@jaypie/mcp 0.8.190 → 0.8.191

package/dist/assets.js

@@ -55,11 +55,11 @@ function getMcpAssetPaths() {
  */
 function getMcpBuildInfo() {
     return {
-        commit: "c95f849f"
+        commit: "f88048b4"
             ,
-        version: "0.8.190"
+        version: "0.8.191"
             ,
-        versionString: "@jaypie/mcp@0.8.190#c95f849f"
+        versionString: "@jaypie/mcp@0.8.191#f88048b4"
             ,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.190",
+  "version": "0.8.191",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.91.md

@@ -0,0 +1,37 @@
+---
+version: 1.2.91
+date: 2026-10-14
+summary: WAF rate limit exempt IPs; Agent permission set stops granting code execution under service roles
+---
+
+## Changes
+
+- **`waf.rateLimit`** on `JaypieDistribution` and `JaypieWebDeploymentBucket`
+  takes `{ exemptIps, perIp }` (#589). `exemptIps` lists IPv4 and IPv6 CIDRs
+  the `RateLimitPerIp` rule neither counts nor blocks. The construct creates
+  one `AWS::WAFv2::IPSet` per address family and scopes the rate-based
+  statement down to everyone outside them. `rateLimitPerIp` keeps working;
+  setting it with `rateLimit.perIp` throws `ConfigurationError`, as does an
+  invalid CIDR.
+- **`JaypieSsoPermissions` Agent set** no longer grants actions that run code
+  under a service execution role (#570): `iam:PassRole`, Lambda invoke, code,
+  configuration, version, alias, and event-source-mapping writes, ECS task
+  definition, run, start, and service updates, `ecr:PutImage` and layer
+  uploads, `states:StartExecution`, `states:StartSyncExecution`, and
+  `pipes:StartPipe`.
+- The Agent set also drops account-wide `secretsmanager:GetSecretValue`,
+  `ssm:PutParameter`, and `s3:PutObject`.
+- `AgentDenyPrivilegedPassRole` stays, so a linked policy granting
+  `iam:PassRole` still cannot pass the SSO, organization, or CDK roles.
+
+## Upgrade
+
+- Agent sessions that invoke or update Lambdas, run ECS tasks, start Step
+  Functions executions, read secrets, write parameters, or put objects now
+  receive `AccessDenied`. Restore a specific workload with a customer managed
+  policy linked to the Agent set, scoped to that workload's ARNs. Nothing
+  denies these actions, so such a grant takes effect.
+- Consumers appending a local `DenyAgentExecutionRoleEscalation` statement can
+  remove it.
+- `rateLimitPerIp` alone synthesizes the same rule as before; no template
+  change without `rateLimit`.

package/release-notes/fabricator/0.4.3.md

@@ -0,0 +1,10 @@
+---
+version: 0.4.3
+date: 2026-10-14
+summary: Lint cleanup with no behavior change
+---
+
+## Changes
+
+- Removes an unused `ConfigurationError` import from `Fabricator`
+- Acknowledges the intentional `console.warn` in `uuidFrom` for lint

package/release-notes/jaypie/1.2.124.md

@@ -0,0 +1,9 @@
+---
+version: 1.2.124
+date: 2026-10-14
+summary: Pulls @jaypie/llm 1.3.65
+---
+
+## Changes
+
+- **`@jaypie/llm` 1.3.65**: `operate()` streams provider transport internally on Anthropic, OpenAI, xAI, Meta, Google, and Mistral, lifting the 16,384 non-streaming output cap.

package/release-notes/llm/1.3.65.md

@@ -0,0 +1,18 @@
+---
+version: 1.3.65
+date: 2026-10-14
+summary: operate() streams provider transport internally on Anthropic, OpenAI, xAI, Meta, Google, and Mistral, lifting the 16,384 non-streaming output cap
+---
+
+## Changes
+
+- `operate()` consumes the provider stream internally and still returns one settled `LlmOperateResponse` on Anthropic, OpenAI, xAI, Meta, Google, and Mistral (#603). Each adapter accumulates stream events back into the payload its non-streaming request returns, so parsing, tool calls, history, structured output, and stop reasons are unchanged.
+- Output budgets resolve to the model maximum instead of 16,384. Gemini 2.5/3.x reaches 65,536; Mistral reaches its 32,768 cap, which stays because it bounds degenerate restating.
+- `timeout` becomes an idle timeout on these providers: the deadline resets on every stream event, so a stall fails over sooner and a long active generation is not cut off. Fireworks, OpenRouter, and Bedrock keep the non-streaming request and a whole-attempt deadline.
+- Parameter-rejection retries (temperature, `reasoning_effort`, `response_format`, schema and output-format rejections) behave the same on both transports.
+- A provider error event inside a stream classifies like the matching HTTP status; a stream that closes before settling is retried as a 500.
+
+## Upgrade
+
+- Long responses that previously stopped at 16,384 tokens with `MAX_TOKENS` now run to the model maximum. Cost and latency grow with them; set `maxTokens` to keep a ceiling.
+- A `timeout` sized for the slowest whole non-streaming response can shrink to the longest expected pause between events.

package/release-notes/mcp/0.8.191.md

@@ -0,0 +1,11 @@
+---
+version: 0.8.191
+date: 2026-10-14
+summary: WAF skills document waf.rateLimit exemptIps; llm skill documents the streamed operate transport
+---
+
+## Changes
+
+- **`waf`**: example for `rateLimit: { exemptIps, perIp }`, exempting known CIDRs from the per-IP rate rule (#589)
+- **`cdk`**: lists `rateLimit` among the WAF configuration props
+- **`llm`**: Default Output Token Limits and timeout notes reflect `operate()` streaming internally on Anthropic, OpenAI, xAI, Meta, Google, and Mistral (#603)

package/release-notes/textract/0.2.7.md

@@ -0,0 +1,9 @@
+---
+version: 0.2.7
+date: 2026-10-14
+summary: Incomplete markdown conversion warns through the logger only
+---
+
+## Changes
+
+- `MarkdownPage` drops a `console.warn` that duplicated `log.warn` for incomplete JSON-to-markdown conversion; the warning still logs once through the Jaypie logger

package/skills/cdk.md

@@ -439,7 +439,7 @@ new JaypieDistribution(this, "Dist", {
 KnownBadInputsRuleSet, IP rate limiting, and WAF logging to S3 with Datadog
 forwarding.
 
-See **`skill("waf")`** for configuration: `rateLimitPerIp`, `webAclArn`,
+See **`skill("waf")`** for configuration: `rateLimit` (`perIp`, `exemptIps`), `rateLimitPerIp`, `webAclArn`,
 `logBucket`, `logRetention`, `managedRuleOverrides`, `managedRuleScopeDowns`,
 `redactedFields`, `redactedHeaders`, the `allow` path-scoped relaxation prop,
 and the rule-name ↔ label casing trap.

package/skills/llm.md

@@ -916,7 +916,8 @@ const response = await llm.operate(input, {
 - A timeout is never an `LlmAbortError`: the caller's `signal` still owns cancellation.
 - An entry's own `timeout` replaces the call's for that entry; `false` disables it.
 - `stream()` treats `timeout` as an idle timeout: it restarts with every chunk and pauses while the consumer holds one. A stall after partial output yields an error chunk.
-- No default applies; unset means no deadline. Size it above the slowest legitimate non-streaming response (long reasoning runs take minutes).
+- `operate()` on Anthropic, Google, Mistral, OpenAI, xAI, and Meta streams its transport internally, so `timeout` is an idle timeout there too: it restarts with every event the provider sends, catching a stall without cutting off a long generation that is still producing. On Bedrock, Fireworks, and OpenRouter `operate()` sends non-streaming requests and `timeout` bounds the whole attempt.
+- No default applies; unset means no deadline. On the non-streaming providers, size it above the slowest legitimate response (long reasoning runs take minutes).
 - `Llm.ocr` keeps `timeout` as the LlamaParse job deadline.
 - A timeout that hands off to the next model logs at `debug` (`API call timed out after 60000ms; not retrying`, then `Provider openai failed; failing over`). Only the failure that reaches the caller logs at `warn`. The report tally counts it under `failures` and `fallbacks`.
 
@@ -1359,14 +1360,21 @@ Google merges them into the generation config.
 
 ### Default Output Token Limits
 
-Anthropic and Google requests resolve a default output-token limit from the
-model's documented maximum output, so long generations do not silently
-truncate:
+Anthropic, Google, and Mistral requests resolve a default output-token limit
+from the model's documented maximum output, so long generations do not
+silently truncate:
 
-- **Non-streaming** (`operate()`, `send()`): capped at 16,384 tokens —
-  larger non-streaming responses risk HTTP timeouts (stream instead)
-- **Streaming** (`stream()`): the model maximum — e.g., 128,000 for current
-  Claude models (64,000 for Haiku 4.5), 65,536 for Gemini 2.5/3.x
+- **Streamed transport** (`stream()`, and `operate()` on Anthropic, Google,
+  Mistral, OpenAI, xAI, and Meta): the model maximum — e.g., 128,000 for
+  current Claude models (64,000 for Haiku 4.5), 65,536 for Gemini 2.5/3.x
+- **Non-streaming**: an adapter request built without the streamed
+  transport is capped at 16,384 (larger non-streaming responses risk HTTP
+  timeouts). The deprecated `send()` on Anthropic sends 16,384 as well
+
+`operate()` consumes the provider stream internally and still returns one
+settled response (same `content`, tool calls, history, stop reason, and
+usage), so streaming there is a transport detail with no caller-facing change.
+Bedrock, Fireworks, and OpenRouter keep non-streaming `operate()` requests.
 
 Override per model with `modelOptions`:
 
@@ -1383,19 +1391,19 @@ await Llm.operate(input, {
 
 OpenAI, xAI, and Meta leave the limit unset (their defaults do not truncate early).
 A chain that mixes them with Anthropic, Google, or Mistral therefore mixes
-output budgets: a Gemini primary resolves to 16,384 non-streaming while an
+output budgets: a Gemini primary resolves to its 65,536 model maximum while an
 OpenAI fallback sends no ceiling, so swapping the primary moves the effective
 budget with nothing at the call site changing. Reasoning tokens count against
 the ceiling. Set `maxOutputTokens` (Google) or `max_tokens` (Anthropic,
 Mistral) in `modelOptions` to pin it per model.
-Mistral is capped (32,768 streaming / 16,384 non-streaming) despite publishing
-no low ceiling: a Mistral model can degenerate into restating its answer when
+Mistral is capped at 32,768 on every transport despite publishing no low
+ceiling: a Mistral model can degenerate into restating its answer when
 `format` and tools are combined, and an uncapped completion turns that into a
 multi-minute request. Override with `modelOptions: { mistral: { max_tokens } }`.
 OpenRouter varies by routed model; pass `max_tokens` via `modelOptions`
 when needed. A truncated response settles `status: "incomplete"` with
 `stopReason: "max_tokens"` and moves a fallback chain to its next entry;
-raise the limit or switch to `stream()`.
+raise the limit through `modelOptions`.
 
 ## See Also
 

package/skills/waf.md

@@ -26,6 +26,16 @@ new JaypieDistribution(this, "Dist", {
   waf: { name: "api", rateLimitPerIp: 500 },
 });
 
+// Exempt known source CIDRs (a partner's backfill server) from the per-IP
+// rate rule. Everyone else is still limited at perIp per 5 minutes.
+new JaypieDistribution(this, "Dist", {
+  handler,
+  waf: {
+    name: "api",
+    rateLimit: { exemptIps: ["203.0.113.10/32", "2001:db8::/48"], perIp: 2000 },
+  },
+});
+
 // Multiple distributions in one env — set a unique waf.name on each to
 // avoid WebACL/S3 bucket name collisions between stacks.
 new JaypieDistribution(this, "Api", { handler: api, waf: { name: "api" } });