ampless 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/index.d.ts

@@ -17,12 +17,20 @@ type SiteSettingsEventType = 'site.settings.updated';
  */
 type PostIndexEventType = 'post.index.refresh';
 type EventType = ContentEventType | MediaEventType | SiteSettingsEventType | PostIndexEventType;
-/** Minimal projection of a Post item carried in events (no body, to keep payloads small). */
+/**
+ * Minimal projection of a Post item carried in events (no body, to keep
+ * payloads small). `format` / `excerpt` are included so the denormalized
+ * PostTag index can render tag-page summaries faithfully — without them the
+ * `listPostsByTag` resolver can't know a post's real format and would
+ * mislabel non-markdown posts.
+ */
 interface ContentEventPayload {
     postId: string;
     slug: string;
     title: string;
     status: 'draft' | 'published';
+    format?: ContentFormat;
+    excerpt?: string;
     publishedAt?: string;
     tags?: string[];
 }
@@ -1829,17 +1837,31 @@ declare function escapeXml(s: string): string;
  *
  *     Variable 'body' has an invalid value.
  *
- * On the read side two wire shapes coexist:
- *
- *   - JSON-encoded string — what the auto-generated CRUD resolver and
- *     custom resolvers usually return.
- *   - Native object / Map — DynamoDBDocumentClient unmarshals
- *     AWSJSON-stored maps straight into JS objects when read directly
- *     from DynamoDB (the path used by the trusted processor and the
- *     MCP Lambda).
- *
- * `decodeAwsJson` handles both: pass strings through `JSON.parse`,
- * everything else as-is.
+ * On the read side there are two FUNDAMENTALLY DIFFERENT paths, and they
+ * must be handled differently — the value's runtime shape is NOT enough
+ * to disambiguate them:
+ *
+ *   1. GraphQL wire read (auto-generated CRUD resolver, custom resolvers,
+ *      raw GraphQL fetch) — the value arrives as a JSON-encoded string,
+ *      regardless of the underlying type. Use `decodeAwsJson` to parse it
+ *      back into the native JS value.
+ *
+ *   2. Direct DynamoDBDocumentClient read (the trusted processor and the
+ *      MCP Lambda read straight from DynamoDB) — DocumentClient already
+ *      unmarshals AWSJSON-backed attributes into native JS types
+ *      (S→string, N→number, BOOL→boolean, M→object). The value is ALREADY
+ *      the correct JS type and must be used AS-IS. Do NOT run
+ *      `decodeAwsJson` / `JSON.parse` on it.
+ *
+ * Why the distinction is load-bearing: a native scalar STRING from path 2
+ * is indistinguishable, by type alone, from a wire string on path 1. But
+ * `decodeAwsJson("1470")` === `JSON.parse("1470")` === the number `1470`,
+ * so running the decoder on a DocumentClient scalar string silently
+ * double-decodes numeric-looking settings/bodies (this caused a
+ * site-wide 500). The "non-strings pass through unchanged" tolerance of
+ * `decodeAwsJson` does NOT make it safe on DocumentClient reads — scalar
+ * strings are exactly the case it corrupts. Pick the decoder by read PATH,
+ * never by the value's runtime shape.
  */
 /**
  * Serialise a value for an AWSJSON variable. `undefined` / `null` both
@@ -1848,9 +1870,14 @@ declare function escapeXml(s: string): string;
  */
 declare function encodeAwsJson(value: unknown): string;
 /**
- * Deserialise an AWSJSON value from a GraphQL / DynamoDB read.
- * Tolerates both the wire-string shape and the auto-unmarshalled
- * native value. Throws if the string is not valid JSON.
+ * Deserialise an AWSJSON value from a GraphQL wire read (path 1 above).
+ * Non-string inputs pass through unchanged; strings go through
+ * `JSON.parse` and throw if not valid JSON.
+ *
+ * Only call this on values read over the GraphQL wire. Do NOT call it on
+ * values read directly via DynamoDBDocumentClient — those are already
+ * native JS types, and a native scalar string (e.g. "1470") would be
+ * double-decoded into a number. See the module doc block above.
  */
 declare function decodeAwsJson(value: unknown): unknown;
 

package/dist/index.js

@@ -529,6 +529,11 @@ function compareRows(a, b, sort) {
       return b.title.localeCompare(a.title);
     case "title-asc":
       return a.title.localeCompare(b.title);
+    default: {
+      const _exhaustive = sort;
+      void _exhaustive;
+      return 0;
+    }
   }
 }
 function compareOptionalIso(a, b, direction) {
@@ -766,6 +771,11 @@ function validateThemeValue(field, raw) {
       const sanitized = v.replace(/[\x00-\x1f<>]/g, "");
       return sanitized.length <= max ? sanitized : sanitized.slice(0, max);
     }
+    default: {
+      const _exhaustive = field;
+      void _exhaustive;
+      return null;
+    }
   }
 }
 var DANGEROUS_URL_RE = /^\s*(javascript|data|vbscript):/i;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ampless",
-  "version": "1.0.0-beta.52",
+  "version": "1.0.0-beta.54",
   "description": "Serverless CMS for AWS Amplify",
   "license": "MIT",
   "type": "module",