@jaypie/mcp 0.7.35 → 0.7.37

package/dist/suites/docs/index.js

@@ -9,7 +9,7 @@ import { gt } from 'semver';
 /**
  * Docs Suite - Documentation services (skill, version, release_notes)
  */
-const BUILD_VERSION_STRING = "@jaypie/mcp@0.7.35#689b7398"
+const BUILD_VERSION_STRING = "@jaypie/mcp@0.7.37#b65e6395"
     ;
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = path.dirname(__filename$1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.7.35",
+  "version": "0.7.37",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.32.md

@@ -0,0 +1,11 @@
+---
+version: 1.2.32
+date: 2026-03-13
+summary: Add removalPolicy option to JaypieEnvSecret
+---
+
+## Changes
+
+- Added `removalPolicy` prop to `JaypieEnvSecret`
+  - Accepts `boolean` (`true` = RETAIN, `false` = DESTROY) or CDK `RemovalPolicy` enum
+  - Simplifies production retention: `removalPolicy: isProductionEnv()`

package/release-notes/jaypie/1.2.20.md

@@ -0,0 +1,9 @@
+---
+version: 1.2.20
+date: 2026-03-13
+summary: Bump for @jaypie/kit 1.2.4 (seed-based key generation)
+---
+
+## Changes
+
+- Updated `@jaypie/kit` to 1.2.4 — `generateJaypieKey` now supports `seed` for deterministic key derivation

package/release-notes/jaypie/1.2.21.md

@@ -0,0 +1,15 @@
+---
+version: 1.2.21
+date: 2026-03-13
+summary: Update internal dependency versions to latest published subpackages
+---
+
+## Changes
+
+- Updated dependency version ranges to match latest published subpackages:
+  - `@jaypie/aws` ^1.2.4 → ^1.2.5
+  - `@jaypie/express` ^1.2.11 → ^1.2.15
+  - `@jaypie/kit` ^1.2.1 → ^1.2.4
+  - `@jaypie/lambda` ^1.2.3 → ^1.2.4
+  - `@jaypie/logger` ^1.2.1 → ^1.2.5
+- Ensures consumers get latest subpackage features (e.g., `generateJaypieKey` seed support)

package/release-notes/kit/1.2.4.md

@@ -0,0 +1,12 @@
+---
+version: 1.2.4
+date: 2026-03-13
+summary: Add seed parameter to generateJaypieKey for deterministic key derivation
+---
+
+## Changes
+
+- Added `seed` option to `generateJaypieKey` for deterministic key derivation via HMAC-SHA256
+  - Uses the `issuer` (defaulting to `"jaypie"`) as the HMAC message
+  - Same seed + same issuer always produces the same key
+  - Useful for bootstrapping owner keys from a shared secret

package/release-notes/mcp/0.7.36.md

@@ -0,0 +1,11 @@
+---
+version: 0.7.36
+date: 2026-03-13
+summary: Update apikey skill with seed and removalPolicy documentation
+---
+
+## Changes
+
+- Updated `~apikey` skill with seed-based key generation documentation
+- Added `PROJECT_ADMIN_SEED` infrastructure example alongside `PROJECT_SALT`
+- Documented `removalPolicy` boolean shorthand for `JaypieEnvSecret`

package/release-notes/mcp/0.7.37.md

@@ -0,0 +1,10 @@
+---
+version: 0.7.37
+date: 2026-03-13
+summary: Add critical reminder to prepare skill about updating jaypie dependency versions
+---
+
+## Changes
+
+- Updated prepare skill to emphasize updating `packages/jaypie/package.json` dependency versions when bumping subpackages
+- Added release notes for jaypie 1.2.21

package/skills/apikey.md

@@ -41,6 +41,25 @@ generateJaypieKey({ prefix: "", issuer: "jaypie" });
 // "jaypie_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6_Xq7R"
 ```
 
+### With Seed
+
+Pass `seed` to derive a deterministic key from a secret. Uses HMAC-SHA256 with the `issuer` (defaulting to `"jaypie"`) as the HMAC message:
+
+```typescript
+const key = generateJaypieKey({ seed: process.env.PROJECT_ADMIN_SEED, issuer: "jaypie" });
+// Same seed + same issuer = same key every time
+```
+
+Different issuers produce different keys from the same seed:
+
+```typescript
+generateJaypieKey({ seed: "my-seed", issuer: "alpha" });
+generateJaypieKey({ seed: "my-seed", issuer: "beta" });
+// Two different keys
+```
+
+This is useful for bootstrapping an initial owner key from a shared secret without requiring database access.
+
 ### Options
 
 | Option | Default | Description |
@@ -50,6 +69,7 @@ generateJaypieKey({ prefix: "", issuer: "jaypie" });
 | `length` | `32` | Random body length |
 | `pool` | base62 (`0-9A-Za-z`) | Character pool for body |
 | `prefix` | `"sk"` | Key prefix (`""` to omit) |
+| `seed` | (none) | Derive key deterministically via HMAC-SHA256 |
 | `separator` | `"_"` | Delimiter between segments |
 
 All options are optional. Zero-param call produces `sk_<32 base62>_<4 checksum>`.
@@ -161,10 +181,13 @@ import { generateJaypieKey, hashJaypieKey, validateJaypieKey } from "@jaypie/tes
 
 ## Infrastructure
 
-Use with the generated secrets pattern for `PROJECT_SALT`:
+Use with the generated secrets pattern for `PROJECT_SALT` and `PROJECT_ADMIN_SEED`:
 
 ```typescript
-// CDK
+import { isProductionEnv } from "@jaypie/kit";
+
+// PROJECT_SALT — used by hashJaypieKey to HMAC hash keys for storage.
+// If this value is lost, all stored key hashes become unverifiable.
 new JaypieEnvSecret(this, "ProjectSalt", {
   envKey: "PROJECT_SALT",
   generateSecretString: {
@@ -172,6 +195,18 @@ new JaypieEnvSecret(this, "ProjectSalt", {
     includeSpace: false,
     passwordLength: 64,
   },
+  // Preserve this value if production stack is deleted
+  removalPolicy: isProductionEnv(),
+});
+
+// PROJECT_ADMIN_SEED — used by generateJaypieKey({ seed }) to derive the bootstrap owner key.
+new JaypieEnvSecret(this, "ProjectAdminSeed", {
+  envKey: "PROJECT_ADMIN_SEED",
+  generateSecretString: {
+    excludePunctuation: true,
+    includeSpace: false,
+    passwordLength: 64,
+  },
 });
 ```