catence 0.1.0 → 0.2.0-beta.10

package/config.example.json

@@ -23,40 +23,52 @@
     }
   },
   "console": {
-    "defaultProfile": "azure-foundry",
+    "defaultProfile": "openai",
     "limits": {
       "toolRounds": 8,
       "toolResultCharacters": 24000
     },
     "profiles": {
-      "azure-foundry": {
-        "label": "Azure Foundry",
-        "defaultModel": "terra",
-        "defaultReasoningEffort": "medium",
-        "models": {
-          "terra": { "label": "GPT-5.6 Terra", "model": "azure_ai/gpt-5.6-terra" },
-          "luna": { "label": "GPT-5.6 Luna", "model": "azure_ai/gpt-5.6-luna" },
-          "sol": { "label": "GPT-5.6 Sol", "model": "azure_ai/gpt-5.6-sol" }
-        },
-        "apiKeyEnv": "AZURE_API_KEY",
-        "apiBaseEnv": "AZURE_API_BASE",
-        "apiVersionEnv": "AZURE_API_VERSION"
-      },
-      "opencode": {
-        "label": "OpenCode-compatible",
-        "model": "openai/your-model-name",
-        "apiKeyEnv": "OPENCODE_API_KEY",
-        "apiBaseEnv": "OPENCODE_API_BASE"
-      },
       "openai": {
         "label": "OpenAI",
         "model": "openai/gpt-5-mini",
         "apiKeyEnv": "OPENAI_API_KEY"
       },
+      "openai-compatible": {
+        "label": "OpenAI-compatible",
+        "model": "openai/your-model-name",
+        "apiKeyEnv": "OPENAI_API_KEY",
+        "apiBaseEnv": "OPENAI_API_BASE"
+      },
       "anthropic": {
         "label": "Anthropic",
         "model": "anthropic/claude-sonnet-4-5",
         "apiKeyEnv": "ANTHROPIC_API_KEY"
+      },
+      "opencode-zen": {
+        "label": "OpenCode Zen",
+        "defaultModel": "deepseek-v4-flash-free",
+        "models": {
+          "deepseek-v4-flash-free": {
+            "label": "DeepSeek V4 Flash Free",
+            "model": "openai/deepseek-v4-flash-free",
+            "variants": { "High": "high", "Max": "max" }
+          },
+          "nemotron-3-ultra-free": { "label": "Nemotron 3 Ultra Free", "model": "openai/nemotron-3-ultra-free" },
+          "big-pickle": { "label": "Big Pickle", "model": "openai/big-pickle" }
+        },
+        "apiKeyEnv": "OPENCODE_API_KEY",
+        "apiBaseEnv": "OPENCODE_ZEN_API_BASE"
+      },
+      "opencode-zen-responses": {
+        "label": "OpenCode Zen (Responses)",
+        "defaultModel": "gpt-5.6-luna",
+        "models": {
+          "gpt-5.6-luna": { "label": "GPT 5.6 Luna", "model": "openai/responses/gpt-5.6-luna" },
+          "gpt-5.6-terra": { "label": "GPT 5.6 Terra", "model": "openai/responses/gpt-5.6-terra" }
+        },
+        "apiKeyEnv": "OPENCODE_API_KEY",
+        "apiBaseEnv": "OPENCODE_ZEN_RESPONSES_API_BASE"
       }
     }
   }

package/dist/contracts/index.d.ts

@@ -1,3 +1,4 @@
+export * from './progress.js';
 export * from './runtime.js';
 export * from './release.js';
 export * from './staging.js';

package/dist/contracts/index.js

@@ -1,3 +1,4 @@
+export * from './progress.js';
 export * from './runtime.js';
 export * from './release.js';
 export * from './staging.js';

package/dist/contracts/progress.d.ts

@@ -0,0 +1,23 @@
+export declare const STALE_RUN_TIMEOUT_MS: number;
+export declare const SYNC_STAGES: readonly ["starting", "login", "singletons", "daily", "range", "ftp_history", "max_metrics", "hrv_history", "scores", "activities", "collections", "importing", "completed", "interrupted", "failed", "timed_out"];
+export type SyncStage = (typeof SYNC_STAGES)[number];
+export interface SyncProgressState {
+    runId: string;
+    provider: string;
+    stage: SyncStage;
+    currentStep: string | null;
+    completedUnits: number;
+    totalUnits: number | null;
+    percentComplete: number;
+    elapsedSeconds: number;
+    estimatedRemainingSeconds: number | null;
+    heartbeatAt: string;
+}
+export interface SyncProgressSnapshot {
+    running: SyncProgressState[];
+    recent: SyncProgressState[];
+}
+export interface InterruptedRuns {
+    runIds: string[];
+}
+export declare function normalizeProgress(value: unknown): SyncProgressState | null;

package/dist/contracts/progress.js

@@ -0,0 +1,48 @@
+export const STALE_RUN_TIMEOUT_MS = 15 * 60 * 1000;
+export const SYNC_STAGES = [
+    'starting',
+    'login',
+    'singletons',
+    'daily',
+    'range',
+    'ftp_history',
+    'max_metrics',
+    'hrv_history',
+    'scores',
+    'activities',
+    'collections',
+    'importing',
+    'completed',
+    'interrupted',
+    'failed',
+    'timed_out',
+];
+export function normalizeProgress(value) {
+    if (typeof value !== 'object' || value === null) {
+        return null;
+    }
+    const record = value;
+    const runId = typeof record.runId === 'string' ? record.runId : '';
+    const provider = typeof record.provider === 'string' ? record.provider : '';
+    if (!runId || !provider) {
+        return null;
+    }
+    const stage = SYNC_STAGES.includes(record.stage)
+        ? record.stage
+        : 'starting';
+    const numberOr = (value, fallback) => typeof value === 'number' && Number.isFinite(value) ? value : fallback;
+    const roundOrNull = (value) => typeof value === 'number' && Number.isFinite(value) ? Math.max(0, Math.round(value)) : null;
+    return {
+        runId,
+        provider,
+        stage,
+        currentStep: typeof record.currentStep === 'string' ? record.currentStep : null,
+        completedUnits: Math.max(0, Math.round(numberOr(record.completedUnits, 0))),
+        totalUnits: roundOrNull(record.totalUnits),
+        percentComplete: Math.min(100, Math.max(0, numberOr(record.percentComplete, 0))),
+        elapsedSeconds: Math.max(0, numberOr(record.elapsedSeconds, 0)),
+        estimatedRemainingSeconds: roundOrNull(record.estimatedRemainingSeconds),
+        heartbeatAt: typeof record.heartbeatAt === 'string' ? record.heartbeatAt : new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=progress.js.map

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.1.0";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.0-beta.10";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.1.0';
+export const CATENCE_RUNTIME_VERSION = '0.2.0-beta.10';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/core/logging.d.ts

@@ -0,0 +1,16 @@
+import type { CatencePaths } from '../contracts/runtime.js';
+export type SyncLogger = {
+    info: (message: string, context?: Record<string, unknown>) => void;
+    warn: (message: string, context?: Record<string, unknown>) => void;
+    error: (message: string, context?: Record<string, unknown>) => void;
+    debug: (message: string, context?: Record<string, unknown>) => void;
+};
+/**
+ * Resolve the sync log file path.
+ *
+ * `CATENCE_LOG` may be an absolute path or a path relative to the catalog home.
+ * When unset (the default), logs go to stderr only so the console stays clean
+ * and stdout remains machine-readable for callers like sync.sh.
+ */
+export declare function resolveLogFile(paths: CatencePaths, environment?: NodeJS.ProcessEnv): string | null;
+export declare function createSyncLogger(paths: CatencePaths, environment?: NodeJS.ProcessEnv): SyncLogger;

package/dist/core/logging.js

@@ -0,0 +1,68 @@
+import { appendFile, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+const LEVEL_WEIGHT = { debug: 10, info: 20, warn: 30, error: 40 };
+function configuredLevel(environment = process.env) {
+    const raw = (environment.CATENCE_LOG_LEVEL ?? 'info').toLowerCase();
+    if (raw === 'debug')
+        return LEVEL_WEIGHT.debug;
+    if (raw === 'warn')
+        return LEVEL_WEIGHT.warn;
+    if (raw === 'error')
+        return LEVEL_WEIGHT.error;
+    return LEVEL_WEIGHT.info;
+}
+/**
+ * Resolve the sync log file path.
+ *
+ * `CATENCE_LOG` may be an absolute path or a path relative to the catalog home.
+ * When unset (the default), logs go to stderr only so the console stays clean
+ * and stdout remains machine-readable for callers like sync.sh.
+ */
+export function resolveLogFile(paths, environment = process.env) {
+    const configured = environment.CATENCE_LOG;
+    if (!configured)
+        return null;
+    return path.isAbsolute(configured) ? configured : path.join(paths.root, configured);
+}
+export function createSyncLogger(paths, environment = process.env) {
+    const threshold = configuredLevel(environment);
+    const logFile = resolveLogFile(paths, environment);
+    const write = (level, message, context) => {
+        if (LEVEL_WEIGHT[level] < threshold)
+            return;
+        const line = formatLogLine(level, message, context);
+        process.stderr.write(`${line}\n`);
+        if (logFile) {
+            // Fire-and-forget: never block a sync run on log persistence.
+            appendLogLine(logFile, `${line}\n`).catch(() => { });
+        }
+    };
+    return {
+        info: (message, context) => write('info', message, context),
+        warn: (message, context) => write('warn', message, context),
+        error: (message, context) => write('error', message, context),
+        debug: (message, context) => write('debug', message, context),
+    };
+}
+function formatLogLine(level, message, context) {
+    const timestamp = new Date().toISOString();
+    const tag = level.toUpperCase().padEnd(5);
+    let line = `[${timestamp}] [${tag}] ${message}`;
+    if (context && Object.keys(context).length > 0) {
+        line += ` ${serializeContext(context)}`;
+    }
+    return line;
+}
+function serializeContext(context) {
+    try {
+        return JSON.stringify(context);
+    }
+    catch {
+        return '';
+    }
+}
+let appendLogLine = async (file, line) => {
+    await mkdir(path.dirname(file), { recursive: true });
+    await appendFile(file, line, 'utf8');
+};
+//# sourceMappingURL=logging.js.map

package/dist/core/query/repository.d.ts

@@ -1,4 +1,5 @@
 import type { CatencePaths } from '../../contracts/runtime.js';
+import { type SyncProgressSnapshot } from '../../contracts/progress.js';
 import type { QueryValues, ReadDataStore } from '../../contracts/storage.js';
 import { type DatasetDefinition } from './catalog.js';
 export declare class ReadOnlyRepository {
@@ -10,6 +11,7 @@ export declare class ReadOnlyRepository {
     datasetRelation(datasetName: string): Promise<string>;
     activitySampleRelation(): Promise<string>;
     status(): Promise<Record<string, unknown>>;
+    progress(): Promise<SyncProgressSnapshot>;
     coverage(): Promise<Record<string, unknown>>;
     activity(activityId: string): Promise<Record<string, unknown> | null>;
     summary(startDate: string, endDate: string): Promise<Record<string, unknown>>;

package/dist/core/query/repository.js

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs';
 import path from 'node:path';
+import { SYNC_STAGES } from '../../contracts/progress.js';
 import { sqlString } from './sql.js';
 import { DATASET_CATALOG, getDataset } from './catalog.js';
 export class ReadOnlyRepository {
@@ -137,6 +138,33 @@ export class ReadOnlyRepository {
             incrementalCursors: cursors,
         };
     }
+    async progress() {
+        // Same sequential-read discipline as status(): the shared native
+        // connection must not run these small reads concurrently.
+        const running = await this.rows(`
+      SELECT runs.run_id, runs.provider, coalesce(progress.stage, 'starting') AS stage,
+        progress.current_step,
+        coalesce(progress.completed_units, 0) AS completed_units,
+        progress.total_units,
+        coalesce(progress.percent, 0) AS percent,
+        coalesce(progress.elapsed_seconds, 0) AS elapsed_seconds,
+        progress.estimated_remaining_seconds,
+        cast(coalesce(progress.heartbeat_at, runs.started_at) AS VARCHAR) AS heartbeat_at
+      FROM sync_runs AS runs
+      LEFT JOIN sync_run_progress AS progress USING (run_id)
+      WHERE runs.status = 'running'
+      ORDER BY runs.started_at DESC
+    `);
+        const recent = await this.rows(`
+      SELECT run_id, provider, stage, current_step, completed_units, total_units, percent,
+        elapsed_seconds, estimated_remaining_seconds,
+        cast(heartbeat_at AS VARCHAR) AS heartbeat_at
+      FROM sync_run_progress
+      ORDER BY heartbeat_at DESC
+      LIMIT 10
+    `);
+        return { running: running.map(toSyncProgressState), recent: recent.map(toSyncProgressState) };
+    }
     async coverage() {
         const rows = await this.rows(`
       SELECT 'activities' AS dataset, min(cast(started_at_utc AS DATE)) AS start_date, max(cast(started_at_utc AS DATE)) AS end_date, count(*)::INTEGER AS row_count FROM activities
@@ -166,6 +194,20 @@ export class ReadOnlyRepository {
         return Object.values(DATASET_CATALOG);
     }
 }
+function toSyncProgressState(row) {
+    return {
+        runId: row.run_id,
+        provider: row.provider,
+        stage: SYNC_STAGES.includes(row.stage) ? row.stage : 'starting',
+        currentStep: row.current_step,
+        completedUnits: Math.max(0, Number(row.completed_units) || 0),
+        totalUnits: row.total_units === null || row.total_units === undefined ? null : Math.max(0, Number(row.total_units) || 0),
+        percentComplete: Math.min(100, Math.max(0, Number(row.percent) || 0)),
+        elapsedSeconds: Math.max(0, Number(row.elapsed_seconds) || 0),
+        estimatedRemainingSeconds: row.estimated_remaining_seconds === null || row.estimated_remaining_seconds === undefined ? null : Math.max(0, Number(row.estimated_remaining_seconds) || 0),
+        heartbeatAt: row.heartbeat_at,
+    };
+}
 /** Converts DuckDB's Date/BigInt values into MCP-safe JSON values. */
 export function jsonSafe(value) {
     if (typeof value === 'bigint')

package/dist/core/runtime/catalog.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import type { CatencePaths } from '../../contracts/runtime.js';
+declare const catalogSchema: z.ZodObject<{
+    formatVersion: z.ZodLiteral<1>;
+    defaultAthleteId: z.ZodString;
+    athletes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        createdAt: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Athlete = z.infer<typeof catalogSchema>['athletes'][number];
+export type CatenceCatalog = z.infer<typeof catalogSchema>;
+export type CatalogPaths = {
+    root: string;
+    catalog: string;
+    athletes: string;
+    console: string;
+};
+export declare function defaultCatalogHome(): string;
+export declare function resolveCatalogPaths(root?: string): CatalogPaths;
+export declare function athleteStorePaths(catalogPaths: CatalogPaths, athleteId: string): CatencePaths;
+export declare function loadCatalog(paths?: CatalogPaths): Promise<CatenceCatalog>;
+export declare function initializeCatalog(paths: CatalogPaths | undefined, athlete: {
+    id: string;
+    label: string;
+}): Promise<CatenceCatalog>;
+export declare function addAthlete(paths: CatalogPaths, athlete: {
+    id: string;
+    label: string;
+    setDefault?: boolean;
+}): Promise<CatenceCatalog>;
+export declare function resolveAthlete(paths: CatalogPaths, athleteId: string): Promise<{
+    athlete: Athlete;
+    paths: CatencePaths;
+}>;
+export declare function defaultAthlete(paths?: CatalogPaths): Promise<{
+    athlete: Athlete;
+    paths: CatencePaths;
+}>;
+export {};

package/dist/core/runtime/catalog.js

@@ -0,0 +1,121 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { z } from 'zod';
+import { resolvePaths } from './configuration.js';
+const CATALOG_FORMAT_VERSION = 1;
+const athleteIdSchema = z.string().regex(/^[a-z][a-z0-9-]{0,62}$/, 'must use lowercase letters, digits, and hyphens, starting with a letter');
+const catalogSchema = z.object({
+    formatVersion: z.literal(CATALOG_FORMAT_VERSION),
+    defaultAthleteId: athleteIdSchema,
+    athletes: z.array(z.object({
+        id: athleteIdSchema,
+        label: z.string().trim().min(1).max(120),
+        createdAt: z.string().datetime(),
+    }).strict()).min(1),
+}).strict().superRefine((catalog, context) => {
+    const ids = catalog.athletes.map((athlete) => athlete.id);
+    if (new Set(ids).size !== ids.length)
+        context.addIssue({ code: 'custom', path: ['athletes'], message: 'athlete IDs must be unique' });
+    if (!ids.includes(catalog.defaultAthleteId))
+        context.addIssue({ code: 'custom', path: ['defaultAthleteId'], message: 'must name a configured athlete' });
+});
+export function defaultCatalogHome() {
+    return path.resolve(process.env.CATENCE_HOME ?? path.join(homedir(), '.catence'));
+}
+export function resolveCatalogPaths(root = defaultCatalogHome()) {
+    const absoluteRoot = path.resolve(root);
+    return {
+        root: absoluteRoot,
+        catalog: path.join(absoluteRoot, 'catalog.json'),
+        athletes: path.join(absoluteRoot, 'athletes'),
+        console: path.join(absoluteRoot, 'console'),
+    };
+}
+export function athleteStorePaths(catalogPaths, athleteId) {
+    const id = athleteIdSchema.parse(athleteId);
+    return resolvePaths(path.join(catalogPaths.athletes, id));
+}
+function legacyStoreMessage(paths) {
+    return `Catence 0.2 uses a catalog at ${paths.root}. The existing directory looks like a 0.1 data store and cannot be migrated automatically. Create a fresh catalog and re-sync each athlete.`;
+}
+/** Home-directory entries the Console creates on its own and must not block catalog initialization. */
+const CONSOLE_ARTIFACTS = new Set(['config.json', 'console', '.files', '.chainlit', 'public']);
+export async function loadCatalog(paths = resolveCatalogPaths()) {
+    const contents = await readFile(paths.catalog, 'utf8').catch((error) => {
+        if (error.code !== 'ENOENT')
+            throw error;
+        if (existsSync(path.join(paths.root, 'catence.duckdb')))
+            throw new Error(legacyStoreMessage(paths));
+        throw new Error(`No Catence catalog exists at ${paths.root}. Run catence-data setup first.`);
+    });
+    try {
+        return catalogSchema.parse(JSON.parse(contents));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Invalid Catence catalog at ${paths.catalog}: ${message}`);
+    }
+}
+async function writeCatalog(paths, catalog) {
+    await mkdir(paths.root, { recursive: true, mode: 0o700 });
+    const temporary = `${paths.catalog}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(catalog, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await rename(temporary, paths.catalog);
+}
+export async function initializeCatalog(paths = resolveCatalogPaths(), athlete) {
+    if (existsSync(paths.catalog))
+        return loadCatalog(paths);
+    let entries;
+    try {
+        entries = await readdir(paths.root);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            entries = [];
+        else
+            throw error;
+    }
+    if (entries.includes('catence.duckdb'))
+        throw new Error(legacyStoreMessage(paths));
+    const unrelated = entries.filter((entry) => !CONSOLE_ARTIFACTS.has(entry));
+    if (unrelated.length > 0) {
+        throw new Error(`Refusing to initialize ${paths.root}: found ${unrelated.join(', ')}. Remove these or choose an empty --home directory.`);
+    }
+    const id = athleteIdSchema.parse(athlete.id);
+    const record = { id, label: athlete.label.trim(), createdAt: new Date().toISOString() };
+    if (!record.label)
+        throw new Error('Athlete label is required.');
+    const catalog = { formatVersion: CATALOG_FORMAT_VERSION, defaultAthleteId: id, athletes: [record] };
+    await writeCatalog(paths, catalog);
+    return catalog;
+}
+export async function addAthlete(paths, athlete) {
+    const catalog = await loadCatalog(paths);
+    const id = athleteIdSchema.parse(athlete.id);
+    if (catalog.athletes.some((entry) => entry.id === id))
+        throw new Error(`Athlete ${id} already exists.`);
+    const label = athlete.label.trim();
+    if (!label)
+        throw new Error('Athlete label is required.');
+    const next = {
+        ...catalog,
+        defaultAthleteId: athlete.setDefault ? id : catalog.defaultAthleteId,
+        athletes: [...catalog.athletes, { id, label, createdAt: new Date().toISOString() }],
+    };
+    await writeCatalog(paths, next);
+    return next;
+}
+export async function resolveAthlete(paths, athleteId) {
+    const catalog = await loadCatalog(paths);
+    const athlete = catalog.athletes.find((entry) => entry.id === athleteId);
+    if (!athlete)
+        throw new Error(`Unknown athlete ${athleteId}. Call list_athletes to inspect the configured catalog.`);
+    return { athlete, paths: athleteStorePaths(paths, athlete.id) };
+}
+export async function defaultAthlete(paths = resolveCatalogPaths()) {
+    const catalog = await loadCatalog(paths);
+    return resolveAthlete(paths, catalog.defaultAthleteId);
+}
+//# sourceMappingURL=catalog.js.map

package/dist/core/runtime/configuration.d.ts

@@ -4,7 +4,7 @@ export type { CatencePaths } from '../../contracts/runtime.js';
 export declare function resolvePaths(root?: string): CatencePaths;
 export declare function ensurePaths(paths: CatencePaths): Promise<void>;
 export declare function defaultFromDate(now?: Date): string;
-export declare function requireIntervalsConfig(): {
+export declare function requireIntervalsConfig(environment?: NodeJS.ProcessEnv): {
     apiKey: string;
     athleteId: string;
 };

package/dist/core/runtime/configuration.js

@@ -23,11 +23,11 @@ export function defaultFromDate(now = new Date()) {
     const date = new Date(Date.UTC(now.getUTCFullYear() - 1, now.getUTCMonth(), now.getUTCDate()));
     return date.toISOString().slice(0, 10);
 }
-export function requireIntervalsConfig() {
-    const apiKey = process.env.INTERVALS_API_KEY;
+export function requireIntervalsConfig(environment = process.env) {
+    const apiKey = environment.INTERVALS_API_KEY;
     if (!apiKey)
         throw new Error('INTERVALS_API_KEY is required for an Intervals sync.');
-    return { apiKey, athleteId: process.env.INTERVALS_ATHLETE_ID ?? '0' };
+    return { apiKey, athleteId: environment.INTERVALS_ATHLETE_ID ?? '0' };
 }
 const rateLimitSchema = z.object({ requests: z.number().int().positive(), windowSeconds: z.number().int().positive() }).strict();
 const nullableRateLimitSchema = rateLimitSchema.nullable();

package/dist/core/runtime/secrets.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+import type { CatencePaths } from '../../contracts/runtime.js';
+declare const secretSchema: z.ZodObject<{
+    garmin: z.ZodOptional<z.ZodObject<{
+        email: z.ZodOptional<z.ZodString>;
+        password: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    intervals: z.ZodOptional<z.ZodObject<{
+        apiKey: z.ZodOptional<z.ZodString>;
+        athleteId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    strava: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AthleteSecrets = z.infer<typeof secretSchema>;
+export type SecretProvider = keyof AthleteSecrets;
+export declare function providerSecretPath(paths: CatencePaths): string;
+export declare function readAthleteSecrets(paths: CatencePaths): Promise<AthleteSecrets>;
+export declare function setAthleteSecret(paths: CatencePaths, provider: SecretProvider, field: string, value: string): Promise<void>;
+/** Build only the provider environment needed by a selected athlete worker. */
+export declare function athleteProviderEnvironment(paths: CatencePaths, base?: NodeJS.ProcessEnv): Promise<NodeJS.ProcessEnv>;
+export {};

package/dist/core/runtime/secrets.js

@@ -0,0 +1,68 @@
+import { chmod } from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+import { ensurePaths } from './configuration.js';
+const secretSchema = z.object({
+    garmin: z.object({ email: z.string().min(1).optional(), password: z.string().min(1).optional() }).strict().optional(),
+    intervals: z.object({ apiKey: z.string().min(1).optional(), athleteId: z.string().min(1).optional() }).strict().optional(),
+    strava: z.object({ clientId: z.string().min(1).optional(), clientSecret: z.string().min(1).optional() }).strict().optional(),
+}).strict();
+const secretFields = {
+    garmin: ['email', 'password'],
+    intervals: ['apiKey', 'athleteId'],
+    strava: ['clientId', 'clientSecret'],
+};
+export function providerSecretPath(paths) {
+    return path.join(paths.secrets, 'providers.json');
+}
+export async function readAthleteSecrets(paths) {
+    const { readFile } = await import('node:fs/promises');
+    const contents = await readFile(providerSecretPath(paths), 'utf8').catch((error) => error.code === 'ENOENT' ? '{}' : Promise.reject(error));
+    try {
+        return secretSchema.parse(JSON.parse(contents));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Invalid provider secrets at ${providerSecretPath(paths)}: ${message}`);
+    }
+}
+export async function setAthleteSecret(paths, provider, field, value) {
+    if (!secretFields[provider].includes(field))
+        throw new Error(`${field} is not a supported ${provider} secret field.`);
+    if (!value.trim())
+        throw new Error('Secret values cannot be empty.');
+    await ensurePaths(paths);
+    const secrets = await readAthleteSecrets(paths);
+    const next = { ...secrets, [provider]: { ...(secrets[provider] ?? {}), [field]: value } };
+    const { writeFile, rename } = await import('node:fs/promises');
+    const destination = providerSecretPath(paths);
+    const temporary = `${destination}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await chmod(temporary, 0o600);
+    await rename(temporary, destination);
+    await chmod(destination, 0o600);
+}
+/** Build only the provider environment needed by a selected athlete worker. */
+export async function athleteProviderEnvironment(paths, base = process.env) {
+    const secrets = await readAthleteSecrets(paths);
+    const environment = { ...base };
+    // Never let credentials inherited by the shared process leak into an
+    // athlete store that has not explicitly configured that provider.
+    for (const name of ['GARMIN_EMAIL', 'GARMIN_PASSWORD', 'INTERVALS_API_KEY', 'INTERVALS_ATHLETE_ID', 'STRAVA_CLIENT_ID', 'STRAVA_CLIENT_SECRET']) {
+        delete environment[name];
+    }
+    if (secrets.garmin?.email)
+        environment.GARMIN_EMAIL = secrets.garmin.email;
+    if (secrets.garmin?.password)
+        environment.GARMIN_PASSWORD = secrets.garmin.password;
+    if (secrets.intervals?.apiKey)
+        environment.INTERVALS_API_KEY = secrets.intervals.apiKey;
+    if (secrets.intervals?.athleteId)
+        environment.INTERVALS_ATHLETE_ID = secrets.intervals.athleteId;
+    if (secrets.strava?.clientId)
+        environment.STRAVA_CLIENT_ID = secrets.strava.clientId;
+    if (secrets.strava?.clientSecret)
+        environment.STRAVA_CLIENT_SECRET = secrets.strava.clientSecret;
+    return environment;
+}
+//# sourceMappingURL=secrets.js.map