mcp-aiven 1.14.6 → 1.15.0

package/README.md

@@ -184,11 +184,30 @@ MCP_HOST=http://localhost:3000 node dist/index.js
 | `AIVEN_WRITE_ALLOWLIST` | No | -- | Comma-separated tool names to re-enable while `AIVEN_READ_ONLY=true` (e.g. `aiven_kafka_topic_create`). Ignored when read-only mode is not enabled. |
 | `MCP_HOST` | No | `https://mcp.aiven.live` | Override the OAuth protected resource host |
 | `MCP_TRANSPORT` | No | `stdio` | Set to `http` to start an HTTP server instead of stdio |
-| `MCP_HTTP_RATE_LIMIT_MAX` | No | `1000` | Max requests per window on `POST /mcp` (HTTP transport). Applies independently to a per-bearer-token bucket and a per-source-IP bucket; whichever fills first returns 429. |
+| `MCP_HTTP_RATE_LIMIT_MAX` | No | `1000` | Max requests per window on `POST /mcp` (HTTP transport), per bearer token. Client IP rate limiting is expected at Cloudflare. |
 | `MCP_HTTP_RATE_LIMIT_WINDOW_MS` | No | `60000` | Window length in milliseconds for `MCP_HTTP_RATE_LIMIT_MAX`. |
+| `EXTRA_PROTECTION` | No | `false` | Set to `true` on HTTP deployments to require a valid `X-Edge-Auth` header on every request except `GET /health`. See [Edge protection rollout](#edge-protection-rollout) below. |
+| `MCP_EDGE_AUTH_SECRET` | When `EXTRA_PROTECTION=true` | -- | Shared secret; must match the value Cloudflare injects as `X-Edge-Auth` via Transform Rules. |
 
 In remote (HTTP) mode, `AIVEN_TOKEN` is not needed. Your MCP client sends your token as a Bearer token with each request.
 
+Production HTTP traffic is rate-limited in two layers: Cloudflare enforces a per-client-IP limit (configured in the Cloudflare dashboard), and this server enforces `MCP_HTTP_RATE_LIMIT_*` per bearer token on `POST /mcp`.
+
+### Edge protection rollout
+
+When `EXTRA_PROTECTION=true`, any mismatch between `MCP_EDGE_AUTH_SECRET` and the value Cloudflare injects as `X-Edge-Auth` causes **every request to return 403** (except `GET /health`). Both values are environment/config on opposite sides of the wire, so the only recovery path is to fix the secret and redeploy or update Cloudflare.
+
+**Enable in this order:**
+
+1. **Cloudflare Transform Rule** — Add a rule that sets `X-Edge-Auth` (and, if used for PG tools, `X-Client-IP`) on traffic to the MCP origin. Note the secret value you configure.
+2. **`MCP_EDGE_AUTH_SECRET`** — Deploy the server with this env var set to the **same** secret as the Transform Rule. Leave `EXTRA_PROTECTION` unset or `false` for now; verify the origin still accepts traffic.
+3. **`EXTRA_PROTECTION=true`** — Enable only after steps 1–2 are live and matched. Confirm a normal MCP request succeeds and direct origin access without `X-Edge-Auth` is rejected.
+4. **Secret rotation** — Update Cloudflare and `MCP_EDGE_AUTH_SECRET` together (or briefly set `EXTRA_PROTECTION=false`), redeploy, then re-enable. Never rotate one side alone while the flag is on.
+
+If `EXTRA_PROTECTION=true` at startup and `MCP_EDGE_AUTH_SECRET` is missing, the process exits immediately with an error.
+
+While rejections continue, the server logs a misconfig warning at most once every 15 minutes (reset after a request with valid `X-Edge-Auth`), so a secret mismatch is visible in logs without one line per rejected request.
+
 ## Tools
 
 ### Core

package/dist/client.d.ts

@@ -1,6 +1,7 @@
 import type { AivenConfig, HttpMethod, RequestOptions } from './types.js';
 export declare class AivenClient {
     private readonly token;
+    private readonly mcpAcornSecret;
     private readonly defaultTimeout;
     private readonly transport;
     private readonly fetchClient;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI1E,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;gBAEzD,MAAM,EAAE,WAAW;IAczB,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC;IAwCb,OAAO,CAAC,YAAY;IAoBd,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAI3E,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1E,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;CAGpE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI1E,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;gBAEzD,MAAM,EAAE,WAAW;IAezB,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC;IAwCb,OAAO,CAAC,YAAY;IAiCd,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAI3E,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1E,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;CAGpE"}

package/dist/client.js

@@ -3,11 +3,13 @@ import { AivenError } from './errors.js';
 import { VERSION, API_BASE_URL } from './config.js';
 export class AivenClient {
     token;
+    mcpAcornSecret;
     defaultTimeout;
     transport;
     fetchClient;
     constructor(config) {
         this.token = config.token;
+        this.mcpAcornSecret = config.mcpAcornSecret;
         this.defaultTimeout = 30000;
         this.transport = config.transport;
         this.fetchClient = createClient({
@@ -51,12 +53,23 @@ export class AivenClient {
         if (options?.mcpClient) {
             headers['X-MCP-Client'] = options.mcpClient;
         }
+        if (options?.clientIp) {
+            headers['X-MCP-Client-IP'] = options.clientIp;
+        }
         if (options?.requestId) {
             headers['X-MCP-Request-ID'] = options.requestId;
         }
         if (options?.toolReasoning) {
             headers['X-MCP-Tool-Reasoning'] = options.toolReasoning;
         }
+        if (options?.mcpAcornAuth) {
+            if (this.mcpAcornSecret) {
+                headers['X-MCP-Acorn-Authorization'] = this.mcpAcornSecret;
+            }
+            else if (this.transport === 'http') {
+                throw new AivenError(500, 'MCP_ACORN_SECRET environment variable is required for PG Editor run-query');
+            }
+        }
         return headers;
     }
     async get(path, options) {

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,eAAe,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,OAAO,WAAW;IACL,KAAK,CAAqB;IAC1B,cAAc,CAAS;IACvB,SAAS,CAAmB;IAC5B,WAAW,CAAyC;IAErE,YAAY,MAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,YAAY,CAAQ;YACrC,OAAO,EAAE,YAAY;YACrB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,aAAa,OAAO,EAAE;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAkB,EAClB,IAAY,EACZ,IAAc,EACd,OAAwB;QAExB,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC5C,MAAM,CAAC,WAAW,EAAW,EAC7B,IAAa,EACb;YACE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,IAAI,EAAE,IAAa;YACnB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B,CACX,CAIA,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,UAAU,CAClB,MAAM,CAAC,QAAQ,CAAC,MAAM,EACtB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,IAAI,YAAY,GAAG,IAAI,GAAG,EAC1F,MAAM,CAAC,KAAK,CAAC,UAAU,EACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CACvB,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChE,OAAO,EAAO,CAAC;QACjB,CAAC;QAED,OAAO,MAAM,CAAC,IAAS,CAAC;IAC1B,CAAC;IAEO,YAAY,CAAC,KAAa,EAAE,OAAwB;QAC1D,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,iBAAiB,EAAE,IAAI,CAAC,SAAS;SAClC,CAAC;QACF,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;YAC3B,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,OAAwB;QAClE,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,OAAwB;QACjE,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY,EAAE,OAAwB;QACpD,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,eAAe,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,OAAO,WAAW;IACL,KAAK,CAAqB;IAC1B,cAAc,CAAqB;IACnC,cAAc,CAAS;IACvB,SAAS,CAAmB;IAC5B,WAAW,CAAyC;IAErE,YAAY,MAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,YAAY,CAAQ;YACrC,OAAO,EAAE,YAAY;YACrB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,aAAa,OAAO,EAAE;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAkB,EAClB,IAAY,EACZ,IAAc,EACd,OAAwB;QAExB,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC5C,MAAM,CAAC,WAAW,EAAW,EAC7B,IAAa,EACb;YACE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,IAAI,EAAE,IAAa;YACnB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B,CACX,CAIA,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,UAAU,CAClB,MAAM,CAAC,QAAQ,CAAC,MAAM,EACtB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,IAAI,YAAY,GAAG,IAAI,GAAG,EAC1F,MAAM,CAAC,KAAK,CAAC,UAAU,EACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CACvB,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChE,OAAO,EAAO,CAAC;QACjB,CAAC;QAED,OAAO,MAAM,CAAC,IAAS,CAAC;IAC1B,CAAC;IAEO,YAAY,CAAC,KAAa,EAAE,OAAwB;QAC1D,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,iBAAiB,EAAE,IAAI,CAAC,SAAS;SAClC,CAAC;QACF,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;YAC3B,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,CAAC,2BAA2B,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;YAC7D,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBACrC,MAAM,IAAI,UAAU,CAClB,GAAG,EACH,2EAA2E,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,OAAwB;QAClE,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,OAAwB;QACjE,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY,EAAE,OAAwB;QACpD,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/config.d.ts

@@ -4,7 +4,7 @@ export declare const VERSION: string;
 export declare const API_ORIGIN: string;
 export declare const API_BASE_URL: string;
 export declare const HOST: string;
-/** HTTP POST /mcp rate limit (per bearer token hash, else per client IP). */
+/** HTTP POST /mcp rate limit (per bearer token hash). */
 export interface HttpMcpRateLimitConfig {
     windowMs: number;
     limit: number;
@@ -18,5 +18,7 @@ export declare function parseScopes(raw: string | undefined): {
 };
 export declare function parseWriteAllowlist(raw: string | undefined): ReadonlySet<string> | undefined;
 export declare function isMaintenanceMode(): boolean;
+export declare function isExtraProtectionEnabled(): boolean;
+export declare function loadEdgeAuthSecret(): string | undefined;
 export declare function loadConfig(transport?: 'stdio' | 'http'): AivenConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C,eAAO,MAAM,OAAO,QAAc,CAAC;AACnC,eAAO,MAAM,UAAU,QAA4D,CAAC;AACpF,eAAO,MAAM,YAAY,QAAqB,CAAC;AAC/C,eAAO,MAAM,IAAI,QAAsD,CAAC;AAExE,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,oBAAoB,IAAI,sBAAsB,CAK7D;AAcD,eAAO,MAAM,YAAY,mBAA4D,CAAC;AAEtF,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB;IAAE,UAAU,EAAE,WAAW,CAAC,eAAe,CAAC,GAAG,SAAS,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAiC9E;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAS5F;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,UAAU,CAAC,SAAS,GAAE,OAAO,GAAG,MAAgB,GAAG,WAAW,CAoB7E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C,eAAO,MAAM,OAAO,QAAc,CAAC;AACnC,eAAO,MAAM,UAAU,QAA4D,CAAC;AACpF,eAAO,MAAM,YAAY,QAAqB,CAAC;AAC/C,eAAO,MAAM,IAAI,QAAsD,CAAC;AAExE,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,oBAAoB,IAAI,sBAAsB,CAK7D;AAcD,eAAO,MAAM,YAAY,mBAA4D,CAAC;AAEtF,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB;IAAE,UAAU,EAAE,WAAW,CAAC,eAAe,CAAC,GAAG,SAAS,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAiC9E;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAS5F;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,wBAAwB,IAAI,OAAO,CAElD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED,wBAAgB,UAAU,CAAC,SAAS,GAAE,OAAO,GAAG,MAAgB,GAAG,WAAW,CAqB7E"}

package/dist/config.js

@@ -74,6 +74,15 @@ export function parseWriteAllowlist(raw) {
 export function isMaintenanceMode() {
     return process.env['MAINTENANCE_MODE'] === 'true';
 }
+export function isExtraProtectionEnabled() {
+    return process.env['EXTRA_PROTECTION'] === 'true';
+}
+export function loadEdgeAuthSecret() {
+    const raw = process.env['MCP_EDGE_AUTH_SECRET'];
+    if (raw === undefined || raw === '')
+        return undefined;
+    return raw;
+}
 export function loadConfig(transport = 'stdio') {
     const token = process.env['AIVEN_TOKEN'];
     if (!token && transport !== 'http') {
@@ -87,6 +96,7 @@ export function loadConfig(transport = 'stdio') {
     if ('error' in parsed) {
         throw new Error(`AIVEN_SERVICES_SCOPE: ${parsed.error}`);
     }
-    return { token, readOnly, transport, categories: parsed.categories, allowSecrets, writeAllowlist };
+    const mcpAcornSecret = process.env['MCP_ACORN_SECRET'];
+    return { token, readOnly, transport, categories: parsed.categories, allowSecrets, writeAllowlist, mcpAcornSecret };
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAC9D,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,sBAAsB,CAAC;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,UAAU,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,wBAAwB,CAAC;AAQxE,SAAS,mBAAmB,CAAC,IAAY,EAAE,YAAoB;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,QAAQ,EAAE,mBAAmB,CAAC,+BAA+B,EAAE,MAAM,CAAC;QACtE,KAAK,EAAE,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAoC;IACzD,IAAI,EAAE,eAAe,CAAC,IAAI;IAC1B,EAAE,EAAE,eAAe,CAAC,EAAE;IACtB,KAAK,EAAE,eAAe,CAAC,KAAK;IAC5B,WAAW,EAAE,eAAe,CAAC,WAAW;IACxC,YAAY,EAAE,eAAe,CAAC,YAAY;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEtF,MAAM,UAAU,WAAW,CACzB,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAExD,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,mCAAmC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3F,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAExC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAA8B,OAAO;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,CAAC,KAAK,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iDAAiD;YAC/C,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,MAAM,CAAC;IACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AACrG,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAC9D,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,sBAAsB,CAAC;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,UAAU,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,wBAAwB,CAAC;AAQxE,SAAS,mBAAmB,CAAC,IAAY,EAAE,YAAoB;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,QAAQ,EAAE,mBAAmB,CAAC,+BAA+B,EAAE,MAAM,CAAC;QACtE,KAAK,EAAE,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAoC;IACzD,IAAI,EAAE,eAAe,CAAC,IAAI;IAC1B,EAAE,EAAE,eAAe,CAAC,EAAE;IACtB,KAAK,EAAE,eAAe,CAAC,KAAK;IAC5B,WAAW,EAAE,eAAe,CAAC,WAAW;IACxC,YAAY,EAAE,eAAe,CAAC,YAAY;CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEtF,MAAM,UAAU,WAAW,CACzB,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAExD,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,mCAAmC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3F,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAExC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAA8B,OAAO;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,CAAC,KAAK,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iDAAiD;YAC/C,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,MAAM,CAAC;IACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;AACrH,CAAC"}

package/dist/edge-auth.d.ts

@@ -0,0 +1,10 @@
+import type { Request, Response, NextFunction } from 'express';
+/** Header set by Cloudflare Transform Rules (`X-Edge-Auth`); compared to `MCP_EDGE_AUTH_SECRET`. */
+export declare const EDGE_AUTH_HEADER = "x-edge-auth";
+/** Min interval between misconfig warnings while rejections continue. */
+export declare const EDGE_AUTH_MISCONFIG_WARN_COOLDOWN_MS: number;
+/** Resets deduped misconfig warning state (for tests). */
+export declare function resetEdgeAuthMisconfigWarnCooldown(): void;
+export declare function hasValidEdgeAuth(req: Request, expectedSecret: string): boolean;
+export declare function createEdgeAuthMiddleware(extraProtection: boolean, edgeAuthSecret: string | undefined): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=edge-auth.d.ts.map

package/dist/edge-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-auth.d.ts","sourceRoot":"","sources":["../src/edge-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C,yEAAyE;AACzE,eAAO,MAAM,oCAAoC,QAAiB,CAAC;AAInE,0DAA0D;AAC1D,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AA2BD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAI9E;AAED,wBAAgB,wBAAwB,CACtC,eAAe,EAAE,OAAO,EACxB,cAAc,EAAE,MAAM,GAAG,SAAS,IAE1B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAiB/D"}

package/dist/edge-auth.js

@@ -0,0 +1,55 @@
+import { timingSafeEqual } from 'node:crypto';
+/** Header set by Cloudflare Transform Rules (`X-Edge-Auth`); compared to `MCP_EDGE_AUTH_SECRET`. */
+export const EDGE_AUTH_HEADER = 'x-edge-auth';
+/** Min interval between misconfig warnings while rejections continue. */
+export const EDGE_AUTH_MISCONFIG_WARN_COOLDOWN_MS = 15 * 60 * 1000;
+let lastMisconfigWarnAt = 0;
+/** Resets deduped misconfig warning state (for tests). */
+export function resetEdgeAuthMisconfigWarnCooldown() {
+    lastMisconfigWarnAt = 0;
+}
+function secureCompare(provided, expected) {
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+function shouldLogMisconfigWarn(now) {
+    return (lastMisconfigWarnAt === 0 || now - lastMisconfigWarnAt >= EDGE_AUTH_MISCONFIG_WARN_COOLDOWN_MS);
+}
+function logEdgeAuthMisconfig(req) {
+    const now = Date.now();
+    if (!shouldLogMisconfigWarn(now))
+        return;
+    lastMisconfigWarnAt = now;
+    console.warn(`mcp-aiven: EXTRA_PROTECTION is enabled but X-Edge-Auth is missing or invalid — ` +
+        `verify MCP_EDGE_AUTH_SECRET matches the Cloudflare Transform Rule (${req.method} ${req.path}); ` +
+        `further warnings suppressed for ${String(EDGE_AUTH_MISCONFIG_WARN_COOLDOWN_MS / 60_000)}m`);
+}
+export function hasValidEdgeAuth(req, expectedSecret) {
+    const header = req.headers[EDGE_AUTH_HEADER];
+    if (typeof header !== 'string' || header.length === 0)
+        return false;
+    return secureCompare(header, expectedSecret);
+}
+export function createEdgeAuthMiddleware(extraProtection, edgeAuthSecret) {
+    return (req, res, next) => {
+        if (!extraProtection) {
+            next();
+            return;
+        }
+        if (req.method === 'GET' && req.path === '/health') {
+            next();
+            return;
+        }
+        if (!edgeAuthSecret || !hasValidEdgeAuth(req, edgeAuthSecret)) {
+            logEdgeAuthMisconfig(req);
+            res.status(403).json({ error: 'Forbidden' });
+            return;
+        }
+        lastMisconfigWarnAt = 0;
+        next();
+    };
+}
+//# sourceMappingURL=edge-auth.js.map

package/dist/edge-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-auth.js","sourceRoot":"","sources":["../src/edge-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,yEAAyE;AACzE,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAE5B,0DAA0D;AAC1D,MAAM,UAAU,kCAAkC;IAChD,mBAAmB,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAO,CACL,mBAAmB,KAAK,CAAC,IAAI,GAAG,GAAG,mBAAmB,IAAI,oCAAoC,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;QAAE,OAAO;IAEzC,mBAAmB,GAAG,GAAG,CAAC;IAC1B,OAAO,CAAC,IAAI,CACV,iFAAiF;QAC/E,sEAAsE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK;QACjG,mCAAmC,MAAM,CAAC,oCAAoC,GAAG,MAAM,CAAC,GAAG,CAC9F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,cAAsB;IACnE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,eAAwB,EACxB,cAAkC;IAElC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YAC9D,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,mBAAmB,GAAG,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/generated/aiven-api.d.ts

@@ -24690,6 +24690,20 @@ export interface components {
                          * @enum {string}
                          */
                         phase: "prepare" | "basebackup" | "basebackup_prepare" | "stream" | "finalize";
+                        /**
+                         * Restore chain position
+                         * @description Position in the backup chain being restored. May be missing.
+                         */
+                        position?: {
+                            /** @description Whether the backup currently being restored is an incremental one */
+                            backup_incremental: boolean;
+                            /** @description Name of the backup currently being restored, matching the name in the service backup list */
+                            backup_name: string;
+                            /** @description 1-based position of the backup currently being restored within the restore chain */
+                            chain_index: number;
+                            /** @description Total number of backups in the restore chain */
+                            chain_total: number;
+                        };
                         /**
                          * @description Unit for current/min/max values. New units may be added. If null should be treated as generic unit
                          * @enum {string}
@@ -25338,6 +25352,20 @@ export interface components {
                          * @enum {string}
                          */
                         phase: "prepare" | "basebackup" | "basebackup_prepare" | "stream" | "finalize";
+                        /**
+                         * Restore chain position
+                         * @description Position in the backup chain being restored. May be missing.
+                         */
+                        position?: {
+                            /** @description Whether the backup currently being restored is an incremental one */
+                            backup_incremental: boolean;
+                            /** @description Name of the backup currently being restored, matching the name in the service backup list */
+                            backup_name: string;
+                            /** @description 1-based position of the backup currently being restored within the restore chain */
+                            chain_index: number;
+                            /** @description Total number of backups in the restore chain */
+                            chain_total: number;
+                        };
                         /**
                          * @description Unit for current/min/max values. New units may be added. If null should be treated as generic unit
                          * @enum {string}
@@ -25893,6 +25921,20 @@ export interface components {
                          * @enum {string}
                          */
                         phase: "prepare" | "basebackup" | "basebackup_prepare" | "stream" | "finalize";
+                        /**
+                         * Restore chain position
+                         * @description Position in the backup chain being restored. May be missing.
+                         */
+                        position?: {
+                            /** @description Whether the backup currently being restored is an incremental one */
+                            backup_incremental: boolean;
+                            /** @description Name of the backup currently being restored, matching the name in the service backup list */
+                            backup_name: string;
+                            /** @description 1-based position of the backup currently being restored within the restore chain */
+                            chain_index: number;
+                            /** @description Total number of backups in the restore chain */
+                            chain_total: number;
+                        };
                         /**
                          * @description Unit for current/min/max values. New units may be added. If null should be treated as generic unit
                          * @enum {string}
@@ -27083,6 +27125,20 @@ export interface components {
                          * @enum {string}
                          */
                         phase: "prepare" | "basebackup" | "basebackup_prepare" | "stream" | "finalize";
+                        /**
+                         * Restore chain position
+                         * @description Position in the backup chain being restored. May be missing.
+                         */
+                        position?: {
+                            /** @description Whether the backup currently being restored is an incremental one */
+                            backup_incremental: boolean;
+                            /** @description Name of the backup currently being restored, matching the name in the service backup list */
+                            backup_name: string;
+                            /** @description 1-based position of the backup currently being restored within the restore chain */
+                            chain_index: number;
+                            /** @description Total number of backups in the restore chain */
+                            chain_total: number;
+                        };
                         /**
                          * @description Unit for current/min/max values. New units may be added. If null should be treated as generic unit
                          * @enum {string}
@@ -27747,6 +27803,20 @@ export interface components {
                          * @enum {string}
                          */
                         phase: "prepare" | "basebackup" | "basebackup_prepare" | "stream" | "finalize";
+                        /**
+                         * Restore chain position
+                         * @description Position in the backup chain being restored. May be missing.
+                         */
+                        position?: {
+                            /** @description Whether the backup currently being restored is an incremental one */
+                            backup_incremental: boolean;
+                            /** @description Name of the backup currently being restored, matching the name in the service backup list */
+                            backup_name: string;
+                            /** @description 1-based position of the backup currently being restored within the restore chain */
+                            chain_index: number;
+                            /** @description Total number of backups in the restore chain */
+                            chain_total: number;
+                        };
                         /**
                          * @description Unit for current/min/max values. New units may be added. If null should be treated as generic unit
                          * @enum {string}
@@ -28421,6 +28491,20 @@ export interface components {
                          * @enum {string}
                          */
                         phase: "prepare" | "basebackup" | "basebackup_prepare" | "stream" | "finalize";
+                        /**
+                         * Restore chain position
+                         * @description Position in the backup chain being restored. May be missing.
+                         */
+                        position?: {
+                            /** @description Whether the backup currently being restored is an incremental one */
+                            backup_incremental: boolean;
+                            /** @description Name of the backup currently being restored, matching the name in the service backup list */
+                            backup_name: string;
+                            /** @description 1-based position of the backup currently being restored within the restore chain */
+                            chain_index: number;
+                            /** @description Total number of backups in the restore chain */
+                            chain_total: number;
+                        };
                         /**
                          * @description Unit for current/min/max values. New units may be added. If null should be treated as generic unit
                          * @enum {string}
@@ -28918,6 +29002,20 @@ export interface components {
                          * @enum {string}
                          */
                         phase: "prepare" | "basebackup" | "basebackup_prepare" | "stream" | "finalize";
+                        /**
+                         * Restore chain position
+                         * @description Position in the backup chain being restored. May be missing.
+                         */
+                        position?: {
+                            /** @description Whether the backup currently being restored is an incremental one */
+                            backup_incremental: boolean;
+                            /** @description Name of the backup currently being restored, matching the name in the service backup list */
+                            backup_name: string;
+                            /** @description 1-based position of the backup currently being restored within the restore chain */
+                            chain_index: number;
+                            /** @description Total number of backups in the restore chain */
+                            chain_total: number;
+                        };
                         /**
                          * @description Unit for current/min/max values. New units may be added. If null should be treated as generic unit
                          * @enum {string}