@honkio/mcp 1.4.0 → 1.5.0

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5C,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAC9C;AAED,wBAAgB,YAAY,CAAC,MAAM,GAAE;IAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAmB,GAAG,MAAM,CAQ/F"}

package/dist/log.js

@@ -0,0 +1,10 @@
+export function createLogger(stream = process.stdout) {
+    const emit = (level, msg, fields) => {
+        stream.write(`${JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields })}\n`);
+    };
+    return {
+        info: (msg, fields) => emit('info', msg, fields),
+        error: (msg, fields) => emit('error', msg, fields),
+    };
+}
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,YAAY,CAAC,SAA4C,OAAO,CAAC,MAAM;IACrF,MAAM,IAAI,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAE,MAAkB,EAAE,EAAE;QACxE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QAChD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/dist/prompts.d.ts

@@ -1,3 +1,3 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from "@modelcontextprotocol/server";
 export declare function registerPrompts(server: McpServer): void;
 //# sourceMappingURL=prompts.d.ts.map

package/dist/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA0IvD"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAGzD,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiHvD"}

package/dist/prompts.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 export function registerPrompts(server) {
-    server.prompt('send_compliant_sms', 'Walk through the full compliant SMS send workflow: check CASL consent and send the message. (CRTC DNCL checking is coming soon and not yet enforced.)', {
-        phone_number: z.string().describe('Recipient phone number in E.164 format (+1 and ten digits). Use the real recipient: 555-XXXX exchanges are reserved and a live send to one is billed as a failure.'),
-        from_number: z.string().describe('Your sending phone number in E.164 format.'),
-        message: z.string().describe('The message body you want to send.'),
-    }, ({ phone_number, from_number, message }) => ({
+    server.registerPrompt('send_compliant_sms', { description: 'Walk through the full compliant SMS send workflow: check CASL consent and send the message. (CRTC DNCL checking is coming soon and not yet enforced.)', argsSchema: z.object({
+            phone_number: z.string().describe('Recipient phone number in E.164 format (+1 and ten digits). Use the real recipient: 555-XXXX exchanges are reserved and a send to one is refused.'),
+            from_number: z.string().describe('Your sending phone number in E.164 format.'),
+            message: z.string().describe('The message body you want to send.'),
+        }) }, ({ phone_number, from_number, message }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -26,9 +26,9 @@ Show me the result of each step.`,
                 },
             }],
     }));
-    server.prompt('provision_canadian_number', 'Search for and provision a Canadian phone number, optionally filtered by area code.', {
-        area_code: z.string().optional().describe('Preferred area code (e.g. "416" for Toronto, "604" for Vancouver). Leave blank to search all available Canadian numbers.'),
-    }, ({ area_code }) => ({
+    server.registerPrompt('provision_canadian_number', { description: 'Search for and provision a Canadian phone number, optionally filtered by area code.', argsSchema: z.object({
+            area_code: z.string().optional().describe('Preferred area code (e.g. "416" for Toronto, "604" for Vancouver). Leave blank to search all available Canadian numbers.'),
+        }) }, ({ area_code }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -44,9 +44,9 @@ Please:
                 },
             }],
     }));
-    server.prompt('setup_webhooks', 'Set up webhook endpoints to receive HonkIO event notifications.', {
-        url: z.string().describe('Your HTTPS endpoint URL that will receive webhook events.'),
-    }, ({ url }) => ({
+    server.registerPrompt('setup_webhooks', { description: 'Set up webhook endpoints to receive HonkIO event notifications.', argsSchema: z.object({
+            url: z.string().describe('Your HTTPS endpoint URL that will receive webhook events.'),
+        }) }, ({ url }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -66,9 +66,9 @@ Please:
                 },
             }],
     }));
-    server.prompt('compliance_audit', 'Run a compliance check on a phone number: consent status and opt-out status. (CRTC DNCL status is coming soon.)', {
-        phone_number: z.string().describe('Phone number to audit in E.164 format.'),
-    }, ({ phone_number }) => ({
+    server.registerPrompt('compliance_audit', { description: 'Run a compliance check on a phone number: consent status and opt-out status. (CRTC DNCL status is coming soon.)', argsSchema: z.object({
+            phone_number: z.string().describe('Phone number to audit in E.164 format.'),
+        }) }, ({ phone_number }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -87,10 +87,10 @@ Summarize with:
                 },
             }],
     }));
-    server.prompt('handle_erasure_request', 'Process a PIPEDA right-to-erasure request for a subscriber.', {
-        phone_number: z.string().describe('Phone number to erase data for in E.164 format.'),
-        reason: z.string().optional().describe('Reason provided by the subscriber for the erasure request.'),
-    }, ({ phone_number, reason }) => ({
+    server.registerPrompt('handle_erasure_request', { description: 'Process a PIPEDA right-to-erasure request for a subscriber.', argsSchema: z.object({
+            phone_number: z.string().describe('Phone number to erase data for in E.164 format.'),
+            reason: z.string().optional().describe('Reason provided by the subscriber for the erasure request.'),
+        }) }, ({ phone_number, reason }) => ({
         messages: [{
                 role: 'user',
                 content: {

package/dist/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,MAAM,CAAC,MAAM,CACX,oBAAoB,EACpB,uJAAuJ,EACvJ;QACE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oKAAoK,CAAC;QACvM,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;KACnE,EACD,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;iBAEC,YAAY;YACjB,WAAW;eACR,OAAO;;;;;;;;;iCASW;iBACxB;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,2BAA2B,EAC3B,qFAAqF,EACrF;QACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0HAA0H,CAAC;KACtK,EACD,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oEAAoE,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE;;;2DAG1E,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;;;;oEAIxC;iBAC3D;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,gBAAgB,EAChB,iEAAiE,EACjE;QACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;KACtF,EACD,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,sFAAsF,GAAG;;;;;;;;;;;iIAWwB;iBACxH;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,kBAAkB,EAClB,iHAAiH,EACjH;QACE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;KAC5E,EACD,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,4DAA4D,YAAY;;;;;;;;;;sDAUlC;iBAC7C;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,wBAAwB,EACxB,6DAA6D,EAC7D;QACE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;QACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;KACrG,EACD,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7B,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;oBAEI,YAAY;EAC9B,MAAM,CAAC,CAAC,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;;;;;;uKAMuH;iBAC9J;aACF,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,MAAM,CAAC,cAAc,CAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,uJAAuJ,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YAC7N,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mJAAmJ,CAAC;YACtL,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SACnE,CAAC,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;iBAEP,YAAY;YACjB,WAAW;eACR,OAAO;;;;;;;;;iCASW;iBAChB;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,qFAAqF,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YAClK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0HAA0H,CAAC;SACtK,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oEAAoE,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE;;;2DAGlF,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;;;;oEAIxC;iBACnD;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,iEAAiE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnI,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;SACtF,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,sFAAsF,GAAG;;;;;;;;;;;iIAWgB;iBAChH;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,iHAAiH,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACrL,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAC5E,CAAC,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,4DAA4D,YAAY;;;;;;;;;;sDAU1C;iBACrC;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,wBAAwB,EAAE,EAAE,WAAW,EAAE,6DAA6D,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACvI,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;SACrG,CAAC,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;oBAEJ,YAAY;EAC9B,MAAM,CAAC,CAAC,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;;;;;;uKAMuH;iBACtJ;aACF,CAAC;KACH,CAAC,CAAC,CAAC;AAChB,CAAC"}

package/dist/rateLimit.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Per-address rate limiting for the hosted endpoint. Fixed one-minute
+ * windows in memory: the service runs as one replica, and the API behind it
+ * has its own per-key limits, so this only has to stop floods and key
+ * spraying from reaching the process and the API.
+ */
+import type { IncomingMessage } from 'node:http';
+/**
+ * The caller's address as seen through `trustedProxies` hops. Each trusted
+ * proxy appends its own address to X-Forwarded-For (Railway's edge appends
+ * one, verified 2026-09-05: a request arrives as "<client>, <edge>"), so the
+ * client is the entry that many places left of the right end. Anything a
+ * client writes into the header itself lands further left and is ignored.
+ * With fewer entries than hops (a local run with no proxy) the leftmost
+ * entry is used; with no header at all, the socket address.
+ */
+export declare function clientIp(req: Pick<IncomingMessage, 'headers' | 'socket'>, trustedProxies?: number): string;
+export interface RateLimiterOptions {
+    /** Events allowed per key per window. */
+    limit: number;
+    /** Window length. Default one minute. */
+    windowMs?: number;
+    /** Cap on tracked keys; the oldest is dropped past it. Default 10,000. */
+    maxEntries?: number;
+    /** Clock, injectable for tests. */
+    now?: () => number;
+}
+export interface RateLimitVerdict {
+    allowed: boolean;
+    /** Seconds until the window resets; what to send as Retry-After. */
+    retryAfterSec: number;
+}
+export declare class RateLimiter {
+    private readonly buckets;
+    private readonly limit;
+    private readonly windowMs;
+    private readonly maxEntries;
+    private readonly now;
+    private lastPrune;
+    constructor(opts: RateLimiterOptions);
+    get size(): number;
+    /** Counts one event for the key and says whether it stayed within the limit. */
+    hit(key: string): RateLimitVerdict;
+    /** Whether the key is already at the limit, without counting anything. */
+    blocked(key: string): RateLimitVerdict;
+    private verdict;
+    private bucket;
+    private prune;
+}
+//# sourceMappingURL=rateLimit.d.ts.map

package/dist/rateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../src/rateLimit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE,cAAc,SAAI,GAAG,MAAM,CAWrG;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,SAAS,CAAS;gBAEd,IAAI,EAAE,kBAAkB;IAQpC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,gFAAgF;IAChF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB;IAOlC,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB;IAOtC,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,MAAM;IAkBd,OAAO,CAAC,KAAK;CAMd"}

package/dist/rateLimit.js

@@ -0,0 +1,85 @@
+/**
+ * The caller's address as seen through `trustedProxies` hops. Each trusted
+ * proxy appends its own address to X-Forwarded-For (Railway's edge appends
+ * one, verified 2026-09-05: a request arrives as "<client>, <edge>"), so the
+ * client is the entry that many places left of the right end. Anything a
+ * client writes into the header itself lands further left and is ignored.
+ * With fewer entries than hops (a local run with no proxy) the leftmost
+ * entry is used; with no header at all, the socket address.
+ */
+export function clientIp(req, trustedProxies = 1) {
+    const xff = req.headers['x-forwarded-for'];
+    const raw = Array.isArray(xff) ? xff.join(',') : xff;
+    if (typeof raw === 'string') {
+        const parts = raw.split(',').map((s) => s.trim()).filter(Boolean);
+        if (parts.length > 0) {
+            const index = Math.max(0, parts.length - 1 - trustedProxies);
+            return parts[index] ?? parts[0];
+        }
+    }
+    return req.socket?.remoteAddress ?? 'unknown';
+}
+export class RateLimiter {
+    buckets = new Map();
+    limit;
+    windowMs;
+    maxEntries;
+    now;
+    lastPrune;
+    constructor(opts) {
+        this.limit = opts.limit;
+        this.windowMs = opts.windowMs ?? 60_000;
+        this.maxEntries = opts.maxEntries ?? 10_000;
+        this.now = opts.now ?? Date.now;
+        this.lastPrune = this.now();
+    }
+    get size() {
+        return this.buckets.size;
+    }
+    /** Counts one event for the key and says whether it stayed within the limit. */
+    hit(key) {
+        const now = this.now();
+        const bucket = this.bucket(key, now);
+        bucket.count += 1;
+        return this.verdict(bucket, bucket.count <= this.limit, now);
+    }
+    /** Whether the key is already at the limit, without counting anything. */
+    blocked(key) {
+        const now = this.now();
+        const existing = this.buckets.get(key);
+        if (!existing || now - existing.windowStart >= this.windowMs)
+            return { allowed: true, retryAfterSec: 0 };
+        return this.verdict(existing, existing.count < this.limit, now);
+    }
+    verdict(bucket, allowed, now) {
+        const retryAfterSec = allowed ? 0 : Math.max(1, Math.ceil((bucket.windowStart + this.windowMs - now) / 1000));
+        return { allowed, retryAfterSec };
+    }
+    bucket(key, now) {
+        if (now - this.lastPrune >= this.windowMs)
+            this.prune(now);
+        let bucket = this.buckets.get(key);
+        if (bucket && now - bucket.windowStart >= this.windowMs) {
+            bucket.windowStart = now;
+            bucket.count = 0;
+        }
+        if (!bucket) {
+            if (this.buckets.size >= this.maxEntries) {
+                const oldest = this.buckets.keys().next().value;
+                if (oldest !== undefined)
+                    this.buckets.delete(oldest);
+            }
+            bucket = { windowStart: now, count: 0 };
+            this.buckets.set(key, bucket);
+        }
+        return bucket;
+    }
+    prune(now) {
+        this.lastPrune = now;
+        for (const [key, bucket] of this.buckets) {
+            if (now - bucket.windowStart >= this.windowMs)
+                this.buckets.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=rateLimit.js.map

package/dist/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../src/rateLimit.ts"],"names":[],"mappings":"AAQA;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAgD,EAAE,cAAc,GAAG,CAAC;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AAChD,CAAC;AAqBD,MAAM,OAAO,WAAW;IACL,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,GAAG,CAAe;IAC3B,SAAS,CAAS;IAE1B,YAAY,IAAwB;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,gFAAgF;IAChF,GAAG,CAAC,GAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,0EAA0E;IAC1E,OAAO,CAAC,GAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,OAAgB,EAAE,GAAW;QAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC9G,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACpC,CAAC;IAEO,MAAM,CAAC,GAAW,EAAE,GAAW;QACrC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC;YACzB,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAChD,IAAI,MAAM,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF"}

package/dist/resources.d.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from "@modelcontextprotocol/server";
 import { type HonkioClient } from './client.js';
 export declare function registerResources(server: McpServer, client: HonkioClient): void;
 //# sourceMappingURL=resources.d.ts.map

package/dist/resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,aAAa,CAAC;AAE7D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAgH/E"}
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,aAAa,CAAC;AAE7D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAgH/E"}

package/dist/resources.js

@@ -1,7 +1,7 @@
 import { HonkioError } from './client.js';
 export function registerResources(server, client) {
     // honkio://messages — paginated list of messages
-    server.resource('messages', 'honkio://messages', { description: 'Recent SMS messages (up to 20)' }, async (uri) => {
+    server.registerResource('messages', 'honkio://messages', { description: 'Recent SMS messages (up to 20)' }, async (uri) => {
         try {
             const result = await client.listMessages({ limit: 20 });
             return {
@@ -24,7 +24,7 @@ export function registerResources(server, client) {
         }
     });
     // honkio://phone-numbers — list of provisioned numbers
-    server.resource('phone-numbers', 'honkio://phone-numbers', { description: 'Phone numbers provisioned on your account' }, async (uri) => {
+    server.registerResource('phone-numbers', 'honkio://phone-numbers', { description: 'Phone numbers provisioned on your account' }, async (uri) => {
         try {
             const result = await client.listPhoneNumbers();
             return {
@@ -47,7 +47,7 @@ export function registerResources(server, client) {
         }
     });
     // honkio://consents — active CASL consents
-    server.resource('consents', 'honkio://consents', { description: 'Active CASL consent records (up to 20)' }, async (uri) => {
+    server.registerResource('consents', 'honkio://consents', { description: 'Active CASL consent records (up to 20)' }, async (uri) => {
         try {
             const result = await client.listConsents({ status: 'ACTIVE', limit: 20 });
             return {
@@ -70,7 +70,7 @@ export function registerResources(server, client) {
         }
     });
     // honkio://webhooks — registered webhooks
-    server.resource('webhooks', 'honkio://webhooks', { description: 'Registered webhook endpoints for your account' }, async (uri) => {
+    server.registerResource('webhooks', 'honkio://webhooks', { description: 'Registered webhook endpoints for your account' }, async (uri) => {
         try {
             const result = await client.listWebhooks();
             return {

package/dist/resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAoB;IACvE,iDAAiD;IACjD,MAAM,CAAC,QAAQ,CACb,UAAU,EACV,mBAAmB,EACnB,EAAE,WAAW,EAAE,gCAAgC,EAAE,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,4BAA4B,OAAO,EAAE;qBAC5C,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uDAAuD;IACvD,MAAM,CAAC,QAAQ,CACb,eAAe,EACf,wBAAwB,EACxB,EAAE,WAAW,EAAE,2CAA2C,EAAE,EAC5D,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC/C,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,iCAAiC,OAAO,EAAE;qBACjD,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,2CAA2C;IAC3C,MAAM,CAAC,QAAQ,CACb,UAAU,EACV,mBAAmB,EACnB,EAAE,WAAW,EAAE,wCAAwC,EAAE,EACzD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,4BAA4B,OAAO,EAAE;qBAC5C,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,0CAA0C;IAC1C,MAAM,CAAC,QAAQ,CACb,UAAU,EACV,mBAAmB,EACnB,EAAE,WAAW,EAAE,+CAA+C,EAAE,EAChE,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3C,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,4BAA4B,OAAO,EAAE;qBAC5C,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAoB;IACvE,iDAAiD;IACjD,MAAM,CAAC,gBAAgB,CACrB,UAAU,EACV,mBAAmB,EACnB,EAAE,WAAW,EAAE,gCAAgC,EAAE,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,4BAA4B,OAAO,EAAE;qBAC5C,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uDAAuD;IACvD,MAAM,CAAC,gBAAgB,CACrB,eAAe,EACf,wBAAwB,EACxB,EAAE,WAAW,EAAE,2CAA2C,EAAE,EAC5D,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC/C,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,iCAAiC,OAAO,EAAE;qBACjD,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,2CAA2C;IAC3C,MAAM,CAAC,gBAAgB,CACrB,UAAU,EACV,mBAAmB,EACnB,EAAE,WAAW,EAAE,wCAAwC,EAAE,EACzD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,4BAA4B,OAAO,EAAE;qBAC5C,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,0CAA0C;IAC1C,MAAM,CAAC,gBAAgB,CACrB,UAAU,EACV,mBAAmB,EACnB,EAAE,WAAW,EAAE,+CAA+C,EAAE,EAChE,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3C,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,CAAC;wBACT,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,4BAA4B,OAAO,EAAE;qBAC5C,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,7 @@
+import { McpServer } from '@modelcontextprotocol/server';
+import type { HonkioClient } from './client.js';
+export declare const PACKAGE_VERSION: string;
+/** Sent to clients that surface server instructions (Gemini CLI, Claude). Plain facts an agent needs before its first call. */
+export declare const INSTRUCTIONS: string;
+export declare function buildServer(client: HonkioClient): McpServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAOhD,eAAO,MAAM,eAAe,EAAE,MAO1B,CAAC;AAKL,+HAA+H;AAC/H,eAAO,MAAM,YAAY,QAMd,CAAC;AAEZ,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAgB3D"}

package/dist/server.js

@@ -0,0 +1,46 @@
+/**
+ * One factory for every transport. The stdio bin and the HTTP entry both call
+ * buildServer, so the two can never advertise different tools.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+import { McpServer } from '@modelcontextprotocol/server';
+import { registerTools } from './tools.js';
+import { registerResources } from './resources.js';
+import { registerPrompts } from './prompts.js';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+export const PACKAGE_VERSION = (() => {
+    try {
+        const pkg = JSON.parse(readFileSync(resolve(__dirname, '../package.json'), 'utf8'));
+        return pkg.version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+})();
+/** Lists change only on a deploy; let clients keep them for five minutes. */
+const LIST_CACHE = { ttlMs: 5 * 60_000, cacheScope: 'private' };
+/** Sent to clients that surface server instructions (Gemini CLI, Claude). Plain facts an agent needs before its first call. */
+export const INSTRUCTIONS = [
+    'HonkIO is a Canadian SMS API. These tools act on the HonkIO account you signed in with, or whose API key you were configured with.',
+    'Keys starting with mk_test_ simulate everything for free: sends come back DELIVERED but nothing leaves the building and nothing is charged. Keys starting with mk_live_ send real SMS and spend real money.',
+    'Three tools spend money on a live key: send_sms and start_verification charge per SMS part, and provision_phone_number charges a first month plus a one-time activation fee and starts monthly rent. Call get_pricing for current figures, and confirm with the user before buying a number or sending to many recipients.',
+    'Commercial messages need CASL consent on file. Use check_consent before send_sms; record_consent stores express or implied consent. A refused send returns an error code such as NO_CONSENT, OPT_OUT_BLOCKED or DAILY_LIMIT_REACHED that explains what to fix.',
+    'Phone numbers are E.164 (+1 and ten digits). 555-XXXX exchanges are reserved and refused. Omit account_id on account tools; it is resolved from the key.',
+].join(' ');
+export function buildServer(client) {
+    const server = new McpServer({ name: 'honkio', version: PACKAGE_VERSION }, {
+        instructions: INSTRUCTIONS,
+        cacheHints: {
+            'tools/list': LIST_CACHE,
+            'prompts/list': LIST_CACHE,
+            'resources/list': LIST_CACHE,
+        },
+    });
+    registerTools(server, client);
+    registerResources(server, client);
+    registerPrompts(server);
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAW,CAAC,GAAG,EAAE;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC5G,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,6EAA6E;AAC7E,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,SAAS,EAAW,CAAC;AAEzE,+HAA+H;AAC/H,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,oIAAoI;IACpI,6MAA6M;IAC7M,4TAA4T;IAC5T,gQAAgQ;IAChQ,0JAA0J;CAC3J,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC9C,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,EAC5C;QACE,YAAY,EAAE,YAAY;QAC1B,UAAU,EAAE;YACV,YAAY,EAAE,UAAU;YACxB,cAAc,EAAE,UAAU;YAC1B,gBAAgB,EAAE,UAAU;SAC7B;KACF,CACF,CAAC;IACF,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/toolMeta.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Title and safety hints for every tool. Directory reviews (Anthropic, OpenAI)
+ * require them, and clients use the hints to decide when to ask the user
+ * before calling. Keep in step with tools.ts; tests/annotations.test.ts fails
+ * if a tool is missing here or here without a registration.
+ *
+ *   readOnlyHint     reads nothing changes
+ *   destructiveHint  cannot be undone (delete, revoke, release, erase)
+ *   idempotentHint   calling twice with the same arguments has no extra effect
+ *   openWorldHint    reaches a phone in the outside world; spends money on a live key
+ */
+import type { ToolAnnotations } from '@modelcontextprotocol/server';
+export interface ToolMeta {
+    title: string;
+    annotations: ToolAnnotations;
+}
+export declare const TOOL_META: Record<string, ToolMeta>;
+/** Metadata for a tool; throws at registration time so a missing entry cannot ship. */
+export declare function meta(name: string): ToolMeta;
+//# sourceMappingURL=toolMeta.d.ts.map

package/dist/toolMeta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolMeta.d.ts","sourceRoot":"","sources":["../src/toolMeta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,eAAe,CAAC;CAC9B;AAmBD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAkD9C,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAI3C"}

package/dist/toolMeta.js

@@ -0,0 +1,75 @@
+const read = (title) => ({
+    title,
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+});
+const write = (title, opts = {}) => ({
+    title,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: opts.idempotent ?? false, openWorldHint: false },
+});
+const destructive = (title) => ({
+    title,
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+});
+const reachesPhone = (title) => ({
+    title,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+});
+export const TOOL_META = {
+    // Messages
+    send_sms: reachesPhone('Send SMS'),
+    list_messages: read('List messages'),
+    get_message: read('Get message'),
+    // Phone numbers
+    search_phone_numbers: read('Search available numbers'),
+    provision_phone_number: reachesPhone('Buy phone number'),
+    list_phone_numbers: read('List phone numbers'),
+    get_phone_number: read('Get phone number'),
+    release_phone_number: destructive('Release phone number'),
+    // CASL compliance
+    record_consent: write('Record consent'),
+    list_consents: read('List consents'),
+    check_consent: read('Check consent'),
+    revoke_consent: destructive('Revoke consent'),
+    record_opt_out: write('Record opt-out', { idempotent: true }),
+    list_opt_outs: read('List opt-outs'),
+    check_dncl: read('Check Do Not Call List'),
+    batch_check_dncl: read('Batch check Do Not Call List'),
+    request_erasure: destructive('Erase subscriber data'),
+    // Pricing
+    get_pricing: read('Get pricing'),
+    // Verification
+    start_verification: reachesPhone('Start phone verification'),
+    check_verification: write('Check verification code'),
+    get_verification: read('Get verification'),
+    list_verifications: read('List verifications'),
+    // Webhooks
+    create_webhook: write('Create webhook'),
+    list_webhooks: read('List webhooks'),
+    update_webhook: write('Update webhook', { idempotent: true }),
+    delete_webhook: destructive('Delete webhook'),
+    list_webhook_deliveries: read('List webhook deliveries'),
+    reactivate_webhook: write('Reactivate webhook', { idempotent: true }),
+    list_webhook_dead_letters: read('List webhook dead letters'),
+    replay_webhook_dead_letter: write('Replay webhook dead letter'),
+    discard_webhook_dead_letter: destructive('Discard webhook dead letter'),
+    // Sending limits
+    get_send_limit: read('Get sending limits'),
+    request_send_limit: write('Request higher volume'),
+    get_topup_allowance: read('Get top-up allowance'),
+    // Account and keys
+    whoami: read('Who am I'),
+    get_account: read('Get account'),
+    update_account: write('Update account', { idempotent: true }),
+    get_usage: read('Get usage'),
+    create_api_key: write('Create API key'),
+    revoke_api_key: destructive('Revoke API key'),
+    rotate_api_key: destructive('Rotate API key'),
+};
+/** Metadata for a tool; throws at registration time so a missing entry cannot ship. */
+export function meta(name) {
+    const m = TOOL_META[name];
+    if (!m)
+        throw new Error(`No tool metadata for ${name}; add it to toolMeta.ts`);
+    return m;
+}
+//# sourceMappingURL=toolMeta.js.map

package/dist/toolMeta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolMeta.js","sourceRoot":"","sources":["../src/toolMeta.ts"],"names":[],"mappings":"AAkBA,MAAM,IAAI,GAAG,CAAC,KAAa,EAAY,EAAE,CAAC,CAAC;IACzC,KAAK;IACL,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;CACxG,CAAC,CAAC;AACH,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,OAAiC,EAAE,EAAY,EAAE,CAAC,CAAC;IAC/E,KAAK;IACL,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,IAAI,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;CAC7H,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,KAAa,EAAY,EAAE,CAAC,CAAC;IAChD,KAAK;IACL,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;CACxG,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,CAAC,KAAa,EAAY,EAAE,CAAC,CAAC;IACjD,KAAK;IACL,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;CACzG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,WAAW;IACX,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC;IAClC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;IACpC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,gBAAgB;IAChB,oBAAoB,EAAE,IAAI,CAAC,0BAA0B,CAAC;IACtD,sBAAsB,EAAE,YAAY,CAAC,kBAAkB,CAAC;IACxD,kBAAkB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC9C,gBAAgB,EAAE,IAAI,CAAC,kBAAkB,CAAC;IAC1C,oBAAoB,EAAE,WAAW,CAAC,sBAAsB,CAAC;IACzD,kBAAkB;IAClB,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC;IACvC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;IACpC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;IACpC,cAAc,EAAE,WAAW,CAAC,gBAAgB,CAAC;IAC7C,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7D,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,IAAI,CAAC,wBAAwB,CAAC;IAC1C,gBAAgB,EAAE,IAAI,CAAC,8BAA8B,CAAC;IACtD,eAAe,EAAE,WAAW,CAAC,uBAAuB,CAAC;IACrD,UAAU;IACV,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,eAAe;IACf,kBAAkB,EAAE,YAAY,CAAC,0BAA0B,CAAC;IAC5D,kBAAkB,EAAE,KAAK,CAAC,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,IAAI,CAAC,kBAAkB,CAAC;IAC1C,kBAAkB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC9C,WAAW;IACX,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC;IACvC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;IACpC,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7D,cAAc,EAAE,WAAW,CAAC,gBAAgB,CAAC;IAC7C,uBAAuB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACxD,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACrE,yBAAyB,EAAE,IAAI,CAAC,2BAA2B,CAAC;IAC5D,0BAA0B,EAAE,KAAK,CAAC,4BAA4B,CAAC;IAC/D,2BAA2B,EAAE,WAAW,CAAC,6BAA6B,CAAC;IACvE,iBAAiB;IACjB,cAAc,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,KAAK,CAAC,uBAAuB,CAAC;IAClD,mBAAmB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IACjD,mBAAmB;IACnB,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7D,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;IAC5B,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC;IACvC,cAAc,EAAE,WAAW,CAAC,gBAAgB,CAAC;IAC7C,cAAc,EAAE,WAAW,CAAC,gBAAgB,CAAC;CAC9C,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,yBAAyB,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/tools.d.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from "@modelcontextprotocol/server";
 import { type HonkioClient } from './client.js';
 export declare function registerTools(server: McpServer, client: HonkioClient): void;
 //# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,aAAa,CAAC;AA2C7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CA6vB3E"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,aAAa,CAAC;AA4C7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAwiB3E"}