catence 0.2.1-beta.2 → 0.2.1-beta.21

package/dist/core/runtime/oauth/model.js

@@ -0,0 +1,345 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdir, readdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+/**
+ * File-backed OAuthServerModel for the mcp-oauth-server package.
+ *
+ * Layout under <catalogHome>/oauth/ (directory 0700, files 0600, atomic
+ * tmp+rename writes, mirroring mcp-keys.ts):
+ *
+ *   clients/<clientId>.json          registered client (clientId is a UUID)
+ *   codes/<sha256(code)>.json        authorization code (raw code never at rest)
+ *   access/<sha256(token)>.json      access token (raw token never at rest)
+ *   refresh/<sha256(token)>.json     refresh token (raw token never at rest)
+ *   cimd/<sha256(clientIdUrl)>.json  cached client id metadata document
+ *
+ * Every path component is either a validated UUID or a SHA-256 hex digest, so
+ * no record id reaches the filesystem unvalidated. Records are immutable once
+ * written; consume operations claim a record with an atomic rename before
+ * deleting it, so exactly one concurrent caller wins. Expired records are
+ * swept on read; malformed records fail closed (undefined) and are removed.
+ */
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const uuidSchema = z.string().regex(UUID_PATTERN, 'must be a UUID');
+const isoTimestampSchema = z.string().datetime();
+// The RFC 7591 metadata fields the lib persists on a client. Registered
+// clients key them by a UUID client_id; a cached Client ID Metadata Document
+// keys them by the document URL instead (see cimdClientRecordSchema).
+const clientMetadataFields = {
+    redirect_uris: z.array(z.string()),
+    token_endpoint_auth_method: z.string().optional(),
+    grant_types: z.array(z.string()).optional(),
+    response_types: z.array(z.string()).optional(),
+    application_type: z.string().optional(),
+    client_name: z.string().optional(),
+    client_uri: z.string().optional(),
+    logo_uri: z.string().optional(),
+    scope: z.string().optional(),
+    contacts: z.array(z.string()).optional(),
+    tos_uri: z.string().optional(),
+    policy_uri: z.string().optional(),
+    jwks_uri: z.string().optional(),
+    jwks: z.any().optional(),
+    software_id: z.string().optional(),
+    software_version: z.string().optional(),
+    // The lib's OAuthClientMetadataSchema passes software_statement through to
+    // the stored client; the strict record schema must accept it too.
+    software_statement: z.string().optional(),
+};
+const clientRecordSchema = z.object({
+    ...clientMetadataFields,
+    client_id: uuidSchema,
+    client_secret: z.string().optional(),
+    client_id_issued_at: z.number().optional(),
+    client_secret_expires_at: z.number().optional(),
+}).strict();
+// A cached CIMD document's client_id is the document URL, not a UUID. The
+// record is keyed by the hash of that URL, never by the id itself.
+const cimdClientRecordSchema = z.object({
+    ...clientMetadataFields,
+    client_id: z.string().min(1),
+    client_secret: z.string().optional(),
+    client_id_issued_at: z.number().optional(),
+    client_secret_expires_at: z.number().optional(),
+}).strict();
+// Codes and tokens are keyed by a hashed secret, never by the client id, and
+// can be issued to either kind of client: a DCR-registered client (UUID) or a
+// client identified by a Client ID Metadata Document (an HTTPS URL). Both are
+// persisted verbatim so the reader must accept both.
+const authorizationCodeRecordSchema = z.object({
+    clientId: z.string().min(1),
+    userId: z.string(),
+    expiresAt: isoTimestampSchema,
+    scopes: z.array(z.string()),
+    resource: z.string().optional(),
+    codeChallenge: z.string(),
+    redirectUri: z.string(),
+    state: z.string().optional(),
+    grantId: uuidSchema.optional(),
+}).strict();
+const tokenRecordSchema = z.object({
+    clientId: z.string().min(1),
+    userId: z.string().optional(),
+    expiresAt: isoTimestampSchema,
+    scopes: z.array(z.string()),
+    resource: z.string().optional(),
+    grantId: uuidSchema.optional(),
+}).strict();
+const clientIdMetadataDocumentRecordSchema = z.object({
+    client: cimdClientRecordSchema,
+    expiresAt: isoTimestampSchema,
+}).strict();
+function hashSecret(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function isExpired(expiresAtIso) {
+    return new Date(expiresAtIso).getTime() <= Date.now();
+}
+async function writeRecord(filePath, record) {
+    await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    const temporary = `${filePath}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await rename(temporary, filePath);
+}
+/**
+ * Read one record file. A missing file is undefined; a malformed file fails
+ * closed (undefined) and is swept so it cannot linger. Read errors other than
+ * ENOENT propagate: the caller's fail-closed wrapper turns them into a
+ * rejection, never into an anonymous success.
+ */
+async function readRecord(filePath, schema) {
+    let contents;
+    try {
+        contents = await readFile(filePath, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    try {
+        return schema.parse(JSON.parse(contents));
+    }
+    catch {
+        await unlink(filePath).catch(() => { });
+        return undefined;
+    }
+}
+async function removeRecord(filePath) {
+    await unlink(filePath).catch((error) => {
+        if (error.code !== 'ENOENT')
+            throw error;
+    });
+}
+export class FileOAuthServerModel {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    clientFile(clientId) {
+        return path.join(this.root, 'clients', `${clientId}.json`);
+    }
+    codeFile(authorizationCode) {
+        return path.join(this.root, 'codes', `${hashSecret(authorizationCode)}.json`);
+    }
+    accessTokenFile(accessToken) {
+        return path.join(this.root, 'access', `${hashSecret(accessToken)}.json`);
+    }
+    refreshTokenFile(refreshToken) {
+        return path.join(this.root, 'refresh', `${hashSecret(refreshToken)}.json`);
+    }
+    cimdFile(clientId) {
+        return path.join(this.root, 'cimd', `${hashSecret(clientId)}.json`);
+    }
+    async getClient(clientId) {
+        // Validate before any filesystem use: client ids become path components.
+        if (!UUID_PATTERN.test(clientId))
+            return undefined;
+        const record = await readRecord(this.clientFile(clientId), clientRecordSchema);
+        return record;
+    }
+    async registerClient(client) {
+        if (!UUID_PATTERN.test(client.client_id))
+            throw new Error(`Invalid OAuth client id: ${client.client_id}`);
+        await writeRecord(this.clientFile(client.client_id), clientRecordSchema.parse(client));
+        return client;
+    }
+    async saveAuthorizationCode(code, _client) {
+        const record = {
+            clientId: code.clientId,
+            userId: code.userId,
+            expiresAt: code.expiresAt.toISOString(),
+            scopes: code.scopes ?? [],
+            codeChallenge: code.codeChallenge,
+            redirectUri: code.redirectUri,
+            ...(code.resource !== undefined ? { resource: code.resource } : {}),
+            ...(code.state !== undefined ? { state: code.state } : {}),
+            ...(code.grantId !== undefined ? { grantId: code.grantId } : {}),
+        };
+        await writeRecord(this.codeFile(code.authorizationCode), record);
+    }
+    /**
+     * Read + invalidate in one operation, scoped to the client. The rename is
+     * the atomic claim: when several requests present the same code only one
+     * rename succeeds, and the losers see ENOENT and return undefined. A request
+     * from the wrong client consumes nothing.
+     */
+    async consumeAuthorizationCode(authorizationCode, clientId) {
+        const record = await this.consumeRecord(this.codeFile(authorizationCode), clientId, authorizationCodeRecordSchema);
+        if (!record)
+            return undefined;
+        return {
+            authorizationCode,
+            clientId: record.clientId,
+            userId: record.userId,
+            expiresAt: new Date(record.expiresAt),
+            scopes: record.scopes,
+            codeChallenge: record.codeChallenge,
+            redirectUri: record.redirectUri,
+            ...(record.resource !== undefined ? { resource: record.resource } : {}),
+            ...(record.state !== undefined ? { state: record.state } : {}),
+            ...(record.grantId !== undefined ? { grantId: record.grantId } : {}),
+        };
+    }
+    async revokeAuthorizationCode(authorizationCode) {
+        await removeRecord(this.codeFile(authorizationCode));
+    }
+    async saveAccessToken(token, _client) {
+        await writeRecord(this.accessTokenFile(token.token), FileOAuthServerModel.tokenRecord(token));
+    }
+    async getAccessToken(accessToken) {
+        const record = await readRecord(this.accessTokenFile(accessToken), tokenRecordSchema);
+        if (!record)
+            return undefined;
+        if (isExpired(record.expiresAt)) {
+            await removeRecord(this.accessTokenFile(accessToken));
+            return undefined;
+        }
+        return FileOAuthServerModel.accessToken(record, accessToken);
+    }
+    /**
+     * Revoke only when the token was issued to the requesting client; never
+     * throw when nothing matches (RFC 7009 §2.2 answers 200 either way).
+     */
+    async revokeAccessToken(accessToken, clientId) {
+        return this.revokeTokenRecord(this.accessTokenFile(accessToken), accessToken, clientId);
+    }
+    async saveRefreshToken(token, _client) {
+        await writeRecord(this.refreshTokenFile(token.token), FileOAuthServerModel.tokenRecord(token));
+    }
+    async revokeRefreshToken(refreshToken, clientId) {
+        return this.revokeTokenRecord(this.refreshTokenFile(refreshToken), refreshToken, clientId);
+    }
+    /** Refresh tokens rotate on every use, so consume is atomic + client-scoped like the code consume. */
+    async consumeRefreshToken(refreshToken, clientId) {
+        const record = await this.consumeRecord(this.refreshTokenFile(refreshToken), clientId, tokenRecordSchema);
+        if (!record)
+            return undefined;
+        return FileOAuthServerModel.refreshToken(record, refreshToken);
+    }
+    /** Sweep every access and refresh token belonging to one authorization grant. */
+    async revokeGrant(grantId) {
+        if (!grantId)
+            return;
+        for (const directory of ['access', 'refresh']) {
+            const directoryPath = path.join(this.root, directory);
+            let entries;
+            try {
+                entries = await readdir(directoryPath);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                throw error;
+            }
+            for (const entry of entries) {
+                if (!entry.endsWith('.json'))
+                    continue;
+                const filePath = path.join(directoryPath, entry);
+                const record = await readRecord(filePath, tokenRecordSchema);
+                if (record?.grantId === grantId)
+                    await removeRecord(filePath);
+            }
+        }
+    }
+    async saveClientIdMetadataDocument(document) {
+        // The cache key is a client-supplied URL: hash it so it never becomes a
+        // path component.
+        const record = {
+            client: cimdClientRecordSchema.parse(document.client),
+            expiresAt: document.expiresAt.toISOString(),
+        };
+        await writeRecord(this.cimdFile(document.client.client_id), record);
+    }
+    async getClientIdMetadataDocument(clientId) {
+        const record = await readRecord(this.cimdFile(clientId), clientIdMetadataDocumentRecordSchema);
+        if (!record)
+            return undefined;
+        if (isExpired(record.expiresAt)) {
+            await removeRecord(this.cimdFile(clientId));
+            return undefined;
+        }
+        return { client: record.client, expiresAt: new Date(record.expiresAt) };
+    }
+    static tokenRecord(token) {
+        return {
+            clientId: token.clientId,
+            expiresAt: token.expiresAt.toISOString(),
+            scopes: token.scopes,
+            ...(token.userId !== undefined ? { userId: token.userId } : {}),
+            ...(token.resource !== undefined ? { resource: token.resource } : {}),
+            ...(token.grantId !== undefined ? { grantId: token.grantId } : {}),
+        };
+    }
+    static accessToken(record, token) {
+        return {
+            token,
+            clientId: record.clientId,
+            expiresAt: new Date(record.expiresAt),
+            scopes: record.scopes,
+            ...(record.userId !== undefined ? { userId: record.userId } : {}),
+            ...(record.resource !== undefined ? { resource: record.resource } : {}),
+            ...(record.grantId !== undefined ? { grantId: record.grantId } : {}),
+        };
+    }
+    static refreshToken(record, token) {
+        return FileOAuthServerModel.accessToken(record, token);
+    }
+    async consumeRecord(filePath, clientId, schema) {
+        const record = await readRecord(filePath, schema);
+        if (!record)
+            return undefined;
+        if (record.clientId !== clientId)
+            return undefined;
+        if (isExpired(record.expiresAt)) {
+            await removeRecord(filePath);
+            return undefined;
+        }
+        // Claim the record atomically before deleting it: the rename succeeds for
+        // exactly one caller even when several requests race the same credential.
+        const claimed = `${filePath}.consumed-${randomBytes(6).toString('hex')}`;
+        try {
+            await rename(filePath, claimed);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+        await removeRecord(claimed);
+        return record;
+    }
+    async revokeTokenRecord(filePath, token, clientId) {
+        const record = await readRecord(filePath, tokenRecordSchema);
+        if (!record || record.clientId !== clientId)
+            return undefined;
+        await removeRecord(filePath);
+        return FileOAuthServerModel.accessToken(record, token);
+    }
+}
+/** The file-backed OAuth server model rooted at <catalogHome>/oauth. */
+export function createFileOAuthServerModel(oauthRoot) {
+    return new FileOAuthServerModel(oauthRoot);
+}
+//# sourceMappingURL=model.js.map

package/dist/core/runtime/oauth/public-client.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Public-client normalization for OAuth client metadata.
+ *
+ * Some OAuth clients — OpenAI's ChatGPT/Codex connector is the known case —
+ * register (RFC 7591 DCR) or publish a client ID metadata document (CIMD)
+ * with `token_endpoint_auth_method: "private_key_jwt"`. Catence has no JWKS
+ * trust for client assertions, so it cannot honor that method; mcp-oauth-server
+ * rejects any method other than "none"/"client_secret_post" outright, which
+ * breaks those clients at registration or authorization time with
+ * `invalid_client: Unsupported token_endpoint_auth_method`.
+ *
+ * The fix is to treat such clients as what they are: public clients. No client
+ * secret is issued, redirect URIs are validated exactly as before, and PKCE
+ * with S256 stays enforced at the authorization and token endpoints — the same
+ * protection a public client gets with `"none"`. A `client_assertion` the
+ * client later sends at the token endpoint is ignored by the server's
+ * client-authentication step, which only reads `client_id`/`client_secret`.
+ */
+export declare const PRIVATE_KEY_JWT = "private_key_jwt";
+/**
+ * True when the metadata declares private_key_jwt client authentication.
+ */
+export declare function declaresPrivateKeyJwt(value: unknown): boolean;
+/**
+ * Return the metadata with private_key_jwt downgraded to "none" (public
+ * client). Anything else passes through unchanged.
+ */
+export declare function asPublicClientMetadata<T>(value: T): T;

package/dist/core/runtime/oauth/public-client.js

@@ -0,0 +1,35 @@
+/**
+ * Public-client normalization for OAuth client metadata.
+ *
+ * Some OAuth clients — OpenAI's ChatGPT/Codex connector is the known case —
+ * register (RFC 7591 DCR) or publish a client ID metadata document (CIMD)
+ * with `token_endpoint_auth_method: "private_key_jwt"`. Catence has no JWKS
+ * trust for client assertions, so it cannot honor that method; mcp-oauth-server
+ * rejects any method other than "none"/"client_secret_post" outright, which
+ * breaks those clients at registration or authorization time with
+ * `invalid_client: Unsupported token_endpoint_auth_method`.
+ *
+ * The fix is to treat such clients as what they are: public clients. No client
+ * secret is issued, redirect URIs are validated exactly as before, and PKCE
+ * with S256 stays enforced at the authorization and token endpoints — the same
+ * protection a public client gets with `"none"`. A `client_assertion` the
+ * client later sends at the token endpoint is ignored by the server's
+ * client-authentication step, which only reads `client_id`/`client_secret`.
+ */
+export const PRIVATE_KEY_JWT = 'private_key_jwt';
+/**
+ * True when the metadata declares private_key_jwt client authentication.
+ */
+export function declaresPrivateKeyJwt(value) {
+    return typeof value === 'object' && value !== null && value.token_endpoint_auth_method === PRIVATE_KEY_JWT;
+}
+/**
+ * Return the metadata with private_key_jwt downgraded to "none" (public
+ * client). Anything else passes through unchanged.
+ */
+export function asPublicClientMetadata(value) {
+    if (!declaresPrivateKeyJwt(value))
+        return value;
+    return { ...value, token_endpoint_auth_method: 'none' };
+}
+//# sourceMappingURL=public-client.js.map

package/dist/core/runtime/oauth/settings.d.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+declare const settingsSchema: z.ZodObject<{
+    formatVersion: z.ZodLiteral<1>;
+    enabled: z.ZodBoolean;
+    publicUrl: z.ZodString;
+}, z.core.$strict>;
+export type McpOauthSettings = z.infer<typeof settingsSchema>;
+export type McpOauthSettingsState = 'ok' | 'missing' | 'invalid';
+export type McpOauthSettingsRead = {
+    state: McpOauthSettingsState;
+    settings: McpOauthSettings | null;
+};
+export type McpOauthSettingsInput = {
+    enabled: boolean;
+    publicUrl?: string;
+};
+/**
+ * Validate the public URL: an absolute https URL with no query string or
+ * fragment (it becomes the advertised OAuth issuer), trailing slashes stripped.
+ * Mirrors the CLI's --public-url rule (cli-options.ts) at the write boundary.
+ */
+export declare function validateOauthPublicUrl(value: string): string;
+/** Validate and normalize a settings write; throws on invalid input (fail loud). */
+export declare function normalizeMcpOauthSettings(input: McpOauthSettingsInput): McpOauthSettings;
+/**
+ * The settings read for resolution, cached by file mtime so Console writes are
+ * picked up without a restart. A missing file is 'missing'; an unreadable or
+ * malformed one is 'invalid' and fails closed downstream.
+ */
+export declare function readMcpOauthSettings(settingsFile: string): McpOauthSettingsRead;
+/** Atomically write validated settings; the write is the only mutation. */
+export declare function writeMcpOauthSettings(settingsFile: string, input: McpOauthSettingsInput): Promise<McpOauthSettings>;
+export {};

package/dist/core/runtime/oauth/settings.js

@@ -0,0 +1,96 @@
+import { mkdir, rename, writeFile } from 'node:fs/promises';
+import { readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+/**
+ * Console-managed OAuth 2.1 exposure settings, stored at
+ * <catalogHome>/oauth/settings.json (directory 0700, file 0600, atomic
+ * tmp+rename writes, mirroring mcp-keys.ts).
+ *
+ * The file is the runtime override for the startup --oauth/--public-url
+ * (CATENCE_OAUTH_ENABLED/CATENCE_PUBLIC_URL) values: once a valid file exists
+ * it alone decides whether the OAuth 2.1 authorization server is enabled, so
+ * the Console can switch OAuth on and off without a restart. A malformed file
+ * fails closed (disabled) until the Console writes a valid one.
+ */
+const MCP_OAUTH_SETTINGS_FORMAT_VERSION = 1;
+const settingsSchema = z.object({
+    formatVersion: z.literal(MCP_OAUTH_SETTINGS_FORMAT_VERSION),
+    enabled: z.boolean(),
+    // Normalized at write time: absolute https URL, no query/fragment, trailing
+    // slashes stripped; empty when never set.
+    publicUrl: z.string().max(2048),
+}).strict()
+    // An enabled record without a public URL is semantically invalid (the URL is
+    // the advertised issuer); the read fails closed for it like any malformed file.
+    .refine((value) => !value.enabled || value.publicUrl.length > 0, { message: 'enabled requires a publicUrl' });
+/**
+ * Validate the public URL: an absolute https URL with no query string or
+ * fragment (it becomes the advertised OAuth issuer), trailing slashes stripped.
+ * Mirrors the CLI's --public-url rule (cli-options.ts) at the write boundary.
+ */
+export function validateOauthPublicUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('publicUrl must be a valid absolute URL.');
+    }
+    if (url.protocol !== 'https:')
+        throw new Error('publicUrl must use https: the OAuth issuer is advertised publicly.');
+    if (url.search || url.hash)
+        throw new Error('publicUrl must not contain a query string or fragment.');
+    return value.replace(/\/+$/, '');
+}
+/** Validate and normalize a settings write; throws on invalid input (fail loud). */
+export function normalizeMcpOauthSettings(input) {
+    const publicUrl = (input.publicUrl ?? '').trim();
+    if (input.enabled && !publicUrl) {
+        throw new Error('publicUrl is required when OAuth is enabled: the OAuth issuer is the public URL of this server.');
+    }
+    return {
+        formatVersion: MCP_OAUTH_SETTINGS_FORMAT_VERSION,
+        enabled: input.enabled,
+        publicUrl: publicUrl ? validateOauthPublicUrl(publicUrl) : '',
+    };
+}
+const settingsCache = new Map();
+/**
+ * The settings read for resolution, cached by file mtime so Console writes are
+ * picked up without a restart. A missing file is 'missing'; an unreadable or
+ * malformed one is 'invalid' and fails closed downstream.
+ */
+export function readMcpOauthSettings(settingsFile) {
+    let mtimeMs = 0;
+    try {
+        mtimeMs = statSync(settingsFile).mtimeMs;
+    }
+    catch {
+        const read = { state: 'missing', settings: null };
+        settingsCache.set(settingsFile, { mtimeMs: 0, read });
+        return read;
+    }
+    const cached = settingsCache.get(settingsFile);
+    if (cached && cached.mtimeMs === mtimeMs)
+        return cached.read;
+    let read;
+    try {
+        read = { state: 'ok', settings: settingsSchema.parse(JSON.parse(readFileSync(settingsFile, 'utf8'))) };
+    }
+    catch {
+        read = { state: 'invalid', settings: null };
+    }
+    settingsCache.set(settingsFile, { mtimeMs, read });
+    return read;
+}
+/** Atomically write validated settings; the write is the only mutation. */
+export async function writeMcpOauthSettings(settingsFile, input) {
+    const settings = normalizeMcpOauthSettings(input);
+    await mkdir(path.dirname(settingsFile), { recursive: true, mode: 0o700 });
+    const temporary = `${settingsFile}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(settings, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await rename(temporary, settingsFile);
+    return settings;
+}
+//# sourceMappingURL=settings.js.map

package/dist/core/runtime/secrets.d.ts

@@ -16,9 +16,24 @@ declare const secretSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type AthleteSecrets = z.infer<typeof secretSchema>;
 export type SecretProvider = keyof AthleteSecrets;
+/** Display labels for the Console credentials editor. */
+export declare const secretProviderLabels: Record<SecretProvider, string>;
+export type SecretFieldDescription = {
+    name: string;
+    configured: boolean;
+};
+export type SecretProviderDescription = {
+    id: SecretProvider;
+    label: string;
+    fields: SecretFieldDescription[];
+};
 export declare function providerSecretPath(paths: CatencePaths): string;
 export declare function readAthleteSecrets(paths: CatencePaths): Promise<AthleteSecrets>;
+/** Metadata only: which provider fields are configured. Values are never returned. */
+export declare function describeAthleteSecrets(paths: CatencePaths): Promise<SecretProviderDescription[]>;
 export declare function setAthleteSecret(paths: CatencePaths, provider: SecretProvider, field: string, value: string): Promise<void>;
+/** Remove one stored provider field; an already-absent field is a no-op. */
+export declare function deleteAthleteSecret(paths: CatencePaths, provider: SecretProvider, field: string): Promise<void>;
 /** Build only the provider environment needed by a selected athlete worker. */
 export declare function athleteProviderEnvironment(paths: CatencePaths, base?: NodeJS.ProcessEnv): Promise<NodeJS.ProcessEnv>;
 export {};

package/dist/core/runtime/secrets.js

@@ -12,6 +12,13 @@ const secretFields = {
     intervals: ['apiKey', 'athleteId'],
     strava: ['clientId', 'clientSecret'],
 };
+const secretProviderOrder = ['garmin', 'intervals', 'strava'];
+/** Display labels for the Console credentials editor. */
+export const secretProviderLabels = {
+    garmin: 'Garmin',
+    intervals: 'Intervals.icu',
+    strava: 'Strava',
+};
 export function providerSecretPath(paths) {
     return path.join(paths.secrets, 'providers.json');
 }
@@ -26,14 +33,17 @@ export async function readAthleteSecrets(paths) {
         throw new Error(`Invalid provider secrets at ${providerSecretPath(paths)}: ${message}`);
     }
 }
-export async function setAthleteSecret(paths, provider, field, value) {
-    if (!secretFields[provider].includes(field))
-        throw new Error(`${field} is not a supported ${provider} secret field.`);
-    if (!value.trim())
-        throw new Error('Secret values cannot be empty.');
-    await ensurePaths(paths);
+/** Metadata only: which provider fields are configured. Values are never returned. */
+export async function describeAthleteSecrets(paths) {
     const secrets = await readAthleteSecrets(paths);
-    const next = { ...secrets, [provider]: { ...(secrets[provider] ?? {}), [field]: value } };
+    return secretProviderOrder.map((provider) => ({
+        id: provider,
+        label: secretProviderLabels[provider],
+        fields: secretFields[provider].map((name) => ({ name, configured: name in (secrets[provider] ?? {}) })),
+    }));
+}
+async function writeAthleteSecrets(paths, next) {
+    await ensurePaths(paths);
     const { writeFile, rename } = await import('node:fs/promises');
     const destination = providerSecretPath(paths);
     const temporary = `${destination}.tmp`;
@@ -42,6 +52,37 @@ export async function setAthleteSecret(paths, provider, field, value) {
     await rename(temporary, destination);
     await chmod(destination, 0o600);
 }
+export async function setAthleteSecret(paths, provider, field, value) {
+    if (!secretFields[provider].includes(field))
+        throw new Error(`${field} is not a supported ${provider} secret field.`);
+    if (!value.trim())
+        throw new Error('Secret values cannot be empty.');
+    const secrets = await readAthleteSecrets(paths);
+    const next = { ...secrets, [provider]: { ...(secrets[provider] ?? {}), [field]: value } };
+    await writeAthleteSecrets(paths, next);
+}
+/** Remove one stored provider field; an already-absent field is a no-op. */
+export async function deleteAthleteSecret(paths, provider, field) {
+    if (!(provider in secretFields))
+        throw new Error(`${provider} is not a supported provider.`);
+    if (!secretFields[provider].includes(field))
+        throw new Error(`${field} is not a supported ${provider} secret field.`);
+    const secrets = await readAthleteSecrets(paths);
+    const existing = secrets[provider];
+    if (!existing || !(field in existing))
+        return;
+    const remaining = {};
+    for (const [name, value] of Object.entries(existing)) {
+        if (name !== field && typeof value === 'string')
+            remaining[name] = value;
+    }
+    const draft = Object.assign({}, secrets);
+    if (Object.keys(remaining).length === 0)
+        delete draft[provider];
+    else
+        draft[provider] = remaining;
+    await writeAthleteSecrets(paths, secretSchema.parse(draft));
+}
 function isTruthyEnvValue(value) {
     if (!value)
         return false;