nxvet-mcp 0.1.0 → 0.3.0

package/README.md

@@ -41,8 +41,17 @@ claude mcp add nxvet --transport http https://mcp.nx.vet/mcp \
 }
 ```
 
-> claude.ai custom connectors currently require OAuth or unauthenticated URLs; header-based
-> API-key auth works in Claude Code, Cursor, and the MCP Inspector. OAuth support is a future step.
+claude.ai / Claude Desktop / mobile — add a **custom connector** with URL `https://mcp.nx.vet/mcp`;
+the OAuth flow opens a NxVET page where you paste your `nxvet_sk_` key once and approve.
+
+### OAuth design (stateless)
+
+The server is its own minimal OAuth 2.1 authorization server (dynamic client registration + PKCE,
+discovery at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server`).
+There is no token database: client ids, auth codes, and access/refresh tokens are AES-256-GCM-sealed
+blobs (secret from `OAUTH_TOKEN_SECRET`, injected via Secrets Manager) that encrypt the approved API
+key. Any instance can verify any token, and revoking the API key upstream instantly invalidates every
+token minted from it. Raw `Authorization: Bearer nxvet_sk_...` headers keep working alongside OAuth.
 
 Claude Desktop (`claude_desktop_config.json`) or any stdio-only client — uses the npm package:
 

package/dist/dates.js

@@ -0,0 +1,49 @@
+/**
+ * Date ergonomics for LLM clients. The NxVET API speaks Unix epoch
+ * milliseconds; models are bad at epoch arithmetic, so tools accept ISO 8601
+ * inputs and every ms timestamp in responses gains an ISO sibling field.
+ */
+/** Accept epoch ms (number) or an ISO 8601 date/datetime string; return epoch ms. */
+export function parseTimeInput(value) {
+    if (typeof value === "number")
+        return value;
+    const trimmed = value.trim();
+    if (/^\d{11,}$/.test(trimmed))
+        return Number(trimmed); // epoch ms sent as a string
+    // Bare dates are treated as UTC midnight (JS already does this for YYYY-MM-DD).
+    const ms = Date.parse(trimmed);
+    if (Number.isNaN(ms)) {
+        throw new Error(`Could not parse time "${value}" — use epoch milliseconds or ISO 8601 (e.g. "2026-07-06" or "2026-07-06T14:00:00Z")`);
+    }
+    return ms;
+}
+const MS_KEY_PATTERN = /(Ms|Time|At|timestamp)$/;
+// Epoch-ms plausibility window: 2001-09-09 .. 2286-11-20.
+const MIN_MS = 1e12;
+const MAX_MS = 1e13;
+function isEpochMsField(key, value) {
+    return (typeof value === "number" &&
+        Number.isFinite(value) &&
+        value >= MIN_MS &&
+        value < MAX_MS &&
+        MS_KEY_PATTERN.test(key));
+}
+/**
+ * Recursively add `<field>Iso` siblings for every epoch-ms timestamp field,
+ * so clients never do calendar math on raw milliseconds.
+ */
+export function enrichTimestamps(data) {
+    if (Array.isArray(data))
+        return data.map(enrichTimestamps);
+    if (data === null || typeof data !== "object")
+        return data;
+    const out = {};
+    for (const [key, value] of Object.entries(data)) {
+        out[key] = enrichTimestamps(value);
+        if (isEpochMsField(key, value)) {
+            out[`${key}Iso`] = new Date(value).toISOString();
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=dates.js.map

package/dist/dates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dates.js","sourceRoot":"","sources":["../src/dates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;IACnF,gFAAgF;IAChF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,sFAAsF,CACrH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,0DAA0D;AAC1D,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,MAAM,GAAG,IAAI,CAAC;AAEpB,SAAS,cAAc,CAAC,GAAW,EAAE,KAAc;IACjD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,KAAK,IAAI,MAAM;QACf,KAAK,GAAG,MAAM;QACd,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/format.js

@@ -1,8 +1,9 @@
 import { NxVetApiError } from "./client.js";
+import { enrichTimestamps } from "./dates.js";
 /** Cap tool output so a huge transcript list can't blow out the client context. */
 const MAX_RESULT_CHARS = 100_000;
 export function jsonResult(data, note) {
-    let text = typeof data === "string" ? data : JSON.stringify(data, null, 2);
+    let text = typeof data === "string" ? data : JSON.stringify(enrichTimestamps(data), null, 2);
     if (text.length > MAX_RESULT_CHARS) {
         text =
             text.slice(0, MAX_RESULT_CHARS) +

package/dist/format.js.map

@@ -1 +1 @@
-{"version":3,"file":"format.js","sourceRoot":"","sources":["../src/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,IAAa;IACrD,IAAI,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI;YACF,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC;gBAC/B,qBAAqB,gBAAgB,iGAAiG,CAAC;IAC3I,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,MAAM,KAAK,GAA2B;YACpC,GAAG,EAAE,oFAAoF;YACzF,GAAG,EAAE,2EAA2E;YAChF,GAAG,EAAE,oCAAoC;YACzC,GAAG,EAAE,yDAAyD;SAC/D,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,mBAAmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,EAAiC;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../src/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,IAAa;IACrD,IAAI,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI;YACF,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC;gBAC/B,qBAAqB,gBAAgB,iGAAiG,CAAC;IAC3I,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,MAAM,KAAK,GAA2B;YACpC,GAAG,EAAE,oFAAoF;YACzF,GAAG,EAAE,2EAA2E;YAChF,GAAG,EAAE,oCAAoC;YACzC,GAAG,EAAE,yDAAyD;SAC/D,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,mBAAmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,EAAiC;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -1,36 +1,84 @@
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { buildServer, SERVER_NAME, SERVER_VERSION } from "./server.js";
+import { oauthEnabled } from "./oauth/crypto.js";
+import { buildOAuthRouter, wellKnownMetadata } from "./oauth/router.js";
+import { isAccessToken, parseAccessToken } from "./oauth/tokens.js";
 const PORT = Number(process.env.PORT ?? 3000);
+const PUBLIC_URL = (process.env.PUBLIC_URL ?? "https://mcp.nx.vet").replace(/\/+$/, "");
 const app = express();
 app.disable("x-powered-by");
 app.use(express.json({ limit: "1mb" }));
+app.use(express.urlencoded({ extended: false, limit: "64kb" }));
+// CORS so browser-based MCP clients (e.g. the Inspector) can connect directly.
+app.use((req, res, next) => {
+    res.set("Access-Control-Allow-Origin", "*");
+    res.set("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+    res.set("Access-Control-Allow-Headers", "Authorization, Content-Type, Mcp-Protocol-Version, Mcp-Session-Id");
+    res.set("Access-Control-Expose-Headers", "Mcp-Session-Id, WWW-Authenticate");
+    if (req.method === "OPTIONS") {
+        res.sendStatus(204);
+        return;
+    }
+    next();
+});
 app.get("/health", (_req, res) => {
-    res.json({ status: "ok", name: SERVER_NAME, version: SERVER_VERSION });
+    res.json({ status: "ok", name: SERVER_NAME, version: SERVER_VERSION, oauth: oauthEnabled() });
 });
+// OAuth discovery + endpoints (active only when OAUTH_TOKEN_SECRET is set).
+if (oauthEnabled()) {
+    const meta = wellKnownMetadata(PUBLIC_URL);
+    for (const path of ["/.well-known/oauth-protected-resource", "/.well-known/oauth-protected-resource/mcp"]) {
+        app.get(path, (_req, res) => {
+            res.json(meta.protectedResource);
+        });
+    }
+    app.get("/.well-known/oauth-authorization-server", (_req, res) => {
+        res.json(meta.authorizationServer);
+    });
+    app.use("/oauth", buildOAuthRouter());
+}
+function unauthorized(res, message, error) {
+    const challenge = [
+        'Bearer realm="nxvet-mcp"',
+        ...(error ? [`error="${error}"`] : []),
+        ...(oauthEnabled()
+            ? [`resource_metadata="${PUBLIC_URL}/.well-known/oauth-protected-resource"`]
+            : []),
+    ].join(", ");
+    res.status(401).set("WWW-Authenticate", challenge).json({
+        jsonrpc: "2.0",
+        error: { code: -32001, message },
+        id: null,
+    });
+}
+/** Resolve the Authorization header to an NxVET API key (raw key or OAuth access token). */
+function resolveApiKey(authHeader) {
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        return {
+            failure: "Missing credentials. Send 'Authorization: Bearer nxvet_sk_...' (create a key at https://app.nx.vet/integrations) or connect via OAuth.",
+        };
+    }
+    const credential = authHeader.slice("Bearer ".length).trim();
+    if (isAccessToken(credential)) {
+        const payload = parseAccessToken(credential);
+        if (!payload) {
+            return { failure: "OAuth access token is invalid or expired — refresh or re-authorize." };
+        }
+        return { apiKey: payload.k };
+    }
+    return { apiKey: credential };
+}
 /**
- * Stateless Streamable HTTP MCP endpoint.
- * Every POST carries the full JSON-RPC message plus the caller's NxVET API key
- * as `Authorization: Bearer nxvet_sk_...`; a fresh server + transport pair is
+ * Stateless Streamable HTTP MCP endpoint. A fresh server + transport pair is
  * created per request, so any instance behind a load balancer can serve it.
  */
 app.post("/mcp", async (req, res) => {
-    const auth = req.headers.authorization;
-    if (!auth || !auth.startsWith("Bearer ")) {
-        res
-            .status(401)
-            .set("WWW-Authenticate", 'Bearer realm="nxvet-mcp"')
-            .json({
-            jsonrpc: "2.0",
-            error: {
-                code: -32001,
-                message: "Missing API key. Send 'Authorization: Bearer nxvet_sk_...' — create a key at https://app.nx.vet/integrations",
-            },
-            id: null,
-        });
+    const { apiKey, failure } = resolveApiKey(req.headers.authorization);
+    if (!apiKey) {
+        unauthorized(res, failure ?? "Unauthorized", "invalid_token");
         return;
     }
-    const apiKey = auth.slice("Bearer ".length).trim();
     const server = buildServer(apiKey);
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined, // stateless mode
@@ -65,6 +113,6 @@ const methodNotAllowed = (_req, res) => {
 app.get("/mcp", methodNotAllowed);
 app.delete("/mcp", methodNotAllowed);
 app.listen(PORT, () => {
-    console.log(`${SERVER_NAME} v${SERVER_VERSION} listening on :${PORT} (POST /mcp)`);
+    console.log(`${SERVER_NAME} v${SERVER_VERSION} listening on :${PORT} (POST /mcp, OAuth ${oauthEnabled() ? "enabled" : "disabled"})`);
 });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAE9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;AAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAExC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;aACnD,IAAI,CAAC;YACJ,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,IAAI,EAAE,CAAC,KAAK;gBACZ,OAAO,EACL,8GAA8G;aACjH;YACD,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACL,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS,EAAE,iBAAiB;KACjD,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;gBACzD,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,CAAC,IAAqB,EAAE,GAAqB,EAAE,EAAE;IACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,+DAA+D,EAAE;QACjG,EAAE,EAAE,IAAI;KACT,CAAC,CAAC;AACL,CAAC,CAAC;AACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAClC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAErC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACpB,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,KAAK,cAAc,kBAAkB,IAAI,cAAc,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAExF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;AAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACxC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAEhE,+EAA+E;AAC/E,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACzB,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,mEAAmE,CAAC,CAAC;IAC7G,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,CAAC;IAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;AAChG,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,uCAAuC,EAAE,2CAA2C,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,GAAqB,EAAE,OAAe,EAAE,KAAc;IAC1E,MAAM,SAAS,GAAG;QAChB,0BAA0B;QAC1B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,YAAY,EAAE;YAChB,CAAC,CAAC,CAAC,sBAAsB,UAAU,wCAAwC,CAAC;YAC5E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;QACtD,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE;QAChC,EAAE,EAAE,IAAI;KACT,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,UAA8B;IACnD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,OAAO,EACL,wIAAwI;SAC3I,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,YAAY,CAAC,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,eAAe,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS,EAAE,iBAAiB;KACjD,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;gBACzD,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,CAAC,IAAqB,EAAE,GAAqB,EAAE,EAAE;IACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,+DAA+D,EAAE;QACjG,EAAE,EAAE,IAAI;KACT,CAAC,CAAC;AACL,CAAC,CAAC;AACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAClC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAErC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACpB,OAAO,CAAC,GAAG,CACT,GAAG,WAAW,KAAK,cAAc,kBAAkB,IAAI,sBAAsB,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CACxH,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/oauth/crypto.js

@@ -0,0 +1,43 @@
+/**
+ * Sealed-payload crypto for the stateless OAuth layer.
+ * Every OAuth artifact (client id, auth code, access/refresh token) is an
+ * AES-256-GCM-encrypted JSON blob — no database, any instance can mint or
+ * verify, and forgery is impossible without OAUTH_TOKEN_SECRET.
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+let cachedKey = null;
+function key() {
+    if (cachedKey)
+        return cachedKey;
+    const secret = process.env.OAUTH_TOKEN_SECRET;
+    if (!secret || secret.length < 32) {
+        throw new Error("OAUTH_TOKEN_SECRET env var (>= 32 chars) is required for OAuth support");
+    }
+    cachedKey = createHash("sha256").update(secret).digest();
+    return cachedKey;
+}
+export function oauthEnabled() {
+    return (process.env.OAUTH_TOKEN_SECRET ?? "").length >= 32;
+}
+export function seal(payload) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key(), iv);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(payload), "utf8"), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64url");
+}
+export function unseal(sealed) {
+    try {
+        const buf = Buffer.from(sealed, "base64url");
+        const decipher = createDecipheriv("aes-256-gcm", key(), buf.subarray(0, 12));
+        decipher.setAuthTag(buf.subarray(12, 28));
+        const plaintext = Buffer.concat([decipher.update(buf.subarray(28)), decipher.final()]);
+        return JSON.parse(plaintext.toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function sha256url(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+//# sourceMappingURL=crypto.js.map

package/dist/oauth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/oauth/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExF,IAAI,SAAS,GAAkB,IAAI,CAAC;AAEpC,SAAS,GAAG;IACV,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAe;IAClC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,MAAM,CAAI,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC"}

package/dist/oauth/page.js

@@ -0,0 +1,58 @@
+/** Consent page for the paste-key OAuth flow. */
+const escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+export function renderConsentPage(params) {
+    const redirectHost = (() => {
+        try {
+            return new URL(params.redirectUri).hostname;
+        }
+        catch {
+            return "unknown";
+        }
+    })();
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Connect to NxVET</title>
+<style>
+  body { font-family: 'Nunito', -apple-system, system-ui, sans-serif; background: #F3F4F6; margin: 0;
+         display: flex; align-items: center; justify-content: center; min-height: 100vh; }
+  .card { background: #fff; border-radius: 18px; box-shadow: 0 4px 24px rgba(0,0,0,.08);
+          padding: 2.5rem; max-width: 430px; width: calc(100% - 2rem); }
+  h1 { font-size: 1.4rem; margin: 0 0 .5rem; color: #111827; }
+  p { color: #4B5563; font-size: .95rem; line-height: 1.5; }
+  code { background: #F3F4F6; padding: .1rem .35rem; border-radius: 4px; font-size: .85em; }
+  label { display: block; font-weight: 700; color: #111827; margin: 1.25rem 0 .4rem; font-size: .9rem; }
+  input[type=password] { width: 100%; box-sizing: border-box; padding: .7rem .9rem; border: 1px solid #D1D5DB;
+          border-radius: 10px; font-size: .95rem; font-family: monospace; }
+  button { width: 100%; margin-top: 1.25rem; padding: .8rem; background: #7C3AED; color: #fff; border: none;
+          border-radius: 10px; font-size: 1rem; font-weight: 700; cursor: pointer; }
+  button:hover { background: #6D28D9; }
+  .error { background: #FEF2F2; border: 1px solid #FECACA; color: #B91C1C; padding: .7rem .9rem;
+          border-radius: 10px; font-size: .9rem; margin-top: 1rem; }
+  .hint { font-size: .82rem; color: #6B7280; margin-top: 1rem; }
+  .client { background: #F5F3FF; border-radius: 10px; padding: .7rem .9rem; font-size: .9rem; color: #4B5563; }
+</style>
+</head>
+<body>
+<div class="card">
+  <h1>Connect to NxVET</h1>
+  <div class="client"><strong>${escapeHtml(redirectHost)}</strong> is requesting access to your NxVET data.</div>
+  <p>Paste an NxVET API key to authorize. The key determines which organization's data the connection can access, with exactly the same permissions as the key itself.</p>
+  ${params.error ? `<div class="error">${escapeHtml(params.error)}</div>` : ""}
+  <form method="POST" action="/oauth/authorize">
+    <input type="hidden" name="client_id" value="${escapeHtml(params.clientId)}">
+    <input type="hidden" name="redirect_uri" value="${escapeHtml(params.redirectUri)}">
+    <input type="hidden" name="state" value="${escapeHtml(params.state)}">
+    <input type="hidden" name="code_challenge" value="${escapeHtml(params.codeChallenge)}">
+    <label for="api_key">NxVET API key</label>
+    <input type="password" id="api_key" name="api_key" placeholder="nxvet_sk_..." autocomplete="off" required>
+    <button type="submit">Verify &amp; Connect</button>
+  </form>
+  <p class="hint">Create or revoke keys at <a href="https://app.nx.vet/integrations" target="_blank" rel="noopener">app.nx.vet/integrations</a> &rarr; API Keys. Revoking the key instantly disconnects this integration. The key is never stored by the MCP server.</p>
+</div>
+</body>
+</html>`;
+}
+//# sourceMappingURL=page.js.map

package/dist/oauth/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/oauth/page.ts"],"names":[],"mappings":"AAAA,iDAAiD;AAEjD,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAC/B,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAU/F,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA6BuB,UAAU,CAAC,YAAY,CAAC;;IAEpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;;mDAE3B,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;sDACxB,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC;+CACrC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;wDACf,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;;;;;;;;QAQhF,CAAC;AACT,CAAC"}

package/dist/oauth/router.js

@@ -0,0 +1,196 @@
+/**
+ * Minimal OAuth 2.1 authorization server for claude.ai and other MCP clients
+ * that require OAuth. Fully stateless: client ids, auth codes, and tokens are
+ * sealed blobs (see tokens.ts). The "login" step is pasting an NxVET API key,
+ * which is validated live against the NxVET API and sealed into the tokens.
+ */
+import { Router } from "express";
+import { sha256url } from "./crypto.js";
+import { renderConsentPage } from "./page.js";
+import { ACCESS_TOKEN_TTL_S, mintAccessToken, mintAuthCode, mintClientId, mintRefreshToken, parseAuthCode, parseClientId, parseRefreshToken, } from "./tokens.js";
+const NXVET_API_BASE = process.env.NXVET_API_BASE ?? "https://app.nx.vet";
+function isAcceptableRedirectUri(uri) {
+    try {
+        const url = new URL(uri);
+        if (url.hash)
+            return false;
+        if (url.protocol === "https:")
+            return true;
+        // Loopback redirects are allowed for local development clients.
+        return url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+async function validateApiKey(apiKey) {
+    if (!apiKey.startsWith("nxvet_sk_"))
+        return { ok: false };
+    try {
+        const res = await fetch(`${NXVET_API_BASE}/api/auth/me`, {
+            headers: { Authorization: `Bearer ${apiKey}` },
+        });
+        if (!res.ok)
+            return { ok: false };
+        const body = (await res.json());
+        return { ok: true, orgName: body.organizationName };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+function oauthError(res, status, error, description) {
+    res.status(status).json({ error, error_description: description });
+}
+export function wellKnownMetadata(publicUrl) {
+    return {
+        protectedResource: {
+            resource: `${publicUrl}/mcp`,
+            authorization_servers: [publicUrl],
+            bearer_methods_supported: ["header"],
+            resource_name: "NxVET MCP Server",
+            resource_documentation: "https://api.nx.vet/mcp.html",
+        },
+        authorizationServer: {
+            issuer: publicUrl,
+            authorization_endpoint: `${publicUrl}/oauth/authorize`,
+            token_endpoint: `${publicUrl}/oauth/token`,
+            registration_endpoint: `${publicUrl}/oauth/register`,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
+            code_challenge_methods_supported: ["S256"],
+            token_endpoint_auth_methods_supported: ["none"],
+            scopes_supported: ["nxvet"],
+            service_documentation: "https://api.nx.vet/mcp.html",
+        },
+    };
+}
+export function buildOAuthRouter() {
+    const router = Router();
+    // RFC 7591 dynamic client registration (public clients, PKCE-only).
+    router.post("/register", (req, res) => {
+        const redirectUris = req.body?.redirect_uris;
+        if (!Array.isArray(redirectUris) ||
+            redirectUris.length === 0 ||
+            !redirectUris.every((u) => typeof u === "string" && isAcceptableRedirectUri(u))) {
+            oauthError(res, 400, "invalid_redirect_uri", "redirect_uris must be HTTPS (or loopback) URLs without fragments");
+            return;
+        }
+        const clientId = mintClientId({ ru: redirectUris });
+        res.status(201).json({
+            client_id: clientId,
+            redirect_uris: redirectUris,
+            token_endpoint_auth_method: "none",
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            client_name: typeof req.body?.client_name === "string" ? req.body.client_name : undefined,
+        });
+    });
+    // Authorization endpoint: GET renders the paste-key consent page.
+    router.get("/authorize", (req, res) => {
+        const q = (name) => (typeof req.query[name] === "string" ? req.query[name] : "");
+        const clientId = q("client_id");
+        const redirectUri = q("redirect_uri");
+        const client = parseClientId(clientId);
+        if (!client || !client.ru.includes(redirectUri)) {
+            res.status(400).send("Invalid client_id or unregistered redirect_uri.");
+            return;
+        }
+        if (q("response_type") !== "code") {
+            res.redirect(`${redirectUri}${redirectUri.includes("?") ? "&" : "?"}error=unsupported_response_type&state=${encodeURIComponent(q("state"))}`);
+            return;
+        }
+        if (!q("code_challenge") || (q("code_challenge_method") || "S256") !== "S256") {
+            res.redirect(`${redirectUri}${redirectUri.includes("?") ? "&" : "?"}error=invalid_request&error_description=PKCE+S256+required&state=${encodeURIComponent(q("state"))}`);
+            return;
+        }
+        res
+            .type("html")
+            .send(renderConsentPage({
+            clientId,
+            redirectUri,
+            state: q("state"),
+            codeChallenge: q("code_challenge"),
+        }));
+    });
+    // Consent form submission: validate the pasted key, issue the auth code.
+    router.post("/authorize", async (req, res) => {
+        const f = (name) => (typeof req.body?.[name] === "string" ? req.body[name] : "");
+        const clientId = f("client_id");
+        const redirectUri = f("redirect_uri");
+        const client = parseClientId(clientId);
+        if (!client || !client.ru.includes(redirectUri) || !f("code_challenge")) {
+            res.status(400).send("Invalid or expired authorization request. Restart the connection from your MCP client.");
+            return;
+        }
+        const apiKey = f("api_key").trim();
+        const validation = await validateApiKey(apiKey);
+        if (!validation.ok) {
+            res.status(401).type("html").send(renderConsentPage({
+                clientId,
+                redirectUri,
+                state: f("state"),
+                codeChallenge: f("code_challenge"),
+                error: "That API key was rejected by NxVET — check it is a valid, unrevoked nxvet_sk_ key.",
+            }));
+            return;
+        }
+        const code = mintAuthCode({
+            k: apiKey,
+            ch: f("code_challenge"),
+            ru: redirectUri,
+            ci: sha256url(clientId),
+        });
+        const url = new URL(redirectUri);
+        url.searchParams.set("code", code);
+        if (f("state"))
+            url.searchParams.set("state", f("state"));
+        res.redirect(url.toString());
+    });
+    // Token endpoint: authorization_code (with PKCE) and refresh_token grants.
+    router.post("/token", (req, res) => {
+        const f = (name) => (typeof req.body?.[name] === "string" ? req.body[name] : "");
+        const grantType = f("grant_type");
+        if (grantType === "authorization_code") {
+            const code = parseAuthCode(f("code"));
+            if (!code) {
+                oauthError(res, 400, "invalid_grant", "Authorization code is invalid or expired");
+                return;
+            }
+            if (code.ci !== sha256url(f("client_id")) || code.ru !== f("redirect_uri")) {
+                oauthError(res, 400, "invalid_grant", "client_id or redirect_uri mismatch");
+                return;
+            }
+            if (!f("code_verifier") || sha256url(f("code_verifier")) !== code.ch) {
+                oauthError(res, 400, "invalid_grant", "PKCE verification failed");
+                return;
+            }
+            res.json({
+                access_token: mintAccessToken({ k: code.k }),
+                token_type: "Bearer",
+                expires_in: ACCESS_TOKEN_TTL_S,
+                refresh_token: mintRefreshToken({ k: code.k, ci: code.ci }),
+                scope: "nxvet",
+            });
+            return;
+        }
+        if (grantType === "refresh_token") {
+            const refresh = parseRefreshToken(f("refresh_token"));
+            if (!refresh || refresh.ci !== sha256url(f("client_id"))) {
+                oauthError(res, 400, "invalid_grant", "Refresh token is invalid or expired");
+                return;
+            }
+            res.json({
+                access_token: mintAccessToken({ k: refresh.k }),
+                token_type: "Bearer",
+                expires_in: ACCESS_TOKEN_TTL_S,
+                refresh_token: mintRefreshToken({ k: refresh.k, ci: refresh.ci }),
+                scope: "nxvet",
+            });
+            return;
+        }
+        oauthError(res, 400, "unsupported_grant_type", "Use authorization_code or refresh_token");
+    });
+    return router;
+}
+//# sourceMappingURL=router.js.map

package/dist/oauth/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAAC;AAE1E,SAAS,uBAAuB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,gEAAgE;QAChE,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAc;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,cAAc,EAAE;YACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAa,EAAE,MAAc,EAAE,KAAa,EAAE,WAAmB;IACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAIjD,OAAO;QACL,iBAAiB,EAAE;YACjB,QAAQ,EAAE,GAAG,SAAS,MAAM;YAC5B,qBAAqB,EAAE,CAAC,SAAS,CAAC;YAClC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,kBAAkB;YACjC,sBAAsB,EAAE,6BAA6B;SACtD;QACD,mBAAmB,EAAE;YACnB,MAAM,EAAE,SAAS;YACjB,sBAAsB,EAAE,GAAG,SAAS,kBAAkB;YACtD,cAAc,EAAE,GAAG,SAAS,cAAc;YAC1C,qBAAqB,EAAE,GAAG,SAAS,iBAAiB;YACpD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,gBAAgB,EAAE,CAAC,OAAO,CAAC;YAC3B,qBAAqB,EAAE,6BAA6B;SACrD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACvD,MAAM,YAAY,GAAY,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC;QACtD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5B,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAC/E,CAAC;YACD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,EAAE,kEAAkE,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC1F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACvD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC,GAAG,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,yCAAyC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9I,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAC9E,GAAG,CAAC,QAAQ,CAAC,GAAG,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,oEAAoE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YACzK,OAAO;QACT,CAAC;QAED,GAAG;aACA,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CACH,iBAAiB,CAAC;YAChB,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;YACjB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC;SACnC,CAAC,CACH,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAC/B,iBAAiB,CAAC;gBAChB,QAAQ;gBACR,WAAW;gBACX,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;gBACjB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC;gBAClC,KAAK,EAAE,oFAAoF;aAC5F,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC;YACxB,CAAC,EAAE,MAAM;YACT,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC;YACvB,EAAE,EAAE,WAAW;YACf,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;QAElC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3E,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,oCAAoC,CAAC,CAAC;gBAC5E,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACrE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,YAAY,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC5C,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,kBAAkB;gBAC9B,aAAa,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC3D,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACzD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,YAAY,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/C,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,kBAAkB;gBAC9B,aAAa,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;gBACjE,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,EAAE,yCAAyC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/oauth/tokens.js

@@ -0,0 +1,41 @@
+/**
+ * Stateless OAuth artifacts. Each is a prefixed sealed blob with a type tag
+ * and expiry baked in. Revoking the underlying NxVET API key invalidates
+ * every token minted from it (the upstream API rejects the key).
+ */
+import { seal, unseal } from "./crypto.js";
+export const ACCESS_TOKEN_TTL_S = 3600; // 1 hour
+const AUTH_CODE_TTL_S = 60;
+const REFRESH_TOKEN_TTL_S = 30 * 24 * 3600; // 30 days
+const PREFIXES = {
+    client: "nxv_c_",
+    code: "nxv_ac_",
+    access: "nxv_at_",
+    refresh: "nxv_rt_",
+};
+const now = () => Math.floor(Date.now() / 1000);
+function mint(type, payload, ttlSeconds) {
+    const envelope = { t: type, exp: ttlSeconds > 0 ? now() + ttlSeconds : 0, p: payload };
+    return PREFIXES[type] + seal(envelope);
+}
+function parse(type, token) {
+    const prefix = PREFIXES[type];
+    if (!token.startsWith(prefix))
+        return null;
+    const envelope = unseal(token.slice(prefix.length));
+    if (!envelope || envelope.t !== type)
+        return null;
+    if (envelope.exp !== 0 && envelope.exp < now())
+        return null;
+    return envelope.p;
+}
+export const mintClientId = (p) => mint("client", p, 0);
+export const parseClientId = (id) => parse("client", id);
+export const mintAuthCode = (p) => mint("code", p, AUTH_CODE_TTL_S);
+export const parseAuthCode = (code) => parse("code", code);
+export const mintAccessToken = (p) => mint("access", p, ACCESS_TOKEN_TTL_S);
+export const parseAccessToken = (t) => parse("access", t);
+export const mintRefreshToken = (p) => mint("refresh", p, REFRESH_TOKEN_TTL_S);
+export const parseRefreshToken = (t) => parse("refresh", t);
+export const isAccessToken = (t) => t.startsWith(PREFIXES.access);
+//# sourceMappingURL=tokens.js.map

package/dist/oauth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,CAAC,SAAS;AACjD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEtD,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,SAAS;CACV,CAAC;AAoCX,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEhD,SAAS,IAAI,CAAC,IAAkB,EAAE,OAAgB,EAAE,UAAkB;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACjG,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,KAAK,CAAI,IAAkB,EAAE,KAAa;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAW,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,QAAQ,CAAC,CAAM,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAgB,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAc,MAAM,EAAE,IAAI,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAiB,SAAS,EAAE,CAAC,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC"}

package/dist/server.js

@@ -6,7 +6,7 @@ import { registerConversationTools } from "./tools/conversations.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
 import { registerApiKeyTools } from "./tools/apiKeys.js";
 export const SERVER_NAME = "nxvet-mcp";
-export const SERVER_VERSION = "0.1.0";
+export const SERVER_VERSION = "0.3.0";
 /**
  * Build a fresh MCP server bound to one caller's API key.
  * The server is stateless — one instance is created per HTTP request and
@@ -17,7 +17,10 @@ export function buildServer(apiKey) {
         instructions: "Tools for the NxVET veterinary platform API (app.nx.vet): consultation labels with transcripts and " +
             "SOAP notes, NxHub ambient-recording conversations and device timelines, webhook management, and API keys. " +
             "Start with get_identity to discover the caller's organizationId. " +
-            "All *Ms timestamps are Unix epoch milliseconds; label metadata and SOAP content are JSON strings that need parsing.",
+            `The current UTC time is ${new Date().toISOString()} — use it for "today"/"yesterday" style questions instead of guessing. ` +
+            "Time-range tool inputs accept ISO 8601 strings directly (no epoch math needed), and every epoch-ms timestamp " +
+            "in responses has an ...Iso sibling field with the ISO 8601 equivalent — always read the Iso fields. " +
+            "Label metadata and SOAP content are JSON strings that need parsing.",
     });
     const client = new NxVetApiClient(apiKey);
     registerIdentityTools(server, client);

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EACV,qGAAqG;YACrG,4GAA4G;YAC5G,mEAAmE;YACnE,qHAAqH;KACxH,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EACV,qGAAqG;YACrG,4GAA4G;YAC5G,mEAAmE;YACnE,2BAA2B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,yEAAyE;YAC5H,+GAA+G;YAC/G,sGAAsG;YACtG,qEAAqE;KACxE,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tools/conversations.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { jsonResult, run } from "../format.js";
+import { parseTimeInput } from "../dates.js";
 // Device and conversation IDs are interpolated into URL paths — restrict them
 // to safe characters (defense-in-depth alongside encodeURIComponent below).
 const SAFE_ID = /^[A-Za-z0-9._~-]+$/;
@@ -12,6 +13,9 @@ const conversationIdSchema = z
     .regex(SAFE_ID, "conversationId may only contain letters, digits, and . _ ~ -")
     .describe("Conversation ID");
 const enc = encodeURIComponent;
+const timeSchema = z
+    .union([z.number().int(), z.string().min(4)])
+    .describe('Epoch milliseconds OR ISO 8601, e.g. "2026-07-06" (UTC midnight) or "2026-07-06T14:00:00Z"');
 export function registerConversationTools(server, client) {
     server.registerTool("list_conversations", {
         title: "List NxHub conversations",
@@ -44,12 +48,12 @@ export function registerConversationTools(server, client) {
             "Time range must not exceed 6 hours. startMs/endMs are Unix epoch milliseconds.",
         inputSchema: {
             deviceId: deviceIdSchema,
-            startMs: z.number().int().describe("Range start, epoch milliseconds"),
-            endMs: z.number().int().describe("Range end, epoch milliseconds (max 6h after startMs)"),
+            startMs: timeSchema.describe("Range start (epoch ms or ISO 8601)"),
+            endMs: timeSchema.describe("Range end (epoch ms or ISO 8601, max 6h after start)"),
         },
     }, async ({ deviceId, startMs, endMs }) => run(async () => jsonResult((await client.get(`/api/nxhub/conversations/timeline/${enc(deviceId)}`, {
-        startMs,
-        endMs,
+        startMs: parseTimeInput(startMs),
+        endMs: parseTimeInput(endMs),
     })).body)));
     server.registerTool("preview_conversation", {
         title: "Preview conversation creation",
@@ -57,10 +61,14 @@ export function registerConversationTools(server, client) {
             "Time range must not exceed 90 minutes.",
         inputSchema: {
             deviceId: deviceIdSchema,
-            startMs: z.number().int().describe("Range start, epoch milliseconds"),
-            endMs: z.number().int().describe("Range end, epoch milliseconds (max 90 min after startMs)"),
+            startMs: timeSchema.describe("Range start (epoch ms or ISO 8601)"),
+            endMs: timeSchema.describe("Range end (epoch ms or ISO 8601, max 90 min after start)"),
         },
-    }, async (args) => run(async () => jsonResult((await client.get("/api/nxhub/conversations/create/preview", args)).body)));
+    }, async ({ deviceId, startMs, endMs }) => run(async () => jsonResult((await client.get("/api/nxhub/conversations/create/preview", {
+        deviceId,
+        startMs: parseTimeInput(startMs),
+        endMs: parseTimeInput(endMs),
+    })).body)));
     server.registerTool("create_conversation", {
         title: "Create conversation from time range",
         description: "Create a new NxHub conversation from a device time range (max 90 minutes). " +
@@ -68,10 +76,12 @@ export function registerConversationTools(server, client) {
             "Creation queues transcript processing; the conversation moves through COMPLETED → PROCESSING → UPLOADED.",
         inputSchema: {
             deviceId: deviceIdSchema,
-            startMs: z.number().int().describe("Range start, epoch milliseconds"),
-            endMs: z.number().int().describe("Range end, epoch milliseconds (max 90 min after startMs)"),
+            startMs: timeSchema.describe("Range start (epoch ms or ISO 8601)"),
+            endMs: timeSchema.describe("Range end (epoch ms or ISO 8601, max 90 min after start)"),
         },
-    }, async (args) => run(async () => jsonResult((await client.post("/api/nxhub/conversations/create", { body: args })).body)));
+    }, async ({ deviceId, startMs, endMs }) => run(async () => jsonResult((await client.post("/api/nxhub/conversations/create", {
+        body: { deviceId, startMs: parseTimeInput(startMs), endMs: parseTimeInput(endMs) },
+    })).body)));
     server.registerTool("complete_conversation", {
         title: "Force-complete active conversation",
         description: "Mark an ACTIVE NxHub conversation as completed, triggering transcript processing immediately " +

package/dist/tools/conversations.js.map

@@ -1 +1 @@
-{"version":3,"file":"conversations.js","sourceRoot":"","sources":["../../src/tools/conversations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAE/C,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,KAAK,CAAC,OAAO,EAAE,wDAAwD,CAAC;KACxE,QAAQ,CAAC,yCAAyC,CAAC,CAAC;AACvD,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,OAAO,EAAE,8DAA8D,CAAC;KAC9E,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAC/B,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAsB;IACjF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,2EAA2E;YAC3E,8FAA8F;YAC9F,qFAAqF;YACrF,sGAAsG;QACxG,WAAW,EAAE;YACX,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YAC3F,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACnE,MAAM,EAAE,CAAC;iBACN,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;iBAC7E,QAAQ,EAAE;iBACV,QAAQ,CAAC,+BAA+B,CAAC;YAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;SAClF;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACzF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,0HAA0H;QAC5H,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,cAAc,EAAE,oBAAoB;SACrC;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,4BAA4B,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAC5F,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,gHAAgH;YAChH,gFAAgF;QAClF,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;SACzF;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CACE,MAAM,MAAM,CAAC,GAAG,CAAC,qCAAqC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE;QACrE,OAAO;QACP,KAAK;KACN,CAAC,CACH,CAAC,IAAI,CACP,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,uGAAuG;YACvG,wCAAwC;QAC1C,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;SAC7F;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CACrF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EACT,6EAA6E;YAC7E,qEAAqE;YACrE,0GAA0G;QAC5G,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;SAC7F;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACxF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,+FAA+F;YAC/F,gEAAgE;QAClE,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,cAAc,EAAE,oBAAoB;SACrC;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;SAC7F,IAAI,CACR,CACF,CACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"conversations.js","sourceRoot":"","sources":["../../src/tools/conversations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,KAAK,CAAC,OAAO,EAAE,wDAAwD,CAAC;KACxE,QAAQ,CAAC,yCAAyC,CAAC,CAAC;AACvD,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,OAAO,EAAE,8DAA8D,CAAC;KAC9E,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAC/B,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC;KACjB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5C,QAAQ,CAAC,4FAA4F,CAAC,CAAC;AAE1G,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAsB;IACjF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,2EAA2E;YAC3E,8FAA8F;YAC9F,qFAAqF;YACrF,sGAAsG;QACxG,WAAW,EAAE;YACX,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YAC3F,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACnE,MAAM,EAAE,CAAC;iBACN,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;iBAC7E,QAAQ,EAAE;iBACV,QAAQ,CAAC,+BAA+B,CAAC;YAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;SAClF;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACzF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,0HAA0H;QAC5H,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,cAAc,EAAE,oBAAoB;SACrC;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,4BAA4B,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAC5F,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,gHAAgH;YAChH,gFAAgF;QAClF,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAClE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,sDAAsD,CAAC;SACnF;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CACE,MAAM,MAAM,CAAC,GAAG,CAAC,qCAAqC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE;QACrE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;QAChC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;KAC7B,CAAC,CACH,CAAC,IAAI,CACP,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,uGAAuG;YACvG,wCAAwC;QAC1C,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAClE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,0DAA0D,CAAC;SACvF;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CACE,MAAM,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE;QAC1D,QAAQ;QACR,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;QAChC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;KAC7B,CAAC,CACH,CAAC,IAAI,CACP,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EACT,6EAA6E;YAC7E,qEAAqE;YACrE,0GAA0G;QAC5G,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAClE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,0DAA0D,CAAC;SACvF;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CACE,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;QACnD,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE;KACnF,CAAC,CACH,CAAC,IAAI,CACP,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,+FAA+F;YAC/F,gEAAgE;QAClE,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc;YACxB,cAAc,EAAE,oBAAoB;SACrC;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,KAAK,IAAI,EAAE,CACb,UAAU,CACR,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;SAC7F,IAAI,CACR,CACF,CACJ,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nxvet-mcp",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "MCP server for the NxVET API (labels, transcripts, NxHub conversations, webhooks, API keys) — hosted at https://mcp.nx.vet/mcp or run locally via npx",
   "type": "module",
   "main": "dist/index.js",