@trainheroic-unofficial/athlete-mcp 3.6.0 → 3.7.2

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import { McpServer, acceptedContent, inputRequired, inputResponse } from "@modelcontextprotocol/server";
+import { CLIENT_CAPABILITIES_META_KEY, McpServer, acceptedContent, inputRequired, inputResponse } from "@modelcontextprotocol/server";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import process from "node:process";
 import { z } from "zod";
@@ -441,10 +441,35 @@ z.object({
 	match: exerciseViewSchema.nullable(),
 	candidates: z.array(exerciseViewSchema)
 });
+/** TrainHeroic's documented exercise parameter-type codes. */
+const exerciseParamTypeSchema = z.union([
+	z.literal(0),
+	z.literal(1),
+	z.literal(2),
+	z.literal(3),
+	z.literal(4),
+	z.literal(5),
+	z.literal(6),
+	z.literal(7),
+	z.literal(10),
+	z.literal(11),
+	z.literal(12),
+	z.literal(13),
+	z.literal(14),
+	z.literal(18)
+]);
+const exerciseWriteShape = {
+	title: z.string().trim().min(1),
+	param_1_type: exerciseParamTypeSchema.optional(),
+	param_2_type: exerciseParamTypeSchema.optional()
+};
 z.looseObject({
-	title: z.string().min(1),
-	param_1_type: z.number().optional(),
-	param_2_type: z.number().optional()
+	...exerciseWriteShape,
+	points_of_performance: z.string().default("")
+});
+z.looseObject({
+	...exerciseWriteShape,
+	points_of_performance: z.string().optional()
 });
 z.object({
 	streamId: idSchema,
@@ -951,6 +976,15 @@ function errorResult(message) {
 const NOT_CONFIRMED = "Not confirmed — the user declined. Nothing was changed.";
 /** Appended to the prompt so the fallback survives whichever way a client surfaces the request. */
 const FALLBACK_HINT = " (If you cannot show this prompt, re-run the tool with confirm:true once the user has agreed.)";
+const CONFIRMATION_REQUIRED = "Ask the user to approve this action, then retry the tool with confirm:true only after they agree. Nothing was changed.";
+/** `undefined` means a legacy request, whose capability check belongs to the SDK's shim. */
+function modernClientSupportsFormElicitation(ctx) {
+	const envelope = ctx.mcpReq.envelope;
+	if (envelope === void 0) return void 0;
+	const elicitation = envelope[CLIENT_CAPABILITIES_META_KEY]?.elicitation;
+	if (elicitation === void 0) return false;
+	return elicitation.form !== void 0 || elicitation.url === void 0;
+}
 /**
 * Confirm a destructive/athlete-facing action.
 *
@@ -966,14 +1000,15 @@ const FALLBACK_HINT = " (If you cannot show this prompt, re-run the tool with co
 * confirmation message ever needs data fetched first, that fetch must be idempotent.
 *
 * Written once in the 2026 `inputRequired` style: modern clients retry with `inputResponses`.
-* A client that cannot elicit at all never reaches the denial below — the SDK rejects the
-* request before the retry — so it must pass `confirm: true`, which is why the hint rides inside
-* the prompt text itself.
+* MCP correctly rejects unsupported embedded requests with `-32021`. This application has an
+* alternate `confirm: true` flow, so a modern client that does not declare form elicitation gets
+* a model-readable tool error that tells it how to recover while the gate remains closed.
 */
 function confirmGate(ctx, message, confirmArg) {
 	if (confirmArg === true) return void 0;
 	if (acceptedContent(ctx.mcpReq.inputResponses, "confirm")?.confirm === true) return void 0;
 	if (inputResponse(ctx.mcpReq.inputResponses, "confirm").kind !== "missing") return errorResult(NOT_CONFIRMED);
+	if (modernClientSupportsFormElicitation(ctx) === false) return errorResult(`${message} ${CONFIRMATION_REQUIRED}`);
 	const prompt = message + FALLBACK_HINT;
 	return inputRequired({ inputRequests: { confirm: inputRequired.elicit({
 		message: prompt,
@@ -1000,12 +1035,29 @@ function confirmGate(ctx, message, confirmArg) {
 */
 const SERVER_INSTRUCTIONS = "Speak to the user in plain, everyday language about their training. Describe what you are doing in the TrainHeroic app's own terms (for example, say you are creating a workout rather than naming a tool). Do not surface internal tool names (the snake_case identifiers such as athlete_session_create), raw parameter names, or numeric ids in your replies unless the user explicitly asks for them; they are implementation details. The tool descriptions cross-reference each other by name only so you can chain them correctly. Keep that wiring to yourself.";
 //#endregion
+//#region ../js/src/date-window.ts
+const DAY_MS = 864e5;
+const ISO_DAY = /^\d{4}-\d{2}-\d{2}$/u;
+function dayNumber(value) {
+	if (!ISO_DAY.test(value)) return null;
+	const timestamp = Date.parse(`${value}T00:00:00Z`);
+	if (!Number.isFinite(timestamp) || new Date(timestamp).toISOString().slice(0, 10) !== value) return null;
+	return timestamp / DAY_MS;
+}
+/** Number of calendar days in an inclusive ISO-date range, or null for an invalid range. */
+function dateSpanDays(start, end) {
+	const first = dayNumber(start);
+	const last = dayNumber(end);
+	return first === null || last === null || first > last ? null : last - first + 1;
+}
+//#endregion
 //#region ../js/src/http-error.ts
 const MAX_REQUEST_KEYS = 50;
 const MAX_RESPONSE_DEPTH = 4;
 const MAX_RESPONSE_KEYS = 20;
 const MAX_RESPONSE_ITEMS = 10;
 const MAX_RESPONSE_NODES = 50;
+const MAX_RESPONSE_STRING = 2e3;
 const RESPONSE_DIAGNOSTIC_KEYS = /* @__PURE__ */ new Set([
 	"code",
 	"detail",
@@ -1043,6 +1095,11 @@ const PARAMETER_TYPES = /* @__PURE__ */ new Set([
 	14,
 	18
 ]);
+/** Keep provider diagnostics useful while removing common credentials and direct identifiers. */
+function redactText(value) {
+	const redacted = value.slice(0, MAX_RESPONSE_STRING).replace(/\bAuthorization(["']?\s*[:=]\s*)(?:"(?:\\(?:[\s\S]|$)|[^"\\])*(?:"|$)|'(?:\\(?:[\s\S]|$)|[^'\\])*(?:'|$)|[^"'\r\n,;&]+)/giu, (_match, separator) => `Authorization${separator}[Redacted]`).replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/giu, "Bearer [Redacted]").replace(/\b(password|passwd|secret|token|access[_-]?token|refresh[_-]?token|session(?:[_-]?(?:id|token))?|api[_-]?key|client[_-]?secret)(["']?\s*[:=]\s*)(?:"(?:\\(?:[\s\S]|$)|[^"\\])*(?:"|$)|'(?:\\(?:[\s\S]|$)|[^'\\])*(?:'|$)|[^"'\r\n,;&}\]]+)/giu, (_match, key, separator) => `${key}${separator}[Redacted]`).replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/giu, "[Redacted email]").replace(/\b(?:\d{1,3}\.){3}\d{1,3}\b/gu, "[Redacted IP]").replace(/\b\d{3}-\d{2}-\d{4}\b/gu, "[Redacted]").replace(/\b(?:bearer\s+)?[a-f0-9]{32,}\b/giu, "[Redacted]");
+	return value.length <= MAX_RESPONSE_STRING ? redacted : `${redacted}…[truncated]`;
+}
 function safeFieldName(key) {
 	if (key === "__proto__" || key === "constructor" || key === "prototype") return "[Redacted key]";
 	if (!/^[A-Za-z_][A-Za-z0-9_.-]{0,79}$/.test(key)) return "[Redacted key]";
@@ -1070,17 +1127,22 @@ function requestBodySummary(body) {
 		const entries = boundedEntries(body, MAX_REQUEST_KEYS).sort(([left], [right]) => left.localeCompare(right));
 		const keys = entries.map(([key]) => safeFieldName(key));
 		const values = {};
+		const arrayLengths = {};
 		for (const [key, value] of entries) {
 			const safeValue = safeRequestValue(key, value);
 			if (safeValue !== void 0) values[safeFieldName(key)] = safeValue;
+			if (Array.isArray(value)) arrayLengths[safeFieldName(key)] = value.length;
 		}
-		return Object.keys(values).length > 0 ? {
+		const byKey = new Map(entries);
+		const dateStart = byKey.get("date_start");
+		const dateEnd = byKey.get("date_end");
+		const span = typeof dateStart === "string" && typeof dateEnd === "string" ? dateSpanDays(dateStart, dateEnd) : null;
+		return {
 			type: "object",
 			keys,
-			values
-		} : {
-			type: "object",
-			keys
+			...Object.keys(values).length > 0 ? { values } : {},
+			...Object.keys(arrayLengths).length > 0 ? { arrayLengths } : {},
+			...span === null ? {} : { dateSpanDays: span }
 		};
 	}
 	const primitive = typeof body;
@@ -1092,7 +1154,7 @@ function sanitizedDiagnosticValue(value, depth, budget, field) {
 	if (value === null) return null;
 	if (typeof value === "boolean") return field && RESPONSE_BOOLEAN_KEYS.has(field) ? value : "[Redacted]";
 	if (typeof value === "number") return field && RESPONSE_STATUS_KEYS.has(field) && Number.isInteger(value) && value >= 100 && value <= 599 ? value : "[Redacted]";
-	if (typeof value === "string") return "[Redacted]";
+	if (typeof value === "string") return redactText(value);
 	if (depth >= MAX_RESPONSE_DEPTH) return "[Truncated]";
 	if (Array.isArray(value)) {
 		const result = [];
@@ -1198,6 +1260,9 @@ function notifyHttpError(handler, method, url, status, diagnostics = {}) {
 	} catch {}
 }
 //#endregion
+//#region ../js/src/transport.ts
+const defaultTrainHeroicTransport = (url, init) => fetch(url, init);
+//#endregion
 //#region ../js/src/auth.ts
 const DEFAULT_AUTH_URL = "https://apis.trainheroic.com/auth";
 /**
@@ -1221,7 +1286,7 @@ function authUrl() {
 */
 async function loginTrainHeroic(email, password, options = {}) {
 	const url = authUrl();
-	const res = await fetch(url, {
+	const res = await (options.transport ?? defaultTrainHeroicTransport)(url, {
 		method: "POST",
 		headers: {
 			"content-type": "application/x-www-form-urlencoded",
@@ -1233,6 +1298,7 @@ async function loginTrainHeroic(email, password, options = {}) {
 		}).toString()
 	});
 	if (!res.ok) {
+		await res.body?.cancel().catch(() => {});
 		notifyHttpError(options.onHttpError, "POST", url, res.status);
 		return null;
 	}
@@ -1246,115 +1312,6 @@ async function loginTrainHeroic(email, password, options = {}) {
 	};
 }
 //#endregion
-//#region ../js/src/client.ts
-const DEFAULT_COACH_BASE = "https://api.trainheroic.com";
-const DEFAULT_APIS_BASE = "https://apis.trainheroic.com";
-/**
-* Resolve an API host, allowing an env override. The override exists so a test harness can point
-* the client at a local fake backend (and it doubles as a staging knob); production leaves these
-* unset and gets the real hosts. Read through `globalThis.process?.env` — not an `import process`
-* — so the runtime-agnostic `.` entry stays free of `node:*` and runs unchanged on workerd, and
-* read per request (not at module load) so a value the harness sets in the child env always wins.
-*/
-function envBase(key, fallback) {
-	const v = (globalThis.process?.env)?.[key];
-	return v && v.length > 0 ? v : fallback;
-}
-var TrainHeroicAuthError = class extends Error {
-	name = "TrainHeroicAuthError";
-};
-/**
-* Authenticated TrainHeroic API client. Holds the credentials (on the hosted Worker, from the
-* grant's encrypted props) and a lazily-acquired session token cached in memory for the life of
-* *this client instance* — nothing longer. On a 401/403 it re-logs in once and retries, since
-* TrainHeroic has no refresh token and sessions expire after ~1-2h.
-*
-* Anything that wants a session to outlive one client owns that itself: pass a previously
-* acquired token as `sessionId` and keep the new one via `options.onSession`. That matters
-* wherever clients are short-lived — the hosted Worker builds one per HTTP request, and each CLI
-* invocation is a fresh process — because otherwise every operation replays the password.
-*/
-var TrainHeroicClient = class {
-	#email;
-	#password;
-	#onSession;
-	#onHttpError;
-	#sessionId;
-	#loginInFlight = null;
-	constructor(email, password, sessionId = null, options = {}) {
-		this.#email = email;
-		this.#password = password;
-		this.#sessionId = sessionId;
-		this.#onSession = options.onSession;
-		this.#onHttpError = options.onHttpError;
-	}
-	get sessionId() {
-		return this.#sessionId;
-	}
-	async #ensureSession() {
-		if (this.#sessionId) return this.#sessionId;
-		this.#loginInFlight ??= this.#login();
-		try {
-			return await this.#loginInFlight;
-		} finally {
-			this.#loginInFlight = null;
-		}
-	}
-	async #login() {
-		const session = await loginTrainHeroic(this.#email, this.#password, this.#onHttpError ? { onHttpError: this.#onHttpError } : {});
-		if (!session) throw new TrainHeroicAuthError("TrainHeroic login failed");
-		this.#sessionId = session.sessionId;
-		try {
-			this.#onSession?.(this.#sessionId);
-		} catch {}
-		return this.#sessionId;
-	}
-	async request(method, path, options = {}) {
-		const url = `${options.base === "apis" ? envBase("TH_APIS_BASE", DEFAULT_APIS_BASE) : envBase("TH_COACH_BASE", DEFAULT_COACH_BASE)}/${path.replace(/^\//, "")}`;
-		let session = await this.#ensureSession();
-		let res = await this.#send(method, url, session, options.body);
-		if (res.status === 401 || res.status === 403) {
-			if (this.#sessionId === session) this.#sessionId = null;
-			session = await this.#ensureSession();
-			res = await this.#send(method, url, session, options.body);
-		}
-		const shouldReport = !res.ok && !options.expectedStatuses?.includes(res.status);
-		let text;
-		try {
-			text = await res.text();
-		} catch (error) {
-			if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, { requestBody: options.body });
-			throw error;
-		}
-		const data = parseResponseText(text);
-		if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, {
-			requestBody: options.body,
-			responseBody: data
-		});
-		return {
-			status: res.status,
-			ok: res.ok,
-			data
-		};
-	}
-	#send(method, url, session, body) {
-		const upper = method.toUpperCase();
-		const headers = {
-			accept: "application/json",
-			"session-token": session
-		};
-		const init = {
-			method: upper,
-			headers
-		};
-		if (body !== void 0 && upper !== "GET" && upper !== "DELETE") {
-			headers["content-type"] = "application/json";
-			init.body = JSON.stringify(body);
-		}
-		return fetch(url, init);
-	}
-};
-//#endregion
 //#region ../js/src/exercise-util.ts
 /**
 * Display labels for TrainHeroic parameter types. The unit is FIXED PER EXERCISE
@@ -1534,6 +1491,127 @@ function assertPositiveInteger(value, label) {
 	if (!Number.isInteger(value) || value < 1) throw new RangeError(`${label} must be a positive integer; received ${value}.`);
 }
 //#endregion
+//#region ../js/src/client.ts
+const DEFAULT_COACH_BASE = "https://api.trainheroic.com";
+const DEFAULT_APIS_BASE = "https://apis.trainheroic.com";
+const MAX_REQUEST_CONCURRENCY = 4;
+/**
+* Resolve an API host, allowing an env override. The override exists so a test harness can point
+* the client at a local fake backend (and it doubles as a staging knob); production leaves these
+* unset and gets the real hosts. Read through `globalThis.process?.env` — not an `import process`
+* — so the runtime-agnostic `.` entry stays free of `node:*` and runs unchanged on workerd, and
+* read per request (not at module load) so a value the harness sets in the child env always wins.
+*/
+function envBase(key, fallback) {
+	const v = (globalThis.process?.env)?.[key];
+	return v && v.length > 0 ? v : fallback;
+}
+var TrainHeroicAuthError = class extends Error {
+	name = "TrainHeroicAuthError";
+};
+/**
+* Authenticated TrainHeroic API client. Holds the credentials (on the hosted Worker, from the
+* grant's encrypted props) and a lazily-acquired session token cached in memory for the life of
+* *this client instance* — nothing longer. On a 401/403 it re-logs in once and retries, since
+* TrainHeroic has no refresh token and sessions expire after ~1-2h.
+*
+* Anything that wants a session to outlive one client owns that itself: pass a previously
+* acquired token as `sessionId` and keep the new one via `options.onSession`. That matters
+* wherever clients are short-lived — the hosted Worker builds one per HTTP request, and each CLI
+* invocation is a fresh process — because otherwise every operation replays the password.
+*/
+var TrainHeroicClient = class {
+	#email;
+	#password;
+	#onSession;
+	#onHttpError;
+	#transport;
+	#requestLimit = createLimiter(MAX_REQUEST_CONCURRENCY);
+	#sessionId;
+	#loginInFlight = null;
+	constructor(email, password, sessionId = null, options = {}) {
+		this.#email = email;
+		this.#password = password;
+		this.#sessionId = sessionId;
+		this.#onSession = options.onSession;
+		this.#onHttpError = options.onHttpError;
+		this.#transport = options.transport ?? defaultTrainHeroicTransport;
+	}
+	get sessionId() {
+		return this.#sessionId;
+	}
+	async #ensureSession() {
+		if (this.#sessionId) return this.#sessionId;
+		this.#loginInFlight ??= this.#login();
+		try {
+			return await this.#loginInFlight;
+		} finally {
+			this.#loginInFlight = null;
+		}
+	}
+	async #login() {
+		const session = await loginTrainHeroic(this.#email, this.#password, {
+			...this.#onHttpError ? { onHttpError: this.#onHttpError } : {},
+			transport: this.#transport
+		});
+		if (!session) throw new TrainHeroicAuthError("TrainHeroic login failed");
+		this.#sessionId = session.sessionId;
+		try {
+			this.#onSession?.(this.#sessionId);
+		} catch {}
+		return this.#sessionId;
+	}
+	async request(method, path, options = {}) {
+		await this.#ensureSession();
+		return this.#requestLimit.run(() => this.#request(method, path, options));
+	}
+	async #request(method, path, options) {
+		const url = `${options.base === "apis" ? envBase("TH_APIS_BASE", DEFAULT_APIS_BASE) : envBase("TH_COACH_BASE", DEFAULT_COACH_BASE)}/${path.replace(/^\//, "")}`;
+		let session = await this.#ensureSession();
+		let res = await this.#send(method, url, session, options.body);
+		if (res.status === 401 || res.status === 403) {
+			await res.body?.cancel().catch(() => {});
+			if (this.#sessionId === session) this.#sessionId = null;
+			session = await this.#ensureSession();
+			res = await this.#send(method, url, session, options.body);
+		}
+		const shouldReport = !res.ok && !options.expectedStatuses?.includes(res.status);
+		let text;
+		try {
+			text = await res.text();
+		} catch (error) {
+			if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, { requestBody: options.body });
+			throw error;
+		}
+		const data = parseResponseText(text);
+		if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, {
+			requestBody: options.body,
+			responseBody: data
+		});
+		return {
+			status: res.status,
+			ok: res.ok,
+			data
+		};
+	}
+	#send(method, url, session, body) {
+		const upper = method.toUpperCase();
+		const headers = {
+			accept: "application/json",
+			"session-token": session
+		};
+		const init = {
+			method: upper,
+			headers
+		};
+		if (body !== void 0 && upper !== "GET" && upper !== "DELETE") {
+			headers["content-type"] = "application/json";
+			init.body = JSON.stringify(body);
+		}
+		return this.#transport(url, init);
+	}
+};
+//#endregion
 //#region ../js/src/athlete.ts
 async function getJson(client, path, label) {
 	const res = await client.request("GET", path);
@@ -3135,7 +3213,7 @@ function registerAthleteTrainingTools(server, ctx) {
 }
 //#endregion
 //#region package.json
-var version = "3.6.0";
+var version = "3.7.2";
 //#endregion
 //#region src/server.ts
 function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trainheroic-unofficial/athlete-mcp",
-  "version": "3.6.0",
+  "version": "3.7.2",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,14 +20,14 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/server": "2.0.0",
-    "zod": "^4.4.3",
-    "@trainheroic-unofficial/core": "3.6.0",
-    "@trainheroic-unofficial/js": "3.6.0"
+    "zod": "^4.6.3",
+    "@trainheroic-unofficial/core": "3.7.2",
+    "@trainheroic-unofficial/js": "3.7.2"
   },
   "devDependencies": {
-    "@types/node": "^26.3.0",
-    "tsdown": "^0.22.14",
-    "tsx": "^4.23.12",
+    "@types/node": "^26.5.1",
+    "tsdown": "^0.23.0",
+    "tsx": "^4.23.13",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11"
   },