@honkio/mcp 1.4.0 → 1.6.0

package/dist/http.js

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+/**
+ * HonkIO MCP server, hosted Streamable HTTP transport: what mcp.honkio.ca runs.
+ *
+ *   POST /mcp      the MCP endpoint (Origin check, then API-key gate, then MCP)
+ *   GET  /healthz  liveness for Railway
+ *
+ * Every request builds a fresh McpServer around a HonkioClient carrying the
+ * caller's key, so nothing is shared between callers and the process holds no
+ * session state. The verifier cache is the only thing that outlives a request.
+ */
+import { createServer } from 'node:http';
+import { pathToFileURL } from 'node:url';
+import { createMcpHandler } from '@modelcontextprotocol/server';
+import { toNodeHandler } from '@modelcontextprotocol/node';
+import { HonkioClient } from './client.js';
+import { buildServer, PACKAGE_VERSION } from './server.js';
+import { extractApiKey, KeyVerifier } from './auth.js';
+import { createLogger } from './log.js';
+import { clientIp, RateLimiter } from './rateLimit.js';
+const MAX_BODY_BYTES = 1_000_000;
+export const DEFAULT_REQUESTS_PER_MINUTE = 300;
+export const DEFAULT_FAILURES_PER_MINUTE = 10;
+/** Keep in step with api/src/services/oauth/scopes.ts. */
+export const SCOPES = [
+    'messages:read', 'messages:send', 'numbers:read', 'numbers:manage', 'compliance:read', 'compliance:write',
+    'verify', 'webhooks:read', 'webhooks:manage', 'account:read', 'account:manage',
+];
+const DEFAULT_SCOPE = SCOPES.filter((s) => s !== 'account:manage').join(' ');
+export const DEFAULT_PUBLIC_URL = 'https://mcp.honkio.ca/mcp';
+function sendJson(res, status, body, headers = {}) {
+    res.writeHead(status, { 'Content-Type': 'application/json', ...headers });
+    res.end(JSON.stringify(body));
+}
+class PayloadTooLarge extends Error {
+}
+function readBody(req, limit) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > limit) {
+                reject(new PayloadTooLarge());
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', reject);
+    });
+}
+function rpcShape(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return {};
+    const { method, params } = body;
+    const name = params?.name ?? params?.uri;
+    return {
+        method: typeof method === 'string' ? method : undefined,
+        name: typeof name === 'string' ? name : undefined,
+    };
+}
+export function createHttpServer(opts) {
+    const logger = opts.logger ?? createLogger();
+    const verifier = opts.verifier ?? new KeyVerifier({ apiBaseUrl: opts.apiBaseUrl, serviceKey: opts.serviceKey });
+    const publicUrl = opts.publicUrl ?? DEFAULT_PUBLIC_URL;
+    const resourceMetadata = {
+        resource: publicUrl,
+        authorization_servers: [opts.apiBaseUrl],
+        bearer_methods_supported: ['header'],
+        scopes_supported: [...SCOPES],
+        resource_documentation: 'https://honkio.ca/docs#mcp',
+    };
+    /** The metadata URL on the origin the caller actually used, so a test host and the public host both resolve. */
+    const metadataUrlFor = (req) => {
+        const proto = typeof req.headers['x-forwarded-proto'] === 'string' ? req.headers['x-forwarded-proto'] : 'http';
+        return `${proto}://${req.headers.host ?? 'localhost'}/.well-known/oauth-protected-resource/mcp`;
+    };
+    const challenge = (req, error) => `Bearer realm="honkio"${error ? `, error="${error}"` : ''}, resource_metadata="${metadataUrlFor(req)}", scope="${DEFAULT_SCOPE}"`;
+    const allowedOrigins = new Set(opts.allowedOrigins ?? []);
+    const requestsPerMinute = opts.rateLimit?.requestsPerMinute ?? DEFAULT_REQUESTS_PER_MINUTE;
+    const failuresPerMinute = opts.rateLimit?.failuresPerMinute ?? DEFAULT_FAILURES_PER_MINUTE;
+    const requests = new RateLimiter({ limit: requestsPerMinute });
+    const failures = new RateLimiter({ limit: failuresPerMinute });
+    const trustedProxies = opts.trustedProxies ?? 1;
+    const handler = createMcpHandler(({ authInfo }) => {
+        if (!authInfo)
+            throw new Error('MCP handler reached without authInfo; the gate must run first');
+        const extra = (authInfo.extra ?? {});
+        return buildServer(new HonkioClient({
+            apiKey: authInfo.token,
+            baseUrl: opts.apiBaseUrl,
+            accountId: extra.accountId,
+            serviceKey: extra.credential === 'token' ? opts.serviceKey : undefined,
+        }));
+    }, {
+        // Default responseMode ('auto'): a single JSON body unless a handler emits a
+        // notification first, which none of ours do. Forcing 'json' logs a warning on boot.
+        onerror: (err) => logger.error('mcp handler error', { error: err.message }),
+    });
+    const mcp = toNodeHandler(handler, {
+        onerror: (err) => logger.error('mcp adapter error', { error: err.message, stack: err.stack }),
+    });
+    /**
+     * A refusal before MCP is reached. Logged with its reason so abuse and
+     * misconfiguration are visible. When an address is given, the refusal also
+     * counts toward that address's failure budget.
+     */
+    function reject(res, status, reason, message, headers = {}, ip) {
+        if (ip && status !== 429)
+            failures.hit(ip);
+        logger.info('mcp rejected', { status, reason, ...(ip ? { ip, forwardedFor: res.req.headers['x-forwarded-for'] } : {}) });
+        sendJson(res, status, { error: reason, message }, headers);
+    }
+    async function route(req, res) {
+        const started = Date.now();
+        const path = (req.url ?? '/').split('?')[0];
+        if (path === '/healthz' && req.method === 'GET') {
+            return sendJson(res, 200, { ok: true, version: PACKAGE_VERSION });
+        }
+        if ((path === '/.well-known/oauth-protected-resource' || path === '/.well-known/oauth-protected-resource/mcp') && req.method === 'GET') {
+            return sendJson(res, 200, resourceMetadata, { 'Access-Control-Allow-Origin': '*', 'Cache-Control': 'public, max-age=300' });
+        }
+        if (path !== '/mcp') {
+            return sendJson(res, 404, { error: 'not_found', message: 'The MCP endpoint is POST /mcp.' });
+        }
+        if (req.method !== 'POST') {
+            return reject(res, 405, 'method_not_allowed', 'The MCP endpoint accepts POST only.', { Allow: 'POST' });
+        }
+        const ip = clientIp(req, trustedProxies);
+        const budget = requests.hit(ip);
+        if (!budget.allowed) {
+            return reject(res, 429, 'rate_limited', `More than ${requestsPerMinute} requests a minute from one address. Retry in ${budget.retryAfterSec} s.`, { 'Retry-After': String(budget.retryAfterSec) }, ip);
+        }
+        const lockout = failures.blocked(ip);
+        if (!lockout.allowed) {
+            return reject(res, 429, 'too_many_failures', `More than ${failuresPerMinute} refused requests a minute from one address. Retry in ${lockout.retryAfterSec} s.`, { 'Retry-After': String(lockout.retryAfterSec) }, ip);
+        }
+        const origin = req.headers.origin;
+        if (typeof origin === 'string' && !allowedOrigins.has(origin)) {
+            return reject(res, 403, 'origin_forbidden', `Origin ${origin} is not allowed to call this endpoint.`, {}, ip);
+        }
+        const key = extractApiKey(req.headers);
+        if (!key) {
+            return reject(res, 401, 'unauthorized', 'Send your HonkIO API key as "Authorization: Bearer mk_live_..." (or mk_test_...).', { 'WWW-Authenticate': challenge(req) }, ip);
+        }
+        const verdict = await verifier.verify(key);
+        if (verdict.status === 'invalid') {
+            return reject(res, 401, 'unauthorized', 'Invalid or revoked API key.', { 'WWW-Authenticate': challenge(req, 'invalid_token') }, ip);
+        }
+        if (verdict.status === 'unavailable') {
+            return reject(res, 503, 'api_unavailable', 'The HonkIO API could not verify the key. Retry shortly.');
+        }
+        let raw;
+        try {
+            raw = await readBody(req, MAX_BODY_BYTES);
+        }
+        catch (err) {
+            if (err instanceof PayloadTooLarge) {
+                return reject(res, 413, 'payload_too_large', 'The request body exceeds 1 MB.', {}, ip);
+            }
+            throw err;
+        }
+        let body;
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            return reject(res, 400, 'invalid_json', 'The request body must be a JSON-RPC message.', {}, ip);
+        }
+        const { method: mcpMethod, name: mcpName } = rpcShape(body);
+        res.on('finish', () => {
+            logger.info('mcp request', {
+                mcpMethod,
+                mcpName,
+                protocolVersion: req.headers['mcp-protocol-version'],
+                account: verdict.accountId,
+                mode: verdict.isTestMode ? 'test' : 'live',
+                status: res.statusCode,
+                ms: Date.now() - started,
+            });
+        });
+        req.auth = verdict.authInfo;
+        await mcp(req, res, body);
+    }
+    const server = createServer((req, res) => {
+        route(req, res).catch((err) => {
+            logger.error('unhandled request error', { error: err instanceof Error ? err.message : String(err) });
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal_error' });
+            else
+                res.end();
+        });
+    });
+    server.requestTimeout = 30_000;
+    return {
+        server,
+        close: async () => {
+            await handler.close();
+            await new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
+        },
+    };
+}
+export async function startHttpServer(opts) {
+    const handle = createHttpServer(opts);
+    const host = opts.host ?? '0.0.0.0';
+    await new Promise((resolve) => handle.server.listen(opts.port, host, resolve));
+    const { port } = handle.server.address();
+    const urlHost = host === '0.0.0.0' ? '127.0.0.1' : host;
+    return { url: `http://${urlHost}:${port}`, port, close: handle.close };
+}
+function main() {
+    const logger = createLogger();
+    const port = Number(process.env['PORT'] ?? 8080);
+    const apiBaseUrl = process.env['API_URL'] ?? process.env['HONKIO_API_URL'] ?? 'https://api.honkio.ca';
+    const allowedOrigins = (process.env['MCP_ALLOWED_ORIGINS'] ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    const positive = (raw, fallback) => {
+        const n = Number(raw);
+        return Number.isInteger(n) && n > 0 ? n : fallback;
+    };
+    const rateLimit = {
+        requestsPerMinute: positive(process.env['MCP_RATE_LIMIT_PER_MINUTE'], DEFAULT_REQUESTS_PER_MINUTE),
+        failuresPerMinute: positive(process.env['MCP_AUTH_FAILURES_PER_MINUTE'], DEFAULT_FAILURES_PER_MINUTE),
+    };
+    const trustedEnv = Number(process.env['MCP_TRUSTED_PROXIES']);
+    const trustedProxies = Number.isInteger(trustedEnv) && trustedEnv >= 0 ? trustedEnv : 1;
+    const publicUrl = process.env['MCP_PUBLIC_URL'] ?? DEFAULT_PUBLIC_URL;
+    const serviceKey = process.env['MCP_SERVICE_KEY'] || undefined;
+    void startHttpServer({ apiBaseUrl, allowedOrigins, logger, port, rateLimit, trustedProxies, publicUrl, serviceKey }).then((running) => {
+        logger.info('listening', { port: running.port, apiBaseUrl, allowedOrigins, rateLimit, trustedProxies, publicUrl, oauth: Boolean(serviceKey), version: PACKAGE_VERSION });
+        const shutdown = (signal) => {
+            logger.info('shutting down', { signal });
+            const force = setTimeout(() => process.exit(1), 10_000);
+            force.unref();
+            void running.close().then(() => process.exit(0));
+        };
+        process.on('SIGTERM', () => shutdown('SIGTERM'));
+        process.on('SIGINT', () => shutdown('SIGINT'));
+    });
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    main();
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAiB,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,YAAY,EAAe,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAkB9C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB;IACzG,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB;CACtE,CAAC;AACX,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAO9D,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,UAAkC,EAAE;IACxG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,eAAgB,SAAQ,KAAK;CAAG;AAEtC,SAAS,QAAQ,CAAC,GAAoB,EAAE,KAAa;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;gBAC9B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAwE,CAAC;IACpG,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,GAAG,CAAC;IACzC,OAAO;QACL,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACvD,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,gBAAgB,GAAG;QACvB,QAAQ,EAAE,SAAS;QACnB,qBAAqB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC;QAC7B,sBAAsB,EAAE,4BAA4B;KACrD,CAAC;IACF,gHAAgH;IAChH,MAAM,cAAc,GAAG,CAAC,GAAoB,EAAU,EAAE;QACtD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/G,OAAO,GAAG,KAAK,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,2CAA2C,CAAC;IAClG,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,GAAoB,EAAE,KAAc,EAAU,EAAE,CACjE,wBAAwB,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,cAAc,CAAC,GAAG,CAAC,aAAa,aAAa,GAAG,CAAC;IACpI,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,IAAI,2BAA2B,CAAC;IAC3F,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,IAAI,2BAA2B,CAAC;IAC3F,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;IAEhD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;QACf,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAgD,CAAC;QACpF,OAAO,WAAW,CAAC,IAAI,YAAY,CAAC;YAClC,MAAM,EAAE,QAAQ,CAAC,KAAK;YACtB,OAAO,EAAE,IAAI,CAAC,UAAU;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC,CAAC,CAAC;IACN,CAAC,EACD;QACE,6EAA6E;QAC7E,oFAAoF;QACpF,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;KAC5E,CACF,CAAC;IACF,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;KAC9F,CAAC,CAAC;IAEH;;;;OAIG;IACH,SAAS,MAAM,CACb,GAAmB,EACnB,MAAc,EACd,MAAc,EACd,OAAe,EACf,UAAkC,EAAE,EACpC,EAAW;QAEX,IAAI,EAAE,IAAI,MAAM,KAAK,GAAG;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5C,IAAI,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAChD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,KAAK,uCAAuC,IAAI,IAAI,KAAK,2CAA2C,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvI,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,6BAA6B,EAAE,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CACX,GAAG,EACH,GAAG,EACH,cAAc,EACd,aAAa,iBAAiB,iDAAiD,MAAM,CAAC,aAAa,KAAK,EACxG,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAC/C,EAAE,CACH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CACX,GAAG,EACH,GAAG,EACH,mBAAmB,EACnB,aAAa,iBAAiB,yDAAyD,OAAO,CAAC,aAAa,KAAK,EACjH,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAChD,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,MAAM,wCAAwC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,MAAM,CACX,GAAG,EACH,GAAG,EACH,cAAc,EACd,mFAAmF,EACnF,EAAE,kBAAkB,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EACtC,EAAE,CACH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,MAAM,CACX,GAAG,EACH,GAAG,EACH,cAAc,EACd,6BAA6B,EAC7B,EAAE,kBAAkB,EAAE,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EACvD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACnC,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,gCAAgC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,8CAA8C,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5D,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;gBACzB,SAAS;gBACT,OAAO;gBACP,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBACpD,OAAO,EAAE,OAAO,CAAC,SAAS;gBAC1B,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC1C,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEF,GAA6C,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;QACvE,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACrC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrG,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAE/B,OAAO;QACL,MAAM;QACN,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyD;IAEzD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACpC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAiB,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,OAAO,EAAE,GAAG,EAAE,UAAU,OAAO,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,IAAI;IACX,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,uBAAuB,CAAC;IACtG,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;SAC9D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,CAAC,GAAuB,EAAE,QAAgB,EAAE,EAAE;QAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrD,CAAC,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;QAClG,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,2BAA2B,CAAC;KACtG,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,kBAAkB,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IAE/D,KAAK,eAAe,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACpI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QACzK,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;YAClC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACxD,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,3 @@
 #!/usr/bin/env node
-/**
- * HonkIO MCP Server
- *
- * Exposes the HonkIO SMS API as an MCP server for AI coding agents.
- * Supports stdio transport (Claude Desktop, Cursor, VS Code, etc.)
- *
- * Usage:
- *   HONKIO_API_KEY=mk_live_... node dist/index.js
- */
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -1,56 +1,29 @@
 #!/usr/bin/env node
 /**
- * HonkIO MCP Server
+ * HonkIO MCP server, stdio transport: what `npx -y @honkio/mcp` runs inside
+ * Claude Code, Claude Desktop, Cursor and VS Code.
  *
- * Exposes the HonkIO SMS API as an MCP server for AI coding agents.
- * Supports stdio transport (Claude Desktop, Cursor, VS Code, etc.)
+ *   HONKIO_API_KEY=mk_test_... node dist/index.js
  *
- * Usage:
- *   HONKIO_API_KEY=mk_live_... node dist/index.js
+ * Diagnostics go to stderr; stdout is the protocol channel and must stay clean.
  */
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, resolve } from 'node:path';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
 import { HonkioClient } from './client.js';
-import { registerTools } from './tools.js';
-import { registerResources } from './resources.js';
-import { registerPrompts } from './prompts.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const PACKAGE_VERSION = (() => {
-    try {
-        const pkg = JSON.parse(readFileSync(resolve(__dirname, '../package.json'), 'utf8'));
-        return pkg.version ?? 'unknown';
-    }
-    catch {
-        return 'unknown';
-    }
-})();
-function getEnv(key) {
-    const val = process.env[key];
-    if (!val) {
-        console.error(`[honkio-mcp] Missing required environment variable: ${key}`);
-        process.exit(1);
-    }
-    return val;
+import { buildServer } from './server.js';
+const apiKey = process.env['HONKIO_API_KEY'];
+if (!apiKey) {
+    console.error('[honkio-mcp] Missing required environment variable: HONKIO_API_KEY');
+    process.exit(1);
 }
-async function main() {
-    const apiKey = getEnv('HONKIO_API_KEY');
-    const baseUrl = process.env['HONKIO_API_URL'] ?? 'https://api.honkio.ca';
-    const client = new HonkioClient({ apiKey, baseUrl });
-    const server = new McpServer({
-        name: 'honkio',
-        version: PACKAGE_VERSION,
+// HONKIO_API_URL is the pre-1.5 name; still honoured so existing local overrides keep working.
+const baseUrl = process.env['API_URL'] ?? process.env['HONKIO_API_URL'] ?? 'https://api.honkio.ca';
+const client = new HonkioClient({ apiKey, baseUrl });
+const handle = serveStdio(() => buildServer(client), {
+    onerror: (err) => console.error('[honkio-mcp]', err.message),
+});
+for (const signal of ['SIGINT', 'SIGTERM']) {
+    process.on(signal, () => {
+        void handle.close().finally(() => process.exit(0));
     });
-    registerTools(server, client);
-    registerResources(server, client);
-    registerPrompts(server);
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
 }
-main().catch((err) => {
-    console.error('[honkio-mcp] Fatal error:', err);
-    process.exit(1);
-});
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC5G,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,uDAAuD,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,uBAAuB,CAAC;IAEzE,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,eAAe;KACzB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;IACZ,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,+FAA+F;AAC/F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,uBAAuB,CAAC;AACnG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAErD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE;IACnD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC;CAC7D,CAAC,CAAC;AAEH,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,10 @@
+/** One JSON object per line on stdout. Used by the HTTP entry only; stdio must keep stdout for the protocol. */
+export type LogFields = Record<string, unknown>;
+export interface Logger {
+    info(msg: string, fields?: LogFields): void;
+    error(msg: string, fields?: LogFields): void;
+}
+export declare function createLogger(stream?: {
+    write(chunk: string): unknown;
+}): Logger;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5C,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAC9C;AAED,wBAAgB,YAAY,CAAC,MAAM,GAAE;IAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAmB,GAAG,MAAM,CAQ/F"}

package/dist/log.js

@@ -0,0 +1,10 @@
+export function createLogger(stream = process.stdout) {
+    const emit = (level, msg, fields) => {
+        stream.write(`${JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields })}\n`);
+    };
+    return {
+        info: (msg, fields) => emit('info', msg, fields),
+        error: (msg, fields) => emit('error', msg, fields),
+    };
+}
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,YAAY,CAAC,SAA4C,OAAO,CAAC,MAAM;IACrF,MAAM,IAAI,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAE,MAAkB,EAAE,EAAE;QACxE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QAChD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/dist/prompts.d.ts

@@ -1,3 +1,3 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from "@modelcontextprotocol/server";
 export declare function registerPrompts(server: McpServer): void;
 //# sourceMappingURL=prompts.d.ts.map

package/dist/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA0IvD"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAGzD,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiHvD"}

package/dist/prompts.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 export function registerPrompts(server) {
-    server.prompt('send_compliant_sms', 'Walk through the full compliant SMS send workflow: check CASL consent and send the message. (CRTC DNCL checking is coming soon and not yet enforced.)', {
-        phone_number: z.string().describe('Recipient phone number in E.164 format (+1 and ten digits). Use the real recipient: 555-XXXX exchanges are reserved and a live send to one is billed as a failure.'),
-        from_number: z.string().describe('Your sending phone number in E.164 format.'),
-        message: z.string().describe('The message body you want to send.'),
-    }, ({ phone_number, from_number, message }) => ({
+    server.registerPrompt('send_compliant_sms', { description: 'Walk through the full compliant SMS send workflow: check CASL consent and send the message. (CRTC DNCL checking is coming soon and not yet enforced.)', argsSchema: z.object({
+            phone_number: z.string().describe('Recipient phone number in E.164 format (+1 and ten digits). Use the real recipient: 555-XXXX exchanges are reserved and a send to one is refused.'),
+            from_number: z.string().describe('Your sending phone number in E.164 format.'),
+            message: z.string().describe('The message body you want to send.'),
+        }) }, ({ phone_number, from_number, message }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -26,9 +26,9 @@ Show me the result of each step.`,
                 },
             }],
     }));
-    server.prompt('provision_canadian_number', 'Search for and provision a Canadian phone number, optionally filtered by area code.', {
-        area_code: z.string().optional().describe('Preferred area code (e.g. "416" for Toronto, "604" for Vancouver). Leave blank to search all available Canadian numbers.'),
-    }, ({ area_code }) => ({
+    server.registerPrompt('provision_canadian_number', { description: 'Search for and provision a Canadian phone number, optionally filtered by area code.', argsSchema: z.object({
+            area_code: z.string().optional().describe('Preferred area code (e.g. "416" for Toronto, "604" for Vancouver). Leave blank to search all available Canadian numbers.'),
+        }) }, ({ area_code }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -44,9 +44,9 @@ Please:
                 },
             }],
     }));
-    server.prompt('setup_webhooks', 'Set up webhook endpoints to receive HonkIO event notifications.', {
-        url: z.string().describe('Your HTTPS endpoint URL that will receive webhook events.'),
-    }, ({ url }) => ({
+    server.registerPrompt('setup_webhooks', { description: 'Set up webhook endpoints to receive HonkIO event notifications.', argsSchema: z.object({
+            url: z.string().describe('Your HTTPS endpoint URL that will receive webhook events.'),
+        }) }, ({ url }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -61,14 +61,14 @@ Please:
    - message.received (to handle inbound SMS replies)
    - opt_out.recorded (to sync opt-outs to your CRM)
    - account.sending_paused and account.delivery_warning (to hear about a pause or a failure spike before customers do)
-3. Display the signing_secret from the response — remind me to store it securely as it won't be shown again. Explain that I should use it to verify the X-HonkIO-Signature header on incoming webhook requests.
+3. Display the signing_secret from the response: remind me to store it securely as it won't be shown again. Explain that I should use it to verify the X-HonkIO-Signature header on incoming webhook requests.
 4. If webhooks already exist, show me the existing ones and ask if I want to create an additional one or update an existing one.`,
                 },
             }],
     }));
-    server.prompt('compliance_audit', 'Run a compliance check on a phone number: consent status and opt-out status. (CRTC DNCL status is coming soon.)', {
-        phone_number: z.string().describe('Phone number to audit in E.164 format.'),
-    }, ({ phone_number }) => ({
+    server.registerPrompt('compliance_audit', { description: 'Run a compliance check on a phone number: consent status and opt-out status. (CRTC DNCL status is coming soon.)', argsSchema: z.object({
+            phone_number: z.string().describe('Phone number to audit in E.164 format.'),
+        }) }, ({ phone_number }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -76,8 +76,8 @@ Please:
                     text: `Please run a CASL compliance audit for the phone number: ${phone_number}
 
 Use these tools and summarize the results:
-1. \`check_consent\` — What is the consent status? Is it ACTIVE, EXPIRED, or missing?
-2. \`list_opt_outs\` with phone_number filter — Has this number opted out from any of my sending numbers?
+1. \`check_consent\`: What is the consent status? Is it ACTIVE, EXPIRED, or missing?
+2. \`list_opt_outs\` with phone_number filter: Has this number opted out from any of my sending numbers?
 (CRTC DNCL checking is coming soon and not yet available, so skip the DNCL lookup for now.)
 
 Summarize with:
@@ -87,10 +87,10 @@ Summarize with:
                 },
             }],
     }));
-    server.prompt('handle_erasure_request', 'Process a PIPEDA right-to-erasure request for a subscriber.', {
-        phone_number: z.string().describe('Phone number to erase data for in E.164 format.'),
-        reason: z.string().optional().describe('Reason provided by the subscriber for the erasure request.'),
-    }, ({ phone_number, reason }) => ({
+    server.registerPrompt('handle_erasure_request', { description: 'Process a PIPEDA right-to-erasure request for a subscriber.', argsSchema: z.object({
+            phone_number: z.string().describe('Phone number to erase data for in E.164 format.'),
+            reason: z.string().optional().describe('Reason provided by the subscriber for the erasure request.'),
+        }) }, ({ phone_number, reason }) => ({
         messages: [{
                 role: 'user',
                 content: {
@@ -101,10 +101,10 @@ Summarize with:
 ${reason ? `**Reason provided:** ${reason}` : ''}
 
 Please:
-1. Confirm with me before proceeding — this action is irreversible.
+1. Confirm with me before proceeding: this action is irreversible.
 2. If confirmed, use \`request_erasure\` to erase all personal data for this number.
 3. Show me the result including the erased_at timestamp.
-4. Explain what was erased (message bodies, consent records, opt-out records) and what is retained (message metadata and an immutable audit log entry for compliance).`,
+4. Explain what was erased (message bodies, consent records, verifications, contacts, non-DENY contact-list entries, and webhook dead letters referencing the number) and what is retained: message metadata, opt-out records (kept as required CASL compliance evidence, never erased), any DENY-list block on the number (kept so the number stays blocked), and an immutable audit log entry.`,
                 },
             }],
     }));

package/dist/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,MAAM,CAAC,MAAM,CACX,oBAAoB,EACpB,uJAAuJ,EACvJ;QACE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oKAAoK,CAAC;QACvM,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;KACnE,EACD,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;iBAEC,YAAY;YACjB,WAAW;eACR,OAAO;;;;;;;;;iCASW;iBACxB;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,2BAA2B,EAC3B,qFAAqF,EACrF;QACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0HAA0H,CAAC;KACtK,EACD,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oEAAoE,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE;;;2DAG1E,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;;;;oEAIxC;iBAC3D;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,gBAAgB,EAChB,iEAAiE,EACjE;QACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;KACtF,EACD,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,sFAAsF,GAAG;;;;;;;;;;;iIAWwB;iBACxH;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,kBAAkB,EAClB,iHAAiH,EACjH;QACE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;KAC5E,EACD,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,4DAA4D,YAAY;;;;;;;;;;sDAUlC;iBAC7C;aACF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,wBAAwB,EACxB,6DAA6D,EAC7D;QACE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;QACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;KACrG,EACD,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7B,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;oBAEI,YAAY;EAC9B,MAAM,CAAC,CAAC,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;;;;;;uKAMuH;iBAC9J;aACF,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,MAAM,CAAC,cAAc,CAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,uJAAuJ,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YAC7N,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mJAAmJ,CAAC;YACtL,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SACnE,CAAC,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;iBAEP,YAAY;YACjB,WAAW;eACR,OAAO;;;;;;;;;iCASW;iBAChB;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,qFAAqF,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YAClK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0HAA0H,CAAC;SACtK,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oEAAoE,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE;;;2DAGlF,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;;;;oEAIxC;iBACnD;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,iEAAiE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnI,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;SACtF,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,sFAAsF,GAAG;;;;;;;;;;;iIAWgB;iBAChH;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,iHAAiH,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACrL,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAC5E,CAAC,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,4DAA4D,YAAY;;;;;;;;;;sDAU1C;iBACrC;aACF,CAAC;KACH,CAAC,CAAC,CAAC;IAEd,MAAM,CAAC,cAAc,CAAC,wBAAwB,EAAE,EAAE,WAAW,EAAE,6DAA6D,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACvI,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;SACrG,CAAC,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;;oBAEJ,YAAY;EAC9B,MAAM,CAAC,CAAC,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;;;;;;iYAMiV;iBAChX;aACF,CAAC;KACH,CAAC,CAAC,CAAC;AAChB,CAAC"}

package/dist/rateLimit.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Per-address rate limiting for the hosted endpoint. Fixed one-minute
+ * windows in memory: the service runs as one replica, and the API behind it
+ * has its own per-key limits, so this only has to stop floods and key
+ * spraying from reaching the process and the API.
+ */
+import type { IncomingMessage } from 'node:http';
+/**
+ * The caller's address as seen through `trustedProxies` hops. Each trusted
+ * proxy appends its own address to X-Forwarded-For (Railway's edge appends
+ * one, verified 2026-09-05: a request arrives as "<client>, <edge>"), so the
+ * client is the entry that many places left of the right end. Anything a
+ * client writes into the header itself lands further left and is ignored.
+ * With fewer entries than hops (a local run with no proxy) the leftmost
+ * entry is used; with no header at all, the socket address.
+ */
+export declare function clientIp(req: Pick<IncomingMessage, 'headers' | 'socket'>, trustedProxies?: number): string;
+export interface RateLimiterOptions {
+    /** Events allowed per key per window. */
+    limit: number;
+    /** Window length. Default one minute. */
+    windowMs?: number;
+    /** Cap on tracked keys; the oldest is dropped past it. Default 10,000. */
+    maxEntries?: number;
+    /** Clock, injectable for tests. */
+    now?: () => number;
+}
+export interface RateLimitVerdict {
+    allowed: boolean;
+    /** Seconds until the window resets; what to send as Retry-After. */
+    retryAfterSec: number;
+}
+export declare class RateLimiter {
+    private readonly buckets;
+    private readonly limit;
+    private readonly windowMs;
+    private readonly maxEntries;
+    private readonly now;
+    private lastPrune;
+    constructor(opts: RateLimiterOptions);
+    get size(): number;
+    /** Counts one event for the key and says whether it stayed within the limit. */
+    hit(key: string): RateLimitVerdict;
+    /** Whether the key is already at the limit, without counting anything. */
+    blocked(key: string): RateLimitVerdict;
+    private verdict;
+    private bucket;
+    private prune;
+}
+//# sourceMappingURL=rateLimit.d.ts.map

package/dist/rateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../src/rateLimit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE,cAAc,SAAI,GAAG,MAAM,CAWrG;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,SAAS,CAAS;gBAEd,IAAI,EAAE,kBAAkB;IAQpC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,gFAAgF;IAChF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB;IAOlC,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB;IAOtC,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,MAAM;IAkBd,OAAO,CAAC,KAAK;CAMd"}