catence 0.2.1-beta.24 → 0.2.1-beta.26

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.24";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.26";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.24';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.26';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/interfaces/http/oauth.js

@@ -109,6 +109,11 @@ export async function createOAuthApp(options) {
     app.get('/.well-known/oauth-authorization-server', serveMetadata(oauthMetadata));
     app.get('/.well-known/oauth-protected-resource', serveMetadata(protectedResourceMetadata));
     app.get('/.well-known/oauth-protected-resource/mcp', serveMetadata(protectedResourceMetadata));
+    // The connector platform probes OIDC-style discovery on every validation
+    // pass (observed hitting the auth gate as a 401 right after fetching the
+    // RFC 8414 document); answer it publicly with the same metadata.
+    app.get('/.well-known/openid-configuration', serveMetadata(oauthMetadata));
+    app.get('/.well-known/openid-configuration/mcp', serveMetadata(oauthMetadata));
     // DCR runs through the library's router, whose own express.json() would
     // re-parse (and reject) an already-consumed stream; parsing here first
     // leaves the sanitized body in place for it.

package/dist/interfaces/http/server.js

@@ -33,6 +33,9 @@ function logRequestCompletion(request, response, pathname) {
     if (process.env.CATENCE_HTTP_ACCESS_LOG === '0')
         return;
     const startedAt = Date.now();
+    // Captured before the compatibility bridge rewrites the header so the log
+    // always shows the value the client actually sent.
+    const rawProtocolVersion = request.headers['mcp-protocol-version'];
     response.once('finish', () => {
         const status = response.statusCode;
         const interesting = pathname === '/mcp' ||
@@ -46,7 +49,7 @@ function logRequestCompletion(request, response, pathname) {
         const userAgent = request.headers['user-agent'];
         if (typeof userAgent === 'string' && userAgent)
             parts.push(`ua="${userAgent.slice(0, 120)}"`);
-        const protocolVersion = request.headers['mcp-protocol-version'];
+        const protocolVersion = rawProtocolVersion;
         if (typeof protocolVersion === 'string' && protocolVersion)
             parts.push(`mcp-protocol-version=${protocolVersion}`);
         const mcpMethod = request.headers['mcp-method'];
@@ -526,7 +529,11 @@ async function handleUnauthenticatedDiscovery(request, response, paths) {
  * The bundled SDK emits the legacy shape, so responses negotiated under a
  * dated 2026 revision are rewritten on the way out. List results vary with the
  * caller's scope, so cacheable responses from this server are always
- * `private`. Errors and notifications carry no result and pass through.
+ * `private`. Every result also repeats the server identity in `_meta`, and
+ * tool definitions drop the SDK's `execution` field — neither the per-result
+ * `_meta.serverInfo` nor `execution` appeared in the revision's schemas for
+ * earlier SDKs, but the revision asks for the former and omits the latter.
+ * Errors and notifications carry no result and pass through.
  */
 const MODERN_CACHEABLE_METHODS = new Set(['server/discover', 'tools/list', 'prompts/list', 'resources/list', 'resources/templates/list', 'resources/read']);
 const MODERN_RESULT_TTL_MS = 300_000;
@@ -551,6 +558,25 @@ function frameModernRpcPayload(payload, method) {
         framed.resultType = 'complete';
         changed = true;
     }
+    if (!('_meta' in framed)) {
+        framed._meta = { 'io.modelcontextprotocol/serverInfo': CATENCE_MCP_SERVER_INFO };
+        changed = true;
+    }
+    if (method === 'tools/list' && Array.isArray(framed.tools)) {
+        let stripped = false;
+        const tools = framed.tools.map((tool) => {
+            if (typeof tool !== 'object' || tool === null || Array.isArray(tool) || !('execution' in tool))
+                return tool;
+            const copy = { ...tool };
+            delete copy.execution;
+            stripped = true;
+            return copy;
+        });
+        if (stripped) {
+            framed.tools = tools;
+            changed = true;
+        }
+    }
     if (method !== undefined && MODERN_CACHEABLE_METHODS.has(method)) {
         if (!('ttlMs' in framed)) {
             framed.ttlMs = MODERN_RESULT_TTL_MS;
@@ -702,7 +728,11 @@ async function handleMcpRequest(request, response, paths, principal) {
     // The HTTP gate has already authenticated this request; the MCP server
     // re-enforces the principal's athlete scope on every tool and roster.
     const server = createCatenceMcpServer(paths, {}, { scope: { athleteIds: principal.athleteIds } });
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+    // JSON responses mirror OpenAI's own reference implementation: a single
+    // request/response has no need for a stream, and a JSON body survives
+    // validators (and intermediaries) that would mishandle an SSE frame. The
+    // spec requires clients to accept both, so this stays compatible.
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
     let cleanedUp = false;
     const cleanup = async () => {
         if (cleanedUp)
@@ -810,7 +840,7 @@ export function createCatenceHttpServer(options = {}) {
             // The OAuth endpoints are the auth surface itself: they bypass the gate
             // and CORS entirely and are delegated to the Express sub-app. When OAuth
             // is effectively disabled they answer 404 — no metadata is advertised.
-            if (pathname.startsWith('/.well-known/oauth-') || pathname.startsWith('/oauth/')) {
+            if (pathname.startsWith('/.well-known/oauth-') || pathname.startsWith('/.well-known/openid-configuration') || pathname.startsWith('/oauth/')) {
                 const config = effectiveOauth();
                 if (config.enabled && config.publicUrl !== undefined) {
                     const handle = await getOauthApp(config.publicUrl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.24",
+  "version": "0.2.1-beta.26",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {