trainbud 0.5.0 → 0.5.2

package/dist/dashboardCharts.js

@@ -58,9 +58,9 @@ function round(value, places = 2) {
  * whole file exists to preserve.
  */
 function emptyChart(width, height, message) {
-    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img" aria-label="${escapeXml(message)}" preserveAspectRatio="none">
-  <text x="${width / 2}" y="${height / 2}" text-anchor="middle" dominant-baseline="middle"
-        fill="${CHART_COLORS.muted}" font-size="13">${escapeXml(message)}</text>
+    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img" aria-label="${escapeXml(message)}" preserveAspectRatio="none">
+  <text x="${width / 2}" y="${height / 2}" text-anchor="middle" dominant-baseline="middle"
+        fill="${CHART_COLORS.muted}" font-size="13">${escapeXml(message)}</text>
 </svg>`;
 }
 /**
@@ -152,30 +152,30 @@ export function lineChart(points, options) {
     const last = [...points].reverse().find((p) => p.value !== null);
     const lastIndex = last ? points.findIndex((p) => p.date === last.date) : -1;
     const baselineMarkup = options.baseline
-        ? `<line x1="${padLeft}" x2="${width - padRight}" y1="${round(y(options.baseline.value))}" y2="${round(y(options.baseline.value))}"
+        ? `<line x1="${padLeft}" x2="${width - padRight}" y1="${round(y(options.baseline.value))}" y2="${round(y(options.baseline.value))}"
         stroke="${CHART_COLORS.muted}" stroke-width="1" stroke-dasharray="3 3" opacity="0.7"><title>${escapeXml(options.baseline.label)}</title></line>`
         : "";
     const dots = points
         .map((point, index) => point.value === null
         ? ""
-        : `<circle cx="${round(x(index))}" cy="${round(y(point.value))}" r="4"
-             fill="${CHART_COLORS.series}" stroke="${CHART_COLORS.surface}" stroke-width="2"
+        : `<circle cx="${round(x(index))}" cy="${round(y(point.value))}" r="4"
+             fill="${CHART_COLORS.series}" stroke="${CHART_COLORS.surface}" stroke-width="2"
              class="dot"><title>${escapeXml(point.date)}: ${escapeXml(format(point.value))}${escapeXml(options.unit ?? "")}</title></circle>`)
         .join("");
-    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img"
-     aria-label="${escapeXml(options.label)}" preserveAspectRatio="none">
-  <line x1="${padLeft}" x2="${width - padRight}" y1="${padTop}" y2="${padTop}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
-  <line x1="${padLeft}" x2="${width - padRight}" y1="${padTop + plotHeight}" y2="${padTop + plotHeight}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
-  <text x="4" y="${padTop + 4}" fill="${CHART_COLORS.muted}" font-size="10">${escapeXml(format(scale.max))}</text>
-  <text x="4" y="${padTop + plotHeight}" fill="${CHART_COLORS.muted}" font-size="10">${escapeXml(format(scale.min))}</text>
-  ${baselineMarkup}
-  <path d="${segments.join(" ")}" fill="none" stroke="${CHART_COLORS.series}" stroke-width="2"
-        stroke-linejoin="round" stroke-linecap="round"/>
-  ${dots}
+    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img"
+     aria-label="${escapeXml(options.label)}" preserveAspectRatio="none">
+  <line x1="${padLeft}" x2="${width - padRight}" y1="${padTop}" y2="${padTop}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
+  <line x1="${padLeft}" x2="${width - padRight}" y1="${padTop + plotHeight}" y2="${padTop + plotHeight}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
+  <text x="4" y="${padTop + 4}" fill="${CHART_COLORS.muted}" font-size="10">${escapeXml(format(scale.max))}</text>
+  <text x="4" y="${padTop + plotHeight}" fill="${CHART_COLORS.muted}" font-size="10">${escapeXml(format(scale.min))}</text>
+  ${baselineMarkup}
+  <path d="${segments.join(" ")}" fill="none" stroke="${CHART_COLORS.series}" stroke-width="2"
+        stroke-linejoin="round" stroke-linecap="round"/>
+  ${dots}
   ${lastIndex >= 0 && last?.value !== null && last !== undefined
-        ? `<text x="${width - padRight}" y="${round(y(last.value)) - 8}" text-anchor="end"
+        ? `<text x="${width - padRight}" y="${round(y(last.value)) - 8}" text-anchor="end"
              fill="${CHART_COLORS.ink}" font-size="11">${escapeXml(format(last.value))}${escapeXml(options.unit ?? "")}</text>`
-        : ""}
+        : ""}
 </svg>`;
 }
 /**
@@ -204,9 +204,9 @@ export function columnChart(points, options) {
     // data and left a hole in the page.
     if (maxValue <= 0) {
         const flat = 54;
-        return `<svg class="chart" viewBox="0 0 ${width} ${flat}" role="img" aria-label="${escapeXml(options.label)}" preserveAspectRatio="none">
-  <line x1="${padLeft}" x2="${width - padRight}" y1="${flat - 14}" y2="${flat - 14}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
-  <text x="${width / 2}" y="${flat / 2 - 4}" text-anchor="middle" fill="${CHART_COLORS.muted}" font-size="12">Nothing spent</text>
+        return `<svg class="chart" viewBox="0 0 ${width} ${flat}" role="img" aria-label="${escapeXml(options.label)}" preserveAspectRatio="none">
+  <line x1="${padLeft}" x2="${width - padRight}" y1="${flat - 14}" y2="${flat - 14}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
+  <text x="${width / 2}" y="${flat / 2 - 4}" text-anchor="middle" fill="${CHART_COLORS.muted}" font-size="12">Nothing spent</text>
 </svg>`;
     }
     const plotWidth = width - padLeft - padRight;
@@ -223,22 +223,22 @@ export function columnChart(points, options) {
         if (barHeight <= 0) {
             // A recorded zero still gets a hit target, so hovering an empty day
             // says "nothing on this day" rather than nothing at all.
-            return `<rect x="${bx}" y="${round(padTop + plotHeight - 1)}" width="${round(barWidth)}" height="1"
+            return `<rect x="${bx}" y="${round(padTop + plotHeight - 1)}" width="${round(barWidth)}" height="1"
           fill="${CHART_COLORS.grid}" class="bar"><title>${title}</title></rect>`;
         }
-        return `<rect x="${bx}" y="${by}" width="${round(barWidth)}" height="${round(barHeight)}"
+        return `<rect x="${bx}" y="${by}" width="${round(barWidth)}" height="${round(barHeight)}"
         rx="${round(radius)}" fill="${CHART_COLORS.series}" class="bar"><title>${title}</title></rect>`;
     })
         .join("");
     const peakIndex = points.findIndex((p) => p.value === maxValue);
     const peakX = round(padLeft + peakIndex * slot + slot / 2);
     const peakY = round(padTop + plotHeight - (maxValue / maxValue) * plotHeight) - 4;
-    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img"
-     aria-label="${escapeXml(options.label)}" preserveAspectRatio="none">
-  <line x1="${padLeft}" x2="${width - padRight}" y1="${padTop + plotHeight}" y2="${padTop + plotHeight}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
-  <text x="4" y="${padTop + 4}" fill="${CHART_COLORS.muted}" font-size="10">${escapeXml(format(maxValue))}</text>
-  ${bars}
-  <text x="${peakX}" y="${peakY}" text-anchor="middle" fill="${CHART_COLORS.ink}" font-size="11">${escapeXml(format(maxValue))}</text>
+    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img"
+     aria-label="${escapeXml(options.label)}" preserveAspectRatio="none">
+  <line x1="${padLeft}" x2="${width - padRight}" y1="${padTop + plotHeight}" y2="${padTop + plotHeight}" stroke="${CHART_COLORS.grid}" stroke-width="1"/>
+  <text x="4" y="${padTop + 4}" fill="${CHART_COLORS.muted}" font-size="10">${escapeXml(format(maxValue))}</text>
+  ${bars}
+  <text x="${peakX}" y="${peakY}" text-anchor="middle" fill="${CHART_COLORS.ink}" font-size="11">${escapeXml(format(maxValue))}</text>
 </svg>`;
 }
 /**
@@ -288,30 +288,30 @@ export function dumbbellChart(rows, options = {}) {
         const px = labelWidth + (previous / max) * trackWidth;
         const cx = labelWidth + (current / max) * trackWidth;
         const y = firstRowY + index * rowHeight;
-        return `
-  <text x="0" y="${y + 4}" fill="${CHART_COLORS.muted}" font-size="11">${escapeXml(row.label)}</text>
-  <line x1="${round(px)}" x2="${round(cx)}" y1="${y}" y2="${y}" stroke="${CHART_COLORS.grid}" stroke-width="2" stroke-linecap="round"/>
+        return `
+  <text x="0" y="${y + 4}" fill="${CHART_COLORS.muted}" font-size="11">${escapeXml(row.label)}</text>
+  <line x1="${round(px)}" x2="${round(cx)}" y1="${y}" y2="${y}" stroke="${CHART_COLORS.grid}" stroke-width="2" stroke-linecap="round"/>
   ${unchanged
             ? // Both weeks land on the same point. Drawn as a grey halo behind the
                 // accent dot: with the normal marks, this week's 2px surface ring
                 // covers last week's dot completely and "no change" renders as "last
                 // week is missing" -- an absence, which is the one thing this codebase
                 // must never draw a measurement as.
-                `<circle cx="${round(cx)}" cy="${y}" r="8" fill="${CHART_COLORS.muted}" opacity="0.45"><title>No change: ${escapeXml(String(current))}${escapeXml(row.unit)}</title></circle>
+                `<circle cx="${round(cx)}" cy="${y}" r="8" fill="${CHART_COLORS.muted}" opacity="0.45"><title>No change: ${escapeXml(String(current))}${escapeXml(row.unit)}</title></circle>
   <circle cx="${round(cx)}" cy="${y}" r="4" fill="${CHART_COLORS.series}"><title>This week: ${escapeXml(String(current))}${escapeXml(row.unit)}</title></circle>`
-            : `<circle cx="${round(px)}" cy="${y}" r="4" fill="${CHART_COLORS.muted}" stroke="${CHART_COLORS.surface}" stroke-width="2"><title>Last week: ${escapeXml(String(previous))}${escapeXml(row.unit)}</title></circle>
-  <circle cx="${round(cx)}" cy="${y}" r="5" fill="${CHART_COLORS.series}" stroke="${CHART_COLORS.surface}" stroke-width="2"><title>This week: ${escapeXml(String(current))}${escapeXml(row.unit)}</title></circle>`}
+            : `<circle cx="${round(px)}" cy="${y}" r="4" fill="${CHART_COLORS.muted}" stroke="${CHART_COLORS.surface}" stroke-width="2"><title>Last week: ${escapeXml(String(previous))}${escapeXml(row.unit)}</title></circle>
+  <circle cx="${round(cx)}" cy="${y}" r="5" fill="${CHART_COLORS.series}" stroke="${CHART_COLORS.surface}" stroke-width="2"><title>This week: ${escapeXml(String(current))}${escapeXml(row.unit)}</title></circle>`}
   <text x="${width}" y="${y + 4}" text-anchor="end" fill="${CHART_COLORS.ink}" font-size="11">${escapeXml(String(current))}${escapeXml(row.unit)}</text>`;
     })
         .join("");
     // Two marks means a legend, always. Identity never rests on colour alone.
-    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img"
-     aria-label="This week against last week" preserveAspectRatio="none">
-  <circle cx="4" cy="6" r="4" fill="${CHART_COLORS.muted}"/>
-  <text x="13" y="10" fill="${CHART_COLORS.muted}" font-size="10">last week</text>
-  <circle cx="76" cy="6" r="5" fill="${CHART_COLORS.series}"/>
-  <text x="86" y="10" fill="${CHART_COLORS.muted}" font-size="10">this week</text>
-  ${body}
+    return `<svg class="chart" viewBox="0 0 ${width} ${height}" role="img"
+     aria-label="This week against last week" preserveAspectRatio="none">
+  <circle cx="4" cy="6" r="4" fill="${CHART_COLORS.muted}"/>
+  <text x="13" y="10" fill="${CHART_COLORS.muted}" font-size="10">last week</text>
+  <circle cx="76" cy="6" r="5" fill="${CHART_COLORS.series}"/>
+  <text x="86" y="10" fill="${CHART_COLORS.muted}" font-size="10">this week</text>
+  ${body}
 </svg>`;
 }
 //# sourceMappingURL=dashboardCharts.js.map

package/dist/deviceTokens.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The prefix is load-bearing, not decoration. Every authenticated request has
+ * to decide whether a bearer token is the master key or a device token, and
+ * without a marker that decision costs a database round trip on every single
+ * request -- including the dashboard's, which never carries a device token.
+ */
+export declare const DEVICE_TOKEN_PREFIX = "tbd_";
+/** 32 bytes from the CSPRNG. The prefix is not part of the entropy. */
+export declare function generateDeviceToken(): string;
+/**
+ * Only the hash is stored.
+ *
+ * `app.db` already holds the Anthropic key in the clear, which is why it is
+ * chmod'd 0600 -- but a backup, a sync folder or a support upload defeats file
+ * permissions, and a plaintext device token in that file is a working watch
+ * credential for whoever reads it. A SHA-256 of a 256-bit random value has no
+ * dictionary to attack: there is nothing to salt and nothing to guess.
+ */
+export declare function hashDeviceToken(token: string): string;
+/**
+ * A cheap structural check, deliberately not a security boundary.
+ *
+ * It decides which lookup to try, nothing more. A forged string carrying the
+ * prefix still has to hash to a row that exists.
+ */
+export declare function looksLikeDeviceToken(token: string): boolean;
+/** `watch-2026-09-06`, so the device list reads as something a human paired. */
+export declare function defaultDeviceLabel(now?: Date): string;
+//# sourceMappingURL=deviceTokens.d.ts.map

package/dist/deviceTokens.js

@@ -0,0 +1,49 @@
+import { createHash, randomBytes } from "node:crypto";
+// SECTION: Per-device tokens
+//
+// A paired watch used to be handed `appConfig.mcpApiKey` -- the master key,
+// the same credential that unlocks the dashboard and every MCP route. Two
+// things followed from that. Revoking one watch meant rotating the key, which
+// logged out everything else and, until 2.0.2, bricked the watch outright. And
+// a token read off a watch was full server access, not watch access.
+//
+// A device token is minted per pairing, carried by the watch in exactly the
+// same `Authorization: Bearer` header, and revocable on its own. The master key
+// keeps working, so a watch paired before this change does not have to re-pair.
+/**
+ * The prefix is load-bearing, not decoration. Every authenticated request has
+ * to decide whether a bearer token is the master key or a device token, and
+ * without a marker that decision costs a database round trip on every single
+ * request -- including the dashboard's, which never carries a device token.
+ */
+export const DEVICE_TOKEN_PREFIX = "tbd_";
+/** 32 bytes from the CSPRNG. The prefix is not part of the entropy. */
+export function generateDeviceToken() {
+    return DEVICE_TOKEN_PREFIX + randomBytes(32).toString("hex");
+}
+/**
+ * Only the hash is stored.
+ *
+ * `app.db` already holds the Anthropic key in the clear, which is why it is
+ * chmod'd 0600 -- but a backup, a sync folder or a support upload defeats file
+ * permissions, and a plaintext device token in that file is a working watch
+ * credential for whoever reads it. A SHA-256 of a 256-bit random value has no
+ * dictionary to attack: there is nothing to salt and nothing to guess.
+ */
+export function hashDeviceToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+/**
+ * A cheap structural check, deliberately not a security boundary.
+ *
+ * It decides which lookup to try, nothing more. A forged string carrying the
+ * prefix still has to hash to a row that exists.
+ */
+export function looksLikeDeviceToken(token) {
+    return token.startsWith(DEVICE_TOKEN_PREFIX) && token.length === DEVICE_TOKEN_PREFIX.length + 64;
+}
+/** `watch-2026-09-06`, so the device list reads as something a human paired. */
+export function defaultDeviceLabel(now = new Date()) {
+    return `watch-${now.toISOString().slice(0, 10)}`;
+}
+//# sourceMappingURL=deviceTokens.js.map

package/dist/history/context.js

@@ -28,7 +28,7 @@ export function addContextEntry(kind, text, options = {}) {
         createdAt: nowSeconds(),
     };
     const result = getHistoryDb()
-        .prepare(`INSERT INTO context_entry (kind, text, effective_from, effective_to, created_at)
+        .prepare(`INSERT INTO context_entry (kind, text, effective_from, effective_to, created_at)
        VALUES (?, ?, ?, ?, ?)`)
         .run(entry.kind, entry.text, entry.effectiveFrom, entry.effectiveTo, entry.createdAt);
     return { id: Number(result.lastInsertRowid), ...entry };
@@ -36,16 +36,16 @@ export function addContextEntry(kind, text, options = {}) {
 /** Everything true on the given date, newest first. */
 export function activeContext(onDate) {
     return getHistoryDb()
-        .prepare(`SELECT
-         id,
-         kind,
-         text,
-         effective_from AS effectiveFrom,
-         effective_to   AS effectiveTo,
-         created_at     AS createdAt
-       FROM context_entry
-       WHERE effective_from <= ?
-         AND (effective_to IS NULL OR effective_to > ?)
+        .prepare(`SELECT
+         id,
+         kind,
+         text,
+         effective_from AS effectiveFrom,
+         effective_to   AS effectiveTo,
+         created_at     AS createdAt
+       FROM context_entry
+       WHERE effective_from <= ?
+         AND (effective_to IS NULL OR effective_to > ?)
        ORDER BY effective_from DESC, id DESC`)
         .all(onDate, onDate);
 }
@@ -61,29 +61,29 @@ export function activeContext(onDate) {
  */
 export function upcomingContext(onDate) {
     return getHistoryDb()
-        .prepare(`SELECT
-         id,
-         kind,
-         text,
-         effective_from AS effectiveFrom,
-         effective_to   AS effectiveTo,
-         created_at     AS createdAt
-       FROM context_entry
-       WHERE effective_from > ?
+        .prepare(`SELECT
+         id,
+         kind,
+         text,
+         effective_from AS effectiveFrom,
+         effective_to   AS effectiveTo,
+         created_at     AS createdAt
+       FROM context_entry
+       WHERE effective_from > ?
        ORDER BY effective_from ASC, id ASC`)
         .all(onDate);
 }
 /** Every entry ever recorded, newest first — for a dashboard or a tool listing. */
 export function allContext() {
     return getHistoryDb()
-        .prepare(`SELECT
-         id,
-         kind,
-         text,
-         effective_from AS effectiveFrom,
-         effective_to   AS effectiveTo,
-         created_at     AS createdAt
-       FROM context_entry
+        .prepare(`SELECT
+         id,
+         kind,
+         text,
+         effective_from AS effectiveFrom,
+         effective_to   AS effectiveTo,
+         created_at     AS createdAt
+       FROM context_entry
        ORDER BY effective_from DESC, id DESC`)
         .all();
 }
@@ -104,18 +104,18 @@ export function logSubjective(date, kind, value, note) {
         throw new Error(`A ${kind} rating must be a number between ${SUBJECTIVE_MIN} and ${SUBJECTIVE_MAX}.`);
     }
     getHistoryDb()
-        .prepare(`INSERT INTO subjective (date, kind, value, note, created_at)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT(date, kind) DO UPDATE SET
-         value = excluded.value,
-         note = excluded.note,
+        .prepare(`INSERT INTO subjective (date, kind, value, note, created_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(date, kind) DO UPDATE SET
+         value = excluded.value,
+         note = excluded.note,
          created_at = excluded.created_at`)
         .run(date, kind, value, note?.trim() || null, nowSeconds());
 }
 export function subjectiveSeries(kind, startDate, endDate) {
     return getHistoryDb()
-        .prepare(`SELECT date, value, note FROM subjective
-       WHERE kind = ? AND date >= ? AND date <= ?
+        .prepare(`SELECT date, value, note FROM subjective
+       WHERE kind = ? AND date >= ? AND date <= ?
        ORDER BY date ASC`)
         .all(kind, startDate, endDate);
 }

package/dist/history/schema.js

@@ -21,71 +21,71 @@ export const SUBJECTIVE_KINDS = ["rpe", "soreness", "mood"];
  * Connect does not send, and re-deriving from the archive beats re-fetching a
  * year against an unofficial API.
  */
-export const HISTORY_SCHEMA = `
-  CREATE TABLE IF NOT EXISTS daily_metric (
-    date       TEXT    NOT NULL,
-    kind       TEXT    NOT NULL,
-    value      REAL    NOT NULL,
-    fetched_at INTEGER NOT NULL,
-    PRIMARY KEY (date, kind)
-  );
-
-  CREATE TABLE IF NOT EXISTS raw_payload (
-    id         INTEGER PRIMARY KEY AUTOINCREMENT,
-    date       TEXT    NOT NULL,
-    source     TEXT    NOT NULL,
-    fetched_at INTEGER NOT NULL,
-    json       TEXT    NOT NULL
-  );
-
-  CREATE INDEX IF NOT EXISTS raw_payload_date_source
-    ON raw_payload (date, source, fetched_at);
-
-  CREATE TABLE IF NOT EXISTS ingest_day (
-    date       TEXT    NOT NULL,
-    source     TEXT    NOT NULL,
-    fetched_at INTEGER NOT NULL,
-    outcome    TEXT    NOT NULL,
-    PRIMARY KEY (date, source)
-  );
-
-  CREATE TABLE IF NOT EXISTS activity (
-    activity_id      INTEGER PRIMARY KEY,
-    date             TEXT    NOT NULL,
-    start_time_local TEXT    NOT NULL,
-    name             TEXT    NOT NULL,
-    type             TEXT    NOT NULL,
-    distance_m       REAL,
-    duration_s       REAL,
-    avg_hr           REAL,
-    max_hr           REAL,
-    elevation_gain_m REAL,
-    calories         REAL,
-    avg_speed_mps    REAL,
-    fetched_at       INTEGER NOT NULL
-  );
-
-  CREATE INDEX IF NOT EXISTS activity_date ON activity (date);
-
-  CREATE TABLE IF NOT EXISTS context_entry (
-    id             INTEGER PRIMARY KEY AUTOINCREMENT,
-    kind           TEXT    NOT NULL,
-    text           TEXT    NOT NULL,
-    effective_from TEXT    NOT NULL,
-    effective_to   TEXT,
-    created_at     INTEGER NOT NULL
-  );
-
-  CREATE INDEX IF NOT EXISTS context_entry_range
-    ON context_entry (effective_from, effective_to);
-
-  CREATE TABLE IF NOT EXISTS subjective (
-    date       TEXT    NOT NULL,
-    kind       TEXT    NOT NULL,
-    value      REAL    NOT NULL,
-    note       TEXT,
-    created_at INTEGER NOT NULL,
-    PRIMARY KEY (date, kind)
-  );
+export const HISTORY_SCHEMA = `
+  CREATE TABLE IF NOT EXISTS daily_metric (
+    date       TEXT    NOT NULL,
+    kind       TEXT    NOT NULL,
+    value      REAL    NOT NULL,
+    fetched_at INTEGER NOT NULL,
+    PRIMARY KEY (date, kind)
+  );
+
+  CREATE TABLE IF NOT EXISTS raw_payload (
+    id         INTEGER PRIMARY KEY AUTOINCREMENT,
+    date       TEXT    NOT NULL,
+    source     TEXT    NOT NULL,
+    fetched_at INTEGER NOT NULL,
+    json       TEXT    NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS raw_payload_date_source
+    ON raw_payload (date, source, fetched_at);
+
+  CREATE TABLE IF NOT EXISTS ingest_day (
+    date       TEXT    NOT NULL,
+    source     TEXT    NOT NULL,
+    fetched_at INTEGER NOT NULL,
+    outcome    TEXT    NOT NULL,
+    PRIMARY KEY (date, source)
+  );
+
+  CREATE TABLE IF NOT EXISTS activity (
+    activity_id      INTEGER PRIMARY KEY,
+    date             TEXT    NOT NULL,
+    start_time_local TEXT    NOT NULL,
+    name             TEXT    NOT NULL,
+    type             TEXT    NOT NULL,
+    distance_m       REAL,
+    duration_s       REAL,
+    avg_hr           REAL,
+    max_hr           REAL,
+    elevation_gain_m REAL,
+    calories         REAL,
+    avg_speed_mps    REAL,
+    fetched_at       INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS activity_date ON activity (date);
+
+  CREATE TABLE IF NOT EXISTS context_entry (
+    id             INTEGER PRIMARY KEY AUTOINCREMENT,
+    kind           TEXT    NOT NULL,
+    text           TEXT    NOT NULL,
+    effective_from TEXT    NOT NULL,
+    effective_to   TEXT,
+    created_at     INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS context_entry_range
+    ON context_entry (effective_from, effective_to);
+
+  CREATE TABLE IF NOT EXISTS subjective (
+    date       TEXT    NOT NULL,
+    kind       TEXT    NOT NULL,
+    value      REAL    NOT NULL,
+    note       TEXT,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (date, kind)
+  );
 `;
 //# sourceMappingURL=schema.js.map

package/dist/httpServer.js

@@ -4,7 +4,8 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { closeCache } from "./garmin/cache.js";
 import { CARD_IDS, DEFAULT_PROFILE, getProfile, updateProfile, } from "./profile.js";
 import { budgetState, clearFeatureUsage, dailyAiSpend, featureCounts, monthToDateSpend, recentAiUsage, recordFeature, } from "./usage.js";
-import { closeAppDb, reconcilePromptJobsOnStartup, setSetting } from "./appDb.js";
+import { closeAppDb, findDeviceTokenId, reconcilePromptJobsOnStartup, setSetting, touchDeviceToken, } from "./appDb.js";
+import { looksLikeDeviceToken } from "./deviceTokens.js";
 import { assertGarminCredentials, assertApiKey, appConfig } from "./config.js";
 import { createMcpServerInstance } from "./server.js";
 import { configureLogger, logger } from "./utils/logger.js";
@@ -197,6 +198,46 @@ function sessionCookieHeader(req, id) {
     const maxAge = Math.floor(SESSION_TTL_MS / 1000);
     return `${SESSION_COOKIE}=${id}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
 }
+/**
+ * Set on every response, before routing, so a 401 and a 500 carry them too.
+ *
+ * This server is reachable from the public internet whenever the tunnel the
+ * watch needs is up, and it was sending no security headers at all.
+ *
+ * `script-src` has to keep `'unsafe-inline'`: the dashboard is server-rendered
+ * HTML with one inline script and inline handlers, and a nonce-based policy is
+ * a rewrite of the page, not a header change. What the policy still buys is
+ * real -- no external script or style can load, the page cannot be framed, and
+ * `form-action 'self'` stops a submission being retargeted.
+ *
+ * HSTS is conditional on purpose. It is sent only on a request that actually
+ * arrived over TLS, because pinning https on a host someone later serves over
+ * plain http locally is a self-inflicted outage.
+ */
+function applySecurityHeaders(req, res) {
+    res.setHeader("Content-Security-Policy", [
+        "default-src 'self'",
+        "script-src 'self' 'unsafe-inline'",
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data:",
+        "connect-src 'self'",
+        "frame-ancestors 'none'",
+        "base-uri 'none'",
+        "form-action 'self'",
+    ].join("; "));
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Frame-Options", "DENY");
+    // The dashboard is reached with ?token=<key> exactly once before the redirect
+    // to a clean URL. no-referrer keeps that one URL out of any outbound request.
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+    res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
+    const forwarded = req.headers["x-forwarded-proto"];
+    const proto = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(",")[0]?.trim();
+    if (proto === "https") {
+        res.setHeader("Strict-Transport-Security", "max-age=31536000");
+    }
+}
 function isAuthorized(req, queryToken) {
     const header = req.headers.authorization;
     const headerToken = header?.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : null;
@@ -204,8 +245,29 @@ function isAuthorized(req, queryToken) {
     if (token !== null && matchesApiKey(token)) {
         return true;
     }
+    if (token !== null && matchesDeviceToken(token)) {
+        return true;
+    }
     return hasValidSession(req);
 }
+/**
+ * A paired watch presents a token minted for it alone.
+ *
+ * Checked after the master key, and only for strings shaped like a device
+ * token, so the dashboard and MCP paths -- which never carry one -- do not pay
+ * a database lookup per request. Revoking the row is what logs a watch out;
+ * rotating the master key no longer has to, which is what made rotation brick
+ * a watch before 2.0.2.
+ */
+function matchesDeviceToken(token) {
+    if (!looksLikeDeviceToken(token))
+        return false;
+    const id = findDeviceTokenId(token);
+    if (id === null)
+        return false;
+    touchDeviceToken(id);
+    return true;
+}
 /**
  * Constant-time comparison. `===` returns as soon as two bytes differ, which
  * leaks the length of the matching prefix to anyone who can time the response,
@@ -533,6 +595,7 @@ export function createHttpMcpServer() {
                 });
             });
             const handleRequest = async (req, res) => {
+                applySecurityHeaders(req, res);
                 // A Host that is not a valid authority is not worth a 500: fall back to
                 // a name that always parses. The host only matters for reading the path
                 // and, in resolvePublicUrl, for telling a paired watch where to call

package/dist/pairApi.js

@@ -1,5 +1,6 @@
-import { createPairToken, getPairToken, approvePairToken, deletePairToken, listPendingPairTokens } from "./appDb.js";
+import { createPairToken, getPairToken, approvePairToken, deletePairToken, listPendingPairTokens, createDeviceToken } from "./appDb.js";
 import { appConfig } from "./config.js";
+import { defaultDeviceLabel } from "./deviceTokens.js";
 export function requestPairing() {
     const token = createPairToken();
     const now = Math.floor(Date.now() / 1000);
@@ -21,9 +22,17 @@ export function checkPairStatus(code, publicUrl) {
         return null;
     if (token.approved_at !== null) {
         deletePairToken(code);
+        // What the watch receives here used to be appConfig.mcpApiKey: the master
+        // key, handed to a device over a tunnel, with no way to take it back except
+        // rotating the key for everything. It is now a token minted for this
+        // pairing alone, revocable by itself. The field name is unchanged on
+        // purpose -- the watch stores whatever arrives here and sends it as a
+        // bearer token, so nothing on the device had to change and no already
+        // paired watch has to pair again.
+        const device = createDeviceToken(defaultDeviceLabel());
         return {
             approved: true,
-            api_key: appConfig.mcpApiKey,
+            api_key: device.token,
             server_url: publicUrl || appConfig.publicUrl,
         };
     }

package/dist/promptApi.js

@@ -209,11 +209,11 @@ async function callClaude(prompt, healthContext, meta) {
     const message = await client.messages.create({
         model,
         max_tokens: length.maxTokens,
-        system: `You are a concise fitness coach assistant shown on a small smartwatch screen.
-Answer in ${length.sentences}. ${TONE_SPEC[profile.ai.tone]} No markdown formatting.
-${audienceContext(profile)}
-Give general training and wellness guidance only. Do not diagnose conditions or give
-medical advice; if asked something medical, say it is outside what you can advise on.
+        system: `You are a concise fitness coach assistant shown on a small smartwatch screen.
+Answer in ${length.sentences}. ${TONE_SPEC[profile.ai.tone]} No markdown formatting.
+${audienceContext(profile)}
+Give general training and wellness guidance only. Do not diagnose conditions or give
+medical advice; if asked something medical, say it is outside what you can advise on.
 ${healthContext}`,
         messages: [{ role: "user", content: prompt }],
     });