feat: Phase 6 - MCP + Webhooks + Worker + Polish

- MCP server: stateless JSON-RPC 2.0 with 18 tools (tasks, habits, projects, notes, domains, search, activity) - Webhooks API: CRUD routes under /api/domains/[domainId]/webhooks/ with test endpoint and deliveries log - Webhook delivery: HMAC-SHA256 signed POST with retry (exponential backoff, max 6) - Worker rewrite: Drizzle ORM instead of PocketBase, polls jobs table, handles webhook_delivery, recurring_spawn, ai_dispatch - Rate limiting: token bucket per IP/API key (100 req/min REST, 300 req/min MCP) - Keyboard help overlay: ? opens Radix Dialog with search/filter, Esc closes - AI @mention stub: @agent in command palette dispatches CustomEvent - Mobile responsive: bottom nav, single-column kanban, day view calendar, 44px touch targets - Accessibility: skip-to-content link, focus rings, aria-labels, color contrast - E2E tests: mcp.spec.ts, webhooks.spec.ts, realtime.spec.ts added - Schema: api_keys and webhook_deliveries tables with migration - Removed old PocketBase-style database.ts from worker
2026-07-29 08:03:28 -04:00
parent eba1d78fb9
commit e5b7d9e2ee
28 changed files with 4959 additions and 884 deletions
@@ -0,0 +1,50 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
+import { db, webhooks, webhookDeliveries } from '@project-e/db';
+import { and, desc, eq, sql } from 'drizzle-orm';
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// GET /api/domains/[domainId]/webhooks/[id]/deliveries — List deliveries for a webhook
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  // Verify webhook exists in this workspace
+  const [webhook] = await db.select({ id: webhooks.id })
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!webhook) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  const { searchParams } = new URL(request.url);
+  const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
+  const offset = parseInt(searchParams.get('offset') || '0');
+
+  const [items, countResult] = await Promise.all([
+    db.select()
+      .from(webhookDeliveries)
+      .where(eq(webhookDeliveries.webhookId, id))
+      .orderBy(desc(webhookDeliveries.createdAt))
+      .limit(limit)
+      .offset(offset),
+    db.select({ count: sql<number>`count(*)` })
+      .from(webhookDeliveries)
+      .where(eq(webhookDeliveries.webhookId, id)),
+  ]);
+
+  return NextResponse.json({
+    items,
+    totalItems: Number(countResult[0]?.count || 0),
+    limit,
+    offset,
+  });
+});
@@ -0,0 +1,118 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, webhooks } from '@project-e/db';
+import { and, eq } from 'drizzle-orm';
+import { z } from 'zod';
+
+const updateWebhookSchema = z.object({
+  name: z.string().optional(),
+  url: z.string().url('Must be a valid URL').optional(),
+  events: z.array(z.string()).optional(),
+  active: z.boolean().optional(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// GET /api/domains/[domainId]/webhooks/[id] — Get a single webhook
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [webhook] = await db.select()
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!webhook) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  // Never return the secret on GET
+  const { secret: _, ...safe } = webhook;
+  return NextResponse.json(safe);
+});
+
+// PATCH /api/domains/[domainId]/webhooks/[id] — Update a webhook
+export const PATCH = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = updateWebhookSchema.parse(body);
+
+    const [existing] = await db.select()
+      .from(webhooks)
+      .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+      .limit(1);
+
+    if (!existing) {
+      return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+    }
+
+    const updateData: Record<string, unknown> = { updatedAt: new Date() };
+    if (data.name !== undefined) updateData.name = data.name;
+    if (data.url !== undefined) updateData.url = data.url;
+    if (data.events !== undefined) updateData.events = data.events;
+    if (data.active !== undefined) updateData.active = data.active;
+
+    const [updated] = await db.update(webhooks)
+      .set(updateData)
+      .where(eq(webhooks.id, id))
+      .returning();
+
+    await recordActivity({
+      actor: user.name,
+      action: 'updated',
+      entityType: 'webhook',
+      entityId: updated.id,
+      changes: updateData,
+      workspaceId: domainId,
+    });
+
+    const { secret: _, ...safe } = updated;
+    return NextResponse.json(safe);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[webhook PATCH] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to update webhook', 500);
+  }
+});
+
+// DELETE /api/domains/[domainId]/webhooks/[id] — Delete a webhook
+export const DELETE = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [existing] = await db.select()
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!existing) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  await db.delete(webhooks).where(eq(webhooks.id, id));
+
+  await recordActivity({
+    actor: user.name,
+    action: 'deleted',
+    entityType: 'webhook',
+    entityId: id,
+    workspaceId: domainId,
+  });
+
+  return new NextResponse(null, { status: 204 });
+});
@@ -0,0 +1,99 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
+import { db, webhooks, webhookDeliveries } from '@project-e/db';
+import { and, eq } from 'drizzle-orm';
+import { createHmac } from 'node:crypto';
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// POST /api/domains/[domainId]/webhooks/[id]/test — Send a test event
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [webhook] = await db.select()
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!webhook) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  if (!webhook.active) {
+    return createErrorResponse('WEBHOOK_DISABLED', 'Cannot test a disabled webhook', 400);
+  }
+
+  const testPayload = {
+    event: 'test.ping',
+    entity_type: 'test',
+    entity_id: 'test-001',
+    data: { message: 'This is a test webhook delivery from Project E.', webhook_id: webhook.id },
+    timestamp: new Date().toISOString(),
+    workspace_id: domainId,
+  };
+
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    'X-Event-Type': 'test.ping',
+  };
+
+  if (webhook.secret) {
+    const body = JSON.stringify(testPayload);
+    const signature = createHmac('sha256', webhook.secret)
+      .update(body)
+      .digest('hex');
+    headers['X-ProjectE-Signature'] = signature;
+  }
+
+  try {
+    const response = await fetch(webhook.url, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(testPayload),
+      signal: AbortSignal.timeout(10000),
+    });
+
+    const responseBody = await response.text();
+
+    // Record the delivery
+    await db.insert(webhookDeliveries).values({
+      webhookId: webhook.id,
+      event: 'test.ping',
+      payload: testPayload as Record<string, unknown>,
+      status: response.ok ? 'success' : 'failed',
+      statusCode: response.status,
+      responseBody: responseBody.substring(0, 1000),
+      attempts: 1,
+    });
+
+    return NextResponse.json({
+      success: response.ok,
+      status: response.status,
+      response: responseBody.substring(0, 500),
+    });
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+
+    await db.insert(webhookDeliveries).values({
+      webhookId: webhook.id,
+      event: 'test.ping',
+      payload: testPayload as Record<string, unknown>,
+      status: 'failed',
+      statusCode: 0,
+      responseBody: errorMessage,
+      attempts: 1,
+    });
+
+    return NextResponse.json({
+      success: false,
+      status: 0,
+      response: errorMessage,
+    });
+  }
+});
@@ -0,0 +1,102 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, webhooks, webhookDeliveries } from '@project-e/db';
+import { and, asc, desc, eq, isNull, sql } from 'drizzle-orm';
+import { createHash, randomBytes } from 'node:crypto';
+import { z } from 'zod';
+
+const createWebhookSchema = z.object({
+  name: z.string().optional(),
+  url: z.string().url('Must be a valid URL'),
+  events: z.array(z.string()).default([]),
+  active: z.boolean().optional().default(true),
+});
+
+const updateWebhookSchema = z.object({
+  name: z.string().optional(),
+  url: z.string().url('Must be a valid URL').optional(),
+  events: z.array(z.string()).optional(),
+  active: z.boolean().optional(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string }> };
+type IdRouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// GET /api/domains/[domainId]/webhooks — List webhooks
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const { searchParams } = new URL(request.url);
+  const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
+  const offset = parseInt(searchParams.get('offset') || '0');
+
+  const [items, countResult] = await Promise.all([
+    db.select()
+      .from(webhooks)
+      .where(eq(webhooks.workspaceId, domainId))
+      .orderBy(desc(webhooks.createdAt))
+      .limit(limit)
+      .offset(offset),
+    db.select({ count: sql<number>`count(*)` })
+      .from(webhooks)
+      .where(eq(webhooks.workspaceId, domainId)),
+  ]);
+
+  return NextResponse.json({
+    items,
+    totalItems: Number(countResult[0]?.count || 0),
+    limit,
+    offset,
+  });
+});
+
+// POST /api/domains/[domainId]/webhooks — Create a webhook
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = createWebhookSchema.parse(body);
+
+    // Generate a webhook secret (shown only once on create)
+    const secret = `whsec_${randomBytes(24).toString('hex')}`;
+
+    const [webhook] = await db.insert(webhooks).values({
+      name: data.name ?? null,
+      url: data.url,
+      secret,
+      events: data.events,
+      active: data.active ?? true,
+      workspaceId: domainId,
+    }).returning();
+
+    await recordActivity({
+      actor: user.name,
+      action: 'created',
+      entityType: 'webhook',
+      entityId: webhook.id,
+      changes: { name: webhook.name, url: webhook.url, events: webhook.events },
+      workspaceId: domainId,
+    });
+
+    // Return the secret on create — it won't be shown again
+    return NextResponse.json({ ...webhook, secret }, { status: 201 });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[webhooks POST] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to create webhook', 500);
+  }
+});
@@ -4,134 +4,743 @@
 // See AGENTS.md for full rules.

 import { NextRequest, NextResponse } from 'next/server';
-import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
-import { createMcpServer } from '@/lib/mcp/server';
-import { createAdminClient } from '@/lib/pocketbase';
+import { db, apiKeys, users, tasks, taskTags, tags as tagsTable, habits, habitCompletions, projects, notes, noteLinks, domains, activityFeed, webhooks, webhookDeliveries } from '@project-e/db';
+import { and, asc, desc, eq, ilike, inArray, isNull, or, sql } from 'drizzle-orm';
+import { createHash } from 'node:crypto';
+import { recordActivity } from '@/lib/activity';

-// Store transports by session ID for stateful mode
-const transports = new Map<string, WebStandardStreamableHTTPServerTransport>();
+// ── JSON-RPC 2.0 types ─────────────────────────────────────────────────────────

-async function authenticateRequest(request: NextRequest): Promise<boolean> {
-  // Check for API key in Authorization header
+interface JsonRpcRequest {
+  jsonrpc: '2.0';
+  method: string;
+  params?: unknown;
+  id: string | number | null;
+}
+
+interface JsonRpcError {
+  code: number;
+  message: string;
+  data?: unknown;
+}
+
+interface JsonRpcResponse {
+  jsonrpc: '2.0';
+  result?: unknown;
+  error?: JsonRpcError;
+  id: string | number | null;
+}
+
+// JSON-RPC error codes
+const JSONRPC_PARSE_ERROR = -32700;
+const JSONRPC_INVALID_REQUEST = -32600;
+const JSONRPC_METHOD_NOT_FOUND = -32601;
+const JSONRPC_INVALID_PARAMS = -32602;
+const JSONRPC_INTERNAL_ERROR = -32603;
+
+// ── Auth ────────────────────────────────────────────────────────────────────────
+
+async function authenticateApiKey(request: NextRequest): Promise<{ userId: string; userName: string } | null> {
  const authHeader = request.headers.get('Authorization');
-  if (!authHeader) return false;
+  if (!authHeader) return null;

  const apiKey = authHeader.replace('Bearer ', '').trim();
-  if (!apiKey) return false;
+  if (!apiKey) return null;

-  try {
-    const pb = createAdminClient();
-    // Look up agent by API key
-    const result = await pb.collection('agents').getList(1, 1, {
-      filter: `api_key = "${apiKey}" && status = "active"`,
-    });
-    return result.items.length > 0;
-  } catch {
-    return false;
+  // API keys are stored as sha256 hash
+  const keyHash = createHash('sha256').update(apiKey).digest('hex');
+
+  const [keyRecord] = await db
+    .select({
+      userId: apiKeys.userId,
+      userName: users.name,
+    })
+    .from(apiKeys)
+    .innerJoin(users, eq(apiKeys.userId, users.id))
+    .where(and(eq(apiKeys.keyHash, keyHash), eq(apiKeys.active, true)))
+    .limit(1);
+
+  if (!keyRecord) return null;
+
+  // Update last_used_at
+  await db.update(apiKeys)
+    .set({ lastUsedAt: new Date() })
+    .where(eq(apiKeys.keyHash, keyHash));
+
+  return { userId: keyRecord.userId, userName: keyRecord.userName };
+}
+
+// ── Tool definitions ─────────────────────────────────────────────────────────────
+
+interface ToolDefinition {
+  name: string;
+  description: string;
+  inputSchema: Record<string, unknown>;
+  handler: (params: Record<string, unknown>, auth: { userId: string; userName: string }) => Promise<unknown>;
+}
+
+const tools: ToolDefinition[] = [
+  // ── Tasks ──────────────────────────────────────────────────────────────────────
+  {
+    name: 'tasks.list',
+    description: 'List tasks with optional filters',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string', description: 'Workspace/domain ID' },
+        status: { type: 'string', enum: ['todo', 'in_progress', 'done', 'cancelled'] },
+        priority: { type: 'string', enum: ['low', 'medium', 'high', 'urgent'] },
+        project_id: { type: 'string' },
+        search: { type: 'string' },
+        limit: { type: 'number', default: 50 },
+        offset: { type: 'number', default: 0 },
+      },
+      required: ['domain_id'],
+    },
+    handler: async (params) => {
+      const conditions: any[] = [
+        eq(tasks.domainId, params.domain_id as string),
+        isNull(tasks.deletedAt),
+      ];
+      if (params.status) conditions.push(eq(tasks.status, params.status as any));
+      if (params.priority) conditions.push(eq(tasks.priority, params.priority as any));
+      if (params.project_id) conditions.push(eq(tasks.projectId, params.project_id as string));
+      if (params.search) conditions.push(ilike(tasks.title, `%${params.search}%`));
+
+      const items = await db.select()
+        .from(tasks)
+        .where(and(...conditions))
+        .orderBy(asc(tasks.order))
+        .limit(Math.min(Number(params.limit) || 50, 200))
+        .offset(Number(params.offset) || 0);
+
+      return { items, total: items.length };
+    },
+  },
+  {
+    name: 'tasks.create',
+    description: 'Create a new task',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string', description: 'Workspace/domain ID' },
+        title: { type: 'string' },
+        description: { type: 'string' },
+        status: { type: 'string', enum: ['todo', 'in_progress', 'done', 'cancelled'] },
+        priority: { type: 'string', enum: ['low', 'medium', 'high', 'urgent'] },
+        due_date: { type: 'string' },
+        project_id: { type: 'string' },
+      },
+      required: ['domain_id', 'title'],
+    },
+    handler: async (params, auth) => {
+      const [task] = await db.insert(tasks).values({
+        title: params.title as string,
+        description: (params.description as string) ?? null,
+        status: (params.status as any) ?? 'todo',
+        priority: (params.priority as any) ?? 'medium',
+        domainId: params.domain_id as string,
+        projectId: (params.project_id as string) ?? null,
+        dueDate: params.due_date ? new Date(params.due_date as string) : null,
+      }).returning();
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'created',
+        entityType: 'task',
+        entityId: task.id,
+        changes: { title: task.title, status: task.status },
+        workspaceId: params.domain_id as string,
+      });
+
+      return task;
+    },
+  },
+  {
+    name: 'tasks.update',
+    description: 'Update an existing task',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        task_id: { type: 'string' },
+        title: { type: 'string' },
+        description: { type: 'string' },
+        status: { type: 'string', enum: ['todo', 'in_progress', 'done', 'cancelled'] },
+        priority: { type: 'string', enum: ['low', 'medium', 'high', 'urgent'] },
+        due_date: { type: 'string' },
+      },
+      required: ['task_id'],
+    },
+    handler: async (params, auth) => {
+      const updateData: Record<string, unknown> = {};
+      if (params.title !== undefined) updateData.title = params.title;
+      if (params.description !== undefined) updateData.description = params.description;
+      if (params.status !== undefined) updateData.status = params.status;
+      if (params.priority !== undefined) updateData.priority = params.priority;
+      if (params.due_date !== undefined) updateData.dueDate = params.due_date ? new Date(params.due_date as string) : null;
+      updateData.updatedAt = new Date();
+
+      const [task] = await db.update(tasks)
+        .set(updateData)
+        .where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
+        .returning();
+
+      if (!task) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Task not found');
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'updated',
+        entityType: 'task',
+        entityId: task.id,
+        changes: updateData,
+        workspaceId: task.domainId,
+      });
+
+      return task;
+    },
+  },
+  {
+    name: 'tasks.delete',
+    description: 'Soft-delete a task',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        task_id: { type: 'string' },
+      },
+      required: ['task_id'],
+    },
+    handler: async (params, auth) => {
+      const [task] = await db.update(tasks)
+        .set({ deletedAt: new Date(), updatedAt: new Date() })
+        .where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
+        .returning();
+
+      if (!task) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Task not found');
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'deleted',
+        entityType: 'task',
+        entityId: task.id,
+        workspaceId: task.domainId,
+      });
+
+      return { deleted: true, id: task.id };
+    },
+  },
+  {
+    name: 'tasks.complete',
+    description: 'Mark a task as done',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        task_id: { type: 'string' },
+      },
+      required: ['task_id'],
+    },
+    handler: async (params, auth) => {
+      const [task] = await db.update(tasks)
+        .set({ status: 'done', completedAt: new Date(), updatedAt: new Date() })
+        .where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
+        .returning();
+
+      if (!task) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Task not found');
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'completed',
+        entityType: 'task',
+        entityId: task.id,
+        workspaceId: task.domainId,
+      });
+
+      return task;
+    },
+  },
+
+  // ── Habits ────────────────────────────────────────────────────────────────────
+  {
+    name: 'habits.list',
+    description: 'List habits',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        active: { type: 'boolean' },
+      },
+      required: ['domain_id'],
+    },
+    handler: async (params) => {
+      const conditions: any[] = [
+        eq(habits.domainId, params.domain_id as string),
+        isNull(habits.deletedAt),
+      ];
+      if (params.active !== undefined) conditions.push(eq(habits.active, params.active as boolean));
+
+      const items = await db.select().from(habits).where(and(...conditions)).orderBy(asc(habits.name));
+      return { items };
+    },
+  },
+  {
+    name: 'habits.create',
+    description: 'Create a new habit',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        name: { type: 'string' },
+        description: { type: 'string' },
+        frequency: { type: 'string', enum: ['daily', 'weekly', 'custom'] },
+        difficulty: { type: 'string', enum: ['easy', 'medium', 'hard'] },
+      },
+      required: ['domain_id', 'name'],
+    },
+    handler: async (params, auth) => {
+      const [habit] = await db.insert(habits).values({
+        name: params.name as string,
+        description: (params.description as string) ?? null,
+        domainId: params.domain_id as string,
+        frequency: (params.frequency as any) ?? 'daily',
+        difficulty: (params.difficulty as any) ?? 'medium',
+      }).returning();
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'created',
+        entityType: 'habit',
+        entityId: habit.id,
+        workspaceId: params.domain_id as string,
+      });
+
+      return habit;
+    },
+  },
+  {
+    name: 'habits.complete',
+    description: 'Log a habit completion',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        habit_id: { type: 'string' },
+        date: { type: 'string', description: 'ISO date string' },
+        value: { type: 'number', default: 1 },
+      },
+      required: ['habit_id'],
+    },
+    handler: async (params, auth) => {
+      const [habit] = await db.select().from(habits).where(and(eq(habits.id, params.habit_id as string), isNull(habits.deletedAt))).limit(1);
+      if (!habit) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Habit not found');
+
+      const [completion] = await db.insert(habitCompletions).values({
+        habitId: params.habit_id as string,
+        date: params.date ? new Date(params.date as string) : new Date(),
+        value: Number(params.value) || 1,
+      }).returning();
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'completed',
+        entityType: 'habit',
+        entityId: habit.id,
+        workspaceId: habit.domainId,
+      });
+
+      return completion;
+    },
+  },
+
+  // ── Projects ───────────────────────────────────────────────────────────────────
+  {
+    name: 'projects.list',
+    description: 'List projects',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        status: { type: 'string', enum: ['active', 'paused', 'completed', 'archived'] },
+      },
+      required: ['domain_id'],
+    },
+    handler: async (params) => {
+      const conditions: any[] = [
+        eq(projects.domainId, params.domain_id as string),
+        isNull(projects.deletedAt),
+      ];
+      if (params.status) conditions.push(eq(projects.status, params.status as any));
+
+      const items = await db.select().from(projects).where(and(...conditions)).orderBy(asc(projects.name));
+      return { items };
+    },
+  },
+  {
+    name: 'projects.create',
+    description: 'Create a new project',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        name: { type: 'string' },
+        description: { type: 'string' },
+        status: { type: 'string', enum: ['active', 'paused', 'completed', 'archived'] },
+        target_date: { type: 'string' },
+      },
+      required: ['domain_id', 'name'],
+    },
+    handler: async (params, auth) => {
+      const [project] = await db.insert(projects).values({
+        name: params.name as string,
+        description: (params.description as string) ?? null,
+        domainId: params.domain_id as string,
+        status: (params.status as any) ?? 'active',
+        targetDate: params.target_date ? new Date(params.target_date as string) : null,
+      }).returning();
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'created',
+        entityType: 'project',
+        entityId: project.id,
+        workspaceId: params.domain_id as string,
+      });
+
+      return project;
+    },
+  },
+
+  // ── Notes ──────────────────────────────────────────────────────────────────────
+  {
+    name: 'notes.list',
+    description: 'List notes',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        is_archived: { type: 'boolean' },
+      },
+      required: ['domain_id'],
+    },
+    handler: async (params) => {
+      const conditions: any[] = [
+        eq(notes.domainId, params.domain_id as string),
+        isNull(notes.deletedAt),
+      ];
+      if (params.is_archived !== undefined) conditions.push(eq(notes.isArchived, params.is_archived as boolean));
+
+      const items = await db.select().from(notes).where(and(...conditions)).orderBy(desc(notes.updatedAt));
+      return { items };
+    },
+  },
+  {
+    name: 'notes.create',
+    description: 'Create a new note',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        title: { type: 'string' },
+        content: { type: 'string' },
+      },
+      required: ['domain_id', 'title'],
+    },
+    handler: async (params, auth) => {
+      const [note] = await db.insert(notes).values({
+        title: params.title as string,
+        content: (params.content as string) ?? null,
+        domainId: params.domain_id as string,
+      }).returning();
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'created',
+        entityType: 'note',
+        entityId: note.id,
+        workspaceId: params.domain_id as string,
+      });
+
+      return note;
+    },
+  },
+  {
+    name: 'notes.update',
+    description: 'Update a note',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        note_id: { type: 'string' },
+        title: { type: 'string' },
+        content: { type: 'string' },
+      },
+      required: ['note_id'],
+    },
+    handler: async (params, auth) => {
+      const updateData: Record<string, unknown> = { updatedAt: new Date() };
+      if (params.title !== undefined) updateData.title = params.title;
+      if (params.content !== undefined) updateData.content = params.content;
+
+      const [note] = await db.update(notes)
+        .set(updateData)
+        .where(and(eq(notes.id, params.note_id as string), isNull(notes.deletedAt)))
+        .returning();
+
+      if (!note) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Note not found');
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'updated',
+        entityType: 'note',
+        entityId: note.id,
+        workspaceId: note.domainId,
+      });
+
+      return note;
+    },
+  },
+  {
+    name: 'notes.search',
+    description: 'Search notes by title or content',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        query: { type: 'string' },
+      },
+      required: ['domain_id', 'query'],
+    },
+    handler: async (params) => {
+      const query = params.query as string;
+      const items = await db.select()
+        .from(notes)
+        .where(and(
+          eq(notes.domainId, params.domain_id as string),
+          isNull(notes.deletedAt),
+          or(
+            ilike(notes.title, `%${query}%`),
+            ilike(notes.content ?? sql`''`, `%${query}%`)
+          )
+        ))
+        .orderBy(desc(notes.updatedAt))
+        .limit(20);
+
+      return { items };
+    },
+  },
+
+  // ── Domains ────────────────────────────────────────────────────────────────────
+  {
+    name: 'domains.list',
+    description: 'List domains/workspaces',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+    },
+    handler: async () => {
+      const items = await db.select().from(domains).orderBy(asc(domains.name));
+      return { items };
+    },
+  },
+  {
+    name: 'domains.create',
+    description: 'Create a new domain/workspace',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        name: { type: 'string' },
+        slug: { type: 'string' },
+        color: { type: 'string' },
+      },
+      required: ['name', 'slug'],
+    },
+    handler: async (params, auth) => {
+      const [domain] = await db.insert(domains).values({
+        name: params.name as string,
+        slug: params.slug as string,
+        color: (params.color as string) ?? null,
+      }).returning();
+
+      await recordActivity({
+        actor: auth.userName,
+        action: 'created',
+        entityType: 'domain',
+        entityId: domain.id,
+        workspaceId: domain.id,
+      });
+
+      return domain;
+    },
+  },
+
+  // ── Search ─────────────────────────────────────────────────────────────────────
+  {
+    name: 'search.query',
+    description: 'Full-text search across entities',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        domain_id: { type: 'string' },
+        query: { type: 'string' },
+        types: { type: 'array', items: { type: 'string' }, description: 'Entity types to search: tasks, notes, projects, habits' },
+        limit: { type: 'number', default: 20 },
+      },
+      required: ['domain_id', 'query'],
+    },
+    handler: async (params) => {
+      const query = params.query as string;
+      const domainId = params.domain_id as string;
+      const types = (params.types as string[]) || ['tasks', 'notes', 'projects', 'habits'];
+      const limit = Math.min(Number(params.limit) || 20, 50);
+      const results: Record<string, unknown[]> = {};
+
+      if (types.includes('tasks')) {
+        results.tasks = await db.select({
+          id: tasks.id, title: tasks.title, status: tasks.status, priority: tasks.priority,
+        }).from(tasks)
+          .where(and(eq(tasks.domainId, domainId), isNull(tasks.deletedAt), ilike(tasks.title, `%${query}%`)))
+          .limit(limit);
+      }
+      if (types.includes('notes')) {
+        results.notes = await db.select({ id: notes.id, title: notes.title }).from(notes)
+          .where(and(eq(notes.domainId, domainId), isNull(notes.deletedAt), ilike(notes.title, `%${query}%`)))
+          .limit(limit);
+      }
+      if (types.includes('projects')) {
+        results.projects = await db.select({ id: projects.id, name: projects.name, status: projects.status }).from(projects)
+          .where(and(eq(projects.domainId, domainId), isNull(projects.deletedAt), ilike(projects.name, `%${query}%`)))
+          .limit(limit);
+      }
+      if (types.includes('habits')) {
+        results.habits = await db.select({ id: habits.id, name: habits.name, frequency: habits.frequency }).from(habits)
+          .where(and(eq(habits.domainId, domainId), isNull(habits.deletedAt), ilike(habits.name, `%${query}%`)))
+          .limit(limit);
+      }
+
+      return results;
+    },
+  },
+
+  // ── Activity ───────────────────────────────────────────────────────────────────
+  {
+    name: 'activity.list',
+    description: 'List recent activity feed entries',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        workspace_id: { type: 'string' },
+        limit: { type: 'number', default: 20 },
+        offset: { type: 'number', default: 0 },
+      },
+      required: ['workspace_id'],
+    },
+    handler: async (params) => {
+      const items = await db.select()
+        .from(activityFeed)
+        .where(eq(activityFeed.workspaceId, params.workspace_id as string))
+        .orderBy(desc(activityFeed.createdAt))
+        .limit(Math.min(Number(params.limit) || 20, 100))
+        .offset(Number(params.offset) || 0);
+
+      return { items };
+    },
+  },
+];
+
+// ── Error helper ─────────────────────────────────────────────────────────────────
+
+class JsonRpcErrorResponse extends Error {
+  constructor(public code: number, message: string, public data?: unknown) {
+    super(message);
+    this.name = 'JsonRpcErrorResponse';
  }
 }

-export async function GET(request: NextRequest) {
-  // Authenticate
-  if (!(await authenticateRequest(request))) {
-    return NextResponse.json(
-      { error: 'Unauthorized. Provide a valid API key in the Authorization header.' },
-      { status: 401 }
-    );
-  }
+// ── Handler ──────────────────────────────────────────────────────────────────────

-  // Create server and transport for SSE connection
-  const server = createMcpServer();
-  const transport = new WebStandardStreamableHTTPServerTransport({
-    sessionIdGenerator: () => crypto.randomUUID(),
-  });
-
-  await server.connect(transport);
-
-  // Handle the request first — sessionId is set during handleRequest
-  const response = await transport.handleRequest(request);
-
-  // Store transport AFTER handleRequest sets the session ID
-  if (transport.sessionId) {
-    transports.set(transport.sessionId, transport);
-  }
-
-  return response;
+function makeError(code: number, message: string, data?: unknown): JsonRpcResponse {
+  return { jsonrpc: '2.0', error: { code, message, data }, id: null };
 }

+function makeResult(result: unknown, id: string | number | null): JsonRpcResponse {
+  return { jsonrpc: '2.0', result, id };
+}
+
+async function handleRequest(body: JsonRpcRequest, auth: { userId: string; userName: string }): Promise<JsonRpcResponse> {
+  const { method, params, id } = body;
+
+  if (method === 'server/discover') {
+    return makeResult({
+      name: 'project-e',
+      version: '1.0.0',
+      capabilities: { tools: {} },
+      tools: tools.map(t => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: t.inputSchema,
+      })),
+    }, id);
+  }
+
+  if (method === 'tools/call') {
+    const callParams = params as { name?: string; arguments?: Record<string, unknown> } | undefined;
+    if (!callParams?.name) {
+      return makeError(JSONRPC_INVALID_PARAMS, 'Missing tool name', id);
+    }
+
+    const tool = tools.find(t => t.name === callParams.name);
+    if (!tool) {
+      return makeError(JSONRPC_METHOD_NOT_FOUND, `Unknown tool: ${callParams.name}`, id);
+    }
+
+    try {
+      const result = await tool.handler(callParams.arguments || {}, auth);
+      return makeResult(result, id);
+    } catch (error) {
+      if (error instanceof JsonRpcErrorResponse) {
+        return makeError(error.code, error.message, error.data);
+      }
+      console.error(`[MCP] Tool ${callParams.name} error:`, error);
+      return makeError(JSONRPC_INTERNAL_ERROR, error instanceof Error ? error.message : 'Internal error', id);
+    }
+  }
+
+  return makeError(JSONRPC_METHOD_NOT_FOUND, `Unknown method: ${method}`, id);
+}
+
+// ── Route handler ────────────────────────────────────────────────────────────────
+
 export async function POST(request: NextRequest) {
-  // Authenticate
-  if (!(await authenticateRequest(request))) {
+  const auth = await authenticateApiKey(request);
+  if (!auth) {
    return NextResponse.json(
-      { error: 'Unauthorized. Provide a valid API key in the Authorization header.' },
+      { jsonrpc: '2.0', error: { code: -32001, message: 'Unauthorized. Provide a valid API key in Authorization: Bearer header.' }, id: null },
      { status: 401 }
    );
  }

-  // Get session ID from header
-  const sessionId = request.headers.get('mcp-session-id');
-
-  if (sessionId) {
-    // Route to existing transport
-    const transport = transports.get(sessionId);
-    if (transport) {
-      return transport.handleRequest(request);
-    }
+  let body: JsonRpcRequest;
+  try {
+    body = await request.json();
+  } catch {
    return NextResponse.json(
-      { error: 'Session not found. Connect via GET first.' },
-      { status: 404 }
-    );
-  }
-
-  // No session ID — this should be an initialization request
-  const server = createMcpServer();
-  const transport = new WebStandardStreamableHTTPServerTransport({
-    sessionIdGenerator: () => crypto.randomUUID(),
-  });
-
-  await server.connect(transport);
-
-  // Handle the request first — sessionId is set during handleRequest
-  const response = await transport.handleRequest(request);
-
-  // Store transport AFTER handleRequest sets the session ID
-  if (transport.sessionId) {
-    transports.set(transport.sessionId, transport);
-  }
-
-  return response;
-}
-
-export async function DELETE(request: NextRequest) {
-  // Authenticate
-  if (!(await authenticateRequest(request))) {
-    return NextResponse.json(
-      { error: 'Unauthorized. Provide a valid API key in the Authorization header.' },
-      { status: 401 }
-    );
-  }
-
-  const sessionId = request.headers.get('mcp-session-id');
-  if (!sessionId) {
-    return NextResponse.json(
-      { error: 'Missing mcp-session-id header' },
+      makeError(JSONRPC_PARSE_ERROR, 'Parse error: invalid JSON'),
      { status: 400 }
    );
  }

-  const transport = transports.get(sessionId);
-  if (!transport) {
+  // Validate JSON-RPC 2.0
+  if (!body || body.jsonrpc !== '2.0' || !body.method) {
    return NextResponse.json(
-      { error: 'Session not found' },
-      { status: 404 }
+      makeError(JSONRPC_INVALID_REQUEST, 'Invalid Request: must be valid JSON-RPC 2.0 with method'),
+      { status: 400 }
    );
  }

-  // Handle the DELETE to terminate the session
-  const response = await transport.handleRequest(request);
+  const response = await handleRequest(body, auth);
+  return NextResponse.json(response);
+}

-  // Clean up
-  transports.delete(sessionId);
-
-  return response;
-}
+// GET is not supported — MCP is stateless POST-only
+export async function GET() {
+  return NextResponse.json(
+    makeError(JSONRPC_METHOD_NOT_FOUND, 'MCP server only accepts POST requests'),
+    { status: 405 }
+  );
+}
@@ -5,36 +5,37 @@

 import { NextRequest, NextResponse } from 'next/server';
 import { withAuth } from '@/lib/auth';
-import { createPocketBaseClient } from '@/lib/pocketbase';
+import { db, webhookDeliveries } from '@project-e/db';
+import { and, desc, eq, sql } from 'drizzle-orm';

 // GET /api/webhook-deliveries — List webhook deliveries with filtering
 export const GET = withAuth(async (request: NextRequest, _user) => {
  const { searchParams } = new URL(request.url);
-  const page = parseInt(searchParams.get('page') || '1');
-  const perPage = parseInt(searchParams.get('perPage') || '50');
-  const filter = searchParams.get('filter') || undefined;
-  const sort = searchParams.get('sort') || '-created';
+  const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
+  const offset = parseInt(searchParams.get('offset') || '0');
  const webhookId = searchParams.get('webhook_id') || '';

-  const pb = createPocketBaseClient();
-
-  let combinedFilter = filter;
+  const conditions = [];
  if (webhookId) {
-    combinedFilter = combinedFilter
-      ? `${combinedFilter} && webhook_id = "${webhookId}"`
-      : `webhook_id = "${webhookId}"`;
+    conditions.push(eq(webhookDeliveries.webhookId, webhookId));
  }

-  const result = await pb.collection('webhook_deliveries').getList(page, perPage, {
-    filter: combinedFilter,
-    sort,
-  });
+  const [items, countResult] = await Promise.all([
+    db.select()
+      .from(webhookDeliveries)
+      .where(conditions.length > 0 ? and(...conditions) : undefined)
+      .orderBy(desc(webhookDeliveries.createdAt))
+      .limit(limit)
+      .offset(offset),
+    db.select({ count: sql<number>`count(*)` })
+      .from(webhookDeliveries)
+      .where(conditions.length > 0 ? and(...conditions) : undefined),
+  ]);

  return NextResponse.json({
-    items: result.items,
-    totalItems: result.totalItems,
-    totalPages: result.totalPages,
-    page: result.page,
-    perPage: result.perPage,
+    items,
+    totalItems: Number(countResult[0]?.count || 0),
+    limit,
+    offset,
  });
 });