@honkio/mcp 1.4.0 → 1.5.0

package/README.md

@@ -2,14 +2,14 @@
 
 Model Context Protocol (MCP) server for [HonkIO](https://honkio.ca), the Canadian SMS API. It lets an AI agent send SMS, run phone verification, manage Canadian numbers, and handle CASL compliance through natural language.
 
-41 tools, 4 resources, and 5 guided prompts, all backed by the live HonkIO REST API.
+41 tools, 4 resources, and 5 guided prompts, all backed by the live HonkIO REST API. Use it two ways: point your client at the hosted endpoint at `https://mcp.honkio.ca/mcp`, or run it locally with `npx`. Both talk to the same API with the same key.
 
 ---
 
 ## Requirements
 
-- **Node.js 20 or newer**
 - A HonkIO account and API key
+- For the local `npx` route only: **Node.js 20 or newer**
 
 ---
 
@@ -30,55 +30,97 @@ Live sending also requires that the account owner has completed phone verificati
 
 ## 2. Connect your AI tool
 
-There is nothing to install. `npx` fetches the server on first use and caches it.
+There are two ways in. The hosted endpoint needs nothing installed and is the right choice for claude.ai connectors, the Claude Messages API, and any client that speaks Streamable HTTP. The local route runs the same server on your machine through `npx`.
 
-In every example below, put your own key in `HONKIO_API_KEY`.
+In every example below, put your own key where it says `mk_test_YOUR_KEY_HERE`.
 
-### Claude Code
+### Hosted endpoint
 
-From inside your project:
+The key travels in a header on every request, so never paste it into a file you commit. The JSON examples read it from an environment variable.
+
+**Claude Code**
 
 ```sh
-claude mcp add honkio \
-  --env HONKIO_API_KEY=mk_test_YOUR_KEY_HERE \
-  -- npx -y @honkio/mcp
+claude mcp add --transport http honkio https://mcp.honkio.ca/mcp \
+  --header "Authorization: Bearer mk_test_YOUR_KEY_HERE"
+```
+
+Prefer to sign in rather than paste a key? Add the endpoint without a header and run `/mcp` inside Claude Code: a browser window opens on honkio.ca where you approve the connection and choose live or test mode. The connection shows up on your API keys page as `OAuth: Claude Code`, and revoking it there disconnects the agent.
+
+```sh
+claude mcp add --transport http honkio https://mcp.honkio.ca/mcp
 ```
 
-Or commit a `.mcp.json` at the project root to share it with your team (keep the real key out of git — see [Keeping your key out of git](#keeping-your-key-out-of-git)):
+Or in a shared `.mcp.json`, with the key coming from `HONKIO_API_KEY` in your shell:
 
 ```json
 {
   "mcpServers": {
     "honkio": {
-      "command": "npx",
-      "args": ["-y", "@honkio/mcp"],
-      "env": { "HONKIO_API_KEY": "mk_test_YOUR_KEY_HERE" }
+      "type": "http",
+      "url": "https://mcp.honkio.ca/mcp",
+      "headers": { "Authorization": "Bearer ${HONKIO_API_KEY}" }
     }
   }
 }
 ```
 
-### Claude Desktop
-
-Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+**Cursor** (`.cursor/mcp.json` or `~/.cursor/mcp.json`)
 
 ```json
 {
   "mcpServers": {
     "honkio": {
-      "command": "npx",
-      "args": ["-y", "@honkio/mcp"],
-      "env": { "HONKIO_API_KEY": "mk_test_YOUR_KEY_HERE" }
+      "url": "https://mcp.honkio.ca/mcp",
+      "headers": { "Authorization": "Bearer mk_test_YOUR_KEY_HERE" }
     }
   }
 }
 ```
 
-Restart Claude Desktop afterwards.
+**VS Code** (`.vscode/mcp.json`)
+
+```json
+{
+  "servers": {
+    "honkio": {
+      "type": "http",
+      "url": "https://mcp.honkio.ca/mcp",
+      "headers": { "Authorization": "Bearer mk_test_YOUR_KEY_HERE" }
+    }
+  }
+}
+```
+
+**Claude Messages API** (no MCP client needed)
+
+```json
+{
+  "model": "claude-opus-5",
+  "max_tokens": 1024,
+  "messages": [{ "role": "user", "content": "List my HonkIO phone numbers." }],
+  "mcp_servers": [
+    { "type": "url", "url": "https://mcp.honkio.ca/mcp", "name": "honkio", "authorization_token": "mk_test_YOUR_KEY_HERE" }
+  ],
+  "tools": [{ "type": "mcp_toolset", "mcp_server_name": "honkio" }]
+}
+```
+
+Send that with the `anthropic-beta: mcp-client-2025-11-20` header. The endpoint also accepts the key as `X-API-Key` if your client cannot set `Authorization`.
 
-### Cursor
+### Local with npx
 
-Edit `.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` globally:
+`npx` fetches the server on first use and caches it. Needs Node.js 20 or newer.
+
+**Claude Code**
+
+```sh
+claude mcp add honkio \
+  --env HONKIO_API_KEY=mk_test_YOUR_KEY_HERE \
+  -- npx -y @honkio/mcp
+```
+
+Or in `.mcp.json` (keep the real key out of git, see [Keeping your key out of git](#keeping-your-key-out-of-git)):
 
 ```json
 {
@@ -92,9 +134,11 @@ Edit `.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` globally:
 }
 ```
 
-### VS Code (GitHub Copilot)
+**Claude Desktop**: `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows), same `mcpServers` block as above, then restart Claude Desktop.
 
-Edit `.vscode/mcp.json` in your workspace:
+**Cursor**: `.cursor/mcp.json` or `~/.cursor/mcp.json`, same `mcpServers` block.
+
+**VS Code** (`.vscode/mcp.json`)
 
 ```json
 {
@@ -128,22 +172,38 @@ To check the server outside any AI tool:
 HONKIO_API_KEY=mk_test_YOUR_KEY npx -y @honkio/mcp
 ```
 
-It should start and wait silently on stdin — an MCP server speaks JSON-RPC over stdio, so no output is the healthy state. Press Ctrl-C to exit. If it exits immediately with an error, the message tells you what is wrong.
+It should start and wait silently on stdin. An MCP server speaks JSON-RPC over stdio, so no output is the healthy state. Press Ctrl-C to exit. If it exits immediately with an error, the message tells you what is wrong.
+
+To check the hosted endpoint outside any AI tool:
+
+```sh
+curl -s https://mcp.honkio.ca/healthz
+curl -s -i -X POST https://mcp.honkio.ca/mcp | head -3
+```
+
+The first returns `{"ok":true,"version":"..."}`. The second, with no key, returns `401` and a `WWW-Authenticate: Bearer` header, which is the endpoint telling you where the key goes.
 
 ---
 
 ## Environment variables
 
-| Variable | Required | Description |
-|---|---|---|
-| `HONKIO_API_KEY` | Yes | Your API key (`mk_live_…` or `mk_test_…`). The server refuses to start without it. |
-| `HONKIO_API_URL` | No | Override the API base URL. Defaults to `https://api.honkio.ca`. Only needed for self-hosting or local development. |
+| Variable | Used by | Required | Description |
+|---|---|---|---|
+| `HONKIO_API_KEY` | local `npx` | Yes | Your API key (`mk_live_…` or `mk_test_…`). The stdio server refuses to start without it. The hosted endpoint takes the key from the request header instead. |
+| `API_URL` | both | No | Override the API base URL. Defaults to `https://api.honkio.ca`. Only needed for self-hosting or local development. The pre-1.5 name `HONKIO_API_URL` still works. |
+| `PORT` | hosted | No | Port for `honkio-mcp-http`. Defaults to `8080`. |
+| `MCP_ALLOWED_ORIGINS` | hosted | No | Comma-separated browser origins allowed to call the endpoint. Empty by default, which refuses any request carrying an `Origin` header. Command-line and server-side clients send none and are unaffected. |
+| `MCP_RATE_LIMIT_PER_MINUTE` | hosted | No | Requests per minute allowed from one client address. Default `300`. Beyond it the endpoint answers `429` with `Retry-After`. |
+| `MCP_AUTH_FAILURES_PER_MINUTE` | hosted | No | Refused requests (bad or missing key, bad Origin, malformed body) per minute allowed from one client address before the address is locked out for the rest of the minute. Default `10`. |
+| `MCP_TRUSTED_PROXIES` | hosted | No | How many proxy hops in front of the process append to `X-Forwarded-For`. The client address is read that many entries from the right. Railway's edge is one hop, the default. Set `0` when nothing sits in front. |
+| `MCP_SERVICE_KEY` | hosted | No | This service's key at the HonkIO API (the API's `MCP_SERVICE_KEY`). Lets the endpoint accept OAuth access tokens, so clients can sign in instead of pasting a key. Unset means API keys only. |
+| `MCP_PUBLIC_URL` | hosted | No | The public URL access tokens are bound to. Default `https://mcp.honkio.ca/mcp`. |
 
 ### Keeping your key out of git
 
 `.mcp.json` and `.vscode/mcp.json` are usually committed. An API key pasted into one is a live credential in your repository history. Either keep those files untracked, or reference an environment variable your shell already exports and add the file to `.gitignore`.
 
-If a key does leak, revoke it immediately at <https://honkio.ca/dashboard/keys> — a revoked key stops working at once.
+If a key does leak, revoke it immediately at <https://honkio.ca/dashboard/keys>. A revoked key stops working at once.
 
 ---
 
@@ -152,11 +212,11 @@ If a key does leak, revoke it immediately at <https://honkio.ca/dashboard/keys>
 ### Messages
 | Tool | Description |
 |---|---|
-| `send_sms` | Send an SMS from one of your numbers. Enforces CASL consent unless overridden. Pass `idempotency_key` when retrying. A reserved exchange (555-XXXX, N11, test codes) comes back 201 FAILED with `error_code: RESERVED_DESTINATION` and is billed. |
+| `send_sms` | Send an SMS from one of your numbers. Enforces CASL consent unless overridden. Pass `idempotency_key` when retrying. A reserved exchange (555-XXXX, N11, test codes) is refused for free with `422 RESERVED_DESTINATION`. |
 | `list_messages` | List messages, filterable by number, status, direction and date. |
 | `get_message` | Full detail for one message, including delivery status and cost. |
 
-Both directions are billed: sending an SMS charges per segment, and receiving one on a provisioned number charges a flat per-message cost — `get_pricing` returns both figures. Inbound charges happen automatically whenever someone texts your number, independent of any tool call.
+Both directions are billed: sending an SMS charges per segment, and receiving one on a provisioned number charges a flat per-message cost. `get_pricing` returns both figures. Inbound charges happen automatically whenever someone texts your number, independent of any tool call.
 
 ### Phone verification (OTP)
 | Tool | Description |
@@ -166,7 +226,7 @@ Both directions are billed: sending an SMS charges per segment, and receiving on
 | `get_verification` | Status of a single verification attempt. |
 | `list_verifications` | List verification attempts. |
 
-On a live key, verification is billed per message segment plus a per-verification surcharge — `get_pricing` returns the current figure. On a test key nothing is sent and nothing is charged, and the code is always `000000`, padded to the requested length. Every verification carries a `mode` of `LIVE` or `TEST`, so you never have to infer which happened.
+On a live key, verification is billed per message segment plus a per-verification surcharge. `get_pricing` returns the current figure. On a test key nothing is sent and nothing is charged, and the code is always `000000`, padded to the requested length. Every verification carries a `mode` of `LIVE` or `TEST`, so you never have to infer which happened.
 
 ### Pricing
 | Tool | Description |
@@ -194,7 +254,7 @@ Prices are set at runtime and change without a release. Read them rather than ha
 | `record_opt_out` | Record an opt-out manually. |
 | `list_opt_outs` | List opt-out records. |
 
-### DNCL — not available yet
+### DNCL: not available yet
 | Tool | Description |
 |---|---|
 | `check_dncl` | Returns `501 DNCL_COMING_SOON`. |
@@ -223,12 +283,12 @@ CRTC Do Not Call List checking is not live. `dncl_exemptions` on `send_sms` is a
 | `request_send_limit` | File a "request a higher volume" for staff review once probation has ended. |
 | `get_topup_allowance` | How much credit can be added right now under the balance and 30-day top-up caps. |
 
-New accounts can send 250 live messages per rolling 24 hours; 30 days after the first live send they can request more. Identical messages to many recipients, per-number rate, link shorteners, and unusually high opt-out or failure rates are also limited — see [honkio.ca/docs#limits](https://honkio.ca/docs#limits). Refused sends return `DAILY_LIMIT_REACHED`, `FANOUT_LIMIT_REACHED`, `NUMBER_RATE_LIMITED`, `RECIPIENT_RATE_LIMITED` (30 an hour / 100 a day to one number), `SENDING_PAUSED`, `UNDELIVERABLE_NUMBER` (three consecutive carrier failures list a number for 90 days) or `LINK_SHORTENER_BLOCKED` with details. A send to a reserved exchange (555-XXXX, N11, carrier test codes) is not refused: it comes back 201 as a billed FAILED row with `error_code: RESERVED_DESTINATION`.
+New accounts can send 250 live messages per rolling 24 hours; 30 days after the first live send they can request more. Identical messages to many recipients, per-number rate, link shorteners, and unusually high opt-out or failure rates are also limited. See [honkio.ca/docs#limits](https://honkio.ca/docs#limits). Refused sends return `DAILY_LIMIT_REACHED`, `FANOUT_LIMIT_REACHED`, `NUMBER_RATE_LIMITED`, `RECIPIENT_RATE_LIMITED` (30 an hour / 100 a day to one number), `SENDING_PAUSED`, `UNDELIVERABLE_NUMBER` (three consecutive carrier failures list a number for 90 days), `NOT_A_MOBILE_NUMBER` (a landline or VoIP destination, refused before sending), `RESERVED_DESTINATION` (a reserved exchange such as 555-XXXX, N11 or a carrier test code, refused in both modes) or `LINK_SHORTENER_BLOCKED` with details.
 
 ### Account and keys
 | Tool | Description |
 |---|---|
-| `whoami` | Identify the account the API key belongs to — id, name, balance, status. |
+| `whoami` | Identify the account the API key belongs to: id, name, balance, status. |
 | `get_account` | Account detail and credit balance. |
 | `update_account` | Update the account name. |
 | `get_usage` | Usage for a billing period, including live delivery health (`delivery`: delivered, failed, undelivered, pending, `failureRatePct`; `byNumber`: the same per sending number). |
@@ -293,21 +353,21 @@ Show me any webhook deliveries that failed and ended up in the dead-letter queue
 Two tools move real money on a live key:
 
 - **`provision_phone_number`** charges the first month's rent plus a one-time activation fee, together, and starts monthly rent. Rent keeps accruing until you call `release_phone_number`; the activation fee is not refunded on release.
-- **`send_sms`** and **`start_verification`** charge per SMS part against your balance, counted the way the carrier splits the body (typographic quotes and dashes are smart-encoded to GSM-7; emoji force Unicode parts). The charge is settled to the carrier's part count after the send. A send the carrier rejects outright costs nothing; a message the carrier accepts but cannot deliver keeps its charge, and so does a send to a reserved exchange (555-XXXX and similar), which is blocked here and returned as a FAILED row. A body over 10 parts is refused with `422 MESSAGE_TOO_LONG` before any charge. `start_verification` adds a per-verification surcharge on top. `get_pricing` tells you what each costs right now.
+- **`send_sms`** and **`start_verification`** charge per SMS part against your balance, counted the way the carrier splits the body (typographic quotes and dashes are smart-encoded to GSM-7; emoji force Unicode parts). The charge is settled to the carrier's part count after the send. A send the carrier rejects outright costs nothing, and so does a send to a reserved exchange (555-XXXX and similar), which is refused here; a message the carrier accepts but cannot deliver keeps its charge. A body over 10 parts is refused with `422 MESSAGE_TOO_LONG` before any charge. `start_verification` adds a per-verification surcharge on top. `get_pricing` tells you what each costs right now.
 
-A third charge is not tool-triggered at all: **inbound SMS is billed per segment** the moment a carrier delivers it to one of your provisioned numbers, whether or not you ever call a tool. Traffic to a number you provisioned draws down your balance on its own (STOP/START/HELP replies are not charged), and a received message is debited even when the balance cannot cover it — the balance goes negative and sends are frozen until the next top-up.
+A third charge is not tool-triggered at all: **inbound SMS is billed per segment** the moment a carrier delivers it to one of your provisioned numbers, whether or not you ever call a tool. Traffic to a number you provisioned draws down your balance on its own (STOP/START/HELP replies are not charged), and a received message is debited even when the balance cannot cover it: the balance goes negative and sends are frozen until the next top-up.
 
-Agents act on instructions that can be vaguer than you intended. If you are exploring, use a test key — the tools behave the same and charge nothing.
+Agents act on instructions that can be vaguer than you intended. If you are exploring, use a test key. The tools behave the same and charge nothing.
 
-A test-mode send still comes back with status `DELIVERED`, because it simulates a successful delivery. That is not a claim that a phone received anything. The `mode` field on the response — `LIVE` or `TEST` — is the one that tells you whether an SMS actually left the building.
+A test-mode send still comes back with status `DELIVERED`, because it simulates a successful delivery. That is not a claim that a phone received anything. The `mode` field on the response, `LIVE` or `TEST`, is the one that tells you whether an SMS actually left the building.
 
 ---
 
 ## Canadian compliance
 
-- **CASL** — commercial messages need consent on record. Use `record_consent` before sending; `send_sms` enforces it unless you pass `skip_consent_check`. Express consent does not expire; implied consent expires two years after the last transaction.
-- **DNCL** — CRTC Do Not Call List checking is not available yet and is not enforced.
-- **PIPEDA** — customer data is **stored** in Canada (`ca-central-1`). Request processing currently runs on infrastructure outside Canada, so data crosses the border in transit; see the [privacy policy](https://honkio.ca/legal/privacy) for the full disclosure. Use `request_erasure` for right-to-erasure requests.
+- **CASL**: commercial messages need consent on record. Use `record_consent` before sending; `send_sms` enforces it unless you pass `skip_consent_check`. Express consent does not expire; implied consent expires two years after the last transaction.
+- **DNCL**: CRTC Do Not Call List checking is not available yet and is not enforced.
+- **PIPEDA**: customer data is **stored** in Canada (`ca-central-1`). Request processing currently runs on infrastructure outside Canada, so data crosses the border in transit; see the [privacy policy](https://honkio.ca/legal/privacy) for the full disclosure. Use `request_erasure` for right-to-erasure requests.
 
 ---
 
@@ -316,7 +376,7 @@ A test-mode send still comes back with status `DELIVERED`, because it simulates
 | Symptom | Cause and fix |
 |---|---|
 | `Error [UNAUTHORIZED]` | Key is wrong, revoked, or `HONKIO_API_KEY` never reached the server. Check the `env` block in your config. |
-| Tools do not appear in the agent | The client did not start the server. Restart the client, and check that `npx` is on its `PATH` — GUI apps do not always inherit your shell's `PATH`. |
+| Tools do not appear in the agent | The client did not start the server. Restart the client, and check that `npx` is on its `PATH`, since GUI apps do not always inherit your shell's `PATH`. |
 | First start is slow, or times out once | `npx` downloads the package on first use. Run `npx -y @honkio/mcp` once in a terminal to warm the cache, then restart your client. |
 | `npm ERR! 404 @honkio/mcp` | Usually an npm registry override or a private proxy. Check `npm config get registry`. |
 | `Error [PAYMENT_REQUIRED]` | The account needs an initial top-up before live use. |
@@ -340,9 +400,36 @@ npm run typecheck  # types only
 npm run build      # compile to dist/
 ```
 
-Point a local checkout at your own API with `HONKIO_API_URL=http://localhost:3000`, and at a local build by using `node /path/to/honkio/mcp/dist/index.js` as the `command` in your client config instead of `npx`.
+Point a local checkout at your own API with `API_URL=http://localhost:3000`, and at a local build by using `node /path/to/honkio/mcp/dist/index.js` as the `command` in your client config instead of `npx`.
+
+`dist/` is gitignored and the published tarball is built from it, so `prepublishOnly` rebuilds on every `npm publish`, so never publish without letting it run.
+
+### Running the hosted entry yourself
+
+The same package ships `honkio-mcp-http`, the process behind `mcp.honkio.ca`:
+
+```sh
+PORT=8080 API_URL=https://api.honkio.ca npx -y -p @honkio/mcp honkio-mcp-http
+```
+
+It answers `GET /healthz` and `POST /mcp`, verifies each caller's key against the API once a minute, rate-limits each client address (see the environment table), and serves both the 2025 handshake protocol and the 2026-07-28 revision. There is a `Dockerfile` and a `railway.toml` in this directory for hosting it.
+
+### Publishing to the MCP Registry
+
+`server.json` describes both the npm package and the hosted endpoint for the official registry under the `ca.honkio/mcp` namespace. Publishing needs the DNS-verified namespace once, then one command per release:
+
+```sh
+# once: generate a keypair and publish the public half at the apex of honkio.ca
+openssl genpkey -algorithm Ed25519 -out mcp-registry.pem
+openssl pkey -in mcp-registry.pem -pubout -outform DER | tail -c 32 | base64
+#   -> TXT record on honkio.ca:  v=MCPv1; k=ed25519; p=<that base64>
+
+# each release, after npm publish and a matching version in server.json
+npx -y @modelcontextprotocol/mcp-publisher login dns --domain honkio.ca --private-key "$(openssl pkey -in mcp-registry.pem -outform DER | tail -c 32 | xxd -p -c 64)"
+npx -y @modelcontextprotocol/mcp-publisher publish
+```
 
-`dist/` is gitignored and the published tarball is built from it, so `prepublishOnly` rebuilds on every `npm publish` — never publish without letting it run.
+The `serverJson` test pins `server.json` to `package.json`, so a version bump that forgets one of them fails `npm test`.
 
 ## License
 

package/dist/auth.d.ts

@@ -0,0 +1,40 @@
+import type { IncomingHttpHeaders } from 'node:http';
+import type { AuthInfo } from '@modelcontextprotocol/server';
+/** OAuth access tokens minted by the API's authorization server. */
+export declare const isAccessToken: (credential: string) => boolean;
+/** The key from `Authorization: Bearer` or, as the API also accepts, `X-API-Key`. Null when absent or not a HonkIO key. */
+export declare function extractApiKey(headers: IncomingHttpHeaders): string | null;
+export type VerifyResult = {
+    status: 'ok';
+    authInfo: AuthInfo;
+    accountId: string;
+    isTestMode: boolean;
+} | {
+    status: 'invalid';
+} | {
+    status: 'unavailable';
+};
+export interface KeyVerifierOptions {
+    apiBaseUrl: string;
+    /** Cache lifetime for both good and rejected keys. Default 60 s. */
+    ttlMs?: number;
+    /** Cap on cached keys; the oldest entry is dropped past it. Default 10,000. */
+    maxEntries?: number;
+    /** Clock, injectable for tests. */
+    now?: () => number;
+    /** This service's key at the API (MCP_SERVICE_KEY). Without it access tokens are refused outright, since the API would refuse them too. */
+    serviceKey?: string;
+}
+export declare class KeyVerifier {
+    private readonly cache;
+    private readonly apiBaseUrl;
+    private readonly ttlMs;
+    private readonly maxEntries;
+    private readonly now;
+    private readonly serviceKey;
+    constructor(opts: KeyVerifierOptions);
+    get size(): number;
+    verify(key: string): Promise<VerifyResult>;
+    private toResult;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAK7D,oEAAoE;AACpE,eAAO,MAAM,aAAa,GAAI,YAAY,MAAM,KAAG,OAA0C,CAAC;AAE9F,2HAA2H;AAC3H,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAYzE;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC5E;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAI9B,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2IAA2I;IAC3I,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;gBAEpC,IAAI,EAAE,kBAAkB;IAQpC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAEK,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IA8BhD,OAAO,CAAC,QAAQ;CAmBjB"}

package/dist/auth.js

@@ -0,0 +1,98 @@
+/**
+ * API-key auth for the hosted MCP endpoint.
+ *
+ * The endpoint is an OAuth-shaped resource server in name only: the bearer
+ * token is a HonkIO API key, and the authority that decides whether it is
+ * valid is the REST API. verify() asks GET /v1/accounts/me and remembers the
+ * answer for a minute, so a chatty agent costs one lookup per key per minute
+ * rather than one per tool call.
+ */
+import { createHash } from 'node:crypto';
+import { HonkioClient, HonkioError } from './client.js';
+const KEY_PATTERN = /^(mk_(live|test)_[A-Za-z0-9]+|hk_at_[A-Za-z0-9_-]+)$/;
+/** OAuth access tokens minted by the API's authorization server. */
+export const isAccessToken = (credential) => credential.startsWith('hk_at_');
+/** The key from `Authorization: Bearer` or, as the API also accepts, `X-API-Key`. Null when absent or not a HonkIO key. */
+export function extractApiKey(headers) {
+    const auth = headers.authorization;
+    if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+        const key = auth.slice('Bearer '.length).trim();
+        return KEY_PATTERN.test(key) ? key : null;
+    }
+    const xKey = headers['x-api-key'];
+    if (typeof xKey === 'string') {
+        const key = xKey.trim();
+        return KEY_PATTERN.test(key) ? key : null;
+    }
+    return null;
+}
+export class KeyVerifier {
+    cache = new Map();
+    apiBaseUrl;
+    ttlMs;
+    maxEntries;
+    now;
+    serviceKey;
+    constructor(opts) {
+        this.apiBaseUrl = opts.apiBaseUrl;
+        this.ttlMs = opts.ttlMs ?? 60_000;
+        this.maxEntries = opts.maxEntries ?? 10_000;
+        this.now = opts.now ?? Date.now;
+        this.serviceKey = opts.serviceKey;
+    }
+    get size() {
+        return this.cache.size;
+    }
+    async verify(key) {
+        const hash = createHash('sha256').update(key).digest('hex');
+        const now = this.now();
+        const hit = this.cache.get(hash);
+        if (hit && hit.expiresAt > now)
+            return this.toResult(key, hit);
+        const token = isAccessToken(key);
+        if (token && !this.serviceKey)
+            return { status: 'invalid' };
+        let verdict;
+        try {
+            const me = await new HonkioClient({ apiKey: key, baseUrl: this.apiBaseUrl, serviceKey: token ? this.serviceKey : undefined }).getCurrentAccount();
+            verdict = { accountId: me.account.id };
+        }
+        catch (err) {
+            if (err instanceof HonkioError && (err.status === 401 || err.status === 403)) {
+                verdict = 'invalid';
+            }
+            else {
+                return { status: 'unavailable' };
+            }
+        }
+        const entry = { expiresAt: now + this.ttlMs, verdict };
+        if (this.cache.size >= this.maxEntries) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
+                this.cache.delete(oldest);
+        }
+        this.cache.set(hash, entry);
+        return this.toResult(key, entry);
+    }
+    toResult(key, entry) {
+        if (entry.verdict === 'invalid')
+            return { status: 'invalid' };
+        const credential = isAccessToken(key) ? 'token' : 'key';
+        // Test mode is a property of the key behind a token; the API decides. For logs only.
+        const isTestMode = credential === 'key' && key.startsWith('mk_test_');
+        const accountId = entry.verdict.accountId;
+        return {
+            status: 'ok',
+            accountId,
+            isTestMode,
+            authInfo: {
+                token: key,
+                clientId: accountId,
+                scopes: [],
+                expiresAt: Math.floor(entry.expiresAt / 1000),
+                extra: { accountId, isTestMode, credential },
+            },
+        };
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAE3E,oEAAoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAE9F,2HAA2H;AAC3H,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqBD,MAAM,OAAO,WAAW;IACL,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,UAAU,CAAS;IACnB,KAAK,CAAS;IACd,UAAU,CAAS;IACnB,GAAG,CAAe;IAClB,UAAU,CAAqB;IAEhD,YAAY,IAAwB;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE5D,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;YAClJ,OAAO,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC7E,OAAO,GAAG,SAAS,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,KAAa;QACzC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACxD,qFAAqF;QACrF,MAAM,UAAU,GAAG,UAAU,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS;YACT,UAAU;YACV,QAAQ,EAAE;gBACR,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC7C,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE;aAC7C;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/client.d.ts

@@ -4,6 +4,10 @@
 export interface HonkioClientOptions {
     apiKey: string;
     baseUrl?: string;
+    /** Account id already known for this key, so the first account-scoped call does not look it up. */
+    accountId?: string;
+    /** Sent as X-MCP-Service-Key. Required when the credential is an OAuth access token: the API honours those only from this service. */
+    serviceKey?: string;
 }
 export declare class HonkioError extends Error {
     readonly status: number;
@@ -13,7 +17,16 @@ export declare class HonkioError extends Error {
 export declare class HonkioClient {
     private readonly apiKey;
     private readonly baseUrl;
+    private accountId;
+    private readonly serviceKey;
     constructor(options: HonkioClientOptions);
+    /**
+     * The account this key belongs to, looked up once per client instance. A
+     * stdio process has one key for its whole life; an HTTP request builds a
+     * fresh client per call, seeded from the verifier's cache, so neither ever
+     * asks the API twice.
+     */
+    currentAccountId(): Promise<string>;
     private request;
     sendMessage(params: {
         from: string;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,WAAY,SAAQ,KAAK;aAElB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,EAAE,mBAAmB;YAK1B,OAAO;IA6CrB,WAAW,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,2DAA2D;QAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMD,YAAY,CAAC,KAAK,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;cAC6B,OAAO,EAAE;cAAQ,OAAO;;IAGtD,UAAU,CAAC,EAAE,EAAE,MAAM;IAMrB,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAIjE,oBAAoB,CAAC,WAAW,EAAE,MAAM;IAIxC,gBAAgB;cACc,OAAO,EAAE;;IAGvC,cAAc,CAAC,EAAE,EAAE,MAAM;IAIzB,kBAAkB,CAAC,EAAE,EAAE,MAAM;IAM7B,aAAa,CAAC,MAAM,EAAE;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC;QACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;IAID,YAAY,CAAC,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cAChE,OAAO,EAAE;;IAGvC,YAAY,CAAC,WAAW,EAAE,MAAM;IAIhC,aAAa,CAAC,WAAW,EAAE,MAAM;IAMjC,YAAY,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IAIlE,WAAW,CAAC,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cACpE,OAAO,EAAE;;IAKvC,SAAS,CAAC,WAAW,EAAE,MAAM;IAI7B,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE;iBACJ,OAAO,EAAE;;IAK1C,cAAc,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAMhE,UAAU;IAMV,iBAAiB,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB;IAID,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAItD,eAAe,CAAC,cAAc,EAAE,MAAM;IAItC,iBAAiB,CAAC,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cACrE,OAAO,EAAE;;IAKvC,aAAa,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAIvD,YAAY;cACkB,OAAO,EAAE;;IAGvC,UAAU,CAAC,EAAE,EAAE,MAAM;IAIrB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;IAIvF,aAAa,CAAC,EAAE,EAAE,MAAM;IAIxB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cACrC,OAAO,EAAE;;IAGvC,iBAAiB,CAAC,SAAS,EAAE,MAAM;IAInC,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE;cAClE,OAAO,EAAE;;IAQvC,uBAAuB,CAAC,YAAY,EAAE,MAAM;IAI5C,wBAAwB,CAAC,YAAY,EAAE,MAAM;IAM7C;;;;;;OAMG;IACH,iBAAiB;iBACgB;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;IAGzE,UAAU,CAAC,EAAE,EAAE,MAAM;IAIrB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;IAIlD,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE;IAM3D,YAAY;IAIZ,gBAAgB,CAAC,MAAM,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAIrE,iBAAiB,CAAC,SAAS,EAAE,MAAM;IAInC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAInF,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAI7C,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;aAChB,MAAM;gBAAU,MAAM;cAAQ,MAAM,GAAG,MAAM;oBAAc,MAAM;;CAK/F"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sIAAsI;IACtI,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,WAAY,SAAQ,KAAK;aAElB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;gBAEpC,OAAO,EAAE,mBAAmB;IAOxC;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;YAO3B,OAAO;IAsDrB,WAAW,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,2DAA2D;QAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMD,YAAY,CAAC,KAAK,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;cAC6B,OAAO,EAAE;cAAQ,OAAO;;IAGtD,UAAU,CAAC,EAAE,EAAE,MAAM;IAMrB,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAIjE,oBAAoB,CAAC,WAAW,EAAE,MAAM;IAIxC,gBAAgB;cACc,OAAO,EAAE;;IAGvC,cAAc,CAAC,EAAE,EAAE,MAAM;IAIzB,kBAAkB,CAAC,EAAE,EAAE,MAAM;IAM7B,aAAa,CAAC,MAAM,EAAE;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC;QACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;IAID,YAAY,CAAC,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cAChE,OAAO,EAAE;;IAGvC,YAAY,CAAC,WAAW,EAAE,MAAM;IAIhC,aAAa,CAAC,WAAW,EAAE,MAAM;IAMjC,YAAY,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IAIlE,WAAW,CAAC,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cACpE,OAAO,EAAE;;IAKvC,SAAS,CAAC,WAAW,EAAE,MAAM;IAI7B,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE;iBACJ,OAAO,EAAE;;IAK1C,cAAc,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAMhE,UAAU;IAMV,iBAAiB,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB;IAID,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAItD,eAAe,CAAC,cAAc,EAAE,MAAM;IAItC,iBAAiB,CAAC,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cACrE,OAAO,EAAE;;IAKvC,aAAa,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAIvD,YAAY;cACkB,OAAO,EAAE;;IAGvC,UAAU,CAAC,EAAE,EAAE,MAAM;IAIrB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;IAIvF,aAAa,CAAC,EAAE,EAAE,MAAM;IAIxB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cACrC,OAAO,EAAE;;IAGvC,iBAAiB,CAAC,SAAS,EAAE,MAAM;IAInC,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE;cAClE,OAAO,EAAE;;IAQvC,uBAAuB,CAAC,YAAY,EAAE,MAAM;IAI5C,wBAAwB,CAAC,YAAY,EAAE,MAAM;IAM7C;;;;;;OAMG;IACH,iBAAiB;iBACgB;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;IAGzE,UAAU,CAAC,EAAE,EAAE,MAAM;IAIrB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;IAIlD,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE;IAM3D,YAAY;IAIZ,gBAAgB,CAAC,MAAM,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAIrE,iBAAiB,CAAC,SAAS,EAAE,MAAM;IAInC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAInF,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAI7C,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;aAChB,MAAM;gBAAU,MAAM;cAAQ,MAAM,GAAG,MAAM;oBAAc,MAAM;;CAK/F"}