@trainheroic-unofficial/athlete-mcp 3.5.2 → 3.7.1

package/dist/server.mjs

@@ -441,10 +441,35 @@ z.object({
 	match: exerciseViewSchema.nullable(),
 	candidates: z.array(exerciseViewSchema)
 });
+/** TrainHeroic's documented exercise parameter-type codes. */
+const exerciseParamTypeSchema = z.union([
+	z.literal(0),
+	z.literal(1),
+	z.literal(2),
+	z.literal(3),
+	z.literal(4),
+	z.literal(5),
+	z.literal(6),
+	z.literal(7),
+	z.literal(10),
+	z.literal(11),
+	z.literal(12),
+	z.literal(13),
+	z.literal(14),
+	z.literal(18)
+]);
+const exerciseWriteShape = {
+	title: z.string().trim().min(1),
+	param_1_type: exerciseParamTypeSchema.optional(),
+	param_2_type: exerciseParamTypeSchema.optional()
+};
 z.looseObject({
-	title: z.string().min(1),
-	param_1_type: z.number().optional(),
-	param_2_type: z.number().optional()
+	...exerciseWriteShape,
+	points_of_performance: z.string().default("")
+});
+z.looseObject({
+	...exerciseWriteShape,
+	points_of_performance: z.string().optional()
 });
 z.object({
 	streamId: idSchema,
@@ -1000,34 +1025,234 @@ function confirmGate(ctx, message, confirmArg) {
 */
 const SERVER_INSTRUCTIONS = "Speak to the user in plain, everyday language about their training. Describe what you are doing in the TrainHeroic app's own terms (for example, say you are creating a workout rather than naming a tool). Do not surface internal tool names (the snake_case identifiers such as athlete_session_create), raw parameter names, or numeric ids in your replies unless the user explicitly asks for them; they are implementation details. The tool descriptions cross-reference each other by name only so you can chain them correctly. Keep that wiring to yourself.";
 //#endregion
+//#region ../js/src/date-window.ts
+const DAY_MS = 864e5;
+const ISO_DAY = /^\d{4}-\d{2}-\d{2}$/u;
+function dayNumber(value) {
+	if (!ISO_DAY.test(value)) return null;
+	const timestamp = Date.parse(`${value}T00:00:00Z`);
+	if (!Number.isFinite(timestamp) || new Date(timestamp).toISOString().slice(0, 10) !== value) return null;
+	return timestamp / DAY_MS;
+}
+/** Number of calendar days in an inclusive ISO-date range, or null for an invalid range. */
+function dateSpanDays(start, end) {
+	const first = dayNumber(start);
+	const last = dayNumber(end);
+	return first === null || last === null || first > last ? null : last - first + 1;
+}
+//#endregion
 //#region ../js/src/http-error.ts
-/**
-* A final non-2xx response from TrainHeroic. The error deliberately carries only request
-* metadata that is safe to send to telemetry: never the path, query string, request body,
-* response body, credentials, or session token.
-*/
+const MAX_REQUEST_KEYS = 50;
+const MAX_RESPONSE_DEPTH = 4;
+const MAX_RESPONSE_KEYS = 20;
+const MAX_RESPONSE_ITEMS = 10;
+const MAX_RESPONSE_NODES = 50;
+const MAX_RESPONSE_STRING = 2e3;
+const RESPONSE_DIAGNOSTIC_KEYS = /* @__PURE__ */ new Set([
+	"code",
+	"detail",
+	"details",
+	"error",
+	"error_code",
+	"errors",
+	"message",
+	"reason",
+	"status",
+	"status_code",
+	"success"
+]);
+const RESPONSE_CONTAINER_KEYS = /* @__PURE__ */ new Set([
+	"data",
+	"received",
+	"response",
+	"result"
+]);
+const RESPONSE_STATUS_KEYS = /* @__PURE__ */ new Set(["status", "status_code"]);
+const RESPONSE_BOOLEAN_KEYS = /* @__PURE__ */ new Set(["success"]);
+const PARAMETER_TYPES = /* @__PURE__ */ new Set([
+	0,
+	1,
+	2,
+	3,
+	4,
+	5,
+	6,
+	7,
+	10,
+	11,
+	12,
+	13,
+	14,
+	18
+]);
+/** Keep provider diagnostics useful while removing common credentials and direct identifiers. */
+function redactText(value) {
+	const redacted = value.slice(0, MAX_RESPONSE_STRING).replace(/\bAuthorization(["']?\s*[:=]\s*)(?:"(?:\\(?:[\s\S]|$)|[^"\\])*(?:"|$)|'(?:\\(?:[\s\S]|$)|[^'\\])*(?:'|$)|[^"'\r\n,;&]+)/giu, (_match, separator) => `Authorization${separator}[Redacted]`).replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/giu, "Bearer [Redacted]").replace(/\b(password|passwd|secret|token|access[_-]?token|refresh[_-]?token|session(?:[_-]?(?:id|token))?|api[_-]?key|client[_-]?secret)(["']?\s*[:=]\s*)(?:"(?:\\(?:[\s\S]|$)|[^"\\])*(?:"|$)|'(?:\\(?:[\s\S]|$)|[^'\\])*(?:'|$)|[^"'\r\n,;&}\]]+)/giu, (_match, key, separator) => `${key}${separator}[Redacted]`).replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/giu, "[Redacted email]").replace(/\b(?:\d{1,3}\.){3}\d{1,3}\b/gu, "[Redacted IP]").replace(/\b\d{3}-\d{2}-\d{4}\b/gu, "[Redacted]").replace(/\b(?:bearer\s+)?[a-f0-9]{32,}\b/giu, "[Redacted]");
+	return value.length <= MAX_RESPONSE_STRING ? redacted : `${redacted}…[truncated]`;
+}
+function safeFieldName(key) {
+	if (key === "__proto__" || key === "constructor" || key === "prototype") return "[Redacted key]";
+	if (!/^[A-Za-z_][A-Za-z0-9_.-]{0,79}$/.test(key)) return "[Redacted key]";
+	return key;
+}
+function boundedEntries(object, limit) {
+	const entries = [];
+	for (const key of Object.keys(object)) {
+		const descriptor = Object.getOwnPropertyDescriptor(object, key);
+		entries.push([key, descriptor && "value" in descriptor ? descriptor.value : void 0]);
+		if (entries.length >= limit) break;
+	}
+	return entries;
+}
+function safeRequestValue(key, value) {
+	if (key === "is_circuit" && typeof value === "boolean") return value;
+	if (["param_1_type", "param_2_type"].includes(key) && typeof value === "number" && PARAMETER_TYPES.has(value)) return value;
+}
+function requestBodySummary(body) {
+	if (Array.isArray(body)) return {
+		type: "array",
+		length: body.length
+	};
+	if (body && typeof body === "object") {
+		const entries = boundedEntries(body, MAX_REQUEST_KEYS).sort(([left], [right]) => left.localeCompare(right));
+		const keys = entries.map(([key]) => safeFieldName(key));
+		const values = {};
+		const arrayLengths = {};
+		for (const [key, value] of entries) {
+			const safeValue = safeRequestValue(key, value);
+			if (safeValue !== void 0) values[safeFieldName(key)] = safeValue;
+			if (Array.isArray(value)) arrayLengths[safeFieldName(key)] = value.length;
+		}
+		const byKey = new Map(entries);
+		const dateStart = byKey.get("date_start");
+		const dateEnd = byKey.get("date_end");
+		const span = typeof dateStart === "string" && typeof dateEnd === "string" ? dateSpanDays(dateStart, dateEnd) : null;
+		return {
+			type: "object",
+			keys,
+			...Object.keys(values).length > 0 ? { values } : {},
+			...Object.keys(arrayLengths).length > 0 ? { arrayLengths } : {},
+			...span === null ? {} : { dateSpanDays: span }
+		};
+	}
+	const primitive = typeof body;
+	return primitive === "boolean" || primitive === "number" || primitive === "string" ? { type: primitive } : { type: "other" };
+}
+function sanitizedDiagnosticValue(value, depth, budget, field) {
+	if (budget.nodes <= 0) return "[Truncated]";
+	budget.nodes -= 1;
+	if (value === null) return null;
+	if (typeof value === "boolean") return field && RESPONSE_BOOLEAN_KEYS.has(field) ? value : "[Redacted]";
+	if (typeof value === "number") return field && RESPONSE_STATUS_KEYS.has(field) && Number.isInteger(value) && value >= 100 && value <= 599 ? value : "[Redacted]";
+	if (typeof value === "string") return redactText(value);
+	if (depth >= MAX_RESPONSE_DEPTH) return "[Truncated]";
+	if (Array.isArray(value)) {
+		const result = [];
+		for (const item of value.slice(0, MAX_RESPONSE_ITEMS)) {
+			if (budget.nodes <= 0) {
+				result.push("[Truncated]");
+				break;
+			}
+			result.push(sanitizedDiagnosticValue(item, depth + 1, budget));
+		}
+		return result;
+	}
+	if (value && typeof value === "object") {
+		const result = {};
+		for (const [key, item] of boundedEntries(value, MAX_RESPONSE_KEYS)) {
+			if (budget.nodes <= 0) {
+				result.truncated = "[Truncated]";
+				break;
+			}
+			const safeKey = safeFieldName(key);
+			const safeValue = safeRequestValue(key, item);
+			if (RESPONSE_DIAGNOSTIC_KEYS.has(key)) result[safeKey] = sanitizedDiagnosticValue(item, depth + 1, budget, key);
+			else if (RESPONSE_CONTAINER_KEYS.has(key) && item && typeof item === "object") result[safeKey] = sanitizedDiagnosticValue(item, depth + 1, budget);
+			else if (safeValue !== void 0) {
+				budget.nodes -= 1;
+				result[safeKey] = safeValue;
+			}
+		}
+		return result;
+	}
+	return `[${typeof value}]`;
+}
+function responseBodyDiagnostics(body, budget, depth = 0) {
+	const activeBudget = budget ?? { nodes: MAX_RESPONSE_NODES };
+	if (activeBudget.nodes <= 0 || depth >= MAX_RESPONSE_DEPTH) return "[Truncated]";
+	if (!body || typeof body !== "object" || Array.isArray(body)) return sanitizedDiagnosticValue(body, depth, activeBudget);
+	const object = body;
+	const result = {};
+	for (const [key, value] of boundedEntries(object, MAX_RESPONSE_KEYS)) {
+		if (activeBudget.nodes <= 0) {
+			result.truncated = "[Truncated]";
+			break;
+		}
+		if (RESPONSE_DIAGNOSTIC_KEYS.has(key)) {
+			result[safeFieldName(key)] = sanitizedDiagnosticValue(value, depth + 1, activeBudget, key);
+			continue;
+		}
+		if (RESPONSE_CONTAINER_KEYS.has(key) && value && typeof value === "object") {
+			activeBudget.nodes -= 1;
+			const nested = responseBodyDiagnostics(value, activeBudget, depth + 1);
+			if (nested === "[Truncated]" || nested && typeof nested === "object" && Object.keys(nested).length > 0) result[safeFieldName(key)] = nested;
+		}
+	}
+	if (Object.keys(result).length > 0) return result;
+	return { type: "object" };
+}
+function parseResponseText(text) {
+	if (text.length === 0) return text;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return text;
+	}
+}
+function safeRequestBodySummary(body) {
+	try {
+		return requestBodySummary(body);
+	} catch {
+		return { type: "other" };
+	}
+}
+function safeResponseBodyDiagnostics(body) {
+	try {
+		return responseBodyDiagnostics(body);
+	} catch {
+		return "[Unavailable]";
+	}
+}
+/** A final non-2xx response plus bounded, telemetry-safe request and response diagnostics. */
 var TrainHeroicHttpError = class extends Error {
 	name = "TrainHeroicHttpError";
 	method;
 	status;
 	host;
-	constructor(method, url, status) {
+	requestBody;
+	responseBody;
+	constructor(method, url, status, diagnostics = {}) {
 		const parsed = new URL(url);
 		const normalizedMethod = method.toUpperCase();
 		super(`TrainHeroic ${normalizedMethod} request failed with HTTP ${status}`);
 		this.method = normalizedMethod;
 		this.status = status;
 		this.host = parsed.host;
+		this.requestBody = diagnostics.requestBody === void 0 ? void 0 : safeRequestBodySummary(diagnostics.requestBody);
+		this.responseBody = diagnostics.responseBody === void 0 ? void 0 : safeResponseBodyDiagnostics(diagnostics.responseBody);
 	}
 };
 /** Call observability hooks without allowing them to change SDK behavior. */
-function notifyHttpError(handler, method, url, status) {
+function notifyHttpError(handler, method, url, status, diagnostics = {}) {
 	if (!handler) return;
 	try {
-		Promise.resolve(handler(new TrainHeroicHttpError(method, url, status))).catch(() => {});
+		Promise.resolve(handler(new TrainHeroicHttpError(method, url, status, diagnostics))).catch(() => {});
 	} catch {}
 }
 //#endregion
+//#region ../js/src/transport.ts
+const defaultTrainHeroicTransport = (url, init) => fetch(url, init);
+//#endregion
 //#region ../js/src/auth.ts
 const DEFAULT_AUTH_URL = "https://apis.trainheroic.com/auth";
 /**
@@ -1051,7 +1276,7 @@ function authUrl() {
 */
 async function loginTrainHeroic(email, password, options = {}) {
 	const url = authUrl();
-	const res = await fetch(url, {
+	const res = await (options.transport ?? defaultTrainHeroicTransport)(url, {
 		method: "POST",
 		headers: {
 			"content-type": "application/x-www-form-urlencoded",
@@ -1063,6 +1288,7 @@ async function loginTrainHeroic(email, password, options = {}) {
 		}).toString()
 	});
 	if (!res.ok) {
+		await res.body?.cancel().catch(() => {});
 		notifyHttpError(options.onHttpError, "POST", url, res.status);
 		return null;
 	}
@@ -1076,110 +1302,6 @@ async function loginTrainHeroic(email, password, options = {}) {
 	};
 }
 //#endregion
-//#region ../js/src/client.ts
-const DEFAULT_COACH_BASE = "https://api.trainheroic.com";
-const DEFAULT_APIS_BASE = "https://apis.trainheroic.com";
-/**
-* Resolve an API host, allowing an env override. The override exists so a test harness can point
-* the client at a local fake backend (and it doubles as a staging knob); production leaves these
-* unset and gets the real hosts. Read through `globalThis.process?.env` — not an `import process`
-* — so the runtime-agnostic `.` entry stays free of `node:*` and runs unchanged on workerd, and
-* read per request (not at module load) so a value the harness sets in the child env always wins.
-*/
-function envBase(key, fallback) {
-	const v = (globalThis.process?.env)?.[key];
-	return v && v.length > 0 ? v : fallback;
-}
-var TrainHeroicAuthError = class extends Error {
-	name = "TrainHeroicAuthError";
-};
-/**
-* Authenticated TrainHeroic API client. Holds the credentials (on the hosted Worker, from the
-* grant's encrypted props) and a lazily-acquired session token cached in memory for the life of
-* *this client instance* — nothing longer. On a 401/403 it re-logs in once and retries, since
-* TrainHeroic has no refresh token and sessions expire after ~1-2h.
-*
-* Anything that wants a session to outlive one client owns that itself: pass a previously
-* acquired token as `sessionId` and keep the new one via `options.onSession`. That matters
-* wherever clients are short-lived — the hosted Worker builds one per HTTP request, and each CLI
-* invocation is a fresh process — because otherwise every operation replays the password.
-*/
-var TrainHeroicClient = class {
-	#email;
-	#password;
-	#onSession;
-	#onHttpError;
-	#sessionId;
-	#loginInFlight = null;
-	constructor(email, password, sessionId = null, options = {}) {
-		this.#email = email;
-		this.#password = password;
-		this.#sessionId = sessionId;
-		this.#onSession = options.onSession;
-		this.#onHttpError = options.onHttpError;
-	}
-	get sessionId() {
-		return this.#sessionId;
-	}
-	async #ensureSession() {
-		if (this.#sessionId) return this.#sessionId;
-		this.#loginInFlight ??= this.#login();
-		try {
-			return await this.#loginInFlight;
-		} finally {
-			this.#loginInFlight = null;
-		}
-	}
-	async #login() {
-		const session = await loginTrainHeroic(this.#email, this.#password, this.#onHttpError ? { onHttpError: this.#onHttpError } : {});
-		if (!session) throw new TrainHeroicAuthError("TrainHeroic login failed");
-		this.#sessionId = session.sessionId;
-		try {
-			this.#onSession?.(this.#sessionId);
-		} catch {}
-		return this.#sessionId;
-	}
-	async request(method, path, options = {}) {
-		const url = `${options.base === "apis" ? envBase("TH_APIS_BASE", DEFAULT_APIS_BASE) : envBase("TH_COACH_BASE", DEFAULT_COACH_BASE)}/${path.replace(/^\//, "")}`;
-		let session = await this.#ensureSession();
-		let res = await this.#send(method, url, session, options.body);
-		if (res.status === 401 || res.status === 403) {
-			if (this.#sessionId === session) this.#sessionId = null;
-			session = await this.#ensureSession();
-			res = await this.#send(method, url, session, options.body);
-		}
-		if (!res.ok && !options.expectedStatuses?.includes(res.status)) notifyHttpError(this.#onHttpError, method, url, res.status);
-		const text = await res.text();
-		let data = text;
-		if (text.length > 0) try {
-			data = JSON.parse(text);
-		} catch {
-			data = text;
-		}
-		return {
-			status: res.status,
-			ok: res.ok,
-			data
-		};
-	}
-	#send(method, url, session, body) {
-		const upper = method.toUpperCase();
-		const headers = {
-			accept: "application/json",
-			"session-token": session
-		};
-		const init = {
-			method: upper,
-			headers
-		};
-		if (body !== void 0 && upper !== "GET" && upper !== "DELETE") {
-			headers["content-type"] = "application/json";
-			init.body = JSON.stringify(body);
-		}
-		return fetch(url, init);
-	}
-};
-//#endregion
 //#region ../js/src/exercise-util.ts
 /**
 * Display labels for TrainHeroic parameter types. The unit is FIXED PER EXERCISE
@@ -1359,6 +1481,127 @@ function assertPositiveInteger(value, label) {
 	if (!Number.isInteger(value) || value < 1) throw new RangeError(`${label} must be a positive integer; received ${value}.`);
 }
 //#endregion
+//#region ../js/src/client.ts
+const DEFAULT_COACH_BASE = "https://api.trainheroic.com";
+const DEFAULT_APIS_BASE = "https://apis.trainheroic.com";
+const MAX_REQUEST_CONCURRENCY = 4;
+/**
+* Resolve an API host, allowing an env override. The override exists so a test harness can point
+* the client at a local fake backend (and it doubles as a staging knob); production leaves these
+* unset and gets the real hosts. Read through `globalThis.process?.env` — not an `import process`
+* — so the runtime-agnostic `.` entry stays free of `node:*` and runs unchanged on workerd, and
+* read per request (not at module load) so a value the harness sets in the child env always wins.
+*/
+function envBase(key, fallback) {
+	const v = (globalThis.process?.env)?.[key];
+	return v && v.length > 0 ? v : fallback;
+}
+var TrainHeroicAuthError = class extends Error {
+	name = "TrainHeroicAuthError";
+};
+/**
+* Authenticated TrainHeroic API client. Holds the credentials (on the hosted Worker, from the
+* grant's encrypted props) and a lazily-acquired session token cached in memory for the life of
+* *this client instance* — nothing longer. On a 401/403 it re-logs in once and retries, since
+* TrainHeroic has no refresh token and sessions expire after ~1-2h.
+*
+* Anything that wants a session to outlive one client owns that itself: pass a previously
+* acquired token as `sessionId` and keep the new one via `options.onSession`. That matters
+* wherever clients are short-lived — the hosted Worker builds one per HTTP request, and each CLI
+* invocation is a fresh process — because otherwise every operation replays the password.
+*/
+var TrainHeroicClient = class {
+	#email;
+	#password;
+	#onSession;
+	#onHttpError;
+	#transport;
+	#requestLimit = createLimiter(MAX_REQUEST_CONCURRENCY);
+	#sessionId;
+	#loginInFlight = null;
+	constructor(email, password, sessionId = null, options = {}) {
+		this.#email = email;
+		this.#password = password;
+		this.#sessionId = sessionId;
+		this.#onSession = options.onSession;
+		this.#onHttpError = options.onHttpError;
+		this.#transport = options.transport ?? defaultTrainHeroicTransport;
+	}
+	get sessionId() {
+		return this.#sessionId;
+	}
+	async #ensureSession() {
+		if (this.#sessionId) return this.#sessionId;
+		this.#loginInFlight ??= this.#login();
+		try {
+			return await this.#loginInFlight;
+		} finally {
+			this.#loginInFlight = null;
+		}
+	}
+	async #login() {
+		const session = await loginTrainHeroic(this.#email, this.#password, {
+			...this.#onHttpError ? { onHttpError: this.#onHttpError } : {},
+			transport: this.#transport
+		});
+		if (!session) throw new TrainHeroicAuthError("TrainHeroic login failed");
+		this.#sessionId = session.sessionId;
+		try {
+			this.#onSession?.(this.#sessionId);
+		} catch {}
+		return this.#sessionId;
+	}
+	async request(method, path, options = {}) {
+		await this.#ensureSession();
+		return this.#requestLimit.run(() => this.#request(method, path, options));
+	}
+	async #request(method, path, options) {
+		const url = `${options.base === "apis" ? envBase("TH_APIS_BASE", DEFAULT_APIS_BASE) : envBase("TH_COACH_BASE", DEFAULT_COACH_BASE)}/${path.replace(/^\//, "")}`;
+		let session = await this.#ensureSession();
+		let res = await this.#send(method, url, session, options.body);
+		if (res.status === 401 || res.status === 403) {
+			await res.body?.cancel().catch(() => {});
+			if (this.#sessionId === session) this.#sessionId = null;
+			session = await this.#ensureSession();
+			res = await this.#send(method, url, session, options.body);
+		}
+		const shouldReport = !res.ok && !options.expectedStatuses?.includes(res.status);
+		let text;
+		try {
+			text = await res.text();
+		} catch (error) {
+			if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, { requestBody: options.body });
+			throw error;
+		}
+		const data = parseResponseText(text);
+		if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, {
+			requestBody: options.body,
+			responseBody: data
+		});
+		return {
+			status: res.status,
+			ok: res.ok,
+			data
+		};
+	}
+	#send(method, url, session, body) {
+		const upper = method.toUpperCase();
+		const headers = {
+			accept: "application/json",
+			"session-token": session
+		};
+		const init = {
+			method: upper,
+			headers
+		};
+		if (body !== void 0 && upper !== "GET" && upper !== "DELETE") {
+			headers["content-type"] = "application/json";
+			init.body = JSON.stringify(body);
+		}
+		return this.#transport(url, init);
+	}
+};
+//#endregion
 //#region ../js/src/athlete.ts
 async function getJson(client, path, label) {
 	const res = await client.request("GET", path);
@@ -2960,7 +3203,7 @@ function registerAthleteTrainingTools(server, ctx) {
 }
 //#endregion
 //#region package.json
-var version = "3.5.2";
+var version = "3.7.1";
 //#endregion
 //#region src/server.ts
 function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trainheroic-unofficial/athlete-mcp",
-  "version": "3.5.2",
+  "version": "3.7.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,14 +20,14 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/server": "2.0.0",
-    "zod": "^4.4.3",
-    "@trainheroic-unofficial/core": "3.5.2",
-    "@trainheroic-unofficial/js": "3.5.2"
+    "zod": "^4.6.3",
+    "@trainheroic-unofficial/core": "3.7.1",
+    "@trainheroic-unofficial/js": "3.7.1"
   },
   "devDependencies": {
-    "@types/node": "^26.3.0",
-    "tsdown": "^0.22.14",
-    "tsx": "^4.23.12",
+    "@types/node": "^26.5.1",
+    "tsdown": "^0.23.0",
+    "tsx": "^4.23.13",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11"
   },