@everystack/mcp 0.4.4 → 0.4.5

package/dist/index.cjs

@@ -21685,7 +21685,7 @@ var RESOURCES = [
   {
     uri: "everystack://logging",
     name: "Logging & Analytics",
-    description: "Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration.",
+    description: "Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration. Includes how to debug a 500 from its requestId, since error responses never carry the error text.",
     filename: "logging.md"
   },
   {
@@ -23735,7 +23735,7 @@ async function runGovernanceCli(argv) {
 }
 
 // src/index.ts
-var version2 = (true ? "0.4.4" : null) ?? "0.3.0-dev";
+var version2 = (true ? "0.4.5" : null) ?? "0.3.0-dev";
 var INSTRUCTIONS = [
   "You govern how any agent builds everystack \u2014 a self-hosted application stack for Expo apps on AWS.",
   "Your job is not only to advise but to keep the build on-script: the architecture the maintainer",

package/dist/logging.md

@@ -76,6 +76,30 @@ everystack logs:query --stage dev --level error --source api
 everystack logs:tail --stage dev            # Raw CloudWatch output
 ```
 
+## Debugging a 500
+
+An error response carries the id that finds the error, never the error itself:
+
+```json
+{ "error": "Internal Server Error", "requestId": "kBQF3n8s…" }
+```
+
+Same id as the `x-request-id` header, and the handler logs the full error against it before
+responding. Resolve it with:
+
+```bash
+everystack logs:query --stage production --traceId kBQF3n8s…
+```
+
+It is the CloudFront edge request id, so it also joins to the CDN access logs
+(`x-edge-request-id`). Locally the same log line goes to stdout — no lookup needed.
+
+**Never add error text to a response to make debugging easier.** Relation and column names handed
+to an unauthenticated caller are schema disclosure. In particular do not gate it on
+`ENVIRONMENT === 'dev'`: `ENVIRONMENT` is set from `$app.stage`, so that gate asks what someone
+named their stage, not whether the caller is trusted. A test in `@everystack/server` fails the
+build if such a gate is reintroduced. The request id is the debugging path.
+
 ## Plugin
 
 ```typescript

package/dist/security.md

@@ -212,6 +212,20 @@ Effect: PATCH and DELETE auto-append `WHERE authorId = user.sub`. Returns 404 if
 
 Use both. rowOwnership catches IDOR at HTTP level with clear 404. RLS catches it at SQL level as a safety net.
 
+## Error responses never carry internals
+
+A `500` returns `{ "error": "Internal Server Error", "requestId": "…" }` and nothing else. A
+database error stringifies to `relation "games" does not exist` — schema disclosure to whoever
+made the request.
+
+**Never gate disclosure on the stage name.** `ENVIRONMENT` comes from `$app.stage`, so
+`ENVIRONMENT === 'dev'` asks what someone named their stage, not whether the caller is trusted.
+A publicly reachable stage named `dev` is a public stage. A test in `@everystack/server` fails the
+build if such a gate appears in `src/`.
+
+Debug from the id instead: `everystack logs:query --traceId <requestId>`. The full error is
+already logged against it.
+
 ## Testing Checklist
 
 Before deploying RLS:
@@ -247,6 +261,7 @@ RESET ROLE;
 - [ ] Write RLS policies per table x role
 - [ ] Connect as `authenticator` (never use RDS master/superuser in production)
 - [ ] Test: SET ROLE authenticated; SELECT returns only expected rows
+- [ ] Test: a 500 returns only `error` and `requestId` — no relation or column names
 
 ### Handler
 - [ ] `exposedTables` whitelist (404 for unlisted tables)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/mcp",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Governance layer that governs how any agent builds everystack — grounding, cheat gates, and Model-aware tooling over MCP",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -40,9 +40,9 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "zod": "3.25.67",
-    "@everystack/model": "0.4.8",
-    "@everystack/cli": "0.4.43",
-    "@everystack/server": "0.4.15"
+    "@everystack/cli": "0.4.48",
+    "@everystack/server": "0.4.18",
+    "@everystack/model": "0.4.12"
   },
   "scripts": {
     "test": "jest",

package/src/resources/index.ts

@@ -179,7 +179,7 @@ const RESOURCES: ResourceDef[] = [
     uri: 'everystack://logging',
     name: 'Logging & Analytics',
     description:
-      'Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration.',
+      'Structured logging: log levels, crash reports, analytics events, S3 log storage, CloudWatch ingestion trigger, client SDK, admin dashboard integration. Includes how to debug a 500 from its requestId, since error responses never carry the error text.',
     filename: 'logging.md',
   },
   {

package/src/resources/logging.md

@@ -76,6 +76,30 @@ everystack logs:query --stage dev --level error --source api
 everystack logs:tail --stage dev            # Raw CloudWatch output
 ```
 
+## Debugging a 500
+
+An error response carries the id that finds the error, never the error itself:
+
+```json
+{ "error": "Internal Server Error", "requestId": "kBQF3n8s…" }
+```
+
+Same id as the `x-request-id` header, and the handler logs the full error against it before
+responding. Resolve it with:
+
+```bash
+everystack logs:query --stage production --traceId kBQF3n8s…
+```
+
+It is the CloudFront edge request id, so it also joins to the CDN access logs
+(`x-edge-request-id`). Locally the same log line goes to stdout — no lookup needed.
+
+**Never add error text to a response to make debugging easier.** Relation and column names handed
+to an unauthenticated caller are schema disclosure. In particular do not gate it on
+`ENVIRONMENT === 'dev'`: `ENVIRONMENT` is set from `$app.stage`, so that gate asks what someone
+named their stage, not whether the caller is trusted. A test in `@everystack/server` fails the
+build if such a gate is reintroduced. The request id is the debugging path.
+
 ## Plugin
 
 ```typescript

package/src/resources/security.md

@@ -212,6 +212,20 @@ Effect: PATCH and DELETE auto-append `WHERE authorId = user.sub`. Returns 404 if
 
 Use both. rowOwnership catches IDOR at HTTP level with clear 404. RLS catches it at SQL level as a safety net.
 
+## Error responses never carry internals
+
+A `500` returns `{ "error": "Internal Server Error", "requestId": "…" }` and nothing else. A
+database error stringifies to `relation "games" does not exist` — schema disclosure to whoever
+made the request.
+
+**Never gate disclosure on the stage name.** `ENVIRONMENT` comes from `$app.stage`, so
+`ENVIRONMENT === 'dev'` asks what someone named their stage, not whether the caller is trusted.
+A publicly reachable stage named `dev` is a public stage. A test in `@everystack/server` fails the
+build if such a gate appears in `src/`.
+
+Debug from the id instead: `everystack logs:query --traceId <requestId>`. The full error is
+already logged against it.
+
 ## Testing Checklist
 
 Before deploying RLS:
@@ -247,6 +261,7 @@ RESET ROLE;
 - [ ] Write RLS policies per table x role
 - [ ] Connect as `authenticator` (never use RDS master/superuser in production)
 - [ ] Test: SET ROLE authenticated; SELECT returns only expected rows
+- [ ] Test: a 500 returns only `error` and `requestId` — no relation or column names
 
 ### Handler
 - [ ] `exposedTables` whitelist (404 for unlisted tables)