@jaypie/mcp 0.8.52 → 0.8.54

package/dist/suites/docs/index.js

@@ -9,7 +9,7 @@ import { gt } from 'semver';
 /**
  * Docs Suite - Documentation services (skill, version, release_notes)
  */
-const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.52#704908ba"
+const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.54#ff24b05a"
     ;
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = path.dirname(__filename$1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.52",
+  "version": "0.8.54",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.52.md

@@ -0,0 +1,25 @@
+---
+version: 1.2.52
+date: 2026-05-06
+summary: JaypieWebDeploymentBucket adopts JaypieDistribution defaults — security headers, WAF, and CloudFront access logging
+---
+
+## Changes
+
+- `JaypieWebDeploymentBucket` now applies the same default security `ResponseHeadersPolicy` as `JaypieDistribution` (HSTS, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy, Cross-Origin-* headers, Server header removal). Attached to the default behavior and the production `/*` behavior.
+- Adds `securityHeaders` (`boolean | SecurityHeadersOverrides`) and `responseHeadersPolicy` (full override) props matching `JaypieDistribution`'s shape.
+- Adds CloudFront access logging by default — creates a log bucket with Datadog forwarding. New `logBucket` and `destination` props mirror `JaypieDistribution`.
+- Adds WAFv2 WebACL by default with `AWSManagedRulesCommonRuleSet`, `AWSManagedRulesKnownBadInputsRuleSet`, and IP rate limiting (2000/5min). New `waf` prop accepts `boolean | JaypieWebDeploymentBucketWafConfig`.
+- WAF defaults to namespacing the WebACL and WAF log bucket with the construct id, so multiple `JaypieWebDeploymentBucket` (or paired `JaypieDistribution`) instances coexist in one stack without name collisions.
+- `host` widened to `string | HostConfig` on `JaypieWebDeploymentBucket` and `JaypieStaticWebBucket`, matching `JaypieDistribution` / `JaypieApiGateway` / `JaypieWebSocket`. HostConfig values are resolved via `envHostname()`.
+- Exposes `logBucket`, `responseHeadersPolicy`, `wafLogBucket`, and `webAcl` as public readonly properties.
+
+## Motivation
+
+`JaypieDistribution` ships with sensible defaults for security headers, WAF, and access logging. Static-site deployments fronted by `JaypieWebDeploymentBucket` deserve the same baseline rather than having to compose two constructs by hand.
+
+## Migration
+
+- Existing `JaypieWebDeploymentBucket` users pick up new AWS resources on next deploy: a CloudFront access-log bucket, a WAFv2 WebACL, and a WAF log bucket. There is ongoing AWS cost (WAF + S3 storage). Opt out per feature with `securityHeaders: false`, `waf: false`, `destination: false`, or `logBucket: <existing>`.
+- Custom security headers: pass `securityHeaders: { contentSecurityPolicy, frameOption, ... }` or a full `responseHeadersPolicy`.
+- Custom WAF: `waf: { name: "static", rateLimitPerIp: 500 }` or `waf: { webAclArn: "arn:..." }` to attach an existing WebACL.

package/release-notes/dynamodb/0.6.1.md

@@ -0,0 +1,20 @@
+---
+version: 0.6.1
+date: 2026-05-02
+summary: Auto-serialize Date instances to ISO 8601 strings on write so entities with Date-typed fields no longer crash the marshaller
+---
+
+## Fixed
+
+- **Date values on entities**. `createEntity`, `updateEntity`, `deleteEntity`,
+  `archiveEntity`, `transactWriteEntities`, and `seedEntities` would throw
+  `Unsupported type passed: ...` from `@aws-sdk/util-dynamodb` whenever a
+  field held a `Date` instance — even though Jaypie entity timestamp types
+  are typed `Date | null`. The fix: `indexEntity` now walks the entity (top
+  level, nested objects, arrays) and converts any `Date` to
+  `value.toISOString()` before timestamps and GSI keys are populated.
+
+  Reads still return ISO strings, not `Date` instances. If you want a
+  `Date` back, hydrate at the boundary (`new Date(entity.expiresAt)`).
+
+  Issue: [#331](https://github.com/finlaysonstudio/jaypie/issues/331)

package/release-notes/eslint/1.2.4.md

@@ -0,0 +1,22 @@
+---
+version: 1.2.4
+date: 2026-05-06
+summary: Fix TypeScript resolver — switch from legacy import-x/resolver to resolver-next so eslint-import-resolver-typescript v4 (interfaceVersion 3) loads cleanly
+---
+
+## Changes
+
+- `jaypie:typescriptRecommended` now sets `import-x/resolver-next: [createTypeScriptImportResolver()]` and clears the legacy `import-x/resolver` entry inherited from `importxFlatConfigs.typescript`.
+
+## Motivation
+
+`eslint-plugin-import-x@4.16.2` validates legacy resolvers via `interfaceVersion === 2`, but `eslint-import-resolver-typescript@4.4.4` exposes `interfaceVersion: 3`. The legacy form (`'import-x/resolver': { typescript: true }`) inherited from the plugin's bundled flat config therefore failed validation, and every `.ts`/`.tsx` file produced `Resolve error: typescript with invalid interface loaded as resolver` plus cascading `import-x/no-unresolved` errors.
+
+The v3-compatible path is `import-x/resolver-next`, which accepts modern resolvers via the resolver factory.
+
+## Migration
+
+- No consumer changes required. Re-export `@jaypie/eslint` as before.
+- Downstream workarounds that overrode `import-x/resolver-next` can be removed.
+
+Fixes #333.

package/release-notes/mcp/0.8.54.md

@@ -0,0 +1,11 @@
+---
+version: 0.8.54
+date: 2026-05-06
+summary: Update web skill for JaypieWebDeploymentBucket defaults; ship release notes for @jaypie/constructs 1.2.52 and @jaypie/eslint 1.2.4
+---
+
+## Changes
+
+- Updated `skill("web")` props table and added Security Headers / WAF / Access Logging sections covering `JaypieWebDeploymentBucket`'s new defaults and override mechanisms (`securityHeaders`, `responseHeadersPolicy`, `waf`, `logBucket`, `destination`).
+- Mirrors the `JaypieDistribution` patterns documented in `skill("cdk")` so static-site and dynamic-origin guidance stay aligned.
+- Added release notes for `@jaypie/constructs` 1.2.52 and `@jaypie/eslint` 1.2.4 (#333).

package/skills/web.md

@@ -35,11 +35,16 @@ new JaypieWebDeploymentBucket(this, "Web", {
 
 | Prop | Type | Default |
 |------|------|---------|
-| `host` | `string` | `mergeDomain(CDK_ENV_WEB_SUBDOMAIN, CDK_ENV_WEB_HOSTED_ZONE \|\| CDK_ENV_HOSTED_ZONE)` |
+| `host` | `string \| HostConfig` | `mergeDomain(CDK_ENV_WEB_SUBDOMAIN, CDK_ENV_WEB_HOSTED_ZONE \|\| CDK_ENV_HOSTED_ZONE)` — `HostConfig` is resolved via `envHostname()` |
 | `zone` | `string \| IHostedZone \| JaypieHostedZone` | `CDK_ENV_WEB_HOSTED_ZONE \|\| CDK_ENV_HOSTED_ZONE` |
 | `certificate` | `boolean \| ICertificate` | `true` (creates via `resolveCertificate`) |
+| `destination` | `LambdaDestination \| boolean` | `true` (Datadog forwarder for access-log bucket notifications) |
+| `logBucket` | `IBucket \| string \| { exportName } \| true` | undefined — creates a new bucket if `destination !== false` |
 | `name` | `string` | `constructEnvName("web")` |
+| `responseHeadersPolicy` | `IResponseHeadersPolicy` | undefined — full override; bypasses default security headers |
 | `roleTag` | `string` | `CDK.ROLE.HOSTING` |
+| `securityHeaders` | `boolean \| SecurityHeadersOverrides` | `true` |
+| `waf` | `boolean \| JaypieWebDeploymentBucketWafConfig` | `true` (WAF name defaults to construct id) |
 
 Also accepts all `s3.BucketProps` — the bucket defaults to `autoDeleteObjects: true`, `publicReadAccess: true`, `websiteIndexDocument: "index.html"`, `websiteErrorDocument: "index.html"` (SPA-friendly).
 
@@ -47,6 +52,52 @@ Also accepts all `s3.BucketProps` — the bucket defaults to `autoDeleteObjects:
 
 - Default behavior: S3 static website origin, `REDIRECT_TO_HTTPS`, `CACHING_DISABLED`.
 - In production (`isProductionEnv()`), a second behavior on `/*` enables `CACHING_OPTIMIZED` — `index.html` stays uncached so SPA deploys are visible immediately; hashed assets get edge cache.
+- Access logs land in a CloudFront log bucket with Datadog forwarding by default. Set `destination: false` to skip notifications, or pass `logBucket: <existing>` to reuse a bucket.
+
+### Security Headers
+
+Same defaults as `JaypieDistribution`: HSTS, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy, Cross-Origin-* headers, and Server header removal (applied via a `ResponseHeadersPolicy` on the default behavior and the production `/*` behavior). Override the same way:
+
+```typescript
+// Disable
+new JaypieWebDeploymentBucket(this, "Web", { host, zone, securityHeaders: false });
+
+// Override specific headers
+new JaypieWebDeploymentBucket(this, "Web", {
+  host, zone,
+  securityHeaders: {
+    contentSecurityPolicy: "default-src 'self';",
+    frameOption: HeadersFrameOption.SAMEORIGIN,
+  },
+});
+
+// Full custom policy
+new JaypieWebDeploymentBucket(this, "Web", { host, zone, responseHeadersPolicy: myPolicy });
+```
+
+### WAF
+
+Same defaults as `JaypieDistribution` (AWSManagedRulesCommonRuleSet, AWSManagedRulesKnownBadInputsRuleSet, IP rate limit 2000/5min, WAF logging to S3 with Datadog forwarding). The WebACL and WAF log bucket are namespaced with the construct id by default so multiple instances coexist without collision:
+
+```typescript
+// Default — WAF named after construct id ("MyWeb-WebAcl")
+new JaypieWebDeploymentBucket(this, "MyWeb", { host, zone });
+
+// Disable
+new JaypieWebDeploymentBucket(this, "Web", { host, zone, waf: false });
+
+// Custom name + rate limit
+new JaypieWebDeploymentBucket(this, "Web", {
+  host, zone,
+  waf: { name: "static", rateLimitPerIp: 500 },
+});
+
+// Existing WebACL
+new JaypieWebDeploymentBucket(this, "Web", {
+  host, zone,
+  waf: { webAclArn: "arn:aws:wafv2:..." },
+});
+```
 
 ### DNS