@jaypie/mcp 0.8.38 → 0.8.40

package/dist/suites/docs/index.js

@@ -9,7 +9,7 @@ import { gt } from 'semver';
 /**
  * Docs Suite - Documentation services (skill, version, release_notes)
  */
-const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.38#ff8c48d7"
+const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.40#d3b7b298"
     ;
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = path.dirname(__filename$1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.38",
+  "version": "0.8.40",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.48.md

@@ -0,0 +1,17 @@
+---
+version: 1.2.48
+date: 2026-04-17
+summary: Add managedRuleScopeDowns to JaypieWafConfig
+---
+
+## Changes
+
+- `JaypieDistribution` WAF config now accepts `managedRuleScopeDowns?: Record<string, CfnWebACL.StatementProperty>`, allowing any managed rule group to be narrowed to a specific URL pattern (or any other WAFv2 statement shape).
+- Keyed by managed rule group name, parallel to `managedRuleOverrides`.
+- Use case: scope `AWSManagedRulesCommonRuleSet` away from `/chat` paths so large chat request bodies don't collide with `SizeRestrictions_BODY` without weakening protection globally.
+
+## Skills
+
+- ~cdk — WAF section adds a `managedRuleScopeDowns` example alongside the existing `managedRuleOverrides` one.
+
+Closes #306.

package/release-notes/constructs/1.2.49.md

@@ -0,0 +1,23 @@
+---
+version: 1.2.49
+date: 2026-04-18
+summary: Consolidate JaypieHostedZone Route53 query log resource policy into a single stack-level singleton
+---
+
+## Changes
+
+- `JaypieHostedZone` no longer creates a per-zone `AWS::Logs::ResourcePolicy`. A single stack-level `CfnResourcePolicy` with a wildcard resource ARN (`arn:<partition>:logs:<region>:<account>:log-group:/aws/route53/*:*`) now grants Route53 permission to write query logs to every zone in the stack.
+- New `queryLoggingPolicy?: boolean` prop (default `true`). Set to `false` to skip the managed policy when provisioning an account-wide policy externally (useful for accounts with many small stacks each owning a hosted zone).
+- New `ensureRoute53QueryLoggingPolicy(scope)` helper exported from `@jaypie/constructs` for custom constructs that need the same stack-level singleton.
+
+## Motivation
+
+CloudWatch Logs enforces a 10-resource-policy-per-region account quota. The previous per-zone `grantWrite` call produced one policy per zone, so the 11th zone in a region failed to deploy with `ServiceLimitExceeded`.
+
+## Deploy Caveats
+
+- **Under the limit (< 10 zones per stack)**: CloudFormation swaps N per-zone policies for 1 consolidated policy on next deploy. A brief gap in Route53 query-log permissions is possible during the change window.
+- **At or past the 10-per-region limit**: CloudFormation does not guarantee delete-before-create across unrelated logical IDs. Creating the new consolidated policy may fail while the legacy per-zone policies still exist. Before deploying, manually delete one or more legacy `/aws/route53/*` resource policies to create headroom, then deploy.
+- **Many small stacks (1 zone each)**: The stack-level singleton still yields N policies across N stacks. Set `queryLoggingPolicy: false` on every zone and manage one account-wide policy externally.
+
+Closes #311.

package/release-notes/express/1.2.22.md

@@ -0,0 +1,25 @@
+---
+version: 1.2.22
+date: 2026-04-17
+summary: Add fabricApiResponse helper and expressHandler fabric option
+---
+
+## Changes
+
+- New export `fabricApiResponse(value)` wraps a value in the canonical Jaypie API envelope:
+  - `null` / `undefined` → `{ data: null }`
+  - `{ data }` with exactly one key → passthrough
+  - `{ errors }` with exactly one key → passthrough
+  - anything else (including `{ data, other }`) → `{ data: value }`
+- New `expressHandler` option `{ fabric: true }` applies `fabricApiResponse` to the handler's return value before `res.json()`, removing the `apiResponse(await service())` boilerplate.
+
+## Why
+
+The `skill("api")` envelope contract says a response contains either `data` or `errors`, never both, and no other top-level keys. The helper and handler option make conforming to that contract the easy path.
+
+## Skills
+
+- ~express — Handler Options block documents the new `fabric` flag; new "fabricApiResponse and `{ fabric: true }`" section covers the helper and wrap rules.
+- ~handlers — Express handler example now shows `{ fabric: true }` as the recommended envelope path.
+
+Closes #309.

package/release-notes/fabric/0.3.2.md

@@ -0,0 +1,23 @@
+---
+version: 0.3.2
+date: 2026-04-17
+summary: fabricExpress integrates expressHandler lifecycle
+---
+
+## Changes
+
+- `FabricExpressConfig` now accepts the full set of `expressHandler` lifecycle options: `chaos`, `locals`, `name`, `secrets`, `setup`, `teardown`, `unavailable`, `validate`.
+- `fabricExpress` wraps the inner middleware with `expressHandler` so per-request lifecycle (secrets loading, setup/teardown, validate, unavailable, locals, observability) runs automatically — matching `fabricLambda` / `fabricWebSocket` adapter patterns.
+- Inner middleware still calls `res.json` / `res.status` / `res.send` directly; `expressHandler` captures these as illegal calls and replays them after postprocess, preserving existing envelope and 405/204 behavior.
+
+## Peer dependencies
+
+- Adds `@jaypie/express` as an optional peer dependency (alongside `@jaypie/lambda`).
+
+## Why
+
+Previously `fabricExpress` was a plain middleware — an asymmetry with `fabricLambda` (wraps `lambdaHandler`) and `fabricWebSocket` (wraps `websocketHandler`). Consumers had to stack `expressHandler(fabricExpress(...))` themselves to get lifecycle, defeating convenience. This change makes lifecycle the default.
+
+## Skills
+
+- ~fabric — Adapters section adds an Express Middleware example covering `fabricHttp` + `fabricExpress` + `FabricRouter`, including lifecycle pass-through.

package/release-notes/jaypie/1.2.40.md

@@ -0,0 +1,11 @@
+---
+version: 1.2.40
+date: 2026-04-17
+summary: Bump @jaypie/express and @jaypie/llm deps
+---
+
+## Changes
+
+- Dependency bumps:
+  - `@jaypie/express` ^1.2.21 → ^1.2.22 (`fabricApiResponse` helper, `{ fabric: true }` handler option)
+  - `@jaypie/llm` ^1.2.28 → ^1.2.29 (peer; xAI retries transient ingest-bytes 400s)

package/release-notes/llm/1.2.29.md

@@ -0,0 +1,16 @@
+---
+version: 1.2.29
+date: 2026-04-17
+summary: xAI adapter retries transient "failed to ingest inline file bytes" 400s
+---
+
+## Changes
+
+- `XaiAdapter` now overrides `classifyError` to mark HTTP 400 responses whose message contains `"failed to ingest inline file bytes"` as retryable. The existing exponential-backoff retry loop then retries them (same pattern as transient-network retries).
+- Unrelated `BadRequestError`s remain non-retryable — they fall through to the parent OpenAI-compatible classifier.
+
+## Why
+
+xAI's media-ingest service enters a bad state after ~12 consecutive file-bearing calls and self-clears after a short pause. Previously these 400s were terminal, losing all downstream work in a batch; they're now transparently retried.
+
+Closes #301.

package/release-notes/mcp/0.8.39.md

@@ -0,0 +1,23 @@
+---
+version: 0.8.39
+date: 2026-04-17
+summary: Add release notes for the #301/#306/#309 + fabricExpress lifecycle batch
+---
+
+## Changes
+
+Added release notes for:
+
+- `@jaypie/constructs@1.2.48` (#306 — WAF scopeDownStatement)
+- `@jaypie/express@1.2.22` (#309 — fabricApiResponse + fabric option)
+- `@jaypie/fabric@0.3.2` (fabricExpress wraps expressHandler)
+- `@jaypie/llm@1.2.29` (#301 — xAI ingest-bytes retry)
+- `@jaypie/testkit@1.2.35` (mock fabricApiResponse)
+- `jaypie@1.2.40` (dependency bumps)
+
+## Skills updated
+
+- ~cdk — WAF section adds `managedRuleScopeDowns` example.
+- ~express — documents `fabric` option and `fabricApiResponse` helper.
+- ~fabric — Adapters section adds Express Middleware / FabricRouter example with lifecycle pass-through.
+- ~handlers — Express handler example uses `{ fabric: true }`.

package/release-notes/mcp/0.8.40.md

@@ -0,0 +1,9 @@
+---
+version: 0.8.40
+date: 2026-04-18
+summary: Include @jaypie/constructs 1.2.49 release notes
+---
+
+## Changes
+
+- Adds release notes for `@jaypie/constructs` 1.2.49 (consolidated Route53 query log resource policy).

package/release-notes/testkit/1.2.35.md

@@ -0,0 +1,9 @@
+---
+version: 1.2.35
+date: 2026-04-17
+summary: Mock fabricApiResponse from @jaypie/express
+---
+
+## Changes
+
+- Added a mock for `fabricApiResponse` (new export in `@jaypie/express@1.2.22`) so consumers get a wrapped mock via `@jaypie/testkit/mock` alongside `cors`, `expressHandler`, etc.

package/skills/cdk.md

@@ -359,6 +359,31 @@ new JaypieDistribution(this, "Dist", {
     },
   },
 });
+
+// Scope a managed rule group to (or away from) specific URL patterns
+new JaypieDistribution(this, "Dist", {
+  handler,
+  waf: {
+    name: "api",
+    managedRuleScopeDowns: {
+      // Only run the CommonRuleSet for paths OTHER than /chat — lets /chat
+      // handle large AI-generated request bodies without weakening protection
+      // elsewhere.
+      AWSManagedRulesCommonRuleSet: {
+        notStatement: {
+          statement: {
+            byteMatchStatement: {
+              fieldToMatch: { uriPath: {} },
+              positionalConstraint: "STARTS_WITH",
+              searchString: "/chat",
+              textTransformations: [{ priority: 0, type: "NONE" }],
+            },
+          },
+        },
+      },
+    },
+  },
+});
 ```
 
 Cost: $5/month per WebACL + $1/month per rule + $0.60 per million requests. Use `waf: false` to opt out.

package/skills/express.md

@@ -46,8 +46,10 @@ app.get("/api/users", expressHandler(async (req, res) => {
 
 ```typescript
 expressHandler(handler, {
+  fabric: false,     // Wrap return with fabricApiResponse before res.json (default false)
   locals: {},        // Values passed to res.locals
   name: "handler",   // Handler name for logging
+  secrets: [],       // AWS Secrets names to load into process.env
   setup: async (req, res) => {},    // Pre-handler setup
   teardown: async (req, res) => {}, // Post-handler cleanup
   unavailable: false, // Return 503 immediately if true
@@ -55,6 +57,29 @@ expressHandler(handler, {
 });
 ```
 
+### fabricApiResponse and `{ fabric: true }`
+
+Return plain domain objects and opt into the canonical Jaypie API envelope:
+
+```typescript
+import { expressHandler, fabricApiResponse } from "jaypie";
+
+// Handler option — wraps the return value automatically
+app.get(
+  "/ping",
+  expressHandler(async (req) => ping(req.query), { fabric: true }),
+);
+
+// Standalone helper — same rules as `{ fabric: true }`
+fabricApiResponse({ id: "1" });        // { data: { id: "1" } }
+fabricApiResponse([{ id: "1" }]);      // { data: [{ id: "1" }] }
+fabricApiResponse({ data: {...} });    // passthrough
+fabricApiResponse({ errors: [...] });  // passthrough
+fabricApiResponse(null);               // { data: null }
+```
+
+Wrap rules: only `{ data }` alone or `{ errors }` alone pass through. Anything else (including `{ data, other }`) gets wrapped as `{ data: value }`.
+
 ## Lambda Adapter
 
 Convert Express apps to Lambda handlers:

package/skills/fabric.md

@@ -77,6 +77,37 @@ const tools = [fabricLlmTool(greetService)];
 // Available to LLM as function call
 ```
 
+### Express Middleware
+
+```typescript
+import { fabricHttp } from "@jaypie/fabric/http";
+import { fabricExpress, FabricRouter } from "@jaypie/fabric/express";
+
+// Wrap service with fabricHttp first (HTTP context + default input transform)
+const greetHttp = fabricHttp({ service: greetService });
+
+// Single-route middleware — alias becomes default path ("/greet")
+app.get("/greet", fabricExpress({ service: greetHttp }));
+
+// Lifecycle pass-through (forwarded to expressHandler): secrets, setup,
+// teardown, validate, unavailable, locals, name, chaos
+app.post(
+  "/records",
+  fabricExpress({
+    service: recordsHttp,
+    secrets: ["MONGODB_URI"],
+    setup: async (req) => { /* ... */ },
+  }),
+);
+
+// Multi-service router — alias-derived paths under a prefix
+app.use(FabricRouter({ services: [greetHttp, searchHttp], prefix: "/api" }));
+```
+
+`fabricExpress` wraps the middleware with `expressHandler` internally, so
+per-route lifecycle and observability come along for the ride (parallel to
+`fabricLambda` → `lambdaHandler` and `fabricWebSocket` → `websocketHandler`).
+
 ## Service Suites
 
 Group related services:

package/skills/handlers.md

@@ -90,6 +90,13 @@ app.get("/api/users", expressHandler(async (req, res) => {
   return { users: [] };
 }));
 
+// Return plain domain objects and let `{ fabric: true }` apply the
+// canonical Jaypie `{ data }` envelope automatically.
+app.get(
+  "/ping",
+  expressHandler(async (req) => ping(req.query), { fabric: true }),
+);
+
 // Convert Express app to Lambda
 export const handler = createLambdaHandler(app);
 ```