@everystack/mcp 0.3.2 → 0.4.0

package/dist/prompts/secure.js

@@ -0,0 +1,219 @@
+import { z } from 'zod';
+export function registerSecurePrompt(server) {
+    server.prompt('secure', 'Set up security for an everystack project: AWS IAM profiles, JWT auth, RLS policies, and edge verification.', {
+        features: z.string().optional().describe('Comma-separated security features to set up (e.g., "aws,rls,auth"). Defaults to all.'),
+        projectPath: z.string().optional().describe('Absolute path to project root'),
+    }, async ({ features, projectPath }) => {
+        const allFeatures = ['aws', 'rls', 'auth', 'edge'];
+        const requested = features
+            ? features.split(',').map((f) => f.trim().toLowerCase())
+            : allFeatures;
+        return {
+            messages: [
+                {
+                    role: 'user',
+                    content: {
+                        type: 'text',
+                        text: [
+                            `Set up security for ${projectPath ? 'the project at ' + projectPath : 'my everystack project'}.`,
+                            `Features: ${requested.join(', ')}`,
+                            '',
+                            '## Instructions',
+                            '',
+                            '1. Read everystack://security for the complete security model.',
+                            '2. Read everystack://auth for JWT authentication details.',
+                            projectPath ? `3. Run project_validate with projectPath="${projectPath}" to find existing security gaps.` : '',
+                            projectPath ? `4. Run schema_analyze with projectPath="${projectPath}" to check schema security.` : '',
+                            '',
+                            requested.includes('aws') ? [
+                                '## AWS IAM Profiles',
+                                '',
+                                'Set up three named AWS profiles with least-privilege permissions:',
+                                '',
+                                '### 1. everystack-create (Infrastructure Creation)',
+                                '',
+                                '**When:** First deploy only. Disable after infrastructure exists.',
+                                '',
+                                '```ini',
+                                '# ~/.aws/credentials',
+                                '[everystack-create]',
+                                'aws_access_key_id = ...',
+                                'aws_secret_access_key = ...',
+                                '```',
+                                '',
+                                'Permissions needed:',
+                                '- CloudFormation (create stacks)',
+                                '- S3 (create buckets)',
+                                '- CloudFront (create distributions)',
+                                '- Lambda (create functions)',
+                                '- RDS (create clusters)',
+                                '- IAM (create roles — scoped to everystack-* prefix)',
+                                '- VPC (create VPC, subnets, security groups)',
+                                '- SQS (create queues)',
+                                '',
+                                '**After first deploy:** Delete or deactivate these access keys.',
+                                '',
+                                '### 2. everystack-manage (Day-to-Day CLI)',
+                                '',
+                                '**When:** Development, running CLI commands, migrations.',
+                                '',
+                                'Permissions needed:',
+                                '- Lambda:InvokeFunction (for CLI → Lambda operations)',
+                                '- S3:PutObject/GetObject (for OTA updates)',
+                                '- CloudWatch:GetLogEvents (for log tailing)',
+                                '- SSM:GetParameter (for secret access)',
+                                '',
+                                '**Cannot:** Create or delete infrastructure, modify IAM, access RDS directly.',
+                                '',
+                                '### 3. everystack-deploy (CI/CD)',
+                                '',
+                                '**When:** Automated deployments from CI/CD pipelines.',
+                                '',
+                                'Permissions needed:',
+                                '- CloudFormation:UpdateStack (update existing, not create new)',
+                                '- Lambda:UpdateFunctionCode',
+                                '- S3:PutObject (deploy assets)',
+                                '- CloudFront:CreateInvalidation',
+                                '',
+                                '**Cannot:** Create new infrastructure, modify IAM, access secrets.',
+                                '',
+                            ].join('\n') : '',
+                            requested.includes('auth') ? [
+                                '## JWT Authentication',
+                                '',
+                                'Read everystack://auth for full details.',
+                                '',
+                                '### Setup',
+                                '',
+                                '1. Generate a strong JWT secret:',
+                                '```bash',
+                                'pnpm sst secret set JwtSecret "$(openssl rand -base64 32)" --stage dev',
+                                '```',
+                                '',
+                                '2. Create auth handlers:',
+                                '```typescript',
+                                "import { createAuthHandlers } from '@everystack/auth';",
+                                '',
+                                'const auth = createAuthHandlers(db, schema, jwtSecret, {',
+                                "  mode: 'postgres',",
+                                '  sql,',
+                                '  cookies: { allowedOrigins: ["https://your-web-origin"] }, // HttpOnly cookies for web — Origin allowlist required (fail-closed)',
+                                '});',
+                                '```',
+                                '',
+                                '3. Wire into Lambda handler with auth routes.',
+                                '',
+                                '4. Create AuthProvider in lib/auth-context.tsx.',
+                                '',
+                                '### Token Lifecycle',
+                                '',
+                                '- Access tokens: short-lived (15 min default)',
+                                '- Refresh tokens: long-lived (7 days default)',
+                                '- Auto-refresh on 401 via client interceptor',
+                                '',
+                            ].join('\n') : '',
+                            requested.includes('rls') ? [
+                                '## Row-Level Security (RLS)',
+                                '',
+                                'Read everystack://security for the mental model and templates.',
+                                '',
+                                '### How RLS Works in everystack',
+                                '',
+                                '1. Client sends JWT in Authorization header',
+                                '2. Handler verifies JWT, extracts claims',
+                                '3. `pgSettings` sets PostgreSQL session variables:',
+                                '   - `SET LOCAL ROLE authenticated`',
+                                '   - `set_config(\'request.jwt.claims\', \'{"sub":"...","role":"..."}\', true)`',
+                                '4. Query runs inside a transaction with those settings',
+                                '5. RLS policies read the claims and filter rows',
+                                '',
+                                '### Step-by-Step',
+                                '',
+                                '1. **Create roles** (one-time migration):',
+                                '```sql',
+                                'CREATE ROLE anon NOLOGIN;',
+                                'CREATE ROLE authenticated NOLOGIN;',
+                                'CREATE ROLE admin NOLOGIN;',
+                                'GRANT anon, authenticated, admin TO authenticator;',
+                                '```',
+                                '',
+                                '2. **Enable RLS on every table:**',
+                                '```sql',
+                                'ALTER TABLE table_name ENABLE ROW LEVEL SECURITY;',
+                                '```',
+                                '',
+                                '3. **Grant minimum permissions:**',
+                                '```sql',
+                                'GRANT SELECT ON table_name TO anon;',
+                                'GRANT SELECT, INSERT, UPDATE, DELETE ON table_name TO authenticated;',
+                                'GRANT ALL ON table_name TO admin;',
+                                '```',
+                                '',
+                                '4. **Create policies per access pattern:**',
+                                '',
+                                '**Public read (soft-delete aware):**',
+                                '```sql',
+                                "CREATE POLICY \"anon_select\" ON table_name FOR SELECT TO anon",
+                                '  USING (deleted_at IS NULL);',
+                                '```',
+                                '',
+                                '**Own rows only:**',
+                                '```sql',
+                                "CREATE POLICY \"own_rows_select\" ON table_name FOR SELECT TO authenticated",
+                                "  USING (user_id = (current_setting('request.jwt.claims', true)::json->>'sub')::uuid);",
+                                '```',
+                                '',
+                                '**Admin full access:**',
+                                '```sql',
+                                "CREATE POLICY \"admin_all\" ON table_name FOR ALL TO admin USING (true);",
+                                '```',
+                                '',
+                                '5. **Configure pgSettings in handler:**',
+                                '```typescript',
+                                'pgSettings: (user) => ({',
+                                "  role: user?.role === 'admin' ? 'admin' : user ? 'authenticated' : 'anon',",
+                                "  'request.jwt.claims': JSON.stringify(user || { role: 'anon' }),",
+                                '}),',
+                                '```',
+                                '',
+                                '### Testing RLS',
+                                '',
+                                '```sql',
+                                '-- Test as authenticated user',
+                                'BEGIN;',
+                                'SET LOCAL ROLE authenticated;',
+                                "SELECT set_config('request.jwt.claims',",
+                                "  '{\"sub\": \"user-uuid\", \"role\": \"authenticated\"}', true);",
+                                'SELECT * FROM posts; -- should only return own posts',
+                                'ROLLBACK;',
+                                '```',
+                                '',
+                            ].join('\n') : '',
+                            requested.includes('edge') ? [
+                                '## Edge JWT Verification',
+                                '',
+                                'Verify JWTs at the CDN edge before requests reach Lambda:',
+                                '',
+                                '- CloudFront function validates JWT signature (HS256)',
+                                '- Rejects expired or malformed tokens at the edge',
+                                '- Reduces Lambda invocations for unauthorized requests',
+                                '- See everystack://deployment for CloudFront function setup',
+                                '',
+                            ].join('\n') : '',
+                            '## Verification',
+                            '',
+                            'After setup, verify security:',
+                            '',
+                            '1. Run project_validate to check for gaps',
+                            '2. Test unauthenticated access returns 401',
+                            '3. Test cross-user data isolation with RLS',
+                            '4. Verify JWT claims propagate through pgSettings',
+                            '5. Check `.env` files are not committed',
+                            '6. Confirm `everystack-create` profile is disabled',
+                        ].filter(Boolean).join('\n'),
+                    },
+                },
+            ],
+        };
+    });
+}

package/dist/resources/index.d.ts

@@ -0,0 +1,12 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+declare function loadResource(filename: string): string;
+interface ResourceDef {
+    uri: string;
+    name: string;
+    description: string;
+    filename: string;
+}
+declare const RESOURCES: ResourceDef[];
+export declare function registerResources(server: McpServer): void;
+export { RESOURCES, loadResource };
+//# sourceMappingURL=index.d.ts.map

package/dist/resources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAmBzE,iBAAS,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,QAAA,MAAM,SAAS,EAAE,WAAW,EAoL3B,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAOzD;AAED,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC"}

package/dist/resources/index.js

@@ -0,0 +1,182 @@
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+// Resolve the directory containing resource files.
+// tsx (our runtime) polyfills __dirname in ESM. ts-jest uses CJS where __dirname is native.
+// We use a dynamic eval to avoid import.meta.url appearing in CJS output (which would throw).
+function getResourcesDir() {
+    // In CJS (ts-jest), __dirname is a global
+    try {
+        return globalThis.__dirname
+            || eval('__dirname');
+    }
+    catch {
+        // In pure ESM, fall back to import.meta.url
+        const { fileURLToPath } = require('node:url');
+        return dirname(fileURLToPath(eval('import.meta.url')));
+    }
+}
+const RESOURCES_DIR = getResourcesDir();
+function loadResource(filename) {
+    return readFileSync(join(RESOURCES_DIR, filename), 'utf-8');
+}
+const RESOURCES = [
+    // Beginner — plain English intro, read first for new users
+    {
+        uri: 'everystack://getting-started',
+        name: 'Getting Started (Beginners)',
+        description: 'Plain English intro for complete beginners. What everystack is, what the tiers mean, what each prerequisite is and why. Read this FIRST for users with no programming experience or no existing project.',
+        filename: 'getting-started.md',
+    },
+    // Beginner — AWS account and credential setup
+    {
+        uri: 'everystack://aws-setup',
+        name: 'AWS Setup (Beginners)',
+        description: 'Step-by-step AWS account creation and IAM credential setup for beginners. Read when check_environment reports missing AWS credentials.',
+        filename: 'aws-setup.md',
+    },
+    // Beginner — first local run walkthrough
+    {
+        uri: 'everystack://first-run',
+        name: 'First Run (Beginners)',
+        description: 'What happens when you run your app locally for the first time. Explains Metro bundler, hot reload, opening in browser or phone, and common first-run errors. Read after scaffolding a new project.',
+        filename: 'first-run.md',
+    },
+    // Beginner — V2 transition guide (adding database to existing app)
+    {
+        uri: 'everystack://adding-database',
+        name: 'Adding a Database (V2 Transition)',
+        description: 'Guide for adding PostgreSQL, API handler, and authentication to an existing Expo app. Read this when a feature needs data persistence or user accounts. Covers PostgreSQL setup, V2 package installation, schema creation, handler config, auth flow, migrations, and RLS security.',
+        filename: 'adding-database.md',
+    },
+    // Core — read these first (for developers)
+    {
+        uri: 'everystack://core',
+        name: 'everystack Core Architecture',
+        description: 'Architecture, package map, V1-V2-V3 tiers, key patterns, project conventions, handler overview, CLI commands. Read this first.',
+        filename: 'core.md',
+    },
+    {
+        uri: 'everystack://security',
+        name: 'everystack Security',
+        description: 'Three-layer security model (Edge/API/Database), AWS IAM profiles (Create/Manage/Deploy), RLS guide with copy-paste policies, deployment checklist. Read before any auth or deployment guidance.',
+        filename: 'security.md',
+    },
+    // Detail — load on demand
+    {
+        uri: 'everystack://handler-options',
+        name: 'Handler Options Reference',
+        description: 'Complete createHandler() options: auth, relations, rpc, hooks, pgSettings, softDelete, naming, exposedTables, hiddenColumns, protectedFields, rowOwnership, cache.',
+        filename: 'handler-options.md',
+    },
+    {
+        uri: 'everystack://query-protocol',
+        name: 'Query Protocol',
+        description: 'PostgREST query protocol: filters (eq, neq, gt, lt, like, ilike, is, in), negation, logical groups (or, and), column selection, relation embedding, ordering, pagination, aggregates, JSON path filtering.',
+        filename: 'query-protocol.md',
+    },
+    {
+        uri: 'everystack://client-api',
+        name: 'Client API',
+        description: 'Typed client: createClient(), query builder (.from, .eq, .select, .order, .limit), mutations (.insert, .update, .delete), token refresh, error handling.',
+        filename: 'client-api.md',
+    },
+    {
+        uri: 'everystack://auth',
+        name: 'Authentication',
+        description: 'JWT auth: createAuthHandlers(), signup/signin/refresh flows, HS256 edge verification, OAuth, password hashing, token lifecycle, AuthProvider React context.',
+        filename: 'auth.md',
+    },
+    {
+        uri: 'everystack://schema-patterns',
+        name: 'Schema Design Patterns',
+        description: 'Drizzle schema design: pgTable, column types, relations, indexes, timestamps, soft delete, UUID vs serial, migration workflow, drizzle-kit commands.',
+        filename: 'schema-patterns.md',
+    },
+    {
+        uri: 'everystack://deployment',
+        name: 'Deployment Guide',
+        description: 'SST deployment: sst.config.ts setup, secrets, stages (dev/production), CloudFront, Lambda configuration, VPC, RDS Aurora Serverless, resource linking.',
+        filename: 'deployment.md',
+    },
+    {
+        uri: 'everystack://admin',
+        name: 'Admin Dashboard',
+        description: 'Declarative admin: AdminRoot, AdminLayout, resource config, field types, EverystackAdapter, presets, custom widgets, navigation.',
+        filename: 'admin.md',
+    },
+    {
+        uri: 'everystack://jobs',
+        name: 'Background Jobs',
+        description: 'SQS background workers: createWorkerHandler, publishJob, job types, dead letter queue, cron scheduling, Postgres materialization adapter.',
+        filename: 'jobs.md',
+    },
+    {
+        uri: 'everystack://storage',
+        name: 'File Storage',
+        description: 'S3 file storage: createStorageHandler, presigned uploads, MIME validation, CDN delivery, ownership enforcement, client upload flow.',
+        filename: 'storage.md',
+    },
+    {
+        uri: 'everystack://logging',
+        name: 'Logging & Analytics',
+        description: 'Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration.',
+        filename: 'logging.md',
+    },
+    {
+        uri: 'everystack://security-device',
+        name: 'Device Security',
+        description: 'Device attestation: Apple App Attest, Google Play Integrity, RS256 device keys, biometric auth, certificate pinning.',
+        filename: 'security-device.md',
+    },
+    {
+        uri: 'everystack://testing',
+        name: 'Testing Patterns',
+        description: 'Testing conventions: Jest setup, TDD workflow, test file structure, mocking patterns (ESM, sharp, AWS SDK), template database isolation, integration tests.',
+        filename: 'testing.md',
+    },
+    {
+        uri: 'everystack://plugins',
+        name: 'Plugin Architecture',
+        description: 'Plugin system: createPluginLambdaHandler, Plugin type, PluginContext, composing handlers from multiple packages, plugin registration order.',
+        filename: 'plugins.md',
+    },
+    {
+        uri: 'everystack://ssr',
+        name: 'Server-Side Rendering',
+        description: 'SSR: getWebHandler, direct Drizzle queries in loaders, JSON-LD structured data, OG meta tags, cache headers, hydration debugging.',
+        filename: 'ssr.md',
+    },
+    {
+        uri: 'everystack://images',
+        name: 'Image Processing',
+        description: 'Sharp image processing: createImageHandler, on-demand resizing, format conversion, EXIF extraction, variant generation, CDN delivery.',
+        filename: 'images.md',
+    },
+    {
+        uri: 'everystack://events',
+        name: 'Events & WebSocket',
+        description: 'Real-time events: PostgreSQL LISTEN/NOTIFY, WebSocket fan-out, Lambda event bridge, client useSignal hook, table change notifications.',
+        filename: 'events.md',
+    },
+    {
+        uri: 'everystack://cli',
+        name: 'CLI Reference',
+        description: 'Full CLI command reference: update, db:migrate, db:seed, db:psql, console, logs:errors, logs:tail, logs:query, cache:purge, certs, channels, diag, analyze:ssr.',
+        filename: 'cli.md',
+    },
+    {
+        uri: 'everystack://project-claude-md',
+        name: 'Project CLAUDE.md Template',
+        description: 'Template for a project-level CLAUDE.md file. Read this and adapt it when scaffolding a new everystack app. Replace placeholders ({PROJECT_NAME}, {ONE_LINE_DESCRIPTION}, {ANNOTATED_DIRECTORY_TREE}) with actual project details.',
+        filename: 'project-claude-md.md',
+    },
+];
+export function registerResources(server) {
+    for (const r of RESOURCES) {
+        const content = loadResource(r.filename);
+        server.resource(r.name, r.uri, { mimeType: 'text/markdown' }, async () => ({
+            contents: [{ uri: r.uri, mimeType: 'text/markdown', text: content }],
+        }));
+    }
+}
+export { RESOURCES, loadResource };