on the contract itself), never clobbering human content.
+ */
+export declare function registerClaudeMdPrompt(server: McpServer): void;
+//# sourceMappingURL=claude-md.d.ts.map

package/dist/prompts/claude-md.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-md.d.ts","sourceRoot":"","sources":["../../src/prompts/claude-md.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiF9D"}

package/dist/prompts/claude-md.js

@@ -0,0 +1,87 @@
+import { z } from 'zod';
+/**
+ * `claude_md` — create or reconcile the project's CLAUDE.md.
+ *
+ * The CLAUDE.md is the project contract. Writing it activates the grounding gate
+ * (the nearest project CLAUDE.md is auto-required). But a contract is a living
+ * document — it drifts from reality as the project grows. So this prompt is
+ * bidirectional: scaffold it when missing, and review + suggest updates when it
+ * exists (a drift check on the contract itself), never clobbering human content.
+ */
+export function registerClaudeMdPrompt(server) {
+    server.prompt('claude_md', 'Create or keep the project CLAUDE.md current. Missing → scaffold from the everystack contract. Exists → review against the project reality + the cheat-gate rules and suggest updates (confirm-first, never clobber). Writing it activates the grounding gate.', {
+        projectPath: z.string().optional().describe('Absolute path to the project root (where CLAUDE.md lives)'),
+    }, async ({ projectPath }) => {
+        const root = projectPath ?? '.';
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Create or reconcile the CLAUDE.md for the project at ${root}.`,
+                            '',
+                            '## Why this matters',
+                            '',
+                            'CLAUDE.md is this project\'s contract. The grounding gate auto-requires the nearest',
+                            'project CLAUDE.md — so writing it is what turns grounding ON (the agent must read it',
+                            'before editing). A contract also drifts as the project grows, so it must be kept current.',
+                            '',
+                            '## Step 1 — detect the project reality',
+                            '',
+                            `- Read ${root}/package.json: which @everystack/* packages are installed (tier: V1 server/cli/ui;`,
+                            '  V2 adds api/auth/admin/logging/security/query; V3 adds jobs/storage/images).',
+                            `- Check for a models/ directory (defineModel files) and a db/ directory.`,
+                            `- Note the project name and what the app does.`,
+                            '',
+                            '## Step 2 — read the template',
+                            '',
+                            'Read the everystack://project-claude-md resource. It is the everystack contract: the',
+                            'Non-negotiables (which mirror the cheat gates), Key Principles, Commands, and the',
+                            'What NOT to Do list. Fill {PROJECT_NAME}, {ONE_LINE_DESCRIPTION}, {ANNOTATED_DIRECTORY_TREE}',
+                            'and tailor Structure/Commands to the packages actually installed.',
+                            '',
+                            `## Step 3 — does ${root}/CLAUDE.md already exist?`,
+                            '',
+                            '### If it does NOT exist → scaffold',
+                            '',
+                            `- Write ${root}/CLAUDE.md from the template, tailored to the detected reality.`,
+                            '- Keep it tight and load-bearing — a wall of prose gets read as scenery. Lead with the',
+                            '  Non-negotiables.',
+                            '- Tell the human: this activates the grounding gate; new sessions must read it first.',
+                            '',
+                            '### If it EXISTS → review and suggest updates (DO NOT clobber)',
+                            '',
+                            'Reconcile the existing CLAUDE.md against three things, and propose a concrete diff:',
+                            '1. **Framework drift** — does it teach superseded ways (e.g. `drizzle-kit generate`,',
+                            '   hand-written migrations, a migration journal, "pass your Drizzle schema") instead of',
+                            '   the migration-authority flow (`defineModel` in db/models/ → `everystack db:sync` on',
+                            '   dev; `db:plan` → `db:apply` on protected stages; `db:check` in CI; data moves in',
+                            '   db/backfills/ via `db:backfill`)? Suggest the current conventions.',
+                            '2. **Project drift** — do the Structure / Commands / package list match what is actually',
+                            '   installed now (new packages, a new tier, a new models/ dir)? Suggest updates. Also',
+                            '   check the operations manual: if docs/RUNBOOK.md is missing, or stale per',
+                            '   `everystack runbook --check`, suggest the `runbook` prompt.',
+                            '3. **Contract-vs-gates drift** — is it missing any Non-negotiable the cheat gates enforce',
+                            '   (data→DB, generated migrations, declared authz, reuse @everystack/ui, secrets boundary)?',
+                            '   Suggest adding it, so the human contract and the enforced rules agree.',
+                            '',
+                            'Rules for reconciling:',
+                            '- **Preserve all human/project-specific content** — project rules, domain notes, the',
+                            '  REQUIRED-READS line. Only update the framework/structure/commands sections and flag gaps.',
+                            '- **Propose, then confirm.** Show the human the suggested changes (a diff) and let them',
+                            '  approve before writing. The CLAUDE.md is theirs; you assist, you do not own it.',
+                            '- **Only flag real drift**, not cosmetic rewording.',
+                            '',
+                            '## Step 4 — confirm',
+                            '',
+                            'After writing/updating, confirm the file is at the project root so the grounding gate',
+                            'picks it up, and summarize what changed.',
+                        ].join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/debug.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerDebugPrompt(server: McpServer): void;
+//# sourceMappingURL=debug.d.ts.map

package/dist/prompts/debug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug.d.ts","sourceRoot":"","sources":["../../src/prompts/debug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAoI3D"}

package/dist/prompts/debug.js

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+export function registerDebugPrompt(server) {
+    server.prompt('debug', 'Systematic debugging for common everystack issues. Provides diagnostic steps based on the symptom.', {
+        symptom: z.string().describe('Description of the problem (e.g., "401 on all API requests", "RLS blocking reads", "Lambda timeout")'),
+        projectPath: z.string().optional().describe('Absolute path to project root'),
+    }, async ({ symptom, projectPath }) => {
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Debug this issue: ${symptom}`,
+                            '',
+                            '## Instructions',
+                            '',
+                            '1. Read everystack://core for architecture context.',
+                            projectPath ? `2. Run project_status with projectPath="${projectPath}" to understand the project.` : '',
+                            projectPath ? `3. Run project_validate with projectPath="${projectPath}" to find configuration issues.` : '',
+                            projectPath ? `4. Run schema_analyze with projectPath="${projectPath}" to check schema/handler alignment.` : '',
+                            '',
+                            '## Diagnostic Framework',
+                            '',
+                            'Work through these categories systematically:',
+                            '',
+                            '### 1. Authentication Issues (401/403)',
+                            '',
+                            'If the symptom involves authentication or authorization:',
+                            '',
+                            '- **Check token flow:**',
+                            '  - Is the JWT being sent in the Authorization header?',
+                            '  - Is the token expired? Decode at jwt.io and check `exp`',
+                            '  - Does `auth.verifyToken` return a valid payload?',
+                            '',
+                            '- **Check publicRoutes:**',
+                            '  - Is the route supposed to be public? Check `auth.publicRoutes` in handler config',
+                            '  - Is the RPC in `auth.publicRpc`?',
+                            '',
+                            '- **Check pgSettings:**',
+                            '  - Is `pgSettings` configured in the handler?',
+                            '  - Does it set `role` and `request.jwt.claims`?',
+                            '  - Test with: `SELECT current_setting(\'request.jwt.claims\', true);`',
+                            '',
+                            '### 2. RLS Issues (empty results, permission denied)',
+                            '',
+                            'Read everystack://security for RLS debugging.',
+                            '',
+                            '- **Check RLS is enabled:**',
+                            '  ```sql',
+                            '  SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = \'public\';',
+                            '  ```',
+                            '',
+                            '- **Check policies exist:**',
+                            '  ```sql',
+                            '  SELECT * FROM pg_policies WHERE schemaname = \'public\';',
+                            '  ```',
+                            '',
+                            '- **Test as specific role:**',
+                            '  ```sql',
+                            '  SET LOCAL ROLE authenticated;',
+                            '  SELECT set_config(\'request.jwt.claims\', \'{"sub":"user-id","role":"authenticated"}\', true);',
+                            '  SELECT * FROM your_table;',
+                            '  ```',
+                            '',
+                            '- **Common RLS mistakes:**',
+                            '  - Policy references wrong claim path (sub vs user_id)',
+                            '  - USING clause doesn\'t match the data (e.g., UUID vs text comparison)',
+                            '  - Missing policy for the operation (SELECT exists but not INSERT)',
+                            '  - Forgot `WITH CHECK` on INSERT/UPDATE policies',
+                            '',
+                            '### 3. Query Issues (wrong data, missing relations)',
+                            '',
+                            'Read everystack://query-protocol for filter syntax.',
+                            '',
+                            '- **Check relations config:**',
+                            '  - Does the handler `relations` config match the Drizzle schema relations?',
+                            '  - Is the relation direction correct (from/to)?',
+                            '',
+                            '- **Check column names:**',
+                            '  - Handler uses camelCase by default. Database uses snake_case.',
+                            '  - Check `naming` option in handler config.',
+                            '',
+                            '### 4. Deployment Issues',
+                            '',
+                            'Read everystack://deployment and everystack://cli.',
+                            '',
+                            '- **Lambda errors:**',
+                            '  ```bash',
+                            '  everystack logs:errors --stage dev',
+                            '  everystack logs:tail --stage dev',
+                            '  ```',
+                            '',
+                            '- **Database connection:**',
+                            '  ```bash',
+                            '  everystack db:psql --stage dev',
+                            '  everystack diag --stage dev',
+                            '  ```',
+                            '',
+                            '- **Common deployment issues:**',
+                            '  - Missing secrets: `pnpm sst secret list --stage dev`',
+                            '  - VPC configuration: Lambda can\'t reach RDS without proper VPC setup',
+                            '  - Bundle size: Check if unnecessary packages are bundled',
+                            '',
+                            '### 5. Performance Issues',
+                            '',
+                            '- **Slow queries:**',
+                            '  - Check for missing indexes on filtered/joined columns',
+                            '  - Check `maxLimit` and `maxEmbedDepth` in handler config',
+                            '  - Use `EXPLAIN ANALYZE` on slow queries',
+                            '',
+                            '- **Cold starts:**',
+                            '  - Minimize Lambda bundle size',
+                            '  - Use provisioned concurrency for production',
+                            '',
+                            '## Resolution',
+                            '',
+                            'After diagnosing:',
+                            '1. Identify the root cause',
+                            '2. Propose a fix with the specific code change',
+                            '3. Verify the fix resolves the issue',
+                            '4. Run project_validate to ensure no new issues were introduced',
+                        ].filter(Boolean).join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/deploy.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerDeployPrompt(server: McpServer): void;
+//# sourceMappingURL=deploy.d.ts.map

package/dist/prompts/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/prompts/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA0H5D"}

package/dist/prompts/deploy.js

@@ -0,0 +1,118 @@
+import { z } from 'zod';
+export function registerDeployPrompt(server) {
+    server.prompt('deploy', 'Step-by-step deployment walkthrough for a specific stage. Covers AWS credentials, SST deploy, migrations, and verification.', {
+        stage: z.enum(['dev', 'staging', 'production']).describe('Deployment stage'),
+        projectPath: z.string().optional().describe('Absolute path to project root'),
+    }, async ({ stage, projectPath }) => {
+        const isProduction = stage === 'production';
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Deploy to ${stage}.`,
+                            '',
+                            '## Instructions',
+                            '',
+                            '1. Read everystack://deployment for infrastructure setup.',
+                            '2. Read everystack://security for AWS credential setup and deployment checklist.',
+                            projectPath ? `3. Run project_validate with projectPath="${projectPath}" to check for issues before deploying.` : '',
+                            projectPath ? `4. Run project_status with projectPath="${projectPath}" to see current deployment state.` : '',
+                            '',
+                            '## Pre-Deploy Checklist',
+                            '',
+                            '### AWS Credentials',
+                            '',
+                            '1. Verify the correct AWS profile is configured:',
+                            `   - ${stage === 'dev' ? '`everystack-manage` — for development deploys and CLI operations' : ''}`,
+                            `   - ${isProduction ? '`everystack-deploy` — for CI/CD production deploys (limited permissions)' : ''}`,
+                            '2. Run `aws sts get-caller-identity` to verify the active profile',
+                            '3. Ensure `everystack-create` profile is DISABLED unless first deploy',
+                            '',
+                            '### Secrets',
+                            '',
+                            'Set required secrets for this stage:',
+                            '```bash',
+                            `pnpm sst secret set JwtSecret "$(openssl rand -base64 32)" --stage ${stage}`,
+                            '```',
+                            '',
+                            isProduction ? [
+                                '### Production Safety',
+                                '',
+                                '- [ ] All tests pass: `pnpm test`',
+                                '- [ ] No security warnings: run project_validate',
+                                '- [ ] RLS policies are in place for all tables',
+                                '- [ ] pgSettings is configured in handler',
+                                '- [ ] No hardcoded secrets in source',
+                                '- [ ] .env files are not committed',
+                                '',
+                            ].join('\n') : '',
+                            '## Deploy Steps',
+                            '',
+                            '### 1. Deploy Infrastructure',
+                            '```bash',
+                            `pnpm sst deploy --stage ${stage}`,
+                            '```',
+                            '',
+                            'This creates/updates:',
+                            '- S3 bucket for static assets',
+                            '- CloudFront distribution',
+                            '- Lambda functions',
+                            '- RDS Aurora Serverless (V2+)',
+                            '- SQS queues (V3)',
+                            '- IAM roles and policies',
+                            '',
+                            '### 3. Database Setup (V2+)',
+                            '```bash',
+                            `everystack db:migrate --stage ${stage}`,
+                            stage === 'dev' ? `everystack db:seed --stage ${stage}  # dev only` : '',
+                            '```',
+                            '',
+                            '### 4. Verify',
+                            '```bash',
+                            '# Check Lambda logs',
+                            `everystack logs:tail --stage ${stage}`,
+                            '',
+                            '# Test the API',
+                            `curl https://your-domain/api/health`,
+                            '',
+                            `# Connect to database (${stage})`,
+                            `everystack db:psql --stage ${stage}`,
+                            '```',
+                            '',
+                            '## Post-Deploy',
+                            '',
+                            '### OTA Updates (no redeploy needed)',
+                            '```bash',
+                            `everystack update --channel ${stage === 'production' ? 'production' : stage} --message "Description"`,
+                            '```',
+                            '',
+                            isProduction ? [
+                                '### Production Monitoring',
+                                '',
+                                '- Check CloudWatch for Lambda errors',
+                                '- Monitor RDS connection count',
+                                '- Verify CDN cache hit rates',
+                                '- Set up CloudWatch alarms for error rates',
+                            ].join('\n') : '',
+                            '',
+                            '## Rollback',
+                            '',
+                            'If something goes wrong:',
+                            '```bash',
+                            '# Revert to previous OTA update',
+                            `everystack update --channel ${stage === 'production' ? 'production' : stage} --rollback`,
+                            '',
+                            '# For infrastructure changes, redeploy from a known good commit',
+                            'git checkout <good-commit>',
+                            `pnpm sst deploy --stage ${stage}`,
+                            '```',
+                        ].filter(Boolean).join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/design-schema.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerDesignSchemaPrompt(server: McpServer): void;
+//# sourceMappingURL=design-schema.d.ts.map

package/dist/prompts/design-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"design-schema.d.ts","sourceRoot":"","sources":["../../src/prompts/design-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAoGlE"}