catence 0.2.1-beta.22 → 0.2.1-beta.24

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.22";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.24";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.22';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.24';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/interfaces/http/server.js

@@ -36,6 +36,7 @@ function logRequestCompletion(request, response, pathname) {
     response.once('finish', () => {
         const status = response.statusCode;
         const interesting = pathname === '/mcp' ||
+            pathname === '/' ||
             pathname.startsWith('/oauth/') ||
             pathname.startsWith('/.well-known/oauth-') ||
             status >= 400;
@@ -51,7 +52,7 @@ function logRequestCompletion(request, response, pathname) {
         const mcpMethod = request.headers['mcp-method'];
         if (typeof mcpMethod === 'string' && mcpMethod)
             parts.push(`mcp-method=${mcpMethod}`);
-        if (pathname === '/mcp')
+        if (pathname === '/mcp' || pathname === '/')
             parts.push(`auth=${bearerTokenFrom(request) !== null ? 'bearer' : 'none'}`);
         console.log(parts.join(' '));
     });
@@ -518,6 +519,141 @@ async function handleUnauthenticatedDiscovery(request, response, paths) {
     await writeDiscoveryResult(response, paths, { athleteIds: 'all' }, jsonRpc.id);
     return true;
 }
+/**
+ * The 2026-07-28 revision frames every completed result with `resultType` and
+ * requires caching hints on cacheable operations (server/discover, tools/list,
+ * prompts/list, resources/list, resources/templates/list, resources/read).
+ * The bundled SDK emits the legacy shape, so responses negotiated under a
+ * dated 2026 revision are rewritten on the way out. List results vary with the
+ * caller's scope, so cacheable responses from this server are always
+ * `private`. Errors and notifications carry no result and pass through.
+ */
+const MODERN_CACHEABLE_METHODS = new Set(['server/discover', 'tools/list', 'prompts/list', 'resources/list', 'resources/templates/list', 'resources/read']);
+const MODERN_RESULT_TTL_MS = 300_000;
+/** Rewrite one JSON-RPC payload; null when it carries nothing to change. */
+function frameModernRpcPayload(payload, method) {
+    let envelope;
+    try {
+        envelope = JSON.parse(payload);
+    }
+    catch {
+        return null;
+    }
+    if (typeof envelope !== 'object' || envelope === null || Array.isArray(envelope))
+        return null;
+    const record = envelope;
+    const result = record.result;
+    if (typeof result !== 'object' || result === null || Array.isArray(result))
+        return null;
+    const framed = { ...result };
+    let changed = false;
+    if (!('resultType' in framed)) {
+        framed.resultType = 'complete';
+        changed = true;
+    }
+    if (method !== undefined && MODERN_CACHEABLE_METHODS.has(method)) {
+        if (!('ttlMs' in framed)) {
+            framed.ttlMs = MODERN_RESULT_TTL_MS;
+            changed = true;
+        }
+        if (!('cacheScope' in framed)) {
+            framed.cacheScope = 'private';
+            changed = true;
+        }
+    }
+    return changed ? JSON.stringify({ ...record, result: framed }) : null;
+}
+/** Rewrite a whole response body (SSE event stream or plain JSON). */
+function frameModernResponseBody(body, contentType, method) {
+    // The adapter hands headers straight to writeHead without caching them, so
+    // the content type may be unreadable here; the body shape is a reliable
+    // fallback (SSE payloads carry `data:` lines, JSON payloads open with `{`).
+    const isEventStream = (contentType !== undefined && contentType.includes('text/event-stream')) ||
+        body.startsWith('event:') ||
+        body.startsWith('data:') ||
+        body.includes('\ndata:');
+    if (isEventStream) {
+        let changed = false;
+        const lines = body.split('\n').map((line) => {
+            if (!line.startsWith('data:'))
+                return line;
+            const framed = frameModernRpcPayload(line.slice('data:'.length).trim(), method);
+            if (framed === null)
+                return line;
+            changed = true;
+            return `data: ${framed}`;
+        });
+        return changed ? lines.join('\n') : null;
+    }
+    if ((contentType !== undefined && contentType.includes('application/json')) || body.trimStart().startsWith('{')) {
+        return frameModernRpcPayload(body, method);
+    }
+    return null;
+}
+/**
+ * Buffer the outgoing body so the modern framing is in place before any byte
+ * reaches the socket; bodies that need no rewriting are forwarded verbatim.
+ * The Node adapter may flush headers early for streamed (chunked) responses,
+ * which stays valid because rewritten bodies only ever drop `content-length`
+ * (SSE responses never carry one to begin with).
+ */
+function installModernFraming(response, method) {
+    const chunks = [];
+    const append = (chunk, encoding) => {
+        if (typeof chunk === 'string')
+            chunks.push(Buffer.from(chunk, typeof encoding === 'string' ? encoding : 'utf8'));
+        else if (Buffer.isBuffer(chunk))
+            chunks.push(chunk);
+        else if (chunk instanceof Uint8Array)
+            chunks.push(Buffer.from(chunk));
+        else if (chunk !== undefined && chunk !== null)
+            chunks.push(Buffer.from(String(chunk)));
+    };
+    const originalEnd = response.end.bind(response);
+    const originalWriteHead = response.writeHead.bind(response);
+    // Headers handed straight to writeHead are not cached for getHeader and may
+    // reach the socket immediately, so a computed content-length is dropped
+    // here before any byte leaves the process: the framed body differs in size
+    // and chunked framing is always valid for these responses. (`removeHeader`
+    // is not an option at end time — by then the headers are already sent.)
+    const withoutLength = (value) => {
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            return value;
+        const copy = {};
+        for (const [key, headerValue] of Object.entries(value)) {
+            if (key.toLowerCase() !== 'content-length')
+                copy[key] = headerValue;
+        }
+        return copy;
+    };
+    response.writeHead = ((statusCode, arg1, arg2) => {
+        if (typeof arg1 === 'string')
+            return originalWriteHead(statusCode, arg1, withoutLength(arg2));
+        return originalWriteHead(statusCode, withoutLength(arg1));
+    });
+    response.write = ((chunk, encodingOrCallback) => {
+        append(chunk, encodingOrCallback);
+        if (typeof encodingOrCallback === 'function')
+            queueMicrotask(encodingOrCallback);
+        return true;
+    });
+    response.end = ((chunk, encodingOrCallback, callback) => {
+        if (response.writableEnded)
+            return response;
+        append(chunk, encodingOrCallback);
+        const done = typeof encodingOrCallback === 'function' ? encodingOrCallback : typeof callback === 'function' ? callback : undefined;
+        const raw = Buffer.concat(chunks);
+        const header = response.getHeader('content-type');
+        const contentType = Array.isArray(header) ? header.join(', ') : header === undefined ? undefined : String(header);
+        const framed = frameModernResponseBody(raw.toString('utf8'), contentType, method);
+        const final = framed === null ? raw : Buffer.from(framed, 'utf8');
+        if (done)
+            originalEnd(final, done);
+        else
+            originalEnd(final);
+        return response;
+    });
+}
 async function handleMcpRequest(request, response, paths, principal) {
     if (request.method !== 'POST') {
         methodNotAllowed(response);
@@ -531,7 +667,8 @@ async function handleMcpRequest(request, response, paths, principal) {
     // the web-standard headers from rawHeaders (not the parsed headers object),
     // so both views are rewritten.
     const requestedVersion = request.headers['mcp-protocol-version'];
-    if (typeof requestedVersion === 'string' && /^2026-\d{2}-\d{2}$/.test(requestedVersion)) {
+    const modernRequest = typeof requestedVersion === 'string' && /^2026-\d{2}-\d{2}$/.test(requestedVersion);
+    if (modernRequest) {
         request.headers['mcp-protocol-version'] = LATEST_PROTOCOL_VERSION;
         const rawHeaders = request.rawHeaders;
         for (let index = 0; index < rawHeaders.length; index += 2) {
@@ -558,6 +695,10 @@ async function handleMcpRequest(request, response, paths, principal) {
         await writeDiscoveryResult(response, paths, { athleteIds: principal.athleteIds }, jsonRpc.id);
         return;
     }
+    // A dated 2026 revision expects the SDK's legacy result shape reframed with
+    // `resultType`/caching fields before it leaves the process.
+    if (modernRequest)
+        installModernFraming(response, jsonRpc?.method);
     // The HTTP gate has already authenticated this request; the MCP server
     // re-enforces the principal's athlete scope on every tool and roster.
     const server = createCatenceMcpServer(paths, {}, { scope: { athleteIds: principal.athleteIds } });
@@ -696,8 +837,9 @@ export function createCatenceHttpServer(options = {}) {
                 // A hosted connector may probe server/discover before attaching the
                 // bearer token. The discovery result exposes nothing athlete-scoped,
                 // so that one probe is answered ahead of the 401; every other
-                // unauthenticated /mcp request stays behind the gate.
-                if (pathname === '/mcp' && request.method === 'POST' && await handleUnauthenticatedDiscovery(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths())) {
+                // unauthenticated MCP request stays behind the gate. The root alias
+                // mirrors /mcp here too so bare-domain connectors see the same gate.
+                if ((pathname === '/mcp' || pathname === '/') && request.method === 'POST' && await handleUnauthenticatedDiscovery(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths())) {
                     return;
                 }
                 // A presented-but-rejected token is a bearer problem, not an OAuth
@@ -1233,7 +1375,11 @@ export function createCatenceHttpServer(options = {}) {
                 }
                 return;
             }
-            if (pathname === '/mcp') {
+            // Hosted connectors probe the URL exactly as the operator typed it, and
+            // a bare-domain connector has no /mcp path to append. Root requests are
+            // served exactly like /mcp; the protected-resource metadata still
+            // advertises /mcp, so issued tokens keep their /mcp audience.
+            if (pathname === '/mcp' || pathname === '/') {
                 await handleMcpRequest(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths(), principal);
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.22",
+  "version": "0.2.1-beta.24",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {