@frihet/mcp-server 1.14.3 → 1.14.4

package/README.md

@@ -39,7 +39,7 @@
 | **ChatGPT Apps** | Coming soon | [chatgpt.com](https://chatgpt.com) |
 | **Anthropic Claude Directory** | Coming soon | [claude.ai/settings/connectors](https://claude.ai/settings/connectors) |
 
-> **Tool count:** npm `latest` (1.14.3) ships all 157 tools, same as the remote endpoint (`mcp.frihet.io`).
+> **Tool count:** npm `latest` (1.14.4) ships all 157 tools, same as the remote endpoint (`mcp.frihet.io`).
 
 ---
 

package/dist/__tests__/intelligence-duplicate-invoice.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Regression test for duplicate_invoice (intelligence.ts).
+ *
+ * Bug: duplicate_invoice fetched the FULL raw stored invoice (getInvoice returns
+ * the entire Firestore doc) and spread it into createInvoice, only blacklisting
+ * 6 fields. The create endpoint validates against a Zod `.strict()` schema that
+ * REJECTS unknown keys → HTTP 400, so any paid/sent/cancelled/e-invoiced invoice
+ * failed to duplicate. Fix: allowlist-PICK only the writable create fields.
+ *
+ * This test asserts the body sent to createInvoice contains ONLY allowlisted
+ * fields (no payments/verifactu/operationType/documentNumber/total/…).
+ */
+export {};
+//# sourceMappingURL=intelligence-duplicate-invoice.test.d.ts.map

package/dist/__tests__/intelligence-duplicate-invoice.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intelligence-duplicate-invoice.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/intelligence-duplicate-invoice.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/__tests__/intelligence-duplicate-invoice.test.js

@@ -0,0 +1,108 @@
+/**
+ * Regression test for duplicate_invoice (intelligence.ts).
+ *
+ * Bug: duplicate_invoice fetched the FULL raw stored invoice (getInvoice returns
+ * the entire Firestore doc) and spread it into createInvoice, only blacklisting
+ * 6 fields. The create endpoint validates against a Zod `.strict()` schema that
+ * REJECTS unknown keys → HTTP 400, so any paid/sent/cancelled/e-invoiced invoice
+ * failed to duplicate. Fix: allowlist-PICK only the writable create fields.
+ *
+ * This test asserts the body sent to createInvoice contains ONLY allowlisted
+ * fields (no payments/verifactu/operationType/documentNumber/total/…).
+ */
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+class StubMcpServer {
+    tools = new Map();
+    registerTool(name, config, handler) {
+        this.tools.set(name, { name, config, handler });
+    }
+}
+// A realistic FULL stored invoice doc as getInvoice returns it: writable fields
+// PLUS many stored-only fields the strict create schema rejects.
+const STORED_INVOICE = {
+    id: "inv_123",
+    documentNumber: "2026-0042",
+    status: "paid",
+    total: 1210,
+    createdAt: "2026-05-01T10:00:00Z",
+    updatedAt: "2026-05-02T10:00:00Z",
+    // ── writable (must be copied) ──
+    clientName: "Acme Corp",
+    clientId: "cli_9",
+    clientAddress: "Gran Via 1, Madrid",
+    clientTaxId: "B12345678",
+    items: [{ description: "Consulting", quantity: 10, unitPrice: 100 }],
+    dueDate: "2026-06-01",
+    notes: "Thanks",
+    taxRate: 21,
+    irpfRate: 15,
+    equivalenceSurchargeRate: 0,
+    clientLocation: "peninsula",
+    prepayment: 0,
+    seriesId: "A",
+    // ── stored-only (must NOT be copied — would 400 the strict create schema) ──
+    payments: [{ amount: 1210, date: "2026-05-10" }],
+    amountPaid: 1210,
+    verifactu: { hash: "abc", chained: true },
+    eInvoice: { format: "facturae" },
+    operationType: "S1",
+    poNumber: "PO-77",
+    discountRate: 5,
+    createdBy: "user_x",
+    sentTo: "billing@acme.com",
+    sentAt: "2026-05-02T10:00:00Z",
+    cancelledAt: null,
+    attachments: ["a.pdf"],
+};
+const REJECTED_FIELDS = [
+    "payments", "amountPaid", "verifactu", "eInvoice", "operationType",
+    "poNumber", "discountRate", "createdBy", "sentTo", "sentAt",
+    "cancelledAt", "attachments", "documentNumber", "total", "createdAt", "updatedAt", "id",
+];
+const COPYABLE_FIELDS = [
+    "clientName", "clientId", "clientAddress", "clientTaxId", "items",
+    "notes", "taxRate", "irpfRate", "equivalenceSurchargeRate",
+    "clientLocation", "prepayment", "seriesId",
+];
+async function makeServerCapturing(captured) {
+    const server = new StubMcpServer();
+    const client = {
+        getInvoice: async (_id) => ({ ...STORED_INVOICE }),
+        createInvoice: async (data) => {
+            captured.body = data;
+            return { id: "inv_dup", status: "draft", ...data };
+        },
+    };
+    const { registerIntelligenceTools } = await import("../tools/intelligence.js");
+    registerIntelligenceTools(server, client);
+    return server;
+}
+describe("duplicate_invoice — allowlist pick", () => {
+    test("sends ONLY writable fields to createInvoice (no strict-schema rejects)", async () => {
+        const captured = {};
+        const server = await makeServerCapturing(captured);
+        const tool = server.tools.get("duplicate_invoice");
+        assert.ok(tool, "duplicate_invoice should be registered");
+        const result = await tool.handler({ id: "inv_123" });
+        assert.notEqual(result.isError, true, "duplicate should not error");
+        assert.ok(captured.body, "createInvoice should have been called");
+        for (const f of REJECTED_FIELDS) {
+            assert.equal(f in captured.body, false, `create body must NOT carry stored-only field "${f}"`);
+        }
+        for (const f of COPYABLE_FIELDS) {
+            assert.equal(f in captured.body, true, `create body must carry writable field "${f}"`);
+        }
+        assert.equal(captured.body.status, "draft", "status forced to draft");
+        assert.equal(typeof captured.body.issueDate, "string", "issueDate set");
+    });
+    test("honors newIssueDate + newDueDate overrides", async () => {
+        const captured = {};
+        const server = await makeServerCapturing(captured);
+        const tool = server.tools.get("duplicate_invoice");
+        await tool.handler({ id: "inv_123", newIssueDate: "2026-07-01", newDueDate: "2026-08-01" });
+        assert.equal(captured.body.issueDate, "2026-07-01");
+        assert.equal(captured.body.dueDate, "2026-08-01");
+    });
+});
+//# sourceMappingURL=intelligence-duplicate-invoice.test.js.map

package/dist/__tests__/intelligence-duplicate-invoice.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intelligence-duplicate-invoice.test.js","sourceRoot":"","sources":["../../src/__tests__/intelligence-duplicate-invoice.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAexC,MAAM,aAAa;IACjB,KAAK,GAA4E,IAAI,GAAG,EAAE,CAAC;IAC3F,YAAY,CAAC,IAAY,EAAE,MAAkB,EAAE,OAAoB;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAED,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,cAAc,GAAG;IACrB,EAAE,EAAE,SAAS;IACb,cAAc,EAAE,WAAW;IAC3B,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,sBAAsB;IACjC,kCAAkC;IAClC,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,OAAO;IACjB,aAAa,EAAE,oBAAoB;IACnC,WAAW,EAAE,WAAW;IACxB,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACpE,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE;IACZ,wBAAwB,EAAE,CAAC;IAC3B,cAAc,EAAE,WAAW;IAC3B,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,GAAG;IACb,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChD,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;IACzC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;IAChC,aAAa,EAAE,IAAI;IACnB,QAAQ,EAAE,OAAO;IACjB,YAAY,EAAE,CAAC;IACf,SAAS,EAAE,QAAQ;IACnB,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,sBAAsB;IAC9B,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,CAAC,OAAO,CAAC;CACd,CAAC;AAEX,MAAM,eAAe,GAAG;IACtB,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe;IAClE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ;IAC3D,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI;CACxF,CAAC;AACF,MAAM,eAAe,GAAG;IACtB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO;IACjE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,0BAA0B;IAC1D,gBAAgB,EAAE,YAAY,EAAE,UAAU;CAC3C,CAAC;AAEF,KAAK,UAAU,mBAAmB,CAAC,QAA4C;IAC7E,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;QAC1D,aAAa,EAAE,KAAK,EAAE,IAA6B,EAAE,EAAE;YACrD,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;QACrD,CAAC;KAC2D,CAAC;IAE/D,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC/E,yBAAyB,CACvB,MAAgF,EAChF,MAAM,CACP,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,QAAQ,GAAuC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAC;QACpE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC;QAElE,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAK,EAAE,KAAK,EAAE,iDAAiD,CAAC,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAK,EAAE,IAAI,EAAE,0CAA0C,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,IAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,QAAQ,GAAuC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAE,CAAC;QAEpD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/observability-redaction.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Trust test — no government ID, credential, or banking identifier may ever
+ * reach the external Langfuse observability service.
+ *
+ * Regression guard for the P0 finding (Codex audit 2026-06-22): the Langfuse
+ * tracer captured the RAW tool output BEFORE the OpenAI profile redaction
+ * wrapper ran, so taxId/secret/IBAN leaked into traces in every profile mode.
+ * The fix moved redaction INTO buildTracePayload, so the trace copy is redacted
+ * unconditionally. This test fails if any sensitive value survives into the
+ * serialized ingestion batch.
+ */
+export {};
+//# sourceMappingURL=observability-redaction.test.d.ts.map

package/dist/__tests__/observability-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability-redaction.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/observability-redaction.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/__tests__/observability-redaction.test.js

@@ -0,0 +1,94 @@
+/**
+ * Trust test — no government ID, credential, or banking identifier may ever
+ * reach the external Langfuse observability service.
+ *
+ * Regression guard for the P0 finding (Codex audit 2026-06-22): the Langfuse
+ * tracer captured the RAW tool output BEFORE the OpenAI profile redaction
+ * wrapper ran, so taxId/secret/IBAN leaked into traces in every profile mode.
+ * The fix moved redaction INTO buildTracePayload, so the trace copy is redacted
+ * unconditionally. This test fails if any sensitive value survives into the
+ * serialized ingestion batch.
+ */
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { buildTracePayload } from "../observability.js";
+import { redactClone, SENSITIVE_FIELD_NAMES } from "../redaction.js";
+const SECRETS = {
+    taxId: "B12345678",
+    nif: "12345678Z",
+    secret: "whsec_live_DEADBEEFCAFE",
+    iban: "ES9121000418450200051332",
+    passport: "PAX9988776",
+    apiKey: "fri_live_TOPSECRET",
+    accessToken: "ya29.A0ARrdaM-TOKEN",
+    password: "hunter2",
+};
+const SECRET_VALUES = Object.values(SECRETS);
+/** A realistic MCP tool result: structuredContent + a serialized JSON text block. */
+function mcpResultWithSecrets() {
+    return {
+        content: [{ type: "text", text: JSON.stringify({ id: "cli_1", ...SECRETS }) }],
+        structuredContent: {
+            client: { id: "cli_1", name: "Acme", ...SECRETS },
+            webhooks: [{ id: "wh_1", url: "https://x.test", secret: SECRETS.secret }],
+        },
+    };
+}
+function assertNoSecrets(serialized) {
+    for (const v of SECRET_VALUES) {
+        assert.ok(!serialized.includes(v), `sensitive value leaked into trace payload: ${v}`);
+    }
+}
+describe("observability redaction", () => {
+    test("buildTracePayload strips PII/credentials from output (success path)", () => {
+        const now = new Date("2026-06-22T10:00:00.000Z");
+        const batch = buildTracePayload({
+            toolName: "get_client",
+            input: { id: "cli_1", taxId: SECRETS.taxId },
+            output: mcpResultWithSecrets(),
+            isError: false,
+            startTime: now,
+            endTime: now,
+            traceId: "trace_1",
+            spanId: "span_1",
+            stub: null,
+        });
+        assertNoSecrets(JSON.stringify(batch));
+    });
+    test("buildTracePayload strips PII from input args even on the error path", () => {
+        const now = new Date("2026-06-22T10:00:00.000Z");
+        const batch = buildTracePayload({
+            toolName: "create_client",
+            input: { name: "Acme", ...SECRETS },
+            output: undefined,
+            isError: true,
+            // an error message that echoes the request body must not leak either
+            errorMessage: `Backend rejected payload: {"taxId":"${SECRETS.taxId}","secret":"${SECRETS.secret}"}`,
+            startTime: now,
+            endTime: now,
+            traceId: "trace_2",
+            spanId: "span_2",
+            stub: null,
+        });
+        assertNoSecrets(JSON.stringify(batch));
+    });
+    test("redactClone never mutates its argument", () => {
+        const original = mcpResultWithSecrets();
+        const before = JSON.stringify(original);
+        redactClone(original);
+        assert.equal(JSON.stringify(original), before, "redactClone must not mutate input");
+    });
+    test("redactClone preserves non-sensitive fields", () => {
+        const cloned = redactClone({ id: "cli_1", name: "Acme", total: 100, taxId: SECRETS.taxId });
+        assert.equal(cloned.id, "cli_1");
+        assert.equal(cloned.name, "Acme");
+        assert.equal(cloned.total, 100);
+        assert.notEqual(cloned.taxId, SECRETS.taxId);
+    });
+    test("the sensitive field set covers the critical Trust fields", () => {
+        for (const f of ["taxId", "secret", "iban", "apiKey", "accessToken", "password"]) {
+            assert.ok(SENSITIVE_FIELD_NAMES.includes(f), `missing critical sensitive field: ${f}`);
+        }
+    });
+});
+//# sourceMappingURL=observability-redaction.test.js.map

package/dist/__tests__/observability-redaction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability-redaction.test.js","sourceRoot":"","sources":["../../src/__tests__/observability-redaction.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAErE,MAAM,OAAO,GAAG;IACd,KAAK,EAAE,WAAW;IAClB,GAAG,EAAE,WAAW;IAChB,MAAM,EAAE,yBAAyB;IACjC,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,oBAAoB;IAC5B,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,SAAS;CACpB,CAAC;AACF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAE7C,qFAAqF;AACrF,SAAS,oBAAoB;IAC3B,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9E,iBAAiB,EAAE;YACjB,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE;YACjD,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,CACP,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EACvB,8CAA8C,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC5C,MAAM,EAAE,oBAAoB,EAAE;YAC9B,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE;YACnC,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;YACb,qEAAqE;YACrE,YAAY,EAAE,uCAAuC,OAAO,CAAC,KAAK,eAAe,OAAO,CAAC,MAAM,IAAI;YACnG,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,mCAAmC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAA4B,CAAC;QACvH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACpE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,qCAAqC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/openai-profile.test.js

@@ -9,6 +9,7 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
 import { applyOpenAIProfile } from "../openai-profile.js";
+import { SENSITIVE_FIELD_NAMES } from "../redaction.js";
 import { registerAllTools } from "../tools/register-all.js";
 import { registerAllPrompts } from "../prompts/register-all.js";
 class StubMcpServer {
@@ -128,5 +129,37 @@ describe("OpenAI profile", () => {
         assert.equal(serialized.includes("secret"), false);
         assert.equal(serialized.includes("should-not-leak"), false);
     });
+    test("no reviewed tool DECLARES a sensitive field in its outputSchema", () => {
+        const server = makeOpenAIServer();
+        // Recursively collect every object key declared by a Zod output schema.
+        const collectKeys = (schema, acc) => {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const def = schema?._def;
+            const typeName = def?.typeName;
+            if (typeName === "ZodObject") {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                for (const [key, value] of Object.entries(schema.shape)) {
+                    acc.add(key);
+                    collectKeys(value, acc);
+                }
+            }
+            else if (typeName === "ZodArray") {
+                collectKeys(def.type, acc);
+            }
+            else if (typeName === "ZodOptional" || typeName === "ZodNullable") {
+                collectKeys(def.innerType, acc);
+            }
+            return acc;
+        };
+        for (const tool of server.tools.values()) {
+            const out = tool.config.outputSchema;
+            if (!out)
+                continue;
+            const keys = collectKeys(out, new Set());
+            for (const field of SENSITIVE_FIELD_NAMES) {
+                assert.equal(keys.has(field), false, `${tool.name} outputSchema must not declare sensitive field "${field}"`);
+            }
+        }
+    });
 });
 //# sourceMappingURL=openai-profile.test.js.map

package/dist/__tests__/openai-profile.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai-profile.test.js","sourceRoot":"","sources":["../../src/__tests__/openai-profile.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAuBhE,MAAM,aAAa;IACjB,KAAK,GAAgC,IAAI,GAAG,EAAE,CAAC;IAC/C,OAAO,GAAa,EAAE,CAAC;IACvB,SAAS,GAAa,EAAE,CAAC;IAEzB,YAAY,CAAC,IAAY,EAAE,MAAkB,EAAE,OAAoB;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;YAChD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO;oBACL,EAAE,EAAE,YAAY;oBAChB,IAAI,EAAE,kBAAkB;oBACxB,KAAK,EAAE,kBAAkB;oBACzB,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,CAAC;gBACT,KAAK;aACN,CAAC;QACJ,CAAC;KACF,CAAkB,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,gBAAgB,CACd,MAAgF,EAChF,UAAU,EAAE,CACb,CAAC;IACF,kBAAkB,CAAC,MAAgF,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAEvC,KAAK,MAAM,UAAU,IAAI;YACvB,qBAAqB;YACrB,sBAAsB;YACtB,eAAe;YACf,uBAAuB;YACvB,2BAA2B;YAC3B,oBAAoB;YACpB,gBAAgB;YAChB,oBAAoB;SACrB,EAAE,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,UAAU,qCAAqC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC;aACrE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACxB,IAAI,EAAE,CAAC;QAEV,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE;YAC/B,gBAAgB;YAChB,cAAc;YACd,YAAY;YACZ,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,mFAAmF;YACnF,MAAM,CAAC,KAAK,CACV,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,EACjD,SAAS,EACT,GAAG,IAAI,CAAC,IAAI,8CAA8C,CAC3D,CAAC;YACF,MAAM,CAAC,EAAE,CACP,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EACjD,GAAG,IAAI,CAAC,IAAI,oDAAoD,CACjE,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,MAAM,CAAC,WAAW,EACrD,sBAAsB,CACvB,CAAC;QACF,0EAA0E;QAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE1C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"openai-profile.test.js","sourceRoot":"","sources":["../../src/__tests__/openai-profile.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAuBhE,MAAM,aAAa;IACjB,KAAK,GAAgC,IAAI,GAAG,EAAE,CAAC;IAC/C,OAAO,GAAa,EAAE,CAAC;IACvB,SAAS,GAAa,EAAE,CAAC;IAEzB,YAAY,CAAC,IAAY,EAAE,MAAkB,EAAE,OAAoB;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;YAChD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO;oBACL,EAAE,EAAE,YAAY;oBAChB,IAAI,EAAE,kBAAkB;oBACxB,KAAK,EAAE,kBAAkB;oBACzB,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,CAAC;gBACT,KAAK;aACN,CAAC;QACJ,CAAC;KACF,CAAkB,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,gBAAgB,CACd,MAAgF,EAChF,UAAU,EAAE,CACb,CAAC;IACF,kBAAkB,CAAC,MAAgF,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAEvC,KAAK,MAAM,UAAU,IAAI;YACvB,qBAAqB;YACrB,sBAAsB;YACtB,eAAe;YACf,uBAAuB;YACvB,2BAA2B;YAC3B,oBAAoB;YACpB,gBAAgB;YAChB,oBAAoB;SACrB,EAAE,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,UAAU,qCAAqC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC;aACrE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACxB,IAAI,EAAE,CAAC;QAEV,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE;YAC/B,gBAAgB;YAChB,cAAc;YACd,YAAY;YACZ,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,mFAAmF;YACnF,MAAM,CAAC,KAAK,CACV,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,EACjD,SAAS,EACT,GAAG,IAAI,CAAC,IAAI,8CAA8C,CAC3D,CAAC;YACF,MAAM,CAAC,EAAE,CACP,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EACjD,GAAG,IAAI,CAAC,IAAI,oDAAoD,CACjE,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,MAAM,CAAC,WAAW,EACrD,sBAAsB,CACvB,CAAC;QACF,0EAA0E;QAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE1C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC3E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,wEAAwE;QACxE,MAAM,WAAW,GAAG,CAAC,MAAe,EAAE,GAAgB,EAAe,EAAE;YACrE,8DAA8D;YAC9D,MAAM,GAAG,GAAI,MAAc,EAAE,IAAI,CAAC;YAClC,MAAM,QAAQ,GAAuB,GAAG,EAAE,QAAQ,CAAC;YACnD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7B,8DAA8D;gBAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAE,MAAc,CAAC,KAAgC,CAAC,EAAE,CAAC;oBAC5F,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACb,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACnC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACpE,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBAC1C,MAAM,CAAC,KAAK,CACV,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EACf,KAAK,EACL,GAAG,IAAI,CAAC,IAAI,mDAAmD,KAAK,GAAG,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/observability.d.ts

@@ -27,6 +27,36 @@ export declare function initLangfuse(config: {
     secretKey?: string;
     baseUrl?: string;
 }): void;
+interface LangfuseSpanBody {
+    id: string;
+    traceId: string;
+    name: string;
+    startTime: string;
+    endTime: string;
+    input?: unknown;
+    output?: unknown;
+    metadata?: Record<string, unknown>;
+    level?: "DEFAULT" | "DEBUG" | "WARNING" | "ERROR";
+    statusMessage?: string;
+}
+interface LangfuseTraceBody {
+    id: string;
+    name: string;
+    timestamp: string;
+    input?: unknown;
+    output?: unknown;
+    metadata?: Record<string, unknown>;
+    tags?: string[];
+    userId?: string;
+}
+interface IngestionBatch {
+    batch: Array<{
+        type: string;
+        id: string;
+        timestamp: string;
+        body: LangfuseTraceBody | LangfuseSpanBody;
+    }>;
+}
 interface StubMarker {
     plannedEndpoint?: string;
     note?: string;
@@ -61,6 +91,36 @@ interface TraceContext {
  * Call once from server init; applies to all subsequent traces.
  */
 export declare function setTraceContext(ctx: TraceContext): void;
+interface TracePayloadParams {
+    toolName: string;
+    /** Raw tool input args (redacted before serialization). */
+    input: unknown;
+    /** Raw tool output (redacted before serialization); ignored when isError. */
+    output: unknown;
+    isError: boolean;
+    errorMessage?: string;
+    startTime: Date;
+    endTime: Date;
+    traceId: string;
+    spanId: string;
+    /** Already-hashed user id, or undefined. */
+    userIdHashed?: string;
+    clientName?: string;
+    mcpVersion?: string;
+    /** Fabricated-stub marker, or null on a genuine result. */
+    stub: StubMarker | null;
+}
+/**
+ * Builds the Langfuse trace+span ingestion batch for a single tool call.
+ *
+ * CRITICAL (Trust): `input` and `output` are passed through {@link redactClone}
+ * before they enter the payload, so government IDs (taxId/NIF/CIF), banking
+ * identifiers (IBAN), webhook signing secrets, and auth tokens NEVER reach the
+ * external Langfuse service — in ANY profile mode. The tool-call output handed
+ * to the user is redacted later (OpenAI mode only); this redacts the trace copy
+ * unconditionally. Exported so a test can assert no sensitive value survives.
+ */
+export declare function buildTracePayload(p: TracePayloadParams): IngestionBatch;
 /**
  * Wraps a tool handler fn and sends a Langfuse trace+span for the call.
  *

package/dist/observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAkCH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAQP;AAgED,UAAU,UAAU;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CA0BpE;AAkCD,UAAU,YAAY;IACpB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAuIZ"}
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAoCH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAQP;AA2BD,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,cAAc;IACtB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAAA;KAAE,CAAC,CAAC;CAC3G;AAWD,UAAU,UAAU;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CA0BpE;AAkCD,UAAU,YAAY;IACpB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAEvD;AAID,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,GAAG,cAAc,CA2EvE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CA+EZ"}

package/dist/observability.js

@@ -18,6 +18,7 @@
  *
  * Docs: https://langfuse.com/docs/api/reference/overview
  */
+import { redactClone, redactText } from "./redaction.js";
 function getConfig() {
     let publicKey;
     let secretKey;
@@ -147,6 +148,83 @@ let _sessionContext = {};
 export function setTraceContext(ctx) {
     _sessionContext = { ..._sessionContext, ...ctx };
 }
+/**
+ * Builds the Langfuse trace+span ingestion batch for a single tool call.
+ *
+ * CRITICAL (Trust): `input` and `output` are passed through {@link redactClone}
+ * before they enter the payload, so government IDs (taxId/NIF/CIF), banking
+ * identifiers (IBAN), webhook signing secrets, and auth tokens NEVER reach the
+ * external Langfuse service — in ANY profile mode. The tool-call output handed
+ * to the user is redacted later (OpenAI mode only); this redacts the trace copy
+ * unconditionally. Exported so a test can assert no sensitive value survives.
+ */
+export function buildTracePayload(p) {
+    const { toolName, input, output, isError, errorMessage, startTime, endTime, traceId, spanId, userIdHashed, clientName, mcpVersion, stub, } = p;
+    const stubbed = stub !== null;
+    // success: false whenever the call threw OR returned a fabricated stub body.
+    const success = !isError && !stubbed;
+    const stubNote = stub?.note ??
+        (stub?.plannedEndpoint
+            ? `Backend endpoint not yet available: ${stub.plannedEndpoint}`
+            : undefined);
+    // ── Redact BEFORE the payload is built (never mutates the live response) ──
+    const safeArgs = redactClone(input);
+    const safeError = errorMessage ? redactText(errorMessage) : errorMessage;
+    const safeOutput = isError ? { error: safeError } : redactClone(output);
+    const traceBody = {
+        id: traceId,
+        name: "mcp_request",
+        timestamp: startTime.toISOString(),
+        input: { tool: toolName, args: safeArgs },
+        output: safeOutput,
+        metadata: {
+            tool: toolName,
+            clientName,
+            mcpVersion,
+            // FALSE on a thrown error AND on a fabricated-stub fallback.
+            success,
+            ...(stubbed
+                ? {
+                    stub: true,
+                    ...(stub?.plannedEndpoint ? { plannedEndpoint: stub.plannedEndpoint } : {}),
+                    ...(stubNote ? { note: stubNote } : {}),
+                }
+                : {}),
+        },
+        tags: [`mcp.tool.${toolName}`, ...(stubbed ? ["mcp.stub"] : [])],
+        ...(userIdHashed ? { userId: userIdHashed } : {}),
+    };
+    const spanBody = {
+        id: spanId,
+        traceId,
+        name: `tool.${toolName}`,
+        startTime: startTime.toISOString(),
+        endTime: endTime.toISOString(),
+        input: safeArgs,
+        output: safeOutput,
+        metadata: {
+            durationMs: endTime.getTime() - startTime.getTime(),
+            clientName,
+            mcpVersion,
+            ...(stubbed ? { stub: true } : {}),
+        },
+        // ERROR on a thrown error; WARNING on a fabricated-stub fallback (the call
+        // "succeeded" mechanically but returned no real backend data); DEFAULT only
+        // on a genuine success.
+        level: isError ? "ERROR" : stubbed ? "WARNING" : "DEFAULT",
+        ...(isError && safeError
+            ? { statusMessage: safeError }
+            : stubbed && stubNote
+                ? { statusMessage: stubNote }
+                : {}),
+    };
+    return {
+        batch: [
+            { type: "trace-create", id: newId(), timestamp: startTime.toISOString(), body: traceBody },
+            { type: "span-create", id: newId(), timestamp: startTime.toISOString(), body: spanBody },
+        ],
+    };
+}
 /**
  * Wraps a tool handler fn and sends a Langfuse trace+span for the call.
  *
@@ -193,82 +271,29 @@ export async function traceMCPTool(toolName, input, fn) {
         // success. This is the central fix: it covers every stub branch regardless of
         // which tool produced it, because the stub path never reaches the catch above.
         const stub = isError ? null : inspectStubMarker(output);
-        const stubbed = stub !== null;
-        // success: false whenever the call threw OR returned a fabricated stub body.
-        const success = !isError && !stubbed;
-        const stubNote = stub?.note ??
-            (stub?.plannedEndpoint
-                ? `Backend endpoint not yet available: ${stub.plannedEndpoint}`
-                : undefined);
         // Fire-and-forget — build and send async, never awaited
         void (async () => {
             try {
                 // Hash PII fields
                 const userIdRaw = _sessionContext.userId;
                 const userIdHashed = userIdRaw ? await hashPii(userIdRaw) : undefined;
-                const traceBody = {
-                    id: traceId,
-                    name: "mcp_request",
-                    timestamp: startTime.toISOString(),
-                    input: { tool: toolName, args: input },
-                    output: isError ? { error: errorMessage } : output,
-                    metadata: {
-                        tool: toolName,
-                        clientName: _sessionContext.clientName,
-                        mcpVersion: _sessionContext.mcpVersion,
-                        // FALSE on a thrown error AND on a fabricated-stub fallback.
-                        success,
-                        ...(stubbed
-                            ? {
-                                stub: true,
-                                ...(stub?.plannedEndpoint ? { plannedEndpoint: stub.plannedEndpoint } : {}),
-                                ...(stubNote ? { note: stubNote } : {}),
-                            }
-                            : {}),
-                    },
-                    tags: [`mcp.tool.${toolName}`, ...(stubbed ? ["mcp.stub"] : [])],
-                    ...(userIdHashed ? { userId: userIdHashed } : {}),
-                };
-                const spanBody = {
-                    id: spanId,
-                    traceId,
-                    name: `tool.${toolName}`,
-                    startTime: startTime.toISOString(),
-                    endTime: endTime.toISOString(),
+                // buildTracePayload redacts input/output (taxId/secret/IBAN/tokens) so
+                // the external Langfuse service never stores cleartext PII or credentials.
+                const batch = buildTracePayload({
+                    toolName,
                     input,
-                    output: isError ? { error: errorMessage } : output,
-                    metadata: {
-                        durationMs: endTime.getTime() - startTime.getTime(),
-                        clientName: _sessionContext.clientName,
-                        mcpVersion: _sessionContext.mcpVersion,
-                        ...(stubbed ? { stub: true } : {}),
-                    },
-                    // ERROR on a thrown error; WARNING on a fabricated-stub fallback (the
-                    // call "succeeded" mechanically but returned no real backend data);
-                    // DEFAULT only on a genuine success.
-                    level: isError ? "ERROR" : stubbed ? "WARNING" : "DEFAULT",
-                    ...(isError && errorMessage
-                        ? { statusMessage: errorMessage }
-                        : stubbed && stubNote
-                            ? { statusMessage: stubNote }
-                            : {}),
-                };
-                const batch = {
-                    batch: [
-                        {
-                            type: "trace-create",
-                            id: newId(),
-                            timestamp: startTime.toISOString(),
-                            body: traceBody,
-                        },
-                        {
-                            type: "span-create",
-                            id: newId(),
-                            timestamp: startTime.toISOString(),
-                            body: spanBody,
-                        },
-                    ],
-                };
+                    output,
+                    isError,
+                    errorMessage,
+                    startTime,
+                    endTime,
+                    traceId,
+                    spanId,
+                    userIdHashed,
+                    clientName: _sessionContext.clientName,
+                    mcpVersion: _sessionContext.mcpVersion,
+                    stub,
+                });
                 await sendBatch(config, batch);
             }
             catch (langfuseErr) {

package/dist/observability.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.js","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAaH,SAAS,SAAS;IAChB,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,IAAI,OAA2B,CAAC;IAEhC,UAAU;IACV,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;QACnD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC5C,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC5C,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,+EAA+E;AAE/E,IAAI,SAAS,GAA0B,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAI5B;IACC,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3D,SAAS,GAAG;YACV,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,SAAS,IAAI,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAiCD,gFAAgF;AAEhF,SAAS,KAAK;IACZ,+DAA+D;IAC/D,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,EAA6B,CAAC,CAAC;IAEjF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7F,OAAO;gBACL,eAAe,EAAE,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,kBAAkB,CAAY,CAAC,CAAC,CAAC,SAAS;gBAC9G,IAAI,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;aAC9E,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,IAAI,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO;gBACL,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAW;gBAClD,IAAI,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;aAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,SAAS,CAAC,MAAsB,EAAE,KAAqB;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,uBAAuB,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,SAAS,WAAW,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,kCAAkC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,8BAA8B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC1E,SAAS,EAAE,eAAe;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,qFAAqF;AACrF,IAAI,eAAe,GAAiB,EAAE,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAiB;IAC/C,eAAe,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,GAAG,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,KAAc,EACd,EAAoB;IAEpB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAE/B,oCAAoC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,IAAI,MAAS,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAgC,CAAC;IACrC,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QACpB,MAAM,GAAG,MAAM,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,CAAC;QACf,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAE3B,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,yEAAyE;QACzE,+EAA+E;QAC/E,8EAA8E;QAC9E,+EAA+E;QAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC;QAC9B,6EAA6E;QAC7E,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;QACrC,MAAM,QAAQ,GACZ,IAAI,EAAE,IAAI;YACV,CAAC,IAAI,EAAE,eAAe;gBACpB,CAAC,CAAC,uCAAuC,IAAI,CAAC,eAAe,EAAE;gBAC/D,CAAC,CAAC,SAAS,CAAC,CAAC;QAEjB,wDAAwD;QACxD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,kBAAkB;gBAClB,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC;gBACzC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEtE,MAAM,SAAS,GAAsB;oBACnC,EAAE,EAAE,OAAO;oBACX,IAAI,EAAE,aAAa;oBACnB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;oBACtC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,MAAM;oBAClD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,eAAe,CAAC,UAAU;wBACtC,UAAU,EAAE,eAAe,CAAC,UAAU;wBACtC,6DAA6D;wBAC7D,OAAO;wBACP,GAAG,CAAC,OAAO;4BACT,CAAC,CAAC;gCACE,IAAI,EAAE,IAAI;gCACV,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC3E,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACxC;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;oBACD,IAAI,EAAE,CAAC,YAAY,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAChE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC;gBAEF,MAAM,QAAQ,GAAqB;oBACjC,EAAE,EAAE,MAAM;oBACV,OAAO;oBACP,IAAI,EAAE,QAAQ,QAAQ,EAAE;oBACxB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;oBAClC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;oBAC9B,KAAK;oBACL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,MAAM;oBAClD,QAAQ,EAAE;wBACR,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;wBACnD,UAAU,EAAE,eAAe,CAAC,UAAU;wBACtC,UAAU,EAAE,eAAe,CAAC,UAAU;wBACtC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnC;oBACD,sEAAsE;oBACtE,oEAAoE;oBACpE,qCAAqC;oBACrC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBAC1D,GAAG,CAAC,OAAO,IAAI,YAAY;wBACzB,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE;wBACjC,CAAC,CAAC,OAAO,IAAI,QAAQ;4BACnB,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE;4BAC7B,CAAC,CAAC,EAAE,CAAC;iBACV,CAAC;gBAEF,MAAM,KAAK,GAAmB;oBAC5B,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,cAAc;4BACpB,EAAE,EAAE,KAAK,EAAE;4BACX,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;4BAClC,IAAI,EAAE,SAAS;yBAChB;wBACD;4BACE,IAAI,EAAE,aAAa;4BACnB,EAAE,EAAE,KAAK,EAAE;4BACX,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;4BAClC,IAAI,EAAE,QAAQ;yBACf;qBACF;iBACF,CAAC;gBAEF,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,2BAA2B;gBAC3B,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,YAAY;oBACrB,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,yCAAyC,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;oBAC5H,SAAS,EAAE,gBAAgB;oBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;AACH,CAAC"}
+{"version":3,"file":"observability.js","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAazD,SAAS,SAAS;IAChB,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,IAAI,OAA2B,CAAC;IAEhC,UAAU;IACV,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;QACnD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC5C,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC5C,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,+EAA+E;AAE/E,IAAI,SAAS,GAA0B,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAI5B;IACC,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3D,SAAS,GAAG;YACV,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,SAAS,IAAI,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAiCD,gFAAgF;AAEhF,SAAS,KAAK;IACZ,+DAA+D;IAC/D,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,EAA6B,CAAC,CAAC;IAEjF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7F,OAAO;gBACL,eAAe,EAAE,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,kBAAkB,CAAY,CAAC,CAAC,CAAC,SAAS;gBAC9G,IAAI,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;aAC9E,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,IAAI,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO;gBACL,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAW;gBAClD,IAAI,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;aAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,SAAS,CAAC,MAAsB,EAAE,KAAqB;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,uBAAuB,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,SAAS,WAAW,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,kCAAkC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,8BAA8B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC1E,SAAS,EAAE,eAAe;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,qFAAqF;AACrF,IAAI,eAAe,GAAiB,EAAE,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAiB;IAC/C,eAAe,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,GAAG,EAAE,CAAC;AACnD,CAAC;AAwBD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAqB;IACrD,MAAM,EACJ,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAC9C,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,GAChF,GAAG,CAAC,CAAC;IAEN,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;IACrC,MAAM,QAAQ,GACZ,IAAI,EAAE,IAAI;QACV,CAAC,IAAI,EAAE,eAAe;YACpB,CAAC,CAAC,uCAAuC,IAAI,CAAC,eAAe,EAAE;YAC/D,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAExE,MAAM,SAAS,GAAsB;QACnC,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,UAAU;YACV,6DAA6D;YAC7D,OAAO;YACP,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,IAAI,EAAE,IAAI;oBACV,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxC;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,IAAI,EAAE,CAAC,YAAY,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;IAEF,MAAM,QAAQ,GAAqB;QACjC,EAAE,EAAE,MAAM;QACV,OAAO;QACP,IAAI,EAAE,QAAQ,QAAQ,EAAE;QACxB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAC9B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE;YACR,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;YACnD,UAAU;YACV,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,wBAAwB;QACxB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC1D,GAAG,CAAC,OAAO,IAAI,SAAS;YACtB,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;YAC9B,CAAC,CAAC,OAAO,IAAI,QAAQ;gBACnB,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE;gBAC7B,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1F,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SACzF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,KAAc,EACd,EAAoB;IAEpB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAE/B,oCAAoC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,IAAI,MAAS,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAgC,CAAC;IACrC,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QACpB,MAAM,GAAG,MAAM,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,CAAC;QACf,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAE3B,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,yEAAyE;QACzE,+EAA+E;QAC/E,8EAA8E;QAC9E,+EAA+E;QAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAExD,wDAAwD;QACxD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,kBAAkB;gBAClB,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC;gBACzC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEtE,uEAAuE;gBACvE,2EAA2E;gBAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC;oBAC9B,QAAQ;oBACR,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,YAAY;oBACZ,SAAS;oBACT,OAAO;oBACP,OAAO;oBACP,MAAM;oBACN,YAAY;oBACZ,UAAU,EAAE,eAAe,CAAC,UAAU;oBACtC,UAAU,EAAE,eAAe,CAAC,UAAU;oBACtC,IAAI;iBACL,CAAC,CAAC;gBAEH,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,2BAA2B;gBAC3B,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,YAAY;oBACrB,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,yCAAyC,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;oBAC5H,SAAS,EAAE,gBAAgB;oBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/openai-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-profile.d.ts","sourceRoot":"","sources":["../src/openai-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAkRH;;;GAGG;AACH,eAAO,MAAM,UAAU,QAQkB,CAAC;AAM1C;;;;;;;;;;;;;;;;GAgBG;AAEH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CA8HpD;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,QAA4B,CAAC;AAE/D,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CACzC,CAAC;AAEvB,iEAAiE;AACjE,eAAO,MAAM,8BAA8B,QAAyB,CAAC"}
+{"version":3,"file":"openai-profile.d.ts","sourceRoot":"","sources":["../src/openai-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA6SH;;;GAGG;AACH,eAAO,MAAM,UAAU,QAQkB,CAAC;AAM1C;;;;;;;;;;;;;;;;GAgBG;AAEH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAsIpD;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,QAA4B,CAAC;AAE/D,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CACzC,CAAC;AAEvB,iEAAiE;AACjE,eAAO,MAAM,8BAA8B,QAAyB,CAAC"}

package/dist/openai-profile.js

@@ -20,6 +20,8 @@
  *
  * @see https://developers.openai.com/apps-sdk/app-submission-guidelines
  */
+import { z } from "zod";
+import { SENSITIVE_FIELD_NAMES, deepRedact, redactText } from "./redaction.js";
 const PROFILE = {
     // -- OpenAI-reviewed core surface ----------------------------------------
     //
@@ -170,53 +172,80 @@ const PROFILE = {
     },
     // ── Output fields redacted ─────────────────────────────────────────
     // Stripped from structuredContent and text in ALL tool responses.
-    // Includes synonyms that the Frihet API may return via .passthrough() schemas.
-    redactOutputFields: [
-        "taxId", "tax_id", // Primary field name + snake_case variant
-        "nif", "cif", "vatNumber", // Spanish/EU synonyms for government tax ID
-        "vat_number", "vatId", "vat_id",
-        "secret", // Webhook signing credential
-        "iban", "bankAccount", // Banking identifiers (if exposed via passthrough)
-        "bank_account", "accountNumber",
-        "idDocument", "documentNumber", // Guest/customer government document fields
-        "passport", "passportNumber",
-        "dni", "nationalId", "national_id",
-        "ssn", "socialSecurityNumber", "social_security_number",
-        "apiKey", "api_key",
-        "accessToken", "access_token", "refreshToken", "refresh_token",
-        "password", "mfa", "otp",
-    ],
+    // Single source of truth lives in redaction.ts (shared with observability.ts
+    // so Langfuse traces redact the EXACT same field set).
+    redactOutputFields: SENSITIVE_FIELD_NAMES,
 };
 /* ------------------------------------------------------------------ */
-/*  Deep field redaction                                                */
+/*  Deep field redaction — shared policy in redaction.ts               */
 /* ------------------------------------------------------------------ */
-/** Recursively removes named fields from an object/array tree. */
-function deepRedact(obj, fields) {
-    if (obj === null || typeof obj !== "object")
-        return;
-    if (Array.isArray(obj)) {
-        for (const item of obj)
-            deepRedact(item, fields);
-        return;
+//
+// deepRedact (in-place DELETE) + redactText (regex) now live in ./redaction.ts
+// so observability.ts redacts the SAME field set before tracing to Langfuse.
+/* ------------------------------------------------------------------ */
+/*  Output SCHEMA stripping (descriptor-level)                          */
+/* ------------------------------------------------------------------ */
+/**
+ * Returns a Zod output schema with sensitive fields removed at EVERY depth.
+ *
+ * Runtime output redaction (deepRedact in the handler wrapper) hides the
+ * VALUES, but the advertised `outputSchema` descriptor still DECLARES taxId /
+ * secret etc. at tools/list — which OpenAI's submission review auto-detects as
+ * exposed government IDs / credentials. This strips them from the descriptor too.
+ *
+ * Surgical: only the object/array nodes on the path to a sensitive field are
+ * rebuilt; untouched branches are returned BY REFERENCE so their `.describe()`
+ * metadata and `.passthrough()` behavior are preserved. A schema with no
+ * sensitive field anywhere is returned unchanged (identity).
+ */
+function stripSensitiveOutputSchema(schema, fields) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const def = schema?._def;
+    const typeName = def?.typeName;
+    if (typeName === "ZodObject") {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const shape = schema.shape;
+        const newShape = {};
+        let changed = false;
+        for (const [key, value] of Object.entries(shape)) {
+            if (fields.includes(key)) {
+                changed = true;
+                continue; // drop the sensitive field entirely from the descriptor
+            }
+            const stripped = stripSensitiveOutputSchema(value, fields);
+            if (stripped !== value)
+                changed = true;
+            newShape[key] = stripped;
+        }
+        if (!changed)
+            return schema;
+        let rebuilt = z.object(newShape);
+        if (typeof def.description === "string")
+            rebuilt = rebuilt.describe(def.description);
+        return rebuilt;
     }
-    const record = obj;
-    for (const field of fields) {
-        if (field in record)
-            delete record[field];
+    if (typeName === "ZodArray") {
+        const inner = def.type;
+        const stripped = stripSensitiveOutputSchema(inner, fields);
+        if (stripped === inner)
+            return schema;
+        let rebuilt = z.array(stripped);
+        if (typeof def.description === "string")
+            rebuilt = rebuilt.describe(def.description);
+        return rebuilt;
     }
-    for (const value of Object.values(record)) {
-        deepRedact(value, fields);
+    if (typeName === "ZodOptional") {
+        const inner = def.innerType;
+        const stripped = stripSensitiveOutputSchema(inner, fields);
+        return stripped === inner ? schema : z.optional(stripped);
     }
-}
-/** Best-effort redaction of JSON field patterns from display text. */
-function redactText(text, fields) {
-    let result = text;
-    for (const field of fields) {
-        // Remove "field": "value", or "field": value patterns
-        result = result.replace(new RegExp(`\\s*"${field}"\\s*:\\s*(?:"[^"]*"|null|true|false|\\d+(?:\\.\\d+)?)\\s*,?`, "g"), "");
+    if (typeName === "ZodNullable") {
+        const inner = def.innerType;
+        const stripped = stripSensitiveOutputSchema(inner, fields);
+        return stripped === inner ? schema : z.nullable(stripped);
     }
-    // Clean up trailing commas before } or ] left by removals
-    return result.replace(/,(\s*[}\]])/g, "$1");
+    // Primitives, unions, records, and anything else: leave untouched.
+    return schema;
 }
 /* ------------------------------------------------------------------ */
 /*  Resources excluded / redacted in OpenAI mode                       */
@@ -306,6 +335,13 @@ export function applyOpenAIProfile(server) {
                 delete config.inputSchema[field];
             }
         }
+        // 4b. Strip sensitive fields from the OUTPUT schema descriptor too.
+        // The handler wrapper (step 5) redacts VALUES at runtime; this removes the
+        // field DECLARATIONS (taxId/secret/iban/…) from the outputSchema advertised
+        // at tools/list, so OpenAI review never sees a gov-ID/credential field.
+        if (config.outputSchema) {
+            config.outputSchema = stripSensitiveOutputSchema(config.outputSchema, fieldsToRedact);
+        }
         // 5. Wrap handler to redact sensitive output fields
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const wrappedHandler = async (input) => {

package/dist/openai-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai-profile.js","sourceRoot":"","sources":["../src/openai-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAyBH,MAAM,OAAO,GAAkB;IAC7B,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,eAAe;QACf,aAAa;QACb,iBAAiB;QACjB,iBAAiB;QACjB,eAAe;QACf,aAAa;QACb,cAAc;QACd,YAAY;QACZ,sBAAsB;QACtB,wBAAwB;QACxB,mBAAmB;QACnB,eAAe;QACf,aAAa;QACb,aAAa;QACb,WAAW;QACX,cAAc;QACd,YAAY;QACZ,eAAe;QACf,aAAa;QAEb,eAAe;QACf,gBAAgB;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,uBAAuB;QACvB,qBAAqB;QACrB,oBAAoB;QACpB,gBAAgB;QAChB,cAAc;QACd,eAAe;QAEf,eAAe;QACf,gBAAgB;QAChB,mBAAmB;QACnB,gBAAgB;QAChB,eAAe;QACf,gBAAgB;QAChB,cAAc;QACd,eAAe;QAEf,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,uBAAuB;QACvB,oBAAoB;QACpB,gBAAgB;QAChB,cAAc;QACd,eAAe;QACf,gBAAgB;QAEhB,gDAAgD;QAChD,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,qBAAqB,EAAG,wDAAwD;QAChF,sBAAsB,EAAE,wDAAwD;KACjF,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,cAAc,EAAE,IAAI;IAEpB,uEAAuE;IACvE,yEAAyE;IACzE,mBAAmB,EAAE;QACnB,YAAY,EAAI,EAAE,aAAa,EAAE,IAAI,EAAE;QACvC,UAAU,EAAM,EAAE,aAAa,EAAE,IAAI,EAAE;QACvC,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;QACvC,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;KACxC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oBAAoB,EAAE;QACpB,YAAY,EACV,uDAAuD;YACvD,sCAAsC;YACtC,sDAAsD;YACtD,iDAAiD;QAEnD,aAAa,EACX,4DAA4D;YAC5D,sDAAsD;YACtD,uDAAuD;YACvD,4DAA4D;YAC5D,0DAA0D;QAE5D,aAAa,EACX,6FAA6F;YAC7F,mEAAmE;YACnE,gFAAgF;QAElF,YAAY,EACV,kEAAkE;YAClE,sCAAsC;YACtC,oEAAoE;YACpE,iDAAiD;QAEnD,aAAa,EACX,4DAA4D;YAC5D,+DAA+D;YAC/D,mEAAmE;YACnE,6DAA6D;YAC7D,4DAA4D;QAE9D,aAAa,EACX,6FAA6F;YAC7F,uEAAuE;YACvE,kFAAkF;QAEpF,YAAY,EACV,mFAAmF;YACnF,8DAA8D;YAC9D,wFAAwF;YACxF,4CAA4C;YAC5C,kFAAkF;QAEpF,UAAU,EACR,gFAAgF;YAChF,sEAAsE;YACtE,wFAAwF;YACxF,4CAA4C;YAC5C,qFAAqF;QAEvF,cAAc,EACZ,+EAA+E;YAC/E,qFAAqF;YACrF,qFAAqF;YACrF,gDAAgD;YAChD,wFAAwF;YACxF,6FAA6F;YAC7F,0CAA0C;QAE5C,cAAc,EACZ,kEAAkE;YAClE,2DAA2D;YAC3D,0FAA0F;YAC1F,6CAA6C;KAChD;IAED,sEAAsE;IACtE,kEAAkE;IAClE,uDAAuD;IACvD,gBAAgB,EAAE;QAChB,aAAa,EAAG,CAAC,OAAO,CAAC,EAAI,6CAA6C;QAC1E,aAAa,EAAG,CAAC,OAAO,CAAC;QACzB,aAAa,EAAG,CAAC,OAAO,CAAC;QACzB,aAAa,EAAG,CAAC,OAAO,CAAC;QACzB,YAAY,EAAI,CAAC,IAAI,CAAC,EAAO,kDAAkD;QAC/E,UAAU,EAAM,CAAC,IAAI,CAAC;QACtB,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAG,iDAAiD;QAC9E,cAAc,EAAE,CAAC,QAAQ,CAAC;KAC3B;IAED,sEAAsE;IACtE,kEAAkE;IAClE,+EAA+E;IAC/E,kBAAkB,EAAE;QAClB,OAAO,EAAE,QAAQ,EAAc,0CAA0C;QACzE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAM,4CAA4C;QAC3E,YAAY,EAAE,OAAO,EAAE,QAAQ;QAC/B,QAAQ,EAAuB,6BAA6B;QAC5D,MAAM,EAAE,aAAa,EAAU,mDAAmD;QAClF,cAAc,EAAE,eAAe;QAC/B,YAAY,EAAE,gBAAgB,EAAE,4CAA4C;QAC5E,UAAU,EAAE,gBAAgB;QAC5B,KAAK,EAAE,YAAY,EAAE,aAAa;QAClC,KAAK,EAAE,sBAAsB,EAAE,wBAAwB;QACvD,QAAQ,EAAE,SAAS;QACnB,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe;QAC9D,UAAU,EAAE,KAAK,EAAE,KAAK;KACzB;CACF,CAAC;AAEF,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAExE,kEAAkE;AAClE,SAAS,UAAU,CAAC,GAAY,EAAE,MAAgB;IAChD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO;IAEpD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,GAAG;YAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,IAAY,EAAE,MAAgB;IAChD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,sDAAsD;QACtD,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,IAAI,MAAM,CACR,QAAQ,KAAK,8DAA8D,EAC3E,GAAG,CACJ,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,0DAA0D;IAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,kBAAkB,EAAE,4DAA4D;CACjF,CAAC,CAAC;AAEH,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GACrB,sBAAsB;IACtB,qFAAqF;IACrF,oCAAoC;IACpC,6GAA6G;IAC3G,gIAAgI;IAClI,8FAA8F;IAC9F,+BAA+B;IAC/B,uCAAuC,CAAC;AAE1C,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;;;;;;;;GAgBG;AACH,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,MAAW;IAC5C,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAElD,uEAAuE;IAEvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE9D,8DAA8D;IAC9D,MAAM,CAAC,YAAY,GAAG,CAAC,IAAY,EAAE,MAAW,EAAE,OAAY,EAAE,EAAE;QAChE,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAE5C,kCAAkC;QAClC,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAE3C,gCAAgC;QAChC,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC;QAClE,CAAC;QAED,0BAA0B;QAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC;QACpC,CAAC;QAED,6EAA6E;QAC7E,gFAAgF;QAChF,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,iFAAiF;QACjF,uEAAuE;QACvE,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC7C,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC;YAC7C,MAAM,CAAC,WAAW;gBAChB,EAAE,KAAK,IAAI;oBACT,CAAC,CAAC,6GAA6G;oBAC/G,CAAC,CAAC,gHAAgH,CAAC;QACzH,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,8DAA8D;QAC9D,MAAM,cAAc,GAAG,KAAK,EAAE,KAAU,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YAEpC,iDAAiD;YACjD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,UAAU,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;YACvD,CAAC;YAED,mDAAmD;YACnD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC5D,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,uEAAuE;IAEvE,MAAM,wBAAwB,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEtE,wDAAwD;IACxD,8DAA8D;IAC9D,MAAM,CAAC,gBAAgB,GAAG,CAAC,IAAY,EAAE,GAAG,IAAW,EAAE,EAAE;QACzD,8CAA8C;QAC9C,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAExC,+CAA+C;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,8DAA8D;YAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEtC,yDAAyD;gBACzD,IAAI,MAAM,EAAE,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;wBACtC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACrC,qDAAqD;4BACrD,IAAI,CAAC;gCACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gCACxC,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gCACnC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;4BACjD,CAAC;4BAAC,MAAM,CAAC;gCACP,0CAA0C;gCAC1C,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;4BAC1D,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,wBAAwB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC;IAEF,uEAAuE;IAEvE,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAC1E,8DAA8D;QAC9D,MAAM,CAAC,cAAc,GAAG,CAAC,KAAa,EAAE,GAAG,KAAY,EAAE,EAAE,CAAC,SAAS,CAAC;IACxE,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;AAE/D,yDAAyD;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,OAAO,CAAC,YAAY,CAAC;AAEvB,iEAAiE;AACjE,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC,IAAI,CAAC"}
+{"version":3,"file":"openai-profile.js","sourceRoot":"","sources":["../src/openai-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAuB/E,MAAM,OAAO,GAAkB;IAC7B,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,eAAe;QACf,aAAa;QACb,iBAAiB;QACjB,iBAAiB;QACjB,eAAe;QACf,aAAa;QACb,cAAc;QACd,YAAY;QACZ,sBAAsB;QACtB,wBAAwB;QACxB,mBAAmB;QACnB,eAAe;QACf,aAAa;QACb,aAAa;QACb,WAAW;QACX,cAAc;QACd,YAAY;QACZ,eAAe;QACf,aAAa;QAEb,eAAe;QACf,gBAAgB;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,uBAAuB;QACvB,qBAAqB;QACrB,oBAAoB;QACpB,gBAAgB;QAChB,cAAc;QACd,eAAe;QAEf,eAAe;QACf,gBAAgB;QAChB,mBAAmB;QACnB,gBAAgB;QAChB,eAAe;QACf,gBAAgB;QAChB,cAAc;QACd,eAAe;QAEf,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,uBAAuB;QACvB,oBAAoB;QACpB,gBAAgB;QAChB,cAAc;QACd,eAAe;QACf,gBAAgB;QAEhB,gDAAgD;QAChD,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,qBAAqB,EAAG,wDAAwD;QAChF,sBAAsB,EAAE,wDAAwD;KACjF,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,cAAc,EAAE,IAAI;IAEpB,uEAAuE;IACvE,yEAAyE;IACzE,mBAAmB,EAAE;QACnB,YAAY,EAAI,EAAE,aAAa,EAAE,IAAI,EAAE;QACvC,UAAU,EAAM,EAAE,aAAa,EAAE,IAAI,EAAE;QACvC,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;QACvC,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;KACxC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oBAAoB,EAAE;QACpB,YAAY,EACV,uDAAuD;YACvD,sCAAsC;YACtC,sDAAsD;YACtD,iDAAiD;QAEnD,aAAa,EACX,4DAA4D;YAC5D,sDAAsD;YACtD,uDAAuD;YACvD,4DAA4D;YAC5D,0DAA0D;QAE5D,aAAa,EACX,6FAA6F;YAC7F,mEAAmE;YACnE,gFAAgF;QAElF,YAAY,EACV,kEAAkE;YAClE,sCAAsC;YACtC,oEAAoE;YACpE,iDAAiD;QAEnD,aAAa,EACX,4DAA4D;YAC5D,+DAA+D;YAC/D,mEAAmE;YACnE,6DAA6D;YAC7D,4DAA4D;QAE9D,aAAa,EACX,6FAA6F;YAC7F,uEAAuE;YACvE,kFAAkF;QAEpF,YAAY,EACV,mFAAmF;YACnF,8DAA8D;YAC9D,wFAAwF;YACxF,4CAA4C;YAC5C,kFAAkF;QAEpF,UAAU,EACR,gFAAgF;YAChF,sEAAsE;YACtE,wFAAwF;YACxF,4CAA4C;YAC5C,qFAAqF;QAEvF,cAAc,EACZ,+EAA+E;YAC/E,qFAAqF;YACrF,qFAAqF;YACrF,gDAAgD;YAChD,wFAAwF;YACxF,6FAA6F;YAC7F,0CAA0C;QAE5C,cAAc,EACZ,kEAAkE;YAClE,2DAA2D;YAC3D,0FAA0F;YAC1F,6CAA6C;KAChD;IAED,sEAAsE;IACtE,kEAAkE;IAClE,uDAAuD;IACvD,gBAAgB,EAAE;QAChB,aAAa,EAAG,CAAC,OAAO,CAAC,EAAI,6CAA6C;QAC1E,aAAa,EAAG,CAAC,OAAO,CAAC;QACzB,aAAa,EAAG,CAAC,OAAO,CAAC;QACzB,aAAa,EAAG,CAAC,OAAO,CAAC;QACzB,YAAY,EAAI,CAAC,IAAI,CAAC,EAAO,kDAAkD;QAC/E,UAAU,EAAM,CAAC,IAAI,CAAC;QACtB,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAG,iDAAiD;QAC9E,cAAc,EAAE,CAAC,QAAQ,CAAC;KAC3B;IAED,sEAAsE;IACtE,kEAAkE;IAClE,6EAA6E;IAC7E,uDAAuD;IACvD,kBAAkB,EAAE,qBAAqB;CAC1C,CAAC;AAEF,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAE7E,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAExE;;;;;;;;;;;;GAYG;AACH,SAAS,0BAA0B,CACjC,MAAe,EACf,MAAyB;IAEzB,8DAA8D;IAC9D,MAAM,GAAG,GAAI,MAAc,EAAE,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAuB,GAAG,EAAE,QAAQ,CAAC;IAEnD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,MAAM,KAAK,GAAI,MAAc,CAAC,KAAgC,CAAC;QAC/D,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS,CAAC,wDAAwD;YACpE,CAAC;YACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;YACvC,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAC5B,IAAI,OAAO,GAAiB,CAAC,CAAC,MAAM,CAAC,QAAyB,CAAC,CAAC;QAChE,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC;QACvB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QACtC,IAAI,OAAO,GAAiB,CAAC,CAAC,KAAK,CAAC,QAAwB,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAwB,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAwB,CAAC,CAAC;IAC5E,CAAC;IAED,mEAAmE;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,kBAAkB,EAAE,4DAA4D;CACjF,CAAC,CAAC;AAEH,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GACrB,sBAAsB;IACtB,qFAAqF;IACrF,oCAAoC;IACpC,6GAA6G;IAC3G,gIAAgI;IAClI,8FAA8F;IAC9F,+BAA+B;IAC/B,uCAAuC,CAAC;AAE1C,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;;;;;;;;GAgBG;AACH,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,MAAW;IAC5C,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAElD,uEAAuE;IAEvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE9D,8DAA8D;IAC9D,MAAM,CAAC,YAAY,GAAG,CAAC,IAAY,EAAE,MAAW,EAAE,OAAY,EAAE,EAAE;QAChE,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAE5C,kCAAkC;QAClC,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAE3C,gCAAgC;QAChC,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC;QAClE,CAAC;QAED,0BAA0B;QAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC;QACpC,CAAC;QAED,6EAA6E;QAC7E,gFAAgF;QAChF,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,iFAAiF;QACjF,uEAAuE;QACvE,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC7C,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC;YAC7C,MAAM,CAAC,WAAW;gBAChB,EAAE,KAAK,IAAI;oBACT,CAAC,CAAC,6GAA6G;oBAC/G,CAAC,CAAC,gHAAgH,CAAC;QACzH,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,CAAC,YAAY,GAAG,0BAA0B,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACxF,CAAC;QAED,oDAAoD;QACpD,8DAA8D;QAC9D,MAAM,cAAc,GAAG,KAAK,EAAE,KAAU,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YAEpC,iDAAiD;YACjD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,UAAU,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;YACvD,CAAC;YAED,mDAAmD;YACnD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC5D,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,uEAAuE;IAEvE,MAAM,wBAAwB,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEtE,wDAAwD;IACxD,8DAA8D;IAC9D,MAAM,CAAC,gBAAgB,GAAG,CAAC,IAAY,EAAE,GAAG,IAAW,EAAE,EAAE;QACzD,8CAA8C;QAC9C,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAExC,+CAA+C;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,8DAA8D;YAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEtC,yDAAyD;gBACzD,IAAI,MAAM,EAAE,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;wBACtC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACrC,qDAAqD;4BACrD,IAAI,CAAC;gCACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gCACxC,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gCACnC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;4BACjD,CAAC;4BAAC,MAAM,CAAC;gCACP,0CAA0C;gCAC1C,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;4BAC1D,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,wBAAwB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC;IAEF,uEAAuE;IAEvE,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAC1E,8DAA8D;QAC9D,MAAM,CAAC,cAAc,GAAG,CAAC,KAAa,EAAE,GAAG,KAAY,EAAE,EAAE,CAAC,SAAS,CAAC;IACxE,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;AAE/D,yDAAyD;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,OAAO,CAAC,YAAY,CAAC;AAEvB,iEAAiE;AACjE,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC,IAAI,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared PII / credential redaction policy for the Frihet MCP server.
+ *
+ * Single source of truth for the set of field names that must never leave the
+ * process in cleartext — government IDs (NIF/CIF/VAT), banking identifiers,
+ * identity documents, webhook signing secrets, and auth tokens.
+ *
+ * Two consumers:
+ *   - openai-profile.ts — strips these from tool I/O in OpenAI-safe mode
+ *     (in-place DELETE of the live response the user receives).
+ *   - observability.ts  — redacts these from every Langfuse trace payload
+ *     (non-mutating CLONE) so an external observability service never stores a
+ *     taxId / secret / IBAN, regardless of profile mode.
+ *
+ * Zero runtime deps — safe in both Node.js (stdio) and Cloudflare Workers (edge).
+ */
+/** Sentinel left in place of a redacted value in cloned (tracing) payloads. */
+export declare const REDACTED = "[redacted]";
+/**
+ * Field names whose VALUES must never appear in logs, traces, or any surface
+ * outside the process boundary. Includes snake_case + locale synonyms because
+ * the Frihet API may return any of them via `.passthrough()` schemas.
+ */
+export declare const SENSITIVE_FIELD_NAMES: readonly string[];
+/** Recursively removes named fields from an object/array tree, IN PLACE. */
+export declare function deepRedact(obj: unknown, fields?: readonly string[]): void;
+/** Best-effort redaction of JSON field patterns from display / serialized text. */
+export declare function redactText(text: string, fields?: readonly string[]): string;
+/**
+ * Returns a deep CLONE of `value` with sensitive field values replaced by the
+ * REDACTED sentinel (objects/arrays) and JSON field patterns stripped from any
+ * string leaf (covers the serialized MCP `content[].text` block).
+ *
+ * Unlike {@link deepRedact} this never mutates its argument — required for
+ * tracing, where the original object is the live response returned to the
+ * caller. A depth guard bounds pathological / cyclic structures.
+ */
+export declare function redactClone(value: unknown, fields?: readonly string[], depth?: number): unknown;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,SAAS,MAAM,EAA0B,GAAG,IAAI,CAehG;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,SAAS,MAAM,EAA0B,GAAG,MAAM,CAclG;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,OAAO,EACd,MAAM,GAAE,SAAS,MAAM,EAA0B,EACjD,KAAK,SAAI,GACR,OAAO,CAWT"}

package/dist/redaction.js

@@ -0,0 +1,91 @@
+/**
+ * Shared PII / credential redaction policy for the Frihet MCP server.
+ *
+ * Single source of truth for the set of field names that must never leave the
+ * process in cleartext — government IDs (NIF/CIF/VAT), banking identifiers,
+ * identity documents, webhook signing secrets, and auth tokens.
+ *
+ * Two consumers:
+ *   - openai-profile.ts — strips these from tool I/O in OpenAI-safe mode
+ *     (in-place DELETE of the live response the user receives).
+ *   - observability.ts  — redacts these from every Langfuse trace payload
+ *     (non-mutating CLONE) so an external observability service never stores a
+ *     taxId / secret / IBAN, regardless of profile mode.
+ *
+ * Zero runtime deps — safe in both Node.js (stdio) and Cloudflare Workers (edge).
+ */
+/** Sentinel left in place of a redacted value in cloned (tracing) payloads. */
+export const REDACTED = "[redacted]";
+/**
+ * Field names whose VALUES must never appear in logs, traces, or any surface
+ * outside the process boundary. Includes snake_case + locale synonyms because
+ * the Frihet API may return any of them via `.passthrough()` schemas.
+ */
+export const SENSITIVE_FIELD_NAMES = [
+    "taxId", "tax_id", // Primary field name + snake_case variant
+    "nif", "cif", "vatNumber", // Spanish/EU synonyms for government tax ID
+    "vat_number", "vatId", "vat_id",
+    "secret", // Webhook signing credential
+    "iban", "bankAccount", // Banking identifiers
+    "bank_account", "accountNumber",
+    "idDocument", "documentNumber", // Guest/customer government document fields
+    "passport", "passportNumber",
+    "dni", "nationalId", "national_id",
+    "ssn", "socialSecurityNumber", "social_security_number",
+    "apiKey", "api_key",
+    "accessToken", "access_token", "refreshToken", "refresh_token",
+    "password", "mfa", "otp",
+];
+/** Recursively removes named fields from an object/array tree, IN PLACE. */
+export function deepRedact(obj, fields = SENSITIVE_FIELD_NAMES) {
+    if (obj === null || typeof obj !== "object")
+        return;
+    if (Array.isArray(obj)) {
+        for (const item of obj)
+            deepRedact(item, fields);
+        return;
+    }
+    const record = obj;
+    for (const field of fields) {
+        if (field in record)
+            delete record[field];
+    }
+    for (const value of Object.values(record)) {
+        deepRedact(value, fields);
+    }
+}
+/** Best-effort redaction of JSON field patterns from display / serialized text. */
+export function redactText(text, fields = SENSITIVE_FIELD_NAMES) {
+    let result = text;
+    for (const field of fields) {
+        // Remove "field": "value", or "field": value patterns
+        result = result.replace(new RegExp(`\\s*"${field}"\\s*:\\s*(?:"[^"]*"|null|true|false|\\d+(?:\\.\\d+)?)\\s*,?`, "g"), "");
+    }
+    // Clean up trailing commas before } or ] left by removals
+    return result.replace(/,(\s*[}\]])/g, "$1");
+}
+/**
+ * Returns a deep CLONE of `value` with sensitive field values replaced by the
+ * REDACTED sentinel (objects/arrays) and JSON field patterns stripped from any
+ * string leaf (covers the serialized MCP `content[].text` block).
+ *
+ * Unlike {@link deepRedact} this never mutates its argument — required for
+ * tracing, where the original object is the live response returned to the
+ * caller. A depth guard bounds pathological / cyclic structures.
+ */
+export function redactClone(value, fields = SENSITIVE_FIELD_NAMES, depth = 0) {
+    if (depth > 16)
+        return REDACTED; // cycle / pathological-depth guard
+    if (typeof value === "string")
+        return redactText(value, fields);
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => redactClone(v, fields, depth + 1));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] = fields.includes(k) ? REDACTED : redactClone(v, fields, depth + 1);
+    }
+    return out;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO,EAAE,QAAQ,EAAe,0CAA0C;IAC1E,KAAK,EAAE,KAAK,EAAE,WAAW,EAAO,4CAA4C;IAC5E,YAAY,EAAE,OAAO,EAAE,QAAQ;IAC/B,QAAQ,EAAwB,6BAA6B;IAC7D,MAAM,EAAE,aAAa,EAAW,sBAAsB;IACtD,cAAc,EAAE,eAAe;IAC/B,YAAY,EAAE,gBAAgB,EAAE,4CAA4C;IAC5E,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,YAAY,EAAE,aAAa;IAClC,KAAK,EAAE,sBAAsB,EAAE,wBAAwB;IACvD,QAAQ,EAAE,SAAS;IACnB,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe;IAC9D,UAAU,EAAE,KAAK,EAAE,KAAK;CACzB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,SAA4B,qBAAqB;IACxF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO;IAEpD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,GAAG;YAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAA4B,qBAAqB;IACxF,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,sDAAsD;QACtD,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,IAAI,MAAM,CACR,QAAQ,KAAK,8DAA8D,EAC3E,GAAG,CACJ,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,0DAA0D;IAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,KAAc,EACd,SAA4B,qBAAqB,EACjD,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,QAAQ,CAAC,CAAC,mCAAmC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAErF,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/tools/intelligence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intelligence.d.ts","sourceRoot":"","sources":["../../src/tools/intelligence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAU5D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CA6JxF"}
+{"version":3,"file":"intelligence.d.ts","sourceRoot":"","sources":["../../src/tools/intelligence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAU5D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CA+KxF"}

package/dist/tools/intelligence.js

@@ -99,17 +99,44 @@ export function registerIntelligenceTools(server, client) {
                 .describe("Due date for the new invoice (YYYY-MM-DD) / Fecha de vencimiento de la nueva factura"),
         },
     }, async ({ id, newIssueDate, newDueDate }) => withToolLogging("duplicate_invoice", async () => {
-        // 1. Fetch the original invoice
+        // 1. Fetch the original invoice (returns the FULL raw stored document —
+        //    payments, verifactu, eInvoice, operationType, createdBy, etc.)
         const original = await client.getInvoice(id);
-        // 2. Strip fields that shouldn't be copied
-        const { id: _id, documentNumber: _docNum, status: _status, createdAt: _createdAt, updatedAt: _updatedAt, total: _total, ...copyData } = original;
-        // 3. Set new values
+        // 2. Allowlist-PICK only the fields the create endpoint actually accepts.
+        //    The create POST validates against a Zod `.strict()` schema that
+        //    REJECTS unknown keys (HTTP 400). Spreading the raw GET doc and only
+        //    blacklisting a handful of fields left stored-only fields (payments,
+        //    amountPaid, verifactu, eInvoice, operationType, poNumber, createdBy,
+        //    sentTo/sentAt, cancelled*, attachments, …) in the body, so any paid /
+        //    sent / cancelled / e-invoiced invoice failed to duplicate. Picking
+        //    the writable subset mirrors the create schema and never 400s.
+        //    Deliberately NOT copied: documentNumber (fresh gapless number),
+        //    status (forced draft), recurring (a copy is a one-off), and every
+        //    lifecycle/computed field (total, payments, verifactu, …).
+        const COPYABLE_INVOICE_FIELDS = [
+            "clientName",
+            "clientId",
+            "clientAddress",
+            "clientTaxId",
+            "items",
+            "dueDate",
+            "notes",
+            "taxRate",
+            "irpfRate",
+            "equivalenceSurchargeRate",
+            "clientLocation",
+            "prepayment",
+            "seriesId",
+        ];
+        // 3. Build the duplicate from the writable subset + new values.
         const today = new Date().toISOString().split("T")[0];
-        const invoiceData = {
-            ...copyData,
-            status: "draft",
-            issueDate: newIssueDate || today,
-        };
+        const invoiceData = {};
+        for (const field of COPYABLE_INVOICE_FIELDS) {
+            if (original[field] !== undefined)
+                invoiceData[field] = original[field];
+        }
+        invoiceData.status = "draft";
+        invoiceData.issueDate = newIssueDate || today;
         if (newDueDate) {
             invoiceData.dueDate = newDueDate;
         }

package/dist/tools/intelligence.js.map

@@ -1 +1 @@
-{"version":3,"file":"intelligence.js","sourceRoot":"","sources":["../../src/tools/intelligence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,UAAU,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAqB;IAChF,6BAA6B;IAE7B,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,gGAAgG;YAChG,+FAA+F;YAC/F,kGAAkG;YAClG,6FAA6F;YAC7F,0FAA0F;QAC5F,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,4BAA4B;IAE5B,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,qFAAqF;YACrF,2EAA2E;YAC3E,uFAAuF;YACvF,kFAAkF;YAClF,wFAAwF;QAC1F,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,0EAA0E;gBAC1E,sDAAsD,CACvD;SACJ;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAC;QACvF,OAAO;YACL,OAAO,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAClD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,4BAA4B;IAE5B,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,oGAAoG;YACpG,oFAAoF;YACpF,gFAAgF;YAChF,6EAA6E;YAC7E,8FAA8F;QAChG,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,8EAA8E;gBAC9E,+DAA+D,CAChE;SACJ;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,oBAAoB,OAAO,GAAG,CAAC,CAAC,CAAC,mCAAmC,CAAC;QAC7F,OAAO;YACL,OAAO,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAClD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0BAA0B;IAE1B,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,2GAA2G;YAC3G,mEAAmE;YACnE,8EAA8E;YAC9E,wFAAwF;YACxF,sGAAsG;YACtG,4DAA4D;QAC9D,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;YACvF,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,uGAAuG,CAAC;YACpH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,sFAAsF,CAAC;SACpG;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QAC1F,gCAAgC;QAChC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE7C,2CAA2C;QAC3C,MAAM,EACJ,EAAE,EAAE,GAAG,EACP,cAAc,EAAE,OAAO,EACvB,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,KAAK,EAAE,MAAM,EACb,GAAG,QAAQ,EACZ,GAAG,QAAQ,CAAC;QAEb,oBAAoB;QACpB,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,WAAW,GAA4B;YAC3C,GAAG,QAAQ;YACX,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,YAAY,IAAI,KAAK;SACjC,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,OAAO,GAAG,UAAU,CAAC;QACnC,CAAC;QAED,0BAA0B;QAC1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACvD,OAAO;YACL,OAAO,EAAE;gBACP,aAAa,CACX,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC;oBAC1C,+BAA+B,EAAE,sDAAsD,EAAE,qBAAqB,CAC/G;aACF;YACD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"intelligence.js","sourceRoot":"","sources":["../../src/tools/intelligence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,UAAU,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAqB;IAChF,6BAA6B;IAE7B,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,gGAAgG;YAChG,+FAA+F;YAC/F,kGAAkG;YAClG,6FAA6F;YAC7F,0FAA0F;QAC5F,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,4BAA4B;IAE5B,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,qFAAqF;YACrF,2EAA2E;YAC3E,uFAAuF;YACvF,kFAAkF;YAClF,wFAAwF;QAC1F,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,0EAA0E;gBAC1E,sDAAsD,CACvD;SACJ;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAC;QACvF,OAAO;YACL,OAAO,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAClD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,4BAA4B;IAE5B,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,oGAAoG;YACpG,oFAAoF;YACpF,gFAAgF;YAChF,6EAA6E;YAC7E,8FAA8F;QAChG,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,8EAA8E;gBAC9E,+DAA+D,CAChE;SACJ;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,oBAAoB,OAAO,GAAG,CAAC,CAAC,CAAC,mCAAmC,CAAC;QAC7F,OAAO;YACL,OAAO,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAClD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0BAA0B;IAE1B,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,2GAA2G;YAC3G,mEAAmE;YACnE,8EAA8E;YAC9E,wFAAwF;YACxF,sGAAsG;YACtG,4DAA4D;QAC9D,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;YACvF,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,uGAAuG,CAAC;YACpH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,sFAAsF,CAAC;SACpG;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QAC1F,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE7C,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,uBAAuB,GAAG;YAC9B,YAAY;YACZ,UAAU;YACV,eAAe;YACf,aAAa;YACb,OAAO;YACP,SAAS;YACT,OAAO;YACP,SAAS;YACT,UAAU;YACV,0BAA0B;YAC1B,gBAAgB;YAChB,YAAY;YACZ,UAAU;SACF,CAAC;QAEX,gEAAgE;QAChE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,uBAAuB,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,WAAW,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QACD,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC;QAC7B,WAAW,CAAC,SAAS,GAAG,YAAY,IAAI,KAAK,CAAC;QAE9C,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,OAAO,GAAG,UAAU,CAAC;QACnC,CAAC;QAED,0BAA0B;QAC1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACvD,OAAO;YACL,OAAO,EAAE;gBACP,aAAa,CACX,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC;oBAC1C,+BAA+B,EAAE,sDAAsD,EAAE,qBAAqB,CAC/G;aACF;YACD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frihet/mcp-server",
-  "version": "1.14.3",
+  "version": "1.14.4",
   "description": "AI-native MCP server for business management — invoices, expenses, deposits, clients, products, quotes, webhooks, CRM, e-invoicing (Facturae/XRechnung/Factur-X/FatturaPA/PEPPOL + FACe Spain B2G + TicketBAI Basque Country + KSeF Poland), vacation rentals, POS, banking, fiscal (Modelo 303/130/390/180/347/415/425/418, VeriFactu, TicketBAI, IS M200/M202), IGIC, AIEM, GL audit approval, white-label portal domain, VIES EU VAT lookup, bank rules, time tracking, recurring invoices, team management, gestoria. 157 tools. Remote endpoint at mcp.frihet.io (zero install). Works with Claude, Cursor, Windsurf, Cline.",
   "type": "module",
   "main": "./dist/index.js",
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node --test dist/__tests__/openai-profile.test.js dist/__tests__/tool-exposure.test.js dist/__tests__/einvoice-tools.test.js dist/__tests__/einvoice-day4-tools.test.js dist/__tests__/stay-tools.test.js dist/__tests__/pos-tools.test.js dist/__tests__/kitchen-tools.test.js dist/__tests__/banking-tools.test.js dist/__tests__/banking-client-contract.test.js dist/__tests__/fiscal-tools.test.js dist/__tests__/time-tools.test.js dist/__tests__/recurring-tools.test.js dist/__tests__/team-tools.test.js dist/__tests__/d4b-hr-payroll-onboarding-tools.test.js dist/__tests__/audit-server-version.test.js dist/__tests__/openai-grouped-compose.test.js dist/__tests__/contract.test.js",
+    "test": "npm run build && node --test dist/__tests__/openai-profile.test.js dist/__tests__/tool-exposure.test.js dist/__tests__/einvoice-tools.test.js dist/__tests__/einvoice-day4-tools.test.js dist/__tests__/stay-tools.test.js dist/__tests__/pos-tools.test.js dist/__tests__/kitchen-tools.test.js dist/__tests__/banking-tools.test.js dist/__tests__/banking-client-contract.test.js dist/__tests__/fiscal-tools.test.js dist/__tests__/time-tools.test.js dist/__tests__/recurring-tools.test.js dist/__tests__/team-tools.test.js dist/__tests__/d4b-hr-payroll-onboarding-tools.test.js dist/__tests__/audit-server-version.test.js dist/__tests__/openai-grouped-compose.test.js dist/__tests__/contract.test.js dist/__tests__/observability-redaction.test.js dist/__tests__/intelligence-duplicate-invoice.test.js",
     "start": "node dist/index.js",
     "postinstall": "node scripts/postinstall.js || true",
     "prepublishOnly": "npm run build && npm run audit:mcp-refs -- --repo frihet-mcp",

package/scripts/audit-mcp-refs.mjs

@@ -68,6 +68,7 @@ const REPOS = {
       'skill/SKILL.md',
       'src/index.ts',
       'workers/remote-mcp/src/index.ts',
+      'workers/remote-mcp/src/auth-handler.ts',
       'workers/remote-mcp/public/releases.json',
     ],
   },