catence 0.2.1-beta.22 → 0.2.1-beta.23

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.22";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.23";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.22';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.23';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/interfaces/http/server.js

@@ -36,6 +36,7 @@ function logRequestCompletion(request, response, pathname) {
     response.once('finish', () => {
         const status = response.statusCode;
         const interesting = pathname === '/mcp' ||
+            pathname === '/' ||
             pathname.startsWith('/oauth/') ||
             pathname.startsWith('/.well-known/oauth-') ||
             status >= 400;
@@ -51,7 +52,7 @@ function logRequestCompletion(request, response, pathname) {
         const mcpMethod = request.headers['mcp-method'];
         if (typeof mcpMethod === 'string' && mcpMethod)
             parts.push(`mcp-method=${mcpMethod}`);
-        if (pathname === '/mcp')
+        if (pathname === '/mcp' || pathname === '/')
             parts.push(`auth=${bearerTokenFrom(request) !== null ? 'bearer' : 'none'}`);
         console.log(parts.join(' '));
     });
@@ -696,8 +697,9 @@ export function createCatenceHttpServer(options = {}) {
                 // A hosted connector may probe server/discover before attaching the
                 // bearer token. The discovery result exposes nothing athlete-scoped,
                 // so that one probe is answered ahead of the 401; every other
-                // unauthenticated /mcp request stays behind the gate.
-                if (pathname === '/mcp' && request.method === 'POST' && await handleUnauthenticatedDiscovery(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths())) {
+                // unauthenticated MCP request stays behind the gate. The root alias
+                // mirrors /mcp here too so bare-domain connectors see the same gate.
+                if ((pathname === '/mcp' || pathname === '/') && request.method === 'POST' && await handleUnauthenticatedDiscovery(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths())) {
                     return;
                 }
                 // A presented-but-rejected token is a bearer problem, not an OAuth
@@ -1233,7 +1235,11 @@ export function createCatenceHttpServer(options = {}) {
                 }
                 return;
             }
-            if (pathname === '/mcp') {
+            // Hosted connectors probe the URL exactly as the operator typed it, and
+            // a bare-domain connector has no /mcp path to append. Root requests are
+            // served exactly like /mcp; the protected-resource metadata still
+            // advertises /mcp, so issued tokens keep their /mcp audience.
+            if (pathname === '/mcp' || pathname === '/') {
                 await handleMcpRequest(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths(), principal);
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.22",
+  "version": "0.2.1-beta.23",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {