@systemdox/mcp-server 0.1.45 → 0.1.46

package/dist/plugin-path.js

@@ -0,0 +1,544 @@
+#!/usr/bin/env node
+
+// src/plugin-path.ts
+import { createHash, randomBytes } from "crypto";
+import { existsSync } from "fs";
+import { mkdir as mkdir2, rename as rename2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join2, resolve, sep } from "path";
+import { inflateRawSync } from "zlib";
+
+// src/lib/cache.ts
+var ResponseCache = class {
+  store = /* @__PURE__ */ new Map();
+  ttlMs;
+  constructor(ttlMs) {
+    this.ttlMs = ttlMs;
+  }
+  get(key) {
+    const entry = this.store.get(key);
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiresAt) {
+      this.store.delete(key);
+      return void 0;
+    }
+    return entry.data;
+  }
+  set(key, data) {
+    this.store.set(key, {
+      data,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  invalidate(key) {
+    this.store.delete(key);
+  }
+  clear() {
+    this.store.clear();
+  }
+};
+
+// src/lib/api-client.ts
+var SystemDoxApiError = class extends Error {
+  constructor(status, text) {
+    super(`SystemDox API error ${status}: ${text}`);
+    this.status = status;
+    this.text = text;
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = void 0;
+    }
+    this.body = body;
+    const code = body?.code;
+    this.code = typeof code === "string" ? code : /\b(SYD-[A-Z]\d{3})\b/.exec(text)?.[1];
+  }
+  status;
+  text;
+  code;
+  body;
+};
+var TEAM_SETUP = "/v1/team-setup";
+var seg = (s) => encodeURIComponent(String(s));
+var SystemDoxApiClient = class {
+  config;
+  cache;
+  constructor(config) {
+    this.config = config;
+    this.cache = new ResponseCache(config.cacheTtlMs);
+  }
+  async validate() {
+    const res = await this.fetchRaw("/v1/health");
+    if (!res.ok) {
+      throw new Error(
+        `SystemDox API authentication failed (${res.status}). Check your SYSTEMDOX_API_KEY.`
+      );
+    }
+  }
+  async get(path, params) {
+    const url = this.buildUrl(path, params);
+    const cacheKey = url.toString();
+    const cached = this.cache.get(cacheKey);
+    if (cached !== void 0) return cached;
+    const res = await this.fetchRaw(path, params);
+    if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+    const data = await res.json();
+    this.cache.set(cacheKey, data);
+    return data;
+  }
+  /** A read that skips the cache: an install must take the version that is
+   * latest now, not the one cached before someone published another. */
+  async getFresh(path) {
+    const res = await this.fetchRaw(path);
+    if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+    return await res.json();
+  }
+  async post(path, body) {
+    return this.mutate("POST", path, body);
+  }
+  async put(path, body) {
+    return this.mutate("PUT", path, body);
+  }
+  async mutate(method, path, body) {
+    const url = this.buildUrl(path);
+    const res = await fetch(url, {
+      method,
+      headers: {
+        // The API Gateway authorizer only reads the Authorization header;
+        // X-API-Key is kept for backwards compatibility.
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "X-API-Key": this.config.apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+    return await res.json();
+  }
+  // ── Team setup (ADR-217, specs/changes/team-setup/openapi.yaml) ──────────
+  // One method per operationId. Every read skips the cache: setup, sync and
+  // plugin-path act on what the workspace holds now.
+  /** getOwnTeamSetup: the key's own workspace, named in `workspace`. */
+  getOwnTeamSetup() {
+    return this.getFresh(TEAM_SETUP);
+  }
+  getTeamSetup(workspace) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}`);
+  }
+  getMarketplace(workspace) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/marketplace.json`);
+  }
+  getPart(workspace, part) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}`);
+  }
+  publishPartVersion(workspace, part, files) {
+    return this.post(`${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}/versions`, { files });
+  }
+  getPartVersion(workspace, part, version) {
+    return this.getFresh(
+      `${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}/versions/${seg(version)}`
+    );
+  }
+  getSetupSkills(workspace) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/skills`);
+  }
+  setSetupSkills(workspace, skills) {
+    return this.put(`${TEAM_SETUP}/${seg(workspace)}/skills`, { skills });
+  }
+  getPlugin(workspace) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/plugin`);
+  }
+  /** getPluginZip: the zip's bytes as served, and its X-Content-SHA256
+   * header. The caller checks the BYTES against the hash it was given. */
+  async getPluginZip(workspace, version) {
+    const res = await fetch(
+      this.buildUrl(`${TEAM_SETUP}/${seg(workspace)}/plugin/versions/${seg(version)}/zip`),
+      {
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "X-API-Key": this.config.apiKey,
+          Accept: "application/zip"
+        }
+      }
+    );
+    if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+    return { bytes: Buffer.from(await res.arrayBuffer()), sha256: res.headers.get("x-content-sha256") };
+  }
+  listMemoryProjects(workspace) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/memory`);
+  }
+  getMemory(workspace, project) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}`);
+  }
+  /** pushMemoryVersion: a stale base throws SystemDoxApiError with status 409,
+   * code SYD-K010 and `body.currentVersion`. */
+  pushMemoryVersion(workspace, project, body) {
+    return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/versions`, body);
+  }
+  getMemoryVersion(workspace, project, version) {
+    return this.getFresh(
+      `${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/versions/${seg(version)}`
+    );
+  }
+  findMissingBlobs(workspace, project, hashes) {
+    return this.post(
+      `${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs/missing`,
+      { hashes }
+    );
+  }
+  uploadBlobs(workspace, project, blobs) {
+    return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs`, { blobs });
+  }
+  readBlobs(workspace, project, hashes) {
+    return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs/read`, { hashes });
+  }
+  listValueAnswers(workspace) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/values`);
+  }
+  lookupValues(workspace, values) {
+    return this.post(`${TEAM_SETUP}/${seg(workspace)}/values`, { values });
+  }
+  answerValues(workspace, answers) {
+    return this.put(`${TEAM_SETUP}/${seg(workspace)}/values`, { answers });
+  }
+  fileMemoryPeople(workspace, people) {
+    return this.post(`${TEAM_SETUP}/${seg(workspace)}/people`, { people });
+  }
+  resolvePerson(workspace, personId) {
+    return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/people/${seg(personId)}`);
+  }
+  invalidateCache(path) {
+    if (path) {
+      this.cache.invalidate(this.buildUrl(path).toString());
+    } else {
+      this.cache.clear();
+    }
+  }
+  buildUrl(path, params) {
+    const base = this.config.apiUrl.replace(/\/+$/, "");
+    const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        url.searchParams.set(key, value);
+      }
+    }
+    return url;
+  }
+  async fetchRaw(path, params) {
+    const url = this.buildUrl(path, params);
+    return fetch(url, {
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "X-API-Key": this.config.apiKey,
+        Accept: "application/json"
+      }
+    });
+  }
+};
+
+// src/lib/team-setup-files.ts
+import { execFile } from "child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir, userInfo } from "os";
+import { dirname, join } from "path";
+import { promisify } from "util";
+
+// src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
+  }
+  return apiUrl;
+}
+
+// src/lib/team-setup-files.ts
+var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isWorkspace(value) {
+  return typeof value === "string" && value.length <= 64 && SLUG_RE.test(value);
+}
+function homeDir() {
+  return homedir();
+}
+function systemdoxDir() {
+  return join(homeDir(), ".claude", "systemdox");
+}
+function credentialsPath() {
+  return join(systemdoxDir(), "credentials.json");
+}
+function workspaceDir(workspace) {
+  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
+  return join(systemdoxDir(), workspace);
+}
+function statePath(workspace) {
+  return join(workspaceDir(workspace), "state.json");
+}
+function pluginRoot(workspace) {
+  return join(workspaceDir(workspace), "plugin");
+}
+function pluginDir(workspace, version) {
+  return join(pluginRoot(workspace), String(version));
+}
+async function readJson(path, empty) {
+  let text;
+  try {
+    text = await readFile(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return empty;
+    throw e;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`${path} is not valid JSON: fix or remove it, then run this again`);
+  }
+}
+async function writeJsonAtomically(path, value, mode) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  await writeFile(tmp, JSON.stringify(value, null, 2) + "\n", mode === void 0 ? "utf8" : { encoding: "utf8", mode });
+  await rename(tmp, path);
+}
+async function readCredentials() {
+  return readJson(credentialsPath(), {});
+}
+var run = promisify(execFile);
+async function apiKeyFor(workspace, env = process.env) {
+  if (env.SYSTEMDOX_API_KEY) return env.SYSTEMDOX_API_KEY;
+  const entry = (await readCredentials())[workspace];
+  return typeof entry?.apiKey === "string" && entry.apiKey ? entry.apiKey : void 0;
+}
+function apiUrlFrom(env = process.env) {
+  return requireHttpsApiUrl(env.SYSTEMDOX_API_URL || API_URL_DEFAULT);
+}
+async function readState(workspace) {
+  return readJson(statePath(workspace), {});
+}
+async function writeState(workspace, state) {
+  await writeJsonAtomically(statePath(workspace), state);
+}
+async function updateState(workspace, change) {
+  const state = await readState(workspace);
+  change(state);
+  await writeState(workspace, state);
+  return state;
+}
+async function removeFolder(path) {
+  await rm(path, { recursive: true, force: true });
+}
+
+// src/plugin-path.ts
+var PLUGIN_PATH_USAGE = "Usage: systemdox-mcp-server plugin-path <workspace> --version <n> --sha256 <hash>";
+var MAX_UNPACKED_BYTES = 20 * 1024 * 1024;
+var SHA256_RE = /^[0-9a-f]{64}$/;
+function parsePluginPathArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--version" || a === "--sha256") {
+      const value = argv[++i];
+      if (!value) throw new Error(`${a} needs a value
+${PLUGIN_PATH_USAGE}`);
+      if (a === "--sha256") {
+        if (!SHA256_RE.test(value)) throw new Error(`--sha256 must be 64 lowercase hex characters, got ${value}`);
+        args.sha256 = value;
+      } else if (/^[1-9]\d{0,8}$/.test(value)) args.version = Number(value);
+      else throw new Error(`--version must be a whole number, got ${value}`);
+    } else if (a.startsWith("-")) throw new Error(`Unknown option ${a}
+${PLUGIN_PATH_USAGE}`);
+    else if (!args.workspace) args.workspace = a;
+    else throw new Error(`Unexpected argument ${a}
+${PLUGIN_PATH_USAGE}`);
+  }
+  if (!args.workspace || !args.version || !args.sha256) throw new Error(PLUGIN_PATH_USAGE);
+  if (!isWorkspace(args.workspace)) throw new Error(`${args.workspace} is not a workspace name`);
+  return args;
+}
+var PluginRefused = class extends Error {
+};
+var EOCD = 101010256;
+var CENTRAL = 33639248;
+var LOCAL = 67324752;
+var S_IFMT = 61440;
+var S_IFLNK = 40960;
+var S_IFDIR = 16384;
+var S_IFREG = 32768;
+function refuse(name, why) {
+  throw new PluginRefused(`refused the plugin entry ${JSON.stringify(name)}: it ${why}. Nothing was unpacked.`);
+}
+function readZipEntries(zip) {
+  let eocd = -1;
+  for (let i = zip.length - 22; i >= Math.max(0, zip.length - 22 - 65535); i--) {
+    if (zip.readUInt32LE(i) === EOCD) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd < 0) throw new PluginRefused("the download is not a zip. Nothing was unpacked.");
+  const count = zip.readUInt16LE(eocd + 10);
+  let at = zip.readUInt32LE(eocd + 16);
+  if (count === 65535 || at === 4294967295) throw new PluginRefused("the zip is a ZIP64 archive, which a plugin never is. Nothing was unpacked.");
+  const entries = [];
+  let total = 0;
+  for (let n = 0; n < count; n++) {
+    if (at + 46 > zip.length || zip.readUInt32LE(at) !== CENTRAL) {
+      throw new PluginRefused("the zip's directory is damaged. Nothing was unpacked.");
+    }
+    const madeBy = zip.readUInt16LE(at + 4);
+    const flags = zip.readUInt16LE(at + 8);
+    const method = zip.readUInt16LE(at + 10);
+    const compressedSize = zip.readUInt32LE(at + 20);
+    const size = zip.readUInt32LE(at + 24);
+    const nameLength = zip.readUInt16LE(at + 28);
+    const extraLength = zip.readUInt16LE(at + 30);
+    const commentLength = zip.readUInt16LE(at + 32);
+    const external = zip.readUInt32LE(at + 38);
+    const offset = zip.readUInt32LE(at + 42);
+    const name = zip.subarray(at + 46, at + 46 + nameLength).toString(flags & 2048 ? "utf8" : "latin1");
+    at += 46 + nameLength + extraLength + commentLength;
+    const unixMode = madeBy >> 8 === 3 ? external >>> 16 : 0;
+    const segments = name.split(/[\\/]/);
+    if (!name || /^[\\/]/.test(name) || /^[A-Za-z]:/.test(name)) refuse(name, "is absolute");
+    if (segments.includes("..")) refuse(name, "climbs out of the plugin folder (..)");
+    if (name.includes(":") || name.includes("\0")) refuse(name, "is not a plain relative path");
+    if ((unixMode & S_IFMT) === S_IFLNK) refuse(name, "is a link");
+    const directory = name.endsWith("/") || (unixMode & S_IFMT) === S_IFDIR;
+    if (!directory && unixMode && (unixMode & S_IFMT) !== S_IFREG) refuse(name, "is not a regular file");
+    if (flags & 1) refuse(name, "is encrypted");
+    if (!directory && method !== 0 && method !== 8) refuse(name, `uses compression method ${method}`);
+    total += size;
+    if (total > MAX_UNPACKED_BYTES) refuse(name, `takes the unpacked size past ${MAX_UNPACKED_BYTES} bytes`);
+    entries.push({ name, directory, mode: unixMode ? unixMode & 511 : void 0, method, compressedSize, size, offset });
+  }
+  return entries;
+}
+function entryData(zip, entry) {
+  const at = entry.offset;
+  if (at + 30 > zip.length || zip.readUInt32LE(at) !== LOCAL) refuse(entry.name, "has a damaged header");
+  const start = at + 30 + zip.readUInt16LE(at + 26) + zip.readUInt16LE(at + 28);
+  const raw = zip.subarray(start, start + entry.compressedSize);
+  let data;
+  try {
+    data = entry.method === 0 ? raw : inflateRawSync(raw, { maxOutputLength: Math.max(1, entry.size) + 1 });
+  } catch (e) {
+    refuse(entry.name, `cannot be unpacked (${e.message})`);
+  }
+  if (data.length !== entry.size) refuse(entry.name, "unpacks to a size other than the one it declares");
+  return data;
+}
+async function unpackZip(zip, dest) {
+  const entries = readZipEntries(zip);
+  const root = resolve(dest);
+  const targets = entries.map((e) => {
+    const full = resolve(root, ...e.name.split(/[\\/]/).filter(Boolean));
+    if (full !== root && !full.startsWith(root + sep)) refuse(e.name, "climbs out of the plugin folder");
+    return full;
+  });
+  const data = entries.map((e) => e.directory ? void 0 : entryData(zip, e));
+  await mkdir2(root, { recursive: true });
+  for (const [i, entry] of entries.entries()) {
+    if (entry.directory) {
+      await mkdir2(targets[i], { recursive: true });
+      continue;
+    }
+    await mkdir2(dirname2(targets[i]), { recursive: true });
+    await writeFile2(targets[i], data[i], { mode: entry.mode ?? 420 });
+  }
+  return entries.filter((e) => !e.directory).length;
+}
+async function runPluginPath(argv, io) {
+  let args;
+  try {
+    args = parsePluginPathArgs(argv);
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  const { workspace, version, sha256 } = args;
+  const folder = pluginDir(workspace, version);
+  try {
+    const state = await readState(workspace);
+    if (existsSync(folder) && state.plugin?.[String(version)]?.sha256 === sha256) {
+      io.out(folder);
+      return 0;
+    }
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  let client = io.client;
+  if (!client) {
+    try {
+      const apiUrl = apiUrlFrom();
+      const apiKey = await apiKeyFor(workspace);
+      if (!apiKey) {
+        io.err(
+          `No SystemDox key for ${workspace}. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup, then run this again.`
+        );
+        return 1;
+      }
+      client = new SystemDoxApiClient({ apiKey, apiUrl, cacheTtlMs: 0, defaultOrg: void 0 });
+    } catch (e) {
+      io.err(e.message);
+      return 1;
+    }
+  }
+  let zip;
+  try {
+    ({ bytes: zip } = await client.getPluginZip(workspace, version));
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  const got = createHash("sha256").update(zip).digest("hex");
+  if (got !== sha256) {
+    io.err(
+      `The download of ${workspace}'s team plugin version ${version} has SHA-256 ${got}, not the ${sha256} Claude Code named. Nothing was unpacked.`
+    );
+    return 2;
+  }
+  const tmp = join2(pluginRoot(workspace), `.${version}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
+  try {
+    await unpackZip(zip, tmp);
+    if (existsSync(folder) && (await readState(workspace)).plugin?.[String(version)]?.sha256 === sha256) {
+      await removeFolder(tmp);
+    } else {
+      if (existsSync(folder)) await removeFolder(folder);
+      try {
+        await rename2(tmp, folder);
+      } catch (e) {
+        if (!existsSync(folder)) throw e;
+        await removeFolder(tmp);
+      }
+    }
+    await updateState(workspace, (state) => {
+      state.plugin = { ...state.plugin, [String(version)]: { sha256, installedAt: (/* @__PURE__ */ new Date()).toISOString() } };
+    });
+  } catch (e) {
+    await removeFolder(tmp);
+    io.err(e.message);
+    return e instanceof PluginRefused ? 2 : 1;
+  }
+  io.err(`Unpacked ${workspace}'s team plugin version ${version}.`);
+  io.out(folder);
+  return 0;
+}
+export {
+  MAX_UNPACKED_BYTES,
+  PLUGIN_PATH_USAGE,
+  PluginRefused,
+  parsePluginPathArgs,
+  readZipEntries,
+  runPluginPath,
+  unpackZip
+};

package/dist/tools/skills.js

@@ -77,18 +77,9 @@ async function walk(root, { skipHidden }, dir = root, out = { files: [], links:
   out.files.sort();
   return out;
 }
-async function readSkillDirectory(directory) {
-  const root = resolve(directory);
-  if (!existsSync(join(root, ENTRY_FILE))) {
-    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
-  }
-  const walked = await walk(root, { skipHidden: true });
-  if (walked.links.length) {
-    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
-  }
-  const paths = walked.files;
+async function readTextFiles(root, paths, what) {
   if (paths.length > MAX_FILES) {
-    throw new Error(`${root} holds ${paths.length} files: a skill holds at most ${MAX_FILES}`);
+    throw new Error(`${root} holds ${paths.length} files: ${what} holds at most ${MAX_FILES}`);
   }
   const decoder = new TextDecoder("utf-8", { fatal: true });
   const files = [];
@@ -98,7 +89,7 @@ async function readSkillDirectory(directory) {
       throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
     }
     const raw = await readFile(join(root, ...path.split("/")));
-    if (raw.includes(0)) throw new Error(`${path} is binary: a skill holds text files only`);
+    if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
     if (raw.length > MAX_FILE_BYTES) {
       throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
     }
@@ -114,6 +105,18 @@ async function readSkillDirectory(directory) {
     }
     files.push({ path, content });
   }
+  return files;
+}
+async function readSkillDirectory(directory) {
+  const root = resolve(directory);
+  if (!existsSync(join(root, ENTRY_FILE))) {
+    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
+  }
+  const walked = await walk(root, { skipHidden: true });
+  if (walked.links.length) {
+    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
+  }
+  const files = await readTextFiles(root, walked.files, "a skill");
   const skillMd = files.find((f) => f.path === ENTRY_FILE);
   const name = frontmatterName(skillMd.content);
   if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);

package/dist/tools/team-setup.d.ts

@@ -0,0 +1,33 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { SystemDoxApiClient } from "../lib/api-client.js";
+import { type FileIn, type PartName } from "../lib/team-setup-types.js";
+/**
+ * The team setup over MCP (ADR-217 with Amendments 1 and 2,
+ * specs/changes/team-setup/contract.md):
+ *
+ * - `publish_setup_part` publishes one part of the team setup (hooks, MCP
+ *   servers, agents, commands, instructions), with publish_skill's reading
+ *   rules: the local server reads the folder itself, only the paths the part
+ *   accepts, and refuses a link, a binary file or a file past ADR-216's limits
+ *   before anything is sent; the hosted server takes `files`.
+ * - `resolve_person` reads back a person a memory names by token, for this
+ *   session only. It writes nothing and keeps nothing.
+ *
+ * Both act on the key's own workspace, which `GET /team-setup` names.
+ */
+type Client = Pick<SystemDoxApiClient, "getOwnTeamSetup" | "publishPartVersion" | "resolvePerson">;
+/**
+ * Read the files `part` accepts from `directory`, and nothing else. A link on
+ * the way to one of them (the file, its folder, anything inside a folder read
+ * whole) stops the read before any file is read. Returns the files and what
+ * was left out inside the folders read (hidden files, and files that are not
+ * `*.md` where only those are accepted).
+ */
+export declare function readPartDirectory(part: PartName, directory: string): Promise<{
+    files: FileIn[];
+    leftOut: string[];
+}>;
+export declare function registerTeamSetupTools(server: McpServer, apiClient: Client, { localFiles }: {
+    localFiles: boolean;
+}): void;
+export {};