catence 0.2.1-beta.23 → 0.2.1-beta.25

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.23";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.25";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.23';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.25';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/interfaces/http/oauth.js

@@ -109,6 +109,11 @@ export async function createOAuthApp(options) {
     app.get('/.well-known/oauth-authorization-server', serveMetadata(oauthMetadata));
     app.get('/.well-known/oauth-protected-resource', serveMetadata(protectedResourceMetadata));
     app.get('/.well-known/oauth-protected-resource/mcp', serveMetadata(protectedResourceMetadata));
+    // The connector platform probes OIDC-style discovery on every validation
+    // pass (observed hitting the auth gate as a 401 right after fetching the
+    // RFC 8414 document); answer it publicly with the same metadata.
+    app.get('/.well-known/openid-configuration', serveMetadata(oauthMetadata));
+    app.get('/.well-known/openid-configuration/mcp', serveMetadata(oauthMetadata));
     // DCR runs through the library's router, whose own express.json() would
     // re-parse (and reject) an already-consumed stream; parsing here first
     // leaves the sanitized body in place for it.

package/dist/interfaces/http/server.js

@@ -33,6 +33,9 @@ function logRequestCompletion(request, response, pathname) {
     if (process.env.CATENCE_HTTP_ACCESS_LOG === '0')
         return;
     const startedAt = Date.now();
+    // Captured before the compatibility bridge rewrites the header so the log
+    // always shows the value the client actually sent.
+    const rawProtocolVersion = request.headers['mcp-protocol-version'];
     response.once('finish', () => {
         const status = response.statusCode;
         const interesting = pathname === '/mcp' ||
@@ -46,7 +49,7 @@ function logRequestCompletion(request, response, pathname) {
         const userAgent = request.headers['user-agent'];
         if (typeof userAgent === 'string' && userAgent)
             parts.push(`ua="${userAgent.slice(0, 120)}"`);
-        const protocolVersion = request.headers['mcp-protocol-version'];
+        const protocolVersion = rawProtocolVersion;
         if (typeof protocolVersion === 'string' && protocolVersion)
             parts.push(`mcp-protocol-version=${protocolVersion}`);
         const mcpMethod = request.headers['mcp-method'];
@@ -519,6 +522,164 @@ async function handleUnauthenticatedDiscovery(request, response, paths) {
     await writeDiscoveryResult(response, paths, { athleteIds: 'all' }, jsonRpc.id);
     return true;
 }
+/**
+ * The 2026-07-28 revision frames every completed result with `resultType` and
+ * requires caching hints on cacheable operations (server/discover, tools/list,
+ * prompts/list, resources/list, resources/templates/list, resources/read).
+ * The bundled SDK emits the legacy shape, so responses negotiated under a
+ * dated 2026 revision are rewritten on the way out. List results vary with the
+ * caller's scope, so cacheable responses from this server are always
+ * `private`. Every result also repeats the server identity in `_meta`, and
+ * tool definitions drop the SDK's `execution` field — neither the per-result
+ * `_meta.serverInfo` nor `execution` appeared in the revision's schemas for
+ * earlier SDKs, but the revision asks for the former and omits the latter.
+ * Errors and notifications carry no result and pass through.
+ */
+const MODERN_CACHEABLE_METHODS = new Set(['server/discover', 'tools/list', 'prompts/list', 'resources/list', 'resources/templates/list', 'resources/read']);
+const MODERN_RESULT_TTL_MS = 300_000;
+/** Rewrite one JSON-RPC payload; null when it carries nothing to change. */
+function frameModernRpcPayload(payload, method) {
+    let envelope;
+    try {
+        envelope = JSON.parse(payload);
+    }
+    catch {
+        return null;
+    }
+    if (typeof envelope !== 'object' || envelope === null || Array.isArray(envelope))
+        return null;
+    const record = envelope;
+    const result = record.result;
+    if (typeof result !== 'object' || result === null || Array.isArray(result))
+        return null;
+    const framed = { ...result };
+    let changed = false;
+    if (!('resultType' in framed)) {
+        framed.resultType = 'complete';
+        changed = true;
+    }
+    if (!('_meta' in framed)) {
+        framed._meta = { 'io.modelcontextprotocol/serverInfo': CATENCE_MCP_SERVER_INFO };
+        changed = true;
+    }
+    if (method === 'tools/list' && Array.isArray(framed.tools)) {
+        let stripped = false;
+        const tools = framed.tools.map((tool) => {
+            if (typeof tool !== 'object' || tool === null || Array.isArray(tool) || !('execution' in tool))
+                return tool;
+            const copy = { ...tool };
+            delete copy.execution;
+            stripped = true;
+            return copy;
+        });
+        if (stripped) {
+            framed.tools = tools;
+            changed = true;
+        }
+    }
+    if (method !== undefined && MODERN_CACHEABLE_METHODS.has(method)) {
+        if (!('ttlMs' in framed)) {
+            framed.ttlMs = MODERN_RESULT_TTL_MS;
+            changed = true;
+        }
+        if (!('cacheScope' in framed)) {
+            framed.cacheScope = 'private';
+            changed = true;
+        }
+    }
+    return changed ? JSON.stringify({ ...record, result: framed }) : null;
+}
+/** Rewrite a whole response body (SSE event stream or plain JSON). */
+function frameModernResponseBody(body, contentType, method) {
+    // The adapter hands headers straight to writeHead without caching them, so
+    // the content type may be unreadable here; the body shape is a reliable
+    // fallback (SSE payloads carry `data:` lines, JSON payloads open with `{`).
+    const isEventStream = (contentType !== undefined && contentType.includes('text/event-stream')) ||
+        body.startsWith('event:') ||
+        body.startsWith('data:') ||
+        body.includes('\ndata:');
+    if (isEventStream) {
+        let changed = false;
+        const lines = body.split('\n').map((line) => {
+            if (!line.startsWith('data:'))
+                return line;
+            const framed = frameModernRpcPayload(line.slice('data:'.length).trim(), method);
+            if (framed === null)
+                return line;
+            changed = true;
+            return `data: ${framed}`;
+        });
+        return changed ? lines.join('\n') : null;
+    }
+    if ((contentType !== undefined && contentType.includes('application/json')) || body.trimStart().startsWith('{')) {
+        return frameModernRpcPayload(body, method);
+    }
+    return null;
+}
+/**
+ * Buffer the outgoing body so the modern framing is in place before any byte
+ * reaches the socket; bodies that need no rewriting are forwarded verbatim.
+ * The Node adapter may flush headers early for streamed (chunked) responses,
+ * which stays valid because rewritten bodies only ever drop `content-length`
+ * (SSE responses never carry one to begin with).
+ */
+function installModernFraming(response, method) {
+    const chunks = [];
+    const append = (chunk, encoding) => {
+        if (typeof chunk === 'string')
+            chunks.push(Buffer.from(chunk, typeof encoding === 'string' ? encoding : 'utf8'));
+        else if (Buffer.isBuffer(chunk))
+            chunks.push(chunk);
+        else if (chunk instanceof Uint8Array)
+            chunks.push(Buffer.from(chunk));
+        else if (chunk !== undefined && chunk !== null)
+            chunks.push(Buffer.from(String(chunk)));
+    };
+    const originalEnd = response.end.bind(response);
+    const originalWriteHead = response.writeHead.bind(response);
+    // Headers handed straight to writeHead are not cached for getHeader and may
+    // reach the socket immediately, so a computed content-length is dropped
+    // here before any byte leaves the process: the framed body differs in size
+    // and chunked framing is always valid for these responses. (`removeHeader`
+    // is not an option at end time — by then the headers are already sent.)
+    const withoutLength = (value) => {
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            return value;
+        const copy = {};
+        for (const [key, headerValue] of Object.entries(value)) {
+            if (key.toLowerCase() !== 'content-length')
+                copy[key] = headerValue;
+        }
+        return copy;
+    };
+    response.writeHead = ((statusCode, arg1, arg2) => {
+        if (typeof arg1 === 'string')
+            return originalWriteHead(statusCode, arg1, withoutLength(arg2));
+        return originalWriteHead(statusCode, withoutLength(arg1));
+    });
+    response.write = ((chunk, encodingOrCallback) => {
+        append(chunk, encodingOrCallback);
+        if (typeof encodingOrCallback === 'function')
+            queueMicrotask(encodingOrCallback);
+        return true;
+    });
+    response.end = ((chunk, encodingOrCallback, callback) => {
+        if (response.writableEnded)
+            return response;
+        append(chunk, encodingOrCallback);
+        const done = typeof encodingOrCallback === 'function' ? encodingOrCallback : typeof callback === 'function' ? callback : undefined;
+        const raw = Buffer.concat(chunks);
+        const header = response.getHeader('content-type');
+        const contentType = Array.isArray(header) ? header.join(', ') : header === undefined ? undefined : String(header);
+        const framed = frameModernResponseBody(raw.toString('utf8'), contentType, method);
+        const final = framed === null ? raw : Buffer.from(framed, 'utf8');
+        if (done)
+            originalEnd(final, done);
+        else
+            originalEnd(final);
+        return response;
+    });
+}
 async function handleMcpRequest(request, response, paths, principal) {
     if (request.method !== 'POST') {
         methodNotAllowed(response);
@@ -532,7 +693,8 @@ async function handleMcpRequest(request, response, paths, principal) {
     // the web-standard headers from rawHeaders (not the parsed headers object),
     // so both views are rewritten.
     const requestedVersion = request.headers['mcp-protocol-version'];
-    if (typeof requestedVersion === 'string' && /^2026-\d{2}-\d{2}$/.test(requestedVersion)) {
+    const modernRequest = typeof requestedVersion === 'string' && /^2026-\d{2}-\d{2}$/.test(requestedVersion);
+    if (modernRequest) {
         request.headers['mcp-protocol-version'] = LATEST_PROTOCOL_VERSION;
         const rawHeaders = request.rawHeaders;
         for (let index = 0; index < rawHeaders.length; index += 2) {
@@ -559,6 +721,10 @@ async function handleMcpRequest(request, response, paths, principal) {
         await writeDiscoveryResult(response, paths, { athleteIds: principal.athleteIds }, jsonRpc.id);
         return;
     }
+    // A dated 2026 revision expects the SDK's legacy result shape reframed with
+    // `resultType`/caching fields before it leaves the process.
+    if (modernRequest)
+        installModernFraming(response, jsonRpc?.method);
     // The HTTP gate has already authenticated this request; the MCP server
     // re-enforces the principal's athlete scope on every tool and roster.
     const server = createCatenceMcpServer(paths, {}, { scope: { athleteIds: principal.athleteIds } });
@@ -670,7 +836,7 @@ export function createCatenceHttpServer(options = {}) {
             // The OAuth endpoints are the auth surface itself: they bypass the gate
             // and CORS entirely and are delegated to the Express sub-app. When OAuth
             // is effectively disabled they answer 404 — no metadata is advertised.
-            if (pathname.startsWith('/.well-known/oauth-') || pathname.startsWith('/oauth/')) {
+            if (pathname.startsWith('/.well-known/oauth-') || pathname.startsWith('/.well-known/openid-configuration') || pathname.startsWith('/oauth/')) {
                 const config = effectiveOauth();
                 if (config.enabled && config.publicUrl !== undefined) {
                     const handle = await getOauthApp(config.publicUrl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.23",
+  "version": "0.2.1-beta.25",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {