@hasna/contacts 0.5.2 → 0.6.0

package/dist/cli/index.js

@@ -4,6 +4,7 @@ var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __toESM = (mod, isNodeMode, target) => {
   target = mod != null ? __create(__getProtoOf(mod)) : {};
@@ -16,6 +17,20 @@ var __toESM = (mod, isNodeMode, target) => {
       });
   return to;
 };
+var __moduleCache = /* @__PURE__ */ new WeakMap;
+var __toCommonJS = (from) => {
+  var entry = __moduleCache.get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function")
+    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    }));
+  __moduleCache.set(from, entry);
+  return entry;
+};
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __export = (target, all) => {
   for (var name in all)
@@ -2632,6 +2647,41 @@ var init_database = __esm(() => {
     created_at TEXT NOT NULL DEFAULT (datetime('now')),
     updated_at TEXT NOT NULL DEFAULT (datetime('now'))
   );
+  `,
+    `
+  ALTER TABLE contacts ADD COLUMN sensitivity TEXT NOT NULL DEFAULT 'normal' CHECK(sensitivity IN ('normal','confidential','restricted'));
+
+  CREATE TABLE IF NOT EXISTS contact_documents (
+    id TEXT PRIMARY KEY,
+    contact_id TEXT NOT NULL REFERENCES contacts(id) ON DELETE CASCADE,
+    doc_type TEXT NOT NULL,
+    label TEXT,
+    encrypted_value TEXT NOT NULL,
+    iv TEXT NOT NULL,
+    encrypted_file_path TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    expires_at TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+
+  CREATE TABLE IF NOT EXISTS contact_health (
+    id TEXT PRIMARY KEY,
+    contact_id TEXT NOT NULL UNIQUE REFERENCES contacts(id) ON DELETE CASCADE,
+    blood_type TEXT,
+    allergies TEXT NOT NULL DEFAULT '[]',
+    medical_conditions TEXT NOT NULL DEFAULT '[]',
+    medications TEXT NOT NULL DEFAULT '[]',
+    emergency_contacts TEXT NOT NULL DEFAULT '[]',
+    health_insurance_provider TEXT,
+    health_insurance_id TEXT,
+    primary_physician TEXT,
+    primary_physician_phone TEXT,
+    organ_donor INTEGER NOT NULL DEFAULT 0,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
   `
   ];
 });
@@ -2681,6 +2731,7 @@ function rowToContact(row) {
     follow_up_at: row.follow_up_at ?? null,
     archived: !!row.archived,
     project_id: row.project_id ?? null,
+    sensitivity: row.sensitivity ?? "normal",
     do_not_contact: !!row.do_not_contact,
     priority: row.priority ?? 3,
     timezone: row.timezone ?? null
@@ -2768,8 +2819,8 @@ function createContact(input, db) {
   const firstName = input.first_name ?? "";
   const lastName = input.last_name ?? "";
   const displayName = input.display_name ?? (firstName || lastName ? `${firstName} ${lastName}`.trim() : "Unnamed Contact");
-  d.run(`INSERT INTO contacts (id, first_name, last_name, display_name, nickname, avatar_url, notes, birthday, company_id, job_title, source, custom_fields, last_contacted_at, website, preferred_contact_method, status, follow_up_at, project_id, do_not_contact, priority, timezone, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  d.run(`INSERT INTO contacts (id, first_name, last_name, display_name, nickname, avatar_url, notes, birthday, company_id, job_title, source, custom_fields, last_contacted_at, website, preferred_contact_method, status, follow_up_at, project_id, sensitivity, do_not_contact, priority, timezone, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     firstName,
     lastName,
@@ -2788,6 +2839,7 @@ function createContact(input, db) {
     input.status ?? "active",
     input.follow_up_at ?? null,
     input.project_id ?? null,
+    input.sensitivity ?? "normal",
     input.do_not_contact ? 1 : 0,
     input.priority ?? 3,
     input.timezone ?? null,
@@ -2836,6 +2888,7 @@ function listContacts(opts = {}, db) {
     order_by = "display_name",
     order_dir = "asc",
     include_dnc = false,
+    include_restricted = false,
     priority_min,
     updated_since
   } = opts;
@@ -2846,6 +2899,9 @@ function listContacts(opts = {}, db) {
   if (!include_dnc) {
     conditions.push("c.do_not_contact = 0");
   }
+  if (!include_restricted) {
+    conditions.push("c.sensitivity != 'restricted'");
+  }
   if (company_id) {
     conditions.push("c.company_id = ?");
     params.push(company_id);
@@ -2974,6 +3030,10 @@ function updateContact(id, input, db) {
     setClauses.push("project_id = ?");
     params.push(input.project_id);
   }
+  if (input.sensitivity !== undefined) {
+    setClauses.push("sensitivity = ?");
+    params.push(input.sensitivity);
+  }
   if (input.do_not_contact !== undefined) {
     setClauses.push("do_not_contact = ?");
     params.push(input.do_not_contact ? 1 : 0);
@@ -3021,26 +3081,26 @@ function searchContacts(query, db) {
   const ftsRows = d.query(`
     SELECT c.* FROM contacts c
     JOIN contacts_fts fts ON fts.id = c.id
-    WHERE contacts_fts MATCH ? AND c.archived = 0
+    WHERE contacts_fts MATCH ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     ORDER BY rank
     LIMIT 50
   `).all(`"${query.replace(/"/g, '""')}"*`);
   const emailRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN emails e ON e.contact_id = c.id
-    WHERE e.address LIKE ? AND c.archived = 0
+    WHERE e.address LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const phoneRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN phones p ON p.contact_id = c.id
-    WHERE p.number LIKE ? AND c.archived = 0
+    WHERE p.number LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const companyRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN companies co ON co.id = c.company_id
-    WHERE co.name LIKE ? AND c.archived = 0
+    WHERE co.name LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const seen = new Set;
@@ -3263,6 +3323,19 @@ var init_contacts = __esm(() => {
 });
 
 // src/db/companies.ts
+var exports_companies = {};
+__export(exports_companies, {
+  updateCompany: () => updateCompany,
+  unarchiveCompany: () => unarchiveCompany,
+  searchCompanies: () => searchCompanies,
+  listOwnedEntities: () => listOwnedEntities,
+  listCompanyEmployees: () => listCompanyEmployees,
+  listCompanies: () => listCompanies,
+  getCompany: () => getCompany,
+  deleteCompany: () => deleteCompany,
+  createCompany: () => createCompany,
+  archiveCompany: () => archiveCompany
+});
 function rowToCompany2(row) {
   return {
     ...row,
@@ -3485,6 +3558,59 @@ function deleteCompany(id, db) {
   logActivity(d, { company_id: id, action: "company.deleted", details: `Deleted company: ${row.name}` });
   d.run(`DELETE FROM companies WHERE id = ?`, [id]);
 }
+function searchCompanies(query, db) {
+  const d = db || getDatabase();
+  const rows = d.query(`
+    SELECT * FROM companies
+    WHERE name LIKE ? OR domain LIKE ? OR description LIKE ? OR industry LIKE ?
+    LIMIT 50
+  `).all(`%${query}%`, `%${query}%`, `%${query}%`, `%${query}%`);
+  return rows.map((row) => loadCompanyDetails(d, rowToCompany2(row)));
+}
+function listCompanyEmployees(companyId, db) {
+  const d = db || getDatabase();
+  const row = d.query(`SELECT id FROM companies WHERE id = ?`).get(companyId);
+  if (!row)
+    throw new CompanyNotFoundError(companyId);
+  const rows = d.query(`SELECT * FROM contacts WHERE company_id = ? ORDER BY display_name ASC`).all(companyId);
+  return rows.map((r) => ({
+    ...r,
+    source: r.source,
+    custom_fields: JSON.parse(r.custom_fields || "{}"),
+    preferred_contact_method: r.preferred_contact_method ?? null,
+    status: r.status ?? "active",
+    follow_up_at: r.follow_up_at ?? null,
+    archived: !!r.archived,
+    project_id: r.project_id ?? null,
+    sensitivity: r.sensitivity ?? "normal",
+    do_not_contact: !!r.do_not_contact,
+    priority: r.priority ?? 3,
+    timezone: r.timezone ?? null
+  }));
+}
+function archiveCompany(id, db) {
+  const d = db || getDatabase();
+  const row = d.query(`SELECT * FROM companies WHERE id = ?`).get(id);
+  if (!row)
+    throw new CompanyNotFoundError(id);
+  d.run(`UPDATE companies SET archived = 1, updated_at = ? WHERE id = ?`, [now(), id]);
+  logActivity(d, { company_id: id, action: "company.archived", details: `Archived company: ${row.name}` });
+  const updated = d.query(`SELECT * FROM companies WHERE id = ?`).get(id);
+  return loadCompanyDetails(d, rowToCompany2(updated));
+}
+function unarchiveCompany(id, db) {
+  const d = db || getDatabase();
+  const row = d.query(`SELECT * FROM companies WHERE id = ?`).get(id);
+  if (!row)
+    throw new CompanyNotFoundError(id);
+  d.run(`UPDATE companies SET archived = 0, updated_at = ? WHERE id = ?`, [now(), id]);
+  logActivity(d, { company_id: id, action: "company.unarchived", details: `Unarchived company: ${row.name}` });
+  const updated = d.query(`SELECT * FROM companies WHERE id = ?`).get(id);
+  return loadCompanyDetails(d, rowToCompany2(updated));
+}
+function listOwnedEntities(db) {
+  return listCompanies({ is_owned_entity: true }, db);
+}
 var init_companies = __esm(() => {
   init_types();
   init_database();
@@ -3859,6 +3985,7 @@ function listContactsByTag(tagId, db) {
     follow_up_at: r.follow_up_at ?? null,
     archived: !!r.archived,
     project_id: r.project_id ?? null,
+    sensitivity: r.sensitivity ?? "normal",
     do_not_contact: !!r.do_not_contact,
     priority: r.priority ?? 3,
     timezone: r.timezone ?? null
@@ -4384,13 +4511,104 @@ async function exportContacts(format, contacts) {
   }
 }
 
+// src/lib/images.ts
+var exports_images = {};
+__export(exports_images, {
+  saveImage: () => saveImage,
+  listImages: () => listImages,
+  getImagesDir: () => getImagesDir,
+  getImagePath: () => getImagePath,
+  getImageAsBase64: () => getImageAsBase64,
+  deleteImage: () => deleteImage
+});
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, copyFileSync, unlinkSync, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3, extname, basename } from "path";
+function ensureImagesDir() {
+  if (!existsSync3(IMAGES_DIR))
+    mkdirSync3(IMAGES_DIR, { recursive: true });
+}
+function getImagesDir() {
+  ensureImagesDir();
+  return IMAGES_DIR;
+}
+function saveImage(entityId, source, options) {
+  ensureImagesDir();
+  deleteImage(entityId);
+  const base64Match = source.match(/^data:image\/(\w+);base64,(.+)$/s);
+  if (base64Match) {
+    const ext2 = base64Match[1] === "jpeg" ? "jpg" : base64Match[1];
+    const data = Buffer.from(base64Match[2], "base64");
+    const filename2 = `${entityId}.${ext2}`;
+    writeFileSync2(join3(IMAGES_DIR, filename2), data);
+    return filename2;
+  }
+  if (!existsSync3(source) && /^[A-Za-z0-9+/=\n\r]+$/.test(source.trim()) && source.length > 100) {
+    const ext2 = options?.format || "jpg";
+    const data = Buffer.from(source.trim(), "base64");
+    const filename2 = `${entityId}.${ext2}`;
+    writeFileSync2(join3(IMAGES_DIR, filename2), data);
+    return filename2;
+  }
+  if (!existsSync3(source)) {
+    throw new Error(`Image file not found: ${source}`);
+  }
+  const ext = extname(source).slice(1).toLowerCase() || "jpg";
+  const validExts = ["jpg", "jpeg", "png", "gif", "webp", "svg", "avif", "ico"];
+  if (!validExts.includes(ext)) {
+    throw new Error(`Unsupported image format: ${ext}. Supported: ${validExts.join(", ")}`);
+  }
+  const filename = `${entityId}.${ext === "jpeg" ? "jpg" : ext}`;
+  copyFileSync(source, join3(IMAGES_DIR, filename));
+  return filename;
+}
+function getImagePath(entityId) {
+  ensureImagesDir();
+  const files = readdirSync(IMAGES_DIR);
+  const match = files.find((f) => f.startsWith(`${entityId}.`));
+  return match ? join3(IMAGES_DIR, match) : null;
+}
+function getImageAsBase64(entityId) {
+  const path = getImagePath(entityId);
+  if (!path)
+    return null;
+  const ext = extname(path).slice(1);
+  const mime = ext === "jpg" ? "image/jpeg" : ext === "svg" ? "image/svg+xml" : `image/${ext}`;
+  const data = readFileSync2(path);
+  return `data:${mime};base64,${data.toString("base64")}`;
+}
+function deleteImage(entityId) {
+  ensureImagesDir();
+  const files = readdirSync(IMAGES_DIR);
+  let deleted = false;
+  for (const f of files) {
+    if (f.startsWith(`${entityId}.`)) {
+      unlinkSync(join3(IMAGES_DIR, f));
+      deleted = true;
+    }
+  }
+  return deleted;
+}
+function listImages() {
+  ensureImagesDir();
+  const files = readdirSync(IMAGES_DIR).filter((f) => !f.startsWith("."));
+  return files.map((f) => ({
+    entity_id: basename(f, extname(f)),
+    filename: f,
+    path: join3(IMAGES_DIR, f)
+  }));
+}
+var IMAGES_DIR;
+var init_images = __esm(() => {
+  IMAGES_DIR = join3(process.env["HOME"] || "~", ".contacts", "images");
+});
+
 // src/server/serve.ts
 var exports_serve = {};
 __export(exports_serve, {
   startServer: () => startServer
 });
-import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join4 } from "path";
 function json(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status,
@@ -4595,8 +4813,60 @@ async function handleExport(req) {
     }
   });
 }
+async function handleImages(req, _url, segments) {
+  const entityId = segments[2];
+  if (!entityId)
+    return apiError("Entity ID required");
+  if (req.method === "GET") {
+    const imagePath = getImagePath(entityId);
+    if (!imagePath || !existsSync4(imagePath)) {
+      return new Response(null, { status: 404, headers: { "Content-Type": "text/plain" } });
+    }
+    return new Response(Bun.file(imagePath), {
+      headers: { "Cache-Control": "public, max-age=3600" }
+    });
+  }
+  if (req.method === "POST") {
+    const contentType = req.headers.get("content-type") || "";
+    if (contentType.includes("multipart/form-data")) {
+      const formData = await req.formData();
+      const file = formData.get("image");
+      if (!file)
+        return apiError("No image file in form data");
+      const ext = file.name?.split(".").pop() || "jpg";
+      const buffer = Buffer.from(await file.arrayBuffer());
+      const tmpPath = join4(getImagesDir(), `_upload_${entityId}.${ext}`);
+      const { writeFileSync: wfs } = await import("fs");
+      wfs(tmpPath, buffer);
+      try {
+        const filename = saveImage(entityId, tmpPath);
+        const { unlinkSync: unlinkSync2 } = await import("fs");
+        try {
+          unlinkSync2(tmpPath);
+        } catch {}
+        return json({ ok: true, entity_id: entityId, filename });
+      } catch (e) {
+        return apiError(e instanceof Error ? e.message : "Upload failed");
+      }
+    }
+    const body = await parseJson(req);
+    if (!body?.image)
+      return apiError("Provide image as base64 string or file upload");
+    try {
+      const filename = saveImage(entityId, body.image, { format: body.format });
+      return json({ ok: true, entity_id: entityId, filename });
+    } catch (e) {
+      return apiError(e instanceof Error ? e.message : "Upload failed");
+    }
+  }
+  if (req.method === "DELETE") {
+    const deleted = deleteImage(entityId);
+    return json({ ok: true, deleted });
+  }
+  return apiError("Method not allowed", 405);
+}
 function serveStaticFile(filePath) {
-  if (!existsSync3(filePath))
+  if (!existsSync4(filePath))
     return null;
   return new Response(Bun.file(filePath));
 }
@@ -4636,12 +4906,15 @@ function startServer(port) {
             case "export":
               response = req.method === "GET" ? await handleExport(req) : apiError("Method not allowed", 405);
               break;
+            case "images":
+              response = await handleImages(req, url, segments);
+              break;
             default:
               response = apiError("Not found", 404);
           }
         } else {
-          const filePath = join3(DASHBOARD_DIST, url.pathname === "/" ? "index.html" : url.pathname);
-          response = serveStaticFile(filePath) ?? serveStaticFile(join3(DASHBOARD_DIST, "index.html")) ?? new Response("Not Found", { status: 404 });
+          const filePath = join4(DASHBOARD_DIST, url.pathname === "/" ? "index.html" : url.pathname);
+          response = serveStaticFile(filePath) ?? serveStaticFile(join4(DASHBOARD_DIST, "index.html")) ?? new Response("Not Found", { status: 404 });
         }
       } catch (err) {
         console.error("Request error:", err);
@@ -4662,7 +4935,8 @@ var init_serve = __esm(() => {
   init_contacts();
   init_companies();
   init_tags();
-  DASHBOARD_DIST = join3(import.meta.dir, "../../dashboard/dist");
+  init_images();
+  DASHBOARD_DIST = join4(import.meta.dir, "../../dashboard/dist");
 });
 
 // src/db/notes.ts
@@ -5774,6 +6048,418 @@ var init_org_chart = __esm(() => {
   init_database();
 });
 
+// src/lib/vault.ts
+var exports_vault = {};
+__export(exports_vault, {
+  unlockVault: () => unlockVault,
+  requireVault: () => requireVault,
+  lockVault: () => lockVault,
+  isVaultUnlocked: () => isVaultUnlocked,
+  isVaultInitialized: () => isVaultInitialized,
+  initVault: () => initVault,
+  getDocumentsDir: () => getDocumentsDir,
+  encryptFile: () => encryptFile,
+  encrypt: () => encrypt,
+  decryptFile: () => decryptFile,
+  decrypt: () => decrypt
+});
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join5 } from "path";
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from "crypto";
+function deriveKey(passphrase, salt) {
+  return pbkdf2Sync(passphrase, salt, 1e5, 32, "sha512");
+}
+function initVault(passphrase) {
+  if (!existsSync5(VAULT_DIR))
+    mkdirSync4(VAULT_DIR, { recursive: true });
+  if (!existsSync5(DOCUMENTS_DIR))
+    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  const salt = randomBytes(32);
+  const key = deriveKey(passphrase, salt);
+  const keyHash = createHash("sha256").update(key).digest("hex");
+  const config = { salt: salt.toString("hex"), key_hash: keyHash, created_at: new Date().toISOString() };
+  writeFileSync3(VAULT_CONFIG, JSON.stringify(config, null, 2));
+  _derivedKey = key;
+}
+function isVaultInitialized() {
+  return existsSync5(VAULT_CONFIG);
+}
+function unlockVault(passphrase) {
+  if (!existsSync5(VAULT_CONFIG))
+    throw new Error("Vault not initialized. Run 'contacts vault init' first.");
+  const config = JSON.parse(readFileSync3(VAULT_CONFIG, "utf-8"));
+  const salt = Buffer.from(config.salt, "hex");
+  const key = deriveKey(passphrase, salt);
+  const keyHash = createHash("sha256").update(key).digest("hex");
+  if (keyHash !== config.key_hash)
+    return false;
+  _derivedKey = key;
+  return true;
+}
+function lockVault() {
+  _derivedKey = null;
+}
+function isVaultUnlocked() {
+  return _derivedKey !== null;
+}
+function requireVault() {
+  if (!_derivedKey)
+    throw new Error("Vault is locked. Unlock with 'contacts vault unlock' or vault_unlock MCP tool first.");
+  return _derivedKey;
+}
+function encrypt(plaintext) {
+  const key = requireVault();
+  const iv = randomBytes(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  let encrypted = cipher.update(plaintext, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return { ciphertext: encrypted + ":" + authTag, iv: iv.toString("hex") };
+}
+function decrypt(ciphertext, iv) {
+  const key = requireVault();
+  const [encData, authTag] = ciphertext.split(":");
+  if (!encData || !authTag)
+    throw new Error("Invalid ciphertext format");
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
+  decipher.setAuthTag(Buffer.from(authTag, "hex"));
+  let decrypted = decipher.update(encData, "hex", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+function encryptFile(sourcePath, entityId) {
+  const key = requireVault();
+  if (!existsSync5(DOCUMENTS_DIR))
+    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  const data = readFileSync3(sourcePath);
+  const iv = randomBytes(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  const destPath = join5(DOCUMENTS_DIR, `${entityId}.enc`);
+  const output = Buffer.concat([iv, authTag, encrypted]);
+  writeFileSync3(destPath, output);
+  return destPath;
+}
+function decryptFile(encPath) {
+  const key = requireVault();
+  const data = readFileSync3(encPath);
+  const iv = data.subarray(0, 16);
+  const authTag = data.subarray(16, 32);
+  const encrypted = data.subarray(32);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+}
+function getDocumentsDir() {
+  if (!existsSync5(DOCUMENTS_DIR))
+    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  return DOCUMENTS_DIR;
+}
+var VAULT_DIR, VAULT_CONFIG, DOCUMENTS_DIR, _derivedKey = null;
+var init_vault = __esm(() => {
+  VAULT_DIR = join5(process.env["HOME"] || "~", ".contacts");
+  VAULT_CONFIG = join5(VAULT_DIR, "vault.json");
+  DOCUMENTS_DIR = join5(VAULT_DIR, "documents");
+});
+
+// src/db/documents.ts
+var exports_documents = {};
+__export(exports_documents, {
+  listDocuments: () => listDocuments,
+  getDocument: () => getDocument,
+  deleteDocument: () => deleteDocument,
+  addDocument: () => addDocument,
+  DOCUMENT_TYPES: () => DOCUMENT_TYPES
+});
+import { existsSync as existsSync6, unlinkSync as unlinkSync2 } from "fs";
+function addDocument(input, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const id = uuid();
+  const { ciphertext, iv } = encrypt(input.value);
+  let encFilePath = null;
+  if (input.file_path) {
+    encFilePath = encryptFile(input.file_path, id);
+  }
+  _db2.query(`INSERT INTO contact_documents (id, contact_id, doc_type, label, encrypted_value, iv, encrypted_file_path, metadata, expires_at, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)`).run(id, input.contact_id, input.doc_type, input.label ?? null, ciphertext, iv, encFilePath, JSON.stringify(input.metadata || {}), input.expires_at ?? null, now(), now());
+  return getDocument(id, _db2);
+}
+function getDocument(id, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT * FROM contact_documents WHERE id = ?`).get(id);
+  if (!row)
+    throw new Error(`Document not found: ${id}`);
+  return rowToDoc(row);
+}
+function listDocuments(contactId, db) {
+  const _db2 = db || getDatabase();
+  const rows = _db2.query(`SELECT id, doc_type, label, encrypted_file_path, expires_at, created_at FROM contact_documents WHERE contact_id = ? ORDER BY created_at DESC`).all(contactId);
+  return rows.map((r) => ({
+    id: r.id,
+    doc_type: r.doc_type,
+    label: r.label,
+    has_file: !!r.encrypted_file_path,
+    expires_at: r.expires_at,
+    created_at: r.created_at
+  }));
+}
+function deleteDocument(id, db) {
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT encrypted_file_path FROM contact_documents WHERE id = ?`).get(id);
+  if (row?.encrypted_file_path && existsSync6(row.encrypted_file_path)) {
+    try {
+      unlinkSync2(row.encrypted_file_path);
+    } catch {}
+  }
+  _db2.query(`DELETE FROM contact_documents WHERE id = ?`).run(id);
+}
+function rowToDoc(row) {
+  return {
+    id: row.id,
+    contact_id: row.contact_id,
+    doc_type: row.doc_type,
+    label: row.label,
+    value: decrypt(row.encrypted_value, row.iv),
+    has_file: !!row.encrypted_file_path,
+    metadata: JSON.parse(row.metadata || "{}"),
+    expires_at: row.expires_at,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+var DOCUMENT_TYPES;
+var init_documents = __esm(() => {
+  init_database();
+  init_vault();
+  DOCUMENT_TYPES = [
+    "passport",
+    "national_id",
+    "tax_id",
+    "ssn",
+    "drivers_license",
+    "bank_account",
+    "visa",
+    "insurance",
+    "contract",
+    "certificate",
+    "medical_record",
+    "prescription",
+    "allergy_list",
+    "vaccination",
+    "blood_type",
+    "health_insurance",
+    "medical_condition",
+    "emergency_contact_medical",
+    "other"
+  ];
+});
+
+// src/lib/document-scanner.ts
+var exports_document_scanner = {};
+__export(exports_document_scanner, {
+  scanDocument: () => scanDocument
+});
+import { readFileSync as readFileSync4, existsSync as existsSync7 } from "fs";
+import { extname as extname2 } from "path";
+async function scanDocument(imageSource, docType) {
+  const apiKey = process.env["OPENAI_API_KEY"];
+  if (!apiKey) {
+    throw new Error("OPENAI_API_KEY not set. Set it in ~/.secrets or environment to use document scanning.");
+  }
+  let imageData;
+  if (imageSource.startsWith("data:image/")) {
+    imageData = imageSource;
+  } else if (existsSync7(imageSource)) {
+    const buffer = readFileSync4(imageSource);
+    const ext = extname2(imageSource).slice(1).toLowerCase();
+    const mime = ext === "jpg" || ext === "jpeg" ? "image/jpeg" : ext === "png" ? "image/png" : ext === "webp" ? "image/webp" : ext === "gif" ? "image/gif" : "image/jpeg";
+    imageData = `data:${mime};base64,${buffer.toString("base64")}`;
+  } else if (/^[A-Za-z0-9+/=\n\r]+$/.test(imageSource.trim()) && imageSource.length > 100) {
+    imageData = `data:image/jpeg;base64,${imageSource.trim()}`;
+  } else {
+    throw new Error(`Image source not found or invalid: ${imageSource.slice(0, 50)}...`);
+  }
+  const typeHint = docType ? ` This is a ${docType} document.` : "";
+  const prompt = `Extract all text and structured data from this document image.${typeHint} Return a JSON object with these fields:
+- document_type: detected type (passport, national_id, drivers_license, tax_document, medical_record, prescription, insurance_card, bank_statement, visa, certificate, contract, other)
+- full_name: full name as shown
+- date_of_birth: in YYYY-MM-DD format if visible
+- document_number: main ID/document number
+- issuing_country: country code or name
+- issue_date: in YYYY-MM-DD format if visible
+- expiry_date: in YYYY-MM-DD format if visible
+- address: full address if visible
+- nationality: if visible
+- gender: if visible
+- mrz_code: Machine Readable Zone text if this is a passport/ID with MRZ
+- phone: any phone numbers visible
+- email: any email addresses visible
+- additional_fields: object with any other visible structured data
+- raw_text: all visible text transcribed
+
+Only include fields that are actually visible in the document. Return valid JSON only.`;
+  const response = await fetch("https://api.openai.com/v1/chat/completions", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      model: "gpt-4o",
+      messages: [
+        {
+          role: "user",
+          content: [
+            { type: "text", text: prompt },
+            { type: "image_url", image_url: { url: imageData, detail: "high" } }
+          ]
+        }
+      ],
+      max_tokens: 2000,
+      temperature: 0
+    })
+  });
+  if (!response.ok) {
+    const err = await response.text();
+    throw new Error(`OpenAI API error: ${response.status} \u2014 ${err}`);
+  }
+  const data = await response.json();
+  const content = data.choices?.[0]?.message?.content || "";
+  const jsonMatch = content.match(/```json\s*([\s\S]*?)```/) || content.match(/\{[\s\S]*\}/);
+  if (!jsonMatch) {
+    return { fields: {}, raw_text: content, document_type: docType || "unknown", confidence: 0.3 };
+  }
+  try {
+    const parsed = JSON.parse(jsonMatch[1] || jsonMatch[0]);
+    const { document_type, raw_text, additional_fields, ...mainFields } = parsed;
+    const fields = {};
+    for (const [k, v] of Object.entries(mainFields)) {
+      if (v && typeof v === "string")
+        fields[k] = v;
+    }
+    if (additional_fields && typeof additional_fields === "object") {
+      for (const [k, v] of Object.entries(additional_fields)) {
+        if (v && typeof v === "string")
+          fields[k] = v;
+      }
+    }
+    return {
+      fields,
+      raw_text: raw_text || content,
+      document_type: document_type || docType || "unknown",
+      confidence: Object.keys(fields).length > 3 ? 0.9 : Object.keys(fields).length > 0 ? 0.7 : 0.3
+    };
+  } catch {
+    return { fields: {}, raw_text: content, document_type: docType || "unknown", confidence: 0.3 };
+  }
+}
+var init_document_scanner = () => {};
+
+// src/db/health.ts
+var exports_health = {};
+__export(exports_health, {
+  setHealthData: () => setHealthData,
+  getHealthData: () => getHealthData,
+  deleteHealthData: () => deleteHealthData
+});
+function setHealthData(contactId, input, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const existing = _db2.query(`SELECT id FROM contact_health WHERE contact_id = ?`).get(contactId);
+  if (existing) {
+    const sets = [];
+    const params = [];
+    if (input.blood_type !== undefined) {
+      sets.push("blood_type = ?");
+      params.push(input.blood_type);
+    }
+    if (input.allergies !== undefined) {
+      sets.push("allergies = ?");
+      params.push(JSON.stringify(input.allergies));
+    }
+    if (input.medical_conditions !== undefined) {
+      sets.push("medical_conditions = ?");
+      params.push(JSON.stringify(input.medical_conditions));
+    }
+    if (input.medications !== undefined) {
+      sets.push("medications = ?");
+      params.push(JSON.stringify(input.medications));
+    }
+    if (input.emergency_contacts !== undefined) {
+      sets.push("emergency_contacts = ?");
+      params.push(JSON.stringify(input.emergency_contacts));
+    }
+    if (input.health_insurance_provider !== undefined) {
+      sets.push("health_insurance_provider = ?");
+      params.push(input.health_insurance_provider);
+    }
+    if (input.health_insurance_id !== undefined) {
+      sets.push("health_insurance_id = ?");
+      params.push(input.health_insurance_id);
+    }
+    if (input.primary_physician !== undefined) {
+      sets.push("primary_physician = ?");
+      params.push(input.primary_physician);
+    }
+    if (input.primary_physician_phone !== undefined) {
+      sets.push("primary_physician_phone = ?");
+      params.push(input.primary_physician_phone);
+    }
+    if (input.organ_donor !== undefined) {
+      sets.push("organ_donor = ?");
+      params.push(input.organ_donor ? 1 : 0);
+    }
+    if (input.notes !== undefined) {
+      sets.push("notes = ?");
+      params.push(input.notes);
+    }
+    if (sets.length) {
+      sets.push("updated_at = ?");
+      params.push(now());
+      params.push(contactId);
+      _db2.query(`UPDATE contact_health SET ${sets.join(", ")} WHERE contact_id = ?`).run(...params);
+    }
+  } else {
+    const id = uuid();
+    _db2.query(`INSERT INTO contact_health (id, contact_id, blood_type, allergies, medical_conditions, medications, emergency_contacts, health_insurance_provider, health_insurance_id, primary_physician, primary_physician_phone, organ_donor, notes, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(id, contactId, input.blood_type ?? null, JSON.stringify(input.allergies || []), JSON.stringify(input.medical_conditions || []), JSON.stringify(input.medications || []), JSON.stringify(input.emergency_contacts || []), input.health_insurance_provider ?? null, input.health_insurance_id ?? null, input.primary_physician ?? null, input.primary_physician_phone ?? null, input.organ_donor ? 1 : 0, input.notes ?? null, now(), now());
+  }
+  return getHealthData(contactId, _db2);
+}
+function getHealthData(contactId, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT * FROM contact_health WHERE contact_id = ?`).get(contactId);
+  if (!row)
+    return null;
+  return {
+    id: row.id,
+    contact_id: row.contact_id,
+    blood_type: row.blood_type,
+    allergies: JSON.parse(row.allergies || "[]"),
+    medical_conditions: JSON.parse(row.medical_conditions || "[]"),
+    medications: JSON.parse(row.medications || "[]"),
+    emergency_contacts: JSON.parse(row.emergency_contacts || "[]"),
+    health_insurance_provider: row.health_insurance_provider,
+    health_insurance_id: row.health_insurance_id,
+    primary_physician: row.primary_physician,
+    primary_physician_phone: row.primary_physician_phone,
+    organ_donor: !!row.organ_donor,
+    notes: row.notes,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+function deleteHealthData(contactId, db) {
+  const _db2 = db || getDatabase();
+  _db2.query(`DELETE FROM contact_health WHERE contact_id = ?`).run(contactId);
+}
+var init_health = __esm(() => {
+  init_database();
+  init_vault();
+});
+
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -6074,8 +6760,8 @@ function readConfig() {
 }
 
 // src/cli/index.tsx
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync4, copyFileSync, statSync, mkdirSync as mkdirSync3, readdirSync } from "fs";
-import { extname, join as join4 } from "path";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync8, copyFileSync as copyFileSync2, statSync, mkdirSync as mkdirSync5, readdirSync as readdirSync2 } from "fs";
+import { extname as extname3, join as join6 } from "path";
 function renderTable(headers, rows) {
   const colWidths = headers.map((h) => h.length);
   for (const row of rows) {
@@ -6180,7 +6866,7 @@ async function confirm(question) {
   const answer = await prompt(question + " [y/N]");
   return answer.toLowerCase() === "y" || answer.toLowerCase() === "yes";
 }
-program.name("contacts").description("Open Contacts \u2014 contact management for AI coding agents").version("0.5.0");
+program.name("contacts").description("Open Contacts \u2014 contact management for AI coding agents").version("0.6.0");
 function collect(val, prev) {
   return [...prev, val];
 }
@@ -6246,10 +6932,11 @@ Add New Contact
 \u2713 Contact created: ${contact.display_name} (${contact.id})
 `));
 });
-program.command("list").description("List contacts").option("--tag <tag_id>", "Filter by tag ID").option("--company <id>", "Filter by company ID").option("--limit <n>", "Max results", "50").action(async (opts) => {
+program.command("list").description("List contacts").option("--tag <tag_id>", "Filter by tag ID").option("--company <id>", "Filter by company ID").option("--include-restricted", "Include restricted-sensitivity contacts").option("--limit <n>", "Max results", "50").action(async (opts) => {
   const result = listContacts({
     tag_id: opts.tag,
     company_id: opts.company,
+    include_restricted: opts.includeRestricted,
     limit: parseInt(opts.limit, 10)
   });
   if (result.contacts.length === 0) {
@@ -6486,13 +7173,13 @@ Add New Tag
 `));
 });
 program.command("import <file>").description("Import contacts from CSV, vCard (.vcf), or JSON file").action(async (file) => {
-  if (!existsSync4(file)) {
+  if (!existsSync8(file)) {
     console.error(chalk.red(`
 File not found: ${file}
 `));
     process.exit(1);
   }
-  const ext = extname(file).toLowerCase();
+  const ext = extname3(file).toLowerCase();
   const formatMap = {
     ".csv": "csv",
     ".vcf": "vcf",
@@ -6506,7 +7193,7 @@ Unsupported file type: ${ext}. Use .csv, .vcf, or .json
 `));
     process.exit(1);
   }
-  const data = readFileSync2(file, "utf8");
+  const data = readFileSync5(file, "utf8");
   console.log(chalk.blue(`
 Importing ${format.toUpperCase()} from ${file}...
 `));
@@ -6537,7 +7224,7 @@ Invalid format: ${format}. Use csv, vcf, or json
   const { contacts } = listContacts({ limit: 1e5 });
   const output = await exportContacts(format, contacts);
   if (opts.output) {
-    writeFileSync2(opts.output, output, "utf8");
+    writeFileSync4(opts.output, output, "utf8");
     console.log(chalk.green(`
 \u2713 Exported ${contacts.length} contact(s) to ${opts.output}
 `));
@@ -6809,15 +7496,15 @@ program.command("init").description("Show setup info, stats, and configuration")
   console.log();
 });
 program.command("backup").description("Backup the contacts database").option("--output <path>", "Output path").option("--list", "List existing backups").action((opts) => {
-  const backupDir = join4(process.env["HOME"] || "~", ".contacts", "backups");
+  const backupDir = join6(process.env["HOME"] || "~", ".contacts", "backups");
   if (opts.list) {
-    if (!existsSync4(backupDir)) {
+    if (!existsSync8(backupDir)) {
       console.log(chalk.gray(`
 No backups found.
 `));
       return;
     }
-    const files = readdirSync(backupDir).filter((f) => f.endsWith(".db")).sort().reverse();
+    const files = readdirSync2(backupDir).filter((f) => f.endsWith(".db")).sort().reverse();
     if (files.length === 0) {
       console.log(chalk.gray(`
 No backups found.
@@ -6828,7 +7515,7 @@ No backups found.
 Existing Backups:
 `));
     for (const f of files) {
-      const filePath = join4(backupDir, f);
+      const filePath = join6(backupDir, f);
       const size2 = statSync(filePath).size;
       const mtime = statSync(filePath).mtime.toISOString().slice(0, 19).replace("T", " ");
       console.log(`  ${chalk.cyan(f)}  ${chalk.gray(`${(size2 / 1024).toFixed(1)} KB  ${mtime}`)}`);
@@ -6837,16 +7524,16 @@ Existing Backups:
     return;
   }
   const src = getDbPath();
-  if (!existsSync4(src)) {
+  if (!existsSync8(src)) {
     console.error(chalk.red(`
 Database not found: ${src}
 `));
     process.exit(1);
   }
-  mkdirSync3(backupDir, { recursive: true });
+  mkdirSync5(backupDir, { recursive: true });
   const ts = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
-  const dest = opts.output || join4(backupDir, `contacts-${ts}.db`);
-  copyFileSync(src, dest);
+  const dest = opts.output || join6(backupDir, `contacts-${ts}.db`);
+  copyFileSync2(src, dest);
   const size = statSync(dest).size;
   console.log(chalk.green(`
 \u2713 Backed up to ${dest} (${(size / 1024).toFixed(1)} KB)
@@ -8100,4 +8787,331 @@ dealsTeamCmd.command("assign <deal-id> <contact-id>").description("Assign a cont
 \u2713 ${contact.display_name} assigned as ${opts.role || "other"} in deal ${dealId}
 `));
 });
+var photoCmd = program.command("photo").description("Manage contact profile photos");
+photoCmd.command("set <contact-id> <image-path>").description("Set a contact's profile photo from a local file").action((contactId, imagePath) => {
+  const { saveImage: saveImage2 } = (init_images(), __toCommonJS(exports_images));
+  try {
+    const contact = getContact(contactId);
+    const filename = saveImage2(contactId, imagePath);
+    updateContact(contactId, { avatar_url: `~/.contacts/images/${filename}` });
+    console.log(chalk.green(`Photo set for ${contact.display_name}: ~/.contacts/images/${filename}`));
+  } catch (e) {
+    console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+  }
+});
+photoCmd.command("show <contact-id>").description("Show the path to a contact's profile photo").action((contactId) => {
+  const { getImagePath: getImagePath2 } = (init_images(), __toCommonJS(exports_images));
+  const contact = getContact(contactId);
+  const path = getImagePath2(contactId);
+  if (path) {
+    console.log(`${chalk.bold(contact.display_name)}: ${chalk.cyan(path)}`);
+  } else {
+    console.log(chalk.yellow(`No photo set for ${contact.display_name}`));
+  }
+});
+photoCmd.command("remove <contact-id>").description("Remove a contact's profile photo").action((contactId) => {
+  const { deleteImage: deleteImage2 } = (init_images(), __toCommonJS(exports_images));
+  const contact = getContact(contactId);
+  const deleted = deleteImage2(contactId);
+  if (deleted) {
+    updateContact(contactId, { avatar_url: null });
+    console.log(chalk.green(`Photo removed for ${contact.display_name}`));
+  } else {
+    console.log(chalk.yellow(`No photo found for ${contact.display_name}`));
+  }
+});
+photoCmd.command("list").description("List all stored photos").action(() => {
+  const { listImages: listImages2 } = (init_images(), __toCommonJS(exports_images));
+  const images = listImages2();
+  if (!images.length) {
+    console.log(chalk.yellow("No photos stored"));
+    return;
+  }
+  for (const img of images) {
+    try {
+      const contact = getContact(img.entity_id);
+      console.log(`${chalk.bold(contact.display_name)}: ${chalk.cyan(img.path)}`);
+    } catch {
+      console.log(`${chalk.gray(img.entity_id)}: ${chalk.cyan(img.path)}`);
+    }
+  }
+});
+var logoCmd = program.command("logo").description("Manage company logos");
+logoCmd.command("set <company-id> <image-path>").description("Set a company's logo from a local file").action((companyId, imagePath) => {
+  const { saveImage: saveImage2 } = (init_images(), __toCommonJS(exports_images));
+  try {
+    const company = getCompany(companyId);
+    if (!company) {
+      console.error(chalk.red("Company not found"));
+      return;
+    }
+    const filename = saveImage2(companyId, imagePath);
+    const { updateCompany: updateCompany2 } = (init_companies(), __toCommonJS(exports_companies));
+    updateCompany2(companyId, { logo_url: `~/.contacts/images/${filename}` });
+    console.log(chalk.green(`Logo set for ${company.name}: ~/.contacts/images/${filename}`));
+  } catch (e) {
+    console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+  }
+});
+logoCmd.command("show <company-id>").description("Show the path to a company's logo").action((companyId) => {
+  const { getImagePath: getImagePath2 } = (init_images(), __toCommonJS(exports_images));
+  const company = getCompany(companyId);
+  if (!company) {
+    console.error(chalk.red("Company not found"));
+    return;
+  }
+  const path = getImagePath2(companyId);
+  if (path) {
+    console.log(`${chalk.bold(company.name)}: ${chalk.cyan(path)}`);
+  } else {
+    console.log(chalk.yellow(`No logo set for ${company.name}`));
+  }
+});
+program.command("set-sensitivity <id> <level>").description("Set contact sensitivity level (normal, confidential, restricted)").action((id, level) => {
+  if (!["normal", "confidential", "restricted"].includes(level)) {
+    console.error(chalk.red(`
+Invalid sensitivity level: ${level}. Use: normal, confidential, restricted
+`));
+    process.exit(1);
+  }
+  const contact = getContact(id);
+  updateContact(id, { sensitivity: level });
+  console.log(chalk.green(`
+Sensitivity set to ${level} for ${contact.display_name}
+`));
+});
+var vaultCmd = program.command("vault").description("Manage the encrypted document vault");
+function promptPassphrase(promptText) {
+  const { createInterface } = __require("readline");
+  return new Promise((resolve2) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    process.stdout.write(promptText);
+    rl.question("", (answer) => {
+      rl.close();
+      resolve2(answer);
+    });
+  });
+}
+vaultCmd.command("init").description("Initialize the encrypted vault").action(async () => {
+  const { initVault: initVault2, isVaultInitialized: isVaultInitialized2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  if (isVaultInitialized2()) {
+    console.log(chalk.yellow(`
+Vault already initialized. Use "contacts vault unlock" to access it.
+`));
+    return;
+  }
+  const passphrase = await promptPassphrase("Enter vault passphrase: ");
+  if (!passphrase) {
+    console.error(chalk.red("Passphrase is required."));
+    process.exit(1);
+  }
+  const confirm2 = await promptPassphrase("Confirm passphrase: ");
+  if (passphrase !== confirm2) {
+    console.error(chalk.red("Passphrases do not match."));
+    process.exit(1);
+  }
+  initVault2(passphrase);
+  console.log(chalk.green(`
+Vault initialized and unlocked.
+`));
+});
+vaultCmd.command("unlock").description("Unlock the vault").action(async () => {
+  const { unlockVault: unlockVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  const passphrase = await promptPassphrase("Enter vault passphrase: ");
+  const ok = unlockVault2(passphrase);
+  if (!ok) {
+    console.error(chalk.red(`
+Invalid passphrase.
+`));
+    process.exit(1);
+  }
+  console.log(chalk.green(`
+Vault unlocked.
+`));
+});
+vaultCmd.command("lock").description("Lock the vault").action(async () => {
+  const { lockVault: lockVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  lockVault2();
+  console.log(chalk.green(`
+Vault locked.
+`));
+});
+vaultCmd.command("status").description("Show vault status").action(async () => {
+  const { isVaultInitialized: isVaultInitialized2, isVaultUnlocked: isVaultUnlocked2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  const initialized = isVaultInitialized2();
+  const unlocked = isVaultUnlocked2();
+  console.log(chalk.bold.blue(`
+Vault Status:`));
+  console.log(`  Initialized: ${initialized ? chalk.green("yes") : chalk.red("no")}`);
+  console.log(`  Unlocked:    ${unlocked ? chalk.green("yes") : chalk.red("no")}`);
+  if (initialized) {
+    const db = getDatabase();
+    try {
+      const docCount = db.query("SELECT COUNT(*) as n FROM contact_documents").get().n;
+      console.log(`  Documents:   ${chalk.cyan(String(docCount))}`);
+    } catch {}
+  }
+  console.log();
+});
+var docsCmd = program.command("docs").description("Manage encrypted contact documents");
+docsCmd.command("add <contact-id>").description("Add an encrypted document").option("--type <type>", "Document type (passport, national_id, tax_id, ssn, drivers_license, bank_account, visa, insurance, contract, certificate, medical_record, prescription, allergy_list, vaccination, blood_type, health_insurance, medical_condition, emergency_contact_medical, other)", "other").option("--label <label>", "Document label").option("--value <value>", "Document value (required)").option("--file <path>", "File to encrypt and attach").option("--expires <date>", "Expiry date (YYYY-MM-DD)").action(async (contactId, opts) => {
+  const { addDocument: addDocument2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  if (!opts.value) {
+    console.error(chalk.red("--value is required"));
+    process.exit(1);
+  }
+  const doc = addDocument2({
+    contact_id: contactId,
+    doc_type: opts.type || "other",
+    label: opts.label,
+    value: opts.value,
+    file_path: opts.file,
+    expires_at: opts.expires
+  });
+  console.log(chalk.green(`
+Document added: ${doc.doc_type} (${doc.id})
+`));
+});
+docsCmd.command("list <contact-id>").description("List documents for a contact (metadata only)").action(async (contactId) => {
+  const { listDocuments: listDocuments2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  const docs = listDocuments2(contactId);
+  if (!docs.length) {
+    console.log(chalk.gray(`
+No documents found.
+`));
+    return;
+  }
+  console.log();
+  renderTable(["Type", "Label", "Has File", "Expires", "Created"], docs.map((d) => ({
+    Type: d.doc_type,
+    Label: d.label || "",
+    "Has File": d.has_file ? "yes" : "no",
+    Expires: d.expires_at ? d.expires_at.slice(0, 10) : "",
+    Created: d.created_at.slice(0, 10)
+  })));
+  console.log(chalk.gray(`
+${docs.length} document(s)
+`));
+});
+docsCmd.command("show <doc-id>").description("Show a document with decrypted value (vault must be unlocked)").action(async (docId) => {
+  const { getDocument: getDocument2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  const doc = getDocument2(docId);
+  console.log(chalk.bold.blue(`
+Document: ${doc.doc_type}`));
+  if (doc.label)
+    console.log(chalk.gray("  Label:   ") + doc.label);
+  console.log(chalk.gray("  Value:   ") + doc.value);
+  console.log(chalk.gray("  Has File:") + (doc.has_file ? " yes" : " no"));
+  if (doc.expires_at)
+    console.log(chalk.gray("  Expires: ") + doc.expires_at.slice(0, 10));
+  console.log(chalk.gray(`  ID: ${doc.id}
+`));
+});
+docsCmd.command("remove <doc-id>").description("Delete a document").action(async (docId) => {
+  const { deleteDocument: deleteDocument2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  deleteDocument2(docId);
+  console.log(chalk.green(`
+Document deleted: ${docId}
+`));
+});
+docsCmd.command("scan <image-path>").description("Scan a document image using AI vision").option("--contact <id>", "Contact ID to associate with").option("--type <type>", "Document type hint").action(async (imagePath, opts) => {
+  const { scanDocument: scanDocument2 } = await Promise.resolve().then(() => (init_document_scanner(), exports_document_scanner));
+  console.log(chalk.blue(`
+Scanning document...
+`));
+  const result = await scanDocument2(imagePath, opts.type);
+  console.log(chalk.bold(`  Type: ${result.document_type}  Confidence: ${(result.confidence * 100).toFixed(0)}%
+`));
+  console.log(chalk.yellow("  Extracted fields:"));
+  for (const [k, v] of Object.entries(result.fields)) {
+    console.log(`    ${chalk.gray(k.padEnd(20))} ${v}`);
+  }
+  console.log();
+});
+docsCmd.command("types").description("List all valid document types").action(async () => {
+  const { DOCUMENT_TYPES: DOCUMENT_TYPES2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  console.log(chalk.bold.blue(`
+Document Types:
+`));
+  for (const t of DOCUMENT_TYPES2) {
+    console.log(`  ${chalk.cyan(t)}`);
+  }
+  console.log();
+});
+var healthCmd = program.command("health").description("Manage contact health data (vault required)");
+healthCmd.command("show <id>").description("Show health data for a contact").action(async (id) => {
+  const { getHealthData: getHealthData2 } = await Promise.resolve().then(() => (init_health(), exports_health));
+  const contact = getContact(id);
+  const health = getHealthData2(id);
+  if (!health) {
+    console.log(chalk.gray(`
+No health data for ${contact.display_name}.
+`));
+    return;
+  }
+  console.log(chalk.bold.blue(`
+Health: ${contact.display_name}
+`));
+  if (health.blood_type)
+    console.log(chalk.gray("  Blood Type:      ") + health.blood_type);
+  if (health.allergies.length)
+    console.log(chalk.gray("  Allergies:       ") + health.allergies.join(", "));
+  if (health.medical_conditions.length)
+    console.log(chalk.gray("  Conditions:      ") + health.medical_conditions.join(", "));
+  if (health.medications.length)
+    console.log(chalk.gray("  Medications:     ") + health.medications.join(", "));
+  if (health.emergency_contacts.length) {
+    console.log(chalk.yellow(`
+  Emergency Contacts:`));
+    for (const ec of health.emergency_contacts) {
+      console.log(`    ${chalk.bold(ec.name)}  ${ec.phone}  ${chalk.gray(ec.relationship)}`);
+    }
+  }
+  if (health.health_insurance_provider)
+    console.log(chalk.gray(`
+  Insurance:       `) + `${health.health_insurance_provider} (${health.health_insurance_id || "no ID"})`);
+  if (health.primary_physician)
+    console.log(chalk.gray("  Physician:       ") + `${health.primary_physician} ${health.primary_physician_phone || ""}`);
+  console.log(chalk.gray("  Organ Donor:     ") + (health.organ_donor ? "yes" : "no"));
+  if (health.notes)
+    console.log(chalk.gray("  Notes:           ") + health.notes);
+  console.log();
+});
+healthCmd.command("set <id>").description("Set health data for a contact").option("--blood-type <type>", "Blood type (e.g. A+, O-)").option("--allergies <list>", "Comma-separated allergies").option("--conditions <list>", "Comma-separated medical conditions").option("--medications <list>", "Comma-separated medications").option("--insurance-provider <name>", "Health insurance provider").option("--insurance-id <id>", "Health insurance ID").option("--physician <name>", "Primary physician").option("--physician-phone <phone>", "Physician phone").option("--organ-donor", "Mark as organ donor").option("--notes <text>", "Health notes").action(async (id, opts) => {
+  const { setHealthData: setHealthData2 } = await Promise.resolve().then(() => (init_health(), exports_health));
+  const contact = getContact(id);
+  const input = {};
+  if (opts.bloodType)
+    input.blood_type = opts.bloodType;
+  if (opts.allergies)
+    input.allergies = opts.allergies.split(",").map((s) => s.trim());
+  if (opts.conditions)
+    input.medical_conditions = opts.conditions.split(",").map((s) => s.trim());
+  if (opts.medications)
+    input.medications = opts.medications.split(",").map((s) => s.trim());
+  if (opts.insuranceProvider)
+    input.health_insurance_provider = opts.insuranceProvider;
+  if (opts.insuranceId)
+    input.health_insurance_id = opts.insuranceId;
+  if (opts.physician)
+    input.primary_physician = opts.physician;
+  if (opts.physicianPhone)
+    input.primary_physician_phone = opts.physicianPhone;
+  if (opts.organDonor !== undefined)
+    input.organ_donor = opts.organDonor;
+  if (opts.notes)
+    input.notes = opts.notes;
+  setHealthData2(id, input);
+  console.log(chalk.green(`
+Health data updated for ${contact.display_name}
+`));
+});
+healthCmd.command("clear <id>").description("Delete all health data for a contact").action(async (id) => {
+  const { deleteHealthData: deleteHealthData2 } = await Promise.resolve().then(() => (init_health(), exports_health));
+  const contact = getContact(id);
+  deleteHealthData2(id);
+  console.log(chalk.green(`
+Health data cleared for ${contact.display_name}
+`));
+});
 program.parse(process.argv);