ofw-mcp 2.9.0 → 2.9.2

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.9.0"
+    "version": "2.9.2"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.9.0",
+      "version": "2.9.2",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.9.0",
+  "version": "2.9.2",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"

package/dist/bundle.js

@@ -34929,7 +34929,8 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "capture_redirect",
   "read_indexed_db",
   "read_dom",
-  "download"
+  "download",
+  "graphql"
 ]);
 
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
@@ -35232,6 +35233,7 @@ function assertIndexedDbScopesArray(value, label) {
 }
 var DOM_SELECTOR_RE = /^[^-]{1,512}$/;
 var DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
+var GRAPHQL_OP_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]{0,127}$/;
 function assertDomSelectorsArray(value, label) {
   if (!Array.isArray(value)) {
     throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
@@ -35268,6 +35270,37 @@ function assertDomSelectorsArray(value, label) {
     }
   }
 }
+function assertGraphqlOpsArray(value, label) {
+  if (!Array.isArray(value)) {
+    throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    assertObject(entry, `${label}[${i}]`);
+    if (entry.name === void 0) {
+      throw new ProtocolError(`${label}[${i}].name: missing`);
+    }
+    if (entry.operationName === void 0) {
+      throw new ProtocolError(`${label}[${i}].operationName: missing`);
+    }
+    if (typeof entry.name !== "string" || !SCOPE_KEY_RE.test(entry.name)) {
+      throw new ProtocolError(`${label}[${i}].name: invalid ${JSON.stringify(entry.name)}`);
+    }
+    if (typeof entry.operationName !== "string" || !GRAPHQL_OP_NAME_RE.test(entry.operationName)) {
+      throw new ProtocolError(`${label}[${i}].operationName: invalid ${JSON.stringify(entry.operationName)}`);
+    }
+    if (seen.has(entry.name)) {
+      throw new ProtocolError(`${label}: duplicate name ${JSON.stringify(entry.name)}`);
+    }
+    seen.add(entry.name);
+    for (const k of Object.keys(entry)) {
+      if (k !== "name" && k !== "operationName") {
+        throw new ProtocolError(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
+      }
+    }
+  }
+}
 function validateFrame(raw) {
   assertObject(raw, "frame");
   const t = raw.type;
@@ -35346,6 +35379,9 @@ function validateHello(raw) {
     if (raw.domSelectors !== void 0) {
       assertDomSelectorsArray(raw.domSelectors, "hello.domSelectors");
     }
+    if (raw.graphqlOps !== void 0) {
+      assertGraphqlOpsArray(raw.graphqlOps, "hello.graphqlOps");
+    }
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
@@ -35595,6 +35631,28 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
+  if (raw.op === "graphql_query") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.name === void 0)
+      throw new ProtocolError("inner.init.name: missing");
+    if (raw.init.variables === void 0) {
+      throw new ProtocolError("inner.init.variables: missing");
+    }
+    assertString(raw.init.name, "inner.init.name");
+    if (raw.init.name.length === 0) {
+      throw new ProtocolError("inner.init.name: must be non-empty");
+    }
+    assertObject(raw.init.variables, "inner.init.variables");
+    if (raw.init.tabUrl !== void 0) {
+      assertString(raw.init.tabUrl, "inner.init.tabUrl");
+    }
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "name" && k !== "variables" && k !== "tabUrl") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on graphql_query`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "download") {
     assertObject(raw.init, "inner.init");
     if (raw.init.url === void 0) {
@@ -35620,7 +35678,7 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download"; got ${JSON.stringify(raw.op)}`);
+  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download", "graphql_query"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -35651,6 +35709,10 @@ function assertStringMap(value, label) {
     }
   }
 }
+var KNOWN_RESPONSE_OPS = /* @__PURE__ */ new Set([
+  ...KNOWN_CAPABILITIES,
+  "graphql_query"
+]);
 function validateInnerResponse(raw) {
   assertPositiveInt(raw.id, "inner.id");
   if (raw.ok === true) {
@@ -35712,6 +35774,13 @@ function validateInnerResponse(raw) {
       assertStringMap(raw.values, "inner.values");
       return raw;
     }
+    if (op === "graphql_query") {
+      if (raw.data === void 0) {
+        throw new ProtocolError("inner.data: missing on graphql_query response");
+      }
+      assertObject(raw.data, "inner.data");
+      return raw;
+    }
     if (op === "download") {
       assertObject(raw.value, "inner.value");
       assertString(raw.value.path, "inner.value.path");
@@ -35736,7 +35805,7 @@ function validateInnerResponse(raw) {
   if (raw.ok === false) {
     assertString(raw.error, "inner.error");
     if (raw.op !== void 0) {
-      if (typeof raw.op !== "string" || !KNOWN_CAPABILITIES.has(raw.op)) {
+      if (typeof raw.op !== "string" || !KNOWN_RESPONSE_OPS.has(raw.op)) {
         throw new ProtocolError(`inner.op: unknown response op ${JSON.stringify(raw.op)}`);
       }
     }
@@ -35928,11 +35997,33 @@ async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
   };
 }
 async function openEncryptedFrame(sessionKey, frame) {
-  const iv = fromB64(frame.iv);
-  const ct = fromB64(frame.ciphertext);
-  const pt = await aesGcmOpen(sessionKey, iv, ct);
-  const parsed = JSON.parse(dec.decode(pt));
-  return validateInnerFrame(parsed);
+  const result = await openEncryptedFrameDetailed(sessionKey, frame);
+  if (result.stage === "ok")
+    return result.inner;
+  throw result.error instanceof Error ? result.error : new Error(String(result.error));
+}
+async function openEncryptedFrameDetailed(sessionKey, frame) {
+  let pt;
+  try {
+    const iv = fromB64(frame.iv);
+    const ct = fromB64(frame.ciphertext);
+    pt = await aesGcmOpen(sessionKey, iv, ct);
+  } catch (error51) {
+    return { stage: "decrypt-failed", error: error51 };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(dec.decode(pt));
+  } catch (error51) {
+    return { stage: "validation-failed", error: error51, recoveredId: void 0 };
+  }
+  try {
+    const inner = validateInnerFrame(parsed);
+    return { stage: "ok", inner };
+  } catch (error51) {
+    const recoveredId = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.id === "number" && Number.isInteger(parsed.id) && parsed.id > 0 ? parsed.id : void 0;
+    return { stage: "validation-failed", error: error51, recoveredId };
+  }
 }
 
 // node_modules/@fetchproxy/server/dist/election.js
@@ -36058,6 +36149,12 @@ async function buildServerHello(opts) {
       ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
     }));
   }
+  if (opts.graphqlOps && opts.graphqlOps.length > 0) {
+    hello.graphqlOps = opts.graphqlOps.map((d) => ({
+      name: d.name,
+      operationName: d.operationName
+    }));
+  }
   return hello;
 }
 
@@ -36148,7 +36245,8 @@ async function startHost(opts) {
     indexedDbScopes: opts.ownIndexedDbScopes,
     localStoragePointers: opts.ownLocalStoragePointers,
     sessionStoragePointers: opts.ownSessionStoragePointers,
-    domSelectors: opts.ownDomSelectors
+    domSelectors: opts.ownDomSelectors,
+    graphqlOps: opts.ownGraphqlOps
   });
   const ownSessionNonce = fromB64(ownHello.sessionNonce);
   let extensionWs = null;
@@ -36385,7 +36483,8 @@ async function startPeer(opts) {
     indexedDbScopes: opts.indexedDbScopes,
     domSelectors: opts.domSelectors,
     localStoragePointers: opts.localStoragePointers,
-    sessionStoragePointers: opts.sessionStoragePointers
+    sessionStoragePointers: opts.sessionStoragePointers,
+    graphqlOps: opts.graphqlOps
   });
   const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
@@ -36429,10 +36528,20 @@ async function startPeer(opts) {
           return;
         if (!session.acceptInboundSeq(frame.seq))
           return;
-        try {
-          const inner = await openEncryptedFrame(session.sessionKey, frame);
-          innerListeners.forEach((cb) => cb(inner));
-        } catch {
+        const result = await openEncryptedFrameDetailed(session.sessionKey, frame);
+        if (result.stage === "ok") {
+          innerListeners.forEach((cb) => cb(result.inner));
+        } else if (result.stage === "decrypt-failed") {
+        } else {
+          console.error("[fetchproxy] peer: received a frame that decrypted OK but failed validation:", result.error);
+          if (result.recoveredId !== void 0) {
+            innerListeners.forEach((cb) => cb({
+              type: "response",
+              id: result.recoveredId,
+              ok: false,
+              error: `malformed response failed protocol validation: ${String(result.error)}`
+            }));
+          }
         }
       }
     } catch (e) {
@@ -36709,6 +36818,10 @@ var FetchproxyServer = class {
   pendingIdb = /* @__PURE__ */ new Map();
   // download awaiters resolve the saved-file metadata (path + size + mime).
   pendingDownload = /* @__PURE__ */ new Map();
+  // 1.x+: graphql_query awaiters resolve the GraphQL `data` object. Its
+  // shape is operation-specific, so the awaiter resolves `unknown` and the
+  // caller narrows.
+  pendingGraphql = /* @__PURE__ */ new Map();
   mcpId = null;
   identity = null;
   // 0.5.3+: in-flight role-election / handle-start promise. Set the
@@ -36796,6 +36909,10 @@ var FetchproxyServer = class {
         selector: d.selector,
         ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
       })),
+      graphqlOps: (opts.graphqlOps ?? []).map((d) => ({
+        name: d.name,
+        operationName: d.operationName
+      })),
       // 0.8.0+: timer + lazy-revive default to ON. Every realty MCP
       // adapter was about to set these to the same numbers anyway; the
       // back-door is `0` (explicit opt-out) if a caller genuinely wants
@@ -36917,6 +37034,7 @@ var FetchproxyServer = class {
         ownLocalStoragePointers: this.opts.localStoragePointers,
         ownSessionStoragePointers: this.opts.sessionStoragePointers,
         ownDomSelectors: this.opts.domSelectors,
+        ownGraphqlOps: this.opts.graphqlOps,
         onPairCode: this.opts.onPairCode
       });
       this.hostHandle.onOwnInner((inner) => this.onInner(inner));
@@ -36945,7 +37063,8 @@ var FetchproxyServer = class {
         indexedDbScopes: this.opts.indexedDbScopes,
         localStoragePointers: this.opts.localStoragePointers,
         sessionStoragePointers: this.opts.sessionStoragePointers,
-        domSelectors: this.opts.domSelectors
+        domSelectors: this.opts.domSelectors,
+        graphqlOps: this.opts.graphqlOps
       });
       this.peerHandle.onInner((inner) => this.onInner(inner));
       this.peerHandle.onRenegotiate(() => {
@@ -37151,6 +37270,7 @@ var FetchproxyServer = class {
         this.pendingRedirect.delete(id);
         this.pendingDownload.delete(id);
         this.pendingIdb.delete(id);
+        this.pendingGraphql.delete(id);
       }
       throw err;
     }
@@ -37960,6 +38080,52 @@ var FetchproxyServer = class {
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
   }
+  /**
+   * 1.x+: run a declared GraphQL operation through the page's own Apollo
+   * client (`window.__APOLLO_CLIENT__`) in the signed-in tab's MAIN world.
+   * Requires `'graphql'` in capabilities AND `name` to match a declared
+   * `graphqlOps` entry. The extension resolves `name` → `operationName` →
+   * the live DocumentNode the page already observed, then invokes
+   * `client.query({ query, variables })` — the site's own request path, so
+   * per-request bot telemetry (Akamai etc.) runs automatically.
+   *
+   * Returns the GraphQL `data` object on success (shape is
+   * operation-specific; the caller narrows). Throws a plain `Error` on
+   * developer mistakes (undeclared capability, undeclared name) and a
+   * descriptive `Error` on the `ok:false` bridge path — which includes the
+   * typed "operation not yet observed on this tab" case (open the site's
+   * page and retry).
+   */
+  async graphqlQuery(opts) {
+    if (!this.opts.capabilities.includes("graphql")) {
+      throw new Error('FetchproxyServer.graphqlQuery(): MCP did not declare "graphql" in capabilities');
+    }
+    if (typeof opts.name !== "string" || opts.name.length === 0) {
+      throw new Error("FetchproxyServer.graphqlQuery: opts.name must be a non-empty string");
+    }
+    const declaredNames = this.opts.graphqlOps.map((d) => d.name);
+    if (!declaredNames.includes(opts.name)) {
+      throw new Error(`FetchproxyServer.graphqlQuery: operation ${JSON.stringify(opts.name)} not in declared graphqlOps [${declaredNames.map((n) => JSON.stringify(n)).join(", ")}]`);
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "graphql_query",
+      init: {
+        name: opts.name,
+        variables: opts.variables,
+        ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
+      }
+    };
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve2, reject });
+    });
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
+  }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
     if (undeclared.length > 0) {
@@ -38097,6 +38263,20 @@ var FetchproxyServer = class {
       }
       return;
     }
+    const graphqlCb = this.pendingGraphql.get(inner.id);
+    if (graphqlCb) {
+      this.pendingGraphql.delete(inner.id);
+      if (inner.ok) {
+        if (inner.op === "graphql_query") {
+          graphqlCb.resolve(inner.data);
+        } else {
+          graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
+        }
+      } else {
+        graphqlCb.reject(new FetchproxyProtocolError(inner.error));
+      }
+      return;
+    }
     const cookiesCb = this.pendingReadCookies.get(inner.id);
     if (cookiesCb) {
       this.pendingReadCookies.delete(inner.id);
@@ -38148,6 +38328,9 @@ var FetchproxyServer = class {
     for (const { reject } of this.pendingDownload.values())
       reject(err);
     this.pendingDownload.clear();
+    for (const { reject } of this.pendingGraphql.values())
+      reject(err);
+    this.pendingGraphql.clear();
   }
   /**
    * 0.5.2+: read the current pair-pending pair code from whichever handle
@@ -38407,7 +38590,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.9.0",
+  version: "2.9.2",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -38442,8 +38625,8 @@ var package_default = {
     "worker:test": "vitest run --config vitest.workers.config.ts"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.13.0",
-    "@fetchproxy/bootstrap": "^1.3.0",
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/bootstrap": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
     zod: "^4.4.3"
@@ -38689,11 +38872,208 @@ var OFWClient = class {
 };
 var client = new OFWClient();
 
+// src/timestamps.ts
+var DEFAULT_DISPLAY_TZ = "America/New_York";
+function isValidTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function displayTimeZone() {
+  const configured = readEnvVar("DISPLAY_TZ");
+  if (configured && isValidTimeZone(configured)) return configured;
+  return DEFAULT_DISPLAY_TZ;
+}
+function offsetAt(instant, tz) {
+  const w = wallPartsIn(instant, tz);
+  const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
+  const minutes = Math.round((asUTC - instant.getTime()) / 6e4);
+  const sign = minutes < 0 ? "-" : "+";
+  const abs = Math.abs(minutes);
+  return `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
+}
+var wallPartsFormatters = /* @__PURE__ */ new Map();
+var displayFormatters = /* @__PURE__ */ new Map();
+function wallPartsFormatter(tz) {
+  let fmt = wallPartsFormatters.get(tz);
+  if (!fmt) {
+    fmt = buildWallPartsFormatter(tz);
+    wallPartsFormatters.set(tz, fmt);
+  }
+  return fmt;
+}
+function wallPartsIn(instant, tz) {
+  const parts = wallPartsFormatter(tz).formatToParts(instant);
+  const out = {};
+  for (const p of parts) {
+    if (p.type !== "literal") out[p.type] = Number(p.value);
+  }
+  return out;
+}
+function buildWallPartsFormatter(tz) {
+  return new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    // h23 pins midnight to hour 00; without it some ICU builds render hour 24.
+    hourCycle: "h23"
+  });
+}
+function wallTimeToInstant(y, mo, d, h, mi, s, ms, tz) {
+  let guess = Date.UTC(y, mo - 1, d, h, mi, s, ms);
+  for (let i = 0; i < 2; i += 1) {
+    const seen = wallPartsIn(new Date(guess), tz);
+    const seenUTC = Date.UTC(seen.year, seen.month - 1, seen.day, seen.hour, seen.minute, seen.second, ms);
+    const drift = Date.UTC(y, mo - 1, d, h, mi, s, ms) - seenUTC;
+    if (drift === 0) break;
+    guess += drift;
+  }
+  return new Date(guess);
+}
+function pad(n, width = 2) {
+  return String(n).padStart(width, "0");
+}
+function isoWithOffset(instant, tz, offset) {
+  const w = wallPartsIn(instant, tz);
+  const msPart = instant.getUTCMilliseconds();
+  const frac = msPart ? `.${pad(msPart, 3)}` : "";
+  return `${pad(w.year, 4)}-${pad(w.month)}-${pad(w.day)}T${pad(w.hour)}:${pad(w.minute)}:${pad(w.second)}${frac}${offset}`;
+}
+function formatInstant(instant, tz = displayTimeZone()) {
+  const offset = offsetAt(instant, tz);
+  let fmt = displayFormatters.get(tz);
+  if (!fmt) {
+    fmt = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      weekday: "short",
+      month: "short",
+      day: "numeric",
+      year: "numeric",
+      hour: "numeric",
+      minute: "2-digit",
+      timeZoneName: "short"
+    });
+    displayFormatters.set(tz, fmt);
+  }
+  return { iso: isoWithOffset(instant, tz, offset), display: fmt.format(instant) };
+}
+var TIMESTAMP_KEYS = /* @__PURE__ */ new Set([
+  // OFW: naive local wall-clock from the API.
+  "sentAt",
+  "viewedAt",
+  "modifiedAt",
+  "createdAt",
+  "dueAt",
+  "occurredAt",
+  // OFW: UTC instants we stamp ourselves.
+  "fetchedBodyAt",
+  "fetchedAt",
+  "syncedAt",
+  "downloadedAt",
+  "recordedAt",
+  "expiresAt",
+  // Freshness/sync bookkeeping. These sit in the SAME object as `asOf`, so
+  // omitting them left the freshness block emitting two zones at once — the
+  // exact defect this module exists to remove. Enumerated from a sweep of
+  // emitted field names rather than from the ones a bug report happened to
+  // mention.
+  "asOf",
+  "checkedAt",
+  "lastVerifiedAt",
+  "oldestVerifiedAt",
+  "lastServerSyncAt",
+  "lastSyncAt",
+  // OFW API inner shape: `date: { dateTime }`, `viewed: { dateTime }`.
+  "dateTime",
+  // Generic.
+  "date",
+  "updated",
+  "lastModified",
+  "expirationTime"
+]);
+var ZONE_NAME_KEYS = /* @__PURE__ */ new Set(["timeZone", "timezone"]);
+var RFC3339_WITH_OFFSET = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?(Z|[+-]\d{2}:?\d{2})$/;
+var NAIVE_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?$/;
+var DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+function isRealCalendarDate(p) {
+  const utc = new Date(Date.UTC(p.year, p.month - 1, p.day, p.hour, p.minute, p.second));
+  return utc.getUTCFullYear() === p.year && utc.getUTCMonth() === p.month - 1 && utc.getUTCDate() === p.day && utc.getUTCHours() === p.hour && utc.getUTCMinutes() === p.minute && utc.getUTCSeconds() === p.second;
+}
+function parseTimestampValue(key, value, assumeNaiveIn) {
+  if (typeof value !== "string") return null;
+  const raw = value.trim();
+  if (raw === "" || DATE_ONLY.test(raw)) return null;
+  if (RFC3339_WITH_OFFSET.test(raw)) {
+    const parsed = new Date(raw.replace(" ", "T"));
+    return Number.isNaN(parsed.getTime()) ? null : parsed;
+  }
+  const naive = NAIVE_DATE_TIME.exec(raw);
+  if (naive) {
+    const [, y, mo, d, h, mi, s, frac] = naive;
+    const ms = frac ? Number(frac.padEnd(3, "0").slice(0, 3)) : 0;
+    const parts = {
+      year: Number(y),
+      month: Number(mo),
+      day: Number(d),
+      hour: Number(h),
+      minute: Number(mi),
+      second: Number(s ?? "0")
+    };
+    if (!isRealCalendarDate(parts)) return null;
+    return wallTimeToInstant(
+      parts.year,
+      parts.month,
+      parts.day,
+      parts.hour,
+      parts.minute,
+      parts.second,
+      ms,
+      assumeNaiveIn
+    );
+  }
+  return null;
+}
+function walk(node, tz) {
+  if (Array.isArray(node)) {
+    for (const item of node) walk(item, tz);
+    return node;
+  }
+  if (node === null || typeof node !== "object") return node;
+  const obj = node;
+  for (const key of Object.keys(obj)) {
+    const value = obj[key];
+    if (value !== null && typeof value === "object") {
+      walk(value, tz);
+      continue;
+    }
+    if (ZONE_NAME_KEYS.has(key) || !TIMESTAMP_KEYS.has(key)) continue;
+    const instant = parseTimestampValue(key, value, tz);
+    if (!instant) continue;
+    const { iso, display } = formatInstant(instant, tz);
+    obj[key] = iso;
+    obj[`${key}Display`] = display;
+  }
+  return obj;
+}
+function normalizeTimestampsInValue(value, tz = displayTimeZone()) {
+  if (value === null || typeof value !== "object") return value;
+  return walk(structuredClone(value), tz);
+}
+
 // src/tools/_shared.ts
-var jsonResponse = textResult;
+function jsonResponse(data) {
+  return textResult(normalizeTimestampsInValue(data));
+}
 var textResponse = rawTextResult;
 function jsonErrorResponse(data) {
-  return { ...textResult(data), isError: true };
+  return { ...jsonResponse(data), isError: true };
 }
 var ApiRecipientSchema = external_exports.looseObject({
   // Live OFW payloads key the recipient's id as `userId` (verified against a
@@ -40191,7 +40571,7 @@ function orderedPages(objects) {
   if (rootRef === void 0) return inFileOrder;
   const ordered = [];
   const seen = /* @__PURE__ */ new Set();
-  const walk = (num) => {
+  const walk2 = (num) => {
     if (seen.has(num)) return;
     seen.add(num);
     const obj = objects.get(num);
@@ -40201,9 +40581,9 @@ function orderedPages(objects) {
       return;
     }
     const kids = /\/Kids\s*\[([^\]]*)\]/.exec(obj.body)?.[1];
-    if (kids) for (const kid of refsIn(kids)) walk(kid);
+    if (kids) for (const kid of refsIn(kids)) walk2(kid);
   };
-  walk(rootRef);
+  walk2(rootRef);
   return ordered.length > 0 ? ordered : inFileOrder;
 }
 function streamBytes(bytes, obj) {
@@ -42714,7 +43094,7 @@ var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
 await runMcp({
   name: "ofw",
-  version: "2.9.0",
+  version: "2.9.2",
   // x-release-please-version
   deps: client,
   tools: [

package/dist/index.js

@@ -35,7 +35,7 @@ const nodeAttachmentIO = new NodeAttachmentIO();
 // always succeeds before any credential check runs.
 await runMcp({
     name: 'ofw',
-    version: '2.9.0', // x-release-please-version
+    version: '2.9.2', // x-release-please-version
     deps: client,
     tools: [
         registerUserTools,

package/dist/timestamps.js

@@ -0,0 +1,282 @@
+// Canonical timestamp handling for every structured OFW response.
+//
+// A single response object used to mix zones: `sentAt`/`viewedAt`/`modifiedAt`
+// came from OFW's API as NAIVE local wall-clock ("2026-07-27T23:31:09", no
+// offset), while `fetchedBodyAt` and `freshness.asOf` were stamped by us as UTC
+// with a `Z`. Nothing in the payload said which was which, so a reader assumed
+// one zone for both and was wrong by the UTC offset on half the fields.
+//
+// The failure that matters is the calendar DAY. A message sent 10:38 PM Eastern
+// reported as 02:38 lands on the following day, and in a co-parenting record
+// that decides which custody day an event belongs to and whether it beat a
+// 48-hour response window.
+//
+// Every value that survives detection is rewritten to ISO-8601 WITH an
+// explicit offset and paired with a `<key>Display` sibling rendered in the
+// operator's zone, weekday included, because a wrong weekday is what makes a
+// date-boundary error visible at a glance.
+//
+// NOTE: this mirrors the helper in gogcli-mcp. Both connectors had the same
+// defect, and the two copies should collapse into @chrischall/mcp-utils once
+// that package next ships.
+import { readEnvVar } from '@chrischall/mcp-utils';
+// Fallback display zone for this deployment. IANA name, never a fixed offset —
+// a hardcoded -04:00 would be an hour wrong from November through March.
+export const DEFAULT_DISPLAY_TZ = 'America/New_York';
+function isValidTimeZone(tz) {
+    try {
+        new Intl.DateTimeFormat('en-US', { timeZone: tz });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// The zone all *Display fields render in, and the zone a NAIVE source value is
+// assumed to be wall-clock in. OFW's API reports naive local times in the
+// account's own zone, so this must match it. An invalid DISPLAY_TZ falls back
+// rather than throwing, so a typo degrades the label instead of breaking
+// every tool.
+export function displayTimeZone() {
+    const configured = readEnvVar('DISPLAY_TZ');
+    if (configured && isValidTimeZone(configured))
+        return configured;
+    return DEFAULT_DISPLAY_TZ;
+}
+// Offset of `tz` at a given instant, as "+HH:MM"/"-HH:MM". Uses the IANA
+// database via Intl, so DST is handled per-instant rather than per-zone.
+function offsetAt(instant, tz) {
+    // Derived arithmetically rather than parsed out of Intl's "GMT-04:00" label:
+    // the gap between the zone's wall clock and the instant IS the offset, and
+    // zone offsets are always whole minutes.
+    const w = wallPartsIn(instant, tz);
+    const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
+    const minutes = Math.round((asUTC - instant.getTime()) / 60_000);
+    const sign = minutes < 0 ? '-' : '+';
+    const abs = Math.abs(minutes);
+    return `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
+}
+// Wall-clock fields of `instant` as seen in `tz`, via Intl so the IANA rules
+// (including DST) apply.
+// Intl.DateTimeFormat construction dominates the cost here, and a 50-message
+// listing formats hundreds of timestamps. Cache one formatter per zone.
+const wallPartsFormatters = new Map();
+const displayFormatters = new Map();
+function wallPartsFormatter(tz) {
+    let fmt = wallPartsFormatters.get(tz);
+    if (!fmt) {
+        fmt = buildWallPartsFormatter(tz);
+        wallPartsFormatters.set(tz, fmt);
+    }
+    return fmt;
+}
+function wallPartsIn(instant, tz) {
+    const parts = wallPartsFormatter(tz).formatToParts(instant);
+    const out = {};
+    for (const p of parts) {
+        if (p.type !== 'literal')
+            out[p.type] = Number(p.value);
+    }
+    return out;
+}
+function buildWallPartsFormatter(tz) {
+    return new Intl.DateTimeFormat('en-US', {
+        timeZone: tz,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+        second: '2-digit',
+        // h23 pins midnight to hour 00; without it some ICU builds render hour 24.
+        hourCycle: 'h23',
+    });
+}
+// Interpret naive wall-clock fields as an instant in `tz`. There is no direct
+// inverse of the zone rules, so guess UTC, measure how far the guess lands from
+// the requested wall time in that zone, and correct. Two passes settle the case
+// where the correction itself crosses a DST boundary.
+function wallTimeToInstant(y, mo, d, h, mi, s, ms, tz) {
+    let guess = Date.UTC(y, mo - 1, d, h, mi, s, ms);
+    for (let i = 0; i < 2; i += 1) {
+        const seen = wallPartsIn(new Date(guess), tz);
+        const seenUTC = Date.UTC(seen.year, seen.month - 1, seen.day, seen.hour, seen.minute, seen.second, ms);
+        const drift = Date.UTC(y, mo - 1, d, h, mi, s, ms) - seenUTC;
+        if (drift === 0)
+            break;
+        guess += drift;
+    }
+    return new Date(guess);
+}
+function pad(n, width = 2) {
+    return String(n).padStart(width, '0');
+}
+// Render `instant` as ISO-8601 carrying `offset`'s wall time and label.
+function isoWithOffset(instant, tz, offset) {
+    const w = wallPartsIn(instant, tz);
+    const msPart = instant.getUTCMilliseconds();
+    const frac = msPart ? `.${pad(msPart, 3)}` : '';
+    return `${pad(w.year, 4)}-${pad(w.month)}-${pad(w.day)}T${pad(w.hour)}:${pad(w.minute)}:${pad(w.second)}${frac}${offset}`;
+}
+// The one place an instant becomes user-visible text. Every emitted timestamp
+// goes through here, so no call site can reintroduce a naive value.
+export function formatInstant(instant, tz = displayTimeZone()) {
+    const offset = offsetAt(instant, tz);
+    let fmt = displayFormatters.get(tz);
+    if (!fmt) {
+        fmt = new Intl.DateTimeFormat('en-US', {
+            timeZone: tz,
+            weekday: 'short',
+            month: 'short',
+            day: 'numeric',
+            year: 'numeric',
+            hour: 'numeric',
+            minute: '2-digit',
+            timeZoneName: 'short',
+        });
+        displayFormatters.set(tz, fmt);
+    }
+    return { iso: isoWithOffset(instant, tz, offset), display: fmt.format(instant) };
+}
+// Keys whose STRING values are timestamps. Deliberately an allowlist rather
+// than a name pattern: a value must ALSO match a timestamp shape below, so both
+// the key and the value have to agree before anything is touched. That keeps
+// user-authored content (a message body quoting a date, an expense description)
+// from ever being rewritten.
+const TIMESTAMP_KEYS = new Set([
+    // OFW: naive local wall-clock from the API.
+    'sentAt',
+    'viewedAt',
+    'modifiedAt',
+    'createdAt',
+    'dueAt',
+    'occurredAt',
+    // OFW: UTC instants we stamp ourselves.
+    'fetchedBodyAt',
+    'fetchedAt',
+    'syncedAt',
+    'downloadedAt',
+    'recordedAt',
+    'expiresAt',
+    // Freshness/sync bookkeeping. These sit in the SAME object as `asOf`, so
+    // omitting them left the freshness block emitting two zones at once — the
+    // exact defect this module exists to remove. Enumerated from a sweep of
+    // emitted field names rather than from the ones a bug report happened to
+    // mention.
+    'asOf',
+    'checkedAt',
+    'lastVerifiedAt',
+    'oldestVerifiedAt',
+    'lastServerSyncAt',
+    'lastSyncAt',
+    // OFW API inner shape: `date: { dateTime }`, `viewed: { dateTime }`.
+    'dateTime',
+    // Generic.
+    'date',
+    'updated',
+    'lastModified',
+    'expirationTime',
+]);
+// Deliberately NOT timestamps: `startDate`/`endDate` are YYYY-MM-DD and
+// `startTime`/`endTime` are HH:mm — a calendar date and a wall time, neither of
+// which denotes an instant. Attaching an offset would invent information. The
+// shape guards below would reject them anyway; this records the intent.
+// Keys that hold a zone NAME rather than an instant. They cannot match a
+// timestamp shape anyway, but naming them documents the hazard.
+const ZONE_NAME_KEYS = new Set(['timeZone', 'timezone']);
+const RFC3339_WITH_OFFSET = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?(Z|[+-]\d{2}:?\d{2})$/;
+const NAIVE_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?$/;
+// A bare YYYY-MM-DD is a DATE, not an instant — Calendar uses it for all-day
+// events. Converting one would invent a time that the source never asserted.
+const DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+// True when the components describe a real calendar instant. Guards against
+// Date.UTC's silent rollover of out-of-range values.
+function isRealCalendarDate(p) {
+    const utc = new Date(Date.UTC(p.year, p.month - 1, p.day, p.hour, p.minute, p.second));
+    return utc.getUTCFullYear() === p.year
+        && utc.getUTCMonth() === p.month - 1
+        && utc.getUTCDate() === p.day
+        && utc.getUTCHours() === p.hour
+        && utc.getUTCMinutes() === p.minute
+        && utc.getUTCSeconds() === p.second;
+}
+// Resolve a raw field value to an instant, or null when it is not a timestamp.
+// `assumeNaiveIn` is the zone a naive (offset-less) value is wall-clock in.
+export function parseTimestampValue(key, value, assumeNaiveIn) {
+    if (typeof value !== 'string')
+        return null;
+    const raw = value.trim();
+    if (raw === '' || DATE_ONLY.test(raw))
+        return null;
+    if (RFC3339_WITH_OFFSET.test(raw)) {
+        // The source already knows its offset; trust it verbatim.
+        const parsed = new Date(raw.replace(' ', 'T'));
+        return Number.isNaN(parsed.getTime()) ? null : parsed;
+    }
+    const naive = NAIVE_DATE_TIME.exec(raw);
+    if (naive) {
+        const [, y, mo, d, h, mi, s, frac] = naive;
+        const ms = frac ? Number(frac.padEnd(3, '0').slice(0, 3)) : 0;
+        const parts = {
+            year: Number(y), month: Number(mo), day: Number(d),
+            hour: Number(h), minute: Number(mi), second: Number(s ?? '0'),
+        };
+        // Date.UTC silently rolls impossible components over — month 99 becomes
+        // 2034, Feb 30 becomes Mar 2 — so a typo would surface as a confident wrong
+        // date rather than a rejection. The offset branch above already returns
+        // null for the same input; match it.
+        //
+        // Checked in UTC space, deliberately: validating against the ZONE's wall
+        // clock would also reject a non-existent spring-forward time like
+        // 2026-03-08 02:30 ET, and shifting such a value forward (as zone libraries
+        // do) is better than dropping a timestamp we can place to within an hour.
+        if (!isRealCalendarDate(parts))
+            return null;
+        return wallTimeToInstant(parts.year, parts.month, parts.day, parts.hour, parts.minute, parts.second, ms, assumeNaiveIn);
+    }
+    return null;
+}
+// True when a string carries no zone information — the shape this whole module
+// exists to eliminate. Used by the contract test.
+export function isNaiveTimestamp(value) {
+    return typeof value === 'string' && NAIVE_DATE_TIME.test(value.trim());
+}
+// Walk a parsed payload, rewriting every allowlisted timestamp to canonical
+// form and attaching its display sibling. Mutates and returns `node`.
+function walk(node, tz) {
+    if (Array.isArray(node)) {
+        for (const item of node)
+            walk(item, tz);
+        return node;
+    }
+    if (node === null || typeof node !== 'object')
+        return node;
+    const obj = node;
+    for (const key of Object.keys(obj)) {
+        const value = obj[key];
+        if (value !== null && typeof value === 'object') {
+            walk(value, tz);
+            continue;
+        }
+        if (ZONE_NAME_KEYS.has(key) || !TIMESTAMP_KEYS.has(key))
+            continue;
+        const instant = parseTimestampValue(key, value, tz);
+        if (!instant)
+            continue;
+        const { iso, display } = formatInstant(instant, tz);
+        obj[key] = iso;
+        obj[`${key}Display`] = display;
+    }
+    return obj;
+}
+// Normalize every timestamp in a structured response payload.
+//
+// The input is CLONED before walking: response payloads routinely include live
+// cache rows, and rewriting those in place would corrupt the cache and make the
+// normalization observable on a later read. Primitives pass through untouched
+// so the seam is safe for any tool result.
+export function normalizeTimestampsInValue(value, tz = displayTimeZone()) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    return walk(structuredClone(value), tz);
+}

package/dist/tools/_shared.js

@@ -1,9 +1,19 @@
 import { expandPath as expandPathUtil, rawTextResult, textResult } from '@chrischall/mcp-utils';
 import { z } from 'zod';
 import { parseLenient } from '@chrischall/mcp-utils';
+import { normalizeTimestampsInValue } from '../timestamps.js';
 // Pretty-printed JSON tool result. Thin wrapper over @chrischall/mcp-utils'
-// `textResult` so the rest of the codebase keeps the local name.
-export const jsonResponse = textResult;
+// `textResult`, with one addition: every timestamp in the payload is rewritten
+// to ISO-8601 with an explicit offset and paired with a `<field>Display`
+// sibling in the operator's zone.
+//
+// This is the single seam every structured tool response passes through, which
+// is the point — normalizing here rather than at each call site is what makes
+// it impossible for a tool to reintroduce the naive-local values that had
+// `sentAt` and `fetchedBodyAt` silently disagreeing by the UTC offset.
+export function jsonResponse(data) {
+    return textResult(normalizeTimestampsInValue(data));
+}
 // Raw-string tool result. Wrapper over @chrischall/mcp-utils' `rawTextResult`.
 export const textResponse = rawTextResult;
 // A STRUCTURED failure: the machine-readable payload of `jsonResponse` plus
@@ -11,7 +21,11 @@ export const textResponse = rawTextResult;
 // we declined to overwrite) without being mistaken for a successful write.
 // mcp-utils' `errorResult` only carries a string.
 export function jsonErrorResponse(data) {
-    return { ...textResult(data), isError: true };
+    // Routed through jsonResponse, not textResult: a refusal payload carries the
+    // same freshness block as the success path, and emitting it unnormalized made
+    // an UNVERIFIED_EMPTY response report `asOf` in UTC while every successful
+    // response reported it with an offset.
+    return { ...jsonResponse(data), isError: true };
 }
 // OFW API shape for `recipients[]` on message/draft list and detail
 // responses. Used wherever we validate the response of a `/pub/v3/messages*`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.9.0",
+  "version": "2.9.2",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -35,8 +35,8 @@
     "worker:test": "vitest run --config vitest.workers.config.ts"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.13.0",
-    "@fetchproxy/bootstrap": "^1.3.0",
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/bootstrap": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
     "zod": "^4.4.3"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.9.0",
+  "version": "2.9.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.9.0",
+      "version": "2.9.2",
       "transport": {
         "type": "stdio"
       },