rhombus-node-mcp 0.1.48 → 0.1.50

package/dist/api/access-anomaly-tool-api.js

@@ -0,0 +1,105 @@
+import { buildMediaHints } from "./badge-correlation.js";
+import { searchOnGuardEvents } from "./onguard-tool-api.js";
+const ALL_RULES = [
+    "lost_or_inactive_badge",
+    "entry_not_made",
+    "off_hours",
+    "impossible_travel",
+    "area_novelty",
+];
+const DAY_MS = 86_400_000;
+/**
+ * Flags anomalous OnGuard access events over a window: deterministic rules (lost/inactive badge, no-entry,
+ * off-hours, impossible travel, first-time-in-area vs a baseline) computed over searchOnGuardEvents, each
+ * finding carrying the still/clip hints to confirm it. The agent narrates/triages from here.
+ */
+export async function getAccessAnomalies(args, timeZone, requestModifiers, sessionId) {
+    const rules = new Set(args.rules && args.rules.length ? args.rules : ALL_RULES);
+    const offStart = args.offHoursStartHour ?? 7;
+    const offEnd = args.offHoursEndHour ?? 19;
+    const maxTravelSec = args.impossibleTravelMaxSeconds ?? 30;
+    const baselineDays = args.baselineDays ?? 30;
+    const scope = { area: args.area, locationUuids: args.locationUuids, deviceUuids: args.deviceUuids };
+    const { events } = await searchOnGuardEvents({ ...scope, afterMs: args.afterMs, beforeMs: args.beforeMs, limit: args.limit ?? 500 }, timeZone, requestModifiers, sessionId);
+    // Baseline area-set per cardholder (for area_novelty).
+    const baselineAreas = new Map();
+    if (rules.has("area_novelty") && baselineDays > 0 && args.afterMs != null) {
+        const { events: baseEvents } = await searchOnGuardEvents({ ...scope, afterMs: args.afterMs - baselineDays * DAY_MS, beforeMs: args.afterMs, limit: 1000 }, timeZone, requestModifiers, sessionId);
+        for (const e of baseEvents) {
+            if (!e.cardholderName || !e.areaEntering)
+                continue;
+            const set = baselineAreas.get(e.cardholderName) ?? new Set();
+            set.add(e.areaEntering);
+            baselineAreas.set(e.cardholderName, set);
+        }
+    }
+    const hourFmt = new Intl.DateTimeFormat("en-US", { timeZone, hour: "2-digit", hourCycle: "h23" });
+    const localHour = (ms) => parseInt(hourFmt.format(new Date(ms)), 10);
+    const findings = [];
+    const seen = new Set();
+    const add = (e, rule, severity, rationale) => {
+        const key = `${e.cardholderName ?? ""}|${rule}|${e.timestampMs ?? ""}|${e.areaEntering ?? ""}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        const { clipHint, stillHint } = buildMediaHints({ deviceUuid: e.deviceUuid, timestampMs: e.timestampMs });
+        findings.push({
+            cardholderName: e.cardholderName,
+            rule,
+            severity,
+            datetime: e.datetime,
+            timestampMs: e.timestampMs,
+            deviceUuid: e.deviceUuid,
+            area: e.areaEntering ?? e.areaExiting,
+            rationale,
+            clipHint,
+            stillHint,
+        });
+    };
+    for (const e of events) {
+        const at = e.areaEntering ? ` at "${e.areaEntering}"` : "";
+        if (rules.has("lost_or_inactive_badge") && e.badgeStatus && e.badgeStatus.toLowerCase() !== "active") {
+            add(e, "lost_or_inactive_badge", "high", `Badge status "${e.badgeStatus}" used${at}.`);
+        }
+        if (rules.has("entry_not_made") && e.entryMade === false) {
+            add(e, "entry_not_made", "medium", `Access granted but no entry made${at} — possible tailgating or aborted entry.`);
+        }
+        if (rules.has("off_hours") && e.timestampMs != null) {
+            const h = localHour(e.timestampMs);
+            if (h < offStart || h >= offEnd) {
+                add(e, "off_hours", "medium", `Entry ${e.datetime ?? `${h}:00`} is outside business hours (${offStart}:00–${offEnd}:00)${at}.`);
+            }
+        }
+        if (rules.has("area_novelty") && baselineAreas.size > 0 && e.cardholderName && e.areaEntering) {
+            const base = baselineAreas.get(e.cardholderName);
+            if (base && !base.has(e.areaEntering)) {
+                add(e, "area_novelty", "high", `First entry to "${e.areaEntering}" — not in ${e.cardholderName}'s prior ${baselineDays}-day pattern.`);
+            }
+        }
+    }
+    // Impossible travel: per cardholder, consecutive taps in different areas within the window.
+    if (rules.has("impossible_travel")) {
+        const byPerson = new Map();
+        for (const e of events) {
+            if (!e.cardholderName || e.timestampMs == null)
+                continue;
+            const arr = byPerson.get(e.cardholderName) ?? [];
+            arr.push(e);
+            byPerson.set(e.cardholderName, arr);
+        }
+        for (const [name, evs] of byPerson) {
+            const sorted = evs.slice().sort((a, b) => (a.timestampMs ?? 0) - (b.timestampMs ?? 0));
+            for (let i = 1; i < sorted.length; i++) {
+                const a = sorted[i - 1];
+                const b = sorted[i];
+                const gapSec = ((b.timestampMs ?? 0) - (a.timestampMs ?? 0)) / 1000;
+                if (a.areaEntering && b.areaEntering && a.areaEntering !== b.areaEntering && gapSec <= maxTravelSec) {
+                    add(b, "impossible_travel", "high", `${name} at "${a.areaEntering}" then "${b.areaEntering}" ${Math.round(gapSec)}s apart — physically implausible for one person.`);
+                }
+            }
+        }
+    }
+    const sev = (s) => (s === "high" ? 0 : 1);
+    findings.sort((a, b) => sev(a.severity) - sev(b.severity) || (b.timestampMs ?? 0) - (a.timestampMs ?? 0));
+    return { findings, eventsAnalyzed: events.length };
+}

package/dist/api/faces-tool-api.js

@@ -82,8 +82,10 @@ export async function searchSimilarFaces(faceEventUuid, timeZone, requestModifie
         throw new Error(JSON.stringify(res));
     return (res.faceEvents || []).map((event) => ({
         uuid: event.uuid ?? undefined,
+        deviceUuid: event.deviceUuid ?? undefined,
         personUuid: event.personUuid ?? undefined,
         similarity: event.similarity ?? undefined,
+        eventTimestampMs: event.eventTimestamp ?? undefined,
         eventTimestamp: event.eventTimestamp
             ? formatTimestamp(event.eventTimestamp, timeZone)
             : undefined,

package/dist/api/lost-badge-tool-api.js

@@ -0,0 +1,85 @@
+import { buildMediaHints } from "./badge-correlation.js";
+import { getFaceEvents, searchSimilarFaces } from "./faces-tool-api.js";
+import { searchOnGuardEvents } from "./onguard-tool-api.js";
+/**
+ * Lost / stolen-badge live response. Finds recent lost/inactive-badge use, and for each: the door clip/still,
+ * the face captured at the door (identified or UNIDENTIFIED), and a cross-camera track of that same face
+ * (via similar-face search) ordered to a last-known location. Detection + door evidence are exact; the track
+ * is best-effort (depends on face capture + recognition coverage).
+ */
+export async function getLostBadgeResponse(args, timeZone, requestModifiers, sessionId) {
+    const scope = { area: args.area, locationUuids: args.locationUuids, deviceUuids: args.deviceUuids };
+    const { events } = await searchOnGuardEvents({ ...scope, anomalyOnly: true, afterMs: args.afterMs, beforeMs: args.beforeMs, limit: args.limit ?? 50 }, timeZone, requestModifiers, sessionId);
+    // anomalyOnly returns lost-badge AND no-entry anomalies; keep the lost/inactive-badge ones.
+    const lostEvents = events.filter((e) => e.badgeStatus && e.badgeStatus.toLowerCase() !== "active");
+    const winMs = (args.faceWindowSeconds ?? 30) * 1000;
+    const incidents = [];
+    for (const e of lostEvents) {
+        const { clipHint, stillHint } = buildMediaHints({ deviceUuid: e.deviceUuid, timestampMs: e.timestampMs });
+        let facesAtDoor = [];
+        let sightings = [];
+        if (e.deviceUuid && e.timestampMs != null) {
+            try {
+                // Face(s) at the door: query by time window (the faces tool can't filter by device), then match
+                // the door camera client-side.
+                const { faceEvents } = await getFaceEvents({
+                    pageRequest: { lastEvaluatedKey: null, maxPageSize: 75 },
+                    searchFilter: {
+                        faceNameContains: null,
+                        faceNames: [],
+                        hasEmbedding: null,
+                        hasName: null,
+                        labels: [],
+                        locationUuids: [],
+                        personUuids: [],
+                        timestampFilter: {
+                            rangeStart: new Date(e.timestampMs - winMs).toISOString(),
+                            rangeEnd: new Date(e.timestampMs + winMs).toISOString(),
+                        },
+                    },
+                }, timeZone, requestModifiers, sessionId);
+                facesAtDoor = faceEvents
+                    .filter((f) => f.deviceUuid === e.deviceUuid)
+                    .map((f) => ({
+                    faceName: f.faceName ?? undefined,
+                    personUuid: f.personUuid ?? undefined,
+                    thumbnailS3Key: f.thumbnailS3Key ?? undefined,
+                    faceEventUuid: f.uuid ?? undefined,
+                    eventTimestamp: f.eventTimestamp,
+                }));
+                // Track that face across cameras, ordered in time.
+                const seed = facesAtDoor.find((f) => f.faceEventUuid);
+                if (seed?.faceEventUuid) {
+                    const similar = await searchSimilarFaces(seed.faceEventUuid, timeZone, requestModifiers, sessionId);
+                    sightings = similar
+                        .map((s) => ({
+                        deviceUuid: s.deviceUuid,
+                        datetime: s.eventTimestamp,
+                        timestampMs: s.eventTimestampMs,
+                        similarity: s.similarity,
+                        personUuid: s.personUuid,
+                    }))
+                        .sort((a, b) => (a.timestampMs ?? 0) - (b.timestampMs ?? 0));
+                }
+            }
+            catch {
+                // Face enrichment is best-effort — never fail the whole response over it.
+            }
+        }
+        const last = sightings.length ? sightings[sightings.length - 1] : undefined;
+        incidents.push({
+            cardholderOfRecord: e.cardholderName,
+            badgeStatus: e.badgeStatus,
+            datetime: e.datetime,
+            timestampMs: e.timestampMs,
+            deviceUuid: e.deviceUuid,
+            area: e.areaEntering ?? e.areaExiting,
+            clipHint,
+            stillHint,
+            facesAtDoor,
+            sightings,
+            lastKnownSighting: last ? { deviceUuid: last.deviceUuid, datetime: last.datetime } : undefined,
+        });
+    }
+    return { incidents, count: incidents.length };
+}

package/dist/api/onguard-tool-api.js

@@ -31,8 +31,11 @@ export async function searchOnGuardEvents(args, timeZone, requestModifiers, sess
         timestampMs: e.timestampMs ?? undefined,
         datetime: e.timestampMs != null ? formatTimestamp(e.timestampMs, timeZone) : undefined,
         deviceUuid: e.deviceUuid ?? undefined,
-        label: e.customDisplayName ?? undefined,
-        cardholderName: e.customDescription ?? undefined,
+        label: e.customDisplayName ?? e.objectType ?? undefined,
+        // Dedicated-event-types put the cardholder in its own `cardholderName` field (customDescription
+        // is null on ONGUARD_* docs); keep customDescription as a legacy fallback. The generated schema
+        // predates the field, so read it through a cast until `assets/openapi.json` is regenerated.
+        cardholderName: e.cardholderName ?? e.customDescription ?? undefined,
         badgeStatus: e.badgeStatus ?? undefined,
         badgeType: e.badgeType ?? undefined,
         areaEntering: e.areaEntering ?? undefined,

package/dist/telemetry/tracingProxy.js

@@ -1,9 +1,20 @@
-import { SpanStatusCode, trace } from "@opentelemetry/api";
+import { context, SpanKind, SpanStatusCode, trace, TraceFlags, } from "@opentelemetry/api";
 import { resolveSessionIdentity } from "../api/get-accessible-apps.js";
 import { logger } from "../logger.js";
 import { extractFromToolExtra } from "../util.js";
 const TRACER_NAME = "rhombus-node-mcp";
 const TOOL_CALL_SPAN = "mcp.tool.call";
+const INVALID_TRACE_ID = "00000000000000000000000000000000";
+let warnedNoopTracer = false;
+function warnIfNoopTracer(span) {
+    if (warnedNoopTracer)
+        return;
+    const { traceId, traceFlags } = span.spanContext();
+    if (traceId === INVALID_TRACE_ID || traceFlags === TraceFlags.NONE) {
+        warnedNoopTracer = true;
+        logger.warn("📡 OpenTelemetry custom spans are no-ops — @opentelemetry/api is not sharing the SDK TracerProvider. Check for duplicate @opentelemetry/api in node_modules.");
+    }
+}
 function setArgKeys(span, args) {
     if (args && typeof args === "object") {
         const keys = Object.keys(args);
@@ -34,7 +45,9 @@ async function attachSessionIdentity(span, extra) {
 function wrapHandler(toolName, handler) {
     return async (args, extra) => {
         const tracer = trace.getTracer(TRACER_NAME);
-        return tracer.startActiveSpan(TOOL_CALL_SPAN, async (span) => {
+        const parentContext = context.active();
+        return tracer.startActiveSpan(TOOL_CALL_SPAN, { kind: SpanKind.INTERNAL }, parentContext, async (span) => {
+            warnIfNoopTracer(span);
             const start = Date.now();
             span.setAttribute("mcp.tool.name", toolName);
             span.setAttribute("mcp.transport", process.env.TRANSPORT_TYPE ?? "stdio");
@@ -50,6 +63,9 @@ function wrapHandler(toolName, handler) {
                         message: "tool returned isError",
                     });
                 }
+                else {
+                    span.setStatus({ code: SpanStatusCode.OK });
+                }
                 return result;
             }
             catch (error) {
@@ -63,6 +79,7 @@ function wrapHandler(toolName, handler) {
             }
             finally {
                 span.setAttribute("mcp.tool.duration_ms", Date.now() - start);
+                span.end();
             }
         });
     };

package/dist/tools-console/access-anomaly-tool.js

@@ -0,0 +1,53 @@
+import { getAccessAnomalies } from "../api/access-anomaly-tool-api.js";
+import { OUTPUT_SCHEMA, TOOL_ARGS } from "../types/access-anomaly-tool-types.js";
+import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
+const TOOL_NAME = "access-anomaly-tool";
+const TOOL_DESCRIPTION = `
+Scans Honeywell OnGuard (Lenel) access events over a time window and flags anomalous badge activity. Use for
+"find unusual badge activity", "anything suspicious in access this week", or proactive access review.
+
+Runs deterministic rules and returns ranked findings (high severity first):
+- lost_or_inactive_badge: a non-active badge (lost/suspended) was used
+- entry_not_made: access granted but no entry made (possible tailgating)
+- off_hours: entry outside business hours (configurable)
+- impossible_travel: one cardholder at two different areas seconds apart
+- area_novelty: a cardholder's first-ever entry to an area vs their prior history (needs a baseline window)
+
+Each finding includes cardholderName, the rule, severity, datetime, area, the camera deviceUuid, a plain-language
+rationale, and clip/still hints. Resolve relative times (e.g. "this week") to ISO 8601 first via the timestamp tool.
+
+This is a triage aid: present findings grouped by severity, and for the notable ones call the camera-tool
+(requestType "image", cameraUuid = finding.deviceUuid, timestamp = finding.timestampMs) and/or clips-tool
+("createClip" using finding.clipHint) — in PARALLEL — so a human can confirm. Don't assert wrongdoing; surface the
+evidence.
+`;
+const TOOL_HANDLER = async (args, _extra) => {
+    const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
+    try {
+        const result = await getAccessAnomalies({
+            area: args.area ?? undefined,
+            locationUuids: args.locationUuids ?? undefined,
+            deviceUuids: args.deviceUuids ?? undefined,
+            afterMs: args.startTime ? new Date(args.startTime).getTime() : undefined,
+            beforeMs: args.endTime ? new Date(args.endTime).getTime() : undefined,
+            rules: args.rules ?? undefined,
+            baselineDays: args.baselineDays ?? undefined,
+            offHoursStartHour: args.offHoursStartHour ?? undefined,
+            offHoursEndHour: args.offHoursEndHour ?? undefined,
+            impossibleTravelMaxSeconds: args.impossibleTravelMaxSeconds ?? undefined,
+            limit: args.limit ?? undefined,
+        }, args.timeZone ?? "UTC", requestModifiers, sessionId);
+        return createToolStructuredContent(result);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown error";
+        return createToolStructuredContent({ error: message });
+    }
+};
+export function createTool(server) {
+    server.registerTool(TOOL_NAME, {
+        description: TOOL_DESCRIPTION,
+        inputSchema: TOOL_ARGS,
+        outputSchema: OUTPUT_SCHEMA.shape,
+    }, TOOL_HANDLER);
+}

package/dist/tools-console/lost-badge-tool.js

@@ -0,0 +1,47 @@
+import { getLostBadgeResponse } from "../api/lost-badge-tool-api.js";
+import { OUTPUT_SCHEMA, TOOL_ARGS } from "../types/lost-badge-tool-types.js";
+import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
+const TOOL_NAME = "lost-badge-tool";
+const TOOL_DESCRIPTION = `
+Lost / stolen-badge live response for Honeywell OnGuard (Lenel) access. Use for "a lost badge was just used —
+who is it and where did they go?", or to review lost/inactive-badge use over a window.
+
+For each lost/inactive-badge use it returns:
+- cardholderOfRecord (who the badge belongs to — may NOT be who used it) and badgeStatus
+- the door deviceUuid + time, plus clipHint / stillHint for the door footage
+- facesAtDoor: the face(s) captured at the door at that moment — a recognized name, or UNIDENTIFIED (an unknown
+  face on a valid badge is the strongest stolen/shared-badge signal), with a thumbnail
+- sightings: that same face tracked across cameras, ordered in time, ending in lastKnownSighting (last-known location)
+
+Resolve relative times (e.g. "in the last hour") to ISO 8601 first via the timestamp tool.
+
+To present: show the door still/clip (camera-tool image / clips-tool createClip with the hints), the face at the
+door, and the cross-camera track to last-known location. Detection + door evidence are reliable; the face track
+depends on face-recognition coverage, so treat it as investigative, not proof.
+`;
+const TOOL_HANDLER = async (args, _extra) => {
+    const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
+    try {
+        const result = await getLostBadgeResponse({
+            area: args.area ?? undefined,
+            locationUuids: args.locationUuids ?? undefined,
+            deviceUuids: args.deviceUuids ?? undefined,
+            afterMs: args.startTime ? new Date(args.startTime).getTime() : undefined,
+            beforeMs: args.endTime ? new Date(args.endTime).getTime() : undefined,
+            faceWindowSeconds: args.faceWindowSeconds ?? undefined,
+            limit: args.limit ?? undefined,
+        }, args.timeZone ?? "UTC", requestModifiers, sessionId);
+        return createToolStructuredContent(result);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown error";
+        return createToolStructuredContent({ error: message });
+    }
+};
+export function createTool(server) {
+    server.registerTool(TOOL_NAME, {
+        description: TOOL_DESCRIPTION,
+        inputSchema: TOOL_ARGS,
+        outputSchema: OUTPUT_SCHEMA.shape,
+    }, TOOL_HANDLER);
+}

package/dist/types/access-anomaly-tool-types.js

@@ -0,0 +1,76 @@
+import { z } from "zod";
+import { createUuidSchema } from "../types.js";
+import { ISOTimestampFormatDescription } from "../utils/timestampInput.js";
+export const ANOMALY_RULES = [
+    "lost_or_inactive_badge",
+    "entry_not_made",
+    "off_hours",
+    "impossible_travel",
+    "area_novelty",
+];
+export const TOOL_ARGS = {
+    area: z.string().nullable().describe("Optional: restrict analysis to events entering this area (full-text)."),
+    locationUuids: z
+        .array(createUuidSchema())
+        .nullable()
+        .describe("Optional: restrict to these Rhombus location UUIDs."),
+    deviceUuids: z.array(createUuidSchema()).nullable().describe("Optional: restrict to these camera UUIDs."),
+    startTime: z
+        .string()
+        .datetime({ message: "Invalid datetime string. Expected ISO 8601 format.", offset: true })
+        .nullable()
+        .describe("Start of the window to analyze (inclusive). " + ISOTimestampFormatDescription),
+    endTime: z
+        .string()
+        .datetime({ message: "Invalid datetime string. Expected ISO 8601 format.", offset: true })
+        .nullable()
+        .describe("End of the window to analyze (inclusive). " + ISOTimestampFormatDescription),
+    rules: z
+        .array(z.enum(ANOMALY_RULES))
+        .nullable()
+        .describe("Which rules to run; default all. Options: lost_or_inactive_badge, entry_not_made, off_hours, impossible_travel, area_novelty."),
+    baselineDays: z
+        .number()
+        .nullable()
+        .describe("Days of prior history used to learn each person's normal areas for area_novelty (default 30; 0 disables it)."),
+    offHoursStartHour: z
+        .number()
+        .nullable()
+        .describe("Local business-hours start hour 0–23; entries before it are off-hours (default 7)."),
+    offHoursEndHour: z
+        .number()
+        .nullable()
+        .describe("Local business-hours end hour 0–23; entries at/after it are off-hours (default 19)."),
+    impossibleTravelMaxSeconds: z
+        .number()
+        .nullable()
+        .describe("Max seconds between two different-area taps by one person to flag impossible travel (default 30)."),
+    limit: z.number().nullable().describe("Max events to analyze in the window (default 500)."),
+    timeZone: z
+        .string()
+        .nullable()
+        .describe("IANA timezone for hour-of-day checks and formatting, e.g. America/New_York. Defaults to UTC."),
+};
+const TOOL_ARGS_SCHEMA = z.object(TOOL_ARGS);
+const ClipHintSchema = z.object({ deviceUuid: z.string(), startTimeMs: z.number(), endTimeMs: z.number() });
+const StillHintSchema = z.object({ deviceUuid: z.string(), timestampMs: z.number() });
+export const AnomalyFindingSchema = z.object({
+    cardholderName: z.string().optional(),
+    rule: z.string().describe("Which rule fired."),
+    severity: z.string().describe('"high" or "medium".'),
+    datetime: z.string().optional(),
+    timestampMs: z.number().optional(),
+    deviceUuid: z.string().optional().describe("Camera at the event. Pass to camera-tool (image) / clips-tool (createClip)."),
+    area: z.string().optional(),
+    rationale: z.string().describe("Plain-language explanation of why this was flagged."),
+    clipHint: ClipHintSchema.optional(),
+    stillHint: StillHintSchema.optional(),
+});
+export const OUTPUT_SCHEMA = z.object({
+    findings: z
+        .array(AnomalyFindingSchema)
+        .optional()
+        .describe("Anomalies, ranked high severity first then most-recent."),
+    eventsAnalyzed: z.number().optional(),
+    error: z.string().optional(),
+});

package/dist/types/lost-badge-tool-types.js

@@ -0,0 +1,68 @@
+import { z } from "zod";
+import { createUuidSchema } from "../types.js";
+import { ISOTimestampFormatDescription } from "../utils/timestampInput.js";
+export const TOOL_ARGS = {
+    area: z.string().nullable().describe("Optional: restrict to events entering this area (full-text)."),
+    locationUuids: z.array(createUuidSchema()).nullable().describe("Optional: restrict to these location UUIDs."),
+    deviceUuids: z.array(createUuidSchema()).nullable().describe("Optional: restrict to these camera UUIDs."),
+    startTime: z
+        .string()
+        .datetime({ message: "Invalid datetime string. Expected ISO 8601 format.", offset: true })
+        .nullable()
+        .describe("Start of the window to scan for lost/inactive-badge use (inclusive). " + ISOTimestampFormatDescription),
+    endTime: z
+        .string()
+        .datetime({ message: "Invalid datetime string. Expected ISO 8601 format.", offset: true })
+        .nullable()
+        .describe("End of the window (inclusive). " + ISOTimestampFormatDescription),
+    faceWindowSeconds: z
+        .number()
+        .nullable()
+        .describe("± seconds around each badge event to look for the face at the door (default 30)."),
+    limit: z.number().nullable().describe("Max badge events to scan in the window (default 50)."),
+    timeZone: z
+        .string()
+        .nullable()
+        .describe("IANA timezone for formatting times, e.g. America/New_York. Defaults to UTC."),
+};
+const TOOL_ARGS_SCHEMA = z.object(TOOL_ARGS);
+const ClipHintSchema = z.object({ deviceUuid: z.string(), startTimeMs: z.number(), endTimeMs: z.number() });
+const StillHintSchema = z.object({ deviceUuid: z.string(), timestampMs: z.number() });
+const FaceAtDoorSchema = z.object({
+    faceName: z.string().optional().describe('Recognized name, or absent/UNIDENTIFIED if no enrolled match.'),
+    personUuid: z.string().optional(),
+    thumbnailS3Key: z.string().optional().describe("Face crop thumbnail key for display."),
+    faceEventUuid: z.string().optional(),
+    eventTimestamp: z.string().optional(),
+});
+const SightingSchema = z.object({
+    deviceUuid: z.string().optional().describe("Camera where the same face was seen."),
+    datetime: z.string().optional(),
+    timestampMs: z.number().optional(),
+    similarity: z.number().optional(),
+    personUuid: z.string().optional(),
+});
+export const LostBadgeIncidentSchema = z.object({
+    cardholderOfRecord: z.string().optional().describe("The cardholder the badge is registered to (may not be who used it)."),
+    badgeStatus: z.string().optional(),
+    datetime: z.string().optional(),
+    timestampMs: z.number().optional(),
+    deviceUuid: z.string().optional().describe("Door camera. Pass to camera-tool (image) / clips-tool (createClip)."),
+    area: z.string().optional(),
+    clipHint: ClipHintSchema.optional(),
+    stillHint: StillHintSchema.optional(),
+    facesAtDoor: z.array(FaceAtDoorSchema).optional().describe("Face(s) captured at the door at the time of use."),
+    sightings: z
+        .array(SightingSchema)
+        .optional()
+        .describe("Same face seen across cameras, ordered in time — the track after the door."),
+    lastKnownSighting: z
+        .object({ deviceUuid: z.string().optional(), datetime: z.string().optional() })
+        .optional()
+        .describe("Most recent sighting — the person's last-known location."),
+});
+export const OUTPUT_SCHEMA = z.object({
+    incidents: z.array(LostBadgeIncidentSchema).optional(),
+    count: z.number().optional(),
+    error: z.string().optional(),
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rhombus-node-mcp",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "description": "MCP server for Rhombus API",
   "keywords": [
     "ai",
@@ -50,7 +50,6 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@opentelemetry/api": "^1.9.0",
     "axios": "^1.11.0",
     "cheerio": "^1.1.2",
     "chrono-node": "^2.8.0",
@@ -66,6 +65,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@opentelemetry/api": "^1.9.0",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.3",
     "@types/luxon": "^3.6.2",
@@ -78,5 +78,13 @@
   },
   "engines": {
     "node": ">=18"
+  },
+  "peerDependencies": {
+    "@opentelemetry/api": "^1.9.0"
+  },
+  "peerDependenciesMeta": {
+    "@opentelemetry/api": {
+      "optional": true
+    }
   }
 }