@jaypie/mcp 0.8.159 → 0.8.160

package/dist/assets.js

@@ -55,11 +55,11 @@ function getMcpAssetPaths() {
  */
 function getMcpBuildInfo() {
     return {
-        commit: "4e7a07fe"
+        commit: "b6d2f24e"
             ,
-        version: "0.8.159"
+        version: "0.8.160"
             ,
-        versionString: "@jaypie/mcp@0.8.159#4e7a07fe"
+        versionString: "@jaypie/mcp@0.8.160#b6d2f24e"
             ,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.159",
+  "version": "0.8.160",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.88.md

@@ -0,0 +1,67 @@
+---
+version: 1.2.88
+date: 2026-09-15
+summary: Datadog forwarder invoke permissions, hardened log buckets, origin access control, WAF header redaction, and JaypieMigration log props
+---
+
+## Changes
+
+- **Datadog forwarder invoke permissions.** `resolveDatadogForwarderFunction`
+  and `JaypieDatadogForwarder` import the forwarder with
+  `fromFunctionAttributes({ sameEnvironment: true })`. `fromFunctionArn` on a
+  token ARN yields an unresolved environment, so `addPermission()` was a silent
+  no-op and every trigger deployed without invoke permission (#560).
+  `JaypieDatadogForwarder` acknowledges
+  `@aws-cdk/aws-events:ruleUnresolvedEnvironment` on its own events rule.
+- **Hardened default log buckets.** The CloudFront access log bucket and WAF log
+  bucket that `JaypieDistribution` and `JaypieWebDeploymentBucket` create now
+  block all public access, enforce SSL, are versioned, use SSE-S3, expire
+  objects after `logRetention` (365 days by default, new prop), and carry
+  `RemovalPolicy.RETAIN` with no auto-delete. The WAF bucket policy declares the
+  `delivery.logs.amazonaws.com` statements so CloudFormation owns it (#561).
+- **`JaypieDistribution` origin access control.** `originAccessControl: true`
+  creates an `AWS_IAM` Function URL, uses
+  `FunctionUrlOrigin.withOriginAccessControl`, and adds the
+  `lambda:InvokeFunction` permission Lambda requires alongside
+  `lambda:InvokeFunctionUrl`. Opt-in; the default stays `authType: NONE` (#562).
+- **`JaypieWebDeploymentBucket` origin access control.**
+  `originAccessControl: true` serves a private bucket through the S3 REST
+  endpoint with OAC, `BLOCK_ALL`, `enforceSSL`, no website configuration, and
+  `defaultRootObject: "index.html"`. Opt-in; the default stays the public S3
+  website bucket (#563).
+- **WAF log redaction.** `authorization`, `cookie`, `x-amz-content-sha256`, and
+  `x-api-key` are always redacted from WAF logs. The `waf` config accepts
+  `redactedHeaders`, which merges with that default rather than replacing it,
+  and a `redactedFields` passthrough for query strings, URI paths, and JSON body
+  fields (#564).
+- **`waf.logRetention`** overrides the construct's `logRetention` for the WAF
+  log bucket alone.
+- **`JaypieDistribution` warns** (`@jaypie/constructs:originAccessControlIgnored`)
+  when `originAccessControl` is set with a handler that supplies its own
+  Function URL or origin, where the prop has no effect.
+- **`JaypieMigration` rejects `reservedConcurrentExecutions: 0`** with a
+  `ConfigurationError`. The migration Lambda is both `onEventHandler` and
+  `isCompleteHandler`, so a reservation of 0 means it is never invoked.
+- **`JaypieDatadogForwarder` throws `ConfigurationError`** rather than a vanilla
+  `Error` when the Datadog API key is missing.
+- **`JaypieMigration` log props.** `logGroup`, `logRetention`, and
+  `reservedConcurrentExecutions` forward to the wrapped `JaypieLambda` (#565).
+
+## Upgrade
+
+- **Log buckets survive stack deletion.** The CloudFront log bucket moves from
+  `DESTROY` with auto-delete to `RETAIN`. Deleting a stack now leaves the bucket
+  and its objects behind as a billable resource to remove by hand.
+- **Retention rises from 90 to 365 days** on the construct-created log buckets,
+  roughly quadrupling retained volume. Pass `logRetention: 90` to keep the old
+  value. Versioning is a one-way door on an existing bucket.
+- **The WAF log bucket gains a CloudFormation-owned bucket policy.** Any
+  statement added to that bucket out of band is discarded on the next deploy.
+- **Existing WAF logging configurations gain `RedactedFields`** on the next
+  deploy. The four default headers are always redacted; there is no opt-out.
+- **Datadog forwarder triggers gain `AWS::Lambda::Permission` resources** on the
+  next deploy, and S3 notification configurations that previously failed
+  validation now apply.
+- `originAccessControl` is opt-in on both constructs; no existing deployment
+  changes without setting it. With it enabled on `JaypieDistribution`, clients
+  must send the body SHA-256 in `x-amz-content-sha256` on POST and PUT.

package/release-notes/mcp/0.8.160.md

@@ -0,0 +1,19 @@
+---
+version: 0.8.160
+date: 2026-09-15
+summary: Document forwarder invoke permissions, hardened log buckets, origin access control, WAF redaction, and JaypieMigration log props
+---
+
+## Changes
+
+- **`skill("JaypieDatadogForwarder")`** gains an "Invoke Permissions" section
+  covering token-ARN imports and the events-rule warning acknowledgement.
+- **`skill("cdk")`** gains "Origin Access Control" and "Importing a Lambda by
+  Token ARN" sections, and the WAF summary lists the new config keys.
+- **`skill("waf")`** documents the hardened log bucket, `waf.logRetention`, and
+  the merge semantics of `redactedHeaders` / `redactedFields`.
+- **`skill("web")`** gains an "Origin Access Control" section and documents
+  `logRetention` and the hardened log buckets.
+- **`skill("migrations")`** documents `logGroup`, `logRetention`, and
+  `reservedConcurrentExecutions`, including the inert-`logRetention` gap
+  deferred to 2.0 (#568) and the zero-concurrency throw.

package/skills/JaypieDatadogForwarder.md

@@ -72,6 +72,21 @@ const forwarderFunction = resolveDatadogForwarderFunction(this);
 
 This imports the Lambda via `Fn.importValue("account-datadog-forwarder")` and caches per scope (WeakMap), so multiple calls in the same stack return the same reference.
 
+## Invoke Permissions
+
+The forwarder ARN is always an unresolved token: a cross-stack export or a nested-stack output. `lambda.Function.fromFunctionArn` on a token ARN produces an import with an unknown environment, and `addPermission()` on such an import is a silent no-op that only emits an `UnclearLambdaEnvironment` warning. Every trigger wired to the forwarder then deploys with no invoke permission, and S3 rejects the notification configuration because it cannot validate the destination.
+
+Both import sites use `lambda.Function.fromFunctionAttributes(scope, id, { functionArn, sameEnvironment: true })`. The flag is correct here because the forwarder is always in the same account and region as its consumers.
+
+`JaypieDatadogForwarder` acknowledges `@aws-cdk/aws-events:ruleUnresolvedEnvironment` on its own `CloudFormationEventsRule`. Acknowledgements resolve by construct path, so a consumer creating a rule that targets `forwarder.forwarderFunction` sees that warning on their own rule and should acknowledge it with the same justification:
+
+```typescript
+Annotations.of(rule).acknowledgeWarning(
+  "@aws-cdk/aws-events:ruleUnresolvedEnvironment",
+  "The Datadog forwarder is always in the same account and region",
+);
+```
+
 ### For Log Subscription Filters
 
 Use `resolveDatadogLoggingDestination` to get a `LambdaDestination`:

package/skills/cdk.md

@@ -440,8 +440,50 @@ KnownBadInputsRuleSet, IP rate limiting, and WAF logging to S3 with Datadog
 forwarding.
 
 See **`skill("waf")`** for configuration: `rateLimitPerIp`, `webAclArn`,
-`logBucket`, `managedRuleOverrides`, `managedRuleScopeDowns`, the `allow`
-path-scoped relaxation prop, and the rule-name ↔ label casing trap.
+`logBucket`, `logRetention`, `managedRuleOverrides`, `managedRuleScopeDowns`,
+`redactedFields`, `redactedHeaders`, the `allow` path-scoped relaxation prop,
+and the rule-name ↔ label casing trap.
+
+WAF logs always redact `authorization`, `cookie`, `x-amz-content-sha256`, and
+`x-api-key`. A `redactedHeaders` list merges with that default rather than
+replacing it, so adding a header can only ever redact more.
+
+## Origin Access Control
+
+`JaypieDistribution` with an `IFunction` handler creates a Function URL with
+`authType: NONE`, so the Lambda is invokable around CloudFront and the WAF.
+`originAccessControl: true` makes CloudFront the only caller:
+
+```typescript
+new JaypieDistribution(this, "Dist", {
+  handler,
+  originAccessControl: true,
+});
+```
+
+- The Function URL becomes `AWS_IAM`, the origin becomes
+  `origins.FunctionUrlOrigin.withOriginAccessControl(...)`, and the construct
+  adds the `lambda:InvokeFunction` permission that `withOriginAccessControl`
+  omits (Lambda requires both it and `lambda:InvokeFunctionUrl`).
+- **Client requirement:** with OAC, Lambda rejects a POST or PUT unless the
+  client sends the body SHA-256 in `x-amz-content-sha256`. For a body carrying
+  low-entropy secrets, salt it with a nonce so the hash is not reversible. That
+  header is redacted from WAF logs by default.
+- The prop applies only to the `IFunction` path. A caller-supplied
+  `IFunctionUrl` or `IOrigin` owns its own auth; setting the prop there warns
+  at synth (`@jaypie/constructs:originAccessControlIgnored`).
+- `JaypieWebDeploymentBucket` has its own `originAccessControl` prop for the S3
+  case; see `skill("web")`.
+
+## Importing a Lambda by Token ARN
+
+`lambda.Function.fromFunctionArn` on an ARN that is a token (`Fn.importValue`,
+a nested-stack output) yields an import with an unresolved environment.
+`addPermission()` on it is a silent no-op that only warns
+(`UnclearLambdaEnvironment`), so every trigger deploys without invoke
+permission. Use
+`lambda.Function.fromFunctionAttributes(scope, id, { functionArn, sameEnvironment: true })`
+whenever the function is known to be in the same account and region.
 
 ## Organization Trail Security Baseline
 

package/skills/migrations.md

@@ -35,7 +35,10 @@ new JaypieMigration(this, "SeedData", {
 | `dependencies` | `Construct[]` | `[]` | Constructs that must be created before the migration runs |
 | `environment` | `Record<string, string> \| (Record<string, string> \| string)[]` | - | Environment variables for the migration Lambda |
 | `handler` | `string` | `"index.handler"` | Lambda entry point |
+| `logGroup` | `logs.ILogGroup` | - | Log group for the migration Lambda; forwarded to `JaypieLambda`. Supply one to control KMS encryption and retention |
+| `logRetention` | `logs.RetentionDays \| number` | `90` days | Retention for the log group `JaypieLambda` creates. Ignored when `logGroup` is supplied |
 | `queryInterval` | `cdk.Duration` | `Duration.seconds(60)` | Polling interval between `isCompleteHandler` invocations |
+| `reservedConcurrentExecutions` | `number` | - | Reserved concurrency for the migration Lambda. `0` throws at synth; `1` leaves no headroom if onEvent overlaps a waiter poll |
 | `secrets` | `SecretsArrayItem[]` | `[]` | Secrets to make available to the Lambda |
 | `tables` | `dynamodb.ITable[]` | `[]` | DynamoDB tables to grant read/write access |
 | `timeout` | `cdk.Duration` | `Duration.minutes(15)` | Per-invocation Lambda timeout |
@@ -45,6 +48,9 @@ new JaypieMigration(this, "SeedData", {
 
 - **Timeout**: 15 minutes per invocation (Lambda max); `totalTimeout` controls the end-to-end ceiling across all polling invocations (default 2 hours)
 - **Role**: Tagged as `CDK.ROLE.PROCESSING`
+- **Logging**: `logGroup`, `logRetention`, and `reservedConcurrentExecutions` forward to the wrapped `JaypieLambda`. Pass `logGroup` when a compliance baseline requires a KMS-encrypted group or 12-month retention. The `cr.Provider` framework functions keep service-created log groups
+- **`logRetention` is inert when `logGroup` is supplied.** `JaypieLambda` resolves `logGroup ?? new logs.LogGroup(..., { retention: logRetention })`, so passing both silently drops the retention value. Set retention on the group you pass. Jaypie 2.0 will throw on that combination (#568)
+- **Concurrency**: the migration Lambda is both `onEventHandler` and `isCompleteHandler`. `reservedConcurrentExecutions: 0` blocks every invocation and throws `ConfigurationError` at synth
 - **Execution**: Uses `cr.Provider` with both `onEventHandler` and `isCompleteHandler` pointing to the same Lambda. The `onEventHandler` returns `PhysicalResourceId` immediately; the migration code runs in `isCompleteHandler` invocations, which are polled by Step Functions until `IsComplete: true`. `Delete` requests skip the migration entirely.
 - **Dependencies**: Use `dependencies` to ensure tables and other resources exist before the migration executes
 - **Permissions**: Tables passed via `tables` get data-plane (`grantReadWriteData`), `Query` and `Scan` on `${tableArn}/index/*`, plus `DescribeTable`, `DescribeTimeToLive`, and `DescribeContinuousBackups` scoped to the table ARN and its indexes. Migrations read and write data. They do not change table shape

package/skills/waf.md

@@ -53,6 +53,51 @@ new JaypieDistribution(this, "Dist", {
 Cost: $5/month per WebACL + $1/month per rule + $0.60 per million requests. That
 cost is why WAF is opt-in; set `waf: true` (or a config object) to opt in.
 
+## Log bucket
+
+The construct-created WAF log bucket blocks all public access, enforces SSL, is
+versioned, uses SSE-S3, retains objects for `logRetention` (365 days by
+default), and carries `RemovalPolicy.RETAIN` with no auto-delete. It survives
+stack deletion; delete it by hand when tearing an environment down.
+
+CloudFormation owns the whole bucket policy, including the two
+`delivery.logs.amazonaws.com` delivery statements. A policy statement added to
+that bucket out of band (console, CLI, another stack) is discarded on the next
+deploy.
+
+A consumer-supplied `logBucket` is used as given: it needs its own hardening and
+its own delivery policy.
+
+## Redact headers from WAF logs
+
+WAF logs record every request header. Jaypie always redacts
+`authorization`, `cookie`, `x-amz-content-sha256`, and `x-api-key`
+(`DEFAULT_WAF_REDACTED_HEADERS`). `redactedHeaders` names more:
+
+```typescript
+new JaypieDistribution(this, "Dist", {
+  handler,
+  waf: { name: "api", redactedHeaders: ["x-session-token"] },
+});
+```
+
+- The list **merges** with the defaults rather than replacing them, so adding a
+  header can only ever redact more. There is no way to un-redact a default.
+- Names are compared case-insensitively, as WAF matches them, so naming a
+  default again does not duplicate it.
+- `x-amz-content-sha256` is in the default because `originAccessControl`
+  requires clients to send a SHA-256 of the request body. For a low-entropy body
+  that hash is a body fingerprint.
+- `redactedFields` passes `wafv2.CfnLoggingConfiguration.FieldToMatchProperty`
+  entries (query string, URI path, JSON body) through and layers on top of the
+  redacted headers.
+- WAF caps the combined list at 100 entries; exceeding it throws a
+  `ConfigurationError` at synth.
+
+`waf.logRetention` overrides the construct's `logRetention` for the WAF log
+bucket alone, so WAF logs and CloudFront access logs can keep different
+retention.
+
 ## Override specific managed rule actions
 
 Flip a named sub-rule from `block` to `count` everywhere (e.g. allow large

package/skills/web.md

@@ -42,14 +42,16 @@ new JaypieWebDeploymentBucket(this, "Web", {
 | `defaultBehavior` | `Partial<BehaviorOptions>` | undefined — merged over the construct's default behavior; keys given win |
 | `destination` | `LambdaDestination \| boolean` | `true` (Datadog forwarder for access-log bucket notifications) |
 | `logBucket` | `IBucket \| string \| { exportName } \| true` | undefined — creates a new bucket if `destination !== false` |
+| `logRetention` | `Duration \| number` | `Duration.days(365)` — retention for the log buckets the construct creates; `waf.logRetention` overrides it for the WAF bucket |
 | `name` | `string` | `constructEnvName(component)` |
+| `originAccessControl` | `boolean` | `false` — serve the bucket privately through the S3 REST endpoint with CloudFront OAC |
 | `responseHeadersPolicy` | `IResponseHeadersPolicy` | undefined — full override; bypasses default security headers |
 | `roleTag` | `string` | `CDK.ROLE.HOSTING` |
 | `securityHeaders` | `boolean \| SecurityHeadersOverrides` | `true` |
 | `spa` | `boolean` | `false` — viewer-request rewrite of extension-less URIs to `/index.html` |
 | `waf` | `boolean \| JaypieWebDeploymentBucketWafConfig` | `false` (when enabled, WAF name defaults to construct id) |
 
-Also accepts all `s3.BucketProps` — the bucket defaults to `autoDeleteObjects: true`, `publicReadAccess: true`, `websiteIndexDocument: "index.html"`, `websiteErrorDocument: "index.html"` — which renders an SPA deep link but answers 404; see [Single-Page App](#single-page-app).
+Also accepts all `s3.BucketProps`. With `originAccessControl: false` (the default) the bucket is a public S3 website: `autoDeleteObjects: true`, `publicReadAccess: true`, `websiteIndexDocument: "index.html"`, `websiteErrorDocument: "index.html"` — which renders an SPA deep link but answers 404; see [Single-Page App](#single-page-app). With `originAccessControl: true` the bucket is private; see [Origin Access Control](#origin-access-control).
 
 ### Bucket Name
 
@@ -67,6 +69,7 @@ Changing `component` or `name` on a deployed stack renames the bucket, which rep
 - Default behavior: S3 static website origin, `REDIRECT_TO_HTTPS`. `CACHING_DISABLED` outside production; `CACHING_OPTIMIZED` in production (`isProductionEnv()`), so hashed assets get edge cache. The response headers policy sets `Cache-Control: no-store` so browsers still revalidate.
 - No `/*` behavior is created. Paths registered afterward with `distribution.addBehavior("/app/*", origin)` are evaluated ahead of the default behavior and match in every environment — a static site and a Lambda surface can share one distribution.
 - Access logs land in a CloudFront log bucket with Datadog forwarding by default. Set `destination: false` to skip notifications, or pass `logBucket: <existing>` to reuse a bucket.
+- The construct-created log buckets block all public access, enforce SSL, are versioned, use SSE-S3, retain objects for `logRetention` (365 days by default), and carry `RemovalPolicy.RETAIN` with no auto-delete. They survive stack deletion; delete them by hand when tearing an environment down.
 
 ```typescript
 const web = new JaypieWebDeploymentBucket(this, "Web", { host, zone });
@@ -107,6 +110,27 @@ new JaypieWebDeploymentBucket(this, "App", {
 - Exposed as `.spaFunction`. Works without `host` and `zone`, so a deep link resolves on the CloudFront default domain before DNS is wired.
 - Combining `spa: true` with a caller-supplied **viewer-request** association throws `ConfigurationError` at synth; CloudFront permits one function per event type. Other event types (for example viewer-response) compose, with the rewrite appended last.
 
+### Origin Access Control
+
+The default bucket is a public S3 website endpoint. CloudFront cannot use origin access control against a website endpoint, so the bucket stays readable around CloudFront and the WAF.
+
+`originAccessControl: true` serves the bucket privately:
+
+```typescript
+new JaypieWebDeploymentBucket(this, "Web", {
+  host,
+  originAccessControl: true,
+  spa: true,
+  zone,
+});
+```
+
+- The bucket gets `BlockPublicAccess.BLOCK_ALL` and `enforceSSL: true`, with no ACL, no public read, and no website configuration.
+- The default behavior uses `origins.S3BucketOrigin.withOriginAccessControl(bucket)`, and the distribution sets `defaultRootObject: "index.html"`.
+- Combining it with `publicReadAccess: true`, `websiteIndexDocument`, or `websiteErrorDocument` through `bucketProps` throws `ConfigurationError` at synth. Other bucket props still compose.
+- **Pair it with `spa: true`.** The REST endpoint has no error document, and OAC grants only `s3:GetObject`, so a miss returns `403 AccessDenied` rather than the app shell. The SPA function rewrites extension-less deep links before they reach the origin, so they never miss.
+- `isWebsite` is `false` and `bucketWebsiteUrl` no longer addresses a live endpoint.
+
 ### Security Headers
 
 Same defaults as `JaypieDistribution`: HSTS, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy, Cross-Origin-* headers, and Server header removal (applied via a `ResponseHeadersPolicy` on the default behavior). Override the same way: