trapic-mcp 0.1.0

package/dist/worker.js

@@ -0,0 +1,700 @@
+/**
+ * Cloudflare Worker entry point for trapic-mcp
+ * Uses Web Standard Streamable HTTP transport (stateless mode)
+ * With Bearer token authentication
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { registerCreate } from "./tools/create.js";
+import { registerSearch } from "./tools/search.js";
+import { registerChain } from "./tools/chain.js";
+import { registerActive } from "./tools/active.js";
+import { registerUpdate } from "./tools/update.js";
+import { registerExtract } from "./tools/extract.js";
+import { registerContext } from "./tools/context.js";
+import { registerSummary } from "./tools/summary.js";
+import { registerPreload } from "./tools/preload.js";
+import { isRateLimited, recordRequest } from "./rate-limit.js";
+import { getSupabase } from "./supabase.js";
+import { runArchive } from "./archive.js";
+import { setWaitUntil } from "./background.js";
+// Auth code replay prevention (per-isolate layer)
+const consumedCodes = new Map();
+const CODE_EXPIRY_MS = 5 * 60 * 1000;
+function cleanupConsumedCodes() {
+    const now = Date.now();
+    for (const [key, ts] of consumedCodes) {
+        if (now - ts > CODE_EXPIRY_MS)
+            consumedCodes.delete(key);
+    }
+}
+function generateRandomString(length) {
+    const bytes = new Uint8Array(length);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes).map(b => b.toString(16).padStart(2, "0")).join("");
+}
+// Signed auth code: encodes userId + codeChallenge + redirectUri + expiry into a tamper-proof string
+// Uses SUPABASE_SERVICE_ROLE_KEY as HMAC secret (available in all Worker instances)
+async function createAuthCode(env, userId, codeChallenge, redirectUri) {
+    const payload = JSON.stringify({
+        uid: userId,
+        cc: codeChallenge,
+        ru: redirectUri,
+        exp: Date.now() + 5 * 60 * 1000,
+    });
+    const payloadB64 = btoa(payload);
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(env.SUPABASE_SERVICE_ROLE_KEY), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payloadB64));
+    const sigHex = Array.from(new Uint8Array(sig)).map(b => b.toString(16).padStart(2, "0")).join("");
+    return `${payloadB64}.${sigHex}`;
+}
+async function verifyAuthCode(env, code) {
+    const parts = code.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [payloadB64, sigHex] = parts;
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(env.SUPABASE_SERVICE_ROLE_KEY), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+    const sigBytes = new Uint8Array(sigHex.match(/.{2}/g).map(h => parseInt(h, 16)));
+    const valid = await crypto.subtle.verify("HMAC", key, sigBytes, new TextEncoder().encode(payloadB64));
+    if (!valid)
+        return null;
+    const payload = JSON.parse(atob(payloadB64));
+    if (payload.exp < Date.now())
+        return null;
+    return { userId: payload.uid, codeChallenge: payload.cc, redirectUri: payload.ru };
+}
+async function hashToken(token) {
+    const data = new TextEncoder().encode(token);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    return Array.from(new Uint8Array(hashBuffer))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function resolveUserId(authHeader) {
+    if (!authHeader?.startsWith("Bearer "))
+        return null;
+    const token = authHeader.slice(7);
+    if (!token.startsWith("tr_"))
+        return null;
+    const tokenHash = await hashToken(token);
+    const supabase = getSupabase();
+    const { data } = await supabase
+        .from("trace_api_tokens")
+        .select("user_id")
+        .eq("token_hash", tokenHash)
+        .is("revoked_at", null)
+        .single();
+    if (!data)
+        return null;
+    // Update last_used_at (fire-and-forget)
+    supabase
+        .from("trace_api_tokens")
+        .update({ last_used_at: new Date().toISOString() })
+        .eq("token_hash", tokenHash)
+        .then(() => { }, (err) => console.error("[bg]", err.message));
+    return data.user_id;
+}
+function escapeHtml(str) {
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+function getCorsOrigin(request) {
+    const origin = request.headers.get("Origin") || "";
+    const allowed = ["https://trapic.ai", "https://www.trapic.ai", "http://localhost:5173"];
+    return allowed.includes(origin) ? origin : allowed[0];
+}
+function isValidRedirectUri(uri) {
+    try {
+        const parsed = new URL(uri);
+        const allowed = ["localhost", "127.0.0.1", "trapic.ai"];
+        return allowed.some(h => parsed.hostname === h || parsed.hostname.endsWith("." + h));
+    }
+    catch {
+        return false;
+    }
+}
+function createServer(userId) {
+    const server = new McpServer({
+        name: "trapic-mcp",
+        version: "0.1.0",
+    });
+    registerCreate(server, userId);
+    registerSearch(server, userId);
+    registerChain(server, userId);
+    registerActive(server, userId);
+    registerUpdate(server, userId);
+    registerExtract(server);
+    registerContext(server, userId);
+    registerSummary(server, userId);
+    registerPreload(server, userId);
+    return server;
+}
+export default {
+    async fetch(request, env, ctx) {
+        setWaitUntil((p) => ctx.waitUntil(p));
+        const url = new URL(request.url);
+        // CORS preflight
+        if (request.method === "OPTIONS") {
+            return new Response(null, {
+                headers: {
+                    "Access-Control-Allow-Origin": "*",
+                    "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+                    "Access-Control-Allow-Headers": "Content-Type, Authorization, mcp-session-id, mcp-protocol-version",
+                    "Access-Control-Max-Age": "86400",
+                },
+            });
+        }
+        // Health check (no auth needed)
+        if (url.pathname === "/health") {
+            return Response.json({
+                status: "ok",
+                server: "trapic-mcp",
+                version: "0.1.0",
+            });
+        }
+        // Inject env vars for all modules that use process.env (supabase.ts, embedding.ts, llm.ts)
+        globalThis.process = globalThis.process || { env: {} };
+        globalThis.process.env.SUPABASE_URL = env.SUPABASE_URL;
+        globalThis.process.env.SUPABASE_SERVICE_ROLE_KEY = env.SUPABASE_SERVICE_ROLE_KEY;
+        globalThis.process.env.OPENAI_API_KEY = env.OPENAI_API_KEY;
+        if (env.OPENAI_EMBED_MODEL)
+            globalThis.process.env.OPENAI_EMBED_MODEL = env.OPENAI_EMBED_MODEL;
+        if (env.GROQ_API_KEY)
+            globalThis.process.env.GROQ_API_KEY = env.GROQ_API_KEY;
+        if (env.GROQ_CHAT_MODEL)
+            globalThis.process.env.GROQ_CHAT_MODEL = env.GROQ_CHAT_MODEL;
+        // ── OAuth 2.1 Discovery & Flow ─────────────────────────────────────────
+        const origin = url.origin; // e.g. https://mcp.trapic.ai
+        // Protected Resource Metadata (RFC 9728)
+        if (url.pathname === "/.well-known/oauth-protected-resource") {
+            return Response.json({
+                resource: origin,
+                authorization_servers: [origin],
+                bearer_methods_supported: ["header"],
+            }, { headers: { "Access-Control-Allow-Origin": "*" } });
+        }
+        // Authorization Server Metadata (RFC 8414)
+        if (url.pathname === "/.well-known/oauth-authorization-server") {
+            return Response.json({
+                issuer: origin,
+                authorization_endpoint: `${origin}/oauth/authorize`,
+                token_endpoint: `${origin}/oauth/token`,
+                registration_endpoint: `${origin}/register`,
+                response_types_supported: ["code"],
+                grant_types_supported: ["authorization_code", "refresh_token"],
+                code_challenge_methods_supported: ["S256"],
+                token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+                scopes_supported: ["trapic"],
+            }, { headers: { "Access-Control-Allow-Origin": "*" } });
+        }
+        // Dynamic Client Registration (RFC 7591)
+        if (url.pathname === "/register" && request.method === "POST") {
+            try {
+                const body = await request.json();
+                // Generate a client_id for the registering client
+                const clientId = `client_${generateRandomString(16)}`;
+                return Response.json({
+                    client_id: clientId,
+                    client_name: body.client_name || "MCP Client",
+                    redirect_uris: body.redirect_uris || [],
+                    grant_types: body.grant_types || ["authorization_code"],
+                    response_types: body.response_types || ["code"],
+                    token_endpoint_auth_method: body.token_endpoint_auth_method || "none",
+                    client_id_issued_at: Math.floor(Date.now() / 1000),
+                }, {
+                    status: 201,
+                    headers: {
+                        "Access-Control-Allow-Origin": getCorsOrigin(request),
+                        "Content-Type": "application/json",
+                    },
+                });
+            }
+            catch (e) {
+                return Response.json({ error: "invalid_client_metadata" }, {
+                    status: 400,
+                    headers: { "Access-Control-Allow-Origin": getCorsOrigin(request) },
+                });
+            }
+        }
+        // OAuth Authorize — shows login form
+        if (url.pathname === "/oauth/authorize" && request.method === "GET") {
+            const clientId = url.searchParams.get("client_id") || "";
+            const redirectUri = url.searchParams.get("redirect_uri") || "";
+            const state = url.searchParams.get("state") || "";
+            const codeChallenge = url.searchParams.get("code_challenge") || "";
+            const codeChallengeMethod = url.searchParams.get("code_challenge_method") || "";
+            if (!redirectUri || !codeChallenge || codeChallengeMethod !== "S256") {
+                return new Response("Missing required OAuth parameters", { status: 400 });
+            }
+            if (!isValidRedirectUri(redirectUri)) {
+                return new Response("Invalid redirect_uri", { status: 400 });
+            }
+            const errorMsg = url.searchParams.get("error") || "";
+            const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Trapic — Sign In</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: #0a0a0a; color: #e5e5e5; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
+    .card { background: #171717; border: 1px solid #262626; border-radius: 12px; padding: 2rem; width: 100%; max-width: 380px; }
+    .logo { font-size: 1.25rem; font-weight: 700; margin-bottom: 0.25rem; }
+    .desc { color: #737373; font-size: 0.875rem; margin-bottom: 1.5rem; }
+    label { display: block; font-size: 0.8rem; color: #a3a3a3; margin-bottom: 0.25rem; }
+    input[type="email"], input[type="password"] { width: 100%; padding: 0.6rem 0.75rem; background: #0a0a0a; border: 1px solid #333; border-radius: 8px; color: #e5e5e5; font-size: 0.9rem; margin-bottom: 1rem; outline: none; }
+    input:focus { border-color: #525252; }
+    button { width: 100%; padding: 0.6rem; background: #fff; color: #000; border: none; border-radius: 9999px; font-size: 0.9rem; font-weight: 600; cursor: pointer; }
+    button:hover { opacity: 0.9; }
+    .error { color: #ef4444; font-size: 0.8rem; margin-bottom: 1rem; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="logo">Trapic</div>
+    <div class="desc">Sign in to authorize access to your knowledge base</div>
+    ${errorMsg ? `<div class="error">${escapeHtml(errorMsg)}</div>` : ""}
+    <form method="POST" action="/oauth/authorize">
+      <input type="hidden" name="client_id" value="${escapeHtml(clientId)}" />
+      <input type="hidden" name="redirect_uri" value="${escapeHtml(redirectUri)}" />
+      <input type="hidden" name="state" value="${escapeHtml(state)}" />
+      <input type="hidden" name="code_challenge" value="${escapeHtml(codeChallenge)}" />
+      <input type="hidden" name="code_challenge_method" value="${escapeHtml(codeChallengeMethod)}" />
+      <label>Email</label>
+      <input type="email" name="email" required autocomplete="email" autofocus />
+      <label>Password</label>
+      <input type="password" name="password" required autocomplete="current-password" />
+      <button type="submit">Sign In</button>
+    </form>
+  </div>
+</body>
+</html>`;
+            return new Response(html, {
+                headers: {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'",
+                    "X-Content-Type-Options": "nosniff",
+                    "X-Frame-Options": "DENY",
+                },
+            });
+        }
+        // OAuth Authorize POST — validates credentials, issues auth code via 302 redirect
+        if (url.pathname === "/oauth/authorize" && request.method === "POST") {
+            // Parse form body (native form POST sends application/x-www-form-urlencoded)
+            const ct = request.headers.get("content-type") || "";
+            let email = "", password = "", clientId = "", redirectUri = "", state = "", codeChallenge = "";
+            if (ct.includes("application/x-www-form-urlencoded")) {
+                const text = await request.text();
+                const p = new URLSearchParams(text);
+                email = p.get("email") || "";
+                password = p.get("password") || "";
+                clientId = p.get("client_id") || "";
+                redirectUri = p.get("redirect_uri") || "";
+                state = p.get("state") || "";
+                codeChallenge = p.get("code_challenge") || "";
+            }
+            else {
+                const body = await request.json();
+                email = body.email || "";
+                password = body.password || "";
+                clientId = body.client_id || "";
+                redirectUri = body.redirect_uri || "";
+                state = body.state || "";
+                codeChallenge = body.code_challenge || "";
+            }
+            if (!isValidRedirectUri(redirectUri)) {
+                return new Response("Invalid redirect_uri", { status: 400 });
+            }
+            // On error, redirect back to login form with error message
+            const loginRedirect = (error) => {
+                const backUrl = new URL(`${origin}/oauth/authorize`);
+                backUrl.searchParams.set("client_id", clientId);
+                backUrl.searchParams.set("redirect_uri", redirectUri);
+                backUrl.searchParams.set("state", state);
+                backUrl.searchParams.set("code_challenge", codeChallenge);
+                backUrl.searchParams.set("code_challenge_method", "S256");
+                backUrl.searchParams.set("error", error);
+                return new Response(null, { status: 302, headers: { "Location": backUrl.toString() } });
+            };
+            try {
+                const supabase = getSupabase();
+                const { data: authData, error: authError } = await supabase.auth.signInWithPassword({
+                    email, password,
+                });
+                if (authError || !authData.user) {
+                    return loginRedirect(authError?.message || "Invalid credentials");
+                }
+                // Generate signed auth code (stateless, works across Worker instances)
+                const code = await createAuthCode(env, authData.user.id, codeChallenge, redirectUri);
+                const redirectUrl = new URL(redirectUri);
+                redirectUrl.searchParams.set("code", code);
+                if (state)
+                    redirectUrl.searchParams.set("state", state);
+                // Always 302 redirect to redirect_uri — this is what OAuth clients expect
+                return new Response(null, { status: 302, headers: { "Location": redirectUrl.toString() } });
+            }
+            catch (e) {
+                return loginRedirect("Server error");
+            }
+        }
+        // OAuth Token Exchange — code → access token
+        if (url.pathname === "/oauth/token" && request.method === "POST") {
+            const corsH = { "Access-Control-Allow-Origin": getCorsOrigin(request), "Content-Type": "application/json" };
+            try {
+                let grantType, code, codeVerifier, redirectUri;
+                const contentType = request.headers.get("content-type") || "";
+                if (contentType.includes("application/x-www-form-urlencoded")) {
+                    const text = await request.text();
+                    const params = new URLSearchParams(text);
+                    grantType = params.get("grant_type") || "";
+                    code = params.get("code") || "";
+                    codeVerifier = params.get("code_verifier") || "";
+                    redirectUri = params.get("redirect_uri") || "";
+                }
+                else {
+                    const body = await request.json();
+                    grantType = body.grant_type || "";
+                    code = body.code || "";
+                    codeVerifier = body.code_verifier || "";
+                    redirectUri = body.redirect_uri || "";
+                }
+                if (grantType !== "authorization_code") {
+                    return Response.json({ error: "unsupported_grant_type" }, { status: 400, headers: corsH });
+                }
+                // Auth code replay prevention
+                cleanupConsumedCodes();
+                const codeKey = code.slice(0, 64);
+                if (consumedCodes.has(codeKey)) {
+                    return Response.json({ error: "invalid_grant", error_description: "Code already used" }, { status: 400, headers: corsH });
+                }
+                const stored = await verifyAuthCode(env, code);
+                if (!stored) {
+                    return Response.json({ error: "invalid_grant", error_description: "Code expired or invalid" }, { status: 400, headers: corsH });
+                }
+                // Mark code as consumed
+                consumedCodes.set(codeKey, Date.now());
+                if (stored.redirectUri !== redirectUri) {
+                    return Response.json({ error: "invalid_grant", error_description: "Redirect URI mismatch" }, { status: 400, headers: corsH });
+                }
+                // Verify PKCE S256
+                const encoder = new TextEncoder();
+                const digest = await crypto.subtle.digest("SHA-256", encoder.encode(codeVerifier));
+                const expectedChallenge = btoa(String.fromCharCode(...new Uint8Array(digest)))
+                    .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+                if (expectedChallenge !== stored.codeChallenge) {
+                    return Response.json({ error: "invalid_grant", error_description: "PKCE verification failed" }, { status: 400, headers: corsH });
+                }
+                // Generate a new tr_ API token for this user
+                const supabase = getSupabase();
+                const rawToken = `tr_${generateRandomString(24)}`;
+                const tokenHash = await hashToken(rawToken);
+                await supabase.from("trace_api_tokens").insert({
+                    user_id: stored.userId,
+                    token_hash: tokenHash,
+                    token_prefix: rawToken.slice(0, 7),
+                    name: "claude-ai-connector",
+                });
+                return Response.json({
+                    access_token: rawToken,
+                    token_type: "Bearer",
+                    scope: "trapic",
+                }, { headers: corsH });
+            }
+            catch (e) {
+                return Response.json({ error: "server_error", error_description: e.message }, { status: 500, headers: corsH });
+            }
+        }
+        // ── Auth endpoints ────────────────────────────────────────────────────
+        if (url.pathname.startsWith("/auth/")) {
+            const headers = {
+                "Access-Control-Allow-Origin": getCorsOrigin(request),
+                "Content-Type": "application/json",
+            };
+            const supabase = getSupabase();
+            function generateApiToken() {
+                const bytes = new Uint8Array(24);
+                crypto.getRandomValues(bytes);
+                const hex = Array.from(bytes)
+                    .map((b) => b.toString(16).padStart(2, "0"))
+                    .join("");
+                return `tr_${hex}`;
+            }
+            // POST /auth/login — no auth needed
+            if (url.pathname === "/auth/login" && request.method === "POST") {
+                try {
+                    const body = (await request.json());
+                    if (!body.email || !body.password) {
+                        return Response.json({ error: "email and password required" }, { status: 400, headers });
+                    }
+                    // Rate limit login attempts per email
+                    const loginKey = `login:${body.email}`;
+                    const loginRate = isRateLimited(loginKey);
+                    if (loginRate.limited) {
+                        return Response.json({ error: "Too many login attempts. Try again later." }, { status: 429, headers });
+                    }
+                    recordRequest(loginKey);
+                    const { data: authData, error: authError } = await supabase.auth.signInWithPassword({
+                        email: body.email,
+                        password: body.password,
+                    });
+                    if (authError || !authData.user) {
+                        return Response.json({ error: authError?.message || "Login failed" }, { status: 401, headers });
+                    }
+                    // Generate API token
+                    const rawToken = generateApiToken();
+                    const tokenHash = await hashToken(rawToken);
+                    const tokenPrefix = rawToken.slice(0, 7);
+                    const { error: insertError } = await supabase
+                        .from("trace_api_tokens")
+                        .insert({
+                        user_id: authData.user.id,
+                        token_hash: tokenHash,
+                        token_prefix: tokenPrefix,
+                        name: body.token_name || "cli",
+                    });
+                    if (insertError) {
+                        return Response.json({ error: insertError.message }, { status: 400, headers });
+                    }
+                    return Response.json({
+                        token: rawToken,
+                        user: { id: authData.user.id, email: authData.user.email },
+                    }, { headers });
+                }
+                catch (err) {
+                    return Response.json({ error: err.message || "Internal error" }, { status: 500, headers });
+                }
+            }
+            // All other auth routes require Bearer token
+            const authHeader = request.headers.get("Authorization");
+            const userId = await resolveUserId(authHeader);
+            if (!userId) {
+                return Response.json({ error: "Unauthorized" }, { status: 401, headers });
+            }
+            const currentTokenHash = authHeader
+                ? await hashToken(authHeader.slice(7))
+                : null;
+            // POST /auth/logout — revoke current token
+            if (url.pathname === "/auth/logout" && request.method === "POST") {
+                if (currentTokenHash) {
+                    await supabase
+                        .from("trace_api_tokens")
+                        .update({ revoked_at: new Date().toISOString() })
+                        .eq("token_hash", currentTokenHash);
+                }
+                return Response.json({ ok: true }, { headers });
+            }
+            // GET /auth/whoami — current user + token info
+            if (url.pathname === "/auth/whoami") {
+                const { data: userData } = await supabase.auth.admin.getUserById(userId);
+                const { data: tokenData } = await supabase
+                    .from("trace_api_tokens")
+                    .select("token_prefix, name, created_at, last_used_at")
+                    .eq("token_hash", currentTokenHash)
+                    .single();
+                // Get usage stats
+                const { count: activeTraces } = await supabase
+                    .from("traces")
+                    .select("*", { count: "exact", head: true })
+                    .eq("author", userId)
+                    .eq("status", "active");
+                return Response.json({
+                    user: {
+                        id: userId,
+                        email: userData?.user?.email || null,
+                        created_at: userData?.user?.created_at || null,
+                    },
+                    token: tokenData || null,
+                    stats: { active_traces: activeTraces || 0 },
+                }, { headers });
+            }
+            // GET /auth/tokens — list all tokens
+            if (url.pathname === "/auth/tokens") {
+                const { data: tokens } = await supabase
+                    .from("trace_api_tokens")
+                    .select("id, token_prefix, name, created_at, last_used_at, revoked_at")
+                    .eq("user_id", userId)
+                    .order("created_at", { ascending: false });
+                // Mark which token is the current one
+                let currentTokenId = null;
+                if (currentTokenHash) {
+                    const { data: ct } = await supabase
+                        .from("trace_api_tokens")
+                        .select("id")
+                        .eq("token_hash", currentTokenHash)
+                        .single();
+                    currentTokenId = ct?.id || null;
+                }
+                const result = (tokens || []).map((t) => ({
+                    ...t,
+                    is_current: t.id === currentTokenId,
+                }));
+                return Response.json({ tokens: result }, { headers });
+            }
+            // POST /auth/tokens/create — create new API token
+            if (url.pathname === "/auth/tokens/create" && request.method === "POST") {
+                const body = (await request.json());
+                const rawToken = generateApiToken();
+                const tokenHash = await hashToken(rawToken);
+                const tokenPrefix = rawToken.slice(0, 7);
+                const { error: insertError } = await supabase
+                    .from("trace_api_tokens")
+                    .insert({
+                    user_id: userId,
+                    token_hash: tokenHash,
+                    token_prefix: tokenPrefix,
+                    name: body?.name || "default",
+                });
+                if (insertError) {
+                    return Response.json({ error: insertError.message }, { status: 400, headers });
+                }
+                return Response.json({
+                    token: rawToken,
+                    prefix: tokenPrefix,
+                    name: body?.name || "default",
+                }, { headers });
+            }
+            // POST /auth/tokens/revoke — revoke a specific token
+            if (url.pathname === "/auth/tokens/revoke" && request.method === "POST") {
+                const body = (await request.json());
+                if (!body?.token_id) {
+                    return Response.json({ error: "token_id required" }, { status: 400, headers });
+                }
+                const { data: updated, error } = await supabase
+                    .from("trace_api_tokens")
+                    .update({ revoked_at: new Date().toISOString() })
+                    .eq("id", body.token_id)
+                    .eq("user_id", userId)
+                    .is("revoked_at", null)
+                    .select("id")
+                    .single();
+                if (error || !updated) {
+                    return Response.json({ error: "Token not found or already revoked" }, { status: 404, headers });
+                }
+                return Response.json({ ok: true, revoked: body.token_id }, { headers });
+            }
+            return Response.json({ error: "Not found" }, { status: 404, headers });
+        }
+        // ── Send invite email ────────────────────────────────────────
+        if (url.pathname === "/api/send-invite" && request.method === "POST") {
+            const corsH = {
+                "Access-Control-Allow-Origin": getCorsOrigin(request),
+                "Content-Type": "application/json",
+            };
+            if (!env.RESEND_API_KEY) {
+                return Response.json({ error: "Email service not configured" }, { status: 500, headers: corsH });
+            }
+            try {
+                const body = await request.json();
+                if (!body.email || !body.token) {
+                    return Response.json({ error: "email and token required" }, { status: 400, headers: corsH });
+                }
+                const inviteLink = `https://trapic.ai/team?invite=${body.token}`;
+                const res = await fetch("https://api.resend.com/emails", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${env.RESEND_API_KEY}`,
+                    },
+                    body: JSON.stringify({
+                        from: "Trapic <noreply@trapic.ai>",
+                        to: [body.email],
+                        subject: `${body.inviter_name || "Someone"} invited you to join ${body.team_name || "a team"} on Trapic`,
+                        html: `
+              <div style="font-family: -apple-system, sans-serif; max-width: 480px; margin: 0 auto; padding: 40px 20px;">
+                <h2 style="font-size: 20px; font-weight: 600; margin-bottom: 8px;">You're invited to join ${body.team_name || "a team"}</h2>
+                <p style="color: #6b7280; font-size: 14px; line-height: 1.6;">
+                  ${body.inviter_name || "A team member"} has invited you to collaborate on <strong>Trapic</strong> — the AI knowledge management platform.
+                </p>
+                <a href="${inviteLink}" style="display: inline-block; margin-top: 24px; padding: 12px 24px; background: #111; color: #fff; text-decoration: none; border-radius: 8px; font-size: 14px; font-weight: 500;">
+                  Accept Invitation
+                </a>
+                <p style="margin-top: 24px; color: #9ca3af; font-size: 12px;">
+                  This invitation expires in 7 days. If you didn't expect this, you can ignore it.
+                </p>
+              </div>
+            `,
+                    }),
+                });
+                if (!res.ok) {
+                    const err = await res.text();
+                    return Response.json({ error: `Email failed: ${err}` }, { status: 500, headers: corsH });
+                }
+                return Response.json({ status: "sent" }, { headers: corsH });
+            }
+            catch (e) {
+                return Response.json({ error: e.message }, { status: 500, headers: corsH });
+            }
+        }
+        // MCP endpoint
+        if (url.pathname === "/mcp") {
+            // Fix Accept header: some MCP clients (e.g. Claude Code) may not include
+            // both application/json and text/event-stream, which the SDK requires.
+            const accept = request.headers.get("Accept") || "";
+            if (request.method === "POST" && (!accept.includes("application/json") || !accept.includes("text/event-stream"))) {
+                const headers = new Headers(request.headers);
+                headers.set("Accept", "application/json, text/event-stream");
+                request = new Request(request, { headers });
+            }
+            // Authenticate via Bearer token only (no query parameter support)
+            const authHeader = request.headers.get("Authorization");
+            const userId = await resolveUserId(authHeader);
+            // Reject unauthenticated requests (with OAuth discovery hint)
+            if (!userId) {
+                return Response.json({ error: "Unauthorized. Provide a valid Bearer token via Authorization header." }, {
+                    status: 401,
+                    headers: {
+                        "Access-Control-Allow-Origin": "*",
+                        "WWW-Authenticate": `Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource"`,
+                    },
+                });
+            }
+            // Rate limit authenticated users
+            if (userId) {
+                const rateCheck = isRateLimited(userId);
+                if (rateCheck.limited) {
+                    return Response.json({ error: "Rate limit exceeded. Try again in 60 seconds.", retry_after_seconds: 60 }, {
+                        status: 429,
+                        headers: {
+                            "Access-Control-Allow-Origin": "*",
+                            "Retry-After": "60",
+                        },
+                    });
+                }
+                recordRequest(userId); // fire-and-forget
+            }
+            const server = createServer(userId);
+            const transport = new WebStandardStreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                enableJsonResponse: true,
+            });
+            await server.connect(transport);
+            const response = await transport.handleRequest(request);
+            // Add CORS headers
+            const headers = new Headers(response.headers);
+            headers.set("Access-Control-Allow-Origin", "*");
+            headers.set("Access-Control-Expose-Headers", "mcp-session-id");
+            return new Response(response.body, {
+                status: response.status,
+                statusText: response.statusText,
+                headers,
+            });
+        }
+        return Response.json({ error: "Not found" }, { status: 404 });
+    },
+    async scheduled(event, env, ctx) {
+        ctx.waitUntil(runArchive({
+            SUPABASE_URL: env.SUPABASE_URL,
+            SUPABASE_SERVICE_ROLE_KEY: env.SUPABASE_SERVICE_ROLE_KEY,
+            ARCHIVE_BUCKET: env.ARCHIVE_BUCKET,
+        }).then((log) => {
+            console.log(`[archive] ${new Date().toISOString()} ${log}`);
+        }).catch((err) => {
+            console.error(`[archive] Error: ${err.message}`);
+        }));
+    },
+};