@jaypie/mcp 0.8.56 → 0.8.58

package/dist/suites/docs/index.js

@@ -9,7 +9,7 @@ import { gt } from 'semver';
 /**
  * Docs Suite - Documentation services (skill, version, release_notes)
  */
-const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.56#4233ad47"
+const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.58#340296a3"
     ;
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = path.dirname(__filename$1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.56",
+  "version": "0.8.58",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.54.md

@@ -0,0 +1,19 @@
+---
+version: 1.2.54
+date: 2026-05-10
+summary: JaypieMigration grants control-plane DynamoDB perms scoped to passed tables (issue #339)
+---
+
+## Changes
+
+- `JaypieMigration` now grants control-plane DynamoDB actions (`DescribeContinuousBackups`, `DescribeTable`, `DescribeTimeToLive`, `UpdateContinuousBackups`, `UpdateTable`, `UpdateTimeToLive`) on the ARNs of any tables passed via `tables`, scoped to the table ARN and its indexes (`/index/*`). Data-plane access is unchanged.
+
+## Motivation
+
+The migration Lambda was previously granted only data-plane access via `grantReadWriteData`. Migrations whose entire purpose is to evolve table shape (add a GSI, change TTL, toggle streams, update backups) `AccessDenied` on the first control-plane call. Combined with `lambdaHandler`'s default soft-fail, the deploy reported `CREATE_COMPLETE` while later migrations silently never ran.
+
+Pair this with the new `migrationHandler` in `@jaypie/lambda` (1.2.6) for end-to-end loud-fail behavior.
+
+## Migration
+
+No action required. Existing migrations using only data-plane ops keep working; migrations that previously failed with `AccessDeniedException` on `dynamodb:DescribeTable` or `dynamodb:UpdateTable` should now succeed.

package/release-notes/constructs/1.2.55.md

@@ -0,0 +1,45 @@
+---
+version: 1.2.55
+date: 2026-05-10
+summary: JaypieMigration `timeout` prop default 15m (#341); JaypieDistribution `waf.allow` path-scoped relaxations (#342)
+---
+
+## Changes
+
+### `JaypieMigration` — `timeout` prop, default 15 minutes (#341)
+
+- `JaypieMigrationProps` accepts an optional `timeout?: cdk.Duration` that is forwarded to the inner `JaypieLambda`.
+- The default migration Lambda timeout is now **15 minutes** (Lambda's maximum), up from 5 minutes.
+
+### `JaypieDistribution` — `waf.allow` (#342)
+
+- New `waf.allow` field accepts an entry (or array of entries) shaped `{ path, AWSManagedRulesCommonRuleSet: [...], AWSManagedRulesKnownBadInputsRuleSet: [...], ... }`. Each entry flips the named sub-rules from `block` to `count` **only** on requests matching its path set; strict default action is preserved everywhere else.
+- `path` accepts a string or string[]. Trailing `*` becomes WAFv2 `STARTS_WITH`; no trailing `*` becomes `EXACTLY`. Multiple paths in one entry are OR'd.
+- Each managed-rule-group key accepts a string or string[] of sub-rule names.
+- `waf.allow` composes with `waf.managedRuleOverrides`: the baseline override list applies to both the relaxed and strict emissions of a group; `allow` further relaxes specific (path × sub-rule) intersections. Groups not named in `allow` keep their existing single-rule emission.
+
+```ts
+waf: {
+  allow: [
+    {
+      path: "/hooks/*",
+      AWSManagedRulesCommonRuleSet: ["ExploitablePaths_URIPATH"],
+      AWSManagedRulesKnownBadInputsRuleSet: ["CrossSiteScripting_BODY"],
+    },
+  ],
+}
+```
+
+## Motivation
+
+### `JaypieMigration` timeout
+
+Real-world DynamoDB migrations the construct exists to support routinely exceed five minutes: first-time GSI creation commonly takes 3–10 minutes to reach `ACTIVE`, and a backfill that scans and rewrites entities after the GSI is ready adds more. The previous 5-minute hard cap left no headroom; CloudFormation rolled back even when the underlying operation would have completed.
+
+### `waf.allow`
+
+Webhook ingress paths (Datadog, GitHub, Slack, Jira) legitimately trip body- and URI-inspection rules in `AWSManagedRulesCommonRuleSet` / `AWSManagedRulesKnownBadInputsRuleSet`, while the rest of the API should keep full blocking. The previous escape hatch — distribution-wide `managedRuleOverrides` — weakened protection on every path on the host. `waf.allow` confines the relaxation to the listed paths.
+
+## Migration
+
+No action required. `JaypieMigration` callers that previously relied on the 5-minute default still complete in well under 15 minutes; callers that want to keep 5 minutes can pass `timeout: Duration.minutes(5)` explicitly. `waf.allow` is opt-in — distributions that don't pass it keep their previous WebACL exactly.

package/release-notes/jaypie/1.2.46.md

@@ -0,0 +1,13 @@
+---
+version: 1.2.46
+date: 2026-05-10
+summary: Re-export migrationHandler from @jaypie/lambda (issue #339)
+---
+
+## Changes
+
+- Re-exports `migrationHandler` from `@jaypie/lambda` 1.2.6.
+
+## Motivation
+
+Migration Lambdas should fail loudly so a failed migration fails the deploy. Use `migrationHandler` instead of `lambdaHandler` in migration entrypoints — see the migrations skill for usage.

package/release-notes/jaypie/1.2.47.md

@@ -0,0 +1,9 @@
+---
+version: 1.2.47
+date: 2026-05-10
+summary: Bump @jaypie/llm to 1.2.34 for retry-executor sibling-rejection fix (issue #336)
+---
+
+## Changes
+
+- Bumps the `@jaypie/llm` peer dependency to `^1.2.34` so the retry executor no longer crashes the host when an upstream SDK surfaces twin rejections of an already-handled error.

package/release-notes/lambda/1.2.6.md

@@ -0,0 +1,27 @@
+---
+version: 1.2.6
+date: 2026-05-10
+summary: Add migrationHandler that defaults throw: true so failed migrations fail the deploy (issue #339)
+---
+
+## Changes
+
+- New `migrationHandler` export. Wraps `lambdaHandler` with `throw: true` defaulted so a thrown error propagates out of the Lambda, causing the CFN custom resource (and the deploy) to fail loudly instead of swallowing the error and reporting `CREATE_COMPLETE`.
+- Re-exported by `jaypie` and mocked by `@jaypie/testkit/mock`.
+- Pass `{ throw: false }` to opt back into the soft-fail behavior.
+
+## Motivation
+
+`JaypieMigration` runs its Lambda via a CFN custom resource provider. With `lambdaHandler`'s default `throw: false`, a thrown migration error was caught, logged as `fatal`, and returned as a successful response — CFN saw a 200-shaped response and marked the resource `CREATE_COMPLETE`. The deploy turned green while later migrations silently never ran.
+
+## Migration
+
+Update migration entry points from `lambdaHandler` to `migrationHandler`:
+
+```typescript
+import { migrationHandler } from "jaypie";
+
+export const handler = migrationHandler(async (event) => {
+  // migration logic
+});
+```

package/release-notes/llm/1.2.34.md

@@ -0,0 +1,18 @@
+---
+version: 1.2.34
+date: 2026-05-10
+summary: Retry executor swallows sibling rejections of already-handled upstream errors (issue #336)
+---
+
+## Changes
+
+- New shared `createStaleRejectionGuard` helper records errors that the retry layer has caught and recognizes sibling unhandled rejections by reference *or* by `name + message`. When a sibling fires, the guard attaches a `.catch()` to the dangling promise so it is no longer treated as unhandled.
+- `RetryExecutor` and `StreamLoop` both consume the shared guard. Transient socket teardown errors (`TypeError: terminated`, `ECONNRESET`, etc.) continue to be suppressed exactly as before.
+
+## Motivation
+
+Provider SDKs occasionally surface a single upstream failure as twin promise rejections. The retry layer catches and handles the first; the second arrives on a later microtask and escaped the previous guard because that guard only matched a fixed set of transient-network patterns. A real example: OpenRouter's `matchers.js` does `JSON.parse("")` and throws `SyntaxError: Unexpected end of JSON input`. The retry executor caught it and was sleeping before the next attempt when the sibling rejection killed the host process — many hours into a long evaluation run.
+
+## Migration
+
+No action required. The new guard is strictly more permissive than the old one — it swallows the same transient-network rejections plus any rejection whose error matches one the retry loop has already caught. Unrelated rejections are unaffected.

package/release-notes/mcp/0.8.57.md

@@ -0,0 +1,9 @@
+---
+version: 0.8.57
+date: 2026-05-10
+summary: Migrations skill recommends migrationHandler and documents control-plane perms (issue #339)
+---
+
+## Changes
+
+- `skill("migrations")` now recommends `migrationHandler` for the Lambda entrypoint and documents the control-plane DynamoDB permissions added by `JaypieMigration` 1.2.54.

package/release-notes/mcp/0.8.58.md

@@ -0,0 +1,9 @@
+---
+version: 0.8.58
+date: 2026-05-10
+summary: Release notes for @jaypie/constructs 1.2.55 and @jaypie/llm 1.2.34
+---
+
+## Changes
+
+- Adds release notes for `@jaypie/constructs` 1.2.55 (`JaypieMigration` `timeout` prop default 15 minutes — issue #341; `JaypieDistribution` `waf.allow` path-scoped relaxations — issue #342) and `@jaypie/llm` 1.2.34 (retry executor swallows sibling rejections — issue #336), plus the corresponding `jaypie` 1.2.47 dependency bump.

package/release-notes/testkit/1.2.37.md

@@ -0,0 +1,9 @@
+---
+version: 1.2.37
+date: 2026-05-10
+summary: Mock migrationHandler from @jaypie/lambda (issue #339)
+---
+
+## Changes
+
+- Adds `migrationHandler` mock that mirrors the real handler — defaults `throw: true` so thrown errors surface in tests.

package/skills/migrations.md

@@ -44,16 +44,18 @@ new JaypieMigration(this, "SeedData", {
 - **Role**: Tagged as `CDK.ROLE.PROCESSING`
 - **Execution**: Runs on every deploy via CloudFormation custom resource (uses a deploy nonce to force re-invocation even when only Lambda code changes)
 - **Dependencies**: Use `dependencies` to ensure tables and other resources exist before the migration executes
+- **Permissions**: Tables passed via `tables` get data-plane (`grantReadWriteData`) plus control-plane access (`DescribeTable`, `UpdateTable`, `UpdateTimeToLive`, `UpdateContinuousBackups`) scoped to the table ARN and its indexes — migrations that add GSIs, toggle TTL, or change backups work without extra IAM
 
 ## Migration Lambda Handler
 
-The migration Lambda receives a CloudFormation custom resource event. Return a result to signal success; throw to signal failure and roll back the stack.
+The migration Lambda receives a CloudFormation custom resource event. Use `migrationHandler` so a thrown error fails the CFN custom resource (and the deploy) — `lambdaHandler`'s default `throw: false` returns a success-shaped response on error and CFN reports `CREATE_COMPLETE` even when the migration failed.
 
 ```typescript
 // src/migrations/seed/index.ts
 import { initClient, seedEntities, APEX } from "@jaypie/dynamodb";
+import { migrationHandler } from "jaypie";
 
-export const handler = async (event: any) => {
+export const handler = migrationHandler(async (event) => {
   await initClient();
 
   await seedEntities([
@@ -62,9 +64,11 @@ export const handler = async (event: any) => {
   ]);
 
   return { status: "complete" };
-};
+});
 ```
 
+`migrationHandler` is `lambdaHandler` with `throw: true` defaulted. Pass `{ throw: false }` to opt back into soft-fail behavior.
+
 ## Building Migration Code
 
 Bundle migrations separately using esbuild, then reference the output directory: