@ductape/mcp 0.3.1 → 0.3.2

package/dist/index.js

@@ -2904,11 +2904,23 @@ Import an existing resource and register it on the product:
   Use import-persist-all for multi-env products (required):
     ductape_cli("cloud resources import-persist-all -f all-envs.json --json")
   File is a JSON ARRAY — one entry per env, same product + component tag across all entries.
-  Each entry: { cloud, service, type, product, component, env, resource, region?, dbName? }
+  Each entry: { cloud, service, type, product, component, env, resource, region?, dbName?, masterPassword? }
   Supported service identifiers: s3, gcs, blob, rds, postgresql, cloudsql, sqs, pubsub,
     servicebus, neptune, cosmos-gremlin, opensearch, azure-search, atlas-cluster, aura-instance,
     vertex-vector-search, spanner-graph, dynamodb, keyspaces, mysql
 
+  masterPassword is required for self-hosted-style imports where Ductape cannot mint or fetch
+  credentials on its own: rds, postgresql, cloudsql, mysql (unless the instance already has
+  stored Ductape credentials from a prior link), and — critically — aura-instance. Neo4j Aura
+  shows the auto-generated database password only ONCE, at instance creation, in the Aura
+  console, and it can never be retrieved again via the Aura API. Importing an Aura instance
+  without masterPassword will fail with a clear error at import time; skipping that check and
+  importing anyway is not possible — always ask the user for the instance's password before
+  calling import-persist-all for an aura-instance entry, the same as you would ask for an RDS
+  master password. Aura's username is always "neo4j" — never ask the user for it. Atlas
+  (atlas-cluster) does NOT need masterPassword — Ductape mints/rotates its own database user via
+  the Atlas Admin API.
+
 Provision a brand-new resource and register it:
   ductape_cli("cloud resources provision-persist-all -f all-envs.json --json")
   Additional per-entry fields: tier, region/location, waitForReady.
@@ -6953,6 +6965,32 @@ async function main() {
                 '        "product":"my-product","component":"billing-db","env":"snd","resource":"Cluster0","dbName":"billing_snd"},\n' +
                 '        {"cloud":"atlas-tag","service":"atlas-cluster","type":"databases",\n' +
                 '        "product":"my-product","component":"billing-db","env":"prd","resource":"Cluster0","dbName":"billing_prd"}]\n' +
+                '  - Neo4j Aura (graph) import flow — service identifier is "aura-instance":\n' +
+                '    CRITICAL: masterPassword is REQUIRED in every import entry for aura-instance. Aura shows the\n' +
+                '    auto-generated database password only ONCE, at instance creation, in the Aura console, and it\n' +
+                '    can never be retrieved again via the Aura API — Ductape has no way to source it automatically.\n' +
+                '    Always ask the user for the instance password before calling import-persist-all for an\n' +
+                '    aura-instance entry; do not attempt the import without it, it will fail with a clear error\n' +
+                '    naming exactly this. The username is always "neo4j" for every Aura instance — never ask the\n' +
+                '    user for it, and never put it in masterPassword by mistake.\n' +
+                '    Step 1 — discover the instance:\n' +
+                '      ductape_cli("cloud resources list -f /tmp/aura-list.json --json")\n' +
+                '      File: {"cloud": "<aura-connection-tag>", "service": "aura-instance"}\n' +
+                '      Returns a list of Aura instances; note the "id" or "name" field (this is your resource\n' +
+                '      identifier). Aura instances cannot be created through Ductape — provision-persist-all is\n' +
+                '      not supported for this provider; only an already-existing instance can be linked.\n' +
+                '    Step 2 — import (one entry per product env, same instance across all envs unless the user\n' +
+                '      explicitly wants different Aura instances per environment):\n' +
+                '        cloud (connection tag), service: "aura-instance", type: "graphs",\n' +
+                '        product, component (new or existing graph tag), env, resource (instance id/name from\n' +
+                '        Step 1), masterPassword (the instance password — ask the user, do not guess or omit).\n' +
+                '      Example (two envs, same Aura instance):\n' +
+                '      [{"cloud":"aura-tag","service":"aura-instance","type":"graphs",\n' +
+                '        "product":"my-product","component":"commerce-network","env":"snd",\n' +
+                '        "resource":"1d7fc731","masterPassword":"<user-supplied>"},\n' +
+                '        {"cloud":"aura-tag","service":"aura-instance","type":"graphs",\n' +
+                '        "product":"my-product","component":"commerce-network","env":"prd",\n' +
+                '        "resource":"1d7fc731","masterPassword":"<user-supplied>"}]\n' +
                 '  - Message broker / event broker import:\n' +
                 '    CLI accepts these aliases for the messageBrokers module: events, event, broker, brokers, message-brokers.\n' +
                 '    List existing brokers: ductape_cli("resources events list --json")\n' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",