@hasna/contacts 0.5.3 → 0.6.0

package/dist/mcp/index.js

@@ -557,6 +557,41 @@ var init_database = __esm(() => {
     created_at TEXT NOT NULL DEFAULT (datetime('now')),
     updated_at TEXT NOT NULL DEFAULT (datetime('now'))
   );
+  `,
+    `
+  ALTER TABLE contacts ADD COLUMN sensitivity TEXT NOT NULL DEFAULT 'normal' CHECK(sensitivity IN ('normal','confidential','restricted'));
+
+  CREATE TABLE IF NOT EXISTS contact_documents (
+    id TEXT PRIMARY KEY,
+    contact_id TEXT NOT NULL REFERENCES contacts(id) ON DELETE CASCADE,
+    doc_type TEXT NOT NULL,
+    label TEXT,
+    encrypted_value TEXT NOT NULL,
+    iv TEXT NOT NULL,
+    encrypted_file_path TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    expires_at TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+
+  CREATE TABLE IF NOT EXISTS contact_health (
+    id TEXT PRIMARY KEY,
+    contact_id TEXT NOT NULL UNIQUE REFERENCES contacts(id) ON DELETE CASCADE,
+    blood_type TEXT,
+    allergies TEXT NOT NULL DEFAULT '[]',
+    medical_conditions TEXT NOT NULL DEFAULT '[]',
+    medications TEXT NOT NULL DEFAULT '[]',
+    emergency_contacts TEXT NOT NULL DEFAULT '[]',
+    health_insurance_provider TEXT,
+    health_insurance_id TEXT,
+    primary_physician TEXT,
+    primary_physician_phone TEXT,
+    organ_donor INTEGER NOT NULL DEFAULT 0,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
   `
   ];
 });
@@ -656,6 +691,7 @@ function rowToContact(row) {
     follow_up_at: row.follow_up_at ?? null,
     archived: !!row.archived,
     project_id: row.project_id ?? null,
+    sensitivity: row.sensitivity ?? "normal",
     do_not_contact: !!row.do_not_contact,
     priority: row.priority ?? 3,
     timezone: row.timezone ?? null
@@ -743,8 +779,8 @@ function createContact(input, db) {
   const firstName = input.first_name ?? "";
   const lastName = input.last_name ?? "";
   const displayName = input.display_name ?? (firstName || lastName ? `${firstName} ${lastName}`.trim() : "Unnamed Contact");
-  d.run(`INSERT INTO contacts (id, first_name, last_name, display_name, nickname, avatar_url, notes, birthday, company_id, job_title, source, custom_fields, last_contacted_at, website, preferred_contact_method, status, follow_up_at, project_id, do_not_contact, priority, timezone, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  d.run(`INSERT INTO contacts (id, first_name, last_name, display_name, nickname, avatar_url, notes, birthday, company_id, job_title, source, custom_fields, last_contacted_at, website, preferred_contact_method, status, follow_up_at, project_id, sensitivity, do_not_contact, priority, timezone, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     firstName,
     lastName,
@@ -763,6 +799,7 @@ function createContact(input, db) {
     input.status ?? "active",
     input.follow_up_at ?? null,
     input.project_id ?? null,
+    input.sensitivity ?? "normal",
     input.do_not_contact ? 1 : 0,
     input.priority ?? 3,
     input.timezone ?? null,
@@ -811,6 +848,7 @@ function listContacts(opts = {}, db) {
     order_by = "display_name",
     order_dir = "asc",
     include_dnc = false,
+    include_restricted = false,
     priority_min,
     updated_since
   } = opts;
@@ -821,6 +859,9 @@ function listContacts(opts = {}, db) {
   if (!include_dnc) {
     conditions.push("c.do_not_contact = 0");
   }
+  if (!include_restricted) {
+    conditions.push("c.sensitivity != 'restricted'");
+  }
   if (company_id) {
     conditions.push("c.company_id = ?");
     params.push(company_id);
@@ -949,6 +990,10 @@ function updateContact(id, input, db) {
     setClauses.push("project_id = ?");
     params.push(input.project_id);
   }
+  if (input.sensitivity !== undefined) {
+    setClauses.push("sensitivity = ?");
+    params.push(input.sensitivity);
+  }
   if (input.do_not_contact !== undefined) {
     setClauses.push("do_not_contact = ?");
     params.push(input.do_not_contact ? 1 : 0);
@@ -996,26 +1041,26 @@ function searchContacts(query, db) {
   const ftsRows = d.query(`
     SELECT c.* FROM contacts c
     JOIN contacts_fts fts ON fts.id = c.id
-    WHERE contacts_fts MATCH ? AND c.archived = 0
+    WHERE contacts_fts MATCH ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     ORDER BY rank
     LIMIT 50
   `).all(`"${query.replace(/"/g, '""')}"*`);
   const emailRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN emails e ON e.contact_id = c.id
-    WHERE e.address LIKE ? AND c.archived = 0
+    WHERE e.address LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const phoneRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN phones p ON p.contact_id = c.id
-    WHERE p.number LIKE ? AND c.archived = 0
+    WHERE p.number LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const companyRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN companies co ON co.id = c.company_id
-    WHERE co.name LIKE ? AND c.archived = 0
+    WHERE co.name LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const seen = new Set;
@@ -4271,6 +4316,361 @@ function deleteImage(entityId) {
   return deleted;
 }
 
+// src/lib/vault.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join4 } from "path";
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from "crypto";
+var VAULT_DIR = join4(process.env["HOME"] || "~", ".contacts");
+var VAULT_CONFIG = join4(VAULT_DIR, "vault.json");
+var DOCUMENTS_DIR = join4(VAULT_DIR, "documents");
+var _derivedKey = null;
+function deriveKey(passphrase, salt) {
+  return pbkdf2Sync(passphrase, salt, 1e5, 32, "sha512");
+}
+function initVault(passphrase) {
+  if (!existsSync4(VAULT_DIR))
+    mkdirSync3(VAULT_DIR, { recursive: true });
+  if (!existsSync4(DOCUMENTS_DIR))
+    mkdirSync3(DOCUMENTS_DIR, { recursive: true });
+  const salt = randomBytes(32);
+  const key = deriveKey(passphrase, salt);
+  const keyHash = createHash("sha256").update(key).digest("hex");
+  const config = { salt: salt.toString("hex"), key_hash: keyHash, created_at: new Date().toISOString() };
+  writeFileSync2(VAULT_CONFIG, JSON.stringify(config, null, 2));
+  _derivedKey = key;
+}
+function isVaultInitialized() {
+  return existsSync4(VAULT_CONFIG);
+}
+function unlockVault(passphrase) {
+  if (!existsSync4(VAULT_CONFIG))
+    throw new Error("Vault not initialized. Run 'contacts vault init' first.");
+  const config = JSON.parse(readFileSync3(VAULT_CONFIG, "utf-8"));
+  const salt = Buffer.from(config.salt, "hex");
+  const key = deriveKey(passphrase, salt);
+  const keyHash = createHash("sha256").update(key).digest("hex");
+  if (keyHash !== config.key_hash)
+    return false;
+  _derivedKey = key;
+  return true;
+}
+function lockVault() {
+  _derivedKey = null;
+}
+function isVaultUnlocked() {
+  return _derivedKey !== null;
+}
+function requireVault() {
+  if (!_derivedKey)
+    throw new Error("Vault is locked. Unlock with 'contacts vault unlock' or vault_unlock MCP tool first.");
+  return _derivedKey;
+}
+function encrypt(plaintext) {
+  const key = requireVault();
+  const iv = randomBytes(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  let encrypted = cipher.update(plaintext, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return { ciphertext: encrypted + ":" + authTag, iv: iv.toString("hex") };
+}
+function decrypt(ciphertext, iv) {
+  const key = requireVault();
+  const [encData, authTag] = ciphertext.split(":");
+  if (!encData || !authTag)
+    throw new Error("Invalid ciphertext format");
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
+  decipher.setAuthTag(Buffer.from(authTag, "hex"));
+  let decrypted = decipher.update(encData, "hex", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+function encryptFile(sourcePath, entityId) {
+  const key = requireVault();
+  if (!existsSync4(DOCUMENTS_DIR))
+    mkdirSync3(DOCUMENTS_DIR, { recursive: true });
+  const data = readFileSync3(sourcePath);
+  const iv = randomBytes(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  const destPath = join4(DOCUMENTS_DIR, `${entityId}.enc`);
+  const output = Buffer.concat([iv, authTag, encrypted]);
+  writeFileSync2(destPath, output);
+  return destPath;
+}
+
+// src/db/documents.ts
+init_database();
+import { existsSync as existsSync5, unlinkSync as unlinkSync2 } from "fs";
+var DOCUMENT_TYPES = [
+  "passport",
+  "national_id",
+  "tax_id",
+  "ssn",
+  "drivers_license",
+  "bank_account",
+  "visa",
+  "insurance",
+  "contract",
+  "certificate",
+  "medical_record",
+  "prescription",
+  "allergy_list",
+  "vaccination",
+  "blood_type",
+  "health_insurance",
+  "medical_condition",
+  "emergency_contact_medical",
+  "other"
+];
+function addDocument(input, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const id = uuid();
+  const { ciphertext, iv } = encrypt(input.value);
+  let encFilePath = null;
+  if (input.file_path) {
+    encFilePath = encryptFile(input.file_path, id);
+  }
+  _db2.query(`INSERT INTO contact_documents (id, contact_id, doc_type, label, encrypted_value, iv, encrypted_file_path, metadata, expires_at, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)`).run(id, input.contact_id, input.doc_type, input.label ?? null, ciphertext, iv, encFilePath, JSON.stringify(input.metadata || {}), input.expires_at ?? null, now(), now());
+  return getDocument(id, _db2);
+}
+function getDocument(id, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT * FROM contact_documents WHERE id = ?`).get(id);
+  if (!row)
+    throw new Error(`Document not found: ${id}`);
+  return rowToDoc(row);
+}
+function listDocuments(contactId, db) {
+  const _db2 = db || getDatabase();
+  const rows = _db2.query(`SELECT id, doc_type, label, encrypted_file_path, expires_at, created_at FROM contact_documents WHERE contact_id = ? ORDER BY created_at DESC`).all(contactId);
+  return rows.map((r) => ({
+    id: r.id,
+    doc_type: r.doc_type,
+    label: r.label,
+    has_file: !!r.encrypted_file_path,
+    expires_at: r.expires_at,
+    created_at: r.created_at
+  }));
+}
+function deleteDocument(id, db) {
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT encrypted_file_path FROM contact_documents WHERE id = ?`).get(id);
+  if (row?.encrypted_file_path && existsSync5(row.encrypted_file_path)) {
+    try {
+      unlinkSync2(row.encrypted_file_path);
+    } catch {}
+  }
+  _db2.query(`DELETE FROM contact_documents WHERE id = ?`).run(id);
+}
+function rowToDoc(row) {
+  return {
+    id: row.id,
+    contact_id: row.contact_id,
+    doc_type: row.doc_type,
+    label: row.label,
+    value: decrypt(row.encrypted_value, row.iv),
+    has_file: !!row.encrypted_file_path,
+    metadata: JSON.parse(row.metadata || "{}"),
+    expires_at: row.expires_at,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+
+// src/db/health.ts
+init_database();
+function setHealthData(contactId, input, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const existing = _db2.query(`SELECT id FROM contact_health WHERE contact_id = ?`).get(contactId);
+  if (existing) {
+    const sets = [];
+    const params = [];
+    if (input.blood_type !== undefined) {
+      sets.push("blood_type = ?");
+      params.push(input.blood_type);
+    }
+    if (input.allergies !== undefined) {
+      sets.push("allergies = ?");
+      params.push(JSON.stringify(input.allergies));
+    }
+    if (input.medical_conditions !== undefined) {
+      sets.push("medical_conditions = ?");
+      params.push(JSON.stringify(input.medical_conditions));
+    }
+    if (input.medications !== undefined) {
+      sets.push("medications = ?");
+      params.push(JSON.stringify(input.medications));
+    }
+    if (input.emergency_contacts !== undefined) {
+      sets.push("emergency_contacts = ?");
+      params.push(JSON.stringify(input.emergency_contacts));
+    }
+    if (input.health_insurance_provider !== undefined) {
+      sets.push("health_insurance_provider = ?");
+      params.push(input.health_insurance_provider);
+    }
+    if (input.health_insurance_id !== undefined) {
+      sets.push("health_insurance_id = ?");
+      params.push(input.health_insurance_id);
+    }
+    if (input.primary_physician !== undefined) {
+      sets.push("primary_physician = ?");
+      params.push(input.primary_physician);
+    }
+    if (input.primary_physician_phone !== undefined) {
+      sets.push("primary_physician_phone = ?");
+      params.push(input.primary_physician_phone);
+    }
+    if (input.organ_donor !== undefined) {
+      sets.push("organ_donor = ?");
+      params.push(input.organ_donor ? 1 : 0);
+    }
+    if (input.notes !== undefined) {
+      sets.push("notes = ?");
+      params.push(input.notes);
+    }
+    if (sets.length) {
+      sets.push("updated_at = ?");
+      params.push(now());
+      params.push(contactId);
+      _db2.query(`UPDATE contact_health SET ${sets.join(", ")} WHERE contact_id = ?`).run(...params);
+    }
+  } else {
+    const id = uuid();
+    _db2.query(`INSERT INTO contact_health (id, contact_id, blood_type, allergies, medical_conditions, medications, emergency_contacts, health_insurance_provider, health_insurance_id, primary_physician, primary_physician_phone, organ_donor, notes, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(id, contactId, input.blood_type ?? null, JSON.stringify(input.allergies || []), JSON.stringify(input.medical_conditions || []), JSON.stringify(input.medications || []), JSON.stringify(input.emergency_contacts || []), input.health_insurance_provider ?? null, input.health_insurance_id ?? null, input.primary_physician ?? null, input.primary_physician_phone ?? null, input.organ_donor ? 1 : 0, input.notes ?? null, now(), now());
+  }
+  return getHealthData(contactId, _db2);
+}
+function getHealthData(contactId, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT * FROM contact_health WHERE contact_id = ?`).get(contactId);
+  if (!row)
+    return null;
+  return {
+    id: row.id,
+    contact_id: row.contact_id,
+    blood_type: row.blood_type,
+    allergies: JSON.parse(row.allergies || "[]"),
+    medical_conditions: JSON.parse(row.medical_conditions || "[]"),
+    medications: JSON.parse(row.medications || "[]"),
+    emergency_contacts: JSON.parse(row.emergency_contacts || "[]"),
+    health_insurance_provider: row.health_insurance_provider,
+    health_insurance_id: row.health_insurance_id,
+    primary_physician: row.primary_physician,
+    primary_physician_phone: row.primary_physician_phone,
+    organ_donor: !!row.organ_donor,
+    notes: row.notes,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+function deleteHealthData(contactId, db) {
+  const _db2 = db || getDatabase();
+  _db2.query(`DELETE FROM contact_health WHERE contact_id = ?`).run(contactId);
+}
+
+// src/lib/document-scanner.ts
+import { readFileSync as readFileSync4, existsSync as existsSync6 } from "fs";
+import { extname as extname2 } from "path";
+async function scanDocument(imageSource, docType) {
+  const apiKey = process.env["OPENAI_API_KEY"];
+  if (!apiKey) {
+    throw new Error("OPENAI_API_KEY not set. Set it in ~/.secrets or environment to use document scanning.");
+  }
+  let imageData;
+  if (imageSource.startsWith("data:image/")) {
+    imageData = imageSource;
+  } else if (existsSync6(imageSource)) {
+    const buffer = readFileSync4(imageSource);
+    const ext = extname2(imageSource).slice(1).toLowerCase();
+    const mime = ext === "jpg" || ext === "jpeg" ? "image/jpeg" : ext === "png" ? "image/png" : ext === "webp" ? "image/webp" : ext === "gif" ? "image/gif" : "image/jpeg";
+    imageData = `data:${mime};base64,${buffer.toString("base64")}`;
+  } else if (/^[A-Za-z0-9+/=\n\r]+$/.test(imageSource.trim()) && imageSource.length > 100) {
+    imageData = `data:image/jpeg;base64,${imageSource.trim()}`;
+  } else {
+    throw new Error(`Image source not found or invalid: ${imageSource.slice(0, 50)}...`);
+  }
+  const typeHint = docType ? ` This is a ${docType} document.` : "";
+  const prompt = `Extract all text and structured data from this document image.${typeHint} Return a JSON object with these fields:
+- document_type: detected type (passport, national_id, drivers_license, tax_document, medical_record, prescription, insurance_card, bank_statement, visa, certificate, contract, other)
+- full_name: full name as shown
+- date_of_birth: in YYYY-MM-DD format if visible
+- document_number: main ID/document number
+- issuing_country: country code or name
+- issue_date: in YYYY-MM-DD format if visible
+- expiry_date: in YYYY-MM-DD format if visible
+- address: full address if visible
+- nationality: if visible
+- gender: if visible
+- mrz_code: Machine Readable Zone text if this is a passport/ID with MRZ
+- phone: any phone numbers visible
+- email: any email addresses visible
+- additional_fields: object with any other visible structured data
+- raw_text: all visible text transcribed
+
+Only include fields that are actually visible in the document. Return valid JSON only.`;
+  const response = await fetch("https://api.openai.com/v1/chat/completions", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      model: "gpt-4o",
+      messages: [
+        {
+          role: "user",
+          content: [
+            { type: "text", text: prompt },
+            { type: "image_url", image_url: { url: imageData, detail: "high" } }
+          ]
+        }
+      ],
+      max_tokens: 2000,
+      temperature: 0
+    })
+  });
+  if (!response.ok) {
+    const err = await response.text();
+    throw new Error(`OpenAI API error: ${response.status} \u2014 ${err}`);
+  }
+  const data = await response.json();
+  const content = data.choices?.[0]?.message?.content || "";
+  const jsonMatch = content.match(/```json\s*([\s\S]*?)```/) || content.match(/\{[\s\S]*\}/);
+  if (!jsonMatch) {
+    return { fields: {}, raw_text: content, document_type: docType || "unknown", confidence: 0.3 };
+  }
+  try {
+    const parsed = JSON.parse(jsonMatch[1] || jsonMatch[0]);
+    const { document_type, raw_text, additional_fields, ...mainFields } = parsed;
+    const fields = {};
+    for (const [k, v] of Object.entries(mainFields)) {
+      if (v && typeof v === "string")
+        fields[k] = v;
+    }
+    if (additional_fields && typeof additional_fields === "object") {
+      for (const [k, v] of Object.entries(additional_fields)) {
+        if (v && typeof v === "string")
+          fields[k] = v;
+      }
+    }
+    return {
+      fields,
+      raw_text: raw_text || content,
+      document_type: document_type || docType || "unknown",
+      confidence: Object.keys(fields).length > 3 ? 0.9 : Object.keys(fields).length > 0 ? 0.7 : 0.3
+    };
+  } catch {
+    return { fields: {}, raw_text: content, document_type: docType || "unknown", confidence: 0.3 };
+  }
+}
+
 // src/mcp/index.ts
 var server = new Server({ name: "contacts", version: "0.1.0" }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({
@@ -4349,7 +4749,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
             }
           },
           tag_ids: { type: "array", items: { type: "string" }, description: "Tag IDs to assign" },
-          source: { type: "string", enum: ["manual", "import", "linkedin", "github", "twitter", "email", "calendar", "crm", "other"] }
+          source: { type: "string", enum: ["manual", "import", "linkedin", "github", "twitter", "email", "calendar", "crm", "other"] },
+          sensitivity: { type: "string", enum: ["normal", "confidential", "restricted"], description: "Contact sensitivity level (default: normal)" }
         }
       }
     },
@@ -4385,6 +4786,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
           project_id: { type: "string", description: "Primary project ID (single, null to clear)" },
           project_ids: { type: "array", items: { type: "string" }, description: "Replace all project links with this array of todos project IDs" },
           source: { type: "string", enum: ["manual", "import", "linkedin", "github", "twitter", "email", "calendar", "crm", "other"] },
+          sensitivity: { type: "string", enum: ["normal", "confidential", "restricted"] },
           emails_add: { type: "array", items: { type: "object", properties: { address: { type: "string" }, type: { type: "string" }, is_primary: { type: "boolean" } }, required: ["address"] }, description: "New email addresses to append (duplicates are skipped)" },
           phones_add: { type: "array", items: { type: "object", properties: { number: { type: "string" }, type: { type: "string" }, country_code: { type: "string" }, is_primary: { type: "boolean" } }, required: ["number"] }, description: "New phone numbers to append (duplicates are skipped)" }
         },
@@ -4413,6 +4815,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
           status: { type: "string", enum: ["active", "pending_reply", "converted", "closed", "other"] },
           project_id: { type: "string", description: "Filter by project ID" },
           archived: { type: "boolean", description: "Include archived contacts (default false)" },
+          include_restricted: { type: "boolean", description: "Include restricted-sensitivity contacts (default false)" },
           follow_up_due: { type: "boolean", description: "Only return contacts whose follow_up_at is in the past" },
           last_contacted_after: { type: "string", description: "ISO 8601 date \u2014 only contacts last contacted after this date" },
           last_contacted_before: { type: "string", description: "ISO 8601 date \u2014 only contacts last contacted before this date" },
@@ -5737,7 +6140,20 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     { name: "delete_contact_photo", description: "Remove a contact's profile photo.", inputSchema: { type: "object", properties: { contact_id: { type: "string" } }, required: ["contact_id"] } },
     { name: "set_company_logo", description: "Set a company's logo image. Provide either a local file path or base64-encoded image data. Stores image in ~/.contacts/images/ and updates logo_url.", inputSchema: { type: "object", properties: { company_id: { type: "string" }, image: { type: "string", description: "File path or base64 data" }, format: { type: "string", description: "Image format hint for raw base64" } }, required: ["company_id", "image"] } },
     { name: "get_company_logo", description: "Get a company's logo as base64 data URI.", inputSchema: { type: "object", properties: { company_id: { type: "string" } }, required: ["company_id"] } },
-    { name: "delete_company_logo", description: "Remove a company's logo image.", inputSchema: { type: "object", properties: { company_id: { type: "string" } }, required: ["company_id"] } }
+    { name: "delete_company_logo", description: "Remove a company's logo image.", inputSchema: { type: "object", properties: { company_id: { type: "string" } }, required: ["company_id"] } },
+    { name: "set_sensitivity", description: "Set a contact's sensitivity level (normal, confidential, restricted). Restricted contacts are hidden from list/search unless explicitly requested.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, sensitivity: { type: "string", enum: ["normal", "confidential", "restricted"] } }, required: ["contact_id", "sensitivity"] } },
+    { name: "vault_init", description: "Initialize the encrypted document vault with a passphrase. Must be called before storing documents or health data.", inputSchema: { type: "object", properties: { passphrase: { type: "string" } }, required: ["passphrase"] } },
+    { name: "vault_unlock", description: "Unlock the vault for this session with a passphrase.", inputSchema: { type: "object", properties: { passphrase: { type: "string" } }, required: ["passphrase"] } },
+    { name: "vault_lock", description: "Lock the vault, clearing the encryption key from memory.", inputSchema: { type: "object", properties: {} } },
+    { name: "vault_status", description: "Check vault initialization and lock status.", inputSchema: { type: "object", properties: {} } },
+    { name: "add_document", description: "Store an encrypted document for a contact (passport, tax_id, medical_record, etc.). Vault must be unlocked.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, doc_type: { type: "string", enum: [...DOCUMENT_TYPES] }, label: { type: "string" }, value: { type: "string", description: "Plaintext value (will be encrypted)" }, file_path: { type: "string", description: "Optional file to encrypt and attach" }, metadata: { type: "object" }, expires_at: { type: "string" } }, required: ["contact_id", "doc_type", "value"] } },
+    { name: "list_documents", description: "List documents for a contact (metadata only \u2014 no decryption needed).", inputSchema: { type: "object", properties: { contact_id: { type: "string" } }, required: ["contact_id"] } },
+    { name: "get_document", description: "Get a document with decrypted value. Vault must be unlocked.", inputSchema: { type: "object", properties: { document_id: { type: "string" } }, required: ["document_id"] } },
+    { name: "delete_document", description: "Delete a document and its encrypted file.", inputSchema: { type: "object", properties: { document_id: { type: "string" } }, required: ["document_id"] } },
+    { name: "scan_document", description: "Scan a document image using AI vision (OpenAI GPT-4o) to extract structured data. Optionally auto-save to vault.", inputSchema: { type: "object", properties: { image: { type: "string", description: "File path or base64 image data" }, doc_type: { type: "string", description: "Hint: passport, national_id, drivers_license, etc." }, contact_id: { type: "string", description: "Contact to associate scanned document with" }, auto_save: { type: "boolean", description: "Automatically save extracted data as a vault document" } }, required: ["image"] } },
+    { name: "set_health_data", description: "Set or update health data for a contact. Vault must be unlocked.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, blood_type: { type: "string" }, allergies: { type: "array", items: { type: "string" } }, medical_conditions: { type: "array", items: { type: "string" } }, medications: { type: "array", items: { type: "string" } }, emergency_contacts: { type: "array", items: { type: "object", properties: { name: { type: "string" }, phone: { type: "string" }, relationship: { type: "string" } }, required: ["name", "phone", "relationship"] } }, health_insurance_provider: { type: "string" }, health_insurance_id: { type: "string" }, primary_physician: { type: "string" }, primary_physician_phone: { type: "string" }, organ_donor: { type: "boolean" }, notes: { type: "string" } }, required: ["contact_id"] } },
+    { name: "get_health_data", description: "Get health data for a contact. Vault must be unlocked.", inputSchema: { type: "object", properties: { contact_id: { type: "string" } }, required: ["contact_id"] } },
+    { name: "delete_health_data", description: "Delete all health data for a contact.", inputSchema: { type: "object", properties: { contact_id: { type: "string" } }, required: ["contact_id"] } }
   ]
 }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
@@ -5766,7 +6182,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           addresses: a.addresses,
           social_profiles: a.social_profiles,
           tag_ids: a.tag_ids,
-          source: a.source
+          source: a.source,
+          sensitivity: a.sensitivity
         };
         const contact = createContact(input);
         if (Array.isArray(a.project_ids) && a.project_ids.length > 0) {
@@ -5801,6 +6218,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           follow_up_at: rest.follow_up_at,
           project_id: rest.project_id,
           source: rest.source,
+          sensitivity: rest.sensitivity,
           emails_add: rest.emails_add,
           phones_add: rest.phones_add
         };
@@ -5824,6 +6242,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           status: a.status,
           project_id: a.project_id,
           archived: a.archived,
+          include_restricted: a.include_restricted,
           follow_up_due: a.follow_up_due,
           last_contacted_after: a.last_contacted_after,
           last_contacted_before: a.last_contacted_before,
@@ -7270,6 +7689,100 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           updateCompany(company_id, { logo_url: null });
         return { content: [{ type: "text", text: JSON.stringify({ ok: true, deleted }) }] };
       }
+      case "set_sensitivity": {
+        const contact = updateContact(a.contact_id, { sensitivity: a.sensitivity });
+        return { content: [{ type: "text", text: JSON.stringify({ ok: true, contact_id: a.contact_id, sensitivity: a.sensitivity }) }] };
+      }
+      case "vault_init": {
+        initVault(a.passphrase);
+        return { content: [{ type: "text", text: JSON.stringify({ ok: true, message: "Vault initialized and unlocked" }) }] };
+      }
+      case "vault_unlock": {
+        const ok = unlockVault(a.passphrase);
+        if (!ok)
+          return { content: [{ type: "text", text: "Invalid passphrase" }], isError: true };
+        return { content: [{ type: "text", text: JSON.stringify({ ok: true, message: "Vault unlocked" }) }] };
+      }
+      case "vault_lock": {
+        lockVault();
+        return { content: [{ type: "text", text: JSON.stringify({ ok: true, message: "Vault locked" }) }] };
+      }
+      case "vault_status": {
+        const initialized = isVaultInitialized();
+        const unlocked = isVaultUnlocked();
+        const db = getDatabase();
+        let docCount = 0;
+        try {
+          docCount = db.query("SELECT COUNT(*) as n FROM contact_documents").get().n;
+        } catch {}
+        return { content: [{ type: "text", text: JSON.stringify({ initialized, unlocked, document_count: docCount }) }] };
+      }
+      case "add_document": {
+        const doc = addDocument({
+          contact_id: a.contact_id,
+          doc_type: a.doc_type,
+          label: a.label,
+          value: a.value,
+          file_path: a.file_path,
+          metadata: a.metadata,
+          expires_at: a.expires_at
+        });
+        return { content: [{ type: "text", text: JSON.stringify(doc, null, 2) }] };
+      }
+      case "list_documents": {
+        const docs = listDocuments(a.contact_id);
+        return { content: [{ type: "text", text: JSON.stringify(docs, null, 2) }] };
+      }
+      case "get_document": {
+        const doc = getDocument(a.document_id);
+        return { content: [{ type: "text", text: JSON.stringify(doc, null, 2) }] };
+      }
+      case "delete_document": {
+        deleteDocument(a.document_id);
+        return { content: [{ type: "text", text: JSON.stringify({ deleted: true }) }] };
+      }
+      case "scan_document": {
+        const result = await scanDocument(a.image, a.doc_type);
+        if (a.auto_save && a.contact_id && isVaultUnlocked()) {
+          try {
+            const doc = addDocument({
+              contact_id: a.contact_id,
+              doc_type: result.document_type || "other",
+              label: `Scanned ${result.document_type}`,
+              value: JSON.stringify(result.fields),
+              metadata: { raw_text: result.raw_text, confidence: result.confidence }
+            });
+            return { content: [{ type: "text", text: JSON.stringify({ scan: result, saved_document: doc }, null, 2) }] };
+          } catch (saveErr) {
+            return { content: [{ type: "text", text: JSON.stringify({ scan: result, save_error: saveErr instanceof Error ? saveErr.message : String(saveErr) }, null, 2) }] };
+          }
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      }
+      case "set_health_data": {
+        const health = setHealthData(a.contact_id, {
+          blood_type: a.blood_type,
+          allergies: a.allergies,
+          medical_conditions: a.medical_conditions,
+          medications: a.medications,
+          emergency_contacts: a.emergency_contacts,
+          health_insurance_provider: a.health_insurance_provider,
+          health_insurance_id: a.health_insurance_id,
+          primary_physician: a.primary_physician,
+          primary_physician_phone: a.primary_physician_phone,
+          organ_donor: a.organ_donor,
+          notes: a.notes
+        });
+        return { content: [{ type: "text", text: JSON.stringify(health, null, 2) }] };
+      }
+      case "get_health_data": {
+        const health = getHealthData(a.contact_id);
+        return { content: [{ type: "text", text: JSON.stringify(health, null, 2) }] };
+      }
+      case "delete_health_data": {
+        deleteHealthData(a.contact_id);
+        return { content: [{ type: "text", text: JSON.stringify({ deleted: true }) }] };
+      }
       default:
         return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
     }