@openephemeris/mcp-server 3.19.0 → 3.20.0

package/CHANGELOG.md

@@ -7,6 +7,26 @@ Version numbering follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [3.20.0] — 2026-07-09
+
+Second wave of the transport/iframe review: legacy transport retirement, resumability, and remaining hardening/quality items.
+
+### Removed
+- **Legacy SSE transport retired.** `GET /sse` + `POST /message` (pre-2025 spec, SDK-deprecated, no cross-machine replay, zero live sessions) now return `410 Gone` pointing at `/mcp`. `scripts/test-sse-client.ts` and the `test:sse` script removed; docs updated.
+
+### Added
+- **`Last-Event-ID` resumability.** Bounded in-memory `EventStore` (200 events/stream, 2h TTL) on the Streamable HTTP transport — a reconnecting SSE stream replays missed events instead of losing them. Per-process is safe because sessions are machine-pinned via fly-replay.
+- **Server-computed natal aspects.** `explore_natal_chart` was discarding the `aspects` array the natal endpoint already returns (with true ephemeris-derived `is_applying`) and re-deriving aspects client-side with an approximate heuristic — `computeAspects` deleted, server aspects mapped through. Bi-wheel cross-aspects stay client-side (two charts, no single endpoint) but the applying/separating heuristic now uses real longitude speeds instead of defaulted guesses.
+- **CSP + keyboard accessibility** on the four iframe apps: inline-only `Content-Security-Policy` meta on each shell; interactive SVG elements (planets, houses, aspects, centers/gates/channels) get `tabindex`/`role`/`aria-label`, Enter/Space activation, and visible focus indicators.
+- **Real-handler test coverage.** `createSseApp()` is now exported and `test/server-sse-real-app.test.ts` drives the actual Express app: 401/WWW-Authenticate contract, expired-JWT refresh signal, session issuance with machine prefix, cross-machine `fly-replay` 307 + loop-guard 404, resume-auth requirement, Host allowlist, and the 410 legacy responses.
+- **`check:plugin` release gate** (`scripts/plugin-audit.ts`): plugin.json version must match the package (it had rotted at 3.1.0) and `openephemeris-plugin.zip` must match the plugin tree by content; `regen:plugin` rebuilds both. Wired into `verify:release`.
+- **CI:** `validate:visual` (Playwright + axe over the app harness) added to the validate workflow; the live canary now sends a **Telegram alert on failure** (needs `TELEGRAM_BOT_TOKEN`/`TELEGRAM_CHAT_ID` secrets; no-ops without them).
+
+### Changed
+- Resume-path auth now runs **before** the session lookup so an unauthenticated probe cannot learn whether a session id exists.
+
+---
+
 ## [3.19.0] — 2026-07-09
 
 Transport hardening + E2E release verification, from a full review of the streaming HTTP transport and iframe app capability.

package/README.md

@@ -187,7 +187,7 @@ The server is hosted at `https://mcp.openephemeris.com/mcp` with full Streamable
 
 - **Claude Web**: Add `https://mcp.openephemeris.com/mcp` as a custom connector URL — leave OAuth Client ID and Secret **blank**. The server uses OAuth 2.1 + PKCE (Dynamic Client Registration), so Claude handles authentication via a browser popup automatically.
 - **Via Smithery**: Use the [Smithery listing](https://smithery.ai/servers/open-ephemeris/openephemeris) for managed connections with any client
-- **Legacy SSE**: `https://mcp.openephemeris.com/sse` remains available for SSE-only clients
+- **Legacy SSE**: retired in 3.20.0 — use Streamable HTTP at `/mcp`
 
 ### Auth and upgrade behavior in MCP clients
 

package/dist/event-store.d.ts

@@ -0,0 +1,11 @@
+import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
+import type { EventStore, EventId, StreamId } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+export declare class InMemoryEventStore implements EventStore {
+    private streams;
+    storeEvent(streamId: StreamId, message: JSONRPCMessage): Promise<EventId>;
+    replayEventsAfter(lastEventId: EventId, { send }: {
+        send: (eventId: EventId, message: JSONRPCMessage) => Promise<void>;
+    }): Promise<StreamId>;
+    /** Drop streams idle past the TTL so abandoned sessions don't leak memory. */
+    private reapStale;
+}

package/dist/event-store.js

@@ -0,0 +1,61 @@
+/**
+ * event-store.ts — bounded in-memory EventStore for Streamable HTTP
+ * resumability (Last-Event-ID).
+ *
+ * Without an event store the transport cannot replay server→client messages
+ * missed across an SSE reconnect — a dropped connection silently loses any
+ * buffered events. This store keeps a small per-session ring of recent events
+ * so a client reconnecting with Last-Event-ID resumes cleanly.
+ *
+ * Deliberately in-memory and per-process: sessions are already machine-pinned
+ * (fly-replay routes a session's requests to its owning machine), so the
+ * events for a session always live on the machine handling its reconnect.
+ */
+import { randomUUID } from "node:crypto";
+const MAX_EVENTS_PER_STREAM = 200;
+const STREAM_TTL_MS = 2 * 60 * 60 * 1000; // matches the session idle TTL
+export class InMemoryEventStore {
+    streams = new Map();
+    async storeEvent(streamId, message) {
+        // Event IDs embed the stream ID so replay can locate the stream without a
+        // secondary index: "<streamId>__<uuid>".
+        const eventId = `${streamId}__${randomUUID()}`;
+        let stream = this.streams.get(streamId);
+        if (!stream) {
+            stream = { events: [], lastTouched: Date.now() };
+            this.streams.set(streamId, stream);
+        }
+        stream.events.push({ eventId, message });
+        stream.lastTouched = Date.now();
+        if (stream.events.length > MAX_EVENTS_PER_STREAM) {
+            stream.events.splice(0, stream.events.length - MAX_EVENTS_PER_STREAM);
+        }
+        this.reapStale();
+        return eventId;
+    }
+    async replayEventsAfter(lastEventId, { send }) {
+        const sep = lastEventId.lastIndexOf("__");
+        const streamId = sep > 0 ? lastEventId.slice(0, sep) : "";
+        const stream = this.streams.get(streamId);
+        if (!stream)
+            return streamId;
+        const idx = stream.events.findIndex((e) => e.eventId === lastEventId);
+        // If the event aged out of the ring, replay nothing rather than
+        // duplicating from an unknown point — the client re-requests as needed.
+        if (idx === -1)
+            return streamId;
+        for (const event of stream.events.slice(idx + 1)) {
+            await send(event.eventId, event.message);
+        }
+        stream.lastTouched = Date.now();
+        return streamId;
+    }
+    /** Drop streams idle past the TTL so abandoned sessions don't leak memory. */
+    reapStale() {
+        const cutoff = Date.now() - STREAM_TTL_MS;
+        for (const [id, stream] of this.streams) {
+            if (stream.lastTouched < cutoff)
+                this.streams.delete(id);
+        }
+    }
+}

package/dist/server-sse.d.ts

@@ -1 +1,7 @@
-export {};
+import express from "express";
+/**
+ * Build the full Express app (auth gate, OAuth routes, /mcp Streamable HTTP,
+ * health, resources). Exported so tests can drive the REAL handlers with
+ * supertest instead of a re-implemented stub. Does not listen.
+ */
+export declare function createSseApp(): Promise<express.Application>;

package/dist/server-sse.js

@@ -14,13 +14,13 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
 import express from "express";
 import axios from "axios";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { InMemoryEventStore } from "./event-store.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, isInitializeRequest, } from "@modelcontextprotocol/sdk/types.js";
 import { initTools, toolRegistry, formatToolResponse, formatToolError, modelVisibleTools } from "./tools/index.js";
 import { BackendClient, runWithClient } from "./backend/client.js";
@@ -418,12 +418,17 @@ function startSseKeepalive(res) {
     }, 25_000);
     res.on("close", () => clearInterval(ping));
 }
-async function main() {
+/**
+ * Build the full Express app (auth gate, OAuth routes, /mcp Streamable HTTP,
+ * health, resources). Exported so tests can drive the REAL handlers with
+ * supertest instead of a re-implemented stub. Does not listen.
+ */
+export async function createSseApp() {
     await initTools();
     const app = express();
-    // NOTE: Do NOT use express.json() globally — SSEServerTransport.handlePostMessage
-    // reads the raw request stream itself. Pre-parsing with express.json() consumes it,
-    // causing "stream is not readable" errors.
+    // NOTE: express.json() is applied per-route (jsonParser on /mcp POST), not
+    // globally — the OAuth token route needs urlencoded, and transports that
+    // read the raw request stream break if the body is pre-consumed.
     // CORS + Origin allowlist
     // Per Anthropic remote-MCP review criteria, browser-originated requests must
     // be validated against an allowlist. Native (no-Origin) clients like Claude
@@ -455,7 +460,7 @@ async function main() {
             .filter(Boolean)
             .map((h) => new RegExp(`^${h.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(:\\d+)?$`, "i")),
     ];
-    const MCP_ROUTES = new Set(["/mcp", "/sse", "/message"]);
+    const MCP_ROUTES = new Set(["/mcp"]);
     app.use((req, res, next) => {
         if (MCP_ROUTES.has(req.path)) {
             const host = req.headers.host;
@@ -491,10 +496,6 @@ async function main() {
         }
         next();
     });
-    // Track active transports by session ID
-    const transports = new Map();
-    // Per-session BackendClient — each connection authenticates independently.
-    const sessionClients = new Map();
     // ---------------------------------------------------------------------------
     // OAuth 2.1 routes — must be mounted BEFORE JSON body parser
     // ---------------------------------------------------------------------------
@@ -531,14 +532,12 @@ async function main() {
         sessionRateLimiter(req, res, next);
     };
     app.use("/mcp", throttleSessionCreation);
-    app.use("/sse", sessionRateLimiter);
     // Health check
     app.get("/health", (_req, res) => {
         res.json({
             ok: true,
             version,
-            transports: ["sse", "streamable-http"],
-            sse_sessions: transports.size,
+            transports: ["streamable-http"],
             http_sessions: httpSessions.size,
         });
     });
@@ -591,6 +590,27 @@ async function main() {
         const sessionId = req.headers["mcp-session-id"];
         // Resume existing session
         if (sessionId) {
+            // A session id alone is not a credential: require a key/JWT BEFORE the
+            // session lookup so an unauthenticated probe can't learn whether a
+            // session id exists, and reject an expired JWT with the OAuth-refresh
+            // signal (same semantics as the init gate below).
+            const resumedAuth = extractAuth(req);
+            if (!resumedAuth.apiKey && !resumedAuth.jwt) {
+                res.set("WWW-Authenticate", `Bearer realm="OpenEphemeris MCP", resource_metadata="${PROTECTED_RESOURCE_METADATA_URL}"`);
+                res.status(401).json({
+                    error: "auth_required",
+                    message: "Authentication required on every request. Pass an API key via X-API-Key header, or a Bearer token via Authorization header.",
+                });
+                return;
+            }
+            if (resumedAuth.jwt && isJwtExpired(resumedAuth.jwt)) {
+                res.set("WWW-Authenticate", `Bearer realm="OpenEphemeris MCP", error="invalid_token", error_description="The access token expired", resource_metadata="${PROTECTED_RESOURCE_METADATA_URL}"`);
+                res.status(401).json({
+                    error: "invalid_token",
+                    message: "Your session token has expired. Re-authorize to continue.",
+                });
+                return;
+            }
             const session = httpSessions.get(sessionId);
             if (!session) {
                 // Cross-machine session recovery (Fly): min_machines_running >= 2 but
@@ -612,26 +632,6 @@ async function main() {
                 });
                 return;
             }
-            // A session id alone is not a credential: require the caller to still
-            // present a key/JWT on every resume, and reject an expired JWT with the
-            // OAuth-refresh signal (same semantics as the init gate below).
-            const resumedAuth = extractAuth(req);
-            if (!resumedAuth.apiKey && !resumedAuth.jwt) {
-                res.set("WWW-Authenticate", `Bearer realm="OpenEphemeris MCP", resource_metadata="${PROTECTED_RESOURCE_METADATA_URL}"`);
-                res.status(401).json({
-                    error: "auth_required",
-                    message: "Authentication required on every request. Pass an API key via X-API-Key header, or a Bearer token via Authorization header.",
-                });
-                return;
-            }
-            if (resumedAuth.jwt && isJwtExpired(resumedAuth.jwt)) {
-                res.set("WWW-Authenticate", `Bearer realm="OpenEphemeris MCP", error="invalid_token", error_description="The access token expired", resource_metadata="${PROTECTED_RESOURCE_METADATA_URL}"`);
-                res.status(401).json({
-                    error: "invalid_token",
-                    message: "Your session token has expired. Re-authorize to continue.",
-                });
-                return;
-            }
             // Refresh the session's Bearer JWT if the host rotated it. claude.ai
             // refreshes tokens via /oauth/token roughly hourly (self-signed Supabase
             // JWTs expire in 1h); the frozen JWT captured at init would otherwise 401
@@ -706,6 +706,10 @@ async function main() {
             // can be replayed to the owner (see the resume branch above). No-op off
             // Fly (FLY_MACHINE_ID unset) — the raw UUID is used unchanged.
             sessionIdGenerator: () => encodeSessionId(randomUUID()),
+            // Last-Event-ID resumability: a reconnecting SSE stream replays the
+            // events it missed instead of silently losing them. Per-process is fine
+            // — the session is machine-pinned via fly-replay.
+            eventStore: new InMemoryEventStore(),
             onsessioninitialized: (id) => {
                 httpSessions.set(id, { server, transport, client, lastSeen: Date.now() });
                 console.error(`[HTTP] Session initialized: ${id}`);
@@ -796,101 +800,23 @@ async function main() {
         }
     });
     // ---------------------------------------------------------------------------
-    // Legacy SSE transport — MCP spec pre-2025 (kept for backward compatibility)
-    // Endpoint: GET https://mcp.openephemeris.com/sse
-    // New integrations should prefer /mcp (Streamable HTTP above).
+    // Legacy SSE transport — RETIRED in 3.20.0.
+    // The pre-2025 HTTP+SSE transport (/sse + /message) was SDK-deprecated, had
+    // no cross-machine replay (broken with min_machines_running >= 2), and live
+    // metrics showed zero sessions. 410 Gone points stragglers at /mcp.
     // ---------------------------------------------------------------------------
-    // SSE endpoint — clients GET /sse to establish a stream
-    app.get("/sse", async (req, res) => {
-        // Extract auth from query param or header (supports API keys + OAuth JWTs)
-        const { apiKey, jwt } = extractAuth(req);
-        if (!apiKey && !jwt) {
-            res.status(401).json({
-                error: "auth_required",
-                message: "Authentication required. Pass an API key via X-API-Key header or query param, or a Bearer JWT via Authorization header. Get a free key at https://openephemeris.com/dashboard?tab=apikeys",
-            });
-            return;
-        }
-        // Validate API keys against the Go backend; JWTs validated downstream.
-        if (apiKey) {
-            const keyStatus = await validateApiKey(apiKey);
-            if (keyStatus === "invalid") {
-                res.status(403).json({
-                    error: "invalid_api_key",
-                    message: "The provided API key is invalid or inactive. Check your key at https://openephemeris.com/dashboard?tab=apikeys",
-                });
-                return;
-            }
-            // Fail closed for browser clients when validation is unavailable (APP-6).
-            if (keyStatus === "unknown" && isBrowserOrigin(req)) {
-                res.set("Retry-After", "5");
-                res.status(503).json({
-                    error: "validation_unavailable",
-                    message: "Could not verify your API key right now. Please retry shortly.",
-                });
-                return;
-            }
-        }
-        const transport = new SSEServerTransport("/message", res);
-        const sessionId = transport.sessionId;
-        transports.set(sessionId, transport);
-        // Create a per-session BackendClient so concurrent SSE connections
-        // don't overwrite each other's API key on the shared singleton.
-        const sessionClient = new BackendClient({
-            baseURL: BACKEND_URL,
-            apiKey,
-            jwt,
+    const legacySseGone = (_req, res) => {
+        res.status(410).json({
+            error: "transport_retired",
+            message: "The legacy SSE transport has been retired. Connect via Streamable HTTP at https://mcp.openephemeris.com/mcp instead.",
         });
-        sessionClients.set(sessionId, sessionClient);
-        const server = createMcpServer();
-        // Guard: prevent double-close from crashing the process
-        let closed = false;
-        const cleanup = () => {
-            if (closed)
-                return;
-            closed = true;
-            transports.delete(sessionId);
-            sessionClients.delete(sessionId);
-            try {
-                server.close().catch(() => { });
-            }
-            catch { /* ignore */ }
-        };
-        transport.onclose = cleanup;
-        // Handle abrupt client disconnects (browser tab closed, etc.)
-        res.on("close", cleanup);
-        try {
-            // server.connect() calls transport.start() internally in SDK v1.27+
-            await server.connect(transport);
-            // Stream is established — keep it alive through Fly's proxy.
-            startSseKeepalive(res);
-        }
-        catch (err) {
-            console.error(`SSE session ${sessionId} failed to start:`, err);
-            cleanup();
-        }
-    });
-    // Message endpoint — clients POST /message?sessionId=xxx
-    app.post("/message", async (req, res) => {
-        const sessionId = req.query.sessionId;
-        const transport = transports.get(sessionId);
-        const sessionClient = sessionClients.get(sessionId);
-        if (!transport) {
-            res.status(400).json({
-                error: "invalid_session",
-                message: "Unknown or expired session. Re-connect to /sse first.",
-            });
-            return;
-        }
-        // Run handlePostMessage inside the session's client context so all tool
-        // handlers reach getActiveClient() and get this user's BackendClient.
-        if (sessionClient) {
-            await runWithClient(sessionClient, () => transport.handlePostMessage(req, res));
-        }
-        else {
-            await transport.handlePostMessage(req, res);
-        }
-    });
+    };
+    app.get("/sse", legacySseGone);
+    app.post("/message", legacySseGone);
+    return app;
+}
+async function main() {
+    const app = await createSseApp();
     // Reap abandoned sessions (no DELETE, no transport close) every 10 minutes.
     setInterval(reapIdleSessions, 10 * 60 * 1000).unref();
     const httpServer = app.listen(PORT, "0.0.0.0", () => {
@@ -919,7 +845,13 @@ process.on("uncaughtException", (err) => {
 process.on("unhandledRejection", (reason) => {
     console.error("Unhandled promise rejection:", reason);
 });
-main().catch((error) => {
-    console.error("Fatal error:", error);
-    process.exit(1);
-});
+// Only listen when run as the entry point — importing createSseApp from
+// tests must not bind a port or install the reaper interval.
+const isDirectRun = process.argv[1] !== undefined &&
+    import.meta.url.toLowerCase() === pathToFileURL(process.argv[1]).href.toLowerCase();
+if (isDirectRun) {
+    main().catch((error) => {
+        console.error("Fatal error:", error);
+        process.exit(1);
+    });
+}

package/dist/tools/apps/bi-wheel-app.js

@@ -248,15 +248,17 @@ export function computeCrossAspects(planets1, planets2) {
     const results = [];
     for (const p1 of planets1) {
         for (const p2 of planets2) {
-            let diff = Math.abs(p1.longitude - p2.longitude) % 360;
-            if (diff > 180)
-                diff = 360 - diff;
+            // Signed separation of p2 ahead of p1 (0–360), folded to shortest arc.
+            const delta = (((p2.longitude - p1.longitude) % 360) + 360) % 360;
+            const diff = delta > 180 ? 360 - delta : delta;
+            // Rate of change of the shortest-arc separation, from real daily motion.
+            const rel = (p2.speed ?? 0) - (p1.speed ?? 0);
+            const dDiff = delta > 180 ? -rel : rel;
             for (const asp of CROSS_ASPECT_DEFS) {
                 const orb = Math.abs(diff - asp.angle);
                 if (orb <= asp.orb) {
-                    const applying = ((p1.speed ?? 1) - (p2.speed ?? 0)) < 0
-                        ? diff < asp.angle
-                        : diff > asp.angle;
+                    // Applying = the separation is moving toward the exact aspect angle.
+                    const applying = (diff - asp.angle) * dDiff < 0;
                     results.push({
                         planet1: p1.name,
                         wheel1: "inner",

package/dist/tools/apps/chart-wheel-app.js

@@ -189,7 +189,7 @@ registerTool({
         const chartData = await client.post("/ephemeris/natal-chart", natalBody);
         // Build human-readable summary for the LLM context
         const summary = buildChartSummary(chartData, String(args.location ?? `${lat}, ${lon}`));
-        // Build the UI payload (planets normalised to array, aspects computed)
+        // Build the UI payload (planets normalised to array, server aspects mapped)
         const modelPayload = buildModelPayload(chartData, {
             datetime,
             timezone: args.timezone ?? null,
@@ -453,52 +453,39 @@ const ALL_KNOWN_BODIES = new Set([...CLASSICAL_PLANETS, ...EXTENDED_BODIES]);
  * Tokens saved vs. full uiPayload: ~85–95% reduction (no 100KB SVG, no asteroid flood).
  */
 /**
- * Compute major aspects between a set of planets.
- * Returns a structured AspectData[] array — the natal chart API does not
- * include aspects in its JSON response; we derive them from longitude data.
+ * Map the server-computed aspects array from /ephemeris/natal-chart (and the
+ * solar-return / progressed responses) to the AspectData shape the chart-wheel
+ * UI consumes: { planet1, planet2, type, angle, orb, applying }.
+ *
+ * The Go API computes aspects by default (options.include_aspects = true),
+ * including a proper ephemeris-based is_applying flag — so no client-side
+ * longitude heuristic is needed. Aspects are optionally filtered to the set of
+ * bodies actually displayed so lines never reference a hidden planet.
  */
-function computeAspects(planets) {
-    const ASPECTS = [
-        { type: "conjunction", angle: 0, orb: 8 },
-        { type: "opposition", angle: 180, orb: 8 },
-        { type: "trine", angle: 120, orb: 8 },
-        { type: "square", angle: 90, orb: 7 },
-        { type: "sextile", angle: 60, orb: 6 },
-        { type: "quincunx", angle: 150, orb: 3 },
-        { type: "semisquare", angle: 45, orb: 2 },
-    ];
+function mapServerAspects(rawAspects, allowedNames) {
+    if (!Array.isArray(rawAspects))
+        return [];
     const results = [];
-    for (let i = 0; i < planets.length; i++) {
-        for (let j = i + 1; j < planets.length; j++) {
-            const p1 = planets[i];
-            const p2 = planets[j];
-            // Angular separation: shortest arc (0–180)
-            let diff = Math.abs(p1.longitude - p2.longitude) % 360;
-            if (diff > 180)
-                diff = 360 - diff;
-            for (const asp of ASPECTS) {
-                const orb = Math.abs(diff - asp.angle);
-                // Tighten orbs when one or both bodies are extended (asteroids, etc.)
-                const p1Extended = EXTENDED_BODIES.has(p1.name.toLowerCase());
-                const p2Extended = EXTENDED_BODIES.has(p2.name.toLowerCase());
-                const effectiveOrb = (p1Extended || p2Extended)
-                    ? Math.min(asp.orb * 0.5, 3) // half standard, capped at 3°
-                    : asp.orb;
-                if (orb <= effectiveOrb) {
-                    // Applying: combined longitudinal speed closing the orb
-                    const applying = ((p1.speed ?? 1) - (p2.speed ?? 0)) < 0 ? diff < asp.angle : diff > asp.angle;
-                    results.push({
-                        planet1: p1.name,
-                        planet2: p2.name,
-                        type: asp.type,
-                        angle: asp.angle,
-                        orb: Math.round(orb * 100) / 100,
-                        applying,
-                    });
-                    break; // Each pair only matches one aspect type
-                }
-            }
-        }
+    for (const a of rawAspects) {
+        if (!a || typeof a !== "object")
+            continue;
+        const p1 = canonicalizeBodyName(String(a.planet1 ?? ""));
+        const p2 = canonicalizeBodyName(String(a.planet2 ?? ""));
+        if (!p1 || !p2)
+            continue;
+        if (allowedNames && (!allowedNames.has(p1) || !allowedNames.has(p2)))
+            continue;
+        results.push({
+            planet1: p1,
+            planet2: p2,
+            type: String(a.aspect_type ?? a.type ?? "aspect").toLowerCase(),
+            angle: Number(a.exact_angle ?? a.angle ?? 0),
+            orb: Math.round(Number(a.orb ?? 0) * 100) / 100,
+            // is_applying may be null when the server cannot determine it
+            applying: typeof a.is_applying === "boolean" ? a.is_applying
+                : typeof a.applying === "boolean" ? a.applying
+                    : undefined,
+        });
     }
     return results;
 }
@@ -536,8 +523,8 @@ function buildModelPayload(chartData, birthParams, houseSystem, svgBase, bodyFil
         // Already normalised (e.g. house system recalculate path)
         planetsArray = chartData.planets;
     }
-    // ── 2. Compute aspects from longitude data (API doesn't return them) ──────
-    const aspects = computeAspects(planetsArray);
+    // ── 2. Map server-computed aspects (filtered to displayed bodies) ─────────
+    const aspects = mapServerAspects(chartData.aspects, new Set(planetsArray.map((p) => p.name)));
     // ── 3. Extract angles — API nests ascendant/MC under an `angles` key ──────
     const rawAngles = chartData.angles;
     const rawHouseObj = chartData.houses;
@@ -626,10 +613,8 @@ function buildChartSummary(data, location) {
             elementCount[el]++;
     }
     const domElement = Object.entries(elementCount).sort((a, b) => b[1] - a[1])[0];
-    // Strongest aspect by tightest orb (use computed aspects from planetsArray)
-    const aspects = computeAspects(planetsArray
-        .filter((p) => p.longitude != null)
-        .map((p) => ({ name: p.name, longitude: p.longitude, speed: p.longitude_speed })));
+    // Strongest aspect by tightest orb (server-computed aspects)
+    const aspects = mapServerAspects(data.aspects);
     const strongest = aspects.sort((a, b) => a.orb - b.orb)[0];
     const strongestNote = strongest
         ? `Closest aspect: ${capitalize(strongest.planet1)} ${strongest.type} ${capitalize(strongest.planet2)} (${strongest.orb.toFixed(1)}° orb)`