import { Hono } from "hono";
import { createHash } from "node:crypto";
import { db, apiKeys, users, tasks, taskTags, tags as tagsTable, habits, habitCompletions, projects, notes, domains, activityFeed, webhooks, webhookDeliveries } from "@project-e/db";
import { and, asc, desc, eq, ilike, isNull, or } from "drizzle-orm";
import { recordActivity } from "../middleware/activity";

export const mcpRoutes = new Hono();

// ── JSON-RPC 2.0 types ─────────────────────────────────────────────────────────

interface JsonRpcRequest {
  jsonrpc: "2.0";
  method: string;
  params?: unknown;
  id: string | number | null;
}

interface JsonRpcError {
  code: number;
  message: string;
  data?: unknown;
}

interface JsonRpcResponse {
  jsonrpc: "2.0";
  result?: unknown;
  error?: JsonRpcError;
  id: string | number | null;
}

const JSONRPC_PARSE_ERROR = -32700;
const JSONRPC_INVALID_REQUEST = -32600;
const JSONRPC_METHOD_NOT_FOUND = -32601;
const JSONRPC_INVALID_PARAMS = -32602;
const JSONRPC_INTERNAL_ERROR = -32603;

// ── Auth ────────────────────────────────────────────────────────────────────────

async function authenticateApiKey(c: any): Promise<{ userId: string; userName: string } | null> {
  const authHeader = c.req.header("Authorization");
  if (!authHeader) return null;

  const apiKey = authHeader.replace("Bearer ", "").trim();
  if (!apiKey) return null;

  const keyHash = createHash("sha256").update(apiKey).digest("hex");

  const [keyRecord] = await db
    .select({
      userId: apiKeys.userId,
      userName: users.name,
    })
    .from(apiKeys)
    .innerJoin(users, eq(apiKeys.userId, users.id))
    .where(and(eq(apiKeys.keyHash, keyHash), eq(apiKeys.active, true)))
    .limit(1);

  if (!keyRecord) return null;

  await db.update(apiKeys)
    .set({ lastUsedAt: new Date() })
    .where(eq(apiKeys.keyHash, keyHash));

  return { userId: keyRecord.userId, userName: keyRecord.userName };
}

// ── Tool definitions ─────────────────────────────────────────────────────────────

interface ToolDefinition {
  name: string;
  description: string;
  inputSchema: Record<string, unknown>;
  handler: (params: Record<string, unknown>, auth: { userId: string; userName: string }) => Promise<unknown>;
}

const tools: ToolDefinition[] = [
  {
    name: "tasks.list",
    description: "List tasks with optional filters",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string", description: "Workspace/domain ID" },
        status: { type: "string", enum: ["todo", "in_progress", "done", "cancelled"] },
        priority: { type: "string", enum: ["low", "medium", "high", "urgent"] },
        project_id: { type: "string" },
        search: { type: "string" },
        limit: { type: "number", default: 50 },
        offset: { type: "number", default: 0 },
      },
      required: ["domain_id"],
    },
    handler: async (params) => {
      const conditions: any[] = [
        eq(tasks.domainId, params.domain_id as string),
        isNull(tasks.deletedAt),
      ];
      // TODO(phase-2): filter by state_group / state_id instead of old status
      if (params.priority) conditions.push(eq(tasks.priority, params.priority as any));
      if (params.project_id) conditions.push(eq(tasks.projectId, params.project_id as string));
      if (params.search) conditions.push(ilike(tasks.title, `%${params.search}%`));

      const items = await db.select()
        .from(tasks)
        .where(and(...conditions))
        .orderBy(asc(tasks.order))
        .limit(Math.min(Number(params.limit) || 50, 200))
        .offset(Number(params.offset) || 0);

      return { items, total: items.length };
    },
  },
  {
    name: "tasks.create",
    description: "Create a new task",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string", description: "Workspace/domain ID" },
        title: { type: "string" },
        description: { type: "string" },
        status: { type: "string" },
        priority: { type: "string", enum: ["low", "medium", "high", "urgent"] },
        due_date: { type: "string" },
        project_id: { type: "string" },
      },
      required: ["domain_id", "title"],
    },
    handler: async (params, auth) => {
      const [task] = await db.insert(tasks).values({
        title: params.title as string,
        description: (params.description as string) ?? null,
        priority: (params.priority as any) ?? "medium",
        domainId: params.domain_id as string,
        projectId: (params.project_id as string) ?? null,
        dueDate: params.due_date ? new Date(params.due_date as string) : null,
      }).returning();

      await recordActivity({
        actor: auth.userName,
        action: "created",
        entityType: "task",
        entityId: task.id,
        changes: { title: task.title },
        workspaceId: params.domain_id as string,
      });

      return task;
    },
  },
  {
    name: "tasks.update",
    description: "Update an existing task",
    inputSchema: {
      type: "object",
      properties: {
        task_id: { type: "string" },
        title: { type: "string" },
        description: { type: "string" },
        status: { type: "string" },
        priority: { type: "string", enum: ["low", "medium", "high", "urgent"] },
        due_date: { type: "string" },
      },
      required: ["task_id"],
    },
    handler: async (params, auth) => {
      const [existing] = await db.select().from(tasks).where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt))).limit(1);
      if (!existing) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, "Task not found");
      await verifyDomainAccess(existing.domainId, auth.userId);

      const updateData: Record<string, unknown> = {};
      if (params.title !== undefined) updateData.title = params.title;
      if (params.description !== undefined) updateData.description = params.description;
      if (params.priority !== undefined) updateData.priority = params.priority;
      if (params.due_date !== undefined) updateData.dueDate = params.due_date ? new Date(params.due_date as string) : null;
      updateData.updatedAt = new Date();

      const [task] = await db.update(tasks)
        .set(updateData)
        .where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
        .returning();

      await recordActivity({
        actor: auth.userName,
        action: "updated",
        entityType: "task",
        entityId: task.id,
        changes: updateData,
        workspaceId: task.domainId,
      });

      return task;
    },
  },
  {
    name: "tasks.delete",
    description: "Soft-delete a task",
    inputSchema: {
      type: "object",
      properties: { task_id: { type: "string" } },
      required: ["task_id"],
    },
    handler: async (params, auth) => {
      const [existing] = await db.select().from(tasks).where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt))).limit(1);
      if (!existing) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, "Task not found");
      await verifyDomainAccess(existing.domainId, auth.userId);

      const [task] = await db.update(tasks)
        .set({ deletedAt: new Date(), updatedAt: new Date() })
        .where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
        .returning();

      await recordActivity({
        actor: auth.userName,
        action: "deleted",
        entityType: "task",
        entityId: task.id,
        workspaceId: task.domainId,
      });

      return { deleted: true, id: task.id };
    },
  },
  {
    name: "tasks.complete",
    description: "Mark a task as done",
    inputSchema: {
      type: "object",
      properties: { task_id: { type: "string" } },
      required: ["task_id"],
    },
    handler: async (params, auth) => {
      const [existing] = await db.select().from(tasks).where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt))).limit(1);
      if (!existing) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, "Task not found");
      await verifyDomainAccess(existing.domainId, auth.userId);

      const [task] = await db.update(tasks)
        .set({ completedAt: new Date(), updatedAt: new Date() })
        .where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
        .returning();

      await recordActivity({
        actor: auth.userName,
        action: "completed",
        entityType: "task",
        entityId: task.id,
        workspaceId: task.domainId,
      });

      return task;
    },
  },
  {
    name: "habits.list",
    description: "List habits",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        active: { type: "boolean" },
      },
      required: ["domain_id"],
    },
    handler: async (params) => {
      const conditions: any[] = [eq(habits.domainId, params.domain_id as string), isNull(habits.deletedAt)];
      if (params.active !== undefined) conditions.push(eq(habits.active, params.active as boolean));
      const items = await db.select().from(habits).where(and(...conditions)).orderBy(asc(habits.name));
      return { items };
    },
  },
  {
    name: "habits.create",
    description: "Create a new habit",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        name: { type: "string" },
        description: { type: "string" },
        frequency: { type: "string", enum: ["daily", "weekly", "custom"] },
        difficulty: { type: "string", enum: ["easy", "medium", "hard"] },
      },
      required: ["domain_id", "name"],
    },
    handler: async (params, auth) => {
      const [habit] = await db.insert(habits).values({
        name: params.name as string,
        description: (params.description as string) ?? null,
        domainId: params.domain_id as string,
        frequency: (params.frequency as any) ?? "daily",
        difficulty: (params.difficulty as any) ?? "medium",
      }).returning();

      await recordActivity({
        actor: auth.userName,
        action: "created",
        entityType: "habit",
        entityId: habit.id,
        workspaceId: params.domain_id as string,
      });

      return habit;
    },
  },
  {
    name: "habits.complete",
    description: "Log a habit completion",
    inputSchema: {
      type: "object",
      properties: {
        habit_id: { type: "string" },
        date: { type: "string", description: "ISO date string" },
        value: { type: "number", default: 1 },
      },
      required: ["habit_id"],
    },
    handler: async (params, auth) => {
      const [habit] = await db.select().from(habits).where(and(eq(habits.id, params.habit_id as string), isNull(habits.deletedAt))).limit(1);
      if (!habit) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, "Habit not found");
      await verifyDomainAccess(habit.domainId, auth.userId);

      const [completion] = await db.insert(habitCompletions).values({
        habitId: params.habit_id as string,
        date: params.date ? new Date(params.date as string) : new Date(),
        value: Number(params.value) || 1,
      }).returning();

      await recordActivity({
        actor: auth.userName,
        action: "completed",
        entityType: "habit",
        entityId: habit.id,
        workspaceId: habit.domainId,
      });

      return completion;
    },
  },
  {
    name: "projects.list",
    description: "List projects",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        status: { type: "string", enum: ["active", "paused", "completed", "archived"] },
      },
      required: ["domain_id"],
    },
    handler: async (params) => {
      const conditions: any[] = [eq(projects.domainId, params.domain_id as string), isNull(projects.deletedAt)];
      if (params.status) conditions.push(eq(projects.status, params.status as any));
      const items = await db.select().from(projects).where(and(...conditions)).orderBy(asc(projects.name));
      return { items };
    },
  },
  {
    name: "projects.create",
    description: "Create a new project",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        name: { type: "string" },
        description: { type: "string" },
        status: { type: "string", enum: ["active", "paused", "completed", "archived"] },
        target_date: { type: "string" },
      },
      required: ["domain_id", "name"],
    },
    handler: async (params, auth) => {
      const [project] = await db.insert(projects).values({
        name: params.name as string,
        description: (params.description as string) ?? null,
        domainId: params.domain_id as string,
        status: (params.status as any) ?? "active",
        targetDate: params.target_date ? new Date(params.target_date as string) : null,
      }).returning();

      await recordActivity({
        actor: auth.userName,
        action: "created",
        entityType: "project",
        entityId: project.id,
        workspaceId: params.domain_id as string,
      });

      return project;
    },
  },
  {
    name: "notes.list",
    description: "List notes",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        is_archived: { type: "boolean" },
      },
      required: ["domain_id"],
    },
    handler: async (params) => {
      const conditions: any[] = [eq(notes.domainId, params.domain_id as string), isNull(notes.deletedAt)];
      if (params.is_archived !== undefined) conditions.push(eq(notes.isArchived, params.is_archived as boolean));
      const items = await db.select().from(notes).where(and(...conditions)).orderBy(desc(notes.updatedAt));
      return { items };
    },
  },
  {
    name: "notes.create",
    description: "Create a new note",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        title: { type: "string" },
        content: { type: "string" },
      },
      required: ["domain_id", "title"],
    },
    handler: async (params, auth) => {
      const [note] = await db.insert(notes).values({
        title: params.title as string,
        content: (params.content as string) ?? null,
        domainId: params.domain_id as string,
      }).returning();

      await recordActivity({
        actor: auth.userName,
        action: "created",
        entityType: "note",
        entityId: note.id,
        workspaceId: params.domain_id as string,
      });

      return note;
    },
  },
  {
    name: "notes.update",
    description: "Update a note",
    inputSchema: {
      type: "object",
      properties: {
        note_id: { type: "string" },
        title: { type: "string" },
        content: { type: "string" },
      },
      required: ["note_id"],
    },
    handler: async (params, auth) => {
      const [existing] = await db.select().from(notes).where(and(eq(notes.id, params.note_id as string), isNull(notes.deletedAt))).limit(1);
      if (!existing) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, "Note not found");
      await verifyDomainAccess(existing.domainId, auth.userId);

      const updateData: Record<string, unknown> = { updatedAt: new Date() };
      if (params.title !== undefined) updateData.title = params.title;
      if (params.content !== undefined) updateData.content = params.content;

      const [note] = await db.update(notes)
        .set(updateData)
        .where(and(eq(notes.id, params.note_id as string), isNull(notes.deletedAt)))
        .returning();

      await recordActivity({
        actor: auth.userName,
        action: "updated",
        entityType: "note",
        entityId: note.id,
        workspaceId: note.domainId,
      });

      return note;
    },
  },
  {
    name: "notes.search",
    description: "Search notes by title or content",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        query: { type: "string" },
      },
      required: ["domain_id", "query"],
    },
    handler: async (params) => {
      const query = params.query as string;
      const items = await db.select()
        .from(notes)
        .where(and(
          eq(notes.domainId, params.domain_id as string),
          isNull(notes.deletedAt),
          or(ilike(notes.title, `%${query}%`), ilike(notes.content, `%${query}%`))
        ))
        .orderBy(desc(notes.updatedAt))
        .limit(20);
      return { items };
    },
  },
  {
    name: "domains.list",
    description: "List the caller's domains/workspaces",
    inputSchema: { type: "object", properties: {} },
    handler: async (_params, auth) => {
      // Only the caller's own domains (plus legacy ownerless rows) — never every
      // domain in the database.
      const items = await db.select()
        .from(domains)
        .where(or(eq(domains.ownerId, auth.userId), isNull(domains.ownerId)))
        .orderBy(asc(domains.name));
      return { items };
    },
  },
  {
    name: "domains.create",
    description: "Create a new domain/workspace",
    inputSchema: {
      type: "object",
      properties: {
        name: { type: "string" },
        slug: { type: "string" },
        color: { type: "string" },
      },
      required: ["name", "slug"],
    },
    handler: async (params, auth) => {
      const [domain] = await db.insert(domains).values({
        name: params.name as string,
        slug: params.slug as string,
        color: (params.color as string) ?? null,
        ownerId: auth.userId,
      }).returning();

      await recordActivity({
        actor: auth.userName,
        action: "created",
        entityType: "domain",
        entityId: domain.id,
        workspaceId: domain.id,
      });

      return domain;
    },
  },
  {
    name: "search.query",
    description: "Full-text search across entities",
    inputSchema: {
      type: "object",
      properties: {
        domain_id: { type: "string" },
        query: { type: "string" },
        types: { type: "array", items: { type: "string" }, description: "Entity types: tasks, notes, projects, habits" },
        limit: { type: "number", default: 20 },
      },
      required: ["domain_id", "query"],
    },
    handler: async (params) => {
      const query = params.query as string;
      const domainId = params.domain_id as string;
      const types = (params.types as string[]) || ["tasks", "notes", "projects", "habits"];
      const limit = Math.min(Number(params.limit) || 20, 50);
      const results: Record<string, unknown[]> = {};

      if (types.includes("tasks")) {
        results.tasks = await db.select({ id: tasks.id, title: tasks.title, priority: tasks.priority }).from(tasks)
          .where(and(eq(tasks.domainId, domainId), isNull(tasks.deletedAt), ilike(tasks.title, `%${query}%`))).limit(limit);
      }
      if (types.includes("notes")) {
        results.notes = await db.select({ id: notes.id, title: notes.title }).from(notes)
          .where(and(eq(notes.domainId, domainId), isNull(notes.deletedAt), ilike(notes.title, `%${query}%`))).limit(limit);
      }
      if (types.includes("projects")) {
        results.projects = await db.select({ id: projects.id, name: projects.name, status: projects.status }).from(projects)
          .where(and(eq(projects.domainId, domainId), isNull(projects.deletedAt), ilike(projects.name, `%${query}%`))).limit(limit);
      }
      if (types.includes("habits")) {
        results.habits = await db.select({ id: habits.id, name: habits.name, frequency: habits.frequency }).from(habits)
          .where(and(eq(habits.domainId, domainId), isNull(habits.deletedAt), ilike(habits.name, `%${query}%`))).limit(limit);
      }

      return results;
    },
  },
  {
    name: "activity.list",
    description: "List recent activity feed entries",
    inputSchema: {
      type: "object",
      properties: {
        workspace_id: { type: "string" },
        limit: { type: "number", default: 20 },
        offset: { type: "number", default: 0 },
      },
      required: ["workspace_id"],
    },
    handler: async (params) => {
      const items = await db.select()
        .from(activityFeed)
        .where(eq(activityFeed.workspaceId, params.workspace_id as string))
        .orderBy(desc(activityFeed.createdAt))
        .limit(Math.min(Number(params.limit) || 20, 100))
        .offset(Number(params.offset) || 0);
      return { items };
    },
  },
];

// ── Error helper ─────────────────────────────────────────────────────────────────

class JsonRpcErrorResponse extends Error {
  constructor(public code: number, message: string, public data?: unknown) {
    super(message);
    this.name = "JsonRpcErrorResponse";
  }
}

function makeError(code: number, message: string, data?: unknown, id: string | number | null = null): JsonRpcResponse {
  return { jsonrpc: "2.0", error: { code, message, data }, id };
}

function makeResult(result: unknown, id: string | number | null): JsonRpcResponse {
  return { jsonrpc: "2.0", result, id };
}

// Validate that every field listed in the tool's inputSchema `required` array is
// present. Prevents silent empty-result queries (e.g. a missing domain_id) from
// reaching the database.
function validateParams(tool: ToolDefinition, args: Record<string, unknown>): string | null {
  const schema = tool.inputSchema as { required?: string[] } | undefined;
  for (const field of schema?.required || []) {
    const value = args[field];
    if (value === undefined || value === null || value === "") {
      return `Missing required parameter: ${field}`;
    }
  }
  return null;
}

// Domain/workspace ownership check for tools that receive a domain_id or
// workspace_id. Mirrors requireWorkspaceAccess but works without a Hono context:
// legacy domains with a NULL ownerId pass through the existence check only.
async function verifyDomainAccess(domainId: string, userId: string): Promise<void> {
  if (!domainId || domainId.trim() === "") {
    throw new JsonRpcErrorResponse(JSONRPC_INVALID_PARAMS, "domain_id is required");
  }
  const [domain] = await db
    .select({ id: domains.id, ownerId: domains.ownerId })
    .from(domains)
    .where(eq(domains.id, domainId))
    .limit(1);
  if (!domain) {
    throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, `Domain not found: ${domainId}`);
  }
  if (domain.ownerId !== null && domain.ownerId !== userId) {
    throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, `No access to domain: ${domainId}`);
  }
}

async function handleRequest(body: JsonRpcRequest, auth: { userId: string; userName: string }): Promise<JsonRpcResponse> {
  const { method, params, id } = body;

  // MCP initialize
  if (method === "initialize") {
    return makeResult({
      protocolVersion: "2024-11-05",
      capabilities: {
        tools: {},
        resources: {},
      },
      serverInfo: {
        name: "project-e",
        version: "1.0.0",
      },
    }, id);
  }

  // MCP tools/list
  if (method === "tools/list") {
    return makeResult({
      tools: tools.map(t => ({
        name: t.name,
        description: t.description,
        inputSchema: t.inputSchema,
      })),
    }, id);
  }

  // MCP tools/call
  if (method === "tools/call") {
    const callParams = params as { name?: string; arguments?: Record<string, unknown> } | undefined;
    if (!callParams?.name) {
      return makeError(JSONRPC_INVALID_PARAMS, "Missing tool name", undefined, id);
    }

    const tool = tools.find(t => t.name === callParams.name);
    if (!tool) {
      return makeError(JSONRPC_METHOD_NOT_FOUND, `Unknown tool: ${callParams.name}`, undefined, id);
    }

    try {
      const args = callParams.arguments || {};

      const missing = validateParams(tool, args);
      if (missing) {
        return makeError(JSONRPC_INVALID_PARAMS, missing, undefined, id);
      }

      // Scope to the caller's domains when a domain/workspace is passed.
      const domainId = (args.domain_id as string | undefined) ?? (args.workspace_id as string | undefined);
      if (domainId) {
        await verifyDomainAccess(domainId, auth.userId);
      }

      const result = await tool.handler(args, auth);
      return makeResult({ content: [{ type: "text", text: JSON.stringify(result) }] }, id);
    } catch (error) {
      if (error instanceof JsonRpcErrorResponse) {
        return makeError(error.code, error.message, error.data, id);
      }
      console.error(`[MCP] Tool ${callParams.name} error:`, error);
      return makeError(JSONRPC_INTERNAL_ERROR, error instanceof Error ? error.message : "Internal error", undefined, id);
    }
  }

  // MCP resources/list
  if (method === "resources/list") {
    return makeResult({
      resources: [
        {
          uri: "project-e://tasks",
          name: "Tasks",
          description: "Access to task entities",
          mimeType: "application/json",
        },
        {
          uri: "project-e://notes",
          name: "Notes",
          description: "Access to note entities",
          mimeType: "application/json",
        },
        {
          uri: "project-e://projects",
          name: "Projects",
          description: "Access to project entities",
          mimeType: "application/json",
        },
        {
          uri: "project-e://habits",
          name: "Habits",
          description: "Access to habit entities",
          mimeType: "application/json",
        },
      ],
    }, id);
  }

  // MCP resources/read
  if (method === "resources/read") {
    const readParams = params as { uri?: string } | undefined;
    if (!readParams?.uri) {
      return makeError(JSONRPC_INVALID_PARAMS, "Missing resource URI", undefined, id);
    }
    return makeResult({
      contents: [
        {
          uri: readParams.uri,
          mimeType: "application/json",
          text: JSON.stringify({ message: `Resource ${readParams.uri} accessed. Use tools/call for data operations.` }),
        },
      ],
    }, id);
  }

  // Legacy server/discover
  if (method === "server/discover") {
    return makeResult({
      name: "project-e",
      version: "1.0.0",
      capabilities: { tools: {} },
      tools: tools.map(t => ({
        name: t.name,
        description: t.description,
        inputSchema: t.inputSchema,
      })),
    }, id);
  }

  return makeError(JSONRPC_METHOD_NOT_FOUND, `Unknown method: ${method}`, undefined, id);
}

// ── Route handler ────────────────────────────────────────────────────────────────

mcpRoutes.post("/", async (c) => {
  const auth = await authenticateApiKey(c);
  if (!auth) {
    return c.json(
      { jsonrpc: "2.0", error: { code: -32001, message: "Unauthorized. Provide a valid API key in Authorization: Bearer ***" }, id: null },
      401
    );
  }

  let body: JsonRpcRequest;
  try {
    body = await c.req.json();
  } catch {
    return c.json(makeError(JSONRPC_PARSE_ERROR, "Parse error: invalid JSON"), 400);
  }

  if (!body || body.jsonrpc !== "2.0" || !body.method) {
    return c.json(makeError(JSONRPC_INVALID_REQUEST, "Invalid Request: must be valid JSON-RPC 2.0 with method"), 400);
  }

  const response = await handleRequest(body, auth);
  return c.json(response);
});

mcpRoutes.get("/", async (c) => {
  return c.json(
    makeError(JSONRPC_METHOD_NOT_FOUND, "MCP server only accepts POST requests"),
    405
  );
});