@zykeco/sync-server 0.8.0 → 0.9.0

package/README.md

@@ -112,12 +112,15 @@ The server ships an [MCP](https://modelcontextprotocol.io) endpoint at `POST /mc
 
 ### Required env vars
 
-| Var                     | Default | Purpose                                                                                            |
-| ----------------------- | ------- | -------------------------------------------------------------------------------------------------- |
-| `MCP_ENABLED`           | `true`  | Set `false` to disable the `/mcp` mount entirely.                                                  |
-| `MCP_CLIENT_ID`         | _req._  | Bootstrap client ID for the headless `client_credentials` grant. Public — pick anything memorable. |
-| `MCP_TOKEN_SECRET`      | _req._  | HMAC key for signing bearer tokens. ≥ 32 random bytes. Treat as a secret.                          |
-| `MCP_TOKEN_TTL_SECONDS` | `3600`  | Bearer token lifetime.                                                                             |
+| Var                           | Default   | Purpose                                                                                                                                               |
+| ----------------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `MCP_ENABLED`                 | `true`    | Set `false` to disable the `/mcp` mount entirely.                                                                                                     |
+| `MCP_CLIENT_ID`               | _req._    | Bootstrap client ID for the headless `client_credentials` grant. Public — pick anything memorable.                                                    |
+| `MCP_TOKEN_SECRET`            | _req._    | HMAC key for signing access + refresh tokens. **Must be ≥ 32 chars (enforced at startup)** — generate with `openssl rand -hex 32`. Treat as a secret. |
+| `MCP_TOKEN_TTL_SECONDS`       | `3600`    | Bearer (access) token lifetime.                                                                                                                       |
+| `MCP_REFRESH_ENABLED`         | `true`    | Issue refresh tokens on the auth-code grant so clients renew without re-login. `false` to disable.                                                    |
+| `MCP_REFRESH_TTL_SECONDS`     | `2592000` | Sliding refresh-token lifetime (30 d). Each refresh re-issues with a fresh window.                                                                    |
+| `MCP_REFRESH_MAX_TTL_SECONDS` | `7776000` | Absolute cap on a refresh chain from first issue (90 d). After this, re-auth is required.                                                             |
 
 ### HTTPS requirement & `PUBLIC_URL`
 
@@ -133,15 +136,15 @@ When `PUBLIC_URL` is set, it always wins. Without it, the server falls back to `
 
 ### Endpoints
 
-| Method | Path                                      | Purpose                                                 |
-| ------ | ----------------------------------------- | ------------------------------------------------------- |
-| GET    | `/.well-known/oauth-authorization-server` | RFC 8414 metadata (root-level, what MCP clients probe). |
-| GET    | `/.well-known/oauth-protected-resource`   | RFC 9728 resource metadata pointing back to the AS.     |
-| POST   | `/mcp/register`                           | Dynamic Client Registration (RFC 7591).                 |
-| GET    | `/mcp/authorize`                          | Consent screen (PKCE flow).                             |
-| POST   | `/mcp/authorize`                          | Consent form submit — issues an authorization code.     |
-| POST   | `/mcp/oauth/token`                        | Token endpoint (both grants).                           |
-| POST   | `/mcp`                                    | MCP JSON-RPC. Requires `Authorization: Bearer <token>`. |
+| Method | Path                                      | Purpose                                                                       |
+| ------ | ----------------------------------------- | ----------------------------------------------------------------------------- |
+| GET    | `/.well-known/oauth-authorization-server` | RFC 8414 metadata (root-level, what MCP clients probe).                       |
+| GET    | `/.well-known/oauth-protected-resource`   | RFC 9728 resource metadata pointing back to the AS.                           |
+| POST   | `/mcp/register`                           | Dynamic Client Registration (RFC 7591).                                       |
+| GET    | `/mcp/authorize`                          | Consent screen (PKCE flow).                                                   |
+| POST   | `/mcp/authorize`                          | Consent form submit — issues an authorization code.                           |
+| POST   | `/mcp/oauth/token`                        | Token endpoint (`authorization_code`, `client_credentials`, `refresh_token`). |
+| POST   | `/mcp`                                    | MCP JSON-RPC. Requires `Authorization: Bearer <token>`.                       |
 
 ### Connecting Claude.ai (web or desktop) as a custom connector
 
@@ -168,8 +171,9 @@ That means it's hitting the host root instead of the discovered path. Two causes
 
 #### Token / client lifetime
 
-- Bearer tokens expire after `MCP_TOKEN_TTL_SECONDS` (default 1 h). Claude.ai re-runs the consent flow when expired.
-- DCR client registrations are **in-memory** — they don't survive a server restart. If you restart the server, remove the connector in Claude.ai and re-add it; takes ten seconds.
+- Bearer (access) tokens expire after `MCP_TOKEN_TTL_SECONDS` (default 1 h).
+- When `MCP_REFRESH_ENABLED` is on (default), the auth-code grant also returns a **refresh token**. Clients (claude.ai, Claude Code) silently exchange it for a new access token via `grant_type=refresh_token`, so you no longer re-run the consent flow every time the access token expires. Refresh tokens are stateless and signed: they keep working across server restarts and slide forward on each use, up to the `MCP_REFRESH_MAX_TTL_SECONDS` cap. Because they are stateless, this is sliding re-issuance, **not** reuse-detected rotation: the refresh token you just exchanged stays valid until its own expiry (it is not invalidated by the re-issue), and individual tokens **cannot be revoked** before then — rotate `MCP_TOKEN_SECRET` to invalidate all of them at once.
+- DCR client registrations are **in-memory** — they don't survive a server restart. Refresh tokens do (the client binding is in the signature), so a restart no longer forces a re-login; only brand-new connections need DCR to re-run, which claude.ai does automatically.
 
 ### Connecting from headless agents (`client_credentials`)
 
@@ -187,6 +191,20 @@ curl -X POST https://YOUR_HOST/mcp \
   -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
 ```
 
+The `authorization_code` grant additionally returns a `refresh_token`. To renew
+an access token without re-running the consent flow:
+
+```bash
+curl -X POST https://YOUR_HOST/mcp/oauth/token \
+  -d grant_type=refresh_token \
+  -d client_id=$CLIENT_ID \
+  -d refresh_token=$REFRESH_TOKEN
+# -> { access_token, token_type, expires_in, refresh_token }  (a new refresh_token is re-issued)
+```
+
+(The headless `client_credentials` grant does **not** return a refresh token — it
+just re-requests with the static secret.)
+
 ## Data model
 
 - **`daily_metrics`**, **`weekly_metrics`** — `{ id (PK), isoDate / weekStartIsoDate, metricKey, value, createdAt, updatedAt }`. Composite unique on `(date, metricKey)`.

package/dist/app.js

@@ -1,4 +1,6 @@
 import { Hono } from 'hono';
+import { activitiesRoutes } from './routes/activities.js';
+import { activityHeartRateRoutes } from './routes/activity-heart-rate.js';
 import { dailyMetricsRoutes } from './routes/daily-metrics.js';
 import { dailyStressBurdenRoutes } from './routes/daily-stress-burden.js';
 import { healthRoutes } from './routes/health.js';
@@ -10,6 +12,8 @@ import { userProfileRoutes } from './routes/user-profile.js';
 import { userTimezonesRoutes } from './routes/user-timezones.js';
 import { weeklyMetricsRoutes } from './routes/weekly-metrics.js';
 import { wipeRoutes } from './routes/wipe.js';
+import { createActivitiesStore } from './stores/activities.js';
+import { createActivityHeartRateStore } from './stores/activity-heart-rate.js';
 import { createDailyMetricsStore } from './stores/daily-metrics.js';
 import { createDailyStressBurdenStore } from './stores/daily-stress-burden.js';
 import { createHeartRateMinuteStore } from './stores/heart-rate-minute.js';
@@ -30,6 +34,8 @@ export function buildApp(db, env) {
     const dailyStressBurdenStore = createDailyStressBurdenStore(db);
     const heartRateMinuteStore = createHeartRateMinuteStore(db);
     const hrZoneHistoryStore = createHrZoneHistoryStore(db);
+    const activitiesStore = createActivitiesStore(db);
+    const activityHeartRateStore = createActivityHeartRateStore(db);
     app.route('/v1/sync/daily-metrics', dailyMetricsRoutes(dailyMetricsStore, auth));
     app.route('/v1/sync/weekly-metrics', weeklyMetricsRoutes(weeklyMetricsStore, auth));
     app.route('/v1/sync/sleep-sessions', sleepSessionsRoutes(sleepSessionsStore, auth));
@@ -38,6 +44,8 @@ export function buildApp(db, env) {
     app.route('/v1/sync/daily-stress-burden', dailyStressBurdenRoutes(dailyStressBurdenStore, auth));
     app.route('/v1/sync/heart-rate-minute', heartRateMinuteRoutes(heartRateMinuteStore, auth));
     app.route('/v1/sync/hr-zone-history', hrZoneHistoryRoutes(hrZoneHistoryStore, auth));
+    app.route('/v1/sync/activities', activitiesRoutes(activitiesStore, auth));
+    app.route('/v1/sync/activity-heart-rate', activityHeartRateRoutes(activityHeartRateStore, auth));
     app.route('/v1/sync/wipe', wipeRoutes({
         dailyMetrics: dailyMetricsStore,
         weeklyMetrics: weeklyMetricsStore,
@@ -47,6 +55,8 @@ export function buildApp(db, env) {
         dailyStressBurden: dailyStressBurdenStore,
         heartRateMinute: heartRateMinuteStore,
         hrZoneHistory: hrZoneHistoryStore,
+        activities: activitiesStore,
+        activityHeartRate: activityHeartRateStore,
     }, auth));
     if (env.mcp) {
         const { mcp, discovery } = mcpRoutes({ db, env, mcp: env.mcp });

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,MAAM,UAAU,QAAQ,CAAC,EAAM,EAAE,GAAQ;IACvC,MAAM,IAAI,GAAe,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAChE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAExD,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,uBAAuB,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAC;IACjG,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,KAAK,CACP,eAAe,EACf,UAAU,CACR;QACE,YAAY,EAAE,iBAAiB;QAC/B,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,kBAAkB;QACjC,WAAW,EAAE,gBAAgB;QAC7B,iBAAiB,EAAE,sBAAsB;QACzC,eAAe,EAAE,oBAAoB;QACrC,aAAa,EAAE,kBAAkB;KAClC,EACD,IAAI,CACL,CACF,CAAC;IAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,MAAM,UAAU,QAAQ,CAAC,EAAM,EAAE,GAAQ;IACvC,MAAM,IAAI,GAAe,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAChE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAEhE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,uBAAuB,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAC;IACjG,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,uBAAuB,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAC;IACjG,GAAG,CAAC,KAAK,CACP,eAAe,EACf,UAAU,CACR;QACE,YAAY,EAAE,iBAAiB;QAC/B,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,kBAAkB;QACjC,WAAW,EAAE,gBAAgB;QAC7B,iBAAiB,EAAE,sBAAsB;QACzC,eAAe,EAAE,oBAAoB;QACrC,aAAa,EAAE,kBAAkB;QACjC,UAAU,EAAE,eAAe;QAC3B,iBAAiB,EAAE,sBAAsB;KAC1C,EACD,IAAI,CACL,CACF,CAAC;IAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}