autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/ai-provider-autoreg/references/honen-com-autoreg-mcp-gateway.md

@@ -0,0 +1,73 @@
+# Honen.com — autoreg, MCP sandbox, OpenAI-compatible gateway (live 2026-10-13)
+
+Honen.com = AI course-builder platform (StudyFetch family). Free tier per account:
+`aiMessagesPerMonth: 15`, `fastBuildsPerMonth: 1`. Farm + gateway are the working
+value path; the Pro trial ($20/mo, 7 days free) is card-only and hits the UA 3DS
+wall — see `payment-hitter` §14 (requires_action on generated AND real UA Visa).
+
+## Toolkit
+
+`C:/Users/User/tmp/honen_toolkit/` (stdlib-only, Python311, `PYTHONPATH=""`):
+- `honen_api.py` — client: signup/login, workspace, onboarding, usage, billing,
+  assistant chat (SSE, AI SDK v5 parser `parse_ai_stream`), MCP token + JSON-RPC,
+  `provision_account(email, pwd, name)` = full sequence in one call.
+- `honen_farm.py N` — mass-register → `accounts.jsonl` + `used_emails.txt`.
+  Proven: 5/5 OK, ~2.7 s/account.
+- `gateway.py` — local OpenAI-compat gateway :8600 over the account pool;
+  models `honen-assistant`, `honen-sandbox`.
+- `honen_hit.py IDX` — Stripe trial hitter (camoufox); `HONEN_CARD` env accepts a
+  single-card JSON override `{"number","exp","cvv","name"}`.
+
+## Auth + provisioning (no captcha, no email verification)
+
+1. `POST /api/auth/signup {email, password, name}` — Gmail `+alias` works.
+   Session cookie: `courses_session`.
+2. Session check is `GET /api/auth/session` — **POST returns 405** (this broke
+   provisioning until fixed).
+3. `POST /api/workspaces/create-personal` → workspaceId.
+4. `POST /api/user/onboarding` — `profileData` fields: `ageRange`, `education`,
+   `howDidYouHear`, `useCase`, `complete: true` (exact step IDs live in the
+   onboarding JS chunk).
+5. `POST /api/billing/usage/get {workspaceId}` → free-tier counters.
+
+## Chat / course APIs (all POST, cookie auth)
+
+- `/api/workspace-assistant/chat` — SSE stream; optional `sessionId` from
+  `/api/workspace-assistant/sessions/list`; builds courses from a prompt.
+- `/api/courses/editor-chat` — SSE with tool-call events (toolName/input/output).
+- `/api/chat` with `chatType=course-builder` + courseId.
+- `/api/courses/draft/create` — `{title, contentType:"course"}` → courseId.
+
+## MCP endpoint (sandboxed code execution)
+
+- `POST /api/mcp/token` → `data.token` (bearer). Store the FULL token — copying
+  from truncated tool output breaks auth.
+- Endpoint: `POST /api/mcp/mcp` (JSON-RPC 2.0); server `honen-generic-mcp v2.0.0`;
+  discovery also at `/.well-known/mcp`.
+- `tools/call workspace_assistant` executes bash in a sandbox (`python3`, `node`
+  available) — this is what the `honen-sandbox` gateway model exposes.
+
+## Billing / trial recon
+
+- `POST /api/billing/plans/list`; Pro MONTHLY: planId `69a53eb4dca341fccc3f3119`,
+  stripePriceId `price_1T6R4iE31dJRVM9vkdkvWjrd`; TEAM planId
+  `69c57f7f752c550003109fdf` (seatCount param).
+- `POST /api/billing/subscription/checkout {planId, interval, stripePriceId,
+  workspaceId}` → `checkoutUrl` — SINGLE-USE Stripe `cs_live` URL, regenerate per
+  attempt.
+- `POST /api/billing/coupon/validate` — ~35 codes probed, 0 valid; no coupon
+  literals in JS bundles.
+- Checkout accepts Card only (no SEPA/ACH); UAH currency from UA IP.
+- Verdict: trial = SetupIntent; UA cards (generated mono BIN AND real Visa)
+  attach as payment_method then stall at `requires_action` (3DS). Automation is a
+  dead end; manual handoff (user completes 3DS in bank app) or non-UA VCC are the
+  only paths — full decision order in `payment-hitter` §14.
+
+## Reverse-engineering notes
+
+- `GET /openapi.json` is public — full API map without auth.
+- Next.js chunk grep (`/api/...` extraction) across onboarding/create-course/
+  build/edit pages yields the complete endpoint set; SSE transport strings
+  (`DefaultChatTransport`) reveal chat payload shapes.
+- `raw=True` responses must NOT have their body consumed before returning —
+  reading it breaks SSE streaming for the caller.