hevy-mcp 6.1.1 → 6.1.2

package/dist/cli.mjs

@@ -8,8 +8,8 @@
 		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "d805d34c-9cce-4622-8b67-728aa0cacb5d", e._sentryDebugIdIdentifier = "sentry-dbid-d805d34c-9cce-4622-8b67-728aa0cacb5d");
 	} catch (e) {}
 })();
-import { i as flushTelemetry, r as MissingHevyApiKeyError, t as runServer } from "./runtime-CQ5qda5F.mjs";
-import { a as createSafeErrorDiagnostic } from "./src-c7i9L8Mm.mjs";
+import { i as flushTelemetry, r as MissingHevyApiKeyError, t as runServer } from "./runtime-C0tBW0Rj.mjs";
+import { a as createSafeErrorDiagnostic } from "./src-ITv7b8-Y.mjs";
 //#region src/cli.ts
 runServer().catch(async (error) => {
 	if (error instanceof MissingHevyApiKeyError) console.error(error.message);

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Generated with tsdown
 // https://tsdown.dev
-import { o as createHevyClient, t as createHevyMcpServer } from "./src-c7i9L8Mm.mjs";
+import { o as createHevyClient, t as createHevyMcpServer } from "./src-ITv7b8-Y.mjs";
 import { z } from "zod";
 //#region src/index.ts
 const serverConfigSchema = z.object({ apiKey: z.string().min(1, "Hevy API key is required").describe("Your Hevy API key (available in the Hevy app settings).") });
@@ -32,7 +32,7 @@ function createNodeMcpServer({ apiKey }, _transport = "stdio", lifecycleSignal)
 * does not evaluate the runtime bootstrap; it is loaded only when invoked.
 */
 async function runStdioServer() {
-	const { runStdioServer: run } = await import("./runtime-CQ5qda5F.mjs").then((n) => n.n);
+	const { runStdioServer: run } = await import("./runtime-C0tBW0Rj.mjs").then((n) => n.n);
 	return run();
 }
 /**
@@ -40,7 +40,7 @@ async function runStdioServer() {
 * does not evaluate the runtime bootstrap; it is loaded only when invoked.
 */
 async function runServer() {
-	const { runServer: run } = await import("./runtime-CQ5qda5F.mjs").then((n) => n.n);
+	const { runServer: run } = await import("./runtime-C0tBW0Rj.mjs").then((n) => n.n);
 	return run();
 }
 //#endregion

package/dist/{runtime-CQ5qda5F.mjs → runtime-C0tBW0Rj.mjs}

@@ -5,13 +5,13 @@
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
 		var n = new e.Error().stack;
-		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "c292bf26-255c-46b3-9cb2-3343afe7b7ce", e._sentryDebugIdIdentifier = "sentry-dbid-c292bf26-255c-46b3-9cb2-3343afe7b7ce");
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "74fe8f19-5598-43b9-8f97-71b400eea539", e._sentryDebugIdIdentifier = "sentry-dbid-74fe8f19-5598-43b9-8f97-71b400eea539");
 	} catch (e) {}
 })();
-import { a as createSafeErrorDiagnostic, c as diagnosticEndpointIdentity, i as bucketCount, l as metricEndpointIdentity, n as createExecutionProjection, o as createHevyClient, r as mergeAbortSignals, s as SAFE_OBSERVATION_CODES, t as createHevyMcpServer, u as isHevyHttpError } from "./src-c7i9L8Mm.mjs";
+import { a as createSafeErrorDiagnostic, c as diagnosticEndpointIdentity, i as bucketCount, l as metricEndpointIdentity, n as createExecutionProjection, o as createHevyClient, r as mergeAbortSignals, s as SAFE_OBSERVATION_CODES, t as createHevyMcpServer, u as isHevyHttpError } from "./src-ITv7b8-Y.mjs";
 import { ZodError, z } from "zod";
 import { deserializeMessage } from "@modelcontextprotocol/server";
-import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as Sentry from "@sentry/node";
 import { SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
@@ -365,7 +365,7 @@ function installProcessExceptionTracking(processLike = process) {
 	};
 }
 const name$1 = "hevy-mcp";
-const version$1 = "6.1.1";
+const version$1 = "6.1.2";
 const telemetryEnabled = process.env.HEVY_MCP_TELEMETRY !== "0";
 const collectorToken = "NH9vOela-HYreQxAbJa68cjEmORoEKM57EvneUDVcOo";
 const COLLECTOR_ENDPOINT = "https://otel.chrisdoc.dev/v1";
@@ -1364,6 +1364,7 @@ function createNodeCacheObserver() {
 //#endregion
 //#region src/utils/tool-observer.ts
 const DISCOVERY_TOOL_NAMES = /* @__PURE__ */ new Set(["search-routines"]);
+const SAFE_USER_HASH_PATTERN = /^[0-9a-f]{10}$/u;
 const WORKFLOW_PAGINATION_RESOURCES = /* @__PURE__ */ new Set([
 	"workouts",
 	"bodyMeasurements",
@@ -1384,7 +1385,7 @@ function metricAttributes(invocation, clientAttributes) {
 		...clientAttributes
 	};
 }
-function createAttributes(invocation) {
+function createAttributes(invocation, userHash) {
 	const clientMetadata = getCurrentMcpClientMetadata();
 	const isPrompt = invocation.kind === "prompt";
 	const sessionId = getCurrentMcpSessionId();
@@ -1397,6 +1398,7 @@ function createAttributes(invocation) {
 		"mcp.client.version": clientMetadata.version,
 		"mcp.protocol.version": clientMetadata.protocolVersion,
 		"mcp.transport": getCurrentMcpTransport(),
+		...userHash ? { "user.hash": userHash } : {},
 		"mcp.tool.args.key_count_bucket": invocation.argumentKeyCountBucket ?? "unknown",
 		"mcp.tool.args.keys": invocation.argumentKeys?.join(",") ?? "",
 		...sessionId ? { "mcp.session.id": sessionId } : {}
@@ -1452,7 +1454,8 @@ function bestEffort(operation) {
 	} catch {}
 }
 /** Node-only adapter from core's privacy-safe observation contract to OTel. */
-function createNodeToolObserver() {
+function createNodeToolObserver(options = {}) {
+	const userHash = typeof options.userHash === "string" && SAFE_USER_HASH_PATTERN.test(options.userHash) ? options.userHash : void 0;
 	return { start(invocation) {
 		const startedAt = Date.now();
 		const metrics = metricAttributes(invocation, recordMcpToolInvocation());
@@ -1462,7 +1465,7 @@ function createNodeToolObserver() {
 		let thrownError;
 		return {
 			run(operation) {
-				return tracer.startActiveSpan(`mcp.tool.${invocation.name}`, { attributes: createAttributes(invocation) }, async (span) => {
+				return tracer.startActiveSpan(`mcp.tool.${invocation.name}`, { attributes: createAttributes(invocation, userHash) }, async (span) => {
 					activeSpan = span;
 					try {
 						return await operation();
@@ -1528,6 +1531,22 @@ function createNodeToolObserver() {
 	} };
 }
 //#endregion
+//#region src/utils/user-hash.ts
+const USER_HASH_CONTEXT = "hevy-mcp:sentry-user-id:v1";
+const USER_HASH_LENGTH = 10;
+/**
+* Derive the short, deterministic HMAC pseudonym shared with the Worker
+* telemetry contract without exporting or logging the caller's Hevy API key.
+*/
+function createNodeUserHash(apiKey) {
+	if (apiKey.length === 0) return void 0;
+	try {
+		return createHmac("sha256", apiKey).update(USER_HASH_CONTEXT, "utf8").digest("hex").slice(0, USER_HASH_LENGTH);
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/utils/stdio-observability.ts
 const UTF8_BOM = "";
 /** Maximum escaped characters included in a malformed stdin shape preview. */
@@ -2424,7 +2443,7 @@ function buildServer(apiKey, transport = "stdio", lifecycleSignal) {
 				}),
 				lifecycleSignal,
 				onToolsRegistered: (count) => span.setAttribute("mcp.tools.count", count),
-				observer: createNodeToolObserver(),
+				observer: createNodeToolObserver({ userHash: createNodeUserHash(apiKey) }),
 				cacheObserver: createNodeCacheObserver()
 			});
 			installSdkErrorTracking(server, transport);
@@ -2527,4 +2546,4 @@ async function runServer() {
 //#endregion
 export { flushTelemetry as i, runtime_exports as n, MissingHevyApiKeyError as r, runServer as t };
 
-//# sourceMappingURL=runtime-CQ5qda5F.mjs.map
+//# sourceMappingURL=runtime-C0tBW0Rj.mjs.map

package/dist/{src-c7i9L8Mm.mjs → src-ITv7b8-Y.mjs}

@@ -4512,7 +4512,7 @@ function registerHevyResources(server, runtime) {
 //#endregion
 //#region ../core/src/server-metadata.ts
 const SERVER_NAME = "hevy-mcp";
-const SERVER_VERSION = "6.1.1";
+const SERVER_VERSION = "6.1.2";
 const SERVER_INSTRUCTIONS = [
 	"Hevy MCP connects clients to the authenticated user's Hevy workout-tracking data, including workouts, routines, exercise templates, routine folders, body measurements, and profile information. HEVY_API_KEY must contain a valid Hevy API key for local stdio use.",
 	"Safety: all get-* and search-* tools are read-only. create-* and update-* tools mutate Hevy data. Creates are additive and non-idempotent, so repeating one can create duplicates. Updates can overwrite existing data. Delete operations are not available.",
@@ -5090,4 +5090,4 @@ function createHevyMcpServer(options) {
 //#endregion
 export { createSafeErrorDiagnostic as a, diagnosticEndpointIdentity as c, bucketCount as i, metricEndpointIdentity as l, createExecutionProjection as n, createHevyClient as o, mergeAbortSignals as r, SAFE_OBSERVATION_CODES as s, createHevyMcpServer as t, isHevyHttpError as u };
 
-//# sourceMappingURL=src-c7i9L8Mm.mjs.map
+//# sourceMappingURL=src-ITv7b8-Y.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hevy-mcp",
-	"version": "6.1.1",
+	"version": "6.1.2",
 	"private": false,
 	"description": "A Model Context Protocol (MCP) server implementation that interfaces with the Hevy fitness tracking app and its API.",
 	"repository": {

package/server.json

@@ -7,12 +7,12 @@
 		"url": "https://github.com/chrisdoc/hevy-mcp",
 		"source": "github"
 	},
-	"version": "6.1.1",
+	"version": "6.1.2",
 	"packages": [
 		{
 			"registryType": "npm",
 			"identifier": "hevy-mcp",
-			"version": "6.1.1",
+			"version": "6.1.2",
 			"transport": {
 				"type": "stdio"
 			},