@iflow-mcp/apple-rag-mcp 4.6.2

package/dist/src/utils/url-processor.js

@@ -0,0 +1,54 @@
+/**
+ * URL processing utility for Apple Developer documentation
+ * Handles URL validation, normalization, and malformed URL detection
+ */
+/**
+ * Validates and normalizes a single URL using elegant malformed URL detection
+ * Integrates the sophisticated filtering logic for comprehensive validation
+ */
+export function validateAndNormalizeUrl(url) {
+    // Basic validation
+    if (!url || typeof url !== "string" || url.trim().length === 0) {
+        return {
+            isValid: false,
+            normalizedUrl: url,
+            error: "URL is required",
+        };
+    }
+    // Apply malformed URL detection - global optimal solution
+    const isValidUrl = ![
+        url.split("https://").length > 2 || url.split("http://").length > 2, // Duplicate protocol
+        url.includes("%ef%bb%bf") || url.includes("\ufeff"), // BOM characters
+        url.split("/documentation/").length > 2, // Path duplication
+        url.includes("https:/") && !url.startsWith("https://"), // Protocol format error
+        url.length > 200, // Abnormal length
+        url.split("developer.apple.com").length > 2, // Duplicate domain
+    ].some(Boolean);
+    if (!isValidUrl) {
+        return {
+            isValid: false,
+            normalizedUrl: url,
+            error: "URL contains malformed patterns",
+        };
+    }
+    // Clean and normalize URL - elegant, modern, and concise
+    try {
+        const parsed = new URL(url);
+        // Preserve case sensitivity for Apple Developer paths
+        const normalizedPath = parsed.pathname === "/" ? "/" : parsed.pathname.replace(/\/+$/, ""); // Remove trailing slashes except root
+        // Remove query parameters and fragments to match pages table format
+        const normalizedUrl = `${parsed.protocol.toLowerCase()}//${parsed.hostname.toLowerCase()}${normalizedPath}`;
+        return {
+            isValid: true,
+            normalizedUrl,
+        };
+    }
+    catch {
+        return {
+            isValid: false,
+            normalizedUrl: url,
+            error: "Invalid URL format",
+        };
+    }
+}
+//# sourceMappingURL=url-processor.js.map

package/dist/src/utils/url-processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-processor.js","sourceRoot":"","sources":["../../../src/utils/url-processor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,mBAAmB;IACnB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,GAAG;YAClB,KAAK,EAAE,iBAAiB;SACzB,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,UAAU,GAAG,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,qBAAqB;QAC1F,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB;QACtE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,mBAAmB;QAC5D,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,wBAAwB;QAChF,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,kBAAkB;QACpC,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,mBAAmB;KACjE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEhB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,GAAG;YAClB,KAAK,EAAE,iCAAiC;SACzC,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,sDAAsD;QACtD,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,sCAAsC;QAE7G,oEAAoE;QACpE,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,cAAc,EAAE,CAAC;QAE5G,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,GAAG;YAClB,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/worker.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Apple RAG MCP Server - Cloudflare Worker Native
+ * Ultra-modern, zero-dependency MCP 2025-06-18 compliant server
+ * Global optimal solution with maximum performance
+ */
+import type { WorkerEnv } from "./types/index.js";
+/**
+ * Cloudflare Worker entry point - Global optimal implementation
+ * Handles all MCP protocol requests with edge-optimized performance
+ */
+declare const _default: {
+    fetch(request: Request, env: WorkerEnv, ctx: ExecutionContext): Promise<Response>;
+};
+export default _default;
+//# sourceMappingURL=worker.d.ts.map

package/dist/src/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/worker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD;;;GAGG;;mBAGU,OAAO,OACX,SAAS,OACT,gBAAgB,GACpB,OAAO,CAAC,QAAQ,CAAC;;AALtB,wBA8JE"}

package/dist/src/worker.js

@@ -0,0 +1,136 @@
+/**
+ * Apple RAG MCP Server - Cloudflare Worker Native
+ * Ultra-modern, zero-dependency MCP 2025-06-18 compliant server
+ * Global optimal solution with maximum performance
+ */
+import { HEALTH_STATUS, SERVER_MANIFEST } from "./mcp/manifest.js";
+import { MCPProtocolHandler } from "./mcp/protocol-handler.js";
+import { createServices } from "./services/index.js";
+import { logger } from "./utils/logger.js";
+import { configureTelegram } from "./utils/telegram-notifier.js";
+/**
+ * Cloudflare Worker entry point - Global optimal implementation
+ * Handles all MCP protocol requests with edge-optimized performance
+ */
+export default {
+    async fetch(request, env, ctx) {
+        const startTime = performance.now();
+        // Configure Telegram notification and set execution context for waitUntil
+        configureTelegram(env.TELEGRAM_BOT_URL);
+        logger.setContext(ctx);
+        try {
+            const url = new URL(request.url);
+            // Health check endpoint - ultra-fast response
+            if (request.method === "GET" && url.pathname === "/health") {
+                return new Response(JSON.stringify({
+                    ...HEALTH_STATUS,
+                    timestamp: new Date().toISOString(),
+                }), {
+                    status: 200,
+                    headers: {
+                        "Content-Type": "application/json",
+                        "Cache-Control": "no-cache",
+                    },
+                });
+            }
+            // Manifest endpoint - server discovery
+            if (request.method === "GET" && url.pathname === "/manifest") {
+                return new Response(JSON.stringify(SERVER_MANIFEST), {
+                    status: 200,
+                    headers: {
+                        "Content-Type": "application/json",
+                        "Cache-Control": "public, max-age=3600",
+                    },
+                });
+            }
+            // Reject other GET requests to the MCP endpoint
+            if (request.method === "GET" && url.pathname === "/") {
+                return new Response("Method Not Allowed", {
+                    status: 405,
+                    headers: {
+                        "Access-Control-Allow-Origin": "*",
+                        Allow: "POST, OPTIONS",
+                    },
+                });
+            }
+            // Handle POST /manifest requests (VPS compatibility)
+            if (request.method === "POST" && url.pathname === "/manifest") {
+                try {
+                    const body = await request.json();
+                    // Empty body → return manifest (common client behavior)
+                    if (!body || Object.keys(body).length === 0) {
+                        return new Response(JSON.stringify(SERVER_MANIFEST), {
+                            status: 200,
+                            headers: { "Content-Type": "application/json" },
+                        });
+                    }
+                    // MCP request to wrong endpoint → redirect to correct endpoint
+                    if (body
+                        .jsonrpc === "2.0" &&
+                        body.method) {
+                        return new Response(JSON.stringify({
+                            error: "Endpoint redirect",
+                            message: "MCP protocol requests should be sent to /",
+                            redirect: "/",
+                        }), {
+                            status: 307,
+                            headers: {
+                                "Content-Type": "application/json",
+                                Location: "/",
+                            },
+                        });
+                    }
+                    // Any other POST data → helpful error
+                    return new Response(JSON.stringify({
+                        error: "Invalid manifest request",
+                        message: "Use GET /manifest for server discovery or POST / for MCP communication",
+                        endpoints: {
+                            manifest: "GET /manifest",
+                            mcp: "POST /",
+                        },
+                    }), {
+                        status: 400,
+                        headers: { "Content-Type": "application/json" },
+                    });
+                }
+                catch (_error) {
+                    return new Response(JSON.stringify({
+                        error: "Invalid JSON",
+                        message: "Request body must be valid JSON",
+                    }), {
+                        status: 400,
+                        headers: { "Content-Type": "application/json" },
+                    });
+                }
+            }
+            // Initialize services with Worker environment
+            const services = await createServices(env);
+            // Authenticate request using auth service
+            const authContext = await services.auth.optionalAuth(request);
+            // Create MCP protocol handler
+            const handler = new MCPProtocolHandler(services);
+            // Handle MCP request
+            const response = await handler.handleRequest(request, authContext);
+            return response;
+        }
+        catch (error) {
+            const duration = performance.now() - startTime;
+            const errorUrl = new URL(request.url);
+            logger.error(`Worker error for ${request.method} ${errorUrl.pathname} (duration: ${Math.round(duration)}ms): ${error instanceof Error ? error.message : String(error)}`);
+            return new Response(JSON.stringify({
+                jsonrpc: "2.0",
+                error: {
+                    code: -32603,
+                    message: "Internal server error",
+                },
+            }), {
+                status: 500,
+                headers: {
+                    "Content-Type": "application/json",
+                    "Cache-Control": "no-cache",
+                },
+            });
+        }
+    },
+};
+//# sourceMappingURL=worker.js.map

package/dist/src/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/worker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE;;;GAGG;AACH,eAAe;IACb,KAAK,CAAC,KAAK,CACT,OAAgB,EAChB,GAAc,EACd,GAAqB;QAErB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,0EAA0E;QAC1E,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEjC,8CAA8C;YAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,GAAG,aAAa;oBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,eAAe,EAAE,UAAU;qBAC5B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE;oBACnD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,eAAe,EAAE,sBAAsB;qBACxC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,gDAAgD;YAChD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrD,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;oBACxC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,6BAA6B,EAAE,GAAG;wBAClC,KAAK,EAAE,eAAe;qBACvB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,qDAAqD;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC9D,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;oBAElC,wDAAwD;oBACxD,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC5C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE;4BACnD,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CAAC,CAAC;oBACL,CAAC;oBAED,+DAA+D;oBAC/D,IACG,IAAyD;yBACvD,OAAO,KAAK,KAAK;wBACnB,IAAyD,CAAC,MAAM,EACjE,CAAC;wBACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;4BACb,KAAK,EAAE,mBAAmB;4BAC1B,OAAO,EAAE,2CAA2C;4BACpD,QAAQ,EAAE,GAAG;yBACd,CAAC,EACF;4BACE,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE;gCACP,cAAc,EAAE,kBAAkB;gCAClC,QAAQ,EAAE,GAAG;6BACd;yBACF,CACF,CAAC;oBACJ,CAAC;oBAED,sCAAsC;oBACtC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,0BAA0B;wBACjC,OAAO,EACL,wEAAwE;wBAC1E,SAAS,EAAE;4BACT,QAAQ,EAAE,eAAe;4BACzB,GAAG,EAAE,QAAQ;yBACd;qBACF,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,iCAAiC;qBAC3C,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,8CAA8C;YAC9C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAE3C,0CAA0C;YAC1C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAE9D,8BAA8B;YAC9B,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAEjD,qBAAqB;YACrB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEnE,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,CAAC,KAAK,CACV,oBAAoB,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,eAAe,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3J,CAAC;YAEF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,uBAAuB;iBACjC;aACF,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,UAAU;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/migrations/schema.sql

@@ -0,0 +1,155 @@
+-- Apple RAG Database Schema
+-- Cloudflare D1 (SQLite)
+-- Last updated: 2025-11-26
+
+-- ============================================================
+-- USERS TABLE
+-- Primary user authentication and profile table
+-- ============================================================
+CREATE TABLE IF NOT EXISTS users (
+    id TEXT PRIMARY KEY,
+    email TEXT UNIQUE NOT NULL,
+    password_hash TEXT,
+    name TEXT,
+    avatar TEXT,
+    provider TEXT NOT NULL DEFAULT 'email',
+    provider_id TEXT,
+    oauth_provider TEXT,
+    oauth_id TEXT,
+    stripe_customer_id TEXT,
+    reset_token TEXT,
+    reset_token_expires_at TEXT,
+    last_login TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
+CREATE INDEX IF NOT EXISTS idx_users_provider ON users(provider, provider_id);
+CREATE INDEX IF NOT EXISTS idx_users_stripe ON users(stripe_customer_id);
+
+-- ============================================================
+-- MCP TOKENS TABLE
+-- MCP token management for API access control
+-- ============================================================
+CREATE TABLE IF NOT EXISTS mcp_tokens (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    mcp_token TEXT NOT NULL,
+    last_used_at TEXT,
+    created_at TEXT DEFAULT (datetime('now')),
+    updated_at TEXT DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_mcp_tokens_user_id ON mcp_tokens(user_id);
+CREATE INDEX IF NOT EXISTS idx_mcp_tokens_token ON mcp_tokens(mcp_token);
+
+-- ============================================================
+-- SEARCH LOGS TABLE
+-- Tracks search operations for usage monitoring and rate limiting
+-- ============================================================
+CREATE TABLE IF NOT EXISTS search_logs (
+    id TEXT DEFAULT (lower(hex(randomblob(16)))) PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    mcp_token TEXT,
+    requested_query TEXT NOT NULL,
+    actual_query TEXT NOT NULL,
+    result_count INTEGER DEFAULT 0,
+    response_time_ms INTEGER,
+    status_code INTEGER,
+    error_code TEXT,
+    ip_address TEXT,
+    country_code TEXT,
+    created_at TEXT DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_search_logs_user_id ON search_logs(user_id);
+CREATE INDEX IF NOT EXISTS idx_search_logs_created_at ON search_logs(created_at);
+CREATE INDEX IF NOT EXISTS idx_search_logs_country ON search_logs(country_code);
+
+-- ============================================================
+-- FETCH LOGS TABLE
+-- Tracks fetch operations for usage monitoring and rate limiting
+-- ============================================================
+CREATE TABLE IF NOT EXISTS fetch_logs (
+    id TEXT DEFAULT (lower(hex(randomblob(16)))) PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    mcp_token TEXT,
+    requested_url TEXT NOT NULL,
+    actual_url TEXT,
+    page_id TEXT,
+    response_time_ms INTEGER,
+    status_code INTEGER,
+    error_code TEXT,
+    ip_address TEXT,
+    country_code TEXT,
+    created_at TEXT DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_fetch_logs_user_id ON fetch_logs(user_id);
+CREATE INDEX IF NOT EXISTS idx_fetch_logs_created_at ON fetch_logs(created_at);
+CREATE INDEX IF NOT EXISTS idx_fetch_logs_country ON fetch_logs(country_code);
+
+-- ============================================================
+-- USER SUBSCRIPTIONS TABLE
+-- Stripe integration and subscription lifecycle tracking
+-- ============================================================
+CREATE TABLE IF NOT EXISTS user_subscriptions (
+    user_id TEXT PRIMARY KEY,
+    stripe_customer_id TEXT,
+    stripe_subscription_id TEXT,
+    plan_type TEXT DEFAULT 'hobby',
+    status TEXT DEFAULT 'active',
+    current_period_start TEXT,
+    current_period_end TEXT,
+    cancel_at_period_end BOOLEAN DEFAULT FALSE,
+    price REAL DEFAULT 0,
+    billing_interval TEXT DEFAULT 'month',
+    stripe_price_id TEXT,
+    updated_at TEXT DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_user_subscriptions_stripe_price_id ON user_subscriptions(stripe_price_id);
+
+-- ============================================================
+-- USER AUTHORIZED IPS TABLE
+-- IP-based authentication and access control
+-- ============================================================
+CREATE TABLE IF NOT EXISTS user_authorized_ips (
+    id TEXT DEFAULT (lower(hex(randomblob(16)))) PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    ip_address TEXT NOT NULL,
+    name TEXT NOT NULL,
+    last_used_at TEXT,
+    created_at TEXT DEFAULT (datetime('now')),
+    updated_at TEXT DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_user_authorized_ips_lookup ON user_authorized_ips(ip_address, user_id);
+CREATE INDEX IF NOT EXISTS idx_user_authorized_ips_user_id ON user_authorized_ips(user_id);
+CREATE INDEX IF NOT EXISTS idx_user_authorized_ips_last_used ON user_authorized_ips(last_used_at);
+
+-- ============================================================
+-- CONTACT MESSAGES TABLE
+-- Contact form submissions with bidirectional messaging support
+-- ============================================================
+CREATE TABLE IF NOT EXISTS contact_messages (
+    id TEXT DEFAULT (lower(hex(randomblob(16)))) PRIMARY KEY,
+    user_id TEXT,
+    email TEXT,
+    message TEXT NOT NULL,
+    ip_address TEXT,
+    admin_reply TEXT,
+    replied_at TEXT,
+    user_read_at TEXT,
+    created_at TEXT DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_contact_messages_created_at ON contact_messages(created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_contact_messages_replied_at ON contact_messages(replied_at DESC);
+

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@iflow-mcp/apple-rag-mcp",
+  "version": "4.6.2",
+  "type": "module",
+  "main": "dist/src/worker.js",
+  "bin": {
+    "apple-rag-mcp": "./dist/src/worker.js"
+  },
+  "mcpName": "io.github.BingoWon/apple-rag-mcp",
+  "scripts": {
+    "deploy:dev": "wrangler deploy --env development",
+    "deploy:prod": "wrangler deploy --env production",
+    "build": "tsc",
+    "format": "biome check --write --unsafe ."
+  },
+  "keywords": [
+    "mcp",
+    "mcp-2025-06-18",
+    "streamable-http",
+    "oauth-2.1",
+    "authorization",
+    "rag",
+    "apple",
+    "documentation",
+    "ai",
+    "vector-search",
+    "semantic-search"
+  ],
+  "author": "Apple RAG Team",
+  "license": "MIT",
+  "description": "Modern MCP 2025-06-18 compliant server with OAuth 2.1 Authorization for Apple Developer Documentation with Semantic Search for RAG, Keyword Search, and Hybrid Search - Production ready with vector similarity and semantic AI reranking",
+  "dependencies": {
+    "@types/node": "^20.19.11",
+    "postgres": "^3.4.7"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.2.2",
+    "@cloudflare/workers-types": "^4.20250831.0",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "semantic-release": "^24.2.0",
+    "typescript": "^5.9.2",
+    "wrangler": "^4.33.1"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "packageManager": "pnpm@10.7.0+sha512.6b865ad4b62a1d9842b61d674a393903b871d9244954f652b8842c2b553c72176b278f64c463e52d40fff8aba385c235c8c9ecf5cc7de4fd78b8bb6d49633ab6"
+}

package/scripts/semantic-release-server-json.js

@@ -0,0 +1,34 @@
+/**
+ * Custom Semantic-Release plugin to update server.json version
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+function updateServerJson(_pluginConfig, context) {
+  const { nextRelease, logger } = context;
+  const serverJsonPath = path.resolve(process.cwd(), "server.json");
+
+  if (!fs.existsSync(serverJsonPath)) {
+    logger.log("server.json not found, skipping version update");
+    return;
+  }
+
+  try {
+    const serverJson = JSON.parse(fs.readFileSync(serverJsonPath, "utf8"));
+    serverJson.version = nextRelease.version;
+
+    fs.writeFileSync(
+      serverJsonPath,
+      `${JSON.stringify(serverJson, null, 2)}\n`
+    );
+    logger.log(`Updated server.json version to ${nextRelease.version}`);
+  } catch (error) {
+    logger.error("Failed to update server.json:", error);
+    throw error;
+  }
+}
+
+export default {
+  prepare: updateServerJson,
+};

package/server.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json",
+  "name": "com.apple-rag/mcp-server",
+  "description": "Apple Developer Documentation with Semantic Search, RAG, and AI reranking for MCP clients",
+  "status": "active",
+  "repository": {
+    "url": "https://github.com/BingoWon/apple-rag-mcp",
+    "source": "github"
+  },
+  "version": "4.6.2",
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://mcp.apple-rag.com",
+      "headers": [
+        {
+          "name": "Authorization",
+          "description": "MCP Token for authentication (optional - free tier available without token)",
+          "is_required": false,
+          "is_secret": true
+        }
+      ]
+    }
+  ]
+}

package/src/auth/auth-middleware.ts

@@ -0,0 +1,104 @@
+/**
+ * Simple MCP Authentication Middleware
+ */
+
+import { IPAuthenticationService } from "../services/ip-authentication.js";
+import type { AuthContext } from "../types/index.js";
+import { logger } from "../utils/logger.js";
+import { TokenValidator, type UserTokenData } from "./token-validator.js";
+
+export class AuthMiddleware {
+  private readonly tokenValidator: TokenValidator;
+  private readonly ipAuthService: IPAuthenticationService;
+
+  constructor(d1: D1Database) {
+    this.tokenValidator = new TokenValidator(d1);
+    this.ipAuthService = new IPAuthenticationService(d1);
+  }
+
+  /**
+   * Extract Bearer token from Authorization header
+   * Handles multiple "Bearer" prefixes and validates token format
+   */
+  private extractBearerToken(authHeader?: string): string | null {
+    if (!authHeader) return null;
+
+    // Remove all "Bearer " prefixes (case-insensitive, supports multiple)
+    const token = authHeader.replace(/^(Bearer\s+)+/gi, "").trim();
+
+    // Only return if it matches valid token format
+    return /^at_[a-f0-9]{32}$/.test(token) ? token : null;
+  }
+
+  /**
+   * Optional authentication middleware
+   * Validates token if present, or checks IP-based authentication, allows access without either
+   */
+  async optionalAuth(request: Request): Promise<AuthContext> {
+    const authHeader = request.headers.get("authorization");
+    const token = this.extractBearerToken(authHeader || undefined);
+    const clientIP = this.getClientIP(request);
+
+    // Try token authentication first
+    if (token) {
+      const validation = await this.tokenValidator.validateToken(token);
+
+      if (validation.valid) {
+        logger.info(
+          `Token authentication successful for userId: ${validation.userData?.userId}`
+        );
+
+        return {
+          isAuthenticated: true,
+          userId: validation.userData?.userId,
+          email: validation.userData?.email,
+          token: token,
+        };
+      }
+
+      logger.error(
+        `Token validation failed. Raw header: "${authHeader}", Extracted token: "${token}", IP: ${clientIP}, Error: ${validation.error}`
+      );
+    }
+
+    // Try IP-based authentication
+    const ipAuthResult =
+      await this.ipAuthService.checkIPAuthentication(clientIP);
+    if (ipAuthResult) {
+      logger.info(
+        `IP-based authentication successful for userId: ${ipAuthResult.userId} from IP: ${clientIP}`
+      );
+
+      return {
+        isAuthenticated: true,
+        userId: ipAuthResult.userId,
+        email: ipAuthResult.email,
+        token: "ip-based",
+      };
+    }
+
+    // No authentication method succeeded
+    logger.info(
+      `No authentication provided - allowing unauthenticated access from IP: ${clientIP} (hasToken: ${!!token})`
+    );
+
+    return { isAuthenticated: false };
+  }
+
+  async getUserData(userId: string): Promise<UserTokenData> {
+    return this.tokenValidator.getUserDataById(userId);
+  }
+
+  /**
+   * Get client IP address from request (Worker optimized)
+   */
+  private getClientIP(request: Request): string {
+    // Cloudflare provides client IP in CF-Connecting-IP header
+    return (
+      request.headers.get("CF-Connecting-IP") ||
+      request.headers.get("X-Forwarded-For") ||
+      request.headers.get("X-Real-IP") ||
+      "unknown"
+    );
+  }
+}