@systemdox/mcp-server 0.1.11

package/dist/http.js

@@ -0,0 +1,1623 @@
+#!/usr/bin/env node
+
+// src/http.ts
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+
+// src/lib/cache.ts
+var ResponseCache = class {
+  store = /* @__PURE__ */ new Map();
+  ttlMs;
+  constructor(ttlMs) {
+    this.ttlMs = ttlMs;
+  }
+  get(key) {
+    const entry = this.store.get(key);
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiresAt) {
+      this.store.delete(key);
+      return void 0;
+    }
+    return entry.data;
+  }
+  set(key, data) {
+    this.store.set(key, {
+      data,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  invalidate(key) {
+    this.store.delete(key);
+  }
+  clear() {
+    this.store.clear();
+  }
+};
+
+// src/lib/api-client.ts
+var SystemDoxApiClient = class {
+  config;
+  cache;
+  constructor(config) {
+    this.config = config;
+    this.cache = new ResponseCache(config.cacheTtlMs);
+  }
+  async validate() {
+    const res = await this.fetchRaw("/v1/health");
+    if (!res.ok) {
+      throw new Error(
+        `SystemDox API authentication failed (${res.status}). Check your SYSTEMDOX_API_KEY.`
+      );
+    }
+  }
+  async get(path, params) {
+    const url = this.buildUrl(path, params);
+    const cacheKey = url.toString();
+    const cached = this.cache.get(cacheKey);
+    if (cached !== void 0) return cached;
+    const res = await this.fetchRaw(path, params);
+    if (!res.ok) {
+      const body = await res.text();
+      throw new Error(`SystemDox API error ${res.status}: ${body}`);
+    }
+    const data = await res.json();
+    this.cache.set(cacheKey, data);
+    return data;
+  }
+  async post(path, body) {
+    return this.mutate("POST", path, body);
+  }
+  async put(path, body) {
+    return this.mutate("PUT", path, body);
+  }
+  async mutate(method, path, body) {
+    const url = this.buildUrl(path);
+    const res = await fetch(url, {
+      method,
+      headers: {
+        // The API Gateway authorizer only reads the Authorization header;
+        // X-API-Key is kept for backwards compatibility.
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "X-API-Key": this.config.apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(`SystemDox API error ${res.status}: ${text}`);
+    }
+    return await res.json();
+  }
+  invalidateCache(path) {
+    if (path) {
+      this.cache.invalidate(this.buildUrl(path).toString());
+    } else {
+      this.cache.clear();
+    }
+  }
+  buildUrl(path, params) {
+    const base = this.config.apiUrl.replace(/\/+$/, "");
+    const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        url.searchParams.set(key, value);
+      }
+    }
+    return url;
+  }
+  async fetchRaw(path, params) {
+    const url = this.buildUrl(path, params);
+    return fetch(url, {
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "X-API-Key": this.config.apiKey,
+        Accept: "application/json"
+      }
+    });
+  }
+};
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/tools/get-guardrails.ts
+import { z } from "zod";
+
+// src/lib/language.ts
+var EXTENSION_MAP = {
+  ".py": { language: "python", categories: ["api", "backend", "data-access"] },
+  ".ts": { language: "typescript", categories: ["frontend", "api"] },
+  ".tsx": { language: "typescript", categories: ["frontend"] },
+  ".js": { language: "javascript", categories: ["frontend"] },
+  ".jsx": { language: "javascript", categories: ["frontend"] },
+  ".yaml": {
+    language: "cloudformation",
+    categories: ["infrastructure", "architecture"]
+  },
+  ".yml": {
+    language: "cloudformation",
+    categories: ["infrastructure", "architecture"]
+  },
+  ".json": { language: "json", categories: ["configuration"] },
+  ".css": { language: "css", categories: ["frontend"] },
+  ".html": { language: "html", categories: ["frontend"] },
+  ".sql": { language: "sql", categories: ["data-access"] },
+  ".sh": { language: "shell", categories: ["infrastructure"] },
+  ".bash": { language: "shell", categories: ["infrastructure"] },
+  ".tf": { language: "terraform", categories: ["infrastructure"] },
+  ".md": { language: "markdown", categories: ["documentation"] }
+};
+var PATH_CATEGORY_RULES = [
+  { pattern: /backend\/functions\//, categories: ["api", "backend"] },
+  { pattern: /backend\/layers\//, categories: ["backend"] },
+  { pattern: /backend\//, categories: ["backend"] },
+  { pattern: /apps\/app\//, categories: ["frontend"] },
+  { pattern: /apps\/website\//, categories: ["frontend"] },
+  { pattern: /apps\/portal\//, categories: ["frontend"] },
+  { pattern: /packages\/ui\//, categories: ["frontend"] },
+  { pattern: /infra\//, categories: ["infrastructure"] },
+  { pattern: /\.github\//, categories: ["infrastructure"] },
+  { pattern: /tests?\//, categories: ["testing"] },
+  { pattern: /spec/, categories: ["testing"] },
+  { pattern: /docs\/adr/, categories: ["architecture"] },
+  { pattern: /template\.yaml$/, categories: ["infrastructure", "architecture"] }
+];
+function detectLanguage(filePath) {
+  const ext = filePath.slice(filePath.lastIndexOf("."));
+  return EXTENSION_MAP[ext];
+}
+function detectCategories(filePaths) {
+  const categories = /* @__PURE__ */ new Set();
+  for (const filePath of filePaths) {
+    const langInfo = detectLanguage(filePath);
+    if (langInfo) {
+      for (const cat of langInfo.categories) {
+        categories.add(cat);
+      }
+    }
+    for (const rule of PATH_CATEGORY_RULES) {
+      if (rule.pattern.test(filePath)) {
+        for (const cat of rule.categories) {
+          categories.add(cat);
+        }
+      }
+    }
+  }
+  return Array.from(categories);
+}
+function detectLanguages(filePaths) {
+  const languages = /* @__PURE__ */ new Set();
+  for (const filePath of filePaths) {
+    const info = detectLanguage(filePath);
+    if (info) languages.add(info.language);
+  }
+  return Array.from(languages);
+}
+
+// src/lib/deprecation.ts
+var LEGACY_TOOL_REMOVAL_EARLIEST = "2027-01-31";
+function legacyToolDescription(canonical, description) {
+  return `DEPRECATED \u2014 use \`${canonical}\` instead. This name still works and will not be removed before ${LEGACY_TOOL_REMOVAL_EARLIEST}. ${description}`;
+}
+
+// src/tools/get-guardrails.ts
+var DESCRIPTION = "Retrieve SystemDox checks (banned patterns, required patterns, coding rules). Filter by language, category, or file path to get only relevant checks.";
+var inputSchema = () => ({
+  language: z.string().optional().describe(
+    "Filter by programming language (python, typescript, javascript, cloudformation)"
+  ),
+  category: z.string().optional().describe(
+    "Filter by category (imports, auth, error-handling, architecture, testing, security, conventions, data-access)"
+  ),
+  file_path: z.string().optional().describe(
+    "File path being edited \u2014 language is auto-detected from the extension"
+  )
+});
+function registerGetGuardrails(server, apiClient) {
+  const handler2 = async ({
+    language,
+    category,
+    file_path
+  }) => {
+    const guardrails = await apiClient.get("/v1/guardrails");
+    let filtered = guardrails;
+    const lang = language ?? (file_path ? detectLanguage(file_path)?.language : void 0);
+    if (lang) {
+      filtered = filtered.filter(
+        (g) => g.description.toLowerCase().includes(lang.toLowerCase()) || g.category.toLowerCase().includes(lang.toLowerCase()) || g.title.toLowerCase().includes(lang.toLowerCase())
+      );
+    }
+    if (category) {
+      filtered = filtered.filter(
+        (g) => g.category.toLowerCase() === category.toLowerCase()
+      );
+    }
+    if (filtered.length === 0) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`
+          }
+        ]
+      };
+    }
+    const text = filtered.map(
+      (g) => `## ${g.title} [${g.severity}]
+
+${g.description}
+
+` + (g.pattern ? `**Bad pattern:**
+\`\`\`
+${g.pattern}
+\`\`\`
+
+` : "") + (g.fix ? `**Correct pattern:**
+\`\`\`
+${g.fix}
+\`\`\`
+
+` : "") + (g.fitnessTest ? `**Detection:** \`${g.fitnessTest}\`
+` : "")
+    ).join("\n---\n\n");
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Found ${filtered.length} check(s):
+
+${text}`
+        }
+      ]
+    };
+  };
+  server.registerTool(
+    "get_checks",
+    {
+      title: "Get Checks",
+      description: DESCRIPTION,
+      inputSchema: inputSchema()
+    },
+    handler2
+  );
+  server.registerTool(
+    "get_guardrails",
+    {
+      title: "Get Checks (legacy name)",
+      description: legacyToolDescription("get_checks", DESCRIPTION),
+      inputSchema: inputSchema()
+    },
+    handler2
+  );
+}
+
+// src/tools/get-specs.ts
+import { z as z2 } from "zod";
+function registerGetSpecs(server, apiClient) {
+  server.registerTool(
+    "get_specs",
+    {
+      title: "Get Specs",
+      description: "Retrieve SystemDox specifications (proposal, requirements with RFC 2119 keywords, Given/When/Then scenarios). Get a specific spec by ID, filter by status, or search by keyword.",
+      inputSchema: {
+        spec_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
+        status: z2.enum(["draft", "ready", "archived"]).optional().describe("Filter by status"),
+        search: z2.string().optional().describe("Keyword search across spec names")
+      }
+    },
+    async ({ spec_id, status, search }) => {
+      if (spec_id) {
+        const spec = await apiClient.get(
+          `/v1/specs/${spec_id}`
+        );
+        const sections = [`# ${spec.name}
+
+**Status:** ${spec.status}`];
+        if (spec.proposalContent) {
+          sections.push(`## Proposal
+
+${spec.proposalContent}`);
+        }
+        if (spec.requirements.length > 0) {
+          const reqs = spec.requirements.map((r) => `### ${r.name}
+
+${r.content}`).join("\n\n");
+          sections.push(`## Requirements
+
+${reqs}`);
+        }
+        if (spec.taskContent) {
+          sections.push(`## Tasks
+
+${spec.taskContent}`);
+        }
+        return {
+          content: [{ type: "text", text: sections.join("\n\n") }]
+        };
+      }
+      const specs = await apiClient.get("/v1/specs");
+      let filtered = specs;
+      if (status) {
+        filtered = filtered.filter((s) => s.status === status);
+      }
+      if (search) {
+        const term = search.toLowerCase();
+        filtered = filtered.filter(
+          (s) => s.name.toLowerCase().includes(term)
+        );
+      }
+      if (filtered.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `No specs found${status ? ` with status "${status}"` : ""}${search ? ` matching "${search}"` : ""}.`
+            }
+          ]
+        };
+      }
+      const text = filtered.map(
+        (s) => `- **${s.name}** (${s.specId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
+      ).join("\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Found ${filtered.length} spec(s):
+
+${text}`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-docs.ts
+import { z as z3 } from "zod";
+function matchGlob(path, pattern) {
+  const regex = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
+  return new RegExp(`^${regex}$`).test(path);
+}
+function registerGetDocs(server, apiClient) {
+  server.registerTool(
+    "get_docs",
+    {
+      title: "Get Docs",
+      description: "Retrieve synced documentation from connected GitHub repositories. Filter by repo, file path pattern, or keyword search.",
+      inputSchema: {
+        repo: z3.string().optional().describe("Filter by repo (owner/repo format)"),
+        path: z3.string().optional().describe("File path glob pattern (e.g., docs/adr/*.md)"),
+        search: z3.string().optional().describe("Keyword search across document content"),
+        doc_id: z3.string().optional().describe(
+          "Specific document ID to retrieve full content"
+        )
+      }
+    },
+    async ({ repo, path, search, doc_id }) => {
+      if (doc_id) {
+        const doc = await apiClient.get(
+          `/v1/docs/${encodeURIComponent(doc_id)}/content`
+        );
+        if (doc.error) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Error retrieving document: ${doc.error}`
+              }
+            ],
+            isError: true
+          };
+        }
+        return {
+          content: [{ type: "text", text: doc.content }]
+        };
+      }
+      const params = {};
+      if (repo) params.repo = repo;
+      if (search) params.q = search;
+      const response = await apiClient.get(
+        "/v1/docs",
+        params
+      );
+      let items = response.items;
+      if (path) {
+        items = items.filter((item) => matchGlob(item.path, path));
+      }
+      if (items.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `No documents found${repo ? ` in ${repo}` : ""}${path ? ` matching "${path}"` : ""}${search ? ` for "${search}"` : ""}.`
+            }
+          ]
+        };
+      }
+      const text = items.map(
+        (d) => `- **${d.title}** \u2014 \`${d.repo_full_name}/${d.path}\` (${d.doc_type}, ${d.size} bytes, synced ${d.synced_at})` + (d.snippet ? `
+  > ${d.snippet}` : "")
+      ).join("\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Found ${items.length} document(s) (${response.total} total):
+
+${text}
+
+Use doc_id to retrieve full content.`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-tech-stack.ts
+function registerGetTechStack(server, apiClient) {
+  server.registerTool(
+    "get_tech_stack",
+    {
+      title: "Get Tech Stack",
+      description: "Retrieve the configured technology stack (languages, frameworks, databases, infrastructure) with versions and notes."
+    },
+    async () => {
+      const stack = await apiClient.get(
+        "/v1/ai/settings/stack"
+      );
+      if (stack.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No tech stack entries configured."
+            }
+          ]
+        };
+      }
+      const grouped = /* @__PURE__ */ new Map();
+      for (const entry of stack) {
+        const list = grouped.get(entry.category) ?? [];
+        list.push(entry);
+        grouped.set(entry.category, list);
+      }
+      const sections = Array.from(grouped.entries()).map(([category, entries]) => {
+        const items = entries.map(
+          (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
+        ).join("\n");
+        return `### ${category}
+${items}`;
+      }).join("\n\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Tech stack (${stack.length} entries):
+
+${sections}`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-planning-context.ts
+import { z as z4 } from "zod";
+function registerGetPlanningContext(server, apiClient) {
+  server.registerTool(
+    "get_planning_context",
+    {
+      title: "Get Planning Context",
+      description: "Retrieve org-wide planning context: connected repos with summaries, cross-repo dependencies, ADRs, and active specs. Optionally focus on a target repo.",
+      inputSchema: {
+        target_repo: z4.string().optional().describe(
+          "Focus on a specific repo (owner/repo format) to get its CLAUDE.md and relevant context"
+        )
+      }
+    },
+    async ({ target_repo }) => {
+      const params = {};
+      if (target_repo) params.targetRepo = target_repo;
+      const ctx = await apiClient.get(
+        "/v1/org/planning-context",
+        params
+      );
+      const sections = [];
+      if (ctx.repoSummaries.length > 0) {
+        const repos = ctx.repoSummaries.map(
+          (r) => `#### ${r.repo}
+${r.purpose}
+
+${r.summary}` + (r.conventions.length > 0 ? `
+
+**Conventions:**
+${r.conventions.map((c) => `- ${c}`).join("\n")}` : "")
+        ).join("\n\n");
+        sections.push(`## Repositories (${ctx.repoSummaries.length})
+
+${repos}`);
+      }
+      if (ctx.dependencies.length > 0) {
+        const deps = ctx.dependencies.map((d) => `- ${d.from} \u2192 ${d.to}`).join("\n");
+        sections.push(`## Cross-Repo Dependencies
+
+${deps}`);
+      }
+      if (ctx.adrs.length > 0) {
+        const adrs = ctx.adrs.map((a) => `- ${a.title}${a.repo ? ` (${a.repo})` : ""}`).join("\n");
+        sections.push(`## Architecture Decision Records (${ctx.adrs.length})
+
+${adrs}`);
+      }
+      if (ctx.specs.length > 0) {
+        const specs = ctx.specs.map((s) => `- ${s.name} [${s.status}]`).join("\n");
+        sections.push(`## Specs (${ctx.specs.length})
+
+${specs}`);
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: sections.join("\n\n") || "No planning context available."
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-context.ts
+import { z as z5 } from "zod";
+
+// src/lib/scoring.ts
+var WEIGHT_PATH = 0.4;
+var WEIGHT_KEYWORD = 0.3;
+var WEIGHT_RECENCY = 0.15;
+var WEIGHT_SEVERITY = 0.15;
+var SEVERITY_SCORES = {
+  critical: 1,
+  high: 0.75,
+  medium: 0.5,
+  low: 0.25
+};
+var CHARS_PER_TOKEN = 4;
+function estimateTokens(text) {
+  return Math.ceil(text.length / CHARS_PER_TOKEN);
+}
+function truncateToTokens(text, maxTokens) {
+  const maxChars = Math.max(0, maxTokens) * CHARS_PER_TOKEN;
+  if (text.length <= maxChars) return { text, truncated: false };
+  const head = text.slice(0, maxChars);
+  const floor = Math.floor(maxChars * 0.75);
+  const paragraph = head.lastIndexOf("\n\n");
+  const line = head.lastIndexOf("\n");
+  let cut = maxChars;
+  if (paragraph >= floor) cut = paragraph;
+  else if (line >= floor) cut = line;
+  return { text: head.slice(0, cut).trimEnd(), truncated: true };
+}
+function scorePathMatch(item, languages, categories) {
+  if (languages.length === 0 && categories.length === 0) return 0.5;
+  let score = 0;
+  const itemLang = item.language?.toLowerCase() ?? "";
+  const itemCat = item.category?.toLowerCase() ?? "";
+  if (itemLang && languages.some((l) => itemLang.includes(l))) {
+    score += 0.6;
+  }
+  if (itemCat && categories.some((c) => itemCat.includes(c))) {
+    score += 0.4;
+  }
+  return Math.min(score, 1);
+}
+function scoreKeywordMatch(item, keywords) {
+  if (keywords.length === 0) return 0;
+  const searchable = `${item.title} ${item.content}`.toLowerCase();
+  let matches = 0;
+  for (const kw of keywords) {
+    if (searchable.includes(kw)) matches++;
+  }
+  return Math.min(matches / keywords.length, 1);
+}
+function scoreRecency(item) {
+  if (!item.updatedAt) return 0.5;
+  const now = Date.now();
+  const updated = new Date(item.updatedAt).getTime();
+  const daysSince = (now - updated) / (1e3 * 60 * 60 * 24);
+  if (daysSince <= 7) return 1;
+  if (daysSince <= 30) return 0.75;
+  if (daysSince <= 90) return 0.5;
+  return 0.25;
+}
+function scoreSeverity(item) {
+  if (!item.severity) return 0.5;
+  return SEVERITY_SCORES[item.severity] ?? 0.5;
+}
+function extractKeywords(text) {
+  const stopWords = /* @__PURE__ */ new Set([
+    "the",
+    "a",
+    "an",
+    "is",
+    "are",
+    "was",
+    "were",
+    "be",
+    "been",
+    "being",
+    "have",
+    "has",
+    "had",
+    "do",
+    "does",
+    "did",
+    "will",
+    "would",
+    "could",
+    "should",
+    "may",
+    "might",
+    "can",
+    "shall",
+    "to",
+    "of",
+    "in",
+    "for",
+    "on",
+    "with",
+    "at",
+    "by",
+    "from",
+    "as",
+    "into",
+    "about",
+    "between",
+    "through",
+    "after",
+    "before",
+    "during",
+    "without",
+    "this",
+    "that",
+    "these",
+    "those",
+    "it",
+    "its",
+    "and",
+    "or",
+    "but",
+    "not",
+    "no",
+    "all",
+    "each",
+    "every",
+    "both",
+    "few",
+    "more",
+    "most",
+    "other",
+    "some",
+    "such",
+    "than",
+    "too",
+    "very",
+    "just",
+    "also",
+    "only",
+    "new",
+    "add",
+    "update",
+    "fix",
+    "change",
+    "make",
+    "use",
+    "get",
+    "set",
+    "need",
+    "want",
+    "implement",
+    "create"
+  ]);
+  return text.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
+}
+function scoreItems(items, taskDescription, filePaths) {
+  const languages = detectLanguages(filePaths);
+  const categories = detectCategories(filePaths);
+  const keywords = extractKeywords(taskDescription);
+  return items.map((item) => {
+    const pathScore = scorePathMatch(item, languages, categories);
+    const keywordScore = scoreKeywordMatch(item, keywords);
+    const recencyScore = scoreRecency(item);
+    const severityScore = scoreSeverity(item);
+    const score = pathScore * WEIGHT_PATH + keywordScore * WEIGHT_KEYWORD + recencyScore * WEIGHT_RECENCY + severityScore * WEIGHT_SEVERITY;
+    return {
+      type: item.type,
+      id: item.id,
+      title: item.title,
+      content: item.content,
+      score,
+      tokenEstimate: estimateTokens(item.content)
+    };
+  }).sort((a, b) => b.score - a.score);
+}
+function selectWithinBudget(items, maxTokens) {
+  const selected = [];
+  let tokensUsed = 0;
+  for (const item of items) {
+    if (tokensUsed + item.tokenEstimate > maxTokens) continue;
+    selected.push(item);
+    tokensUsed += item.tokenEstimate;
+  }
+  return { selected, tokensUsed, totalItems: items.length };
+}
+
+// src/lib/context-builder.ts
+var DEFAULT_BUDGET = 4e3;
+var RESERVE_TOKENS = 200;
+var GUARDRAIL_SHARE = 0.35;
+var MIN_BODY_TOKENS = 150;
+var MAX_HYDRATED = 8;
+var MAX_TAIL = 10;
+var TAIL_SHARE = 0.15;
+var TRUNCATION_NOTICE_TOKENS = 30;
+function formatGuardrail(g) {
+  let text = `## ${g.title} [${g.severity}]
+
+${g.description}`;
+  if (g.pattern) text += `
+
+**Bad:** \`\`\`
+${g.pattern}
+\`\`\``;
+  if (g.fix) text += `
+
+**Good:** \`\`\`
+${g.fix}
+\`\`\``;
+  return text;
+}
+function formatSpecHeadline(s) {
+  return `### ${s.name}
+\`spec_id: ${s.specId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
+}
+function formatDocHeadline(d) {
+  return `### ${d.title}
+\`doc_id: ${d.id}\` \xB7 \`${d.repo_full_name}/${d.path}\` \xB7 ${d.doc_type}`;
+}
+function formatStack(entries) {
+  return entries.map(
+    (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
+  ).join("\n");
+}
+function formatRules(rules) {
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    const cat = r.category || "other";
+    if (!byCategory.has(cat)) byCategory.set(cat, []);
+    byCategory.get(cat).push(r);
+  }
+  let text = "";
+  for (const [cat, catRules] of byCategory) {
+    text += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
+`;
+    for (const r of catRules) {
+      text += `- ${r.text}
+`;
+    }
+    text += "\n";
+  }
+  return `## Project Rules (${rules.length})
+
+${text.trim()}`;
+}
+async function fetchSpecBody(api, specId) {
+  const spec = await api.get(
+    `/v1/specs/${encodeURIComponent(specId)}`
+  );
+  const parts = [];
+  if (spec.proposalContent) {
+    parts.push(`**Proposal**
+
+${spec.proposalContent}`);
+  }
+  for (const r of spec.requirements ?? []) {
+    parts.push(`**${r.name}**
+
+${r.content}`);
+  }
+  if (spec.taskContent) {
+    parts.push(`**Tasks**
+
+${spec.taskContent}`);
+  }
+  const body = parts.join("\n\n").trim();
+  if (!body) throw new Error("spec has no content");
+  return body;
+}
+async function fetchDocBody(api, docId) {
+  const doc = await api.get(
+    `/v1/docs/${encodeURIComponent(docId)}/content`
+  );
+  if (doc.error) throw new Error(doc.error);
+  const body = (doc.content ?? "").trim();
+  if (!body) throw new Error("document is empty");
+  return body;
+}
+async function hydrate(api, item, meta) {
+  try {
+    const body = meta.type === "spec" ? await fetchSpecBody(api, meta.id) : await fetchDocBody(api, meta.id);
+    return { item, meta, body };
+  } catch (err) {
+    return {
+      item,
+      meta,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function buildContext(api, { taskDescription, filePaths = [], maxTokens }) {
+  const budget = maxTokens ?? DEFAULT_BUDGET;
+  const [guardrails, specs, docs, stack, rules] = await Promise.all([
+    api.get("/v1/guardrails").catch(() => []),
+    api.get("/v1/specs").catch(() => []),
+    api.get("/v1/docs").catch(() => ({ items: [] })),
+    api.get("/v1/ai/settings/stack").catch(() => []),
+    api.get("/v1/standards/rules").catch(() => [])
+  ]);
+  const refs = /* @__PURE__ */ new Map();
+  const key = (type, id) => `${type}:${id}`;
+  const scorable = [
+    ...guardrails.map((g) => ({
+      type: "guardrail",
+      id: g.id,
+      title: g.title,
+      content: formatGuardrail(g),
+      category: g.category,
+      severity: g.severity,
+      updatedAt: g.updatedAt
+    })),
+    ...specs.filter((s) => s.status !== "archived").map((s) => {
+      refs.set(key("spec", s.specId), {
+        type: "spec",
+        id: s.specId,
+        title: s.name,
+        listLine: `- **${s.name}** \u2014 \`spec_id: ${s.specId}\` (${s.status}, ${s.requirementCount} requirements)`,
+        fetchHint: `get_specs(spec_id="${s.specId}")`
+      });
+      return {
+        type: "spec",
+        id: s.specId,
+        title: s.name,
+        content: formatSpecHeadline(s),
+        updatedAt: s.updatedAt
+      };
+    }),
+    ...docs.items.map((d) => {
+      refs.set(key("doc", d.id), {
+        type: "doc",
+        id: d.id,
+        title: d.title,
+        listLine: `- **${d.title}** \u2014 \`doc_id: ${d.id}\` (\`${d.repo_full_name}/${d.path}\`)`,
+        fetchHint: `get_docs(doc_id="${d.id}")`
+      });
+      return {
+        type: "doc",
+        id: d.id,
+        title: d.title,
+        content: formatDocHeadline(d),
+        category: d.doc_type === "adr" ? "architecture" : void 0,
+        updatedAt: d.synced_at
+      };
+    })
+  ];
+  const ranked = scoreItems(scorable, taskDescription, filePaths);
+  const sections = [];
+  let overhead = 0;
+  if (stack.length > 0) {
+    const section = `## Tech Stack
+
+${formatStack(stack)}`;
+    sections.push(section);
+    overhead += estimateTokens(section);
+  }
+  if (rules.length > 0) {
+    const section = formatRules(rules);
+    sections.push(section);
+    overhead += estimateTokens(section);
+  }
+  let remaining = budget - RESERVE_TOKENS - overhead;
+  const rankedGuardrails = ranked.filter((i) => i.type === "guardrail");
+  const { selected: selectedGuardrails, tokensUsed: guardrailTokens } = selectWithinBudget(
+    rankedGuardrails,
+    Math.max(0, Math.floor(remaining * GUARDRAIL_SHARE))
+  );
+  remaining -= guardrailTokens;
+  const rankedRefs = ranked.filter(
+    (i) => i.type === "spec" || i.type === "doc"
+  );
+  const avgHeadline = rankedRefs.length ? Math.ceil(
+    rankedRefs.slice(0, MAX_HYDRATED).reduce((sum, i) => sum + i.tokenEstimate, 0) / Math.min(rankedRefs.length, MAX_HYDRATED)
+  ) : 0;
+  const affordable = Math.floor(
+    Math.max(0, remaining) / (MIN_BODY_TOKENS + avgHeadline)
+  );
+  const shortlist = rankedRefs.slice(
+    0,
+    Math.max(0, Math.min(MAX_HYDRATED, affordable))
+  );
+  for (const item of shortlist) {
+    remaining -= item.tokenEstimate;
+  }
+  remaining = Math.max(0, remaining);
+  const hydrated = await Promise.all(
+    shortlist.map(
+      (item) => hydrate(api, item, refs.get(key(item.type, item.id)))
+    )
+  );
+  const tailCandidates = rankedRefs.slice(shortlist.length, shortlist.length + MAX_TAIL).map((i) => refs.get(key(i.type, i.id)));
+  const tailCost = tailCandidates.reduce(
+    (sum, m) => sum + estimateTokens(m.listLine),
+    0
+  );
+  const tailReserve = Math.min(
+    tailCost,
+    Math.floor(remaining * TAIL_SHARE)
+  );
+  const bodyBudgetStart = Math.max(0, remaining - tailReserve);
+  let bodyBudget = bodyBudgetStart;
+  let itemsLeft = hydrated.length;
+  let itemsWithBody = 0;
+  let bodyFailures = 0;
+  const blocks = [];
+  for (const h of hydrated) {
+    itemsLeft--;
+    const emit = (block) => {
+      bodyBudget -= Math.max(
+        0,
+        estimateTokens(block) - h.item.tokenEstimate
+      );
+      blocks.push(block);
+    };
+    if (h.error !== void 0) {
+      bodyFailures++;
+      emit(
+        `${h.item.content}
+
+_Body unavailable (${h.error}) \u2014 retry with \`${h.meta.fetchHint}\`._`
+      );
+      continue;
+    }
+    const available = Math.max(0, bodyBudget);
+    const allowance = Math.min(
+      Math.max(MIN_BODY_TOKENS, Math.floor(available / (itemsLeft + 1))),
+      available
+    );
+    if (allowance < MIN_BODY_TOKENS) {
+      emit(
+        `${h.item.content}
+
+_Body omitted (token budget exhausted) \u2014 fetch with \`${h.meta.fetchHint}\`._`
+      );
+      continue;
+    }
+    const { text: body2, truncated } = truncateToTokens(
+      h.body,
+      allowance - TRUNCATION_NOTICE_TOKENS
+    );
+    itemsWithBody++;
+    emit(
+      `${h.item.content}
+
+${body2}` + (truncated ? `
+
+_[truncated to fit the token budget \u2014 full text via \`${h.meta.fetchHint}\`]_` : "")
+    );
+  }
+  remaining = Math.max(0, remaining - (bodyBudgetStart - bodyBudget));
+  if (selectedGuardrails.length > 0) {
+    sections.push(
+      `## Checks (${selectedGuardrails.length})
+
+` + selectedGuardrails.map((i) => i.content).join("\n\n---\n\n")
+    );
+  }
+  if (blocks.length > 0) {
+    sections.push(
+      `## Relevant Specs & Docs (${blocks.length})
+
+_Full text of the highest-ranked items. Every item carries the ID to fetch it in full._
+
+` + blocks.join("\n\n---\n\n")
+    );
+  }
+  const tailLines = [];
+  for (const meta of tailCandidates) {
+    const cost = estimateTokens(meta.listLine);
+    if (cost > remaining) break;
+    tailLines.push(meta.listLine);
+    remaining -= cost;
+  }
+  if (tailLines.length > 0) {
+    sections.push(
+      `## Also Indexed (${tailLines.length})
+
+_Ranked lower \u2014 fetch with \`get_specs\` / \`get_docs\` if you need them._
+
+` + tailLines.join("\n")
+    );
+  }
+  const itemsListed = blocks.length - itemsWithBody + tailLines.length;
+  const itemsOmitted = ranked.length - selectedGuardrails.length - blocks.length - tailLines.length;
+  const body = sections.join("\n\n");
+  const tokensUsed = estimateTokens(body);
+  const stats = {
+    budget,
+    tokensUsed,
+    itemsWithBody,
+    bodyFailures,
+    itemsListed,
+    itemsOmitted: Math.max(0, itemsOmitted),
+    guardrails: selectedGuardrails.length
+  };
+  if (sections.length === 0) {
+    return { text: "No relevant context found for this task.", stats };
+  }
+  const footer = `
+
+---
+_Context: ${itemsWithBody} full text, ${itemsListed} listed, ${stats.itemsOmitted} omitted \xB7 ~${tokensUsed} of ${budget} tokens` + (bodyFailures > 0 ? ` \xB7 ${bodyFailures} body fetch(es) failed` : "") + `_`;
+  return { text: body + footer, stats };
+}
+
+// src/tools/get-context.ts
+function registerGetContext(server, apiClient) {
+  server.registerTool(
+    "get_context",
+    {
+      title: "Get Context",
+      description: "Intelligent context aggregator: fetches checks, specs, docs, and tech stack, ranks them by relevance to your current task, and returns the full text of the highest-ranked items within a token budget \u2014 each with the ID needed to fetch the rest. Use this instead of calling individual tools when you want curated, relevant context.",
+      inputSchema: {
+        task_description: z5.string().describe(
+          "What you're working on (e.g., 'add a new REST endpoint for user preferences')"
+        ),
+        file_paths: z5.array(z5.string()).optional().describe(
+          "File paths being edited \u2014 used for language/category detection"
+        ),
+        max_tokens: z5.number().optional().describe("Maximum token budget for the response (default: 4000)")
+      }
+    },
+    async ({ task_description, file_paths, max_tokens }) => {
+      const { text } = await buildContext(apiClient, {
+        taskDescription: task_description,
+        filePaths: file_paths,
+        maxTokens: max_tokens
+      });
+      return {
+        content: [{ type: "text", text }]
+      };
+    }
+  );
+}
+
+// src/tools/create-guardrail.ts
+import { z as z6 } from "zod";
+var DESCRIPTION2 = "Create a new check in SystemDox. Use this when you discover a pattern that should be enforced (banned pattern, required pattern, coding rule).";
+var CATEGORIES = [
+  "imports",
+  "auth",
+  "error-handling",
+  "architecture",
+  "testing",
+  "security",
+  "conventions",
+  "data-access"
+];
+var inputSchema2 = () => ({
+  title: z6.string().describe("Short title for the check"),
+  description: z6.string().describe("Detailed description of what the check enforces and why"),
+  severity: z6.enum(["critical", "high", "medium", "low"]).describe("Severity level"),
+  category: z6.enum(CATEGORIES).optional().describe("Category (defaults to conventions)"),
+  pattern: z6.string().optional().describe("Bad code pattern that should be avoided"),
+  fix: z6.string().optional().describe("Correct code pattern to use instead"),
+  fitness_test: z6.string().optional().describe("Shell command to detect violations in CI")
+});
+function registerCreateGuardrail(server, apiClient) {
+  const handler2 = async ({
+    title,
+    description,
+    severity,
+    category,
+    pattern,
+    fix,
+    fitness_test
+  }) => {
+    const result = await apiClient.post(
+      "/v1/guardrails",
+      {
+        entries: [
+          {
+            title,
+            description,
+            severity,
+            category: category ?? "conventions",
+            pattern: pattern ?? "",
+            fix: fix ?? "",
+            fitnessTest: fitness_test ?? ""
+          }
+        ]
+      }
+    );
+    apiClient.invalidateCache("/v1/guardrails");
+    const saved = result[0];
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Check created: **${saved.title}** (id: ${saved.id}, severity: ${saved.severity}, category: ${saved.category})`
+        }
+      ]
+    };
+  };
+  server.registerTool(
+    "create_check",
+    {
+      title: "Create Check",
+      description: DESCRIPTION2,
+      inputSchema: inputSchema2(),
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    handler2
+  );
+  server.registerTool(
+    "create_guardrail",
+    {
+      title: "Create Check (legacy name)",
+      description: legacyToolDescription("create_check", DESCRIPTION2),
+      inputSchema: inputSchema2(),
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    handler2
+  );
+}
+
+// src/tools/update-spec.ts
+import { z as z7 } from "zod";
+function registerUpdateSpec(server, apiClient) {
+  server.registerTool(
+    "update_spec",
+    {
+      title: "Update Spec",
+      description: "Update an existing SystemDox spec's proposal, tasks, or requirements. Only draft specs can be modified \u2014 published specs must be versioned first.",
+      inputSchema: {
+        spec_id: z7.string().describe("ID of the spec to update"),
+        section: z7.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
+        content: z7.string().describe(
+          "New markdown content for the section. For requirements, provide the full requirement content."
+        ),
+        requirement_name: z7.string().optional().describe(
+          "Name of the requirement (required when section is 'requirements')"
+        )
+      },
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    async ({ spec_id, section, content, requirement_name }) => {
+      const spec = await apiClient.get(`/v1/specs/${spec_id}`);
+      if (spec.status !== "draft") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Cannot modify spec "${spec.name}" \u2014 status is "${spec.status}". Only draft specs can be updated.`
+            }
+          ],
+          isError: true
+        };
+      }
+      const body = {};
+      if (section === "proposal") {
+        body.proposalContent = content;
+      } else if (section === "tasks") {
+        body.taskContent = content;
+      } else if (section === "requirements") {
+        const existing = spec.requirements;
+        const newReq = {
+          name: requirement_name ?? "Untitled Requirement",
+          content
+        };
+        body.requirements = [...existing, newReq];
+      }
+      await apiClient.put(`/v1/specs/${spec_id}`, body);
+      apiClient.invalidateCache(`/v1/specs/${spec_id}`);
+      apiClient.invalidateCache("/v1/specs");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Updated spec "${spec.name}" \u2014 ${section} section modified.`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/report-decision.ts
+import { z as z8 } from "zod";
+function registerReportDecision(server, apiClient) {
+  server.registerTool(
+    "report_decision",
+    {
+      title: "Report Decision",
+      description: "Record an architecture decision made during development. Creates a draft ADR in SystemDox for human review.",
+      inputSchema: {
+        title: z8.string().describe("Decision title (e.g., 'Use WebSocket for real-time updates')"),
+        context: z8.string().describe("What prompted this decision \u2014 the problem or constraint"),
+        decision: z8.string().describe("What was decided and why"),
+        consequences: z8.string().describe("What this decision means going forward \u2014 trade-offs, follow-up work"),
+        related_files: z8.array(z8.string()).optional().describe("File paths related to this decision")
+      },
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    async ({ title, context, decision, consequences, related_files }) => {
+      const adrTitle = `ADR: ${title}`;
+      const created = await apiClient.post("/v1/specs", {
+        name: adrTitle
+      });
+      const relatedSection = related_files && related_files.length > 0 ? `
+
+## Related Files
+
+${related_files.map((f) => `- \`${f}\``).join("\n")}` : "";
+      const adrContent = `# ${adrTitle}
+
+**Date:** ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}
+**Status:** Draft (pending review)
+
+## Context
+
+${context}
+
+## Decision
+
+${decision}
+
+## Consequences
+
+${consequences}` + relatedSection;
+      await apiClient.put(`/v1/specs/${created.specId}`, {
+        proposalContent: adrContent
+      });
+      apiClient.invalidateCache("/v1/specs");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.specId})
+
+Status: draft \u2014 review in SystemDox before publishing.`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-project-rules.ts
+import { z as z9 } from "zod";
+var CATEGORY_LABELS = {
+  deployment: "Deployment",
+  architecture: "Architecture",
+  security: "Security",
+  testing: "Testing",
+  process: "Process",
+  other: "Other"
+};
+function registerGetProjectRules(server, apiClient) {
+  server.registerTool(
+    "get_project_rules",
+    {
+      title: "Get Project Rules",
+      description: "Retrieve project rules defined in SystemDox Standards. These are team-defined principles covering deployment, architecture, security, testing, and process. Filter by category to get only relevant rules.",
+      inputSchema: {
+        category: z9.enum(["deployment", "architecture", "security", "testing", "process", "other"]).optional().describe("Filter by rule category")
+      }
+    },
+    async ({ category }) => {
+      const rules = await apiClient.get(
+        "/v1/standards/rules"
+      );
+      let filtered = rules;
+      if (category) {
+        filtered = filtered.filter(
+          (r) => r.category.toLowerCase() === category.toLowerCase()
+        );
+      }
+      if (filtered.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `No project rules found${category ? ` in category "${category}"` : ""}.`
+            }
+          ]
+        };
+      }
+      const grouped = /* @__PURE__ */ new Map();
+      for (const rule of filtered) {
+        const cat = rule.category || "other";
+        if (!grouped.has(cat)) grouped.set(cat, []);
+        grouped.get(cat).push(rule);
+      }
+      let text = `Found ${filtered.length} project rule(s):
+
+`;
+      for (const [cat, catRules] of grouped) {
+        const label = CATEGORY_LABELS[cat] ?? cat;
+        text += `## ${label}
+
+`;
+        for (const rule of catRules) {
+          text += `- ${rule.text}
+`;
+        }
+        text += "\n";
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/create-project-rule.ts
+import { z as z10 } from "zod";
+function registerCreateProjectRule(server, apiClient) {
+  server.registerTool(
+    "create_project_rule",
+    {
+      title: "Create Project Rule",
+      description: "Create a new project rule in SystemDox Standards. Use this when you discover a team principle or convention that should be enforced across the project.",
+      inputSchema: {
+        text: z10.string().describe(
+          "The rule statement \u2014 one enforceable principle per rule (e.g. 'All deployments MUST go through GitHub Actions workflows')"
+        ),
+        category: z10.enum(["deployment", "architecture", "security", "testing", "process", "other"]).describe("Rule category")
+      },
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    async ({ text, category }) => {
+      const saved = await apiClient.post(
+        "/v1/standards/rules",
+        { text, category }
+      );
+      apiClient.invalidateCache("/v1/standards/rules");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Project rule created: **${saved.text}** (id: ${saved.id}, category: ${saved.category})`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-prompt-templates.ts
+function registerGetPromptTemplates(server, apiClient) {
+  server.registerTool(
+    "get_prompt_templates",
+    {
+      title: "Get Prompt Templates",
+      description: "Retrieve reusable prompt templates from SystemDox Standards. These are preconfigured prompts that Gen AI should use when generating content \u2014 e.g. code review checklists, documentation templates, or analysis frameworks.",
+      inputSchema: {}
+    },
+    async () => {
+      const templates = await apiClient.get(
+        "/v1/standards/prompt-templates"
+      );
+      if (templates.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No prompt templates found."
+            }
+          ]
+        };
+      }
+      const text = templates.map(
+        (t) => `## ${t.name}
+
+` + (t.description ? `*${t.description}*
+
+` : "") + `\`\`\`
+${t.prompt}
+\`\`\``
+      ).join("\n\n---\n\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Found ${templates.length} prompt template(s):
+
+${text}`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/create-prompt-template.ts
+import { z as z11 } from "zod";
+function registerCreatePromptTemplate(server, apiClient) {
+  server.registerTool(
+    "create_prompt_template",
+    {
+      title: "Create Prompt Template",
+      description: "Create a new reusable prompt template in SystemDox Standards. Use this to store preconfigured prompts for common AI tasks like code reviews, documentation generation, or analysis frameworks.",
+      inputSchema: {
+        name: z11.string().describe("Short name for the template"),
+        description: z11.string().optional().describe("Brief description of when to use this template"),
+        prompt: z11.string().describe("The full prompt text that Gen AI will use when generating content")
+      },
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    async ({ name, description, prompt }) => {
+      const saved = await apiClient.post(
+        "/v1/standards/prompt-templates",
+        {
+          name,
+          description: description ?? "",
+          prompt
+        }
+      );
+      apiClient.invalidateCache("/v1/standards/prompt-templates");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Prompt template created: **${saved.name}** (id: ${saved.id})`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/server.ts
+function createServer(apiClient) {
+  const server = new McpServer({
+    name: "systemdox-mcp-server",
+    version: "0.1.0"
+  });
+  registerGetGuardrails(server, apiClient);
+  registerGetSpecs(server, apiClient);
+  registerGetDocs(server, apiClient);
+  registerGetTechStack(server, apiClient);
+  registerGetPlanningContext(server, apiClient);
+  registerGetContext(server, apiClient);
+  registerGetProjectRules(server, apiClient);
+  registerGetPromptTemplates(server, apiClient);
+  registerCreateGuardrail(server, apiClient);
+  registerUpdateSpec(server, apiClient);
+  registerReportDecision(server, apiClient);
+  registerCreateProjectRule(server, apiClient);
+  registerCreatePromptTemplate(server, apiClient);
+  return server;
+}
+
+// src/http.ts
+var MCP_HOST_SUFFIX = ".mcp.systemdox.com";
+function lowercaseHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers ?? {})) {
+    if (value !== void 0) out[key.toLowerCase()] = value;
+  }
+  return out;
+}
+function jsonError(statusCode, message) {
+  return {
+    statusCode,
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      error: { code: -32e3, message },
+      id: null
+    })
+  };
+}
+async function handler(event) {
+  const headers = lowercaseHeaders(event.headers);
+  const host = (headers["host"] ?? "").toLowerCase();
+  if (host.endsWith(MCP_HOST_SUFFIX)) {
+    const hostTenant = host.slice(0, -MCP_HOST_SUFFIX.length);
+    const keyTenant = event.requestContext?.authorizer?.tenant_slug ?? "";
+    if (!hostTenant || hostTenant.includes(".") || hostTenant !== keyTenant) {
+      return jsonError(403, "API key does not belong to this tenant");
+    }
+  }
+  if (event.httpMethod !== "POST") {
+    return {
+      statusCode: 405,
+      headers: { "Content-Type": "application/json", Allow: "POST" },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        error: { code: -32e3, message: "Method not allowed \u2014 stateless server, POST only" },
+        id: null
+      })
+    };
+  }
+  const authHeader = headers["authorization"] ?? "";
+  const apiKey = authHeader.startsWith("Bearer ") ? authHeader.slice(7).trim() : "";
+  if (!apiKey) {
+    return jsonError(401, "Missing bearer API key");
+  }
+  const rawBody = event.isBase64Encoded ? Buffer.from(event.body ?? "", "base64").toString("utf8") : event.body ?? "";
+  const apiClient = new SystemDoxApiClient({
+    apiKey,
+    apiUrl: process.env.SYSTEMDOX_API_URL ?? "https://api.puglieseweb.com/systemdox",
+    cacheTtlMs: 0,
+    // per-request client; never cache across invocations
+    defaultOrg: void 0
+  });
+  const server = createServer(apiClient);
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    sessionIdGenerator: void 0,
+    // stateless — every POST is independent
+    enableJsonResponse: true
+  });
+  headers["accept"] = "application/json, text/event-stream";
+  if (!(headers["content-type"] ?? "").includes("application/json")) {
+    headers["content-type"] = "application/json";
+  }
+  try {
+    await server.connect(transport);
+    const request = new Request(`https://${host || "localhost"}${event.path || "/mcp"}`, {
+      method: "POST",
+      headers,
+      body: rawBody
+    });
+    const response = await transport.handleRequest(request);
+    const FORWARD = /* @__PURE__ */ new Set(["content-type", "mcp-session-id"]);
+    const responseHeaders = {};
+    response.headers.forEach((value, key) => {
+      if (FORWARD.has(key.toLowerCase())) responseHeaders[key] = value;
+    });
+    if (!("content-type" in responseHeaders)) {
+      responseHeaders["content-type"] = "application/json";
+    }
+    return {
+      statusCode: response.status,
+      headers: responseHeaders,
+      body: await response.text()
+    };
+  } finally {
+    void transport.close().catch((err) => console.error("MCP transport close failed:", err));
+    void server.close().catch((err) => console.error("MCP server close failed:", err));
+  }
+}
+export {
+  handler
+};