@everystack/mcp 0.3.2 → 0.4.0

package/dist/prompts/design-schema.js

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+export function registerDesignSchemaPrompt(server) {
+    server.prompt('design-schema', 'Interactive schema design: plain English description → Drizzle schema + migrations + RLS policies + handler config + testing checklist.', {
+        description: z.string().describe('Plain English description of the data model (e.g., "blog with posts, comments, and tags")'),
+        projectPath: z.string().optional().describe('Absolute path to project root (to analyze existing schema)'),
+    }, async ({ description, projectPath }) => {
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Design a database schema for: ${description}`,
+                            '',
+                            '## Instructions',
+                            '',
+                            '1. Read everystack://schema-patterns for Drizzle schema conventions.',
+                            '2. Read everystack://security for RLS policy patterns.',
+                            '3. Read everystack://handler-options for handler configuration.',
+                            projectPath ? `4. Run schema_analyze with projectPath="${projectPath}" to understand the existing schema.` : '',
+                            '',
+                            '## Deliverables',
+                            '',
+                            'Generate ALL of the following:',
+                            '',
+                            '### 1. Drizzle Schema (db/schema.ts)',
+                            '',
+                            'Follow these conventions:',
+                            '- UUID primary keys: `uuid(\'id\').primaryKey().defaultRandom()`',
+                            '- Timestamps: `timestamp(\'created_at\', { withTimezone: true }).defaultNow().notNull()`',
+                            '- Soft delete columns: `deletedAt` + `deletedBy` on user-facing tables',
+                            '- Foreign keys with `.references(() => table.column)`',
+                            '- Export all tables as named exports',
+                            '- Add Drizzle `relations()` for SSR query building and API embedding',
+                            '',
+                            '### 2. SQL Migration with RLS',
+                            '',
+                            'Generate a custom SQL migration that includes:',
+                            '',
+                            '```sql',
+                            '-- For each table:',
+                            'ALTER TABLE table_name ENABLE ROW LEVEL SECURITY;',
+                            '',
+                            '-- Grant minimum required access per role:',
+                            'GRANT SELECT ON table_name TO anon;',
+                            'GRANT SELECT, INSERT, UPDATE, DELETE ON table_name TO authenticated;',
+                            'GRANT ALL ON table_name TO admin;',
+                            '',
+                            '-- Policies per access pattern:',
+                            '-- Public read:',
+                            'CREATE POLICY "anon_select" ON table_name FOR SELECT TO anon USING (deleted_at IS NULL);',
+                            '',
+                            '-- Own rows only:',
+                            'CREATE POLICY "own_rows" ON table_name FOR ALL TO authenticated',
+                            '  USING (user_id = current_setting(\'request.jwt.claims\', true)::json->>\'sub\');',
+                            '',
+                            '-- Admin full access:',
+                            'CREATE POLICY "admin_all" ON table_name FOR ALL TO admin USING (true);',
+                            '```',
+                            '',
+                            'Adapt the policies to the specific access patterns for each table.',
+                            '',
+                            '### 3. Handler Configuration',
+                            '',
+                            'Generate the createHandler() config snippet:',
+                            '- `exposedTables`: only tables that should be API-accessible',
+                            '- `relations`: for embedding related data in API queries',
+                            '- `rowOwnership`: for user-scoped tables',
+                            '- `softDelete`: for tables with deletedAt columns',
+                            '- `protectedFields`: fields users cannot set directly (role, deletedAt)',
+                            '- `hiddenColumns`: sensitive columns not returned in API responses',
+                            '',
+                            '### 4. Testing Checklist',
+                            '',
+                            'Generate a testing checklist:',
+                            '- [ ] Anonymous users can read public data',
+                            '- [ ] Anonymous users cannot write any data',
+                            '- [ ] Authenticated users can only read/write their own data',
+                            '- [ ] Soft-deleted rows are hidden from normal queries',
+                            '- [ ] Admin users can access all data',
+                            '- [ ] Foreign key constraints prevent orphaned rows',
+                            '- [ ] RLS policies work with pgSettings claim injection',
+                            '',
+                            'Test each RLS policy with:',
+                            '```sql',
+                            'SET LOCAL ROLE authenticated;',
+                            "SELECT set_config('request.jwt.claims', '{\"sub\": \"user-uuid\", \"role\": \"authenticated\"}', true);",
+                            'SELECT * FROM table_name; -- should only return own rows',
+                            '```',
+                        ].filter(Boolean).join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/governance-setup.d.ts

@@ -0,0 +1,9 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * `governance_setup` — guide the agent to wire the everystack governance hooks
+ * into the project's `.claude/settings.json`. The server instructions tell the
+ * agent that enforcement runs via hooks; this prompt produces the exact block and
+ * the confirm-first procedure.
+ */
+export declare function registerGovernanceSetupPrompt(server: McpServer): void;
+//# sourceMappingURL=governance-setup.d.ts.map

package/dist/prompts/governance-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-setup.d.ts","sourceRoot":"","sources":["../../src/prompts/governance-setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA2ErE"}

package/dist/prompts/governance-setup.js

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+/**
+ * `governance_setup` — guide the agent to wire the everystack governance hooks
+ * into the project's `.claude/settings.json`. The server instructions tell the
+ * agent that enforcement runs via hooks; this prompt produces the exact block and
+ * the confirm-first procedure.
+ */
+export function registerGovernanceSetupPrompt(server) {
+    server.prompt('governance_setup', 'Install the everystack governance hooks (grounding gate + cheat gates) into .claude/settings.json. The MCP server alone does not enforce — the hooks are the teeth.', {
+        projectPath: z.string().optional().describe('Absolute path to the project root'),
+        mode: z
+            .enum(['workspace', 'installed'])
+            .optional()
+            .describe('"workspace" (run from this monorepo via tsx) or "installed" (the published @everystack/mcp bin). Default: detect.'),
+    }, async ({ projectPath, mode }) => {
+        const cmd = mode === 'workspace'
+            ? 'npx tsx packages/mcp/src/index.ts'
+            : mode === 'installed'
+                ? 'everystack-mcp'
+                : 'everystack-mcp';
+        const hooks = {
+            hooks: {
+                SessionStart: [{ hooks: [{ type: 'command', command: `${cmd} context` }] }],
+                PreToolUse: [{ matcher: '*', hooks: [{ type: 'command', command: `${cmd} gate` }] }],
+                PostToolUse: [
+                    { matcher: 'Read', hooks: [{ type: 'command', command: `${cmd} mark` }] },
+                    { matcher: 'Write|Edit', hooks: [{ type: 'command', command: `${cmd} validate` }] },
+                ],
+            },
+        };
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Install the everystack governance hooks for ${projectPath ? 'the project at ' + projectPath : 'this project'}.`,
+                            '',
+                            '## Why',
+                            '',
+                            'The everystack MCP server provides knowledge, but ENFORCEMENT (the grounding gate and',
+                            'cheat gates) runs only when these Claude Code hooks are installed. Without them, nothing',
+                            'catches off-script work (hand-written migrations, data bundled into the app, secrets behind',
+                            'EXPO_PUBLIC_*).',
+                            '',
+                            '## Procedure (confirm-first — never silent)',
+                            '',
+                            '1. Read `docs/governance-setup.md` and `hooks.example.json` from the @everystack/mcp package.',
+                            `2. Check whether ${projectPath ? projectPath + '/.claude/settings.json' : '.claude/settings.json'} already has these hooks (commands calling \`${cmd} gate\`).`,
+                            '3. If absent, show the human the exact block below and confirm the command form before writing:',
+                            '   - **Workspace (this monorepo):** `npx tsx packages/mcp/src/index.ts <sub>`',
+                            '   - **Installed package:** `everystack-mcp <sub>` (install `@everystack/mcp`; in a hook prefer',
+                            '     `pnpm exec everystack-mcp <sub>` over bare `npx`, which re-resolves on every tool call).',
+                            '4. Merge the `hooks` block into `.claude/settings.json` (preserve any existing `hooks`/`permissions`).',
+                            '5. Remind the human: hooks run a shell command on every tool call. This is a deliberate,',
+                            '   security-relevant change — it is their call, not yours to make silently.',
+                            '',
+                            '## The block to merge',
+                            '',
+                            '```json',
+                            JSON.stringify(hooks, null, 2),
+                            '```',
+                            '',
+                            '## After install',
+                            '',
+                            '- A fresh session denies every non-Read tool until the project contract (CLAUDE.md + its',
+                            '  REQUIRED-READS) is read. That is the grounding gate working.',
+                            '- `everystack-mcp report` summarizes what the agent tried (the telemetry sensor).',
+                        ].join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/index.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerPrompts(server: McpServer): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/prompts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWzE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAUvD"}

package/dist/prompts/index.js

@@ -0,0 +1,20 @@
+import { registerNewAppPrompt } from './new-app.js';
+import { registerAddFeaturePrompt } from './add-feature.js';
+import { registerDesignSchemaPrompt } from './design-schema.js';
+import { registerDeployPrompt } from './deploy.js';
+import { registerDebugPrompt } from './debug.js';
+import { registerSecurePrompt } from './secure.js';
+import { registerGovernanceSetupPrompt } from './governance-setup.js';
+import { registerClaudeMdPrompt } from './claude-md.js';
+import { registerRunbookPrompt } from './runbook.js';
+export function registerPrompts(server) {
+    registerNewAppPrompt(server);
+    registerAddFeaturePrompt(server);
+    registerDesignSchemaPrompt(server);
+    registerDeployPrompt(server);
+    registerDebugPrompt(server);
+    registerSecurePrompt(server);
+    registerGovernanceSetupPrompt(server);
+    registerClaudeMdPrompt(server);
+    registerRunbookPrompt(server);
+}

package/dist/prompts/new-app.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerNewAppPrompt(server: McpServer): void;
+//# sourceMappingURL=new-app.d.ts.map

package/dist/prompts/new-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"new-app.d.ts","sourceRoot":"","sources":["../../src/prompts/new-app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkN5D"}

package/dist/prompts/new-app.js

@@ -0,0 +1,203 @@
+import { z } from 'zod';
+export function registerNewAppPrompt(server) {
+    server.prompt('new-app', 'Scaffold a new everystack app. Describe what you want to build and Claude will recommend the right tier, check prerequisites, and walk you through setup.', {
+        description: z.string().describe('Describe what you want to build (e.g., "a recipe sharing app where people can post and save recipes")'),
+        tier: z.enum(['V1', 'V2', 'V3']).optional().describe('Target tier: V1 (static), V2 (dynamic with DB), V3 (full platform). If omitted, recommended based on description.'),
+        name: z.string().optional().describe('App name (e.g., my-app). If omitted, suggested from description.'),
+    }, async ({ description, tier, name }) => {
+        const hasTier = tier !== undefined;
+        const hasName = name !== undefined;
+        const tierPackages = {
+            V1: ['@everystack/server', '@everystack/cli', '@everystack/ui'],
+            V2: [
+                '@everystack/server', '@everystack/cli', '@everystack/ui',
+                '@everystack/api', '@everystack/auth', '@everystack/admin',
+                '@everystack/logging', '@everystack/security', '@everystack/query',
+            ],
+            V3: [
+                '@everystack/server', '@everystack/cli', '@everystack/ui',
+                '@everystack/api', '@everystack/auth', '@everystack/admin',
+                '@everystack/logging', '@everystack/security', '@everystack/query',
+                '@everystack/jobs', '@everystack/storage', '@everystack/images',
+            ],
+        };
+        // When tier is omitted, build an intake phase for Claude to work through
+        const intakeSection = !hasTier ? [
+            '## Step 1: Understand the Idea',
+            '',
+            `The user wants to build: "${description}"`,
+            '',
+            'Read the everystack://getting-started resource for how to explain things to beginners.',
+            'Listen to what they want to build. Do NOT categorize into tiers or ask them to choose.',
+            'Every app starts the same way: a running Expo app. Build the UI first, add complexity when features demand it.',
+            '',
+            '## Step 2: Choose a Name',
+            '',
+            hasName
+                ? `Use the name: "${name}"`
+                : 'Suggest a short, lowercase, hyphenated name based on the description (e.g., "recipe-share", "my-recipes"). Ask the user if they like it or want something different.',
+            '',
+            '## Step 3: Check Prerequisites',
+            '',
+            'Run the check_environment tool with phase "local".',
+            'Read everystack://getting-started for how to explain each prerequisite to a beginner.',
+            'Walk through installing missing tools ONE AT A TIME. Confirm each works before moving to the next.',
+            'Only V1 prerequisites are needed now — Node.js, git, pnpm. PostgreSQL is NOT needed yet.',
+            'AWS tools (AWS CLI, credentials, SST) are NOT needed now. The user will build and run locally first.',
+            '',
+            '## Step 4: Scaffold the Project',
+            '',
+            'Once prerequisites are ready and the user has confirmed the name, proceed with the scaffolding steps below.',
+            'The app starts as a static Expo app. Database, auth, and other features are added later when needed.',
+            'Explain each step in plain language alongside the technical commands.',
+            '',
+        ].join('\n') : '';
+        const effectiveTier = tier || 'V1';
+        const effectiveName = name || 'my-app';
+        const packages = tierPackages[effectiveTier];
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            intakeSection,
+                            hasTier
+                                ? `Create a new everystack ${effectiveTier} app called "${effectiveName}".`
+                                : '## Scaffolding Instructions',
+                            `Description: ${description}`,
+                            '',
+                            hasTier ? [
+                                '## Prerequisites',
+                                '',
+                                'Run the check_environment tool with phase "local" to verify local development prerequisites.',
+                                'If any required tools are missing, help the user install them before proceeding.',
+                                'AWS tools are not needed yet — the user will build and run locally first.',
+                            ].join('\n') : '',
+                            '',
+                            '## Instructions',
+                            '',
+                            '1. Read the everystack://core resource for architecture and conventions.',
+                            effectiveTier !== 'V1' ? '2. Read everystack://security for the security model.' : '',
+                            effectiveTier !== 'V1' ? '3. Read everystack://schema-patterns for Drizzle schema design.' : '',
+                            effectiveTier !== 'V1' ? '4. Read everystack://auth for authentication setup.' : '',
+                            '',
+                            '## Steps to Execute',
+                            '',
+                            '### 1. Project Setup',
+                            `- Create the project directory: ${effectiveName}/`,
+                            '- Initialize with: `npx create-expo-app@latest`',
+                            `- Install packages: \`pnpm add ${packages.join(' ')}\``,
+                            effectiveTier !== 'V1' ? '- Install peer deps: `pnpm add drizzle-orm && pnpm add -D drizzle-kit`' : '',
+                            '- Install SST: `pnpm add -D sst`',
+                            '',
+                            '### 2. Project Structure',
+                            '```',
+                            `${effectiveName}/`,
+                            '├── app/              # Expo Router pages',
+                            effectiveTier !== 'V1' ? '├── db/               # Schema, migrations, seed' : '',
+                            '├── server/           # Lambda handlers',
+                            effectiveTier !== 'V1' ? '│   └── api.ts        # PostgREST handler' : '',
+                            effectiveTier === 'V3' ? '│   ├── worker.ts     # SQS worker handler' : '',
+                            effectiveTier === 'V3' ? '│   └── image.ts      # Image processing handler' : '',
+                            '├── lib/              # Shared code (auth context, API client)',
+                            '├── sst.config.ts     # Infrastructure',
+                            '└── package.json',
+                            '```',
+                            '',
+                            effectiveTier !== 'V1' ? [
+                                '### 3. Database Schema',
+                                `Create db/schema.ts with tables for the ${description}.`,
+                                'Follow the patterns from everystack://schema-patterns:',
+                                '- UUID primary keys with defaultRandom()',
+                                '- created_at timestamps on all tables',
+                                '- Foreign key references with proper cascading',
+                                '- Relations for both SSR and API query embedding',
+                                '',
+                                '### 4. Migrations',
+                                '- Generate: `npx drizzle-kit generate`',
+                                '- Add RLS policies in a custom SQL migration',
+                                '- Reference the RLS templates from everystack://security',
+                                '',
+                                '### 5. Handler Configuration',
+                                'Create server/api.ts using createPluginLambdaHandler or createLambdaHandler.',
+                                'Include:',
+                                '- auth.verifyToken for JWT verification',
+                                '- pgSettings for RLS context injection',
+                                '- exposedTables to limit API surface',
+                                '- rowOwnership for user-scoped mutation control',
+                                '- softDelete for reversible deletes',
+                                '',
+                                '### 6. Auth Setup',
+                                'Read everystack://auth for the full auth flow.',
+                                '- Set up createAuthHandlers with the JWT secret',
+                                '- Create lib/auth-context.tsx with AuthProvider',
+                                '- Add signup/signin screens',
+                                '',
+                            ].join('\n') : '',
+                            '## Validation',
+                            '',
+                            'After scaffolding, run the project_validate tool to check for common mistakes.',
+                            '',
+                            '## Run Locally',
+                            '',
+                            'Read everystack://first-run for a walkthrough of what to expect.',
+                            '- Run `npx expo start` (or `pnpm dev`)',
+                            '- Press `w` to open in a browser',
+                            '- Verify the app loads and displays correctly',
+                            '- Try changing text in app/index.tsx to confirm hot reload works',
+                            '',
+                            'This is the milestone: the user sees their app running on their own computer.',
+                            'Celebrate this. Then continue building features.',
+                            '',
+                            !hasTier ? [
+                                '## Growing Your App',
+                                '',
+                                'Build the UI together first — screens, navigation, components, styling. Everything is static and visual.',
+                                '',
+                                'When a feature needs user accounts, login, or saved data:',
+                                '- Read everystack://adding-database for the step-by-step guide',
+                                '- Run check_environment("local") again — PostgreSQL will be needed',
+                                '',
+                                'When a feature needs file uploads or background processing:',
+                                '- Read everystack://storage for file uploads',
+                                '- Read everystack://jobs for background tasks',
+                                '- Read everystack://images for image processing',
+                            ].join('\n') : '',
+                            '',
+                            '## Project Documentation',
+                            'Scaffold the project contract (use the claude_md prompt): read the everystack://project-claude-md',
+                            'resource and write a CLAUDE.md to the project root. This file activates the grounding gate —',
+                            'every later session must read it before editing — so it carries the non-negotiables the cheat',
+                            'gates enforce. Keep it current as the project grows (claude_md reconciles it).',
+                            `Replace {PROJECT_NAME} with "${effectiveName}", {ONE_LINE_DESCRIPTION} with "${description}",`,
+                            'and {ANNOTATED_DIRECTORY_TREE} with the actual project structure created above.',
+                            '',
+                            '## Deployment (Later)',
+                            '',
+                            'When the user is ready to put the app on the internet:',
+                            '1. Run check_environment with phase "deploy" to verify AWS prerequisites',
+                            '2. Set up AWS credentials (read everystack://aws-setup for beginners, everystack://security for IAM profiles)',
+                            '### SST Configuration',
+                            'Create sst.config.ts with:',
+                            '- S3 bucket for static assets',
+                            '- CloudFront distribution',
+                            '- Lambda for SSR',
+                            effectiveTier !== 'V1' ? '- RDS Aurora Serverless PostgreSQL' : '',
+                            effectiveTier !== 'V1' ? '- VPC configuration' : '',
+                            effectiveTier === 'V3' ? '- SQS queue for background jobs' : '',
+                            effectiveTier === 'V3' ? '- S3 bucket for file uploads' : '',
+                            '',
+                            '### Deploy',
+                            'Read everystack://deployment for the full walkthrough.',
+                            '1. `pnpm sst deploy --stage dev`',
+                            effectiveTier !== 'V1' ? '2. `everystack db:migrate`' : '',
+                            effectiveTier !== 'V1' ? '3. `everystack db:seed` (dev only)' : '',
+                        ].filter(Boolean).join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/runbook.d.ts

@@ -0,0 +1,12 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * `runbook` — generate or refresh docs/RUNBOOK.md, the per-app operations manual.
+ *
+ * The compiler lives in the CLI (`everystack runbook` — db:generate for docs:
+ * detection → sections keyed by the app's reality → es:gen/es:slot merge). This
+ * prompt is the thin agent layer on top: run the compiler, then fill the EMPTY
+ * slots with app-specific narrative the compiler cannot know. Generated blocks
+ * belong to the compiler — the agent never writes inside them.
+ */
+export declare function registerRunbookPrompt(server: McpServer): void;
+//# sourceMappingURL=runbook.d.ts.map

package/dist/prompts/runbook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runbook.d.ts","sourceRoot":"","sources":["../../src/prompts/runbook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAgE7D"}

package/dist/prompts/runbook.js

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+/**
+ * `runbook` — generate or refresh docs/RUNBOOK.md, the per-app operations manual.
+ *
+ * The compiler lives in the CLI (`everystack runbook` — db:generate for docs:
+ * detection → sections keyed by the app's reality → es:gen/es:slot merge). This
+ * prompt is the thin agent layer on top: run the compiler, then fill the EMPTY
+ * slots with app-specific narrative the compiler cannot know. Generated blocks
+ * belong to the compiler — the agent never writes inside them.
+ */
+export function registerRunbookPrompt(server) {
+    server.prompt('runbook', 'Generate or refresh docs/RUNBOOK.md — the operations manual compiled from the app\'s detected reality (tier, Models, handlers). Runs `everystack runbook`, then fills empty slots with app narrative (confirm-first). Regenerate after the app grows or an everystack upgrade.', {
+        projectPath: z.string().optional().describe('Absolute path to the project root (where docs/RUNBOOK.md lives)'),
+    }, async ({ projectPath }) => {
+        const root = projectPath ?? '.';
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Generate or refresh docs/RUNBOOK.md for the project at ${root}.`,
+                            '',
+                            '## What this is',
+                            '',
+                            'docs/RUNBOOK.md is the per-app operations manual — how to configure, extend, deploy,',
+                            'monitor, and maintain THIS app. It is COMPILED, not authored: `everystack runbook`',
+                            'derives it from the app\'s detected reality (installed packages → tier, Models,',
+                            'handlers, crons) and regenerating after a change diffs in what\'s new. The division',
+                            'of labor: CLAUDE.md is the terse contract (rules); the runbook is procedures.',
+                            '',
+                            '## Step 1 — run the compiler',
+                            '',
+                            `- If ${root}/docs/RUNBOOK.md exists, run \`everystack runbook --diff\` first and show`,
+                            '  the human which sections would change.',
+                            '- Then run `everystack runbook` to write it. If it reports hand-edited generated',
+                            '  sections (a conflict), do NOT reach for --force — help the human move those words',
+                            '  into a slot or the Notes section first, then regenerate. --force only with their',
+                            '  explicit ok.',
+                            '',
+                            '## Step 2 — fill the EMPTY slots (and only the slots)',
+                            '',
+                            'The document has two kinds of content, mechanically marked:',
+                            '- `<!-- es:gen section=... -->` blocks belong to the compiler. NEVER write inside one —',
+                            '  your words would be overwritten on the next regeneration, and the hash check flags it.',
+                            '- `<!-- es:slot name=... -->` blocks are the human/agent seam and survive every',
+                            '  regeneration. A slot still holding its `_(Fill in: ...)_` placeholder is empty.',
+                            '',
+                            'For each empty slot, draft content from what you know of the project:',
+                            '- `overview` — what the app is, who it serves, what an operator should know first.',
+                            '- `stage-notes` — deployed URLs per stage, channel-to-stage mapping, release cadence',
+                            '  (read `.sst/outputs.json` or ask; do not guess URLs).',
+                            '- `notes` — anything project-specific that fits nowhere else. Leave it if nothing real.',
+                            '',
+                            'Show the human your draft slot content and let them approve before writing — the',
+                            'runbook is theirs; you assist, you do not own it.',
+                            '',
+                            '## Step 3 — verify',
+                            '',
+                            'Run `everystack runbook --check`: it must exit clean (slot edits never make it stale).',
+                            'Tell the human: regenerate any time with `everystack runbook`; CI can enforce currency',
+                            'with `--check`; after an everystack upgrade the diff reads as release notes for this app.',
+                        ].join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/prompts/secure.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerSecurePrompt(server: McpServer): void;
+//# sourceMappingURL=secure.d.ts.map

package/dist/prompts/secure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure.d.ts","sourceRoot":"","sources":["../../src/prompts/secure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAmO5D"}