@jaypie/mcp 0.8.41 → 0.8.43

package/dist/suites/docs/index.js

@@ -9,7 +9,7 @@ import { gt } from 'semver';
 /**
  * Docs Suite - Documentation services (skill, version, release_notes)
  */
-const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.41#6186c609"
+const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.43#947cd2b1"
     ;
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = path.dirname(__filename$1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.41",
+  "version": "0.8.43",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.50.md

@@ -0,0 +1,21 @@
+---
+version: 1.2.50
+date: 2026-04-18
+summary: JaypieEnvSecret shorthand now validates missing env vars instead of silently creating empty secrets
+---
+
+## Changes
+
+- `JaypieEnvSecret` detects shorthand by convention: a SCREAMING_SNAKE_CASE string (e.g., `MONGODB_URI`, `ANTHROPIC_API_KEY`) as the second constructor argument is treated as an `envKey`, even when the env var is not set at deploy time.
+- When shorthand is used without a backing env var, `value`, or `generateSecretString`, construction throws `ConfigurationError` instead of silently producing an empty secret.
+- Non-shorthand PascalCase ids (e.g., `TestSecret`, `ProjectSalt`) continue to behave as before.
+
+## Motivation
+
+The prior shorthand detection required `process.env[name]` to be a non-empty string. A missing env var fell through to the plain-id branch and produced a secret with no value, which surfaced only at runtime via `loadEnvSecrets`. The new convention-based detection keeps shorthand calls on the envKey validation path regardless of env state.
+
+## Migration
+
+- Consumers already setting env vars at deploy time see no change.
+- Stacks relying on the old silent behavior should pass `value` or `generateSecretString`, or set the expected env var.
+- Provider/consumer shorthand pairs now derive the same `EnvSecret_*` construct id on both sides, fixing a latent export-name mismatch when the env var was unset in the consumer environment.

package/release-notes/constructs/1.2.51.md

@@ -0,0 +1,22 @@
+---
+version: 1.2.51
+date: 2026-04-19
+summary: JaypieGitHubDeployRole grants ECR auth and push by default, scoped to <sponsor>-* repositories
+---
+
+## Changes
+
+- `JaypieGitHubDeployRole` grants `ecr:GetAuthorizationToken` on `*` and push actions (`ecr:BatchCheckLayerAvailability`, `ecr:BatchGetImage`, `ecr:CompleteLayerUpload`, `ecr:CreateRepository`, `ecr:DescribeRepositories`, `ecr:InitiateLayerUpload`, `ecr:PutImage`, `ecr:UploadLayerPart`) scoped to `arn:aws:ecr:*:<account>:repository/<sponsor>-*` by default.
+- Sponsor is resolved from `sponsor` prop, `PROJECT_SPONSOR`, or the organization parsed from `CDK_ENV_REPO` / `PROJECT_REPO` (same parse that produces the `repoRestriction`), keeping ECR scope aligned with the OIDC `sub` condition.
+- New `sponsor` and `ecr` props on `JaypieGitHubDeployRoleProps`. Set `ecr: false` to opt out.
+
+## Motivation
+
+Any project shipping a Docker artifact (ECS/Fargate, Lambda containers) needs ECR auth + push on the GitHub Actions deploy role. Previously every consumer had to extend the role downstream. Since `JaypieGitHubDeployRole` already constrains the OIDC `sub` to the organization's repos, granting ECR by default removes boilerplate without expanding the threat surface.
+
+## Migration
+
+- Consumers deploying from a sponsor-scoped monorepo (`<sponsor>-*`) see no change beyond new default permissions.
+- Consumers who previously extended the role for ECR can remove the inline statements.
+- To keep prior behavior with no ECR permissions, pass `ecr: false`.
+- If no sponsor can be resolved (no `sponsor` prop, `PROJECT_SPONSOR`, `CDK_ENV_REPO`, or `PROJECT_REPO`), construction throws `ConfigurationError`; set `ecr: false` to skip the check.

package/release-notes/mcp/0.8.42.md

@@ -0,0 +1,10 @@
+---
+version: 0.8.42
+date: 2026-04-18
+summary: Update secrets skill and add release notes for constructs 1.2.50
+---
+
+## Changes
+
+- Updates `skills/secrets.md` to document convention-based shorthand detection and the new missing-env `ConfigurationError`.
+- Adds release notes for `@jaypie/constructs` 1.2.50.

package/release-notes/mcp/0.8.43.md

@@ -0,0 +1,9 @@
+---
+version: 0.8.43
+date: 2026-04-19
+summary: Release notes for @jaypie/constructs 1.2.51 (ECR defaults on JaypieGitHubDeployRole)
+---
+
+## Changes
+
+- Adds release notes for `@jaypie/constructs` 1.2.51, which grants ECR auth + push permissions by default on `JaypieGitHubDeployRole`, scoped to `<sponsor>-*` repositories.

package/skills/secrets.md

@@ -34,9 +34,12 @@ new JaypieLambda(this, "Handler", {
 });
 ```
 
-When the construct ID matches an environment variable name, `JaypieEnvSecret` automatically:
-- Uses that env var's value as the secret content
-- Sets `envKey` to the ID for later reference
+When the construct ID is a SCREAMING_SNAKE_CASE string (or matches an environment variable name with a non-empty value), `JaypieEnvSecret` automatically:
+- Treats the ID as the `envKey`
+- Uses the env var's value as the secret content
+- Namespaces the CDK construct id as `EnvSecret_${envKey}`
+
+If the shorthand env var is missing at deploy time and no `value` or `generateSecretString` is provided, construction throws `ConfigurationError`. Supply a `value` or `generateSecretString` when the env var may be absent.
 
 ### CI/CD Setup