@openephemeris/mcp-server 3.13.10 → 3.15.0

package/CHANGELOG.md

@@ -7,6 +7,59 @@ Version numbering follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [3.15.0] — 2026-06-15
+
+### Changed
+- **`dev_call` split into `dev_read_api` (GET) and `dev_write_api` (POST/PUT/PATCH/DELETE).** Read and write now live in separate tools so a safe read surface never shares a tool with state-changing calls — required for MCP connector-directory compliance. `dev_read_api` carries `readOnlyHint: true`; `dev_write_api` carries `readOnlyHint: false`. Both name their target API explicitly.
+
+### Fixed
+- **Brand-gold WCAG AA contrast pass** across the chart-wheel, bi-wheel, and bodygraph iframes — gold accents darkened to clear AA against their backgrounds; all three apps are axe-clean.
+- **Moon-phase color cue** now encodes speed/proximity, and aspect-label contrast corrected.
+
+### Added
+- **Collapsible glyph legend** in the interactive chart iframes — keeps the wheel uncluttered while remaining one tap from a full symbol key.
+
+---
+
+## [3.14.0] — 2026-05-24
+
+### Added
+- **Fullscreen bottom-bar layout** for bodygraph, bi-wheel, and chart-wheel iframes — chart fills the viewport, controls dock to the bottom for a cleaner read on small windows.
+- **Debug highlight click handler** in the bodygraph (`?debugHighlight`) — click any gate to surface its center/channel data via iframe postMessage.
+- **Highlight visualization** — highlighted gates render with CSS glow while non-highlighted gates dim, making activation patterns visually obvious.
+- **Click payload metadata** — bodygraph gate groups now emit `data-center` for richer iframe click events.
+- **OAuth refresh-token persistence** to Supabase, with in-memory expiry enforcement and a 90-day TTL (up from 30 days).
+- **OAuth discovery test suite** with 401-compliance coverage.
+
+### Fixed
+- Auth check now runs before `isInitializeRequest` — resolves the Claude Web `ofid_` initialization error.
+- Light-mode ring tokens wired correctly in bi-wheel (were missing token references).
+- Fullscreen bottom-bar layout polish — edge cases and styling fixes after initial rollout.
+
+### Changed
+- **Server-side SVG is now the only bodygraph render path** — the legacy client-side renderer has been retired. Reduces bundle size and removes a source of cross-environment rendering drift.
+- Claude Web connector docs updated to reflect OAuth (not API key) as the connection method.
+
+### Underlying API improvements (delivered transparently)
+- **LLM-format projection now covers all 7 benchmarked endpoints** (was 4): `/ephemeris/natal-chart`, `/comparative/synastry`, `/comparative/natal-transits`, `/human-design/chart`, `/vedic/chart`, `/chinese/bazi`, `/acg/hits`. Weighted average reduction: 61% (GPT-4o), 60% (Claude). Range: 13%–98% per endpoint.
+- `/acg/hits` newly supports `format=llm` — proximity hits as compact rows. Other `/acg/*` endpoints continue to return precision GeoJSON for map rendering.
+
+---
+
+## [3.13.11] — 2026-05-15
+
+### Added
+- **Bi-Wheel UI Parity** — Unified the Bi-Wheel and Natal Chart Wheel architectures with matching feature sets.
+- **Tally & Dignity Panels** — Integrated element/modality tallies and planetary dignity badges into the Bi-Wheel UI.
+- **House System Controls** — Added dynamic house system selection to the Bi-Wheel aspect panel, triggering live recalculations.
+- **Enhanced Rendering** — Exported dignity/tally logic from core renderer for consistent client-side UI generation.
+
+### Fixed
+- Widened `BiWheelMode` type definitions to prevent TypeScript compilation errors during mode-specific panel rendering.
+- Standardized CSS design tokens and layout containers between natal and comparative chart wheels.
+
+---
+
 ## [3.10.4] — 2026-04-24
 
 ### Changed

package/README.md

@@ -183,7 +183,7 @@ Cursor deeplink payload:
 
 The server is hosted at `https://mcp.openephemeris.com/mcp` with full Streamable HTTP support (MCP 2025-11-25 spec). Remote-only clients can connect directly — no bridge/proxy required:
 
-- **Claude Web**: Add `https://mcp.openephemeris.com/mcp` as a remote MCP server with `X-API-Key: your-key` header
+- **Claude Web**: Add `https://mcp.openephemeris.com/mcp` as a custom connector URL — leave OAuth Client ID and Secret **blank**. The server uses OAuth 2.1 + PKCE (Dynamic Client Registration), so Claude handles authentication via a browser popup automatically.
 - **Via Smithery**: Use the [Smithery listing](https://smithery.ai/servers/open-ephemeris/openephemeris) for managed connections with any client
 - **Legacy SSE**: `https://mcp.openephemeris.com/sse` remains available for SSE-only clients
 
@@ -251,15 +251,15 @@ The server is hosted at `https://mcp.openephemeris.com/mcp` with full Streamable
 ## Tooling Model
 
 - Typed tools are preferred for common workflows (natal, transits, moon phase, eclipse, synastry, relocation, electional, Human Design).
-- Generic tools: `dev.list_allowed` returns all currently allowlisted operations, and `dev.call` invokes any allowlisted operation by `method + path`.
+- Generic tools: `dev_list_allowed` returns all currently allowlisted operations; `dev_read_api` invokes allowlisted **GET** (read) operations and `dev_write_api` invokes allowlisted **POST/PUT/PATCH/DELETE** (write/compute) operations, each by `method + path`. Read and write are kept as separate tools so a safe read surface never shares a tool with state-changing writes.
 - Security model: default-deny with explicit allowlist in `config/dev-allowlist.json`.
 - Deny prefixes block sensitive route families (`/auth`, `/billing`, `/admin`, etc.).
 
-### `dev.call` input
+### `dev_read_api` / `dev_write_api` input
 
 | Parameter | Type | Required | Description |
 |---|---|---|---|
-| `method` | `GET\|POST\|PUT\|PATCH\|DELETE` | Yes | HTTP method |
+| `method` | `dev_read_api`: `GET` · `dev_write_api`: `POST\|PUT\|PATCH\|DELETE` | No | HTTP method (defaults to the tool's natural method) |
 | `path` | `string` | Yes | Absolute API path, e.g. `/ephemeris/natal-chart` |
 | `query` | `object` | No | Query parameters |
 | `body` | `object` | No | JSON body for non-GET requests |
@@ -355,8 +355,8 @@ Generated by `npm run sync:readme` from `config/dev-allowlist.json` and the live
 
 - Allowlisted operations: **28**
 - Methods: `GET=4`, `POST=24`, `PUT=0`, `PATCH=0`, `DELETE=0`
-- Registered tools (`OPENEPHEMERIS_PROFILE=dev`): **82**
-- Typed tools: `acg_hits`, `acg_power_lines`, `auth_login`, `auth_logout`, `auth_status`, `bazi_annual_pillar`, `bazi_chart`, `bazi_compatibility`, `bazi_element_balance`, `bazi_luck_pillars`, `bazi_ten_gods`, `bi_wheel_on_cross_aspect_click`, `bi_wheel_on_house_click`, `bi_wheel_on_planet_click`, `bi_wheel_recalculate`, `bi_wheel_synopsis`, `bodygraph_recalculate`, `chart_wheel_on_aspect_click`, `chart_wheel_on_house_click`, `chart_wheel_on_planet_click`, `chart_wheel_recalculate`, `chinese_bazi`, `dev_call`, `dev_list_allowed`, `electional_aspect_search`, `electional_moment_analysis`, `electional_station_tracker`, `ephemeris_angles_points`, `ephemeris_aspect_check`, `ephemeris_bi_wheel`, `ephemeris_chart_wheel`, `ephemeris_composite`, `ephemeris_composite_midpoint`, `ephemeris_dignities`, `ephemeris_electional`, `ephemeris_fixed_stars`, `ephemeris_hermetic_lots`, `ephemeris_house_cusps`, `ephemeris_lunar_return`, `ephemeris_midpoints`, `ephemeris_moon_phase`, `ephemeris_natal_batch`, `ephemeris_natal_chart`, `ephemeris_natal_transits`, `ephemeris_next_eclipse`, `ephemeris_next_lunar_phase`, `ephemeris_overlay`, `ephemeris_planet_position`, `ephemeris_planetary_return`, `ephemeris_progressed_chart`, `ephemeris_relocation`, `ephemeris_retrograde_status`, `ephemeris_solar_return`, `ephemeris_synastry`, `ephemeris_transits`, `explore_bazi_chart`, `explore_bi_wheel`, `explore_human_design`, `explore_moon_phase`, `explore_natal_chart`, `explore_transit_timeline`, `explore_vedic_chart`, `hd_on_center_click`, `hd_on_channel_click`, `hd_on_gate_click`, `hd_on_planet_click`, `hd_on_variable_click`, `hd_opposition`, `hd_planetary_return`, `human_design_bodygraph`, `human_design_chart`, `human_design_composite`, `human_design_penta`, `location_search`, `timezone_resolve`, `vedic_chart`, `venus_eight_year_star`, `venus_elongations`, `venus_phase`, `venus_star_points`, `venus_star_points_conjunctions`, `venus_stations`
+- Registered tools (`OPENEPHEMERIS_PROFILE=dev`): **80**
+- Typed tools: `acg_hits`, `acg_power_lines`, `auth_login`, `auth_logout`, `auth_status`, `bazi_annual_pillar`, `bazi_chart`, `bazi_compatibility`, `bazi_element_balance`, `bazi_luck_pillars`, `bazi_ten_gods`, `bi_wheel_on_cross_aspect_click`, `bi_wheel_on_house_click`, `bi_wheel_on_planet_click`, `bi_wheel_recalculate`, `bi_wheel_synopsis`, `bodygraph_recalculate`, `chart_wheel_on_aspect_click`, `chart_wheel_on_house_click`, `chart_wheel_on_planet_click`, `chart_wheel_recalculate`, `chinese_bazi`, `dev_list_allowed`, `dev_read_api`, `dev_write_api`, `electional_aspect_search`, `electional_moment_analysis`, `electional_station_tracker`, `ephemeris_angles_points`, `ephemeris_aspect_check`, `ephemeris_bi_wheel`, `ephemeris_chart_wheel`, `ephemeris_composite`, `ephemeris_composite_midpoint`, `ephemeris_dignities`, `ephemeris_electional`, `ephemeris_fixed_stars`, `ephemeris_hermetic_lots`, `ephemeris_house_cusps`, `ephemeris_lunar_return`, `ephemeris_midpoints`, `ephemeris_moon_phase`, `ephemeris_natal_batch`, `ephemeris_natal_chart`, `ephemeris_natal_transits`, `ephemeris_next_eclipse`, `ephemeris_next_lunar_phase`, `ephemeris_overlay`, `ephemeris_planet_position`, `ephemeris_planetary_return`, `ephemeris_progressed_chart`, `ephemeris_relocation`, `ephemeris_retrograde_status`, `ephemeris_solar_return`, `ephemeris_synastry`, `ephemeris_transits`, `explore_bi_wheel`, `explore_human_design`, `explore_moon_phase`, `explore_natal_chart`, `hd_on_center_click`, `hd_on_channel_click`, `hd_on_gate_click`, `hd_on_planet_click`, `hd_on_variable_click`, `hd_opposition`, `hd_planetary_return`, `human_design_bodygraph`, `human_design_chart`, `human_design_composite`, `human_design_penta`, `location_search`, `timezone_resolve`, `vedic_chart`, `venus_eight_year_star`, `venus_elongations`, `venus_phase`, `venus_star_points`, `venus_star_points_conjunctions`, `venus_stations`
 - Generic tools: 
 
 ### Allowlist Families

package/dist/index.js

@@ -7,12 +7,12 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { initTools, toolRegistry, formatToolResponse, modelVisibleTools } from "./tools/index.js";
 import { listPrompts, getPromptContent } from "./prompts.js";
+// ── MCP App resource imports ────────────────────────────────────────────────
 import { CHART_WHEEL_RESOURCE_URI, CHART_WHEEL_MIME_TYPE, getChartWheelBundle, } from "./tools/apps/chart-wheel-app.js";
 import { BODYGRAPH_RESOURCE_URI, BODYGRAPH_MIME_TYPE, getBodygraphBundle, } from "./tools/apps/bodygraph-app.js";
 import { BI_WHEEL_RESOURCE_URI, BI_WHEEL_MIME_TYPE, getBiWheelBundle, } from "./tools/apps/bi-wheel-app.js";
-import { TRANSIT_TIMELINE_RESOURCE_URI, TRANSIT_TIMELINE_MIME_TYPE, getTransitTimelineBundle, } from "./tools/apps/transit-timeline-app.js";
 import { MOON_PHASE_RESOURCE_URI, MOON_PHASE_MIME_TYPE, getMoonPhaseBundle, } from "./tools/apps/moon-phase-app.js";
-import { BAZI_RESOURCE_URI, BAZI_MIME_TYPE, getBaziBundle, } from "./tools/apps/bazi-app.js";
+// ─────────────────────────────────────────────────────────────────────────────
 function resolveServerVersion() {
     try {
         const here = path.dirname(fileURLToPath(import.meta.url));
@@ -42,9 +42,6 @@ const server = new Server({
         tools: {},
         prompts: {},
         resources: {},
-        experimental: {
-            "io.modelcontextprotocol/ui": {},
-        },
     },
 });
 // List available tools
@@ -62,10 +59,6 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
                 openWorldHint: tool.annotations?.openWorldHint ?? false,
             },
             // Expose MCP Apps UI linkage so Claude Desktop can prefetch the resource
-            // and render the iframe when a tool result arrives.
-            // Include BOTH the modern nested key (_meta.ui.resourceUri) and the
-            // legacy flat key (_meta["ui/resourceUri"]) — the official ext-apps SDK
-            // normalizes both via registerAppTool() for host compatibility.
             ...(tool._meta?.ui?.resourceUri
                 ? {
                     _meta: {
@@ -127,14 +120,6 @@ server.setRequestHandler(ListResourcesRequestSchema, async () => {
             mimeType: BI_WHEEL_MIME_TYPE,
         });
     }
-    if (getTransitTimelineBundle()) {
-        resources.push({
-            uri: TRANSIT_TIMELINE_RESOURCE_URI,
-            name: "Transit Timeline Explorer",
-            description: "Interactive Gantt-style transit timeline showing planetary aspects over time.",
-            mimeType: TRANSIT_TIMELINE_MIME_TYPE,
-        });
-    }
     if (getMoonPhaseBundle()) {
         resources.push({
             uri: MOON_PHASE_RESOURCE_URI,
@@ -143,14 +128,6 @@ server.setRequestHandler(ListResourcesRequestSchema, async () => {
             mimeType: MOON_PHASE_MIME_TYPE,
         });
     }
-    if (getBaziBundle()) {
-        resources.push({
-            uri: BAZI_RESOURCE_URI,
-            name: "BaZi Four Pillars Explorer",
-            description: "Interactive BaZi chart with pillars, Ten Gods, hidden stems, and Wu Xing balance.",
-            mimeType: BAZI_MIME_TYPE,
-        });
-    }
     return { resources };
 });
 // Read resource
@@ -174,24 +151,12 @@ server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
             throw new Error("Bi-Wheel UI bundle not found. Run `npm run build:ui` to build it.");
         return { contents: [{ uri: BI_WHEEL_RESOURCE_URI, mimeType: BI_WHEEL_MIME_TYPE, text: bundle }] };
     }
-    if (uri === TRANSIT_TIMELINE_RESOURCE_URI) {
-        const bundle = getTransitTimelineBundle();
-        if (!bundle)
-            throw new Error("Transit Timeline UI bundle not found. Run `npm run build:ui` to build it.");
-        return { contents: [{ uri: TRANSIT_TIMELINE_RESOURCE_URI, mimeType: TRANSIT_TIMELINE_MIME_TYPE, text: bundle }] };
-    }
     if (uri === MOON_PHASE_RESOURCE_URI) {
         const bundle = getMoonPhaseBundle();
         if (!bundle)
             throw new Error("Moon Phase UI bundle not found. Run `npm run build:ui` to build it.");
         return { contents: [{ uri: MOON_PHASE_RESOURCE_URI, mimeType: MOON_PHASE_MIME_TYPE, text: bundle }] };
     }
-    if (uri === BAZI_RESOURCE_URI) {
-        const bundle = getBaziBundle();
-        if (!bundle)
-            throw new Error("BaZi UI bundle not found. Run `npm run build:ui` to build it.");
-        return { contents: [{ uri: BAZI_RESOURCE_URI, mimeType: BAZI_MIME_TYPE, text: bundle }] };
-    }
     throw new Error(`Unknown resource: ${uri}`);
 });
 // Handle tool calls
@@ -211,19 +176,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     catch (error) {
         const durationMs = Date.now() - startTime;
         const errorMessage = error instanceof Error ? error.message : String(error);
+        const isRetryable = error.retryable === true || error.status === 401 || error.code === "auth_required";
         console.error(`[MCP] ❌ Failed: ${toolName} (${durationMs}ms) - ${errorMessage}`);
         return {
             content: [
                 {
                     type: "text",
-                    text: JSON.stringify({
-                        success: false,
-                        error: "TOOL_EXECUTION_ERROR",
-                        message: errorMessage,
-                    }, null, 2),
+                    text: `Tool execution failed:\n\n${errorMessage}\n\nPlease read the error above carefully and assist the user (e.g. by providing them the auth link or explaining the issue).`,
                 },
             ],
-            isError: true,
+            isError: !isRetryable,
         };
     }
 });

package/dist/oauth/discovery.d.ts

@@ -8,4 +8,5 @@
  * All URLs use https:// per the OAuth 2.1 specification.
  */
 import { type Router } from "express";
+export declare const PROTECTED_RESOURCE_METADATA_URL = "https://mcp.openephemeris.com/.well-known/oauth-protected-resource";
 export declare const oauthDiscoveryRouter: Router;

package/dist/oauth/discovery.js

@@ -10,18 +10,23 @@
 import express from "express";
 const MCP_SERVER_ORIGIN = "https://mcp.openephemeris.com";
 const WEB_APP_ORIGIN = "https://openephemeris.com";
+export const PROTECTED_RESOURCE_METADATA_URL = `${MCP_SERVER_ORIGIN}/.well-known/oauth-protected-resource`;
 export const oauthDiscoveryRouter = express.Router();
 // ---------------------------------------------------------------------------
 // GET /.well-known/oauth-protected-resource
+// Also served at the path-scoped /.well-known/oauth-protected-resource/mcp
+// per the latest MCP Authorization spec draft (some clients probe per-resource).
 // ---------------------------------------------------------------------------
-oauthDiscoveryRouter.get("/.well-known/oauth-protected-resource", (_req, res) => {
+const protectedResourceHandler = (_req, res) => {
     res.json({
-        resource: MCP_SERVER_ORIGIN,
+        resource: `${MCP_SERVER_ORIGIN}/mcp`,
         authorization_servers: [MCP_SERVER_ORIGIN],
         bearer_methods_supported: ["header"],
         scopes_supported: ["openephemeris:read"],
     });
-});
+};
+oauthDiscoveryRouter.get("/.well-known/oauth-protected-resource", protectedResourceHandler);
+oauthDiscoveryRouter.get("/.well-known/oauth-protected-resource/mcp", protectedResourceHandler);
 // ---------------------------------------------------------------------------
 // GET /.well-known/oauth-authorization-server
 // ---------------------------------------------------------------------------

package/dist/oauth/store.d.ts

@@ -59,8 +59,28 @@ export declare class OAuthStore {
         used: boolean;
         expires_at: Date;
     }) | null>;
+    /**
+     * Refresh-token TTL — 90 days, sliding (reset on each rotation).
+     * Matches GitHub's 6-month convention more closely than Supabase's 30d
+     * default. Tradeoff: longer-lived refresh tokens = bigger blast radius
+     * on leak; rotation + Supabase RLS mitigates this. An active user who
+     * touches OE at least once per 90d gets an effectively permanent
+     * connection.
+     */
+    private static REFRESH_TTL_MS;
     storeRefreshToken(token: string, meta: object): void;
+    /**
+     * Synchronous in-memory consume. Kept for backward compat with any callers
+     * that don't need cross-instance resilience. Token endpoint must use
+     * consumeRefreshTokenAsync.
+     */
     consumeRefreshToken(token: string): object | null;
+    /**
+     * Async consume — checks in-memory first, then Supabase. This is what the
+     * token endpoint uses so refresh requests survive machine restarts and
+     * load-balancing across multiple Fly instances.
+     */
+    consumeRefreshTokenAsync(token: string): Promise<object | null>;
     generateRefreshToken(): string;
     reset(): void;
     private purgeExpired;

package/dist/oauth/store.js

@@ -85,7 +85,7 @@ function persistCodeToSupabase(code, options, expiresAt) {
         redirect_uri: options.redirect_uri,
         code_challenge: options.code_challenge,
         code_challenge_method: options.code_challenge_method,
-        scopes: ["mcp:tools"],
+        scopes: ["openephemeris:read"],
         consumed: false,
         expires_at: expiresAt.toISOString(),
     })
@@ -104,6 +104,36 @@ function persistCodeToSupabase(code, options, expiresAt) {
     });
 }
 // ---------------------------------------------------------------------------
+// Refresh-token persistence (mirrors persistCodeToSupabase pattern)
+// ---------------------------------------------------------------------------
+function persistRefreshTokenToSupabase(token, meta, expiresAt) {
+    const cfg = getSupabaseConfig();
+    if (!cfg)
+        return; // No-op in tests
+    const m = meta;
+    postgrestRequest("POST", "/rest/v1/oauth_refresh_tokens", {
+        token,
+        client_id: m.client_id ?? "unknown",
+        user_id: m.user_id ?? null,
+        supabase_refresh_token: m.supabase_refresh_token ?? null,
+        consumed: false,
+        expires_at: expiresAt.toISOString(),
+    })
+        .then(({ status, data }) => {
+        if (status < 200 || status >= 300) {
+            console.warn(`[store] Supabase refresh-token persist failed: ${status}`, data);
+            return;
+        }
+        const rows = Array.isArray(data) ? data : [data];
+        const id = rows[0]?.id ?? "(unknown)";
+        console.info(`[store] refresh token persisted to Supabase id=${id}`);
+    })
+        .catch((err) => {
+        // Non-fatal — in-memory store still serves same-instance refreshes
+        console.warn("[store] Supabase refresh-token persist error (non-fatal):", err.message);
+    });
+}
+// ---------------------------------------------------------------------------
 // OAuthStore
 // ---------------------------------------------------------------------------
 export class OAuthStore {
@@ -206,18 +236,102 @@ export class OAuthStore {
         }
     }
     // ------------------------------------------------------------------
-    // Refresh tokens (always in-memory — Supabase JWTs handle their own rotation)
+    // Refresh tokens
+    //
+    // In-memory map is the hot path. When Supabase is configured, we ALSO
+    // persist to oauth_refresh_tokens so a refresh request that lands on a
+    // different Fly machine (oe-mcp-live has min_machines_running=2) or
+    // arrives after a machine restart can still be honored. Without this,
+    // ~50% of refresh attempts fail with invalid_grant just from
+    // multi-instance load balancing alone.
     // ------------------------------------------------------------------
+    /**
+     * Refresh-token TTL — 90 days, sliding (reset on each rotation).
+     * Matches GitHub's 6-month convention more closely than Supabase's 30d
+     * default. Tradeoff: longer-lived refresh tokens = bigger blast radius
+     * on leak; rotation + Supabase RLS mitigates this. An active user who
+     * touches OE at least once per 90d gets an effectively permanent
+     * connection.
+     */
+    static REFRESH_TTL_MS = 90 * 24 * 60 * 60 * 1000;
     storeRefreshToken(token, meta) {
-        this.refreshTokens.set(token, { ...meta, consumed: false });
+        const expires_at = new Date(Date.now() + OAuthStore.REFRESH_TTL_MS);
+        this.refreshTokens.set(token, { ...meta, consumed: false, expires_at });
+        // Async durability write — non-blocking
+        persistRefreshTokenToSupabase(token, meta, expires_at);
     }
+    /**
+     * Synchronous in-memory consume. Kept for backward compat with any callers
+     * that don't need cross-instance resilience. Token endpoint must use
+     * consumeRefreshTokenAsync.
+     */
     consumeRefreshToken(token) {
         const stored = this.refreshTokens.get(token);
         if (!stored || stored.consumed)
             return null;
+        if (stored.expires_at < new Date()) {
+            // In-memory entry outlived its TTL. Drop it; the Supabase row (if any)
+            // is also past its expires_at and will be rejected by the WHERE filter
+            // in consumeRefreshTokenAsync's slow path.
+            this.refreshTokens.delete(token);
+            return null;
+        }
         stored.consumed = true;
         return { ...stored };
     }
+    /**
+     * Async consume — checks in-memory first, then Supabase. This is what the
+     * token endpoint uses so refresh requests survive machine restarts and
+     * load-balancing across multiple Fly instances.
+     */
+    async consumeRefreshTokenAsync(token) {
+        // Fast path: in-memory hit
+        const inMem = this.consumeRefreshToken(token);
+        if (inMem)
+            return inMem;
+        // Slow path: Supabase lookup with atomic mark-consumed
+        const cfg = getSupabaseConfig();
+        if (!cfg)
+            return null;
+        try {
+            const selectPath = `/rest/v1/oauth_refresh_tokens` +
+                `?token=eq.${encodeURIComponent(token)}` +
+                `&consumed=eq.false` +
+                `&expires_at=gt.${encodeURIComponent(new Date().toISOString())}` +
+                `&limit=1`;
+            const { status: selStatus, data: selData } = await postgrestRequest("GET", selectPath);
+            if (selStatus < 200 || selStatus >= 300)
+                return null;
+            const rows = Array.isArray(selData) ? selData : [];
+            if (rows.length === 0)
+                return null;
+            const row = rows[0];
+            // Optimistic lock: mark consumed=true WHERE consumed=false
+            const updatePath = `/rest/v1/oauth_refresh_tokens?id=eq.${row.id}&consumed=eq.false`;
+            const { status: updStatus } = await postgrestRequest("PATCH", updatePath, {
+                consumed: true,
+            });
+            if (updStatus < 200 || updStatus >= 300) {
+                // Lost the race — another instance consumed it. Treat as invalid.
+                console.warn(`[store] Supabase refresh-token consume race lost id=${row.id} status=${updStatus}`);
+                return null;
+            }
+            console.info(`[store] refresh token consumed from Supabase id=${row.id}`);
+            const result = {
+                consumed: true,
+                client_id: row.client_id,
+            };
+            if (row.user_id)
+                result.user_id = row.user_id;
+            if (row.supabase_refresh_token)
+                result.supabase_refresh_token = row.supabase_refresh_token;
+            return result;
+        }
+        catch (err) {
+            console.warn("[store] Supabase refresh-token consume error:", err.message);
+            return null;
+        }
+    }
     generateRefreshToken() {
         return randomBytes(32).toString("hex");
     }

package/dist/oauth/token.js

@@ -150,8 +150,10 @@ async function handleRefreshToken(req, res, store) {
         });
         return;
     }
-    // Consume from local store (rotation enforcement)
-    const storedMeta = store.consumeRefreshToken(refresh_token);
+    // Consume from store (in-memory first, then Supabase). Async so refresh
+    // requests survive Fly machine restarts and load-balancing across the
+    // two oe-mcp-live instances.
+    const storedMeta = (await store.consumeRefreshTokenAsync(refresh_token));
     if (!storedMeta) {
         res.status(400).json({
             error: "invalid_grant",

package/dist/prompts.js

@@ -68,9 +68,9 @@ export const PROMPTS = [
             "   Default to Placidus if they're unsure.\n\n" +
             "## Step 2 — Resolve Coordinates and Timezone (MANDATORY)\n" +
             "**Do NOT guess coordinates or timezones from memory.** Use the API tools to resolve them:\n\n" +
-            "**A) Geocode** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**A) Geocode** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'City Name, Country' }`. This returns verified decimal lat/lon.\n\n" +
-            "**B) Timezone** — call `dev_call` with `method: 'POST'`, `path: '/timezone/lookup'`, " +
+            "**B) Timezone** — call `dev_write_api` with `path: '/timezone/lookup'`, " +
             "`body: { latitude: ..., longitude: ..., datetime: 'YYYY-MM-DDTHH:MM:SS' }`. " +
             "This returns the correct IANA timezone and UTC offset for the birth year, including historical DST.\n\n" +
             "- Format: pass `datetime` as local ISO 8601 (e.g. `1990-04-15T14:30:00`) " +
@@ -148,9 +148,9 @@ export const PROMPTS = [
             "4. **Any major events coming up** they already know about — reframes the transits around real context\n\n" +
             "## Step 2 — Resolve Coordinates and Timezone (MANDATORY)\n" +
             "**Do NOT guess coordinates or timezones from memory.** Use the API tools:\n\n" +
-            "**A) Geocode** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**A) Geocode** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Birth City, Country' }`. Use the returned decimal lat/lon.\n\n" +
-            "**B) Timezone** — call `dev_call` with `method: 'POST'`, `path: '/timezone/lookup'`, " +
+            "**B) Timezone** — call `dev_write_api` with `path: '/timezone/lookup'`, " +
             "`body: { latitude: ..., longitude: ..., datetime: 'YYYY-MM-DDTHH:MM:SS' }`.\n\n" +
             "- Set `start_date` to today and `end_date` to the end of the forecast window\n\n" +
             "## Step 3 — Tool Call Sequence\n" +
@@ -211,9 +211,9 @@ export const PROMPTS = [
             "7. **House system**: Placidus (default), Whole Sign, Koch, Equal?\n\n" +
             "## Step 2 — Resolve Both Sets of Coordinates (MANDATORY)\n" +
             "**Do NOT guess coordinates or timezones.** For EACH person:\n\n" +
-            "**A) Geocode** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**A) Geocode** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Birth City, Country' }`.\n\n" +
-            "**B) Timezone** — call `dev_call` with `method: 'POST'`, `path: '/timezone/lookup'`, " +
+            "**B) Timezone** — call `dev_write_api` with `path: '/timezone/lookup'`, " +
             "`body: { latitude: ..., longitude: ..., datetime: 'YYYY-MM-DDTHH:MM:SS' }`.\n\n" +
             "- Format: local ISO 8601 datetime (no Z) + IANA timezone name separately for each person\n" +
             "- Note if either birth time is unknown — flag this upfront before running tools\n\n" +
@@ -283,9 +283,9 @@ export const PROMPTS = [
             "sometimes it explains why a place felt 'off'\n\n" +
             "## Step 2 — Resolve Coordinates (MANDATORY)\n" +
             "**Do NOT guess coordinates or timezones.** Use the API tools:\n\n" +
-            "**A) Geocode birth city** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**A) Geocode birth city** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Birth City, Country' }`.\n\n" +
-            "**B) Timezone** — call `dev_call` with `method: 'POST'`, `path: '/timezone/lookup'`, " +
+            "**B) Timezone** — call `dev_write_api` with `path: '/timezone/lookup'`, " +
             "`body: { latitude: ..., longitude: ..., datetime: 'YYYY-MM-DDTHH:MM:SS' }`.\n\n" +
             "**C) Geocode each target city** — repeat the autocomplete call for each destination city.\n\n" +
             "- Format birth datetime as local ISO 8601 (no Z), pass IANA timezone separately\n\n" +
@@ -372,9 +372,9 @@ export const PROMPTS = [
             "4. **Birth city and country** — needed for timezone conversion\n\n" +
             "## Step 2 — CRITICAL: Convert to UTC\n" +
             "Human Design requires **UTC datetime**. The tool rejects local times without a UTC offset.\n\n" +
-            "**A) Geocode** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**A) Geocode** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Birth City, Country' }`.\n\n" +
-            "**B) Timezone** — call `dev_call` with `method: 'POST'`, `path: '/timezone/lookup'`, " +
+            "**B) Timezone** — call `dev_write_api` with `path: '/timezone/lookup'`, " +
             "`body: { latitude: ..., longitude: ..., datetime: 'YYYY-MM-DDTHH:MM:SS' }`.\n" +
             "This returns the UTC offset for the birth year, including historical DST.\n\n" +
             "- Use the returned offset to convert local birth time → UTC\n" +
@@ -458,7 +458,7 @@ export const PROMPTS = [
             "5. **Any personal chart data?** If yes, run natal chart first and look for dates when the " +
             "moon triggers benefic natal planets.\n\n" +
             "## Step 1.5 — Resolve Event Location (MANDATORY)\n" +
-            "**Do NOT guess coordinates.** Call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**Do NOT guess coordinates.** Call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Event City, Country' }` to get verified decimal lat/lon for the event location.\n\n" +
             "## Step 2 — Check the Planetary Weather First\n" +
             "Before scanning for windows:\n\n" +
@@ -511,6 +511,9 @@ export const PROMPTS = [
             "- Cautions: [anything to be aware of]\n\n" +
             "Close with a clear **★ Top Recommendation** with a one-paragraph explanation of why this " +
             "window is the strongest pick.\n\n" +
+            "**Applying Moon aspects are critical**: The Moon's applying aspects (not yet exact) describe what " +
+            "unfolds after the event begins. A Moon applying to trine Jupiter is excellent; a Moon applying to " +
+            "square Saturn is a warning. Always prioritize applying aspects over separating ones.\n\n" +
             "### If No Good Windows Exist\n" +
             "Be direct: 'There are no high-quality windows in your date range because [specific reason]. " +
             "I'd suggest expanding to [suggested range] where [better conditions] occur.' " +
@@ -542,9 +545,9 @@ export const PROMPTS = [
             "   Default to Lahiri if unsure.\n\n" +
             "## Step 2 — Convert to UTC (MANDATORY)\n" +
             "The `vedic_chart` tool requires a UTC datetime (with Z suffix):\n\n" +
-            "**A) Geocode** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**A) Geocode** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Birth City, Country' }`.\n\n" +
-            "**B) Timezone** — call `dev_call` with `method: 'POST'`, `path: '/timezone/lookup'`, " +
+            "**B) Timezone** — call `dev_write_api` with `path: '/timezone/lookup'`, " +
             "`body: { latitude: ..., longitude: ..., datetime: 'YYYY-MM-DDTHH:MM:SS' }`.\n" +
             "This returns the correct IANA timezone and UTC offset for the birth year, including historical DST.\n\n" +
             "- Use the returned offset to convert local birth time → UTC\n" +
@@ -563,6 +566,9 @@ export const PROMPTS = [
             "- **Whole Sign Bhavas**: the Lagna's sign = the entire 1st Bhava. No intercepted signs.\n" +
             "- **Nakshatras**: 27 lunar mansions of ~13°20' each — the heart of timing and soul-level analysis\n" +
             "- **The Moon is king**: in Jyotish the Moon holds more weight than the Sun for disposition and timing\n" +
+            "- **Vedic aspects (drishti)** differ from Western aspects: they are whole-sign (not degree-orb), and " +
+            "Mars, Jupiter, and Saturn have special additional aspects (Mars: 4th/8th; Jupiter: 5th/9th; Saturn: 3rd/10th). " +
+            "Use the aspect data as returned by the API \u2014 do not apply Western orb-based aspect rules.\n" +
             "- **Guna of chart**: Sattvic (clear, spiritual), Rajasic (active, worldly), or Tamasic (inert)?\n\n" +
             "## Step 5 — Structure the Reading\n\n" +
             "### The Lagna (Ascendant)\n" +
@@ -613,6 +619,9 @@ export const PROMPTS = [
             "   | 🐉 Dragon | 07:00–09:00 | 🐕 Dog | 19:00–21:00 |\n" +
             "   | 🐍 Snake | 09:00–11:00 | 🐖 Pig | 21:00–23:00 |\n" +
             "   If the hour is unknown, note it — the Hour Pillar will be missing.\n" +
+            "   If the birth time is approximate (e.g. 'around noon'), note that the Hour Pillar may be wrong — " +
+            "each shí block is only 2 hours wide. Offer to calculate for the adjacent pillar as a comparison " +
+            "so the user can see which resonates more.\n" +
             "3. **Birth city** — BaZi uses LOCAL solar time, not clock time. City is needed to detect " +
             "any significant longitude offset from the timezone meridian.\n\n" +
             "## Step 2 — Local Solar Time\n" +
@@ -620,7 +629,7 @@ export const PROMPTS = [
             "this difference is small, but it can shift the hour animal by one block for cities far " +
             "from their timezone meridian (e.g. western Xinjiang in China UTC+8, western Spain in CET).\n" +
             "Pass individual date/time components — do NOT convert to UTC.\n\n" +
-            "**Geocode the birth city** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**Geocode the birth city** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Birth City, Country' }` to get verified coordinates for longitude offset calculation.\n\n" +
             "## Step 3 — Call the Tool\n" +
             "Call `chinese_bazi` with:\n" +
@@ -761,9 +770,9 @@ export const PROMPTS = [
             "4. **House system**: Placidus (default), Whole Sign, Koch, Equal?\n\n" +
             "## Step 2 — Resolve Data (MANDATORY)\n" +
             "**Do NOT guess coordinates or timezones.** Use the API tools:\n\n" +
-            "**A) Geocode birth city** — call `dev_call` with `method: 'GET'`, `path: '/location/autocomplete'`, " +
+            "**A) Geocode birth city** — call `dev_read_api` with `path: '/location/autocomplete'`, " +
             "`query: { q: 'Birth City, Country' }`.\n\n" +
-            "**B) Timezone** — call `dev_call` with `method: 'POST'`, `path: '/timezone/lookup'`, " +
+            "**B) Timezone** — call `dev_write_api` with `path: '/timezone/lookup'`, " +
             "`body: { latitude: ..., longitude: ..., datetime: 'YYYY-MM-DDTHH:MM:SS' }`.\n\n" +
             "- For `birth_datetime`, include the UTC offset from the timezone lookup: `1985-06-21T14:00:00-05:00`\n" +
             "  (or convert to UTC with Z: `1985-06-21T19:00:00Z`)\n\n" +