@thothica/docs-cli 1.0.0

package/README.md

@@ -0,0 +1,90 @@
+# @thothica/docs-cli (`thd`)
+
+Command-line tool and MCP server for [Thothica Docs](https://docs.thothica.com).
+Log in without pasting a key, then read, create, edit, and comment on native
+`.docx` documents from the terminal or an AI agent.
+
+Zero runtime dependencies. Node >= 18.
+
+## Install
+
+```bash
+npm install -g @thothica/docs-cli
+# or from the repo:  npm install -g ./cli
+# or run without installing:  npx @thothica/docs-cli <command>
+```
+
+## Log in
+
+```bash
+thd login
+```
+
+This starts a device-authorization flow: it opens the browser, the user signs in
+and approves, and a key is minted and stored in the operating system keychain.
+No key is ever pasted or printed.
+
+Where the key is stored:
+
+- macOS: the login keychain (via `security`)
+- Linux: the Secret Service / libsecret (via `secret-tool`), if present
+- Windows: DPAPI, encrypted per user
+- Fallback (no keychain): a machine-bound AES-256-GCM encrypted file at
+  `~/.config/thothica-docs/`, mode `0600`. Never plaintext.
+
+For CI or headless use, set `THOTHICA_DOCS_TOKEN` instead of logging in.
+
+## Commands
+
+```
+thd login [--client-name NAME] [--no-open]   Log in via the browser
+thd logout                                   Remove the stored credential
+thd whoami                                   Show the signed-in account
+
+thd doc ls [-q QUERY] [--shared] [--json]    List / search documents
+thd doc new "Title" [--md FILE|-]            Create (markdown body, or --template ID)
+thd doc cat ID [--text]                      Print content (markdown by default)
+thd doc get ID [-o FILE]                     Download the real .docx
+thd doc set ID --md FILE|-                   Replace content from markdown
+thd doc rm ID [--permanent]                  Trash (or delete) a document
+
+thd comment ls ID                            List comments inside the document
+thd comment add ID "text" [--anchor "..."]   Add a comment (optional --reply-to ID)
+
+thd templates                                List document templates
+thd open [ID]                                Open the app (or a document) in the browser
+thd mcp                                       Run the MCP server (for AI agents) over stdio
+```
+
+Global flags: `--origin URL` (target another deployment), `--json` (machine
+output). Environment: `THOTHICA_DOCS_TOKEN`, `THOTHICA_DOCS_ORIGIN`.
+
+## MCP server
+
+`thd mcp` speaks the Model Context Protocol over stdio, exposing documents as
+tools for AI agents. See [AGENTS.md](../AGENTS.md) for per-client configuration
+(Claude Code, Cursor, Codex, opencode). The server reads the credential stored by
+`thd login`, or `THOTHICA_DOCS_TOKEN`.
+
+## Examples
+
+```bash
+# create a document from a markdown file
+thd doc new "Q3 plan" --md plan.md
+
+# pipe markdown in
+echo "# Notes\n\n- one\n- two" | thd doc new "Notes" --md -
+
+# read it back as markdown
+thd doc cat DOC_ID
+
+# comment on a phrase
+thd comment add DOC_ID "Please expand this." --anchor "next quarter"
+
+# download the .docx
+thd doc get DOC_ID -o q3-plan.docx
+```
+
+## License
+
+AGPL-3.0.

package/bin/thd.mjs

@@ -0,0 +1,374 @@
+#!/usr/bin/env node
+// Thothica Docs CLI (`thd`). Log in without pasting a key, then read, create,
+// edit, and comment on documents from the terminal or an AI agent. Ships an MCP
+// server (`thd mcp`). Zero dependencies; Node >= 18.
+import { readFileSync, writeFileSync } from "node:fs";
+import {
+  DEFAULT_ORIGIN,
+  CLI_VERSION,
+  resolveOrigin,
+  loadToken,
+  saveToken,
+  deleteToken,
+  describeStore,
+  deviceLogin,
+  tryOpenBrowser,
+  api,
+  ApiError,
+} from "../lib/core.mjs";
+import { runMcpServer } from "../lib/mcp.mjs";
+
+// ---- tiny output helpers ----
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const c = (code, s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : s);
+const bold = (s) => c("1", s);
+const dim = (s) => c("2", s);
+const green = (s) => c("32", s);
+const red = (s) => c("31", s);
+const gold = (s) => c("33", s);
+const cyan = (s) => c("36", s);
+const out = (s = "") => process.stdout.write(s + "\n");
+const eout = (s = "") => process.stderr.write(s + "\n");
+function die(msg) {
+  eout(red("error: ") + msg);
+  process.exit(1);
+}
+
+// ---- arg parsing ----
+const BOOLEANS = new Set([
+  "json",
+  "shared",
+  "permanent",
+  "markdown",
+  "text",
+  "force",
+  "no-open",
+  "help",
+  "version",
+  "quiet",
+]);
+const ALIASES = { q: "query", o: "out", h: "help", v: "version", m: "md" };
+
+// A token is a flag value unless it is another option. A bare "-" (stdin) is a
+// value, and a lone negative number ("-5") is a value; "--x"/"-x" are options.
+function isValue(tok) {
+  if (tok === "-") return true;
+  if (!tok.startsWith("-")) return true;
+  return /^-\d/.test(tok);
+}
+
+function parseArgs(argv) {
+  const res = { _: [], flags: {} };
+  for (let i = 0; i < argv.length; i++) {
+    let a = argv[i];
+    if (a.startsWith("--")) {
+      let key = a.slice(2);
+      let val;
+      const eq = key.indexOf("=");
+      if (eq >= 0) {
+        val = key.slice(eq + 1);
+        key = key.slice(0, eq);
+      }
+      if (BOOLEANS.has(key)) {
+        res.flags[key] = true;
+      } else if (val !== undefined) {
+        res.flags[key] = val;
+      } else if (i + 1 < argv.length && isValue(argv[i + 1])) {
+        res.flags[key] = argv[++i];
+      } else {
+        res.flags[key] = true;
+      }
+    } else if (a.startsWith("-") && a.length > 1) {
+      const short = a.slice(1);
+      const key = ALIASES[short] || short;
+      if (BOOLEANS.has(key)) res.flags[key] = true;
+      else if (i + 1 < argv.length && isValue(argv[i + 1])) res.flags[key] = argv[++i];
+      else res.flags[key] = true;
+    } else {
+      res._.push(a);
+    }
+  }
+  return res;
+}
+
+function client(flags) {
+  const origin = resolveOrigin(flags.origin);
+  const token = loadToken(origin);
+  return { origin, token };
+}
+function requireToken(flags) {
+  const { origin, token } = client(flags);
+  if (!token)
+    die(`not logged in. Run ${bold("thd login")} first, or set THOTHICA_DOCS_TOKEN.`);
+  return { origin, token };
+}
+async function call(origin, token, method, path, opts) {
+  try {
+    return await api(origin, token, method, path, opts);
+  } catch (e) {
+    if (e instanceof ApiError) {
+      if (e.status === 401) die("unauthorized. Your key may be revoked; run `thd login` again.");
+      const extra = e.body?.hint || e.body?.detail;
+      die(`request failed: ${e.code || e.status}${extra ? `\n  ${extra}` : ""}`);
+    }
+    die(String(e?.message || e));
+  }
+}
+function readInput(spec) {
+  // spec is a filename, or "-" for stdin
+  if (spec === "-" || spec === "/dev/stdin") return readFileSync(0, "utf8");
+  return readFileSync(spec, "utf8");
+}
+
+// ---------------------------------------------------------------------------
+// Commands
+// ---------------------------------------------------------------------------
+
+async function cmdLogin(flags) {
+  const origin = resolveOrigin(flags.origin);
+  const clientName = flags["client-name"] || "Thothica Docs CLI";
+  eout(dim(`Signing in to ${origin} ...`));
+  const key = await deviceLogin(origin, clientName, ({ userCode, url }) => {
+    out("");
+    out(`  ${bold("To authorize, open:")}  ${cyan(url)}`);
+    out(`  ${bold("Your code:")}  ${gold(userCode)}`);
+    out("");
+    out(dim("  Sign in (if needed) and approve. Waiting..."));
+    if (!flags["no-open"]) tryOpenBrowser(url);
+  }).catch((e) => die(e.message));
+  const store = saveToken(origin, key);
+  // confirm the key works
+  const me = await call(origin, key, "GET", "/me");
+  out("");
+  out(green("✓ Logged in") + ` as ${bold(me.name || me.email)} <${me.email}>`);
+  out(dim(`  Key stored in: ${store}`));
+  out(dim(`  Origin: ${origin}`));
+}
+
+function cmdLogout(flags) {
+  const origin = resolveOrigin(flags.origin);
+  deleteToken(origin);
+  out(green("✓ Logged out.") + dim(" Local credential removed."));
+  out(dim("  (The key stays valid on the server until revoked in Settings → API keys.)"));
+}
+
+async function cmdWhoami(flags) {
+  const { origin, token } = requireToken(flags);
+  const me = await call(origin, token, "GET", "/me");
+  if (flags.json) return out(JSON.stringify(me, null, 2));
+  out(`${bold(me.name || me.email)}  <${me.email}>`);
+  out(dim(`  auth:     ${me.via}`));
+  out(dim(`  docs:     ${me.documents}`));
+  out(dim(`  storage:  ${(me.storageBytes / 1024).toFixed(1)} KB`));
+  out(dim(`  origin:   ${origin}`));
+  out(dim(`  key from: ${describeStore(origin)}`));
+}
+
+async function cmdDoc(flags, sub, rest) {
+  const { origin, token } = requireToken(flags);
+  switch (sub) {
+    case "ls":
+    case "list": {
+      const p = new URLSearchParams();
+      if (flags.query) p.set("q", flags.query);
+      if (flags.folder) p.set("folder", flags.folder);
+      if (flags.tag) p.set("tag", flags.tag);
+      if (flags.shared) p.set("shared", "1");
+      p.set("limit", String(flags.limit || 50));
+      const res = await call(origin, token, "GET", `/documents?${p.toString()}`);
+      if (flags.json) return out(JSON.stringify(res.documents, null, 2));
+      const docs = res.documents || [];
+      if (!docs.length) return out(dim("No documents."));
+      for (const d of docs) {
+        out(`${bold(d.id)}  ${d.title}`);
+        out(dim(`    v${d.version} · ${d.role} · ${new Date(d.updatedAt).toISOString().slice(0, 10)}`));
+      }
+      return;
+    }
+    case "new":
+    case "create": {
+      const title = rest[0];
+      if (!title) die("usage: thd doc new \"Title\" [--md file|-] [--template id] [--folder id]");
+      const body = { title };
+      if (flags.md) body.markdown = readInput(flags.md);
+      if (flags.template) body.template = flags.template;
+      if (flags.folder) body.folderId = flags.folder;
+      const doc = await call(origin, token, "POST", "/documents", { body });
+      if (flags.json) return out(JSON.stringify(doc, null, 2));
+      out(green("✓ Created ") + bold(doc.title));
+      out(`  id:  ${doc.id}`);
+      out(`  url: ${cyan(`${origin}/doc/${doc.id}`)}`);
+      return;
+    }
+    case "cat":
+    case "read": {
+      const id = rest[0];
+      if (!id) die("usage: thd doc cat ID [--markdown|--text]");
+      const fmt = flags.text ? "text" : "markdown";
+      const res = await call(origin, token, "GET", `/documents/${encodeURIComponent(id)}/text?format=${fmt}`);
+      return out(res.markdown ?? res.text ?? "");
+    }
+    case "get":
+    case "download": {
+      const id = rest[0];
+      if (!id) die("usage: thd doc get ID [-o file.docx]");
+      const meta = await call(origin, token, "GET", `/documents/${encodeURIComponent(id)}`);
+      const res = await api(origin, token, "GET", `/documents/${encodeURIComponent(id)}/content`, { raw: true });
+      if (!res.ok) die(`download failed (${res.status}).`);
+      const buf = Buffer.from(await res.arrayBuffer());
+      const file = flags.out || `${meta.title.replace(/[\\/:*?"<>|]/g, "_")}.docx`;
+      writeFileSync(file, buf);
+      out(green("✓ Saved ") + `${file} ${dim(`(${buf.length} bytes)`)}`);
+      return;
+    }
+    case "set":
+    case "update": {
+      const id = rest[0];
+      if (!id || !flags.md) die("usage: thd doc set ID --md file|- [--force]");
+      const md = readInput(flags.md);
+      const q = flags.force ? "?force=1" : "";
+      const res = await call(
+        origin,
+        token,
+        "PUT",
+        `/documents/${encodeURIComponent(id)}/content${q}`,
+        { body: md, headers: { "Content-Type": "text/markdown" } }
+      );
+      out(green("✓ Saved ") + dim(`version ${res.version}`));
+      return;
+    }
+    case "rm":
+    case "delete": {
+      const id = rest[0];
+      if (!id) die("usage: thd doc rm ID [--permanent]");
+      const q = flags.permanent ? "?permanent=1" : "";
+      await call(origin, token, "DELETE", `/documents/${encodeURIComponent(id)}${q}`);
+      out(green(flags.permanent ? "✓ Deleted permanently." : "✓ Moved to trash."));
+      return;
+    }
+    default:
+      die(`unknown doc subcommand: ${sub || "(none)"}. Try: ls, new, cat, get, set, rm`);
+  }
+}
+
+async function cmdComment(flags, sub, rest) {
+  const { origin, token } = requireToken(flags);
+  const id = rest[0];
+  if (sub === "ls" || sub === "list") {
+    if (!id) die("usage: thd comment ls ID");
+    const res = await call(origin, token, "GET", `/documents/${encodeURIComponent(id)}/comments`);
+    if (flags.json) return out(JSON.stringify(res.comments, null, 2));
+    const comments = res.comments || [];
+    if (!comments.length) return out(dim("No comments."));
+    for (const cm of comments) {
+      const meta = [cm.parentId ? `reply→${cm.parentId}` : null, cm.done ? "resolved" : null]
+        .filter(Boolean)
+        .join(", ");
+      out(`${bold(`[${cm.id}]`)} ${cm.author}${meta ? dim(` (${meta})`) : ""}`);
+      out(`    ${cm.text}`);
+    }
+    return;
+  }
+  if (sub === "add") {
+    const text = rest[1];
+    if (!id || !text) die('usage: thd comment add ID "text" [--anchor "text"] [--reply-to ID]');
+    const body = { text };
+    if (flags.anchor) body.anchor = flags.anchor;
+    if (flags["reply-to"]) body.replyTo = flags["reply-to"];
+    const res = await call(origin, token, "POST", `/documents/${encodeURIComponent(id)}/comments`, { body });
+    out(green("✓ Comment added ") + dim(`(id ${res.comment?.id ?? "?"}, version ${res.version})`));
+    return;
+  }
+  die("usage: thd comment ls|add ...");
+}
+
+async function cmdTemplates(flags) {
+  const { origin, token } = requireToken(flags);
+  const res = await call(origin, token, "GET", "/templates");
+  if (flags.json) return out(JSON.stringify(res.templates, null, 2));
+  for (const t of res.templates || []) {
+    out(`${bold(t.id.padEnd(14))} ${t.name}`);
+    out(dim(`    ${t.description}`));
+  }
+}
+
+function cmdOpen(flags, rest) {
+  const origin = resolveOrigin(flags.origin);
+  const url = rest[0] ? `${origin}/doc/${rest[0]}` : origin;
+  tryOpenBrowser(url);
+  out(dim(`Opening ${url}`));
+}
+
+function helpText() {
+  return `${bold("thd")} ${dim("· Thothica Docs CLI v" + CLI_VERSION)}
+
+${bold("Access")}
+  thd login [--client-name NAME] [--no-open]   Log in via the browser (no key to paste)
+  thd logout                                   Remove the stored credential
+  thd whoami                                   Show the signed-in account
+
+${bold("Documents")}
+  thd doc ls [-q QUERY] [--shared] [--json]    List / search documents
+  thd doc new "Title" [--md FILE|-]            Create (markdown body, or --template ID)
+  thd doc cat ID [--text]                      Print content (markdown by default)
+  thd doc get ID [-o FILE]                     Download the real .docx
+  thd doc set ID --md FILE|- [--force]         Replace content from markdown
+  thd doc rm ID [--permanent]                  Trash (or delete) a document
+
+${bold("Comments")}
+  thd comment ls ID                            List comments inside the document
+  thd comment add ID "text" [--anchor "..."]   Add a comment (optional --reply-to ID)
+
+${bold("More")}
+  thd templates                                List document templates
+  thd open [ID]                                Open the app (or a document) in the browser
+  thd mcp                                       Run the MCP server (for AI agents) over stdio
+
+${bold("Global")}
+  --origin URL        Target a different deployment (default ${DEFAULT_ORIGIN})
+  --json              Machine-readable output where supported
+  Env: THOTHICA_DOCS_TOKEN (key override, for CI), THOTHICA_DOCS_ORIGIN
+
+Docs: ${DEFAULT_ORIGIN}/api   ·   ${DEFAULT_ORIGIN}/llms.txt`;
+}
+
+// ---------------------------------------------------------------------------
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const parsed = parseArgs(argv);
+  const [cmd, sub, ...rest] = parsed._;
+  const flags = parsed.flags;
+
+  if (flags.version || cmd === "version") return out(CLI_VERSION);
+  if (!cmd || cmd === "help" || flags.help) return out(helpText());
+
+  try {
+    switch (cmd) {
+      case "login":
+        return await cmdLogin(flags);
+      case "logout":
+        return cmdLogout(flags);
+      case "whoami":
+        return await cmdWhoami(flags);
+      case "doc":
+      case "docs":
+        return await cmdDoc(flags, sub, rest);
+      case "comment":
+      case "comments":
+        return await cmdComment(flags, sub, rest);
+      case "templates":
+        return await cmdTemplates(flags);
+      case "open":
+        return cmdOpen(flags, parsed._.slice(1));
+      case "mcp":
+        return await runMcpServer({ origin: flags.origin });
+      default:
+        die(`unknown command: ${cmd}. Run ${bold("thd help")}.`);
+    }
+  } catch (e) {
+    die(String(e?.message || e));
+  }
+}
+
+main();

package/lib/core.mjs

@@ -0,0 +1,403 @@
+// Core logic for the Thothica Docs CLI: configuration, secure credential
+// storage, the HTTP client, and the device-login flow. Zero runtime deps;
+// Node >= 18 (global fetch + WebCrypto). Secrets go to the OS keychain when
+// available, otherwise a machine-bound AES-256-GCM encrypted file (never
+// plaintext).
+import { spawnSync } from "node:child_process";
+import {
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  chmodSync,
+  rmSync,
+} from "node:fs";
+import { homedir, hostname, userInfo, platform } from "node:os";
+import { join } from "node:path";
+import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
+
+export const DEFAULT_ORIGIN = "https://docs.thothica.com";
+export const CLI_VERSION = "1.0.0";
+const SERVICE = "thothica-docs";
+
+// ---------------------------------------------------------------------------
+// Config
+// ---------------------------------------------------------------------------
+
+export function configDir() {
+  if (process.env.THOTHICA_DOCS_HOME) return process.env.THOTHICA_DOCS_HOME;
+  if (platform() === "win32") {
+    return join(process.env.APPDATA || join(homedir(), "AppData", "Roaming"), SERVICE);
+  }
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, SERVICE);
+}
+
+function ensureDir() {
+  const dir = configDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  return dir;
+}
+
+function statePath() {
+  return join(configDir(), "state.json");
+}
+
+function readState() {
+  try {
+    return JSON.parse(readFileSync(statePath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function writeState(state) {
+  ensureDir();
+  writeFileSync(statePath(), JSON.stringify(state, null, 2), { mode: 0o600 });
+  try {
+    chmodSync(statePath(), 0o600);
+  } catch {}
+}
+
+export function resolveOrigin(flagOrigin) {
+  const raw =
+    flagOrigin ||
+    process.env.THOTHICA_DOCS_ORIGIN ||
+    readState().origin ||
+    DEFAULT_ORIGIN;
+  return raw.replace(/\/+$/, "");
+}
+
+function accountFor(origin) {
+  try {
+    return new URL(origin).host;
+  } catch {
+    return origin;
+  }
+}
+
+function safeAccount(account) {
+  return account.replace(/[^a-zA-Z0-9._-]/g, "_") || "default";
+}
+
+// Some environments (containers, CI, locked-down machines) have no usable
+// keychain, or the user prefers a file. THOTHICA_DOCS_STORE=file forces the
+// machine-bound encrypted-file backend.
+function forceFile() {
+  return process.env.THOTHICA_DOCS_STORE === "file";
+}
+
+// ---------------------------------------------------------------------------
+// Credential storage: keychain backends + encrypted-file fallback
+// ---------------------------------------------------------------------------
+
+function run(cmd, args, input) {
+  try {
+    const res = spawnSync(cmd, args, {
+      input: input ?? undefined,
+      encoding: "utf8",
+    });
+    return { code: res.status ?? 1, stdout: res.stdout || "", stderr: res.stderr || "", err: res.error };
+  } catch (e) {
+    return { code: 1, stdout: "", stderr: String(e), err: e };
+  }
+}
+
+// -- macOS keychain --
+function macSet(account, secret) {
+  const r = run("security", [
+    "add-generic-password",
+    "-U",
+    "-a", account,
+    "-s", SERVICE,
+    "-D", "application password",
+    "-j", "Thothica Docs API key",
+    "-w", secret,
+  ]);
+  return r.code === 0;
+}
+function macGet(account) {
+  const r = run("security", ["find-generic-password", "-a", account, "-s", SERVICE, "-w"]);
+  return r.code === 0 ? r.stdout.replace(/\n$/, "") : null;
+}
+function macDelete(account) {
+  run("security", ["delete-generic-password", "-a", account, "-s", SERVICE]);
+}
+
+// -- Linux libsecret (secret-tool) -- reads the secret from stdin, not argv --
+function hasSecretTool() {
+  return run("secret-tool", ["--version"]).code === 0 || run("which", ["secret-tool"]).code === 0;
+}
+function linuxSet(account, secret) {
+  if (!hasSecretTool()) return false;
+  const r = run(
+    "secret-tool",
+    ["store", "--label=Thothica Docs", "service", SERVICE, "account", account],
+    secret
+  );
+  return r.code === 0;
+}
+function linuxGet(account) {
+  if (!hasSecretTool()) return null;
+  const r = run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+  return r.code === 0 && r.stdout ? r.stdout.replace(/\n$/, "") : null;
+}
+function linuxDelete(account) {
+  if (hasSecretTool()) run("secret-tool", ["clear", "service", SERVICE, "account", account]);
+}
+
+// -- Windows DPAPI (per-user) via PowerShell, stored to a per-account file --
+function winFile(account) {
+  return join(configDir(), `credential.${safeAccount(account)}.dpapi`);
+}
+function winSet(account, secret) {
+  ensureDir();
+  const path = winFile(account);
+  const script = `$s = [Console]::In.ReadToEnd(); $sec = ConvertTo-SecureString $s -AsPlainText -Force; ConvertFrom-SecureString $sec | Set-Content -NoNewline -Path '${path.replace(/'/g, "''")}'`;
+  const r = run("powershell", ["-NoProfile", "-Command", script], secret);
+  if (r.code === 0) {
+    try {
+      chmodSync(path, 0o600);
+    } catch {}
+    return true;
+  }
+  return false;
+}
+function winGet(account) {
+  const path = winFile(account);
+  if (!existsSync(path)) return null;
+  const script = `$enc = Get-Content -Raw -Path '${path.replace(/'/g, "''")}'; $sec = ConvertTo-SecureString $enc; [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec))`;
+  const r = run("powershell", ["-NoProfile", "-Command", script]);
+  return r.code === 0 && r.stdout ? r.stdout.replace(/\r?\n$/, "") : null;
+}
+function winDelete(account) {
+  const path = winFile(account);
+  if (existsSync(path)) rmSync(path, { force: true });
+}
+
+// -- Encrypted-file fallback: machine-bound AES-256-GCM, 0600 --
+function keyMaterialPath() {
+  return join(configDir(), "machine.key");
+}
+function encPath(account) {
+  return join(configDir(), `credentials.${safeAccount(account)}.enc`);
+}
+function machineKeyMaterial() {
+  ensureDir();
+  const p = keyMaterialPath();
+  if (!existsSync(p)) {
+    writeFileSync(p, randomBytes(32), { mode: 0o600 });
+    try {
+      chmodSync(p, 0o600);
+    } catch {}
+  }
+  return readFileSync(p);
+}
+function deriveKey(salt) {
+  const base = Buffer.concat([
+    Buffer.from(`${hostname()}::${userInfo().username}::${SERVICE}`),
+    machineKeyMaterial(),
+  ]);
+  return scryptSync(base, salt, 32);
+}
+function fileSet(account, secret) {
+  ensureDir();
+  const salt = randomBytes(16);
+  const iv = randomBytes(12);
+  const key = deriveKey(salt);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(Buffer.from(secret, "utf8")), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const payload = {
+    v: 1,
+    salt: salt.toString("base64"),
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64"),
+    ct: ct.toString("base64"),
+  };
+  const path = encPath(account);
+  writeFileSync(path, JSON.stringify(payload), { mode: 0o600 });
+  try {
+    chmodSync(path, 0o600);
+  } catch {}
+  return true;
+}
+function fileGet(account) {
+  const path = encPath(account);
+  if (!existsSync(path)) return null;
+  try {
+    const p = JSON.parse(readFileSync(path, "utf8"));
+    const key = deriveKey(Buffer.from(p.salt, "base64"));
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(p.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(p.tag, "base64"));
+    const pt = Buffer.concat([
+      decipher.update(Buffer.from(p.ct, "base64")),
+      decipher.final(),
+    ]);
+    return pt.toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function fileDelete(account) {
+  const path = encPath(account);
+  if (existsSync(path)) rmSync(path, { force: true });
+}
+
+function backends() {
+  const os = platform();
+  if (os === "darwin") return { name: "macOS keychain", set: macSet, get: macGet, del: macDelete };
+  if (os === "win32") return { name: "Windows DPAPI", set: winSet, get: winGet, del: winDelete };
+  if (os === "linux" && hasSecretTool())
+    return { name: "libsecret keychain", set: linuxSet, get: linuxGet, del: linuxDelete };
+  return null;
+}
+
+const FILE_BACKEND = {
+  name: "machine-bound encrypted file (AES-256-GCM, 0600)",
+  set: fileSet,
+  get: fileGet,
+  del: fileDelete,
+};
+
+/** Store a token securely. Returns the human name of the store used. */
+export function saveToken(origin, token) {
+  const account = accountFor(origin);
+  const primary = forceFile() ? null : backends();
+  let usedBackend = "file";
+  let storeName = FILE_BACKEND.name;
+  if (primary && primary.set(account, token)) {
+    usedBackend = "keychain";
+    storeName = primary.name;
+  } else {
+    FILE_BACKEND.set(account, token);
+  }
+  const state = readState();
+  state.origin = origin;
+  state.accounts = state.accounts || {};
+  state.accounts[account] = { backend: usedBackend, updatedAt: Date.now() };
+  writeState(state);
+  return storeName;
+}
+
+/** Resolve the active token: env override first, then stored credential. */
+export function loadToken(origin) {
+  if (process.env.THOTHICA_DOCS_TOKEN) return process.env.THOTHICA_DOCS_TOKEN.trim();
+  const account = accountFor(origin);
+  if (forceFile()) return FILE_BACKEND.get(account);
+  const state = readState();
+  const pref = state.accounts?.[account]?.backend;
+  const primary = backends();
+  if (pref === "file") return FILE_BACKEND.get(account);
+  if (primary) {
+    const v = primary.get(account);
+    if (v) return v;
+  }
+  return FILE_BACKEND.get(account);
+}
+
+export function deleteToken(origin) {
+  const account = accountFor(origin);
+  const primary = backends();
+  if (primary) primary.del(account);
+  FILE_BACKEND.del(account);
+  const state = readState();
+  if (state.accounts) delete state.accounts[account];
+  writeState(state);
+}
+
+/** Where the credential for this origin lives (for `whoami`). */
+export function describeStore(origin) {
+  if (process.env.THOTHICA_DOCS_TOKEN) return "THOTHICA_DOCS_TOKEN environment variable";
+  const account = accountFor(origin);
+  const pref = readState().accounts?.[account]?.backend;
+  if (pref === "keychain") return backends()?.name || "OS keychain";
+  if (pref === "file") return FILE_BACKEND.name;
+  return "not stored";
+}
+
+// ---------------------------------------------------------------------------
+// HTTP client
+// ---------------------------------------------------------------------------
+
+export class ApiError extends Error {
+  constructor(status, code, body) {
+    super(`${status} ${code || "error"}`);
+    this.status = status;
+    this.code = code;
+    this.body = body;
+  }
+}
+
+export async function api(origin, token, method, path, opts = {}) {
+  const url = `${origin.replace(/\/+$/, "")}/api/v1${path}`;
+  const headers = { ...(opts.headers || {}) };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
+  let body = opts.body;
+  if (body != null && typeof body === "object" && !(body instanceof Uint8Array) && !Buffer.isBuffer(body)) {
+    headers["Content-Type"] = headers["Content-Type"] || "application/json";
+    body = JSON.stringify(body);
+  }
+  const res = await fetch(url, { method, headers, body });
+  if (opts.raw) return res;
+  const text = await res.text();
+  let json = null;
+  try {
+    json = text ? JSON.parse(text) : null;
+  } catch {
+    json = { raw: text };
+  }
+  if (!res.ok) throw new ApiError(res.status, json?.error, json);
+  return json;
+}
+
+// ---------------------------------------------------------------------------
+// Device login flow
+// ---------------------------------------------------------------------------
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+export function tryOpenBrowser(url) {
+  const os = platform();
+  const cmd = os === "darwin" ? "open" : os === "win32" ? "cmd" : "xdg-open";
+  const args = os === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawnSync(cmd, args, { stdio: "ignore" });
+  } catch {}
+}
+
+/**
+ * Run the device-authorization flow. `onPrompt({ userCode, url })` is called
+ * once with what to show the user. Returns the minted API key.
+ */
+export async function deviceLogin(origin, clientName, onPrompt) {
+  const startRes = await fetch(`${origin}/api/v1/auth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientName }),
+  });
+  if (!startRes.ok) throw new Error(`Could not start login (${startRes.status}).`);
+  const start = await startRes.json();
+  if (onPrompt) onPrompt({ userCode: start.user_code, url: start.verification_uri_complete });
+  const deadline = Date.now() + (start.expires_in || 600) * 1000;
+  const interval = Math.max(2, start.interval || 5) * 1000;
+  while (Date.now() < deadline) {
+    await sleep(interval);
+    let j;
+    try {
+      const res = await fetch(`${origin}/api/v1/auth/device/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ device_code: start.device_code }),
+      });
+      j = await res.json();
+    } catch {
+      continue; // transient; keep polling
+    }
+    if (j.status === "approved" && j.key) return j.key;
+    if (j.status === "denied") throw new Error("Authorization was denied in the browser.");
+    if (j.status === "expired") throw new Error("The code expired. Run login again.");
+    // pending -> keep polling
+  }
+  throw new Error("Timed out waiting for approval.");
+}

package/lib/mcp.mjs

@@ -0,0 +1,446 @@
+// A zero-dependency MCP (Model Context Protocol) server over stdio. Exposes
+// Thothica Docs as first-class tools so an AI agent (Claude Code, Codex,
+// opencode, Cursor, ...) can read, create, edit, and comment on documents.
+// Newline-delimited JSON-RPC 2.0; nothing but protocol messages go to stdout.
+import { api, loadToken, resolveOrigin, ApiError, CLI_VERSION } from "./core.mjs";
+
+const PROTOCOL_VERSION = "2024-11-05";
+
+function log(...args) {
+  // Logs must never touch stdout (reserved for protocol messages).
+  process.stderr.write(`[thothica-docs mcp] ${args.join(" ")}\n`);
+}
+
+function ok(text) {
+  return { content: [{ type: "text", text }] };
+}
+function fail(text) {
+  return { content: [{ type: "text", text }], isError: true };
+}
+
+function pretty(obj) {
+  return JSON.stringify(obj, null, 2);
+}
+
+// A short, model-friendly view of a document record.
+function docLine(d) {
+  const tags = d.tags?.length ? `  [${d.tags.map((t) => t.name).join(", ")}]` : "";
+  return `${d.id}  "${d.title}"  (v${d.version}, ${d.role})${tags}`;
+}
+
+const TOOLS = [
+  {
+    name: "whoami",
+    description:
+      "Return the authenticated Thothica Docs account (email, name, document count, storage used). Use this first to confirm access.",
+    inputSchema: { type: "object", properties: {} },
+    async handler(_args, ctx) {
+      const me = await ctx.call("GET", "/me");
+      return ok(
+        `Signed in as ${me.name || me.email} <${me.email}> (auth: ${me.via}).\n` +
+          `Documents: ${me.documents}. Storage: ${(me.storageBytes / 1024).toFixed(1)} KB.`
+      );
+    },
+  },
+  {
+    name: "list_documents",
+    description:
+      "List or search the user's documents. Optional filters: query (title search), folder id, tag id, shared (docs shared with the user), limit.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "title search" },
+        folder: { type: "string", description: "folder id, or 'root'" },
+        tag: { type: "string", description: "tag id" },
+        shared: { type: "boolean", description: "only documents shared with me" },
+        limit: { type: "integer", description: "max results (default 50)" },
+      },
+    },
+    async handler(args, ctx) {
+      const p = new URLSearchParams();
+      if (args.query) p.set("q", args.query);
+      if (args.folder) p.set("folder", args.folder);
+      if (args.tag) p.set("tag", args.tag);
+      if (args.shared) p.set("shared", "1");
+      p.set("limit", String(args.limit || 50));
+      const res = await ctx.call("GET", `/documents?${p.toString()}`);
+      const docs = res.documents || [];
+      if (!docs.length) return ok("No documents found.");
+      return ok(`${docs.length} document(s):\n` + docs.map(docLine).join("\n"));
+    },
+  },
+  {
+    name: "search_documents",
+    description: "Search the user's documents by title. Shorthand for list_documents with a query.",
+    inputSchema: {
+      type: "object",
+      required: ["query"],
+      properties: { query: { type: "string" }, limit: { type: "integer" } },
+    },
+    async handler(args, ctx) {
+      const p = new URLSearchParams({ q: args.query, limit: String(args.limit || 50) });
+      const res = await ctx.call("GET", `/documents?${p.toString()}`);
+      const docs = res.documents || [];
+      if (!docs.length) return ok(`No documents match "${args.query}".`);
+      return ok(`${docs.length} match(es):\n` + docs.map(docLine).join("\n"));
+    },
+  },
+  {
+    name: "read_document",
+    description:
+      "Read a document's content as markdown (default) or plain text, so you can understand or edit it without parsing .docx.",
+    inputSchema: {
+      type: "object",
+      required: ["id"],
+      properties: {
+        id: { type: "string" },
+        format: { type: "string", enum: ["markdown", "text"], description: "default markdown" },
+      },
+    },
+    async handler(args, ctx) {
+      const fmt = args.format === "text" ? "text" : "markdown";
+      const res = await ctx.call("GET", `/documents/${encodeURIComponent(args.id)}/text?format=${fmt}`);
+      const content = res.markdown ?? res.text ?? "";
+      return ok(`# ${res.title} (v${res.version})\n\n${content || "(empty document)"}`);
+    },
+  },
+  {
+    name: "create_document",
+    description:
+      "Create a new document. Provide markdown for the body (headings, lists, bold/italic, quotes are rendered to real .docx), or a template id, or neither for a blank document.",
+    inputSchema: {
+      type: "object",
+      required: ["title"],
+      properties: {
+        title: { type: "string" },
+        markdown: { type: "string", description: "document body in markdown" },
+        template: { type: "string", description: "template id from list_templates" },
+        folderId: { type: "string" },
+      },
+    },
+    async handler(args, ctx) {
+      const body = { title: args.title };
+      if (args.markdown != null) body.markdown = args.markdown;
+      if (args.template) body.template = args.template;
+      if (args.folderId) body.folderId = args.folderId;
+      const doc = await ctx.call("POST", "/documents", body);
+      return ok(
+        `Created "${doc.title}".\nid: ${doc.id}\nversion: ${doc.version}\nurl: ${ctx.origin}/doc/${doc.id}`
+      );
+    },
+  },
+  {
+    name: "update_document",
+    description:
+      "Replace a document's content with new markdown (creates a new version). This rebuilds the whole document, so include the full intended content. It does NOT preserve existing comments or tracked changes: if the document has any, the call is refused unless you pass force:true.",
+    inputSchema: {
+      type: "object",
+      required: ["id", "markdown"],
+      properties: {
+        id: { type: "string" },
+        markdown: { type: "string" },
+        force: {
+          type: "boolean",
+          description: "proceed even though existing comments/tracked changes will be discarded",
+        },
+      },
+    },
+    async handler(args, ctx) {
+      const q = args.force ? "?force=1" : "";
+      const res = await ctx.call(
+        "PUT",
+        `/documents/${encodeURIComponent(args.id)}/content${q}`,
+        args.markdown,
+        { headers: { "Content-Type": "text/markdown" } }
+      );
+      return ok(`Saved. New version: ${res.version} (${res.size} bytes).`);
+    },
+  },
+  {
+    name: "rename_document",
+    description: "Rename a document (editor role).",
+    inputSchema: {
+      type: "object",
+      required: ["id", "title"],
+      properties: { id: { type: "string" }, title: { type: "string" } },
+    },
+    async handler(args, ctx) {
+      const doc = await ctx.call("PATCH", `/documents/${encodeURIComponent(args.id)}`, { title: args.title });
+      return ok(`Renamed to "${doc.title}".`);
+    },
+  },
+  {
+    name: "get_document_info",
+    description: "Get a document's metadata (owner, role, size, version, folder, tags, timestamps).",
+    inputSchema: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
+    async handler(args, ctx) {
+      const doc = await ctx.call("GET", `/documents/${encodeURIComponent(args.id)}`);
+      return ok(pretty(doc));
+    },
+  },
+  {
+    name: "list_comments",
+    description: "List comments living inside the document (threaded, with resolved state).",
+    inputSchema: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
+    async handler(args, ctx) {
+      const res = await ctx.call("GET", `/documents/${encodeURIComponent(args.id)}/comments`);
+      const comments = res.comments || [];
+      if (!comments.length) return ok("No comments.");
+      return ok(
+        comments
+          .map(
+            (c) =>
+              `[${c.id}]${c.parentId ? ` (reply to ${c.parentId})` : ""}${c.done ? " (resolved)" : ""} ${c.author}: ${c.text}`
+          )
+          .join("\n")
+      );
+    },
+  },
+  {
+    name: "add_comment",
+    description:
+      "Add a comment to a document. Anchor it to some existing text (recommended) or omit anchor to attach to the last paragraph. Set replyTo to a comment id for a threaded reply. Requires commenter role or higher.",
+    inputSchema: {
+      type: "object",
+      required: ["id", "text"],
+      properties: {
+        id: { type: "string" },
+        text: { type: "string" },
+        anchor: { type: "string", description: "existing text to attach the comment to" },
+        replyTo: { type: "string", description: "parent comment id" },
+      },
+    },
+    async handler(args, ctx) {
+      const body = { text: args.text };
+      if (args.anchor) body.anchor = args.anchor;
+      if (args.replyTo) body.replyTo = args.replyTo;
+      const res = await ctx.call("POST", `/documents/${encodeURIComponent(args.id)}/comments`, body);
+      return ok(`Comment added (id ${res.comment?.id ?? "?"}). Document is now version ${res.version}.`);
+    },
+  },
+  {
+    name: "list_suggestions",
+    description: "List tracked-change suggestions (insertions, deletions, formatting) inside the document.",
+    inputSchema: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
+    async handler(args, ctx) {
+      const res = await ctx.call("GET", `/documents/${encodeURIComponent(args.id)}/suggestions`);
+      const s = res.suggestions || [];
+      if (!s.length) return ok("No suggestions.");
+      return ok(s.map((x) => `${x.type} by ${x.author}: ${x.text}`).join("\n"));
+    },
+  },
+  {
+    name: "list_versions",
+    description: "List a document's version history.",
+    inputSchema: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
+    async handler(args, ctx) {
+      const res = await ctx.call("GET", `/documents/${encodeURIComponent(args.id)}/versions`);
+      const v = res.versions || [];
+      return ok(
+        v
+          .map(
+            (x) => `v${x.version}  ${x.size} bytes  ${x.authorName || "?"}${x.label ? `  (${x.label})` : ""}`
+          )
+          .join("\n") || "No versions."
+      );
+    },
+  },
+  {
+    name: "list_folders",
+    description: "List the user's folders.",
+    inputSchema: { type: "object", properties: {} },
+    async handler(_args, ctx) {
+      const res = await ctx.call("GET", "/folders");
+      const f = res.folders || [];
+      return ok(f.map((x) => `${x.id}  "${x.name}"${x.parentId ? ` (in ${x.parentId})` : ""}`).join("\n") || "No folders.");
+    },
+  },
+  {
+    name: "create_folder",
+    description: "Create a folder.",
+    inputSchema: {
+      type: "object",
+      required: ["name"],
+      properties: { name: { type: "string" }, parentId: { type: "string" } },
+    },
+    async handler(args, ctx) {
+      const f = await ctx.call("POST", "/folders", { name: args.name, parentId: args.parentId || null });
+      return ok(`Created folder "${f.name}" (id ${f.id}).`);
+    },
+  },
+  {
+    name: "list_templates",
+    description: "List document templates usable with create_document (template id).",
+    inputSchema: { type: "object", properties: {} },
+    async handler(_args, ctx) {
+      const res = await ctx.call("GET", "/templates");
+      return ok((res.templates || []).map((t) => `${t.id}  "${t.name}"  ${t.description}`).join("\n"));
+    },
+  },
+  {
+    name: "share_document",
+    description: "Share a document with a person by email and role (editor, commenter, or viewer). Owner only.",
+    inputSchema: {
+      type: "object",
+      required: ["id", "email", "role"],
+      properties: {
+        id: { type: "string" },
+        email: { type: "string" },
+        role: { type: "string", enum: ["editor", "commenter", "viewer"] },
+      },
+    },
+    async handler(args, ctx) {
+      await ctx.call("POST", `/documents/${encodeURIComponent(args.id)}/permissions`, {
+        email: args.email,
+        role: args.role,
+      });
+      return ok(`Shared with ${args.email} as ${args.role}.`);
+    },
+  },
+  {
+    name: "set_document_fonts",
+    description:
+      "Set the document-wide heading and/or body font (any Google font family name). Rewrites the Word styles; creates a new version.",
+    inputSchema: {
+      type: "object",
+      required: ["id"],
+      properties: {
+        id: { type: "string" },
+        headingFont: { type: "string" },
+        bodyFont: { type: "string" },
+      },
+    },
+    async handler(args, ctx) {
+      const body = {};
+      if (args.headingFont) body.headingFont = args.headingFont;
+      if (args.bodyFont) body.bodyFont = args.bodyFont;
+      const res = await ctx.call("POST", `/documents/${encodeURIComponent(args.id)}/theme`, body);
+      return ok(`Fonts updated. New version: ${res.version}.`);
+    },
+  },
+  {
+    name: "document_url",
+    description: "Get the browser URL where a document can be opened and edited by a human.",
+    inputSchema: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
+    async handler(args, ctx) {
+      return ok(`${ctx.origin}/doc/${args.id}`);
+    },
+  },
+];
+
+const TOOL_BY_NAME = new Map(TOOLS.map((t) => [t.name, t]));
+
+export async function runMcpServer(opts = {}) {
+  const origin = resolveOrigin(opts.origin);
+  const token = loadToken(origin);
+  if (!token) {
+    log("No credential found. Tools will report an auth error. Run `thd login` or set THOTHICA_DOCS_TOKEN.");
+  }
+
+  const ctx = {
+    origin,
+    async call(method, path, body, extra = {}) {
+      if (!token) {
+        throw new Error(
+          "Not authenticated with Thothica Docs. Run `thd login` in a terminal, or set THOTHICA_DOCS_TOKEN."
+        );
+      }
+      return api(origin, token, method, path, { body, ...extra });
+    },
+  };
+
+  function send(msg) {
+    process.stdout.write(JSON.stringify(msg) + "\n");
+  }
+  function respond(id, result) {
+    send({ jsonrpc: "2.0", id, result });
+  }
+  function respondError(id, code, message) {
+    send({ jsonrpc: "2.0", id, error: { code, message } });
+  }
+
+  async function handle(msg) {
+    const { id, method, params } = msg;
+    const isRequest = id !== undefined && id !== null;
+    if (method === "initialize") {
+      respond(id, {
+        protocolVersion: params?.protocolVersion || PROTOCOL_VERSION,
+        capabilities: { tools: { listChanged: false } },
+        serverInfo: { name: "thothica-docs", version: CLI_VERSION },
+      });
+      return;
+    }
+    if (method === "notifications/initialized" || method === "initialized") return; // notification
+    if (method === "ping") {
+      if (isRequest) respond(id, {});
+      return;
+    }
+    if (method === "tools/list") {
+      respond(id, {
+        tools: TOOLS.map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema,
+        })),
+      });
+      return;
+    }
+    if (method === "tools/call") {
+      const tool = TOOL_BY_NAME.get(params?.name);
+      if (!tool) {
+        respond(id, fail(`Unknown tool: ${params?.name}`));
+        return;
+      }
+      try {
+        const result = await tool.handler(params.arguments || {}, ctx);
+        respond(id, result);
+      } catch (e) {
+        const extra = e instanceof ApiError ? e.body?.hint || e.body?.detail : null;
+        const msg =
+          e instanceof ApiError
+            ? `API error ${e.status}: ${e.code || "error"}${extra ? ` (${extra})` : ""}`
+            : String(e?.message || e);
+        respond(id, fail(msg));
+      }
+      return;
+    }
+    if (isRequest) respondError(id, -32601, `Method not found: ${method}`);
+  }
+
+  // Read newline-delimited JSON-RPC from stdin. Track in-flight handlers so a
+  // closed stdin (e.g. a batch pipe) does not drop pending async responses.
+  let buffer = "";
+  let pending = 0;
+  let ended = false;
+  const maybeExit = () => {
+    if (ended && pending === 0) process.exit(0);
+  };
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => {
+    buffer += chunk;
+    let nl;
+    while ((nl = buffer.indexOf("\n")) >= 0) {
+      const line = buffer.slice(0, nl).trim();
+      buffer = buffer.slice(nl + 1);
+      if (!line) continue;
+      let msg;
+      try {
+        msg = JSON.parse(line);
+      } catch {
+        continue; // ignore non-JSON noise
+      }
+      pending++;
+      handle(msg)
+        .catch((e) => log("handler error:", String(e)))
+        .finally(() => {
+          pending--;
+          maybeExit();
+        });
+    }
+  });
+  process.stdin.on("end", () => {
+    ended = true;
+    maybeExit();
+  });
+  log(`ready (origin ${origin}${token ? "" : ", not authenticated"})`);
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@thothica/docs-cli",
+  "version": "1.0.0",
+  "description": "Command-line tool and MCP server for Thothica Docs: let any AI agent read, create, edit, and comment on native .docx documents.",
+  "type": "module",
+  "bin": {
+    "thd": "bin/thd.mjs",
+    "thothica-docs": "bin/thd.mjs"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "thothica",
+    "docs",
+    "docx",
+    "mcp",
+    "ai-agent",
+    "cli",
+    "word"
+  ],
+  "license": "AGPL-3.0",
+  "homepage": "https://docs.thothica.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adoistic/thothica-docs.git",
+    "directory": "cli"
+  },
+  "bugs": {
+    "url": "https://github.com/adoistic/thothica-docs/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {}
+}