@jaypie/mcp 0.8.63 → 0.8.64

package/dist/suites/docs/index.js

@@ -9,7 +9,7 @@ import { gt } from 'semver';
 /**
  * Docs Suite - Documentation services (skill, version, release_notes)
  */
-const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.63#4149aed3"
+const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.64#0a1f765f"
     ;
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = path.dirname(__filename$1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.63",
+  "version": "0.8.64",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.59.md

@@ -0,0 +1,14 @@
+---
+version: 1.2.59
+date: 2026-06-03
+summary: Add JaypieSecret base construct and serviceTag on lambda constructs
+---
+
+## @jaypie/constructs 1.2.59
+
+### Features
+
+- **JaypieSecret**: New base construct — a plain AWS Secrets Manager secret without the environment-driven provider/consumer cross-stack pattern. Reads its value from `process.env[envKey]`, an explicit `value`, or `generateSecretString`, and throws `ConfigurationError` when an `envKey` resolves to nothing. Supports the same SCREAMING_SNAKE_CASE shorthand as `JaypieEnvSecret` (construct id `Secret_${envKey}`).
+- **JaypieEnvSecret** now extends `JaypieSecret`, layering the env-aware provider/consumer behavior on top via a `buildSecret` override. Existing behavior — including issue #347 cross-stack export names — is preserved. `JaypieEnvSecret` is deprecated and will be removed in 2.0.
+- **resolveSecrets / lambda `secrets`**: `SecretsArrayItem` widened to `JaypieSecret | string`, so any `JaypieSecret` (including `JaypieEnvSecret`) is accepted wherever secrets are passed. Strings still create env-aware `JaypieEnvSecret` instances.
+- **serviceTag**: `JaypieLambda` (and `JaypieExpressLambda`, `JaypieWebSocketLambda` by inheritance) accepts a `serviceTag` prop that applies `CDK.TAG.SERVICE` alongside `roleTag` and `vendorTag`. `JaypieQueuedLambda` propagates it to the SQS queue and `JaypieBucketQueuedLambda` to the S3 bucket.

package/skills/secrets.md

@@ -5,7 +5,30 @@ related: apikey, aws, cdk, variables
 
 # Secret Management
 
-Jaypie uses AWS Secrets Manager for secure credential storage. The `JaypieEnvSecret` construct creates secrets at deploy time from environment variables, and `getEnvSecret` retrieves them at runtime.
+Jaypie uses AWS Secrets Manager for secure credential storage. The `JaypieSecret` and `JaypieEnvSecret` constructs create secrets at deploy time from environment variables, and `getEnvSecret` retrieves them at runtime.
+
+## JaypieSecret vs JaypieEnvSecret
+
+- **`JaypieSecret`** — a plain secret. Always creates a secret in the current stack from `process.env[envKey]`, an explicit `value`, or `generateSecretString`. No cross-stack imports or exports. This is the construct to reach for.
+- **`JaypieEnvSecret`** — extends `JaypieSecret` and adds the environment-driven provider/consumer cross-stack pattern (see [Provider/Consumer Pattern](#providerconsumer-pattern) below). **Deprecated; will be removed in 2.0.**
+
+`JaypieEnvSecret` is a `JaypieSecret`, so it is accepted anywhere a `JaypieSecret` is — including the `secrets` array on `JaypieLambda`. Strings in that array still create env-aware `JaypieEnvSecret` instances.
+
+```typescript
+import { JaypieSecret } from "@jaypie/constructs";
+
+// Reads process.env.MY_API_KEY at deploy time
+// Throws ConfigurationError if unset and no value/generateSecretString given
+new JaypieSecret(this, "MY_API_KEY");
+
+// Generated secret, no env var needed
+new JaypieSecret(this, "DbPassword", {
+  envKey: "DB_PASSWORD",
+  generateSecretString: { excludePunctuation: true, passwordLength: 32 },
+});
+```
+
+Everything below that uses `JaypieEnvSecret` works the same on `JaypieSecret`, except the provider/consumer cross-stack behavior, which is `JaypieEnvSecret`-only.
 
 ## The Pattern