@goondocks/myco 0.17.2 → 0.18.1

package/dist/src/worker/package.json

@@ -13,5 +13,10 @@
     "@cloudflare/workers-types": "^4.20250320.0",
     "typescript": "^5.7.0",
     "wrangler": "^4.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "agents": "^0.10.0",
+    "zod": "^4.3.6"
   }
 }

package/dist/src/worker/src/index.ts

@@ -8,6 +8,10 @@
 
 import { initD1Schema } from './schema';
 import { validateAuth } from './auth';
+import { createMcpHandler } from 'agents/mcp';
+import { createMcpServerInstance } from './mcp/server';
+import { authenticateMcpRequest, ensureMcpToken, rotateMcpToken, getMcpTokenHash, MCP_TOKEN_KEY } from './mcp/auth';
+import { embedText, hydrateVectorMatches } from './search-helpers';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -19,6 +23,7 @@ export interface Env {
   AI: Ai;
   MYCO_TEAM_API_KEY: string;
   SYNC_PROTOCOL_VERSION: string;
+  MYCO_SECRETS: KVNamespace;
 }
 
 /** Tables that support embedding in Vectorize. */
@@ -27,6 +32,7 @@ const EMBEDDABLE_TABLES: Record<string, string> = {
   sessions: 'summary',
   plans: 'content',
   artifacts: 'content',
+  skill_records: 'description',
 };
 
 /** All tables the sync endpoint accepts records for. */
@@ -112,13 +118,6 @@ function vectorId(table: string, id: string, machineId: string): string {
   return `${table}:${id}:${machineId}`;
 }
 
-/**
- * Embed text via Workers AI (bge-m3) and return the vector.
- */
-async function embedText(ai: Ai, text: string): Promise<number[]> {
-  const result = await ai.run('@cf/baai/bge-m3', { text: [text] });
-  return result.data[0];
-}
 
 /**
  * Build column names and placeholders for an INSERT OR REPLACE from a data object.
@@ -150,10 +149,15 @@ function buildInsertParts(
 // ---------------------------------------------------------------------------
 
 async function handleHealth(env: Env): Promise<Response> {
-  const result = await env.MYCO_TEAM_DB.prepare('SELECT COUNT(*) as count FROM nodes').first<{
-    count: number;
-  }>();
-  return jsonResponse({ status: 'ok', nodes: result?.count ?? 0 });
+  const [countResult, storedToken] = await Promise.all([
+    env.MYCO_TEAM_DB.prepare('SELECT COUNT(*) as count FROM nodes').first<{ count: number }>(),
+    env.MYCO_SECRETS.get(MCP_TOKEN_KEY),
+  ]);
+
+  const count = countResult?.count ?? 0;
+  const mcpTokenHash = storedToken ? getMcpTokenHash(storedToken) : null;
+
+  return jsonResponse({ status: 'ok', nodes: count, mcp_token_hash: mcpTokenHash });
 }
 
 async function handleConnect(request: Request, env: Env): Promise<Response> {
@@ -191,10 +195,15 @@ async function handleConnect(request: Request, env: Env): Promise<Response> {
     config[row.key] = row.value;
   }
 
+  // MCP token is stored in KV (encrypted at rest), not in team_config
+  const mcpToken = await ensureMcpToken(env.MYCO_SECRETS);
+
   return jsonResponse({
     status: 'connected',
     sync_protocol_version: parseInt(env.SYNC_PROTOCOL_VERSION, 10),
     config,
+    mcp_token: mcpToken,
+    mcp_endpoint: '/mcp',
   });
 }
 
@@ -261,7 +270,11 @@ async function handleSync(request: Request, env: Env): Promise<Response> {
           if (table === 'spores' && record.data.status === 'superseded') {
             embeddingTasks.push(() => deleteVector(env, table, id, machine_id));
           } else {
-            embeddingTasks.push(() => embedAndUpsert(env, table, id, machine_id, textContent));
+            // Include domain-specific metadata for richer search results
+            const extra: Record<string, string> = {};
+            if (table === 'skill_records' && record.data.name) extra.name = record.data.name as string;
+            if (table === 'spores' && record.data.observation_type) extra.observation_type = record.data.observation_type as string;
+            embeddingTasks.push(() => embedAndUpsert(env, table, id, machine_id, textContent, extra));
           }
         }
       }
@@ -303,6 +316,7 @@ async function embedAndUpsert(
   id: string,
   machineId: string,
   text: string,
+  extra?: Record<string, string>,
 ): Promise<void> {
   const vector = await embedText(env.AI, text);
   const vid = vectorId(table, id, machineId);
@@ -310,7 +324,7 @@ async function embedAndUpsert(
     {
       id: vid,
       values: vector,
-      metadata: { table, id, machine_id: machineId },
+      metadata: { table, id, machine_id: machineId, ...extra },
     },
   ]);
 }
@@ -333,61 +347,16 @@ async function handleSearch(request: Request, env: Env): Promise<Response> {
 
   const topK = Math.min(parseInt(url.searchParams.get('top_k') ?? String(DEFAULT_TOP_K), 10), MAX_TOP_K);
 
-  // Embed query
   const queryVector = await embedText(env.AI, query);
+  const matches = await env.MYCO_TEAM_VECTORS.query(queryVector, { topK, returnMetadata: 'all' });
 
-  // Search Vectorize
-  const matches = await env.MYCO_TEAM_VECTORS.query(queryVector, {
-    topK,
-    returnMetadata: 'all',
-  });
-
-  // Group matches by table for batch hydration
-  const byTable = new Map<string, { id: string; machine_id: string; score: number }[]>();
-  for (const match of matches.matches) {
-    const meta = match.metadata as { table: string; id: string; machine_id: string } | undefined;
-    if (!meta) continue;
-    let group = byTable.get(meta.table);
-    if (!group) {
-      group = [];
-      byTable.set(meta.table, group);
-    }
-    group.push({ id: meta.id, machine_id: meta.machine_id, score: match.score });
-  }
+  const validMatches = matches.matches
+    .filter((m) => m.metadata)
+    .map((m) => ({ metadata: m.metadata as { table: string; id: string; machine_id: string }, score: m.score }));
 
-  // Batch-query each table and build results
-  const results: SearchResult[] = [];
-  for (const [table, items] of byTable) {
-    const placeholders = items.map(() => '(?, ?)').join(', ');
-    const binds = items.flatMap((i) => [i.id, i.machine_id]);
-    const { results: rows } = await env.MYCO_TEAM_DB.prepare(
-      `SELECT * FROM ${table} WHERE (id, machine_id) IN (VALUES ${placeholders})`,
-    ).bind(...binds).all();
-
-    const rowMap = new Map<string, Record<string, unknown>>();
-    for (const row of rows) {
-      const r = row as Record<string, unknown>;
-      rowMap.set(`${r.id}:${r.machine_id}`, r);
-    }
+  const results = await hydrateVectorMatches(env.MYCO_TEAM_DB, validMatches);
 
-    for (const item of items) {
-      const row = rowMap.get(`${item.id}:${item.machine_id}`);
-      if (row) {
-        results.push({
-          table,
-          id: item.id,
-          machine_id: item.machine_id,
-          score: item.score,
-          data: row,
-        });
-      }
-    }
-  }
-
-  // Sort by score to preserve ranking after batch hydration
-  results.sort((a, b) => b.score - a.score);
-
-  return jsonResponse({ results });
+  return jsonResponse({ results: results.map((r) => ({ table: r.type, ...r })) });
 }
 
 async function handleGetConfig(env: Env): Promise<Response> {
@@ -429,7 +398,7 @@ async function handlePutConfig(request: Request, env: Env): Promise<Response> {
 // ---------------------------------------------------------------------------
 
 export default {
-  async fetch(request: Request, env: Env): Promise<Response> {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
     const url = new URL(request.url);
     const path = url.pathname;
     const method = request.method;
@@ -448,6 +417,30 @@ export default {
       }
     }
 
+    // MCP routes — separate auth from sync routes
+    if (path.startsWith('/mcp')) {
+      if (!schemaInitialized) {
+        await initD1Schema(env.MYCO_TEAM_DB);
+        schemaInitialized = true;
+      }
+
+      // Token rotation — authenticated with team API key
+      if (path === '/mcp/rotate' && method === 'POST') {
+        const rotateAuthError = validateAuth(request, env);
+        if (rotateAuthError) return rotateAuthError;
+        const newToken = await rotateMcpToken(env.MYCO_SECRETS);
+        return jsonResponse({ token: newToken });
+      }
+
+      // MCP protocol — authenticated with MCP access token
+      const mcpAuthError = await authenticateMcpRequest(request, env.MYCO_SECRETS);
+      if (mcpAuthError) return mcpAuthError;
+
+      const server = createMcpServerInstance(env);
+      const handler = createMcpHandler(server);
+      return handler(request, env, ctx);
+    }
+
     // All other routes require auth
     const authError = validateAuth(request, env);
     if (authError) return authError;

package/dist/src/worker/src/mcp/auth.ts

@@ -0,0 +1,65 @@
+/**
+ * MCP access token auth for the Myco cloud MCP server.
+ *
+ * Tokens are stored in Workers KV (MYCO_SECRETS namespace) under the key 'mcp_access_token'.
+ * KV provides AES-256-GCM encryption at rest — the Cloudflare-native approach for
+ * runtime-managed secrets. This is separate from the worker's MYCO_TEAM_API_KEY auth
+ * used for sync routes.
+ */
+
+export const MCP_TOKEN_KEY = 'mcp_access_token';
+
+export function generateMcpToken(): string {
+  return crypto.randomUUID();
+}
+
+export function getMcpTokenHash(token: string): string {
+  // Non-cryptographic hash for change detection, returns 8 hex chars
+  let hash = 0;
+  for (let i = 0; i < token.length; i++) {
+    hash = ((hash << 5) - hash + token.charCodeAt(i)) | 0;
+  }
+  return Math.abs(hash).toString(16).padStart(8, '0').slice(0, 8);
+}
+
+export async function validateMcpToken(kv: KVNamespace, token: string): Promise<boolean> {
+  const stored = await kv.get(MCP_TOKEN_KEY);
+  if (!stored) return false;
+  return stored === token;
+}
+
+export async function ensureMcpToken(kv: KVNamespace): Promise<string> {
+  const existing = await kv.get(MCP_TOKEN_KEY);
+  if (existing) return existing;
+  const token = generateMcpToken();
+  await kv.put(MCP_TOKEN_KEY, token);
+  return token;
+}
+
+export async function rotateMcpToken(kv: KVNamespace): Promise<string> {
+  const token = generateMcpToken();
+  await kv.put(MCP_TOKEN_KEY, token);
+  return token;
+}
+
+export async function authenticateMcpRequest(
+  request: Request,
+  kv: KVNamespace,
+): Promise<Response | null> {
+  const header = request.headers.get('Authorization');
+  if (!header) {
+    return new Response(JSON.stringify({ error: 'Missing Authorization header' }), {
+      status: 401,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+  const token = header.startsWith('Bearer ') ? header.slice(7) : '';
+  const valid = await validateMcpToken(kv, token);
+  if (!valid) {
+    return new Response(JSON.stringify({ error: 'Invalid MCP access token' }), {
+      status: 401,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+  return null;
+}

package/dist/src/worker/src/mcp/server.ts

@@ -0,0 +1,53 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import type { Env } from '../index';
+import { handleSearch } from './tools/search';
+import { handleContext } from './tools/context';
+import { handleGet } from './tools/get';
+import { handleSessions } from './tools/sessions';
+import { handleGraph } from './tools/graph';
+import { handleSkills } from './tools/skills';
+import { handleTeam } from './tools/team';
+
+export function createMcpServerInstance(env: Env): McpServer {
+  const server = new McpServer({ name: 'myco', version: '1.0.0' });
+
+  server.tool('myco_search', 'Semantic and keyword search across all project knowledge — spores, sessions, plans, artifacts. Returns ranked results with content previews.', {
+    query: z.string().describe('The search query'),
+    types: z.array(z.string()).optional().describe('Filter to content types: spores, sessions, plans, artifacts'),
+    limit: z.number().min(1).max(50).default(10).describe('Maximum results'),
+  }, async (args) => handleSearch(args, env));
+
+  server.tool('myco_context', 'Pre-synthesized project digest. Start here to understand the project. Three tiers: 1500 (executive), 5000 (deep onboarding), 10000 (comprehensive).', {
+    tier: z.number().optional().describe('Digest depth: 1500, 5000 (default), or 10000'),
+  }, async (args) => handleContext(args, env));
+
+  server.tool('myco_get', 'Retrieve a specific item by ID and type. Use after search to get full details.', {
+    id: z.string().describe('The item ID'),
+    type: z.enum(['session', 'spore', 'plan', 'artifact', 'skill']).describe('The item type'),
+  }, async (args) => handleGet(args, env));
+
+  server.tool('myco_sessions', 'List and filter coding sessions. Useful for recent activity, work by branch or agent.', {
+    limit: z.number().min(1).max(100).default(20).optional().describe('Maximum sessions'),
+    status: z.string().optional().describe('Filter: active, completed'),
+    agent: z.string().optional().describe('Filter: claude, codex, cursor, etc.'),
+    branch: z.string().optional().describe('Filter by git branch'),
+    since: z.string().optional().describe('ISO date — sessions after this date'),
+  }, async (args) => handleSessions(args, env));
+
+  server.tool('myco_graph', 'Traverse the knowledge graph from an entity or note. Returns edges and connected entities.', {
+    node_id: z.string().describe('Entity or note ID to traverse from'),
+    direction: z.enum(['incoming', 'outgoing', 'both']).default('both').optional().describe('Edge direction'),
+  }, async (args) => handleGraph(args, env));
+
+  server.tool('myco_skills', 'List project skills — reusable patterns extracted from project knowledge.', {
+    status: z.string().optional().describe('Filter: active, draft, retired'),
+    limit: z.number().min(1).max(100).default(50).optional().describe('Maximum skills'),
+  }, async (args) => handleSkills(args, env));
+
+  // handleTeam takes only env (no args) since it has no parameters
+  server.tool('myco_team', 'List team nodes — machines/developers connected to this project with sync status.', {},
+    async () => handleTeam(env));
+
+  return server;
+}

package/dist/src/worker/src/mcp/tools/context.ts

@@ -0,0 +1,13 @@
+import type { Env } from '../../index';
+
+export async function handleContext(args: { tier?: number }, env: Pick<Env, 'MYCO_TEAM_DB'>) {
+  const tier = args.tier ?? 5000;
+  const row = await env.MYCO_TEAM_DB.prepare(
+    `SELECT id, tier, content, generated_at FROM digest_extracts WHERE tier = ? ORDER BY generated_at DESC LIMIT 1`,
+  ).bind(tier).first<{ id: string; tier: number; content: string; generated_at: number }>();
+
+  if (!row) {
+    return { content: [{ type: 'text' as const, text: JSON.stringify({ content: null, tier, message: `No digest available at tier ${tier}` }) }] };
+  }
+  return { content: [{ type: 'text' as const, text: JSON.stringify({ content: row.content, tier: row.tier, generated_at: row.generated_at }) }] };
+}

package/dist/src/worker/src/mcp/tools/get.ts

@@ -0,0 +1,15 @@
+import type { Env } from '../../index';
+
+const TYPE_TO_TABLE: Record<string, string> = {
+  session: 'sessions', spore: 'spores', plan: 'plans', artifact: 'artifacts', skill: 'skill_records',
+};
+
+export async function handleGet(args: { id: string; type: string }, env: Pick<Env, 'MYCO_TEAM_DB'>) {
+  const table = TYPE_TO_TABLE[args.type];
+  if (!table) return { content: [{ type: 'text' as const, text: JSON.stringify({ error: `Unknown type: ${args.type}` }) }] };
+
+  const row = await env.MYCO_TEAM_DB.prepare(`SELECT * FROM ${table} WHERE id = ? LIMIT 1`).bind(args.id).first<Record<string, unknown>>();
+  if (!row) return { content: [{ type: 'text' as const, text: JSON.stringify({ error: `${args.type} '${args.id}' not found` }) }] };
+
+  return { content: [{ type: 'text' as const, text: JSON.stringify(row) }] };
+}

package/dist/src/worker/src/mcp/tools/graph.ts

@@ -0,0 +1,35 @@
+import type { Env } from '../../index';
+
+export async function handleGraph(
+  args: { node_id: string; direction?: string },
+  env: Pick<Env, 'MYCO_TEAM_DB'>,
+) {
+  const { node_id, direction = 'both' } = args;
+  let edgeCondition: string;
+  const edgeBinds: string[] = [];
+
+  if (direction === 'outgoing') { edgeCondition = 'source_id = ?'; edgeBinds.push(node_id); }
+  else if (direction === 'incoming') { edgeCondition = 'target_id = ?'; edgeBinds.push(node_id); }
+  else { edgeCondition = '(source_id = ? OR target_id = ?)'; edgeBinds.push(node_id, node_id); }
+
+  const { results: edges } = await env.MYCO_TEAM_DB.prepare(
+    `SELECT id, source_id, source_type, target_id, target_type, type, confidence, properties FROM graph_edges WHERE ${edgeCondition} LIMIT 100`,
+  ).bind(...edgeBinds).all();
+
+  const entityIds = new Set<string>();
+  for (const edge of edges as Array<Record<string, unknown>>) {
+    if (edge.source_type === 'entity') entityIds.add(edge.source_id as string);
+    if (edge.target_type === 'entity') entityIds.add(edge.target_id as string);
+  }
+
+  let entities: Record<string, unknown>[] = [];
+  if (entityIds.size > 0) {
+    const placeholders = [...entityIds].map(() => '?').join(', ');
+    const { results } = await env.MYCO_TEAM_DB.prepare(
+      `SELECT id, type, name, properties, first_seen, last_seen FROM entities WHERE id IN (${placeholders})`,
+    ).bind(...entityIds).all();
+    entities = results as Record<string, unknown>[];
+  }
+
+  return { content: [{ type: 'text' as const, text: JSON.stringify({ node_id, edges, entities }) }] };
+}

package/dist/src/worker/src/mcp/tools/search.ts

@@ -0,0 +1,32 @@
+import type { Env } from '../../index';
+import { embedText, hydrateVectorMatches } from '../../search-helpers';
+
+interface SearchArgs {
+  query: string;
+  types?: string[];
+  limit?: number;
+}
+
+export async function handleSearch(args: SearchArgs, env: Pick<Env, 'MYCO_TEAM_DB' | 'MYCO_TEAM_VECTORS' | 'AI'>) {
+  const { query, types, limit = 10 } = args;
+  const topK = Math.min(Math.max(limit, 1), 50);
+
+  const queryVector = await embedText(env.AI, query);
+  const matches = await env.MYCO_TEAM_VECTORS.query(queryVector, { topK, returnMetadata: 'all' });
+
+  // Filter by types if specified, then cast metadata
+  let filtered = matches.matches.filter((m) => m.metadata);
+  if (types && types.length > 0) {
+    const typeSet = new Set(types);
+    filtered = filtered.filter((m) => typeSet.has((m.metadata as { table: string }).table));
+  }
+
+  const validMatches = filtered.map((m) => ({
+    metadata: m.metadata as { table: string; id: string; machine_id: string },
+    score: m.score,
+  }));
+
+  const results = await hydrateVectorMatches(env.MYCO_TEAM_DB, validMatches);
+
+  return { content: [{ type: 'text' as const, text: JSON.stringify({ results: results.slice(0, topK) }) }] };
+}

package/dist/src/worker/src/mcp/tools/sessions.ts

@@ -0,0 +1,24 @@
+import type { Env } from '../../index';
+
+export async function handleSessions(
+  args: { limit?: number; status?: string; agent?: string; branch?: string; since?: string },
+  env: Pick<Env, 'MYCO_TEAM_DB'>,
+) {
+  const { limit = 20, status, agent, branch, since } = args;
+  const conditions: string[] = [];
+  const binds: unknown[] = [];
+
+  if (status) { conditions.push('status = ?'); binds.push(status); }
+  if (agent) { conditions.push('agent = ?'); binds.push(agent); }
+  if (branch) { conditions.push('branch = ?'); binds.push(branch); }
+  if (since) { conditions.push('started_at >= ?'); binds.push(Math.floor(new Date(since).getTime() / 1000)); }
+
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+  binds.push(Math.min(Math.max(limit, 1), 100));
+
+  const { results } = await env.MYCO_TEAM_DB.prepare(
+    `SELECT id, machine_id, agent, "user", branch, status, title, SUBSTR(summary, 1, 300) as summary, prompt_count, tool_count, started_at, ended_at FROM sessions ${where} ORDER BY started_at DESC LIMIT ?`,
+  ).bind(...binds).all();
+
+  return { content: [{ type: 'text' as const, text: JSON.stringify({ sessions: results }) }] };
+}

package/dist/src/worker/src/mcp/tools/skills.ts

@@ -0,0 +1,16 @@
+import type { Env } from '../../index';
+
+export async function handleSkills(args: { status?: string; limit?: number }, env: Pick<Env, 'MYCO_TEAM_DB'>) {
+  const { status, limit = 50 } = args;
+  const conditions: string[] = [];
+  const binds: unknown[] = [];
+  if (status) { conditions.push('status = ?'); binds.push(status); }
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+  binds.push(Math.min(Math.max(limit, 1), 100));
+
+  const { results } = await env.MYCO_TEAM_DB.prepare(
+    `SELECT id, machine_id, name, display_name, description, status, generation, usage_count, last_used_at, created_at, updated_at FROM skill_records ${where} ORDER BY usage_count DESC, created_at DESC LIMIT ?`,
+  ).bind(...binds).all();
+
+  return { content: [{ type: 'text' as const, text: JSON.stringify({ skills: results }) }] };
+}

package/dist/src/worker/src/mcp/tools/team.ts

@@ -0,0 +1,9 @@
+import type { Env } from '../../index';
+
+export async function handleTeam(env: Pick<Env, 'MYCO_TEAM_DB'>) {
+  const { results } = await env.MYCO_TEAM_DB.prepare(
+    `SELECT machine_id, package_version, schema_version, sync_protocol_version, last_seen, registered_at FROM nodes ORDER BY last_seen DESC`,
+  ).all();
+
+  return { content: [{ type: 'text' as const, text: JSON.stringify({ nodes: results }) }] };
+}

package/dist/src/worker/src/schema.ts

@@ -8,7 +8,9 @@
  * Fully idempotent — safe to call on every request.
  */
 
-import { CANDIDATE_STATUS } from '@myco/constants/skill-candidate-status.js';
+// Inline constants — the worker is deployed independently and cannot
+// import from the main @myco package at runtime.
+const CANDIDATE_STATUS = { APPROVED: 'approved', GENERATED: 'generated' } as const;
 
 const SESSIONS_TABLE = `
   CREATE TABLE IF NOT EXISTS sessions (
@@ -196,6 +198,7 @@ const SKILL_CANDIDATES_TABLE = `
     status          TEXT NOT NULL DEFAULT 'identified',
     source_ids      TEXT NOT NULL DEFAULT '[]',
     skill_id        TEXT,
+    supersedes      TEXT,
     approved_at     INTEGER,
     created_at      INTEGER NOT NULL,
     updated_at      INTEGER NOT NULL,
@@ -299,6 +302,7 @@ export async function initD1Schema(db: D1Database): Promise<void> {
   const migrations = [
     'ALTER TABLE skill_usage ADD COLUMN synced_at INTEGER',
     'ALTER TABLE skill_candidates ADD COLUMN approved_at INTEGER',
+    'ALTER TABLE skill_candidates ADD COLUMN supersedes TEXT',
   ];
   for (const sql of migrations) {
     try {

package/dist/src/worker/src/search-helpers.ts

@@ -0,0 +1,70 @@
+/**
+ * Shared search helpers used by both the REST /search endpoint and MCP myco_search tool.
+ */
+
+/**
+ * Embed text via Workers AI (bge-m3) and return the vector.
+ */
+export async function embedText(ai: Ai, text: string): Promise<number[]> {
+  const result = await ai.run('@cf/baai/bge-m3', { text: [text] }) as { data: number[][] };
+  return result.data[0];
+}
+
+export interface HydratedResult {
+  id: string;
+  machine_id: string;
+  type: string;
+  score: number;
+  data: Record<string, unknown>;
+}
+
+interface VectorMatch {
+  metadata: { table: string; id: string; machine_id: string };
+  score: number;
+}
+
+/**
+ * Group Vectorize matches by table and batch-hydrate each group from D1.
+ * Queries run in parallel across tables.
+ */
+export async function hydrateVectorMatches(
+  db: D1Database,
+  matches: VectorMatch[],
+): Promise<HydratedResult[]> {
+  // Group by table
+  const groups = new Map<string, Array<{ id: string; machine_id: string; score: number }>>();
+  for (const match of matches) {
+    const { table, id, machine_id } = match.metadata;
+    const group = groups.get(table) ?? [];
+    group.push({ id, machine_id, score: match.score });
+    groups.set(table, group);
+  }
+
+  // Hydrate all tables in parallel
+  const hydrationPromises = [...groups.entries()].map(async ([table, items]) => {
+    const placeholders = items.map(() => '(?, ?)').join(', ');
+    const binds = items.flatMap((item) => [item.id, item.machine_id]);
+    const { results: rows } = await db.prepare(
+      `SELECT * FROM ${table} WHERE (id, machine_id) IN (VALUES ${placeholders})`,
+    ).bind(...binds).all();
+
+    const rowMap = new Map<string, Record<string, unknown>>();
+    for (const row of rows as Record<string, unknown>[]) {
+      rowMap.set(`${row.id}:${row.machine_id}`, row);
+    }
+
+    const results: HydratedResult[] = [];
+    for (const item of items) {
+      const row = rowMap.get(`${item.id}:${item.machine_id}`);
+      if (row) {
+        results.push({ id: item.id, machine_id: item.machine_id, type: table, score: item.score, data: row });
+      }
+    }
+    return results;
+  });
+
+  const resultArrays = await Promise.all(hydrationPromises);
+  const results = resultArrays.flat();
+  results.sort((a, b) => b.score - a.score);
+  return results;
+}

package/dist/src/worker/wrangler.toml

@@ -1,6 +1,10 @@
 name = "myco-team-sync"
 main = "src/index.ts"
 compatibility_date = "2025-03-27"
+# nodejs_compat is required by the agents SDK and @modelcontextprotocol/sdk,
+# which depend on packages that import Node.js built-ins (node:async_hooks,
+# node:diagnostics_channel, node:os, etc.).
+compatibility_flags = [ "nodejs_compat" ]
 
 [vars]
 SYNC_PROTOCOL_VERSION = "1"
@@ -16,6 +20,11 @@ database_id = "<YOUR_D1_DATABASE_ID>"
 binding = "MYCO_TEAM_VECTORS"
 index_name = "myco-team-vectors"
 
+# KV namespace for runtime secrets (MCP tokens, etc.)
+[[kv_namespaces]]
+binding = "MYCO_SECRETS"
+id = "<YOUR_KV_NAMESPACE_ID>"
+
 # Workers AI binding
 [ai]
 binding = "AI"

package/dist/{stats-BISBIBXZ.js → stats-GEOQ2DFF.js}

@@ -1,19 +1,19 @@
 import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
 import {
   gatherStats
-} from "./chunk-BZDZORVP.js";
+} from "./chunk-LSP5HYOO.js";
 import {
   initVaultDb
-} from "./chunk-CTF7TQMJ.js";
+} from "./chunk-TLK46KKD.js";
 import "./chunk-SAKJMNSR.js";
-import "./chunk-VVGZL2HX.js";
-import "./chunk-ML6GTPZU.js";
-import "./chunk-XD3NEN3Q.js";
+import "./chunk-WYOE4IAX.js";
+import "./chunk-CML4MCYF.js";
+import "./chunk-2V7HR7HB.js";
 import "./chunk-MYX5NCRH.js";
-import "./chunk-XZWFMMJR.js";
-import "./chunk-SI5BBQAT.js";
+import "./chunk-XWOQL4XN.js";
+import "./chunk-W7WENJ6F.js";
 import "./chunk-LPUQPDC2.js";
-import "./chunk-7DAH5GLC.js";
+import "./chunk-CKJAWZQE.js";
 import "./chunk-E7NUADTQ.js";
 import "./chunk-D7TYRPRM.js";
 import "./chunk-E4VLWIJC.js";
@@ -92,4 +92,4 @@ function formatUptime(seconds) {
 export {
   run
 };
-//# sourceMappingURL=stats-BISBIBXZ.js.map
+//# sourceMappingURL=stats-GEOQ2DFF.js.map