catence 0.2.1-beta.12 → 0.2.1-beta.14

package/README.md

@@ -120,7 +120,7 @@ Optional local Streamable HTTP MCP and HTTP APIs:
 catence serve --host 127.0.0.1 --port 8787
 ```
 
-`GET /api/v1/athletes` returns IDs and labels only. `GET /api/v1/dashboard` requires `athleteId`, for example `http://127.0.0.1:8787/api/v1/dashboard?athleteId=alex&days=28`. Browser origins must be listed with `--allow-origin`; the packaged Console instead proxies the dashboard through its authenticated same-origin route. `POST /api/v1/athletes` creates a catalog athlete (`{"id": "sam", "label": "Sam", "setDefault": false}`); the packaged Console exposes the same call to admins from **Settings → Athletes**. The MCP server has no authentication of its own.
+`GET /api/v1/athletes` returns IDs and labels only. `GET /api/v1/dashboard` requires `athleteId`, for example `http://127.0.0.1:8787/api/v1/dashboard?athleteId=alex&days=28`. Browser origins must be listed with `--allow-origin`; the packaged Console instead proxies the dashboard through its authenticated same-origin route. `POST /api/v1/athletes` creates a catalog athlete (`{"id": "sam", "label": "Sam", "setDefault": false}`); the packaged Console exposes the same call to admins from **Settings → Athletes**. The MCP server has no authentication of its own unless `--auth-token-file` (or `CATENCE_MCP_TOKEN_FILE`) requires a bearer token on every endpoint except the health probes.
 
 ## Configuration
 

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.12";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.14";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.12';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.14';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/core/runtime/secrets.d.ts

@@ -16,9 +16,24 @@ declare const secretSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type AthleteSecrets = z.infer<typeof secretSchema>;
 export type SecretProvider = keyof AthleteSecrets;
+/** Display labels for the Console credentials editor. */
+export declare const secretProviderLabels: Record<SecretProvider, string>;
+export type SecretFieldDescription = {
+    name: string;
+    configured: boolean;
+};
+export type SecretProviderDescription = {
+    id: SecretProvider;
+    label: string;
+    fields: SecretFieldDescription[];
+};
 export declare function providerSecretPath(paths: CatencePaths): string;
 export declare function readAthleteSecrets(paths: CatencePaths): Promise<AthleteSecrets>;
+/** Metadata only: which provider fields are configured. Values are never returned. */
+export declare function describeAthleteSecrets(paths: CatencePaths): Promise<SecretProviderDescription[]>;
 export declare function setAthleteSecret(paths: CatencePaths, provider: SecretProvider, field: string, value: string): Promise<void>;
+/** Remove one stored provider field; an already-absent field is a no-op. */
+export declare function deleteAthleteSecret(paths: CatencePaths, provider: SecretProvider, field: string): Promise<void>;
 /** Build only the provider environment needed by a selected athlete worker. */
 export declare function athleteProviderEnvironment(paths: CatencePaths, base?: NodeJS.ProcessEnv): Promise<NodeJS.ProcessEnv>;
 export {};

package/dist/core/runtime/secrets.js

@@ -12,6 +12,13 @@ const secretFields = {
     intervals: ['apiKey', 'athleteId'],
     strava: ['clientId', 'clientSecret'],
 };
+const secretProviderOrder = ['garmin', 'intervals', 'strava'];
+/** Display labels for the Console credentials editor. */
+export const secretProviderLabels = {
+    garmin: 'Garmin',
+    intervals: 'Intervals.icu',
+    strava: 'Strava',
+};
 export function providerSecretPath(paths) {
     return path.join(paths.secrets, 'providers.json');
 }
@@ -26,14 +33,17 @@ export async function readAthleteSecrets(paths) {
         throw new Error(`Invalid provider secrets at ${providerSecretPath(paths)}: ${message}`);
     }
 }
-export async function setAthleteSecret(paths, provider, field, value) {
-    if (!secretFields[provider].includes(field))
-        throw new Error(`${field} is not a supported ${provider} secret field.`);
-    if (!value.trim())
-        throw new Error('Secret values cannot be empty.');
-    await ensurePaths(paths);
+/** Metadata only: which provider fields are configured. Values are never returned. */
+export async function describeAthleteSecrets(paths) {
     const secrets = await readAthleteSecrets(paths);
-    const next = { ...secrets, [provider]: { ...(secrets[provider] ?? {}), [field]: value } };
+    return secretProviderOrder.map((provider) => ({
+        id: provider,
+        label: secretProviderLabels[provider],
+        fields: secretFields[provider].map((name) => ({ name, configured: name in (secrets[provider] ?? {}) })),
+    }));
+}
+async function writeAthleteSecrets(paths, next) {
+    await ensurePaths(paths);
     const { writeFile, rename } = await import('node:fs/promises');
     const destination = providerSecretPath(paths);
     const temporary = `${destination}.tmp`;
@@ -42,6 +52,37 @@ export async function setAthleteSecret(paths, provider, field, value) {
     await rename(temporary, destination);
     await chmod(destination, 0o600);
 }
+export async function setAthleteSecret(paths, provider, field, value) {
+    if (!secretFields[provider].includes(field))
+        throw new Error(`${field} is not a supported ${provider} secret field.`);
+    if (!value.trim())
+        throw new Error('Secret values cannot be empty.');
+    const secrets = await readAthleteSecrets(paths);
+    const next = { ...secrets, [provider]: { ...(secrets[provider] ?? {}), [field]: value } };
+    await writeAthleteSecrets(paths, next);
+}
+/** Remove one stored provider field; an already-absent field is a no-op. */
+export async function deleteAthleteSecret(paths, provider, field) {
+    if (!(provider in secretFields))
+        throw new Error(`${provider} is not a supported provider.`);
+    if (!secretFields[provider].includes(field))
+        throw new Error(`${field} is not a supported ${provider} secret field.`);
+    const secrets = await readAthleteSecrets(paths);
+    const existing = secrets[provider];
+    if (!existing || !(field in existing))
+        return;
+    const remaining = {};
+    for (const [name, value] of Object.entries(existing)) {
+        if (name !== field && typeof value === 'string')
+            remaining[name] = value;
+    }
+    const draft = Object.assign({}, secrets);
+    if (Object.keys(remaining).length === 0)
+        delete draft[provider];
+    else
+        draft[provider] = remaining;
+    await writeAthleteSecrets(paths, secretSchema.parse(draft));
+}
 function isTruthyEnvValue(value) {
     if (!value)
         return false;

package/dist/interfaces/cli/commands.js

@@ -2,7 +2,7 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { Command } from 'commander';
-import { addAthlete, athleteStorePaths, CATENCE_RUNTIME_VERSION, CatenceDatabase, channelForVersion, createDemoStore, dataStatus, defaultCatalogHome, disconnectStravaAccount, fetchNpmDistTags, fetchPypiReleases, hasCommand, importStagedFile, initializeCatalog, isGlobalNpmInstall, linkActivity, loadCatalog, npmGlobalPrefix, planSelfUpdate, readInstalledConsoleVersion, rebuildRetrievalIndex, reimportNutrition, reimportWeight, resolveExtractionErrors, resolveAthlete, resolveCatalogPaths, retryDataSync, runSelfUpdateCommand, setAthleteSecret, syncData, syncProgress, connectStrava, connectStravaWithCallback, unlinkActivity, } from '../../runtime/index.js';
+import { addAthlete, athleteStorePaths, CATENCE_RUNTIME_VERSION, CatenceDatabase, channelForVersion, createDemoStore, dataStatus, deleteAthleteSecret, defaultCatalogHome, disconnectStravaAccount, fetchNpmDistTags, fetchPypiReleases, hasCommand, importStagedFile, initializeCatalog, isGlobalNpmInstall, linkActivity, loadCatalog, npmGlobalPrefix, planSelfUpdate, readInstalledConsoleVersion, rebuildRetrievalIndex, reimportNutrition, reimportWeight, resolveExtractionErrors, resolveAthlete, resolveCatalogPaths, retryDataSync, runSelfUpdateCommand, setAthleteSecret, syncData, syncProgress, connectStrava, connectStravaWithCallback, unlinkActivity, } from '../../runtime/index.js';
 const program = new Command()
     .name('catence-data')
     .description('Athlete-scoped Catence data setup, extraction, and normalization.')
@@ -61,7 +61,7 @@ athleteCommand.command('add')
     .action(async (options) => {
     process.stdout.write(`${JSON.stringify(await addAthlete(currentCatalog(), { id: options.id, label: options.label, setDefault: options.default }), null, 2)}\n`);
 });
-const secretCommand = program.command('secret').description('Write a provider value into one athlete’s owner-only secret store.');
+const secretCommand = program.command('secret').description('Write or remove a provider value in one athlete’s owner-only secret store.');
 secretCommand.command('set')
     .requiredOption('--provider <provider>', 'garmin, intervals, or strava')
     .requiredOption('--field <field>', 'provider secret field')
@@ -73,6 +73,16 @@ secretCommand.command('set')
     await setAthleteSecret(paths, options.provider, options.field, await stdinSecret());
     process.stdout.write(`${JSON.stringify({ athleteId: program.opts().athlete, provider: options.provider, field: options.field, stored: true }, null, 2)}\n`);
 });
+secretCommand.command('remove')
+    .requiredOption('--provider <provider>', 'garmin, intervals, or strava')
+    .requiredOption('--field <field>', 'provider secret field')
+    .action(async (options) => {
+    if (!['garmin', 'intervals', 'strava'].includes(options.provider))
+        throw new Error('--provider must be garmin, intervals, or strava.');
+    const { paths } = await currentAthlete();
+    await deleteAthleteSecret(paths, options.provider, options.field);
+    process.stdout.write(`${JSON.stringify({ athleteId: program.opts().athlete, provider: options.provider, field: options.field, removed: true }, null, 2)}\n`);
+});
 program.command('demo')
     .description('Create a generated demo athlete in an isolated demo catalog without contacting providers.')
     .option('--days <days>', 'generated days of wellness and training data', '90')

package/dist/interfaces/http/cli-options.d.ts

@@ -3,7 +3,10 @@ export type ServeCliOptions = {
     host: string;
     port: number;
     allowedOrigins: string[];
+    authTokenFile?: string;
     help: boolean;
 };
-export declare const SERVE_USAGE = "Usage: catence serve [options]\n\nRun Catence as a local Streamable HTTP MCP server.\n\nOptions:\n  --home <directory>         Catence catalog home. Defaults to CATENCE_HOME or ~/.catence.\n  --host <host>              Listener host. Defaults to 127.0.0.1.\n  --port <port>              Listener port. Defaults to 8787.\n  --allow-origin <origin>    Browser origin allowed to call Catence APIs. May be repeated.\n  -h, --help                 Show this help text.";
+export declare const SERVE_USAGE = "Usage: catence serve [options]\n\nRun Catence as a local Streamable HTTP MCP server.\n\nOptions:\n  --home <directory>         Catence catalog home. Defaults to CATENCE_HOME or ~/.catence.\n  --host <host>              Listener host. Defaults to 127.0.0.1.\n  --port <port>              Listener port. Defaults to 8787.\n  --allow-origin <origin>    Browser origin allowed to call Catence APIs. May be repeated.\n  --auth-token-file <path>   Require 'Authorization: Bearer <token>' on every request except\n                             the health endpoints. Defaults to CATENCE_MCP_TOKEN_FILE.\n  -h, --help                 Show this help text.";
+/** Read and validate the bearer token from a file: trimmed, non-empty, or fail loudly. */
+export declare function loadBearerToken(filePath: string): string;
 export declare function parseServeCliOptions(arguments_: readonly string[]): ServeCliOptions;

package/dist/interfaces/http/cli-options.js

@@ -1,3 +1,4 @@
+import { readFileSync } from 'node:fs';
 export const SERVE_USAGE = `Usage: catence serve [options]
 
 Run Catence as a local Streamable HTTP MCP server.
@@ -7,7 +8,22 @@ Options:
   --host <host>              Listener host. Defaults to 127.0.0.1.
   --port <port>              Listener port. Defaults to 8787.
   --allow-origin <origin>    Browser origin allowed to call Catence APIs. May be repeated.
+  --auth-token-file <path>   Require 'Authorization: Bearer <token>' on every request except
+                             the health endpoints. Defaults to CATENCE_MCP_TOKEN_FILE.
   -h, --help                 Show this help text.`;
+/** Read and validate the bearer token from a file: trimmed, non-empty, or fail loudly. */
+export function loadBearerToken(filePath) {
+    let token;
+    try {
+        token = readFileSync(filePath, 'utf8').trim();
+    }
+    catch (error) {
+        throw new Error(`Cannot read the auth token file ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!token)
+        throw new Error(`The auth token file ${filePath} is empty.`);
+    return token;
+}
 function requiredValue(arguments_, index, option) {
     const value = arguments_[index + 1];
     if (!value || value.startsWith('-'))
@@ -27,10 +43,11 @@ export function parseServeCliOptions(arguments_) {
     let host = process.env.CATENCE_HTTP_HOST ?? '127.0.0.1';
     let port = process.env.CATENCE_HTTP_PORT ? parsePort(process.env.CATENCE_HTTP_PORT) : 8787;
     const allowedOrigins = [];
+    let authTokenFile = process.env.CATENCE_MCP_TOKEN_FILE || undefined;
     for (let index = 0; index < arguments_.length; index++) {
         const argument = arguments_[index];
         if (argument === '-h' || argument === '--help')
-            return { home, host, port, allowedOrigins, help: true };
+            return { home, host, port, allowedOrigins, authTokenFile, help: true };
         if (argument === '--home') {
             home = requiredValue(arguments_, index, '--home');
             index++;
@@ -42,6 +59,17 @@ export function parseServeCliOptions(arguments_) {
                 throw new Error('--home requires a value.');
             continue;
         }
+        if (argument === '--auth-token-file') {
+            authTokenFile = requiredValue(arguments_, index, '--auth-token-file');
+            index++;
+            continue;
+        }
+        if (argument.startsWith('--auth-token-file=')) {
+            authTokenFile = argument.slice('--auth-token-file='.length);
+            if (!authTokenFile)
+                throw new Error('--auth-token-file requires a value.');
+            continue;
+        }
         if (argument === '--host') {
             host = requiredValue(arguments_, index, '--host');
             index++;
@@ -76,6 +104,6 @@ export function parseServeCliOptions(arguments_) {
         }
         throw new Error(`Unknown option: ${argument}`);
     }
-    return { home, host, port, allowedOrigins, help: false };
+    return { home, host, port, allowedOrigins, authTokenFile, help: false };
 }
 //# sourceMappingURL=cli-options.js.map

package/dist/interfaces/http/server.d.ts

@@ -6,6 +6,13 @@ export type CatenceHttpServerOptions = {
     /** Internal compatibility hook for tests and embedded single-store callers. */
     paths?: CatencePaths;
     allowedOrigins?: readonly string[];
+    /**
+     * When set, every request except the health endpoints and CORS preflights
+     * must present `Authorization: Bearer <token>`. The MCP server has no
+     * authentication of its own; this gates it (and the JSON APIs) for
+     * non-loopback exposure such as a Cloudflare Tunnel to an MCP client.
+     */
+    bearerToken?: string;
     /** Internal compatibility hook for tests: override the detached sync spawner. */
     startSync?: typeof startDetachedSync;
     /** Internal compatibility hook for tests: passed into the default startDetachedSync. */

package/dist/interfaces/http/server.js

@@ -1,10 +1,22 @@
+import { timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import path from 'node:path';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { addAthlete, AthleteFileConflictError, AthleteFileTooLargeError, AthleteFileValidationError, catenceRuntimeHealth, DashboardSnapshotService, DetachedSyncBusyError, DETACHED_SYNC_PROVIDERS, jsonSafe, listAthleteFileRevisions, loadCatalog, mergeOpenCodeGoConsoleProfiles, openReadOnlyRepository, readAthleteFile, readAthleteFileRevision, resolveAthlete, resolveCatalogPaths, startDetachedSync, syncProgress, updateAthleteFile, } from '../../runtime/index.js';
+import { addAthlete, AthleteFileConflictError, AthleteFileTooLargeError, AthleteFileValidationError, catenceRuntimeHealth, DashboardSnapshotService, deleteAthleteSecret, describeAthleteSecrets, DetachedSyncBusyError, DETACHED_SYNC_PROVIDERS, jsonSafe, listAthleteFileRevisions, loadCatalog, mergeOpenCodeGoConsoleProfiles, openReadOnlyRepository, readAthleteFile, readAthleteFileRevision, resolveAthlete, resolveCatalogPaths, setAthleteSecret, startDetachedSync, syncProgress, updateAthleteFile, } from '../../runtime/index.js';
 import { createCatenceMcpServer } from '../mcp/server.js';
 import { generationStatus } from './generation-status.js';
 const MAX_REQUEST_BYTES = 1_000_000;
+/** Endpoints that stay open when bearer authentication is enabled: they carry
+ * no personal data and must answer unauthenticated readiness probes. */
+const UNAUTHENTICATED_PATHS = new Set(['/health', '/api/v1/health']);
+function isAuthorized(request, bearerToken) {
+    if (!bearerToken)
+        return true;
+    const received = Buffer.from(request.headers.authorization ?? '');
+    const expected = Buffer.from(`Bearer ${bearerToken}`);
+    // timingSafeEqual throws on length mismatch, so compare sizes first.
+    return received.length === expected.length && timingSafeEqual(received, expected);
+}
 function json(response, statusCode, value) {
     const body = JSON.stringify(jsonSafe(value));
     response.writeHead(statusCode, { 'content-type': 'application/json; charset=utf-8' });
@@ -155,6 +167,40 @@ function parseAthleteFileBody(body) {
         expectedHash: (raw.expectedHash ?? null),
     };
 }
+function parseAthleteSecretBody(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        throw new Error('Request body must be a JSON object.');
+    const raw = body;
+    for (const key of Object.keys(raw)) {
+        if (!['athleteId', 'provider', 'field', 'value'].includes(key))
+            throw new Error(`Unknown athlete-secret field: ${key}.`);
+    }
+    if (raw.athleteId !== undefined && typeof raw.athleteId !== 'string')
+        throw new Error('athleteId must be a string.');
+    if (typeof raw.provider !== 'string' || !raw.provider.trim())
+        throw new Error('provider is required.');
+    if (typeof raw.field !== 'string' || !raw.field.trim())
+        throw new Error('field is required.');
+    if (typeof raw.value !== 'string' || !raw.value.trim())
+        throw new Error('value is required.');
+    return { athleteId: raw.athleteId, provider: raw.provider.trim(), field: raw.field.trim(), value: raw.value };
+}
+function parseAthleteSecretRemovalBody(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        throw new Error('Request body must be a JSON object.');
+    const raw = body;
+    for (const key of Object.keys(raw)) {
+        if (!['athleteId', 'provider', 'field'].includes(key))
+            throw new Error(`Unknown athlete-secret field: ${key}.`);
+    }
+    if (raw.athleteId !== undefined && typeof raw.athleteId !== 'string')
+        throw new Error('athleteId must be a string.');
+    if (typeof raw.provider !== 'string' || !raw.provider.trim())
+        throw new Error('provider is required.');
+    if (typeof raw.field !== 'string' || !raw.field.trim())
+        throw new Error('field is required.');
+    return { athleteId: raw.athleteId, provider: raw.provider.trim(), field: raw.field.trim() };
+}
 async function resolveSyncPaths(catalogPaths, staticPaths, body) {
     if (catalogPaths) {
         if (!body.athleteId)
@@ -279,6 +325,12 @@ export function createCatenceHttpServer(options = {}) {
                 response.writeHead(204).end();
                 return;
             }
+            if (!UNAUTHENTICATED_PATHS.has(pathname) && !isAuthorized(request, options.bearerToken)) {
+                // No WWW-Authenticate on purpose: MCP connector auto-detection treats a
+                // plain 401 as a bearer gate rather than an OAuth server.
+                json(response, 401, { error: { code: 'unauthorized', message: 'A valid Authorization: Bearer token is required.' } });
+                return;
+            }
             if (pathname === '/health' && request.method === 'GET') {
                 json(response, 200, catenceRuntimeHealth());
                 return;
@@ -406,6 +458,50 @@ export function createCatenceHttpServer(options = {}) {
                 }
                 return;
             }
+            if (pathname === '/api/v1/athlete-secrets' && request.method === 'GET') {
+                try {
+                    const url = new URL(request.url ?? '/', 'http://localhost');
+                    const paths = await dashboardPaths(catalogPaths, staticPaths, url);
+                    json(response, 200, { athleteId: url.searchParams.get('athleteId') ?? 'local', providers: await describeAthleteSecrets(paths) });
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    json(response, 400, { error: { code: 'athlete_secrets_unavailable', message } });
+                }
+                return;
+            }
+            if (pathname === '/api/v1/athlete-secrets' && request.method === 'PUT') {
+                try {
+                    const parsed = parseAthleteSecretBody(await readJsonBody(request));
+                    const url = new URL(request.url ?? '/', 'http://localhost');
+                    if (!url.searchParams.get('athleteId') && parsed.athleteId)
+                        url.searchParams.set('athleteId', parsed.athleteId);
+                    const paths = await dashboardPaths(catalogPaths, staticPaths, url);
+                    await setAthleteSecret(paths, parsed.provider, parsed.field, parsed.value);
+                    json(response, 200, { athleteId: url.searchParams.get('athleteId') ?? 'local', providers: await describeAthleteSecrets(paths) });
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    json(response, 400, { error: { code: 'athlete_secret_write_failed', message } });
+                }
+                return;
+            }
+            if (pathname === '/api/v1/athlete-secrets/remove' && request.method === 'POST') {
+                try {
+                    const parsed = parseAthleteSecretRemovalBody(await readJsonBody(request));
+                    const url = new URL(request.url ?? '/', 'http://localhost');
+                    if (!url.searchParams.get('athleteId') && parsed.athleteId)
+                        url.searchParams.set('athleteId', parsed.athleteId);
+                    const paths = await dashboardPaths(catalogPaths, staticPaths, url);
+                    await deleteAthleteSecret(paths, parsed.provider, parsed.field);
+                    json(response, 200, { athleteId: url.searchParams.get('athleteId') ?? 'local', providers: await describeAthleteSecrets(paths) });
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    json(response, 400, { error: { code: 'athlete_secret_remove_failed', message } });
+                }
+                return;
+            }
             if (pathname === '/api/v1/sync' && request.method === 'POST') {
                 let body;
                 try {

package/dist/interfaces/mcp/main.js

@@ -2,7 +2,7 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { existsSync } from 'node:fs';
 import { addAthlete, athleteStorePaths, CatenceDatabase, createDemoStore, defaultCatalogHome, initializeCatalog, loadCatalog, resolveCatalogPaths } from '../../runtime/index.js';
-import { parseServeCliOptions, SERVE_USAGE } from '../http/cli-options.js';
+import { loadBearerToken, parseServeCliOptions, SERVE_USAGE } from '../http/cli-options.js';
 import { createCatenceHttpServer } from '../http/server.js';
 import { MCP_USAGE, parseMcpCliOptions } from './cli-options.js';
 import { createCatenceMcpServer } from './server.js';
@@ -46,9 +46,11 @@ async function run() {
             return;
         }
         await migrateCatalogStores(options.home);
+        const bearerToken = options.authTokenFile ? loadBearerToken(options.authTokenFile) : undefined;
         const httpServer = createCatenceHttpServer({
             catalogPaths: resolveCatalogPaths(options.home),
             allowedOrigins: options.allowedOrigins,
+            bearerToken,
         });
         await new Promise((resolve, reject) => {
             httpServer.once('error', reject);
@@ -58,6 +60,8 @@ async function run() {
             });
         });
         console.error(`Catence Streamable HTTP server is listening at http://${options.host}:${options.port}/mcp`);
+        if (bearerToken)
+            console.error('Bearer-token authentication is enabled; health endpoints stay open for readiness probes.');
         const close = () => {
             httpServer.close(() => process.exit(0));
         };

package/dist/runtime/index.d.ts

@@ -13,8 +13,8 @@ export { CATENCE_PROTOCOL_VERSION, CATENCE_RUNTIME_VERSION, catenceRuntimeHealth
 export { configuredMcpRateLimit, loadCatenceConfig, resolvePaths } from '../core/runtime/configuration.js';
 export { addAthlete, athleteStorePaths, defaultAthlete, defaultCatalogHome, initializeCatalog, loadCatalog, resolveAthlete, resolveCatalogPaths, } from '../core/runtime/catalog.js';
 export type { Athlete, CatalogPaths, CatenceCatalog } from '../core/runtime/catalog.js';
-export { athleteProviderEnvironment, providerSecretPath, readAthleteSecrets, setAthleteSecret } from '../core/runtime/secrets.js';
-export type { AthleteSecrets, SecretProvider } from '../core/runtime/secrets.js';
+export { athleteProviderEnvironment, deleteAthleteSecret, describeAthleteSecrets, providerSecretPath, readAthleteSecrets, secretProviderLabels, setAthleteSecret } from '../core/runtime/secrets.js';
+export type { AthleteSecrets, SecretFieldDescription, SecretProvider, SecretProviderDescription } from '../core/runtime/secrets.js';
 export { ATHLETE_FILE_MAX_CHARACTERS, ATHLETE_FILE_TEMPLATE, AthleteFileConflictError, AthleteFileTooLargeError, AthleteFileValidationError, hashAthleteFileContent, listAthleteFileRevisions, readAthleteFile, readAthleteFileRevision, updateAthleteFile, } from '../core/runtime/athlete-file.js';
 export type { AthleteFileOperation, AthleteFileRevision, AthleteFileSnapshot, AthleteFileUpdate } from '../core/runtime/athlete-file.js';
 export { SlidingWindowLimiter } from '../core/runtime/limiter.js';

package/dist/runtime/index.js

@@ -2,7 +2,7 @@ export { channelForVersion, compareReleaseVersions, fetchNpmDistTags, fetchPypiR
 export { CATENCE_PROTOCOL_VERSION, CATENCE_RUNTIME_VERSION, catenceRuntimeHealth } from '../contracts/release.js';
 export { configuredMcpRateLimit, loadCatenceConfig, resolvePaths } from '../core/runtime/configuration.js';
 export { addAthlete, athleteStorePaths, defaultAthlete, defaultCatalogHome, initializeCatalog, loadCatalog, resolveAthlete, resolveCatalogPaths, } from '../core/runtime/catalog.js';
-export { athleteProviderEnvironment, providerSecretPath, readAthleteSecrets, setAthleteSecret } from '../core/runtime/secrets.js';
+export { athleteProviderEnvironment, deleteAthleteSecret, describeAthleteSecrets, providerSecretPath, readAthleteSecrets, secretProviderLabels, setAthleteSecret } from '../core/runtime/secrets.js';
 export { ATHLETE_FILE_MAX_CHARACTERS, ATHLETE_FILE_TEMPLATE, AthleteFileConflictError, AthleteFileTooLargeError, AthleteFileValidationError, hashAthleteFileContent, listAthleteFileRevisions, readAthleteFile, readAthleteFileRevision, updateAthleteFile, } from '../core/runtime/athlete-file.js';
 export { SlidingWindowLimiter } from '../core/runtime/limiter.js';
 export { DashboardSnapshotService } from '../core/dashboard/snapshot.js';

package/docs/configuration.md

@@ -247,12 +247,17 @@ profiles and preserve existing ones, limits, and `defaultProfile` unless
 | --- | --- |
 | `CATENCE_HOME` | Catalog home (default `~/.catence`); equivalent to `--home` |
 | `CATENCE_HTTP_HOST` / `CATENCE_HTTP_PORT` | Defaults for `catence serve --host/--port` (host `127.0.0.1`, port `8787`) |
-
-Provider credentials are normally stored per athlete with
-`catence-data secret set` (see [`local-mcp.md`](deployment/local-mcp.md#3-store-provider-credentials-stdin-only-never-shell-history)); those secrets are injected
-into the provider worker environment, and inherited `GARMIN_*`/`INTERVALS_*`/
-`STRAVA_*` variables are stripped first so an athlete without a provider cannot
-inherit its credentials.
+| `CATENCE_MCP_TOKEN_FILE` | Default for `catence serve --auth-token-file`; when set, every endpoint except `/health` and `/api/v1/health` requires `Authorization: Bearer <token>` |
+
+Provider credentials are stored per athlete, either with `catence-data secret
+set` (see [`local-mcp.md`](deployment/local-mcp.md#3-store-provider-credentials-stdin-only-never-shell-history))
+or by an administrator from **Settings → Athletes → Credentials** in the
+Console. The Console editor is write-only: it shows each field as configured or
+not, and values can be replaced or removed (`catence-data secret remove`, or the
+dialog's Remove button) but never read back. Those secrets are injected into the
+provider worker environment, and inherited `GARMIN_*`/`INTERVALS_*`/`STRAVA_*`
+variables are stripped first so an athlete without a provider cannot inherit its
+credentials.
 
 For local and Docker development you can also keep credentials in env without
 `secret set` — see the two fallback modes below. File values always win over

package/docs/deployment/docker.md

@@ -506,6 +506,34 @@ claude mcp add --transport http catence -- http://<tailscale-ip>:8787/mcp
   same-origin route.
 - SSH port forwarding keeps the trust boundary at your SSH credentials.
 
+### Bearer-token authentication for remote MCP clients
+
+To serve the MCP endpoint to a remote MCP client (for example a Mistral Work
+custom connector) over a Cloudflare Tunnel, enable bearer-token
+authentication instead of leaving the runtime unauthenticated. Set
+`CATENCE_MCP_TOKEN_FILE` in `catence-deploy/.env` to a host file holding one
+token (`openssl rand -hex 32`); the deploy script bind-mounts that file
+read-only into the container at the same path:
+
+```sh
+# once, when the stack is already deployed:
+printf %s "$(openssl rand -hex 32)" > /srv/catence-mcp-token   # mode 0600, outside the data volume
+echo "CATENCE_MCP_TOKEN_FILE=/srv/catence-mcp-token" >> catence-deploy/.env
+./scripts/deploy-console.sh beta    # re-renders compose with the token mount
+```
+
+With the token configured, every runtime endpoint except `/health` and
+`/api/v1/health` answers `401` without an exact `Authorization: Bearer
+<token>` header — including `/mcp` and the JSON APIs. The Console attaches
+the header automatically to its own runtime calls, and refuses to start when
+the configured file is unreadable or empty.
+
+Keep `CATENCE_MCP_BIND=127.0.0.1` (the default): the tunnel client on the
+host forwards to the host-loopback mapping, so the port still never binds a
+LAN interface. Point the tunnel ingress for the MCP hostname at
+`http://127.0.0.1:8787` and complete the client's credential flow with the
+same token. Rotate by rewriting the file and restarting the stack.
+
 ## Exposing the Console safely
 
 Keep the Console port bound to `127.0.0.1` (the default) and front it with a

package/docs/deployment/local-console.md

@@ -77,6 +77,12 @@ printf %s 'strava-client-secret' | catence-data --athlete alex secret set --prov
 Set only the providers you actually sync; `secret set` accepts each field
 independently.
 
+Administrators can also manage any athlete's credentials from **Settings →
+Athletes → Credentials** in the Console. The dialog is write-only — it shows
+each field as configured or not and lets you replace or remove values, but
+values are never displayed. `catence-data --athlete <id> secret remove
+--provider <provider> --field <field>` mirrors the dialog for scripted setups.
+
 ## 4. Sync data and build retrieval context
 
 ```sh
@@ -282,10 +288,12 @@ per-account grants at the login, then server-owned scoping per chat.
 
 Console pages and chats reach the runtime through the authenticated Console
 origin: Chainlit middleware proxies the Console's API surface — `GET
-/api/v1/dashboard`, `GET`/`POST /api/v1/athletes` (POST is admin-only), `GET
-/api/v1/threads/<id>/generation`, and the models, accounts, tool-server, and
-sync routes — to the runtime only when the Console's JWT cookie is valid
-(otherwise 401), so raw port 8787 does not need to be exposed.
+/api/v1/dashboard`, `GET`/`POST /api/v1/athletes` (POST is admin-only),
+`GET`/`PUT /api/v1/athlete-secrets` and `POST /api/v1/athlete-secrets/remove`
+(all admin-only), `GET /api/v1/threads/<id>/generation`, and the models,
+accounts, tool-server, and sync routes — to the runtime only when the Console's
+JWT cookie is valid (otherwise 401), so raw port 8787 does not need to be
+exposed.
 
 ## Model discovery (OpenCode Go)
 

package/docs/deployment/local-mcp.md

@@ -302,6 +302,31 @@ catence serve --host 127.0.0.1 --port 8787
 By default it is loopback-only. `CATENCE_HTTP_HOST` and `CATENCE_HTTP_PORT`
 override the host and port when the flags are omitted.
 
+#### Bearer-token authentication
+
+The server has no authentication of its own; when it must be reachable beyond
+loopback (for example through a Cloudflare Tunnel to an MCP client such as
+Mistral Work), require a bearer token with `--auth-token-file <path>`
+(environment equivalent: `CATENCE_MCP_TOKEN_FILE`):
+
+```sh
+catence serve --host 127.0.0.1 --port 8787 --auth-token-file /path/to/token
+```
+
+- The file holds one token (whitespace-trimmed); generate one with
+  `openssl rand -hex 32`. An unreadable or empty file aborts startup.
+- Every endpoint except `/health` and `/api/v1/health` (kept open for readiness
+  probes) then answers `401` without an exact
+  `Authorization: Bearer <token>` header. The `401` deliberately carries no
+  `WWW-Authenticate`, so MCP clients with auth auto-detection (Mistral Work)
+  classify the server as bearer-auth rather than OAuth.
+- CORS preflights (`OPTIONS`) pass through without a token.
+- Rotation: rewrite the file and restart the server. Keep the token out of
+  `.env`, `config.json`, shell history, and repositories.
+- The Console attaches the same header automatically to its runtime calls when
+  `CATENCE_MCP_TOKEN_FILE` is set, and refuses to start if the file is
+  unreadable.
+
 - `GET /api/v1/athletes` returns IDs and labels only.
 - `POST /api/v1/athletes` creates a catalog athlete from
   `{"id": "sam", "label": "Sam", "setDefault": false}` and answers with the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.12",
+  "version": "0.2.1-beta.14",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {