@jaypie/mcp 0.8.189 → 0.8.191

package/dist/assets.js

@@ -55,11 +55,11 @@ function getMcpAssetPaths() {
  */
 function getMcpBuildInfo() {
     return {
-        commit: "5569d996"
+        commit: "f88048b4"
             ,
-        version: "0.8.189"
+        version: "0.8.191"
             ,
-        versionString: "@jaypie/mcp@0.8.189#5569d996"
+        versionString: "@jaypie/mcp@0.8.191#f88048b4"
             ,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.189",
+  "version": "0.8.191",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.91.md

@@ -0,0 +1,37 @@
+---
+version: 1.2.91
+date: 2026-10-14
+summary: WAF rate limit exempt IPs; Agent permission set stops granting code execution under service roles
+---
+
+## Changes
+
+- **`waf.rateLimit`** on `JaypieDistribution` and `JaypieWebDeploymentBucket`
+  takes `{ exemptIps, perIp }` (#589). `exemptIps` lists IPv4 and IPv6 CIDRs
+  the `RateLimitPerIp` rule neither counts nor blocks. The construct creates
+  one `AWS::WAFv2::IPSet` per address family and scopes the rate-based
+  statement down to everyone outside them. `rateLimitPerIp` keeps working;
+  setting it with `rateLimit.perIp` throws `ConfigurationError`, as does an
+  invalid CIDR.
+- **`JaypieSsoPermissions` Agent set** no longer grants actions that run code
+  under a service execution role (#570): `iam:PassRole`, Lambda invoke, code,
+  configuration, version, alias, and event-source-mapping writes, ECS task
+  definition, run, start, and service updates, `ecr:PutImage` and layer
+  uploads, `states:StartExecution`, `states:StartSyncExecution`, and
+  `pipes:StartPipe`.
+- The Agent set also drops account-wide `secretsmanager:GetSecretValue`,
+  `ssm:PutParameter`, and `s3:PutObject`.
+- `AgentDenyPrivilegedPassRole` stays, so a linked policy granting
+  `iam:PassRole` still cannot pass the SSO, organization, or CDK roles.
+
+## Upgrade
+
+- Agent sessions that invoke or update Lambdas, run ECS tasks, start Step
+  Functions executions, read secrets, write parameters, or put objects now
+  receive `AccessDenied`. Restore a specific workload with a customer managed
+  policy linked to the Agent set, scoped to that workload's ARNs. Nothing
+  denies these actions, so such a grant takes effect.
+- Consumers appending a local `DenyAgentExecutionRoleEscalation` statement can
+  remove it.
+- `rateLimitPerIp` alone synthesizes the same rule as before; no template
+  change without `rateLimit`.

package/release-notes/fabricator/0.4.3.md

@@ -0,0 +1,10 @@
+---
+version: 0.4.3
+date: 2026-10-14
+summary: Lint cleanup with no behavior change
+---
+
+## Changes
+
+- Removes an unused `ConfigurationError` import from `Fabricator`
+- Acknowledges the intentional `console.warn` in `uuidFrom` for lint

package/release-notes/jaypie/1.2.124.md

@@ -0,0 +1,9 @@
+---
+version: 1.2.124
+date: 2026-10-14
+summary: Pulls @jaypie/llm 1.3.65
+---
+
+## Changes
+
+- **`@jaypie/llm` 1.3.65**: `operate()` streams provider transport internally on Anthropic, OpenAI, xAI, Meta, Google, and Mistral, lifting the 16,384 non-streaming output cap.

package/release-notes/llm/1.3.65.md

@@ -0,0 +1,18 @@
+---
+version: 1.3.65
+date: 2026-10-14
+summary: operate() streams provider transport internally on Anthropic, OpenAI, xAI, Meta, Google, and Mistral, lifting the 16,384 non-streaming output cap
+---
+
+## Changes
+
+- `operate()` consumes the provider stream internally and still returns one settled `LlmOperateResponse` on Anthropic, OpenAI, xAI, Meta, Google, and Mistral (#603). Each adapter accumulates stream events back into the payload its non-streaming request returns, so parsing, tool calls, history, structured output, and stop reasons are unchanged.
+- Output budgets resolve to the model maximum instead of 16,384. Gemini 2.5/3.x reaches 65,536; Mistral reaches its 32,768 cap, which stays because it bounds degenerate restating.
+- `timeout` becomes an idle timeout on these providers: the deadline resets on every stream event, so a stall fails over sooner and a long active generation is not cut off. Fireworks, OpenRouter, and Bedrock keep the non-streaming request and a whole-attempt deadline.
+- Parameter-rejection retries (temperature, `reasoning_effort`, `response_format`, schema and output-format rejections) behave the same on both transports.
+- A provider error event inside a stream classifies like the matching HTTP status; a stream that closes before settling is retried as a 500.
+
+## Upgrade
+
+- Long responses that previously stopped at 16,384 tokens with `MAX_TOKENS` now run to the model maximum. Cost and latency grow with them; set `maxTokens` to keep a ceiling.
+- A `timeout` sized for the slowest whole non-streaming response can shrink to the longest expected pause between events.

package/release-notes/mcp/0.8.190.md

@@ -0,0 +1,11 @@
+---
+version: 0.8.190
+date: 2026-10-14
+summary: Skills agree on packages/cdk as the CDK package directory
+---
+
+## Changes
+
+- **Skills**: `monorepo`, `cdk`, `cicd-actions`, `cicd-deploy`, `dynamodb`, and `jaypie` name `packages/cdk` as the single location for the CDK package (#623)
+- **`monorepo`**: drops `stacks` as a workspace directory name; limits `workspaces/` to repositories whose `packages/` publish to npm; notes that the root `package.json` and vitest globs cover `packages/*` only
+- **`cicd-actions`**: `cdk-deploy` defaults `working-directory` to `packages/cdk`; `web-deploy` defaults to `packages/cdk/cdk-outputs.json` and `packages/web/dist`

package/release-notes/mcp/0.8.191.md

@@ -0,0 +1,11 @@
+---
+version: 0.8.191
+date: 2026-10-14
+summary: WAF skills document waf.rateLimit exemptIps; llm skill documents the streamed operate transport
+---
+
+## Changes
+
+- **`waf`**: example for `rateLimit: { exemptIps, perIp }`, exempting known CIDRs from the per-IP rate rule (#589)
+- **`cdk`**: lists `rateLimit` among the WAF configuration props
+- **`llm`**: Default Output Token Limits and timeout notes reflect `operate()` streaming internally on Anthropic, OpenAI, xAI, Meta, Google, and Mistral (#603)

package/release-notes/textract/0.2.7.md

@@ -0,0 +1,9 @@
+---
+version: 0.2.7
+date: 2026-10-14
+summary: Incomplete markdown conversion warns through the logger only
+---
+
+## Changes
+
+- `MarkdownPage` drops a `console.warn` that duplicated `log.warn` for incomplete JSON-to-markdown conversion; the warning still logs once through the Jaypie logger

package/skills/cdk.md

@@ -107,10 +107,10 @@ new JaypieSesIntake(this, "Intake", {
 
 ## Stack Structure
 
-Organize stacks in the `workspaces/` directory:
+The CDK package lives at `packages/cdk`, alongside every other workspace (see `skill("monorepo")`):
 
 ```
-workspaces/
+packages/
 ├── cdk/
 │   ├── src/
 │   │   ├── app.ts        # CDK app entry
@@ -439,7 +439,7 @@ new JaypieDistribution(this, "Dist", {
 KnownBadInputsRuleSet, IP rate limiting, and WAF logging to S3 with Datadog
 forwarding.
 
-See **`skill("waf")`** for configuration: `rateLimitPerIp`, `webAclArn`,
+See **`skill("waf")`** for configuration: `rateLimit` (`perIp`, `exemptIps`), `rateLimitPerIp`, `webAclArn`,
 `logBucket`, `logRetention`, `managedRuleOverrides`, `managedRuleScopeDowns`,
 `redactedFields`, `redactedHeaders`, the `allow` path-scoped relaxation prop,
 and the rule-name ↔ label casing trap.

package/skills/cicd-actions.md

@@ -194,7 +194,6 @@ runs:
         path: |
           node_modules
           packages/*/node_modules
-          workspaces/*/node_modules
         key: ${{ runner.os }}-node-${{ inputs.node-version }}-${{ hashFiles('**/package-lock.json') }}
         restore-keys: |
           ${{ runner.os }}-node-${{ inputs.node-version }}-
@@ -205,8 +204,7 @@ runs:
       with:
         path: |
           packages/*/dist
-          workspaces/*/dist
-          workspaces/*/.open-next
+          packages/*/.open-next
         key: ${{ runner.os }}-build-${{ github.sha }}
         restore-keys: |
           ${{ runner.os }}-build-
@@ -262,7 +260,7 @@ inputs:
   working-directory:
     description: 'Working directory for CDK commands'
     required: false
-    default: 'workspaces/cdk'
+    default: 'packages/cdk'
   require-approval:
     description: 'CDK approval mode (never, any-change, broadening)'
     required: false
@@ -310,7 +308,7 @@ inputs:
   outputs-file:
     description: 'Path to cdk-outputs.json produced by cdk deploy'
     required: false
-    default: 'workspaces/cdk/cdk-outputs.json'
+    default: 'packages/cdk/cdk-outputs.json'
   prefix:
     description: 'Output name prefix when exportOutputs({ prefix }) was used (e.g., "App")'
     required: false
@@ -318,7 +316,7 @@ inputs:
   source:
     description: 'Directory of built assets to sync'
     required: false
-    default: 'workspaces/web/dist'
+    default: 'packages/web/dist'
   region:
     description: 'AWS region'
     required: false

package/skills/cicd-deploy.md

@@ -261,7 +261,7 @@ jobs:
 
 CDK provisions a `JaypieWebDeploymentBucket`; it does not fill it. Jaypie avoids `s3deploy.BucketDeployment`, so shipping content is a workflow step:
 
-1. `cdk-deploy` deploys the bucket, distribution, and deploy role, and writes `workspaces/cdk/cdk-outputs.json`.
+1. `cdk-deploy` deploys the bucket, distribution, and deploy role, and writes `packages/cdk/cdk-outputs.json`.
 2. `web-deploy` reads `DestinationBucketName`, `DestinationBucketDeployRoleArn`, and `DistributionId` from that file.
 3. `web-deploy` assumes the deploy role, syncs the built assets, and invalidates the distribution.
 
@@ -278,7 +278,7 @@ See `skill("cicd-actions")` for the `web-deploy` action body and `skill("web")`
 `JaypieStack` names every stack `cdk-{PROJECT_SPONSOR}-{PROJECT_KEY}-{PROJECT_ENV}-{PROJECT_NONCE}[-{key}]` and resolves the account and region (see `skill("cdk")`). Do not compose stack names in `app.ts`:
 
 ```typescript
-// workspaces/cdk/src/app.ts
+// packages/cdk/src/app.ts
 import { App } from "aws-cdk-lib";
 import { JaypieAppStack } from "@jaypie/constructs";
 

package/skills/dynamodb.md

@@ -550,7 +550,7 @@ registerModel({ model: "session", indexes: [fabricIndex()], ttl: "30 days" });
 ```
 
 ```typescript
-// workspaces/cdk/lib/data-stack.ts
+// packages/cdk/lib/data-stack.ts
 import "@project/models"; // registers models
 import { JaypieDynamoDb } from "@jaypie/constructs";
 import { getAllRegisteredIndexes } from "@jaypie/fabric";

package/skills/jaypie.md

@@ -50,11 +50,10 @@ Jaypie projects use npm workspaces:
 
 ```
 project/
-├── packages/           # npm packages
+├── packages/           # npm workspaces
 │   ├── api/           # Express API
+│   ├── cdk/           # CDK app
 │   └── lib/           # Shared library
-├── workspaces/        # CDK infrastructure
-│   └── cdk/           # CDK app
 └── package.json       # Root workspace config
 ```
 

package/skills/llm.md

@@ -916,7 +916,8 @@ const response = await llm.operate(input, {
 - A timeout is never an `LlmAbortError`: the caller's `signal` still owns cancellation.
 - An entry's own `timeout` replaces the call's for that entry; `false` disables it.
 - `stream()` treats `timeout` as an idle timeout: it restarts with every chunk and pauses while the consumer holds one. A stall after partial output yields an error chunk.
-- No default applies; unset means no deadline. Size it above the slowest legitimate non-streaming response (long reasoning runs take minutes).
+- `operate()` on Anthropic, Google, Mistral, OpenAI, xAI, and Meta streams its transport internally, so `timeout` is an idle timeout there too: it restarts with every event the provider sends, catching a stall without cutting off a long generation that is still producing. On Bedrock, Fireworks, and OpenRouter `operate()` sends non-streaming requests and `timeout` bounds the whole attempt.
+- No default applies; unset means no deadline. On the non-streaming providers, size it above the slowest legitimate response (long reasoning runs take minutes).
 - `Llm.ocr` keeps `timeout` as the LlamaParse job deadline.
 - A timeout that hands off to the next model logs at `debug` (`API call timed out after 60000ms; not retrying`, then `Provider openai failed; failing over`). Only the failure that reaches the caller logs at `warn`. The report tally counts it under `failures` and `fallbacks`.
 
@@ -1359,14 +1360,21 @@ Google merges them into the generation config.
 
 ### Default Output Token Limits
 
-Anthropic and Google requests resolve a default output-token limit from the
-model's documented maximum output, so long generations do not silently
-truncate:
+Anthropic, Google, and Mistral requests resolve a default output-token limit
+from the model's documented maximum output, so long generations do not
+silently truncate:
 
-- **Non-streaming** (`operate()`, `send()`): capped at 16,384 tokens —
-  larger non-streaming responses risk HTTP timeouts (stream instead)
-- **Streaming** (`stream()`): the model maximum — e.g., 128,000 for current
-  Claude models (64,000 for Haiku 4.5), 65,536 for Gemini 2.5/3.x
+- **Streamed transport** (`stream()`, and `operate()` on Anthropic, Google,
+  Mistral, OpenAI, xAI, and Meta): the model maximum — e.g., 128,000 for
+  current Claude models (64,000 for Haiku 4.5), 65,536 for Gemini 2.5/3.x
+- **Non-streaming**: an adapter request built without the streamed
+  transport is capped at 16,384 (larger non-streaming responses risk HTTP
+  timeouts). The deprecated `send()` on Anthropic sends 16,384 as well
+
+`operate()` consumes the provider stream internally and still returns one
+settled response (same `content`, tool calls, history, stop reason, and
+usage), so streaming there is a transport detail with no caller-facing change.
+Bedrock, Fireworks, and OpenRouter keep non-streaming `operate()` requests.
 
 Override per model with `modelOptions`:
 
@@ -1383,19 +1391,19 @@ await Llm.operate(input, {
 
 OpenAI, xAI, and Meta leave the limit unset (their defaults do not truncate early).
 A chain that mixes them with Anthropic, Google, or Mistral therefore mixes
-output budgets: a Gemini primary resolves to 16,384 non-streaming while an
+output budgets: a Gemini primary resolves to its 65,536 model maximum while an
 OpenAI fallback sends no ceiling, so swapping the primary moves the effective
 budget with nothing at the call site changing. Reasoning tokens count against
 the ceiling. Set `maxOutputTokens` (Google) or `max_tokens` (Anthropic,
 Mistral) in `modelOptions` to pin it per model.
-Mistral is capped (32,768 streaming / 16,384 non-streaming) despite publishing
-no low ceiling: a Mistral model can degenerate into restating its answer when
+Mistral is capped at 32,768 on every transport despite publishing no low
+ceiling: a Mistral model can degenerate into restating its answer when
 `format` and tools are combined, and an uncapped completion turns that into a
 multi-minute request. Override with `modelOptions: { mistral: { max_tokens } }`.
 OpenRouter varies by routed model; pass `max_tokens` via `modelOptions`
 when needed. A truncated response settles `status: "incomplete"` with
 `stopReason: "max_tokens"` and moves a fallback chain to its next entry;
-raise the limit or switch to `stream()`.
+raise the limit through `modelOptions`.
 
 ## See Also
 

package/skills/monorepo.md

@@ -135,8 +135,12 @@ npm install --save-dev @jaypie/eslint @jaypie/repokit @jaypie/testkit eslint vit
 
 | Directory | Purpose |
 |-----------|---------|
-| `packages/` | npm packages (default workspace) |
-| `workspaces/` | CDK-deployed infrastructure and sites |
+| `packages/` | Default for every workspace: npm packages, the CDK package (`packages/cdk`), and sites (`packages/web`) |
+| `workspaces/` | Only in a repository whose `packages/` publish to npm: the unpublished workspaces that manage them (`workspaces/cdk`, `workspaces/documentation`) |
+
+Use `packages/cdk` unless the repository publishes its packages to npm. The Jaypie repository itself is the `workspaces/` case: `packages/` holds the published libraries and `workspaces/` holds the CDK app and documentation site that deploy around them.
+
+`packages/cdk` is the default the `cdk`, `cicd-actions`, and `cicd-deploy` skills assume. The root `package.json` scripts and the vitest `test.projects` glob cover `packages/*` only, so a repository that adds `workspaces/` must pass `workspaces/cdk` to the `cdk-deploy` and `web-deploy` inputs, and its workspaces fall out of `build`, `clean`, `format:package`, `test`, and `typecheck` until every one of those globs names it.
 
 ## Scripts Reference
 
@@ -164,10 +168,9 @@ npm install --save-dev @jaypie/eslint @jaypie/repokit @jaypie/testkit eslint vit
 - etc: configurations
 - lib: usually within a src directory, modules of encapsulated logic that could be refactored out later
 - LOCAL: human local scratch directory, include in gitignore
-- packages: default and preferred name for NPM workspaces; always use for packages publishing to NPM
-- stacks: allowed name for NPM workspaces that publish via CDK
+- packages: default directory for NPM workspaces, including the CDK package (`packages/cdk`); always use for packages publishing to NPM
 - templates: usually CloudFormation
-- workspaces: allowed name for NPM workspace that do not publish
+- workspaces: unpublished workspaces (CDK, sites) in a repository whose packages publish to NPM
 - var: agent and machine local scratch directory, include in gitignore
 
 ### Discouraged Folder Names

package/skills/waf.md

@@ -26,6 +26,16 @@ new JaypieDistribution(this, "Dist", {
   waf: { name: "api", rateLimitPerIp: 500 },
 });
 
+// Exempt known source CIDRs (a partner's backfill server) from the per-IP
+// rate rule. Everyone else is still limited at perIp per 5 minutes.
+new JaypieDistribution(this, "Dist", {
+  handler,
+  waf: {
+    name: "api",
+    rateLimit: { exemptIps: ["203.0.113.10/32", "2001:db8::/48"], perIp: 2000 },
+  },
+});
+
 // Multiple distributions in one env — set a unique waf.name on each to
 // avoid WebACL/S3 bucket name collisions between stacks.
 new JaypieDistribution(this, "Api", { handler: api, waf: { name: "api" } });