couchloop-eq-mcp 1.1.3 → 1.1.6

package/dist/types/journey.d.ts

@@ -27,8 +27,8 @@ export declare const JourneyStepSchema: z.ZodObject<{
         instructions?: string | undefined;
     };
     type: "prompt" | "checkpoint" | "summary";
-    order: number;
     optional: boolean;
+    order: number;
 }, {
     id: string;
     content: {
@@ -37,8 +37,8 @@ export declare const JourneyStepSchema: z.ZodObject<{
         instructions?: string | undefined;
     };
     type: "prompt" | "checkpoint" | "summary";
-    order: number;
     optional: boolean;
+    order: number;
 }>;
 export type JourneyStep = z.infer<typeof JourneyStepSchema>;
 export declare const JourneySchema: z.ZodObject<{
@@ -72,8 +72,8 @@ export declare const JourneySchema: z.ZodObject<{
             instructions?: string | undefined;
         };
         type: "prompt" | "checkpoint" | "summary";
-        order: number;
         optional: boolean;
+        order: number;
     }, {
         id: string;
         content: {
@@ -82,8 +82,8 @@ export declare const JourneySchema: z.ZodObject<{
             instructions?: string | undefined;
         };
         type: "prompt" | "checkpoint" | "summary";
-        order: number;
         optional: boolean;
+        order: number;
     }>, "many">;
     estimatedMinutes: z.ZodNumber;
     tags: z.ZodArray<z.ZodString, "many">;
@@ -99,8 +99,8 @@ export declare const JourneySchema: z.ZodObject<{
             instructions?: string | undefined;
         };
         type: "prompt" | "checkpoint" | "summary";
-        order: number;
         optional: boolean;
+        order: number;
     }[];
     estimatedMinutes: number;
     tags: string[];
@@ -117,8 +117,8 @@ export declare const JourneySchema: z.ZodObject<{
             instructions?: string | undefined;
         };
         type: "prompt" | "checkpoint" | "summary";
-        order: number;
         optional: boolean;
+        order: number;
     }[];
     estimatedMinutes: number;
     tags: string[];

package/dist/types/session.d.ts

@@ -21,23 +21,23 @@ export declare const CreateSessionSchema: z.ZodObject<{
         conversation_id?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
-    journey_slug?: string | undefined;
-    context?: string | undefined;
     auth?: {
         user_id?: string | undefined;
         client_id?: string | undefined;
         token?: string | undefined;
         conversation_id?: string | undefined;
     } | undefined;
-}, {
     journey_slug?: string | undefined;
     context?: string | undefined;
+}, {
     auth?: {
         user_id?: string | undefined;
         client_id?: string | undefined;
         token?: string | undefined;
         conversation_id?: string | undefined;
     } | undefined;
+    journey_slug?: string | undefined;
+    context?: string | undefined;
 }>;
 export type CreateSessionInput = z.infer<typeof CreateSessionSchema>;
 export declare const ResumeSessionSchema: z.ZodObject<{

package/dist/utils/sanitize.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Response Sanitization Utilities
+ *
+ * Strips sensitive internal metadata from responses before returning to users.
+ * Full data is logged server-side for debugging.
+ */
+/**
+ * Sanitize a response object by removing sensitive fields
+ */
+export declare function sanitizeResponse<T extends Record<string, unknown>>(response: T, options?: {
+    logLevel?: 'debug' | 'info' | 'none';
+    allowFields?: string[];
+}): Record<string, unknown>;
+/**
+ * Sanitize an array of objects
+ */
+export declare function sanitizeArray<T extends Record<string, unknown>>(items: T[], options?: {
+    allowFields?: string[];
+}): Record<string, unknown>[];
+/**
+ * Check if a response contains any sensitive fields
+ */
+export declare function hasSensitiveData(obj: Record<string, unknown>): boolean;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/utils/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmDH;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChE,QAAQ,EAAE,CAAC,EACX,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GACA,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyCzB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,KAAK,EAAE,CAAC,EAAE,EACV,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAE3B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAatE"}

package/dist/utils/sanitize.js

@@ -0,0 +1,117 @@
+/**
+ * Response Sanitization Utilities
+ *
+ * Strips sensitive internal metadata from responses before returning to users.
+ * Full data is logged server-side for debugging.
+ */
+import { logger } from './logger.js';
+/**
+ * Fields that should NEVER be exposed to end users
+ */
+const SENSITIVE_FIELDS = [
+    'sessionId',
+    'session_id',
+    'threadId',
+    'thread_id',
+    'messageId',
+    'message_id',
+    'userId',
+    'user_id',
+    'insightId',
+    'insight_id',
+    'checkpointId',
+    'checkpoint_id',
+    'crisisLevel',
+    'crisis_level',
+    'crisisConfidence',
+    'crisis_confidence',
+    'crisisIndicators',
+    'crisis_indicators',
+    'selfCorrected',
+    'self_corrected',
+    'currentStep',
+    'current_step',
+    'internalId',
+    'internal_id',
+    'auth',
+    'token',
+    'apiKey',
+    'api_key',
+];
+/**
+ * Fields that ARE safe to expose
+ */
+const SAFE_FIELDS = [
+    'success',
+    'content',
+    'message',
+    'timestamp',
+    'type',
+    'error',
+    'crisis_resources', // Only if crisis detected
+];
+/**
+ * Sanitize a response object by removing sensitive fields
+ */
+export function sanitizeResponse(response, options) {
+    const { logLevel = 'debug', allowFields = [] } = options || {};
+    // Log full response server-side before sanitizing
+    if (logLevel === 'debug') {
+        logger.debug('[Sanitize] Full response (internal):', response);
+    }
+    else if (logLevel === 'info') {
+        logger.info('[Sanitize] Full response (internal):', response);
+    }
+    const safeFields = [...SAFE_FIELDS, ...allowFields];
+    const sanitized = {};
+    for (const [key, value] of Object.entries(response)) {
+        // Skip sensitive fields
+        if (SENSITIVE_FIELDS.includes(key)) {
+            continue;
+        }
+        // Skip nested metadata objects (they often contain sensitive data)
+        if (key === 'metadata' && typeof value === 'object' && value !== null) {
+            // Only extract crisis detection status for safety messaging
+            const meta = value;
+            if (meta.crisisDetected === true) {
+                sanitized.crisis_resources = '988 Suicide & Crisis Lifeline • Crisis Text Line: text HOME to 741741';
+            }
+            continue;
+        }
+        // Include safe fields
+        if (safeFields.includes(key) || !SENSITIVE_FIELDS.some(s => key.toLowerCase().includes(s.toLowerCase()))) {
+            // Recursively sanitize nested objects
+            if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                sanitized[key] = sanitizeResponse(value, { logLevel: 'none' });
+            }
+            else {
+                sanitized[key] = value;
+            }
+        }
+    }
+    return sanitized;
+}
+/**
+ * Sanitize an array of objects
+ */
+export function sanitizeArray(items, options) {
+    return items.map(item => sanitizeResponse(item, { ...options, logLevel: 'none' }));
+}
+/**
+ * Check if a response contains any sensitive fields
+ */
+export function hasSensitiveData(obj) {
+    for (const key of Object.keys(obj)) {
+        if (SENSITIVE_FIELDS.includes(key)) {
+            return true;
+        }
+        const value = obj[key];
+        if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+            if (hasSensitiveData(value)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/utils/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACvB,WAAW;IACX,YAAY;IACZ,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,cAAc;IACd,eAAe;IACf,aAAa;IACb,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,YAAY;IACZ,aAAa;IACb,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;CACV,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,SAAS;IACT,SAAS;IACT,SAAS;IACT,WAAW;IACX,MAAM;IACN,OAAO;IACP,kBAAkB,EAAE,0BAA0B;CAC/C,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAW,EACX,OAGC;IAED,MAAM,EAAE,QAAQ,GAAG,OAAO,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAE/D,kDAAkD;IAClD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,wBAAwB;QACxB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,IAAI,GAAG,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACtE,4DAA4D;YAC5D,MAAM,IAAI,GAAG,KAAgC,CAAC;YAC9C,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACjC,SAAS,CAAC,gBAAgB,GAAG,uEAAuE,CAAC;YACvG,CAAC;YACD,SAAS;QACX,CAAC;QAED,sBAAsB;QACtB,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,sCAAsC;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,SAAS,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5F,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAU,EACV,OAAoC;IAEpC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA4B;IAC3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,IAAI,gBAAgB,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/workflows/index.d.ts

@@ -15,8 +15,8 @@ export declare const journeysBySlug: Map<string, {
             instructions?: string | undefined;
         };
         type: "prompt" | "checkpoint" | "summary";
-        order: number;
         optional: boolean;
+        order: number;
     }[];
     estimatedMinutes: number;
     tags: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "couchloop-eq-mcp",
-  "version": "1.1.3",
+  "version": "1.1.6",
   "description": "Behavioral governance layer for LLMs - monitors for hallucination, inconsistency, tone drift, and unsafe reasoning while managing stateful AI sessions",
   "main": "dist/index.js",
   "type": "module",
@@ -93,7 +93,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.25.2",
+    "@modelcontextprotocol/sdk": "^1.26.0",
     "@supabase/supabase-js": "^2.39.0",
     "bcryptjs": "^3.0.3",
     "cookie-parser": "^1.4.7",