matrix-workouts-core 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,70 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The version history source of truth is git tags in the format `vMAJOR.MINOR.PATCH`.
+
+## [0.1.0] - 2026-09-14
+
+First public release. Node 20+, ESM only, **zero runtime dependencies**.
+
+### Added
+
+- **`matrix-workouts-core`** — the platform-free entry point. Nothing reachable from
+  it touches a DOM, a `chrome.*`, a `node:` module or `fetch`, which is what lets one
+  parser serve a browser extension, a CLI and an MCP server without a fork. A test
+  asserts it per identifier; `tsconfig` omits the DOM lib so the compiler agrees.
+  - `toWorkout` normalizes either upstream shape — camelCase from the site's
+    `localStorage`, snake_case from the API — into a `Workout` whose field names carry
+    units. `loadCachedWorkouts` reads the browser's persisted blob through an injected
+    `ReadableStorage`.
+  - `findWorkout` accepts **either** id a record has. Rides recorded before
+    13 Aug 2026 carry a record id that differs from the id their own URL uses, so a
+    lookup that knows only one of them fails on half a history.
+  - `heartRateStats` and `flagHeartRateDropouts` filter chest-strap dropouts. The mask
+    is *validity*: `true` means the reading is real.
+  - `programMode` names the console program behind a numeric `programType`;
+    `controlSignature` derives what the console was actually holding constant from the
+    series, which is the more trustworthy of the two.
+  - `fetchWorkoutHistory` over an injected `FetchLike` — the client never calls
+    `fetch` itself. `loginWithXid` exchanges an xid and passcode for credentials and
+    returns nothing else; `readCredentials` borrows a session the browser already has.
+  - `workoutExport` builds the export document, carrying the upstream record verbatim
+    alongside the normalized telemetry so the file is never a worse record of the ride
+    than the browser already had.
+- **`matrix-workouts-core/node`** — the one place real `fetch` and real files are
+  used, behind its own entry point so a browser bundle cannot reach `node:fs` through
+  the root import. `httpFetch`, `downloadHistory`, `readRawHistoryFile`, `loadEnvFile`.
+  Downloads are written `0600`; they are one person's heart rate.
+- **`matrix-workouts-history`** — a CLI that signs in and downloads an entire history,
+  optionally one export document per ride. The only thing here that handles a passcode.
+- `parseHistoryResponse`, so a response read back from a cache file gets the same
+  tolerance as one read off the wire: the same accepted shapes, the same per-record
+  failure isolation, the same truncation check.
+
+### Notes
+
+- **Scope is the indoor bike**, upright and recumbent, which is what the fixtures
+  cover and what this is verified against. Treadmill and rower records parse, but
+  nothing here is tuned for them and no fixture backs them.
+- **Both heart-rate averages are preserved**, never reconciled. The platform's summary
+  is not derived from the sample series and does not always agree with it; on a ride
+  with independent Apple Watch ground truth the console's 153 bpm was exactly right
+  while the filtered series gave 151. On a glitching strap *theirs* is the better
+  number, so both are carried and a consumer decides.
+- **Paging is deliberately not followed.** The workouts endpoint has returned every
+  record in one response on every account seen; inventing page parameters against an
+  undocumented API is a good way to silently truncate someone's history. A
+  `paging.total` larger than what arrived surfaces as `truncated` instead.
+- **The export format identifier stays `full-matrix-workouts/workout`.** It names the
+  repository this code came from, which no longer exists under that name — and it is
+  not going to be renamed. It is an opaque identifier in files already written to
+  people's disks, and changing it would orphan every one of them for the sake of
+  tidiness. `src/export/contract.test.ts` pins it.
+
+### Provenance
+
+Extracted from the `full-matrix-workouts` Chrome extension, now
+[matrix-workouts-chrome](https://github.com/bestimmaa/matrix-workouts-chrome), which
+consumes this package instead of its own copy. The extension's rendering is unchanged
+across the move: every fixture's preview output is byte-identical.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Christoph Halang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/MATRIX_API.md

@@ -0,0 +1,245 @@
+# MATRIX_API.md — the jfit HTTP API
+
+Reference for the undocumented API behind `matrixworkouts.jfit.co` (Matrix / Johnson
+Fitness). Written while building the standalone client in `src/cli/history.ts`.
+
+**Everything here was read out of the site's own JavaScript bundle or confirmed
+against the live API on 14 Sep 2026.** Each endpoint below is marked *verified* (a
+request was actually made and the response observed) or *from the bundle* (the call
+site was read, but never exercised). Do not promote the second kind to the first by
+assuming — this API is undocumented, unversioned, and **its record shape has already
+changed at least once** (see AGENTS.md, "The upstream shape has changed").
+
+---
+
+## Hosts
+
+| Host | Use |
+|---|---|
+| `https://apollo.jfit.co` | **The one that works.** Sign-in and workout history. |
+| `https://orion.jfit.co` | Configured in the bundle as `exerciserApi`, answers **403**. Do not use. |
+
+The bundle sets both up in one function:
+
+```js
+e.apolloBackend.setup({ baseUrl: `https://apollo.jfit.co` });
+e.exerciserApi.setup({ baseUrl: `https://orion.jfit.co` });
+```
+
+The Apollo client is created with `headers: { Accept: "application/json" }` and no
+authentication of its own; the bearer token is attached per request.
+
+---
+
+## Authentication
+
+Two independent token systems appear in the bundle. Only the first matters here.
+
+**Apollo (what we use).** `POST /exerciser/login` returns a profile with a `token`
+field. Send it as `Authorization: Bearer <token>` on subsequent requests.
+
+**Orion `jumpToken`.** A separate async request transform attaches
+`Bearer ${token.accessToken}` from `authStore.jumpToken`. Irrelevant while Orion
+answers 403.
+
+Inside the browser there is no need to sign in at all: the site leaves the token in
+the redux-persist blob at `userStore.exerciserProfile.token`, which is what
+`readCredentials` (`src/api/credentials.ts`) reads. **Prefer that.** It handles no
+passcode, needs no network, and cannot be rate-limited. Signing in with an xid is
+only for the standalone client, which has no browser session to borrow.
+
+---
+
+## `POST /exerciser/login` — *verified*
+
+Exchange a member number (xid) and numeric passcode for a bearer token.
+
+The request shape is not guessed; it is the site's own, from the bundle:
+
+```js
+async loginWithXid(e, t, n = `xid`, r = 0) {
+  let i = { username: e, password: t, type: n, club_id: r };
+  return apisauce.post(`/exerciser/login`, i);
+}
+```
+
+**Request** — `Content-Type: application/json`
+
+| Field | Value |
+|---|---|
+| `username` | the xid (member number). **Not** an email. |
+| `password` | the numeric passcode |
+| `type` | `"xid"`. The bundle's other value is `"apollo"`, used by `loginWithNpUUID` for SSO with an empty password. |
+| `club_id` | `0` in every call the site makes |
+
+**Response** `200` — a flat profile object:
+
+```
+first_name  last_name  email  units  gender  height  weight
+birthday  age  pictureUrl  aliases  identities  id  token
+```
+
+Only two fields matter: **`id`** is the exerciser id for the workouts path, and
+**`token`** is the bearer token. `src/api/login.ts` deliberately returns only those
+two — the rest is PII that no later call needs.
+
+A wrong xid or passcode answers `401`.
+
+> **Rate limiting is unmeasured.** Nothing in the bundle suggests a lockout, and none
+> was hit in testing, but that is not evidence of absence. Do not loop this endpoint.
+
+---
+
+## `GET /exerciser/{id}/workouts` — *verified*
+
+**The whole point.** Returns complete workout records *including every interval* —
+one request gets the entire history.
+
+**Request** — `Authorization: Bearer <token>`, `Accept: application/json`
+
+The site always sends a date window:
+
+```js
+apisauce.get(`/exerciser/${e}/workouts`, {
+  startdate: Math.floor(t.getTime() / 1e3),   // unix seconds
+  enddate:   Math.floor(n.getTime() / 1e3),
+});
+```
+
+**Omitting both returns the full history**, which is what this project does. Confirmed
+live: 47 records spanning 2026-01-10 to 2026-09-13 in a single 1.8 MB response.
+
+**Response** `200` — `{ workouts, messages, paging }`
+
+```json
+{ "paging": { "returned": 47, "total": 47, "page": 1 } }
+```
+
+`paging` has come back complete (`returned === total`) on every account seen.
+**Paging is deliberately not followed** — inventing page parameters against an
+undocumented API is a good way to silently truncate someone's history — so a `total`
+larger than what arrived surfaces as `truncated` instead. See `src/api/client.ts`.
+
+### Record fields
+
+Both spellings, because both occur: the API sends the left column, the browser's
+persisted blob sends the right. This table is the single reference for the upstream
+shape — AGENTS.md carries what the fields *mean* and which of them lie, not what they
+are called.
+
+| API (snake_case) | Cache (camelCase) | Notes |
+|---|---|---|
+| `workout_id` | `workoutId` | names the ride. **Not** the URL segment |
+| `id` | `id` | document id, and the `/workouts/:id` segment the site links to |
+| `model_id` | `modelId` | the machine **model** — not the individual unit |
+| `machine_id` | `machineId` | UUID of the physical machine |
+| `machine_type` / `exercise_title` | `machineType` / `exerciseTitle` | `upright_bike`, `treadmill`, `rower`, … |
+| `workout_type` | `workoutType` | `cardio` |
+| `workout_source` | `workoutSource` | `connected` = machine-recorded |
+| `workout_time` | `workoutTime` | ISO 8601, **UTC** |
+| `duration` | `duration` | **seconds** |
+| `distance` | `distance` | **meters** (the UI renders km) |
+| `calories` | `calories` | kcal |
+| `min/max/average_heart_rate` | `min/max/averageHeartRate` | bpm |
+| `program_type` | `programType` | integer console program id (e.g. `46`) |
+| `program_id` | — | API only; all-zero UUID on every ride seen |
+| `program_level` | — | API only |
+| `watts_kg` | `wattsKg` | often `0` |
+| `workout_originator` | — | API only; empty string on every ride seen |
+| `integration_metadata` | — | API only; `{}` on every ride seen |
+| `archived` | `archived` | `0` / `1` |
+| `intervals` | `intervals` | the sample array — see below |
+
+Cache-only extras, absent from the API: `functionThresholdPower`, `peakRpm`,
+`averageRpm`, `peakSpm`, `totalStrokes` (often `0`, several machine-type specific),
+and `totalSweatScore`, `sprintScores`, `sprint8ProgramLevel` on **Sprint 8 rides only**.
+
+**Field presence is not a promise.** `program_level` and `sprint8ProgramLevel` have
+already disappeared from records that still carry the Sprint 8 scores. Never assume a
+field is meaningful just because it is present and zero.
+
+### Interval fields — the reason this project exists
+
+Each entry in `intervals` is one ~10-second sample:
+
+| API | Cache | Unit | Notes |
+|---|---|---|---|
+| `power` | `power` | watts | **not in the stock UI** |
+| `resistance` | `resistance` | console level (1–30 observed) | **not in the stock UI** — discrete, moves in steps |
+| `rpm` | `rpm` | cadence | **not in the stock UI** |
+| `speed` | `speed` | km/h | |
+| `heart_rate` | `heartRate` | bpm | `0` on a chest-strap dropout |
+| `incline` | `incline` | % | treadmill-relevant; `0` on a bike |
+| `average_distance` | `averageDistance` | meters | **cumulative** distance, despite the name |
+| `distance` | `distance` | meters | per-sample delta |
+| `duration` | `duration` | seconds | `10` for every sample but the last, a partial (0–11) |
+| `total_steps` | `totalSteps` | count | populated on bikes too |
+
+Sample count × 10 s ≈ the record's `duration`.
+
+**`rpm`, `power` and `resistance` appear nowhere in the stock UI.** The stock detail
+page shows six tiles: distance, avg incline, avg heart rate, calories, duration, avg
+speed. That is the entire gap this project closes.
+
+---
+
+## Two shapes for the same data
+
+**The API returns `snake_case`; the browser's persisted blob returns `camelCase`** —
+including inside `intervals` (`average_distance` vs `averageDistance`).
+
+The API also carries four fields the cached blob does not: `program_id`,
+`program_level`, `workout_originator`, `integration_metadata`.
+
+That is the wire fact. The rule it implies for code in this repo — always go through
+`camelizeWorkout()`, never read raw keys — lives in AGENTS.md, which is where anyone
+writing against the parse layer will be looking.
+
+---
+
+## Endpoints that do not work
+
+| Endpoint | Result |
+|---|---|
+| `GET /workouts/{id}` | **404.** In the bundle, but dead. Fetch the list and filter. |
+| anything on `orion.jfit.co` | **403** |
+
+---
+
+## The rest of the surface — *from the bundle, unverified*
+
+Present in the JavaScript, never exercised. Listed so nobody has to re-read a 1.8 MB
+bundle to find them; **treat every shape here as unconfirmed.**
+
+| Endpoint | Bundle payload |
+|---|---|
+| `POST /exerciser/reset_password` | `{ xid }` |
+| `POST /exerciser/register` | the profile, `decamelizeKeys`'d |
+| `POST /exerciser/validate` | — |
+| `POST /exerciser/exchange_token_for_exerciser` | `{ token, vendor: "upace" }` |
+| `GET /exerciser` | — |
+| `PUT /exerciser/{id}` | profile update |
+| `POST /dapi/login`, `POST /dapi/addUser`, `POST /dapi/unlinkUser` | the "dapi" account system |
+| `POST /dapi/dapi-exchange` | `{ token }` |
+| `GET /dapi/user` | `{ user_id }`, headers `session` and `user-uuid` |
+| `GET /dapi/machine`, `GET /dapi/usermachine` | — |
+| `POST /brand/graphql` | branding/CMS |
+| `POST /wallet/pass` | Apple/Google wallet pass |
+
+`reset_password` and the `dapi` write endpoints change account state. **Do not probe
+them.**
+
+---
+
+## Using it
+
+From this repo:
+
+```bash
+cp .env.example .env    # fill in MATRIX_XID and MATRIX_PIN
+npm run history         # full history -> history/
+```
+
+See `src/cli/history.ts`. Credentials live in `.env` (gitignored), are used for the
+single sign-in request, and are never written to output or logged. The `history/`
+directory is gitignored: those files are the rider's resting heart rate.

package/README.md

@@ -0,0 +1,123 @@
+# matrix-workouts-core
+
+[![npm](https://img.shields.io/npm/v/matrix-workouts-core.svg)](https://www.npmjs.com/package/matrix-workouts-core)
+[![CI](https://github.com/bestimmaa/matrix-workouts-core/actions/workflows/ci.yml/badge.svg)](https://github.com/bestimmaa/matrix-workouts-core/actions/workflows/ci.yml)
+[![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+Read what a Matrix / Johnson Fitness exercise bike actually recorded.
+
+The dashboard at `matrixworkouts.jfit.co` shows six tiles per ride: distance, average
+incline, average heart rate, calories, duration, average speed. The record behind that
+page also carries **a sample every 10 seconds with power (watts), console resistance
+level and cadence (rpm)** — none of which appears anywhere in the site's UI. This
+package parses those records, talks to the API that holds the full history, and
+writes a lossless export document. Those three fields are why it exists.
+
+It has **no runtime dependencies** and touches no platform: no DOM, no `chrome.*`, no
+`node:`, no `fetch`. A test asserts that on every run. Node-only helpers live behind a
+separate entry point, so a browser bundle cannot pull them in by accident.
+
+## Install
+
+```bash
+npm install matrix-workouts-core
+```
+
+Node 20 or newer. ESM only.
+
+## Quickstart
+
+```ts
+import { toWorkout, heartRateStats, fetchWorkoutHistory } from "matrix-workouts-core";
+
+const workout = toWorkout(record);          // one raw record -> normalized model
+workout.samples[0]?.powerWatts;             // the thing the site never shows
+heartRateStats(workout.samples);            // dropout-filtered, with the count
+
+// The API needs a fetch; it never calls one itself.
+const { workouts, truncated, skipped } = await fetchWorkoutHistory(credentials, myFetch);
+```
+
+Under Node, the fetch adapter is already written:
+
+```ts
+import { httpFetch, downloadHistory } from "matrix-workouts-core/node";
+import { loginWithXid } from "matrix-workouts-core";
+
+const credentials = await loginWithXid({ xid, pin }, httpFetch);
+const result = await downloadHistory(credentials, { outDir: "history", split: true });
+```
+
+## Download a whole history
+
+The site's own list page holds roughly the current week and errors on anything older.
+The API has everything, so the package ships a CLI that signs in and takes the lot:
+
+```bash
+cp .env.example .env              # your xid and passcode
+npx matrix-workouts-history       # -> history/raw-history-<timestamp>.json
+npx matrix-workouts-history --split    # plus one export document per ride
+npx matrix-workouts-history --out data # somewhere other than history/
+```
+
+| Variable | Required | Meaning |
+|---|---|---|
+| `MATRIX_XID` | yes | the member number printed on the gym tag |
+| `MATRIX_PIN` | yes | the numeric passcode |
+
+Read from `.env` in the working directory or from the environment; the environment
+wins. Used for one sign-in request, never written to the output and never printed.
+
+## What it exports
+
+| Entry point | Holds |
+|---|---|
+| `matrix-workouts-core` | `toWorkout`, `loadCachedWorkouts`, `findWorkout`, `heartRateStats`, `flagHeartRateDropouts`, `controlSignature`, `programMode`, `fetchWorkoutHistory`, `loginWithXid`, `readCredentials`, `workoutExport`, and the `Workout` / `Sample` types |
+| `matrix-workouts-core/node` | `httpFetch`, `downloadHistory`, `readRawHistoryFile`, `loadEnvFile` — real fetch, real files |
+
+Units are in the names (`powerWatts`, `cadenceRpm`, `distanceMeters`), because the
+upstream names are ambiguous and one of them — `averageDistance`, which is cumulative
+— is actively misleading. Every record keeps its untouched original under `raw`, so an
+export is lossless even where this model has no name for a field.
+
+[MATRIX_API.md](MATRIX_API.md) documents the upstream API: endpoints, wire shapes,
+units, and which parts are verified rather than read out of the site's bundle.
+
+## Privacy and scope
+
+**Scope: indoor bikes** — upright and recumbent. Treadmill and rower records parse,
+but nothing here is tuned for them.
+
+This library reads one account's own data and sends it nowhere except the API it came
+from. The CLI handles a passcode for exactly one sign-in request and never stores,
+logs or prints it; downloads are written `0600` because they are the rider's heart
+rate. Where you point `--out` is where that data lives — choose accordingly.
+
+## Development
+
+```bash
+npm test         # vitest
+npm run typecheck
+npm run build    # -> dist/
+```
+
+All three must pass before committing. See [AGENTS.md](AGENTS.md) for the decisions
+and rules behind the code, and [CHANGELOG.md](CHANGELOG.md) for the release history.
+
+Cutting a release:
+
+```bash
+npm run release -- patch     # bumps, tags, packs; refuses without a CHANGELOG entry
+git push origin main:main --follow-tags
+npm publish --access public
+```
+
+## Part of matrix-workouts
+
+| | |
+|---|---|
+| [matrix-workouts-core](https://github.com/bestimmaa/matrix-workouts-core) | this package: parser, API client, export format |
+| [matrix-workouts-chrome](https://github.com/bestimmaa/matrix-workouts-chrome) | the Chrome extension that puts it on screen |
+| [matrix-workouts-mcp](https://github.com/bestimmaa/matrix-workouts-mcp) | an MCP server, so an AI agent can ask about your rides |
+
+MIT licensed. Unaffiliated with Matrix Fitness or Johnson Health Tech.

package/dist/api/client.d.ts

@@ -0,0 +1,63 @@
+import type { Workout } from "../parse/types.js";
+import { type Credentials } from "./credentials.js";
+/**
+ * Client for the jfit HTTP API — the only route to history deeper than the week
+ * the site caches in localStorage.
+ *
+ * Host is `apollo.jfit.co`. `orion.jfit.co` appears in the site's bundle but answers
+ * 403; do not use it. `GET /workouts/{id}` is likewise in the bundle and answers
+ * 404 — the list endpoint is the only one that works, and it returns complete
+ * records with every interval, so one request gets everything.
+ */
+export declare const API_ORIGIN = "https://apollo.jfit.co";
+export declare class ApiError extends Error {
+    /** HTTP status, or 0 for a transport failure. */
+    readonly status: number;
+    name: string;
+    constructor(message: string, 
+    /** HTTP status, or 0 for a transport failure. */
+    status: number);
+}
+/** Just the part of `fetch` we use, so tests need no network and no globals. */
+export interface FetchInit {
+    headers: Record<string, string>;
+    /** Absent means GET. Only the sign-in request sets this. */
+    method?: string;
+    /** Already-serialized JSON, for the one request that has a body. */
+    body?: string;
+}
+export type FetchLike = (url: string, init: FetchInit) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+export declare function workoutsUrl(exerciserId: string): string;
+/**
+ * Fetch the exerciser's full workout history.
+ *
+ * The response is `{ workouts, messages, paging }`. Paging is deliberately not
+ * followed: the endpoint has returned every record in one response on the accounts
+ * seen so far, and inventing page parameters against an undocumented API is a good
+ * way to silently truncate someone's history. If `paging` ever indicates more than
+ * arrived, that surfaces as `truncated` rather than being quietly dropped.
+ */
+export interface HistoryResult {
+    workouts: Workout[];
+    /** True when the response's own paging says there is more than we received. */
+    truncated: boolean;
+    /** Records the API returned that this parser could not read. */
+    skipped: number;
+}
+export declare function fetchWorkoutHistory(credentials: Credentials, fetchImpl: FetchLike): Promise<HistoryResult>;
+/**
+ * Turn a history response body into the normalized result.
+ *
+ * Split out of `fetchWorkoutHistory` so that a response saved to disk and read back
+ * later — which is how the standalone client and the MCP server cache a history —
+ * goes through exactly the same tolerance: the same accepted shapes, the same
+ * per-record failure isolation, the same truncation check. A second reader that
+ * reimplemented any of that would drift from this one on the day the upstream shape
+ * changes again.
+ */
+export declare function parseHistoryResponse(body: unknown): HistoryResult;
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,2BAA2B,CAAC;AAEnD,qBAAa,QAAS,SAAQ,KAAK;IAI/B,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJhB,IAAI,SAAc;gBAEzB,OAAO,EAAE,MAAM;IACf,iDAAiD;IACxC,MAAM,EAAE,MAAM;CAI1B;AAED,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,aAAa,CAAC,CA8BxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAejE"}

package/dist/api/client.js

@@ -0,0 +1,112 @@
+import { toWorkout } from "../parse/workout.js";
+import { redact } from "./credentials.js";
+/**
+ * Client for the jfit HTTP API — the only route to history deeper than the week
+ * the site caches in localStorage.
+ *
+ * Host is `apollo.jfit.co`. `orion.jfit.co` appears in the site's bundle but answers
+ * 403; do not use it. `GET /workouts/{id}` is likewise in the bundle and answers
+ * 404 — the list endpoint is the only one that works, and it returns complete
+ * records with every interval, so one request gets everything.
+ */
+export const API_ORIGIN = "https://apollo.jfit.co";
+export class ApiError extends Error {
+    status;
+    name = "ApiError";
+    constructor(message, 
+    /** HTTP status, or 0 for a transport failure. */
+    status) {
+        super(message);
+        this.status = status;
+    }
+}
+export function workoutsUrl(exerciserId) {
+    return `${API_ORIGIN}/exerciser/${encodeURIComponent(exerciserId)}/workouts`;
+}
+export async function fetchWorkoutHistory(credentials, fetchImpl) {
+    const url = workoutsUrl(credentials.exerciserId);
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            headers: {
+                Authorization: `Bearer ${credentials.token}`,
+                Accept: "application/json",
+            },
+        });
+    }
+    catch (error) {
+        // A transport failure's message can carry the request, so redact before it
+        // escapes into a UI string or a log.
+        const detail = error instanceof Error ? redact(error.message, credentials.token) : "";
+        throw new ApiError(`Could not reach the workout API. ${detail}`.trim(), 0);
+    }
+    if (!response.ok) {
+        throw new ApiError(describeStatus(response.status), response.status);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new ApiError("The workout API returned something that is not JSON.", response.status);
+    }
+    return parseHistoryResponse(body);
+}
+/**
+ * Turn a history response body into the normalized result.
+ *
+ * Split out of `fetchWorkoutHistory` so that a response saved to disk and read back
+ * later — which is how the standalone client and the MCP server cache a history —
+ * goes through exactly the same tolerance: the same accepted shapes, the same
+ * per-record failure isolation, the same truncation check. A second reader that
+ * reimplemented any of that would drift from this one on the day the upstream shape
+ * changes again.
+ */
+export function parseHistoryResponse(body) {
+    const records = extractWorkouts(body);
+    const workouts = [];
+    let skipped = 0;
+    for (const record of records) {
+        // One malformed record must not cost the user their whole history.
+        try {
+            workouts.push(toWorkout(record));
+        }
+        catch {
+            skipped += 1;
+        }
+    }
+    workouts.sort((a, b) => b.startedAt.getTime() - a.startedAt.getTime());
+    return { workouts, truncated: isTruncated(body, records.length), skipped };
+}
+function describeStatus(status) {
+    if (status === 401 || status === 403) {
+        return "The workout API rejected the stored sign-in. Reload the site to refresh it, then try again.";
+    }
+    if (status === 404)
+        return "The workout API has no history for this account.";
+    if (status >= 500)
+        return `The workout API is failing (HTTP ${status}). Try again later.`;
+    return `The workout API refused the request (HTTP ${status}).`;
+}
+function extractWorkouts(body) {
+    // The documented shape is { workouts, messages, paging }; a bare array is
+    // accepted too, since the upstream shape is undocumented and can change.
+    const list = Array.isArray(body)
+        ? body
+        : typeof body === "object" && body !== null
+            ? body["workouts"]
+            : null;
+    if (!Array.isArray(list))
+        return [];
+    return list.filter((item) => typeof item === "object" && item !== null && !Array.isArray(item));
+}
+function isTruncated(body, received) {
+    if (typeof body !== "object" || body === null)
+        return false;
+    const paging = body["paging"];
+    if (typeof paging !== "object" || paging === null)
+        return false;
+    const total = paging["total"];
+    return typeof total === "number" && total > received;
+}
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAoB,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAEnD,MAAM,OAAO,QAAS,SAAQ,KAAK;IAKtB;IAJF,IAAI,GAAG,UAAU,CAAC;IAC3B,YACE,OAAe;IACf,iDAAiD;IACxC,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;IAGzB,CAAC;CACF;AAiBD,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,OAAO,GAAG,UAAU,cAAc,kBAAkB,CAAC,WAAW,CAAC,WAAW,CAAC;AAC/E,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAwB,EACxB,SAAoB;IAEpB,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAEjD,IAAI,QAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,CAAC,KAAK,EAAE;gBAC5C,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,qCAAqC;QACrC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,QAAQ,CAAC,oCAAoC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,mEAAmE;QACnE,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAEvE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,6FAA6F,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kDAAkD,CAAC;IAC9E,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,oCAAoC,MAAM,qBAAqB,CAAC;IAC1F,OAAO,6CAA6C,MAAM,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACzC,CAAC,CAAE,IAAgC,CAAC,UAAU,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,IAAI,EAAmC,EAAE,CACxC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,QAAgB;IAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,MAAM,GAAI,IAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,KAAK,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,QAAQ,CAAC;AACvD,CAAC"}

package/dist/api/credentials.d.ts

@@ -0,0 +1,24 @@
+import type { ReadableStorage } from "../parse/index.js";
+/**
+ * The bearer token and exerciser id the site has already stored in this browser.
+ *
+ * PRIVACY: the token is read into memory on demand and passed straight to the one
+ * request that needs it. It is never logged, never written to `chrome.storage`, and
+ * never included in an error message — `redact()` below exists so a stray token in
+ * a URL cannot reach a thrown string either.
+ */
+export interface Credentials {
+    exerciserId: string;
+    token: string;
+}
+/**
+ * Pull credentials out of the persisted blob.
+ *
+ * The documented location is `userStore.exerciserProfile.token`, but the id is
+ * mirrored in several places depending on how the session was established, so the
+ * lookup is tolerant in the same spirit as the rest of the parse layer.
+ */
+export declare function readCredentials(storage: ReadableStorage): Credentials;
+/** Strip anything token-shaped from a string before it can reach a message or log. */
+export declare function redact(text: string, token: string): string;
+//# sourceMappingURL=credentials.d.ts.map