captchakraken-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,105 @@
+CaptchaKraken Source-Available License v1.0
+Copyright (c) 2026 JobHarvest / JWriter20. All rights reserved.
+
+This license governs use of the CaptchaKraken software in this repository and of
+the associated machine-learning model weights and LoRA adapters published by the
+copyright holder (collectively, the "Software"). By using the Software you agree
+to these terms. If you do not agree, do not use the Software.
+
+================================================================================
+1. GRANT
+================================================================================
+Subject to the restrictions below, you are granted a worldwide, royalty-free,
+non-exclusive license to use, copy, modify, and distribute the Software, and to
+incorporate it into your own products and services.
+
+================================================================================
+2. PERMITTED USES
+================================================================================
+You MAY use the Software for:
+
+  (a) Personal, non-commercial use, research, and education.
+
+  (b) Commercial use INSIDE a larger product or service that delivers
+      substantial value BEYOND captcha solving itself — that is, where captcha
+      solving is an internal, enabling component rather than the product.
+
+  Illustrative (non-exhaustive) examples of PERMITTED commercial use:
+      - Web scrapers and data-collection pipelines.
+      - Stealth / anti-detection browsers and browser automation frameworks
+        that use the Software as one internal capability.
+      - QA, testing, and accessibility tooling.
+      - Any application where the captcha solve is a means to an end the user
+        is actually paying for.
+
+================================================================================
+3. PROHIBITED USES
+================================================================================
+You MAY NOT, without a separate written commercial agreement from the copyright
+holder:
+
+  (a) Sell, resell, rent, or otherwise offer for a fee any captcha-SOLVING
+      service, product, or API whose primary value is solving captchas,
+      where that service is powered by the Software or its model outputs.
+
+  (b) Distribute "thin wrappers" around the Software whose primary purpose is
+      captcha solving — including but not limited to browser extensions,
+      hosted endpoints, SaaS products, or CLIs that simply expose the
+      Software's solving capability to end users.
+
+  (c) Expose, proxy, or relay the responses or outputs of the Software's LoRA
+      models (e.g. bounding boxes, tile selections, click plans) through a paid
+      or public API as a captcha-solving service.
+
+  In short: you may BUILD WITH this Software, but you may not SELL THE SOLVE.
+
+================================================================================
+4. MODEL OUTPUTS
+================================================================================
+Outputs produced by the model weights/adapters are subject to Sections 2 and 3
+to the same extent as the Software itself. Reselling or API-relaying those
+outputs as a captcha-solving service is prohibited under Section 3(c).
+
+================================================================================
+5. REDISTRIBUTION
+================================================================================
+If you redistribute the Software (modified or not), you must retain this license
+and this notice, and you must not remove or alter the restrictions in Section 3.
+
+================================================================================
+6. TRADEMARKS
+================================================================================
+This license does not grant permission to use the trade names, trademarks, or
+product names of the copyright holder, except as required to describe the origin
+of the Software.
+
+================================================================================
+7. NO WARRANTY
+================================================================================
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+8. RESPONSIBLE USE
+================================================================================
+You are responsible for ensuring your use of the Software complies with all
+applicable laws, the terms of service of any site you interact with, and
+applicable anti-fraud and computer-access statutes. The copyright holder does
+not endorse using the Software to violate any third party's terms or rights.
+
+================================================================================
+9. COMMERCIAL LICENSING
+================================================================================
+For uses prohibited under Section 3 — including selling captcha-solving as a
+service — contact the copyright holder to discuss a separate commercial license.
+
+--------------------------------------------------------------------------------
+This text is a license, not legal advice. If the boundary between a permitted
+"value-add" product and a prohibited "thin wrapper" is unclear for your use
+case, ask by opening an issue or messaging the maintainer on GitHub:
+https://github.com/JWriter20/CaptchaKraken
+--------------------------------------------------------------------------------

package/README.md

@@ -0,0 +1,118 @@
+# captchakraken-mcp
+
+The CaptchaKraken account, driven from an MCP client. It signs you in through
+GitHub, mints and revokes API keys for the solving endpoint, and reads back what
+you have spent.
+
+**It does not solve captchas.** The key it mints is what does that, against the
+OpenAI-compatible endpoint at `api.captchakraken.com/v1`.
+
+```bash
+claude mcp add captchakraken -- npx -y captchakraken-mcp
+```
+
+## Tools
+
+| Tool | What it does |
+| --- | --- |
+| `sign_in` | Prints a code and a link; the human approves in a browser. Creates the account if it does not exist, with trial credits and a first key. |
+| `sign_out` | Revokes this client's token on the server and deletes it from disk. |
+| `get_account` | Who is signed in, the balance, and the base URL to point a solver at. |
+| `get_balance` | The balance, and nothing else. |
+| `get_usage` | Billable responses and credits, per day and in total, plus purchases. |
+| `list_api_keys` | The account's solving keys, masked. |
+| `create_api_key` | Mints one and **saves it to disk; the secret is never shown.** |
+| `revoke_api_key` | Kills one by id. Effective within ~30 seconds. |
+| `get_topup_link` | A Stripe URL for the human to open. Charges nothing. |
+| `get_pricing` | The rate card, and how many responses a captcha typically takes. |
+| `get_models` | The lineup, so an agent can decide whether to self-host instead. |
+
+## Signing in
+
+The MCP server runs on a laptop, inside an editor, with no browser it controls
+and nowhere for an OAuth redirect to land. It also cannot hold our GitHub client
+secret — it is distributed to customers, so anything baked into it is public.
+
+So it uses the device flow (RFC 8628):
+
+```
+sign_in  ──▶  "Open http://…/device?code=ABCD-EFGH, code ABCD-EFGH"
+                    │
+                    ├─ the human opens it, signs in with GitHub, approves
+                    │
+sign_in  ──▶  "Signed in as <login>. Balance: $0.50"
+```
+
+`sign_in` waits about 25 seconds and then hands control back rather than
+blocking — MCP clients time tool calls out, and a call killed mid-wait would
+strand the code. **Calling it again resumes the same request**; it does not
+print a second code at a human who is already looking at the first.
+
+## Two credentials, two blast radii
+
+The token this server holds (`ckm_…`) manages the account: it reads the balance
+and usage, mints and revokes API keys, and opens a checkout page. **It cannot
+solve a captcha.**
+
+An API key (`ck_live_…`) solves captchas. **It cannot manage the account** — the
+account API returns 401 for one, exactly as it does for a random string.
+
+That split is the point. If they were one credential, a key leaked from a
+scraper could mint its own replacements faster than anyone could revoke them,
+and the balance would stop being a bound on the damage. Either can be revoked
+from the dashboard.
+
+Nothing here can spend money. `get_topup_link` returns a URL; a person clicks
+it, on a page Stripe hosts. There is no tool that charges a card.
+
+## Where the credentials live
+
+Two files, because they are two credentials.
+
+**The management token** (`ckm_…`) is in `~/.config/captchakraken/mcp.json`,
+mode 0600 in a 0700 directory, keyed by the control-plane origin — so
+rehearsing against a staging deployment and then running against production
+switches identity cleanly instead of presenting a staging token to production
+and 401ing with no explanation.
+
+**The solving key** (`ck_live_…`) is in `~/.captchakraken/credentials`, also
+0600, written by `create_api_key` and read by the solver itself. It carries the
+endpoint alongside the key, so after `create_api_key` a solve works with **no
+environment variables set at all**.
+
+The secret is never returned through a tool result. It goes straight to that
+file and the tool reports the path, because a key in a tool result is a key in
+the transcript the moment an agent repeats it back in a summary — and asking an
+agent nicely not to do that is not a control. If you need the key in an env var
+instead, read it out of the file yourself; nothing in this server will print it.
+
+It is not encrypted. A local secret encrypted with a local key is ceremony, not
+protection: whoever can read the file can read the key. The real defences are
+the file mode, the token's one-year expiry, and the dashboard's disconnect
+button.
+
+Delete the file to forget everything, or run `sign_out`, which also revokes the
+token server-side. Prefer `sign_out` — deleting the file alone leaves a live
+credential that nothing can reach to revoke.
+
+## Configuration
+
+| Variable | Default | Why |
+| --- | --- | --- |
+| `CAPTCHAKRAKEN_BASE_URL` | `https://captchakraken.com` | Point at a staging or self-hosted control plane. |
+| `CAPTCHAKRAKEN_CLIENT_NAME` | `MCP client` | Shown on the approval page. A person approving a code should see something they recognise. |
+
+## Development
+
+```bash
+npm install
+npm run typecheck
+npm run build
+CAPTCHAKRAKEN_BASE_URL=http://127.0.0.1:3000 node dist/index.js
+```
+
+The server it talks to is `captchakraken-cloud`; the endpoints are documented in
+that package's README under **The MCP surface**, and covered by
+`test/mcp-api.test.ts` there. Nothing on stdout but MCP frames — stdout *is* the
+protocol channel on this transport, and one stray `console.log` corrupts the
+stream and presents as a broken server.

package/dist/api.js

@@ -0,0 +1,108 @@
+/**
+ * The HTTP client for `/api/v1` on the control plane.
+ *
+ * ONE PLACE THAT TALKS TO THE NETWORK, so the timeout, the error shape and the
+ * "your token stopped working" case are decided once. Every tool in server.ts
+ * goes through here and none of them calls `fetch`.
+ *
+ * ERRORS ARE THROWN AS `ApiError` WITH THE SERVER'S CODE INTACT. The control
+ * plane deliberately returns a stable `error` string and a human `message`; the
+ * message is what an agent shows a person, and the code is what the tools
+ * branch on. Flattening them into one string would mean parsing English to
+ * decide whether to prompt for a sign-in.
+ */
+import { loadCredential, saveCredential } from './credentials.js';
+/** Every request gets this long. A hung control plane must not hang the editor. */
+const TIMEOUT_MS = 20_000;
+export class ApiError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'ApiError';
+        this.status = status;
+        this.code = code;
+    }
+}
+export class ControlPlane {
+    baseUrl;
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl.replace(/\/$/, '');
+    }
+    async request(path, options = {}) {
+        const { method = 'GET', body, authenticated = true } = options;
+        const headers = {
+            accept: 'application/json',
+            // Named so a support conversation can tell an MCP client apart from curl
+            // in an access log. It carries no authority.
+            'user-agent': 'captchakraken-mcp',
+        };
+        if (body !== undefined)
+            headers['content-type'] = 'application/json';
+        if (authenticated) {
+            const credential = loadCredential(this.baseUrl);
+            if (!credential.accessToken) {
+                throw new ApiError(401, 'not_signed_in', 'Not signed in. Run the sign_in tool first.');
+            }
+            headers.authorization = `Bearer ${credential.accessToken}`;
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+        let response;
+        try {
+            response = await fetch(`${this.baseUrl}${path}`, {
+                method,
+                headers,
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: controller.signal,
+            });
+        }
+        catch (error) {
+            // A DNS failure, a refused connection and our own abort all land here, and
+            // they mean the same thing to the person reading it: we could not reach
+            // the service. The cause is included because "which one" is the first
+            // thing anyone debugging asks.
+            throw new ApiError(0, 'network_error', `Could not reach ${this.baseUrl}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const payload = await readJson(response);
+        if (!response.ok) {
+            const code = typeof payload?.error === 'string' ? payload.error : `http_${response.status}`;
+            const message = typeof payload?.message === 'string'
+                ? payload.message
+                : `${this.baseUrl}${path} returned ${response.status}`;
+            /*
+             * A 401 on an authenticated call means the token we hold is dead —
+             * revoked from the dashboard, expired, or from a deployment this is no
+             * longer pointed at. Dropping it here is what turns the next `sign_in`
+             * into a clean new flow instead of a confusing "already signed in".
+             *
+             * Only on authenticated calls: the device endpoints answer 400/401 for
+             * reasons that have nothing to do with a stored token.
+             */
+            if (response.status === 401 && authenticated) {
+                const credential = loadCredential(this.baseUrl);
+                delete credential.accessToken;
+                delete credential.expiresAt;
+                saveCredential(this.baseUrl, credential);
+            }
+            throw new ApiError(response.status, code, message);
+        }
+        return payload;
+    }
+}
+async function readJson(response) {
+    try {
+        const parsed = await response.json();
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        // An HTML error page from a proxy in front of the app, most likely. The
+        // caller turns this into "returned <status>", which is more use than a JSON
+        // parse error nobody can act on.
+        return null;
+    }
+}
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElE,mFAAmF;AACnF,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,MAAM,CAAS;IACf,IAAI,CAAS;IAEtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AASD,MAAM,OAAO,YAAY;IACd,OAAO,CAAS;IAEzB,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,UAAsB,EAAE;QACrD,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QAE/D,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,yEAAyE;YACzE,6CAA6C;YAC7C,YAAY,EAAE,mBAAmB;SAClC,CAAC;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAErE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,4CAA4C,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,CAAC,aAAa,GAAG,UAAU,UAAU,CAAC,WAAW,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAE/D,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC/C,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2EAA2E;YAC3E,wEAAwE;YACxE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAM,IAAI,QAAQ,CAChB,CAAC,EACD,eAAe,EACf,mBAAmB,IAAI,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5F,MAAM,OAAO,GACX,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ;gBAClC,CAAC,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;YAE3D;;;;;;;;eAQG;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAC;gBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAChD,OAAO,UAAU,CAAC,WAAW,CAAC;gBAC9B,OAAO,UAAU,CAAC,SAAS,CAAC;gBAC5B,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,OAAY,CAAC;IACtB,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,4EAA4E;QAC5E,iCAAiC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/credentials.js

@@ -0,0 +1,163 @@
+/**
+ * Where the token lives on disk.
+ *
+ * THIS FILE IS A CREDENTIAL, and it is written with that in mind: the directory
+ * is 0700, the file is 0600, and it is created with those modes rather than
+ * chmod'ed afterwards — a file that is briefly world-readable on a shared box is
+ * a file that was world-readable.
+ *
+ * IT IS KEYED BY BASE URL. Someone rehearsing against dev.captchakraken.com and
+ * then running against production must not have the dev token silently
+ * presented to production, where it is not a token at all and every call 401s
+ * with no explanation. So the store is a map from origin to what we hold for it,
+ * and switching `CAPTCHAKRAKEN_BASE_URL` switches identity cleanly.
+ *
+ * NOTHING HERE IS ENCRYPTED. A local secret encrypted with a local key is
+ * ceremony, not protection — whoever can read the file can read the key. The
+ * real defences are the file mode, the token's one-year expiry, and the
+ * dashboard's disconnect button.
+ */
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+function configPath() {
+    // XDG first, because someone who has set it has done so on purpose. The
+    // fallback is ~/.config on every platform rather than %APPDATA% on Windows —
+    // one path is easier to tell a person to delete than three.
+    const base = process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), '.config');
+    return join(base, 'captchakraken', 'mcp.json');
+}
+function readStore() {
+    try {
+        const parsed = JSON.parse(readFileSync(configPath(), 'utf8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        // Missing, empty, or corrupt all mean the same thing to every caller: we
+        // hold nothing for this origin, so sign in. Refusing to start because the
+        // file has a stray comma would strand someone with no obvious way out.
+        return {};
+    }
+}
+function writeStore(store) {
+    const path = configPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    /*
+     * Write-then-rename, so a crash mid-write cannot leave a truncated file where
+     * a valid one was — the failure that would cost someone their token for no
+     * reason. The temporary file is created 0600 so the secret is never on disk
+     * under a laxer mode, even for the instant before the rename.
+     */
+    const temporary = `${path}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(store, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temporary, path);
+    // renameSync preserves the temporary file's mode, but an existing file's mode
+    // wins on some filesystems. Cheap to be sure.
+    chmodSync(path, 0o600);
+}
+export function credentialPath() {
+    return configPath();
+}
+/*
+ * ───────────────────────────────────────────────────────────────────────────
+ * The solver credential — a SECOND, deliberately separate store.
+ *
+ * Two credentials exist and they must never meet:
+ *
+ *   ckm_…      management token. Talks to the control plane's /api/v1. Lives in
+ *              mcp.json, above. Can mint and revoke keys.
+ *   ck_live_…  inference key. Talks to the gateway. Lives here. Can spend money
+ *              but cannot mint anything.
+ *
+ * Keeping them in one file would mean whatever reads the solver key at solve
+ * time is also holding a token that can issue more keys — a strictly worse
+ * blast radius for no gain. So this is a separate file in a separate directory,
+ * and the only thing that crosses between them is that `create_api_key` writes
+ * this one as a side effect.
+ *
+ * WHY A FILE AT ALL: `create_api_key` used to return the secret in its tool
+ * result, which puts a live inference key into the agent transcript — the
+ * exact thing this handoff exists to prevent. The key goes to disk at 0600 and
+ * the agent is told the path.
+ *
+ * The Python client reads this in `config.py` (`_read_credentials_file`), which
+ * accepts either name for each value; the env-file form is used because it is
+ * also directly `source`-able by a human.
+ * ───────────────────────────────────────────────────────────────────────────
+ */
+/**
+ * Where the solver looks for its key.
+ *
+ * `CAPTCHA_KRAKEN_STATE_DIR` is honoured because the Python client honours it —
+ * if the two disagreed, someone who had redirected their state dir would get a
+ * file written where nothing reads it and a 401 with no explanation.
+ */
+export function solverCredentialPath() {
+    const stateDir = process.env.CAPTCHA_KRAKEN_STATE_DIR?.trim() || join(homedir(), '.captchakraken');
+    return join(stateDir, 'credentials');
+}
+/**
+ * Write the inference key and its endpoint where the solver will find them.
+ *
+ * The endpoint travels WITH the key on purpose: a hosted user who has never run
+ * vLLM has no reason to know what `VLLM_BASE_URL` is, and a key without an
+ * endpoint authenticates flawlessly against a local port with nothing behind
+ * it. Writing both means signup configures the solve path completely.
+ *
+ * Returns the path, which is what the caller reports in place of the secret.
+ */
+export function writeSolverCredential(options) {
+    const path = solverCredentialPath();
+    // 0700 on the directory, created with the mode rather than chmod'ed into it:
+    // a directory that is briefly world-readable is a directory that was
+    // world-readable, and the file inside it is a live credential.
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const lines = [
+        '# CaptchaKraken inference key — written by captchakraken-mcp.',
+        '# Keep this file private (0600). Revoke the key from the dashboard or the',
+        '# MCP `revoke_api_key` tool if it is ever exposed.',
+        `CAPTCHA_KRAKEN_API_KEY=${options.apiKey}`,
+    ];
+    if (options.baseUrl)
+        lines.push(`VLLM_BASE_URL=${options.baseUrl}`);
+    // Write-then-rename through a 0600 temp file, so a crash mid-write cannot
+    // leave a truncated credential where a valid one was.
+    const temporary = `${path}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${lines.join('\n')}\n`, { mode: 0o600 });
+    renameSync(temporary, path);
+    // renameSync preserves the temp file's mode, but an existing file's mode wins
+    // on some filesystems — and this path is very likely to already exist, since
+    // minting a second key overwrites the first. Cheap to be sure.
+    chmodSync(path, 0o600);
+    return path;
+}
+export function loadCredential(baseUrl) {
+    return readStore()[baseUrl] ?? {};
+}
+export function saveCredential(baseUrl, credential) {
+    const store = readStore();
+    store[baseUrl] = credential;
+    writeStore(store);
+}
+export function clearCredential(baseUrl) {
+    const store = readStore();
+    delete store[baseUrl];
+    writeStore(store);
+}
+/**
+ * Is there a token, and is it still in date?
+ *
+ * The expiry is checked locally as a courtesy — the server checks it too, and
+ * the server is the one that decides. This exists so `sign_in` can say "your
+ * token expired" instead of the agent discovering it through a 401 on whatever
+ * it was actually trying to do.
+ */
+export function hasLiveToken(credential) {
+    if (!credential.accessToken)
+        return false;
+    if (!credential.expiresAt)
+        return true;
+    const expiry = Date.parse(credential.expiresAt);
+    return Number.isNaN(expiry) || expiry > Date.now();
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA6B1C,SAAS,UAAU;IACjB,wEAAwE;IACxE,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAY;IAC9B,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D;;;;;OAKG;IACH,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5B,8EAA8E;IAC9E,8CAA8C;IAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IAEpC,6EAA6E;IAC7E,qEAAqE;IACrE,+DAA+D;IAC/D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG;QACZ,+DAA+D;QAC/D,2EAA2E;QAC3E,oDAAoD;QACpD,0BAA0B,OAAO,CAAC,MAAM,EAAE;KAC3C,CAAC;IACF,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpE,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,aAAa,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5B,8EAA8E;IAC9E,6EAA6E;IAC7E,+DAA+D;IAC/D,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,UAAsB;IACpE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC;IAC5B,UAAU,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACtB,UAAU,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,UAAsB;IACjD,IAAI,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC"}

package/dist/index.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+/**
+ * The entry point. Stdio transport, because that is what an editor speaks.
+ *
+ * NOTHING MAY BE WRITTEN TO STDOUT except MCP frames. Stdout *is* the protocol
+ * channel on this transport, and one stray `console.log` — a debug line, a
+ * deprecation notice, a banner — corrupts the stream and the client reports the
+ * server as broken rather than as chatty. Every diagnostic in this package goes
+ * to stderr, which the client shows in its logs.
+ */
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createServer } from './server.js';
+/**
+ * Which deployment to talk to.
+ *
+ * Overridable so the same package can be pointed at a staging box, and so a
+ * self-hosted control plane is a configuration line rather than a fork. The
+ * default is production, because that is what `npx captchakraken-mcp` with no
+ * arguments should mean.
+ */
+const BASE_URL = (process.env.CAPTCHAKRAKEN_BASE_URL ?? 'https://captchakraken.com').replace(/\/$/, '');
+/**
+ * What the approval page calls this client.
+ *
+ * A person approving a code should see something they recognise, and "the thing
+ * I am typing in" is more recognisable than "captchakraken-mcp". Editors that
+ * set this are rare, so the fallback matters more than the variable.
+ */
+const CLIENT_NAME = process.env.CAPTCHAKRAKEN_CLIENT_NAME?.trim() || 'MCP client';
+async function main() {
+    const server = createServer(BASE_URL, CLIENT_NAME);
+    await server.connect(new StdioServerTransport());
+    console.error(`[captchakraken-mcp] connected, talking to ${BASE_URL}`);
+}
+main().catch((error) => {
+    console.error('[captchakraken-mcp] fatal:', error instanceof Error ? error.stack : error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAC1F,KAAK,EACL,EAAE,CACH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;AAEhE,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/server.js

@@ -0,0 +1,518 @@
+/**
+ * The tools.
+ *
+ * WHAT THIS SERVER IS FOR: letting an agent provision and watch its own captcha
+ * solving. Sign the human in, mint a key for the Abyss model, report what has
+ * been spent, and hand over a payment link when the balance runs low. It does
+ * not solve captchas — that is the gateway's OpenAI-compatible endpoint, and
+ * the key minted here is what talks to it.
+ *
+ * TWO RULES SHAPE EVERY TOOL BELOW.
+ *
+ *  1. NOTHING SPENDS MONEY WITHOUT A HUMAN. `get_topup_link` returns a URL. It
+ *     does not charge a card, and there is no tool that can. An agent may
+ *     *offer* to spend; a person clicks.
+ *
+ *  2. NO TOOL OUTPUT EVER CONTAINS A LIVE CREDENTIAL. `create_api_key` writes
+ *     the minted key straight to a 0600 file and reports the PATH; the solver
+ *     reads it from there. Returning the secret — which this tool used to do —
+ *     puts it in the transcript the moment an agent repeats it in a summary,
+ *     and asking the agent nicely not to is not a control. The management
+ *     token obtained by `sign_in` is likewise written to disk and never
+ *     printed.
+ *
+ * Read-only tools are annotated as such so a client can decide what needs
+ * confirming. `create_api_key` and `revoke_api_key` are not read-only and are
+ * marked destructive where they are.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { ApiError, ControlPlane } from './api.js';
+import { clearCredential, credentialPath, hasLiveToken, loadCredential, saveCredential, solverCredentialPath, writeSolverCredential, } from './credentials.js';
+/**
+ * How long `sign_in` waits before handing control back.
+ *
+ * Deliberately short. MCP clients time tool calls out — 60 seconds is a common
+ * default — and a sign-in that blocks for two minutes gets killed with the
+ * device code stranded. So this polls for well under any of them, then returns
+ * "still waiting, call me again", and the pending code is on disk so the next
+ * call resumes the same flow rather than printing a second code at a human who
+ * is already looking at the first one.
+ */
+const SIGN_IN_WAIT_MS = 25_000;
+function text(body) {
+    return { content: [{ type: 'text', text: body }] };
+}
+function failure(body) {
+    return { content: [{ type: 'text', text: body }], isError: true };
+}
+/**
+ * Turn a thrown ApiError into something an agent can act on.
+ *
+ * `not_signed_in` gets the instruction rather than the raw message, because it
+ * is the one failure with an obvious next step and an agent that is told the
+ * step will take it instead of reporting an error to the human.
+ */
+function describe(error) {
+    if (error instanceof ApiError) {
+        if (error.code === 'not_signed_in' || error.status === 401) {
+            return failure('Not signed in to CaptchaKraken. Run the `sign_in` tool first.');
+        }
+        return failure(`${error.code}: ${error.message}`);
+    }
+    return failure(error instanceof Error ? error.message : String(error));
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export function createServer(baseUrl, clientName) {
+    const api = new ControlPlane(baseUrl);
+    const server = new McpServer({ name: 'captchakraken', version: '0.1.0' }, {
+        instructions: 'CaptchaKraken account management. Use sign_in once to connect a GitHub account, ' +
+            'create_api_key to get a key for the captcha-solving endpoint, and get_usage / ' +
+            'get_balance to see what has been spent. This server does not solve captchas itself — ' +
+            'the key it mints is used against the OpenAI-compatible endpoint reported by get_account.',
+    });
+    // ── signing in ────────────────────────────────────────────────────────────
+    server.registerTool('sign_in', {
+        title: 'Sign in to CaptchaKraken',
+        description: 'Connect a CaptchaKraken account using GitHub, creating one if it does not exist. ' +
+            'Prints a short code and a link for the human to approve in a browser, then waits ' +
+            'briefly. If it returns still-waiting, call it again to resume the same sign-in — it ' +
+            'will not start a second one. New accounts get free trial credits and a first API key.',
+        inputSchema: {
+            client_name: z
+                .string()
+                .optional()
+                .describe('Name shown on the approval page, e.g. the editor this is running in.'),
+        },
+        annotations: { title: 'Sign in to CaptchaKraken', openWorldHint: true },
+    }, async ({ client_name }) => {
+        try {
+            const credential = loadCredential(baseUrl);
+            if (hasLiveToken(credential)) {
+                const who = credential.account?.githubLogin ?? `account ${credential.account?.userId}`;
+                return text(`Already signed in as ${who} on ${baseUrl}.\n` +
+                    'Run `sign_out` first if you want to connect a different account.');
+            }
+            // Resume a code that is still live rather than printing a second one at
+            // a human who is already looking at the first.
+            let pending = credential.pending;
+            if (!pending || pending.expiresAtMs <= Date.now()) {
+                const started = await api.request('/api/v1/device/start', {
+                    method: 'POST',
+                    authenticated: false,
+                    body: { client_name: client_name ?? clientName },
+                });
+                pending = {
+                    deviceCode: started.device_code,
+                    userCode: started.user_code,
+                    verificationUri: started.verification_uri,
+                    verificationUriComplete: started.verification_uri_complete,
+                    expiresAtMs: Date.now() + started.expires_in * 1000,
+                    intervalSeconds: started.interval,
+                };
+                saveCredential(baseUrl, { ...credential, pending });
+            }
+            const outcome = await pollForToken(api, pending);
+            if (outcome.kind === 'granted') {
+                saveCredential(baseUrl, {
+                    accessToken: outcome.grant.access_token,
+                    expiresAt: outcome.grant.expires_at,
+                    account: {
+                        userId: outcome.grant.account.user_id,
+                        githubLogin: outcome.grant.account.github_login,
+                        email: outcome.grant.account.email,
+                    },
+                });
+                const who = outcome.grant.account.github_login ?? `account ${outcome.grant.account.user_id}`;
+                return text(`Signed in as ${who}.\n` +
+                    `Balance: ${outcome.grant.account.balance_usd} (${outcome.grant.account.balance_credits.toLocaleString('en-US')} credits).\n` +
+                    `The token is stored at ${credentialPath()} and can be revoked from the dashboard at any time.\n\n` +
+                    'Next: `create_api_key` mints a key for the solving endpoint.');
+            }
+            if (outcome.kind === 'waiting') {
+                return text(`Waiting for approval.\n\n` +
+                    `  Open:  ${pending.verificationUriComplete}\n` +
+                    `  Code:  ${pending.userCode}\n\n` +
+                    'Ask the human to open that link and approve the code. Then call `sign_in` again ' +
+                    'to resume — it will pick up this same request, not start a new one.');
+            }
+            // Denied or dead. Drop the pending code so the next call starts clean.
+            const { pending: _dropped, ...withoutPending } = credential;
+            saveCredential(baseUrl, withoutPending);
+            return failure(outcome.kind === 'denied'
+                ? 'The sign-in was declined in the browser. Nothing was connected.'
+                : 'That sign-in code expired or was already used. Call `sign_in` again for a new one.');
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    server.registerTool('sign_out', {
+        title: 'Sign out',
+        description: 'Revoke this client’s access token on the server and delete it from disk. API keys ' +
+            'already minted keep working — this disconnects the management client, not the solving.',
+        annotations: { title: 'Sign out', destructiveHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            // Revoke server-side first. If that fails we still have the token, and
+            // deleting it locally would leave a live credential nobody can reach to
+            // revoke — the file is the only copy of it.
+            await api.request('/api/v1/signout', { method: 'POST' });
+            clearCredential(baseUrl);
+            return text('Signed out. The token has been revoked on the server and removed from disk.');
+        }
+        catch (error) {
+            if (error instanceof ApiError && (error.status === 401 || error.code === 'not_signed_in')) {
+                clearCredential(baseUrl);
+                return text('There was no live token. Local state cleared.');
+            }
+            return describe(error);
+        }
+    });
+    // ── the account ───────────────────────────────────────────────────────────
+    server.registerTool('get_account', {
+        title: 'Account and endpoint',
+        description: 'Who is signed in, the credit balance, and the base URL to point an OpenAI-compatible ' +
+            'client at for solving.',
+        annotations: { title: 'Account and endpoint', readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            const me = await api.request('/api/v1/me');
+            const lines = [
+                `Account:   ${me.account.github_login ?? `#${me.account.user_id}`}`,
+                `Email:     ${me.account.email ?? '(none on file)'}`,
+                `Balance:   ${me.account.balance_usd} (${me.account.balance_credits.toLocaleString('en-US')} credits)`,
+                `Endpoint:  ${me.endpoint.base_url}`,
+                `Dashboard: ${me.endpoint.dashboard_url}`,
+            ];
+            if (me.account.low_balance) {
+                lines.push('', 'Balance is low. `get_topup_link` returns a payment link for the human.');
+            }
+            if (me.endpoint.requires_dev_header) {
+                lines.push('', 'This is a development deployment: its gateway also requires the shared X-CK-Dev-Auth header in front of the key.');
+            }
+            return text(lines.join('\n'));
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    server.registerTool('get_balance', {
+        title: 'Credit balance',
+        description: 'The remaining credit balance, in credits and in dollars. Nothing else.',
+        annotations: { title: 'Credit balance', readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            const me = await api.request('/api/v1/me');
+            return text(`${me.account.balance_usd} (${me.account.balance_credits.toLocaleString('en-US')} credits)` +
+                (me.account.low_balance ? ' — low' : ''));
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    server.registerTool('get_usage', {
+        title: 'Usage and spending',
+        description: 'Billable inference responses and credits spent, per day and in total, plus recent ' +
+            'purchases. The server keeps a rolling 30-day window; `days` narrows what is reported.',
+        inputSchema: {
+            days: z
+                .number()
+                .int()
+                .min(1)
+                .max(30)
+                .optional()
+                .describe('How many of the last 30 days to report. Defaults to all 30.'),
+        },
+        annotations: { title: 'Usage and spending', readOnlyHint: true, openWorldHint: true },
+    }, async ({ days }) => {
+        try {
+            const usage = await api.request('/api/v1/usage');
+            // Sliced here rather than asked for: the window is fixed server-side
+            // because that is what makes the read cheap. See the note on the route.
+            const window = days ?? usage.window_days;
+            const daily = usage.daily.slice(-window);
+            const credits = daily.reduce((sum, day) => sum + day.credits, 0);
+            const rounds = daily.reduce((sum, day) => sum + day.billable_rounds, 0);
+            const lines = [
+                `Last ${window} day${window === 1 ? '' : 's'}:`,
+                `  ${rounds.toLocaleString('en-US')} billable responses`,
+                `  ${credits.toLocaleString('en-US')} credits spent`,
+                `Balance now: ${usage.balance_usd} (${usage.balance_credits.toLocaleString('en-US')} credits)`,
+            ];
+            if (usage.totals.waived_rounds > 0) {
+                lines.push('', `${usage.totals.waived_rounds} response(s) in the full window were served free — our own retries and the per-attempt cap. Those are not billing errors.`);
+            }
+            if (usage.totals.by_client.length > 1) {
+                lines.push('', 'By integration (full window):');
+                for (const row of usage.totals.by_client) {
+                    lines.push(`  ${row.client ?? 'direct'}: ${row.billable_rounds.toLocaleString('en-US')} rounds, ${row.credits.toLocaleString('en-US')} credits`);
+                }
+            }
+            const spending = daily.filter((day) => day.credits > 0);
+            if (spending.length > 0) {
+                lines.push('', 'Per day:');
+                for (const day of spending) {
+                    lines.push(`  ${day.day}  ${day.credits.toLocaleString('en-US')} credits`);
+                }
+            }
+            if (usage.ledger.length > 0) {
+                lines.push('', 'Purchases and grants:');
+                for (const entry of usage.ledger.slice(0, 10)) {
+                    const paid = entry.usd_amount_cents === null ? '' : ` ($${(entry.usd_amount_cents / 100).toFixed(2)})`;
+                    lines.push(`  ${entry.at.slice(0, 10)}  ${entry.kind}  ${entry.delta_credits > 0 ? '+' : ''}${entry.delta_credits.toLocaleString('en-US')}${paid}`);
+                }
+            }
+            return text(lines.join('\n'));
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    // ── keys ──────────────────────────────────────────────────────────────────
+    server.registerTool('list_api_keys', {
+        title: 'List API keys',
+        description: 'The account’s solving keys, masked. The secret half is not stored anywhere and cannot ' +
+            'be listed — only minted.',
+        annotations: { title: 'List API keys', readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            const listing = await api.request('/api/v1/keys');
+            if (listing.keys.length === 0) {
+                return text('No keys yet. `create_api_key` mints one.');
+            }
+            const rows = listing.keys.map((key) => {
+                const state = key.revoked ? 'revoked' : 'live';
+                const used = key.last_used_at ? `last used ${key.last_used_at.slice(0, 10)}` : 'never used';
+                return `  #${key.id}  ${key.masked}  ${key.name ?? '(unnamed)'}  [${state}, ${used}]`;
+            });
+            const live = listing.keys.filter((key) => !key.revoked).length;
+            return text([`${live} live of ${listing.max_active_keys} allowed:`, ...rows].join('\n'));
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    server.registerTool('create_api_key', {
+        title: 'Create an API key',
+        description: 'Mint a key for the captcha-solving endpoint (the Abyss model) and save it to disk where ' +
+            'the solver will find it. THE SECRET IS NEVER RETURNED — it is written straight to a ' +
+            '0600 file and only the path is reported back, so it cannot leak through this ' +
+            'conversation. After this runs, a solve works with no environment variables set.',
+        inputSchema: {
+            name: z
+                .string()
+                .max(60)
+                .optional()
+                .describe('A label so this key is identifiable in the dashboard, e.g. "scraper-prod".'),
+        },
+        annotations: { title: 'Create an API key', readOnlyHint: false, openWorldHint: true },
+    }, async ({ name }) => {
+        try {
+            const created = await api.request('/api/v1/keys', {
+                method: 'POST',
+                body: { name: name ?? null },
+            });
+            // The secret goes to disk and NOT into this tool's result. Everything
+            // returned below is safe to repeat: an id, a masked form, and a path.
+            //
+            // The write is the last thing that can fail, and if it does the key
+            // already exists server-side — so say so plainly rather than pretending
+            // nothing happened, and point at revoke. Silently swallowing this would
+            // strand a live key that the user does not know they own.
+            let credentialFile;
+            try {
+                credentialFile = writeSolverCredential({
+                    apiKey: created.api_key,
+                    baseUrl: created.base_url,
+                });
+            }
+            catch (writeError) {
+                const reason = writeError instanceof Error ? writeError.message : String(writeError);
+                return text([
+                    `Key #${created.id} was created (${created.masked}), but saving it to ` +
+                        `${solverCredentialPath()} failed: ${reason}`,
+                    '',
+                    'The secret is NOT being printed here — it would end up in this transcript.',
+                    'The key exists server-side and cannot be retrieved again, so either fix the',
+                    `permissions on that path and mint a new key, or revoke key #${created.id} with`,
+                    'revoke_api_key so nothing untracked is left live.',
+                ].join('\n'));
+            }
+            return text([
+                `Key #${created.id} created${created.name ? ` (${created.name})` : ''}, shown as ${created.masked} in the dashboard.`,
+                '',
+                `Saved to ${credentialFile} (0600), pointing at ${created.base_url}.`,
+                '',
+                'The secret itself is deliberately not shown — it went straight to that file so it',
+                'never enters this conversation, and only a SHA-256 is stored server-side. Solving',
+                'now works with no environment variables set at all.',
+            ].join('\n'));
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    server.registerTool('revoke_api_key', {
+        title: 'Revoke an API key',
+        description: 'Kill a key by its id. It stops working within about 30 seconds — the gateway’s refresh ' +
+            'interval. This cannot be undone; mint a new key instead of trying to restore one.',
+        inputSchema: {
+            id: z.number().int().positive().describe('The key id from list_api_keys.'),
+        },
+        annotations: { title: 'Revoke an API key', readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+    }, async ({ id }) => {
+        try {
+            await api.request(`/api/v1/keys/${id}/revoke`, { method: 'POST' });
+            return text(`Key #${id} revoked. It stops working within 30 seconds.`);
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    // ── money ─────────────────────────────────────────────────────────────────
+    server.registerTool('get_topup_link', {
+        title: 'Get a top-up link',
+        description: 'A URL the human opens to add credits. THIS DOES NOT CHARGE ANYTHING — it returns a ' +
+            'link; a person completes the payment on Stripe. Omit `usd` to let them choose the ' +
+            'amount, which is the right default when the agent has not been told what to spend.',
+        inputSchema: {
+            usd: z
+                .number()
+                .positive()
+                .optional()
+                .describe('A published pack amount. Omit to return the chooser page instead.'),
+        },
+        annotations: { title: 'Get a top-up link', readOnlyHint: false, openWorldHint: true },
+    }, async ({ usd }) => {
+        try {
+            const result = await api.request('/api/v1/billing/checkout', {
+                method: 'POST',
+                body: usd === undefined ? {} : { usd },
+            });
+            if (result.kind === 'checkout') {
+                return text(`Stripe checkout for $${result.usd} (${result.credits?.toLocaleString('en-US')} credits):\n\n  ${result.url}\n\n` +
+                    'Nothing has been charged. The human completes the payment on that page, and the credits land within seconds of it succeeding.');
+            }
+            const packs = (result.packs ?? [])
+                .map((pack) => `  $${pack.usd} → ${pack.credits.toLocaleString('en-US')} credits`)
+                .join('\n');
+            return text(`Top-up page:\n\n  ${result.url}\n\nAvailable packs:\n${packs}\n\nNothing has been charged.`);
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    server.registerTool('get_pricing', {
+        title: 'Pricing',
+        description: 'The rate card: dollars per 1,000 inference responses for images and for video, how many ' +
+            'responses a captcha typically takes, and the per-captcha billing ceiling. Use this to ' +
+            'estimate a job before running it.',
+        annotations: { title: 'Pricing', readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            const pricing = await api.request('/api/v1/pricing', { authenticated: false });
+            const lines = [
+                `Billed per inference response. $1.00 = ${pricing.credits_per_usd.toLocaleString('en-US')} credits.`,
+                '',
+            ];
+            for (const row of pricing.classes) {
+                lines.push(`${row.label}: $${row.usd_per_1000_responses.toFixed(2)} per 1,000 (${row.credits_per_response} credits each)`, `  ${row.covers}`, 
+                // The number that turns a rate into a cost. Without it an agent
+                // estimating a job would quietly assume one response per captcha.
+                `  Typically ${row.typical_responses_per_captcha} response(s) per captcha`);
+            }
+            lines.push('', `Free (never reach the model): ${pricing.free_challenges.join(', ')}`, 
+            // The ceiling an agent should actually plan against: one captcha can
+            // never cost more than this, however badly it goes.
+            `One captcha costs at most ${pricing.max_billable_responses_per_session} billable responses ` +
+                `($${((pricing.classes.find((row) => row.puzzle_class === 'image')?.usd_per_1000_responses ?? 0) * pricing.max_billable_responses_per_session).toFixed(2)} per 1,000 for images). ` +
+                `Responses past that are served free, and the attempt is abandoned after ${pricing.max_responses_per_session}.`, `Packs: ${pricing.credit_packs.map((pack) => `$${pack.usd}`).join(', ')}`);
+            return text(lines.join('\n'));
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    server.registerTool('get_models', {
+        title: 'Models',
+        description: 'The model lineup: which weights can be self-hosted, and which one the hosted endpoint ' +
+            'runs. Useful for deciding whether to pay per solve or run it yourself.',
+        annotations: { title: 'Models', readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            const listing = await api.request('/api/v1/models', { authenticated: false });
+            const lines = [`Hosted endpoint: ${listing.base_url}`, ''];
+            for (const model of listing.models) {
+                lines.push(`${model.name} — ${model.zone}`);
+                lines.push(`  ${model.tagline}`);
+                lines.push(model.hosted
+                    ? '  Hosted only; not downloadable.'
+                    : model.published
+                        ? `  Weights: ${model.hugging_face_id} (~${model.weights_gb} GB, needs ${model.min_vram})`
+                        : `  Weights: ${model.hugging_face_id} — reserved, not uploaded yet`);
+                if (model.accuracy !== null) {
+                    lines.push(`  Measured: ${(model.accuracy * 100).toFixed(1)}% exact match`);
+                }
+                if (model.video)
+                    lines.push('  Handles video challenges.');
+                lines.push('');
+            }
+            return text(lines.join('\n').trimEnd());
+        }
+        catch (error) {
+            return describe(error);
+        }
+    });
+    return server;
+}
+/**
+ * Poll until the token arrives or the budget runs out.
+ *
+ * `slow_down` doubles the interval, permanently for this attempt, which is what
+ * RFC 8628 §3.5 asks for. It should not happen — we honour the interval the
+ * server gave us — but a clock that jumps or a retried call can produce it, and
+ * an implementation that ignores it is one that hammers an unauthenticated
+ * endpoint whenever it does.
+ */
+async function pollForToken(api, pending) {
+    const deadline = Date.now() + SIGN_IN_WAIT_MS;
+    let interval = Math.max(1, pending.intervalSeconds) * 1000;
+    while (Date.now() < deadline) {
+        if (pending.expiresAtMs <= Date.now())
+            return { kind: 'dead' };
+        try {
+            const grant = await api.request('/api/v1/device/token', {
+                method: 'POST',
+                authenticated: false,
+                body: { device_code: pending.deviceCode },
+            });
+            return { kind: 'granted', grant };
+        }
+        catch (error) {
+            if (!(error instanceof ApiError))
+                throw error;
+            switch (error.code) {
+                case 'authorization_pending':
+                    break;
+                case 'slow_down':
+                    interval *= 2;
+                    break;
+                case 'access_denied':
+                    return { kind: 'denied' };
+                case 'expired_token':
+                    return { kind: 'dead' };
+                default:
+                    throw error;
+            }
+        }
+        // Do not overshoot the deadline sleeping: returning a moment early with
+        // "call me again" is better than being killed by the client's timeout.
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            break;
+        await sleep(Math.min(interval, remaining));
+    }
+    return { kind: 'waiting' };
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;GASG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAsF/B,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC,+DAA+D,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,UAAkB;IAC9D,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAC3C;QACE,YAAY,EACV,kFAAkF;YAClF,gFAAgF;YAChF,uFAAuF;YACvF,0FAA0F;KAC7F,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,mFAAmF;YACnF,mFAAmF;YACnF,sFAAsF;YACtF,uFAAuF;QACzF,WAAW,EAAE;YACX,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,sEAAsE,CAAC;SACpF;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,aAAa,EAAE,IAAI,EAAE;KACxE,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YAE3C,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,IAAI,WAAW,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACvF,OAAO,IAAI,CACT,wBAAwB,GAAG,OAAO,OAAO,KAAK;oBAC5C,kEAAkE,CACrE,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,+CAA+C;YAC/C,IAAI,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAc,sBAAsB,EAAE;oBACrE,MAAM,EAAE,MAAM;oBACd,aAAa,EAAE,KAAK;oBACpB,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,IAAI,UAAU,EAAE;iBACjD,CAAC,CAAC;gBACH,OAAO,GAAG;oBACR,UAAU,EAAE,OAAO,CAAC,WAAW;oBAC/B,QAAQ,EAAE,OAAO,CAAC,SAAS;oBAC3B,eAAe,EAAE,OAAO,CAAC,gBAAgB;oBACzC,uBAAuB,EAAE,OAAO,CAAC,yBAAyB;oBAC1D,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI;oBACnD,eAAe,EAAE,OAAO,CAAC,QAAQ;iBAClC,CAAC;gBACF,cAAc,CAAC,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAEjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,cAAc,CAAC,OAAO,EAAE;oBACtB,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;oBACvC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;oBACnC,OAAO,EAAE;wBACP,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO;wBACrC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY;wBAC/C,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK;qBACnC;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,WAAW,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC7F,OAAO,IAAI,CACT,gBAAgB,GAAG,KAAK;oBACtB,YAAY,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc;oBAC7H,0BAA0B,cAAc,EAAE,yDAAyD;oBACnG,8DAA8D,CACjE,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,IAAI,CACT,2BAA2B;oBACzB,YAAY,OAAO,CAAC,uBAAuB,IAAI;oBAC/C,YAAY,OAAO,CAAC,QAAQ,MAAM;oBAClC,kFAAkF;oBAClF,qEAAqE,CACxE,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC;YAC5D,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACxC,OAAO,OAAO,CACZ,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACvB,CAAC,CAAC,iEAAiE;gBACnE,CAAC,CAAC,oFAAoF,CACzF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,oFAAoF;YACpF,wFAAwF;QAC1F,WAAW,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KAC/E,EACD,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,uEAAuE;YACvE,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACzD,eAAe,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;gBAC1F,eAAe,CAAC,OAAO,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,uFAAuF;YACvF,wBAAwB;QAC1B,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KACxF,EACD,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAkB,YAAY,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG;gBACZ,cAAc,EAAE,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE;gBACnE,cAAc,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,gBAAgB,EAAE;gBACpD,cAAc,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW;gBACtG,cAAc,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBACpC,cAAc,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE;aAC1C,CAAC;YACF,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,wEAAwE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;gBACpC,KAAK,CAAC,IAAI,CACR,EAAE,EACF,kHAAkH,CACnH,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KAClF,EACD,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAkB,YAAY,CAAC,CAAC;YAC5D,OAAO,IAAI,CACT,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW;gBACzF,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,oFAAoF;YACpF,uFAAuF;QACzF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,EAAE,CAAC;iBACP,QAAQ,EAAE;iBACV,QAAQ,CAAC,6DAA6D,CAAC;SAC3E;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KACtF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAgB,eAAe,CAAC,CAAC;YAEhE,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,WAAW,CAAC;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;YAExE,MAAM,KAAK,GAAG;gBACZ,QAAQ,MAAM,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;gBAC/C,KAAK,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,qBAAqB;gBACxD,KAAK,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,gBAAgB;gBACpD,gBAAgB,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW;aAC/F,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,2HAA2H,CACzJ,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;gBAChD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBACzC,KAAK,CAAC,IAAI,CACR,KAAK,GAAG,CAAC,MAAM,IAAI,QAAQ,KAAK,GAAG,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CACrI,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;gBACxC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,GACR,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;oBAC5F,KAAK,CAAC,IAAI,CACR,KAAK,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CACxI,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,wFAAwF;YACxF,0BAA0B;QAC5B,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KACjF,EACD,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAkB,cAAc,CAAC,CAAC;YACnE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACpC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;gBAC5F,OAAO,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,WAAW,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC;YACxF,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC/D,OAAO,IAAI,CACT,CAAC,GAAG,IAAI,YAAY,OAAO,CAAC,eAAe,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,0FAA0F;YAC1F,sFAAsF;YACtF,+EAA+E;YAC/E,iFAAiF;QACnF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,EAAE,CAAC;iBACP,QAAQ,EAAE;iBACV,QAAQ,CAAC,4EAA4E,CAAC;SAC1F;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACtF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAqB,cAAc,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE;aAC7B,CAAC,CAAC;YAEH,sEAAsE;YACtE,sEAAsE;YACtE,EAAE;YACF,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,0DAA0D;YAC1D,IAAI,cAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,cAAc,GAAG,qBAAqB,CAAC;oBACrC,MAAM,EAAE,OAAO,CAAC,OAAO;oBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACrF,OAAO,IAAI,CACT;oBACE,QAAQ,OAAO,CAAC,EAAE,iBAAiB,OAAO,CAAC,MAAM,sBAAsB;wBACrE,GAAG,oBAAoB,EAAE,YAAY,MAAM,EAAE;oBAC/C,EAAE;oBACF,4EAA4E;oBAC5E,6EAA6E;oBAC7E,+DAA+D,OAAO,CAAC,EAAE,OAAO;oBAChF,mDAAmD;iBACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CACT;gBACE,QAAQ,OAAO,CAAC,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,OAAO,CAAC,MAAM,oBAAoB;gBACrH,EAAE;gBACF,YAAY,cAAc,wBAAwB,OAAO,CAAC,QAAQ,GAAG;gBACrE,EAAE;gBACF,mFAAmF;gBACnF,mFAAmF;gBACnF,qDAAqD;aACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,yFAAyF;YACzF,mFAAmF;QACrF,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAC3E;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KAC7G,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,qFAAqF;YACrF,oFAAoF;YACpF,oFAAoF;QACtF,WAAW,EAAE;YACX,GAAG,EAAE,CAAC;iBACH,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,mEAAmE,CAAC;SACjF;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACtF,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAM7B,0BAA0B,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE;aACvC,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,OAAO,IAAI,CACT,wBAAwB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,mBAAmB,MAAM,CAAC,GAAG,MAAM;oBAC/G,+HAA+H,CAClI,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;iBAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;iBACjF,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,IAAI,CACT,qBAAqB,MAAM,CAAC,GAAG,yBAAyB,KAAK,+BAA+B,CAC7F,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,0FAA0F;YAC1F,wFAAwF;YACxF,mCAAmC;QACrC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KAC3E,EACD,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAc9B,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAEhD,MAAM,KAAK,GAAG;gBACZ,0CAA0C,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW;gBACpG,EAAE;aACH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CACR,GAAG,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,oBAAoB,gBAAgB,EAC9G,KAAK,GAAG,CAAC,MAAM,EAAE;gBACjB,gEAAgE;gBAChE,kEAAkE;gBAClE,eAAe,GAAG,CAAC,6BAA6B,0BAA0B,CAC3E,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,iCAAiC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACrE,qEAAqE;YACrE,oDAAoD;YACpD,6BAA6B,OAAO,CAAC,kCAAkC,sBAAsB;gBAC3F,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,sBAAsB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;gBACnL,2EAA2E,OAAO,CAAC,yBAAyB,GAAG,EACjH,UAAU,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;YACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,QAAQ;QACf,WAAW,EACT,wFAAwF;YACxF,wEAAwE;QAC1E,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KAC1E,EACD,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAc9B,gBAAgB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAE/C,MAAM,KAAK,GAAG,CAAC,oBAAoB,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjC,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM;oBACV,CAAC,CAAC,kCAAkC;oBACpC,CAAC,CAAC,KAAK,CAAC,SAAS;wBACf,CAAC,CAAC,cAAc,KAAK,CAAC,eAAe,MAAM,KAAK,CAAC,UAAU,cAAc,KAAK,CAAC,QAAQ,GAAG;wBAC1F,CAAC,CAAC,cAAc,KAAK,CAAC,eAAe,+BAA+B,CACzE,CAAC;gBACF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC5B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC9E,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,GAAiB,EAAE,OAAsB;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAE3D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAE/D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAa,sBAAsB,EAAE;gBAClE,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;YAE9C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,uBAAuB;oBAC1B,MAAM;gBACR,KAAK,WAAW;oBACd,QAAQ,IAAI,CAAC,CAAC;oBACd,MAAM;gBACR,KAAK,eAAe;oBAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC5B,KAAK,eAAe;oBAClB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC1B;oBACE,MAAM,KAAK,CAAC;YAChB,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC"}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "captchakraken-mcp",
+  "version": "0.1.0",
+  "description": "MCP server for CaptchaKraken: sign in with GitHub, mint API keys for the Abyss model, and read your usage and spending.",
+  "type": "module",
+  "author": "Jake Writer",
+  "license": "SEE LICENSE IN LICENSE",
+  "bin": {
+    "captchakraken-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/JWriter20/CaptchaKraken.git",
+    "directory": "mcp"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "captcha",
+    "captchakraken"
+  ],
+  "bugs": {
+    "url": "https://github.com/JWriter20/CaptchaKraken/issues"
+  },
+  "homepage": "https://github.com/JWriter20/CaptchaKraken#readme",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "typescript": "^5.9.3"
+  }
+}