@hasna/contacts 0.5.3 → 0.6.1

package/dist/cli/index.js

@@ -2647,6 +2647,41 @@ var init_database = __esm(() => {
     created_at TEXT NOT NULL DEFAULT (datetime('now')),
     updated_at TEXT NOT NULL DEFAULT (datetime('now'))
   );
+  `,
+    `
+  ALTER TABLE contacts ADD COLUMN sensitivity TEXT NOT NULL DEFAULT 'normal' CHECK(sensitivity IN ('normal','confidential','restricted'));
+
+  CREATE TABLE IF NOT EXISTS contact_documents (
+    id TEXT PRIMARY KEY,
+    contact_id TEXT NOT NULL REFERENCES contacts(id) ON DELETE CASCADE,
+    doc_type TEXT NOT NULL,
+    label TEXT,
+    encrypted_value TEXT NOT NULL,
+    iv TEXT NOT NULL,
+    encrypted_file_path TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    expires_at TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+
+  CREATE TABLE IF NOT EXISTS contact_health (
+    id TEXT PRIMARY KEY,
+    contact_id TEXT NOT NULL UNIQUE REFERENCES contacts(id) ON DELETE CASCADE,
+    blood_type TEXT,
+    allergies TEXT NOT NULL DEFAULT '[]',
+    medical_conditions TEXT NOT NULL DEFAULT '[]',
+    medications TEXT NOT NULL DEFAULT '[]',
+    emergency_contacts TEXT NOT NULL DEFAULT '[]',
+    health_insurance_provider TEXT,
+    health_insurance_id TEXT,
+    primary_physician TEXT,
+    primary_physician_phone TEXT,
+    organ_donor INTEGER NOT NULL DEFAULT 0,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
   `
   ];
 });
@@ -2696,6 +2731,7 @@ function rowToContact(row) {
     follow_up_at: row.follow_up_at ?? null,
     archived: !!row.archived,
     project_id: row.project_id ?? null,
+    sensitivity: row.sensitivity ?? "normal",
     do_not_contact: !!row.do_not_contact,
     priority: row.priority ?? 3,
     timezone: row.timezone ?? null
@@ -2783,8 +2819,8 @@ function createContact(input, db) {
   const firstName = input.first_name ?? "";
   const lastName = input.last_name ?? "";
   const displayName = input.display_name ?? (firstName || lastName ? `${firstName} ${lastName}`.trim() : "Unnamed Contact");
-  d.run(`INSERT INTO contacts (id, first_name, last_name, display_name, nickname, avatar_url, notes, birthday, company_id, job_title, source, custom_fields, last_contacted_at, website, preferred_contact_method, status, follow_up_at, project_id, do_not_contact, priority, timezone, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  d.run(`INSERT INTO contacts (id, first_name, last_name, display_name, nickname, avatar_url, notes, birthday, company_id, job_title, source, custom_fields, last_contacted_at, website, preferred_contact_method, status, follow_up_at, project_id, sensitivity, do_not_contact, priority, timezone, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     firstName,
     lastName,
@@ -2803,6 +2839,7 @@ function createContact(input, db) {
     input.status ?? "active",
     input.follow_up_at ?? null,
     input.project_id ?? null,
+    input.sensitivity ?? "normal",
     input.do_not_contact ? 1 : 0,
     input.priority ?? 3,
     input.timezone ?? null,
@@ -2851,6 +2888,7 @@ function listContacts(opts = {}, db) {
     order_by = "display_name",
     order_dir = "asc",
     include_dnc = false,
+    include_restricted = false,
     priority_min,
     updated_since
   } = opts;
@@ -2861,6 +2899,9 @@ function listContacts(opts = {}, db) {
   if (!include_dnc) {
     conditions.push("c.do_not_contact = 0");
   }
+  if (!include_restricted) {
+    conditions.push("c.sensitivity != 'restricted'");
+  }
   if (company_id) {
     conditions.push("c.company_id = ?");
     params.push(company_id);
@@ -2989,6 +3030,10 @@ function updateContact(id, input, db) {
     setClauses.push("project_id = ?");
     params.push(input.project_id);
   }
+  if (input.sensitivity !== undefined) {
+    setClauses.push("sensitivity = ?");
+    params.push(input.sensitivity);
+  }
   if (input.do_not_contact !== undefined) {
     setClauses.push("do_not_contact = ?");
     params.push(input.do_not_contact ? 1 : 0);
@@ -3036,26 +3081,26 @@ function searchContacts(query, db) {
   const ftsRows = d.query(`
     SELECT c.* FROM contacts c
     JOIN contacts_fts fts ON fts.id = c.id
-    WHERE contacts_fts MATCH ? AND c.archived = 0
+    WHERE contacts_fts MATCH ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     ORDER BY rank
     LIMIT 50
   `).all(`"${query.replace(/"/g, '""')}"*`);
   const emailRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN emails e ON e.contact_id = c.id
-    WHERE e.address LIKE ? AND c.archived = 0
+    WHERE e.address LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const phoneRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN phones p ON p.contact_id = c.id
-    WHERE p.number LIKE ? AND c.archived = 0
+    WHERE p.number LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const companyRows = d.query(`
     SELECT DISTINCT c.* FROM contacts c
     JOIN companies co ON co.id = c.company_id
-    WHERE co.name LIKE ? AND c.archived = 0
+    WHERE co.name LIKE ? AND c.archived = 0 AND c.sensitivity != 'restricted'
     LIMIT 20
   `).all(`%${query}%`);
   const seen = new Set;
@@ -3537,6 +3582,7 @@ function listCompanyEmployees(companyId, db) {
     follow_up_at: r.follow_up_at ?? null,
     archived: !!r.archived,
     project_id: r.project_id ?? null,
+    sensitivity: r.sensitivity ?? "normal",
     do_not_contact: !!r.do_not_contact,
     priority: r.priority ?? 3,
     timezone: r.timezone ?? null
@@ -3939,6 +3985,7 @@ function listContactsByTag(tagId, db) {
     follow_up_at: r.follow_up_at ?? null,
     archived: !!r.archived,
     project_id: r.project_id ?? null,
+    sensitivity: r.sensitivity ?? "normal",
     do_not_contact: !!r.do_not_contact,
     priority: r.priority ?? 3,
     timezone: r.timezone ?? null
@@ -6001,6 +6048,418 @@ var init_org_chart = __esm(() => {
   init_database();
 });
 
+// src/lib/vault.ts
+var exports_vault = {};
+__export(exports_vault, {
+  unlockVault: () => unlockVault,
+  requireVault: () => requireVault,
+  lockVault: () => lockVault,
+  isVaultUnlocked: () => isVaultUnlocked,
+  isVaultInitialized: () => isVaultInitialized,
+  initVault: () => initVault,
+  getDocumentsDir: () => getDocumentsDir,
+  encryptFile: () => encryptFile,
+  encrypt: () => encrypt,
+  decryptFile: () => decryptFile,
+  decrypt: () => decrypt
+});
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join5 } from "path";
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from "crypto";
+function deriveKey(passphrase, salt) {
+  return pbkdf2Sync(passphrase, salt, 1e5, 32, "sha512");
+}
+function initVault(passphrase) {
+  if (!existsSync5(VAULT_DIR))
+    mkdirSync4(VAULT_DIR, { recursive: true });
+  if (!existsSync5(DOCUMENTS_DIR))
+    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  const salt = randomBytes(32);
+  const key = deriveKey(passphrase, salt);
+  const keyHash = createHash("sha256").update(key).digest("hex");
+  const config = { salt: salt.toString("hex"), key_hash: keyHash, created_at: new Date().toISOString() };
+  writeFileSync3(VAULT_CONFIG, JSON.stringify(config, null, 2));
+  _derivedKey = key;
+}
+function isVaultInitialized() {
+  return existsSync5(VAULT_CONFIG);
+}
+function unlockVault(passphrase) {
+  if (!existsSync5(VAULT_CONFIG))
+    throw new Error("Vault not initialized. Run 'contacts vault init' first.");
+  const config = JSON.parse(readFileSync3(VAULT_CONFIG, "utf-8"));
+  const salt = Buffer.from(config.salt, "hex");
+  const key = deriveKey(passphrase, salt);
+  const keyHash = createHash("sha256").update(key).digest("hex");
+  if (keyHash !== config.key_hash)
+    return false;
+  _derivedKey = key;
+  return true;
+}
+function lockVault() {
+  _derivedKey = null;
+}
+function isVaultUnlocked() {
+  return _derivedKey !== null;
+}
+function requireVault() {
+  if (!_derivedKey)
+    throw new Error("Vault is locked. Unlock with 'contacts vault unlock' or vault_unlock MCP tool first.");
+  return _derivedKey;
+}
+function encrypt(plaintext) {
+  const key = requireVault();
+  const iv = randomBytes(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  let encrypted = cipher.update(plaintext, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return { ciphertext: encrypted + ":" + authTag, iv: iv.toString("hex") };
+}
+function decrypt(ciphertext, iv) {
+  const key = requireVault();
+  const [encData, authTag] = ciphertext.split(":");
+  if (!encData || !authTag)
+    throw new Error("Invalid ciphertext format");
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
+  decipher.setAuthTag(Buffer.from(authTag, "hex"));
+  let decrypted = decipher.update(encData, "hex", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+function encryptFile(sourcePath, entityId) {
+  const key = requireVault();
+  if (!existsSync5(DOCUMENTS_DIR))
+    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  const data = readFileSync3(sourcePath);
+  const iv = randomBytes(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  const destPath = join5(DOCUMENTS_DIR, `${entityId}.enc`);
+  const output = Buffer.concat([iv, authTag, encrypted]);
+  writeFileSync3(destPath, output);
+  return destPath;
+}
+function decryptFile(encPath) {
+  const key = requireVault();
+  const data = readFileSync3(encPath);
+  const iv = data.subarray(0, 16);
+  const authTag = data.subarray(16, 32);
+  const encrypted = data.subarray(32);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+}
+function getDocumentsDir() {
+  if (!existsSync5(DOCUMENTS_DIR))
+    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  return DOCUMENTS_DIR;
+}
+var VAULT_DIR, VAULT_CONFIG, DOCUMENTS_DIR, _derivedKey = null;
+var init_vault = __esm(() => {
+  VAULT_DIR = join5(process.env["HOME"] || "~", ".contacts");
+  VAULT_CONFIG = join5(VAULT_DIR, "vault.json");
+  DOCUMENTS_DIR = join5(VAULT_DIR, "documents");
+});
+
+// src/db/documents.ts
+var exports_documents = {};
+__export(exports_documents, {
+  listDocuments: () => listDocuments,
+  getDocument: () => getDocument,
+  deleteDocument: () => deleteDocument,
+  addDocument: () => addDocument,
+  DOCUMENT_TYPES: () => DOCUMENT_TYPES
+});
+import { existsSync as existsSync6, unlinkSync as unlinkSync2 } from "fs";
+function addDocument(input, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const id = uuid();
+  const { ciphertext, iv } = encrypt(input.value);
+  let encFilePath = null;
+  if (input.file_path) {
+    encFilePath = encryptFile(input.file_path, id);
+  }
+  _db2.query(`INSERT INTO contact_documents (id, contact_id, doc_type, label, encrypted_value, iv, encrypted_file_path, metadata, expires_at, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)`).run(id, input.contact_id, input.doc_type, input.label ?? null, ciphertext, iv, encFilePath, JSON.stringify(input.metadata || {}), input.expires_at ?? null, now(), now());
+  return getDocument(id, _db2);
+}
+function getDocument(id, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT * FROM contact_documents WHERE id = ?`).get(id);
+  if (!row)
+    throw new Error(`Document not found: ${id}`);
+  return rowToDoc(row);
+}
+function listDocuments(contactId, db) {
+  const _db2 = db || getDatabase();
+  const rows = _db2.query(`SELECT id, doc_type, label, encrypted_file_path, expires_at, created_at FROM contact_documents WHERE contact_id = ? ORDER BY created_at DESC`).all(contactId);
+  return rows.map((r) => ({
+    id: r.id,
+    doc_type: r.doc_type,
+    label: r.label,
+    has_file: !!r.encrypted_file_path,
+    expires_at: r.expires_at,
+    created_at: r.created_at
+  }));
+}
+function deleteDocument(id, db) {
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT encrypted_file_path FROM contact_documents WHERE id = ?`).get(id);
+  if (row?.encrypted_file_path && existsSync6(row.encrypted_file_path)) {
+    try {
+      unlinkSync2(row.encrypted_file_path);
+    } catch {}
+  }
+  _db2.query(`DELETE FROM contact_documents WHERE id = ?`).run(id);
+}
+function rowToDoc(row) {
+  return {
+    id: row.id,
+    contact_id: row.contact_id,
+    doc_type: row.doc_type,
+    label: row.label,
+    value: decrypt(row.encrypted_value, row.iv),
+    has_file: !!row.encrypted_file_path,
+    metadata: JSON.parse(row.metadata || "{}"),
+    expires_at: row.expires_at,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+var DOCUMENT_TYPES;
+var init_documents = __esm(() => {
+  init_database();
+  init_vault();
+  DOCUMENT_TYPES = [
+    "passport",
+    "national_id",
+    "tax_id",
+    "ssn",
+    "drivers_license",
+    "bank_account",
+    "visa",
+    "insurance",
+    "contract",
+    "certificate",
+    "medical_record",
+    "prescription",
+    "allergy_list",
+    "vaccination",
+    "blood_type",
+    "health_insurance",
+    "medical_condition",
+    "emergency_contact_medical",
+    "other"
+  ];
+});
+
+// src/lib/document-scanner.ts
+var exports_document_scanner = {};
+__export(exports_document_scanner, {
+  scanDocument: () => scanDocument
+});
+import { readFileSync as readFileSync4, existsSync as existsSync7 } from "fs";
+import { extname as extname2 } from "path";
+async function scanDocument(imageSource, docType) {
+  const apiKey = process.env["OPENAI_API_KEY"];
+  if (!apiKey) {
+    throw new Error("OPENAI_API_KEY not set. Set it in ~/.secrets or environment to use document scanning.");
+  }
+  let imageData;
+  if (imageSource.startsWith("data:image/")) {
+    imageData = imageSource;
+  } else if (existsSync7(imageSource)) {
+    const buffer = readFileSync4(imageSource);
+    const ext = extname2(imageSource).slice(1).toLowerCase();
+    const mime = ext === "jpg" || ext === "jpeg" ? "image/jpeg" : ext === "png" ? "image/png" : ext === "webp" ? "image/webp" : ext === "gif" ? "image/gif" : "image/jpeg";
+    imageData = `data:${mime};base64,${buffer.toString("base64")}`;
+  } else if (/^[A-Za-z0-9+/=\n\r]+$/.test(imageSource.trim()) && imageSource.length > 100) {
+    imageData = `data:image/jpeg;base64,${imageSource.trim()}`;
+  } else {
+    throw new Error(`Image source not found or invalid: ${imageSource.slice(0, 50)}...`);
+  }
+  const typeHint = docType ? ` This is a ${docType} document.` : "";
+  const prompt = `Extract all text and structured data from this document image.${typeHint} Return a JSON object with these fields:
+- document_type: detected type (passport, national_id, drivers_license, tax_document, medical_record, prescription, insurance_card, bank_statement, visa, certificate, contract, other)
+- full_name: full name as shown
+- date_of_birth: in YYYY-MM-DD format if visible
+- document_number: main ID/document number
+- issuing_country: country code or name
+- issue_date: in YYYY-MM-DD format if visible
+- expiry_date: in YYYY-MM-DD format if visible
+- address: full address if visible
+- nationality: if visible
+- gender: if visible
+- mrz_code: Machine Readable Zone text if this is a passport/ID with MRZ
+- phone: any phone numbers visible
+- email: any email addresses visible
+- additional_fields: object with any other visible structured data
+- raw_text: all visible text transcribed
+
+Only include fields that are actually visible in the document. Return valid JSON only.`;
+  const response = await fetch("https://api.openai.com/v1/chat/completions", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      model: "gpt-4o",
+      messages: [
+        {
+          role: "user",
+          content: [
+            { type: "text", text: prompt },
+            { type: "image_url", image_url: { url: imageData, detail: "high" } }
+          ]
+        }
+      ],
+      max_tokens: 2000,
+      temperature: 0
+    })
+  });
+  if (!response.ok) {
+    const err = await response.text();
+    throw new Error(`OpenAI API error: ${response.status} \u2014 ${err}`);
+  }
+  const data = await response.json();
+  const content = data.choices?.[0]?.message?.content || "";
+  const jsonMatch = content.match(/```json\s*([\s\S]*?)```/) || content.match(/\{[\s\S]*\}/);
+  if (!jsonMatch) {
+    return { fields: {}, raw_text: content, document_type: docType || "unknown", confidence: 0.3 };
+  }
+  try {
+    const parsed = JSON.parse(jsonMatch[1] || jsonMatch[0]);
+    const { document_type, raw_text, additional_fields, ...mainFields } = parsed;
+    const fields = {};
+    for (const [k, v] of Object.entries(mainFields)) {
+      if (v && typeof v === "string")
+        fields[k] = v;
+    }
+    if (additional_fields && typeof additional_fields === "object") {
+      for (const [k, v] of Object.entries(additional_fields)) {
+        if (v && typeof v === "string")
+          fields[k] = v;
+      }
+    }
+    return {
+      fields,
+      raw_text: raw_text || content,
+      document_type: document_type || docType || "unknown",
+      confidence: Object.keys(fields).length > 3 ? 0.9 : Object.keys(fields).length > 0 ? 0.7 : 0.3
+    };
+  } catch {
+    return { fields: {}, raw_text: content, document_type: docType || "unknown", confidence: 0.3 };
+  }
+}
+var init_document_scanner = () => {};
+
+// src/db/health.ts
+var exports_health = {};
+__export(exports_health, {
+  setHealthData: () => setHealthData,
+  getHealthData: () => getHealthData,
+  deleteHealthData: () => deleteHealthData
+});
+function setHealthData(contactId, input, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const existing = _db2.query(`SELECT id FROM contact_health WHERE contact_id = ?`).get(contactId);
+  if (existing) {
+    const sets = [];
+    const params = [];
+    if (input.blood_type !== undefined) {
+      sets.push("blood_type = ?");
+      params.push(input.blood_type);
+    }
+    if (input.allergies !== undefined) {
+      sets.push("allergies = ?");
+      params.push(JSON.stringify(input.allergies));
+    }
+    if (input.medical_conditions !== undefined) {
+      sets.push("medical_conditions = ?");
+      params.push(JSON.stringify(input.medical_conditions));
+    }
+    if (input.medications !== undefined) {
+      sets.push("medications = ?");
+      params.push(JSON.stringify(input.medications));
+    }
+    if (input.emergency_contacts !== undefined) {
+      sets.push("emergency_contacts = ?");
+      params.push(JSON.stringify(input.emergency_contacts));
+    }
+    if (input.health_insurance_provider !== undefined) {
+      sets.push("health_insurance_provider = ?");
+      params.push(input.health_insurance_provider);
+    }
+    if (input.health_insurance_id !== undefined) {
+      sets.push("health_insurance_id = ?");
+      params.push(input.health_insurance_id);
+    }
+    if (input.primary_physician !== undefined) {
+      sets.push("primary_physician = ?");
+      params.push(input.primary_physician);
+    }
+    if (input.primary_physician_phone !== undefined) {
+      sets.push("primary_physician_phone = ?");
+      params.push(input.primary_physician_phone);
+    }
+    if (input.organ_donor !== undefined) {
+      sets.push("organ_donor = ?");
+      params.push(input.organ_donor ? 1 : 0);
+    }
+    if (input.notes !== undefined) {
+      sets.push("notes = ?");
+      params.push(input.notes);
+    }
+    if (sets.length) {
+      sets.push("updated_at = ?");
+      params.push(now());
+      params.push(contactId);
+      _db2.query(`UPDATE contact_health SET ${sets.join(", ")} WHERE contact_id = ?`).run(...params);
+    }
+  } else {
+    const id = uuid();
+    _db2.query(`INSERT INTO contact_health (id, contact_id, blood_type, allergies, medical_conditions, medications, emergency_contacts, health_insurance_provider, health_insurance_id, primary_physician, primary_physician_phone, organ_donor, notes, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(id, contactId, input.blood_type ?? null, JSON.stringify(input.allergies || []), JSON.stringify(input.medical_conditions || []), JSON.stringify(input.medications || []), JSON.stringify(input.emergency_contacts || []), input.health_insurance_provider ?? null, input.health_insurance_id ?? null, input.primary_physician ?? null, input.primary_physician_phone ?? null, input.organ_donor ? 1 : 0, input.notes ?? null, now(), now());
+  }
+  return getHealthData(contactId, _db2);
+}
+function getHealthData(contactId, db) {
+  requireVault();
+  const _db2 = db || getDatabase();
+  const row = _db2.query(`SELECT * FROM contact_health WHERE contact_id = ?`).get(contactId);
+  if (!row)
+    return null;
+  return {
+    id: row.id,
+    contact_id: row.contact_id,
+    blood_type: row.blood_type,
+    allergies: JSON.parse(row.allergies || "[]"),
+    medical_conditions: JSON.parse(row.medical_conditions || "[]"),
+    medications: JSON.parse(row.medications || "[]"),
+    emergency_contacts: JSON.parse(row.emergency_contacts || "[]"),
+    health_insurance_provider: row.health_insurance_provider,
+    health_insurance_id: row.health_insurance_id,
+    primary_physician: row.primary_physician,
+    primary_physician_phone: row.primary_physician_phone,
+    organ_donor: !!row.organ_donor,
+    notes: row.notes,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+function deleteHealthData(contactId, db) {
+  const _db2 = db || getDatabase();
+  _db2.query(`DELETE FROM contact_health WHERE contact_id = ?`).run(contactId);
+}
+var init_health = __esm(() => {
+  init_database();
+  init_vault();
+});
+
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -6301,8 +6760,8 @@ function readConfig() {
 }
 
 // src/cli/index.tsx
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync5, copyFileSync as copyFileSync2, statSync, mkdirSync as mkdirSync4, readdirSync as readdirSync2 } from "fs";
-import { extname as extname2, join as join5 } from "path";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync8, copyFileSync as copyFileSync2, statSync, mkdirSync as mkdirSync5, readdirSync as readdirSync2 } from "fs";
+import { extname as extname3, join as join6 } from "path";
 function renderTable(headers, rows) {
   const colWidths = headers.map((h) => h.length);
   for (const row of rows) {
@@ -6407,7 +6866,7 @@ async function confirm(question) {
   const answer = await prompt(question + " [y/N]");
   return answer.toLowerCase() === "y" || answer.toLowerCase() === "yes";
 }
-program.name("contacts").description("Open Contacts \u2014 contact management for AI coding agents").version("0.5.0");
+program.name("contacts").description("Open Contacts \u2014 contact management for AI coding agents").version("0.6.0");
 function collect(val, prev) {
   return [...prev, val];
 }
@@ -6473,10 +6932,11 @@ Add New Contact
 \u2713 Contact created: ${contact.display_name} (${contact.id})
 `));
 });
-program.command("list").description("List contacts").option("--tag <tag_id>", "Filter by tag ID").option("--company <id>", "Filter by company ID").option("--limit <n>", "Max results", "50").action(async (opts) => {
+program.command("list").description("List contacts").option("--tag <tag_id>", "Filter by tag ID").option("--company <id>", "Filter by company ID").option("--include-restricted", "Include restricted-sensitivity contacts").option("--limit <n>", "Max results", "50").action(async (opts) => {
   const result = listContacts({
     tag_id: opts.tag,
     company_id: opts.company,
+    include_restricted: opts.includeRestricted,
     limit: parseInt(opts.limit, 10)
   });
   if (result.contacts.length === 0) {
@@ -6713,13 +7173,13 @@ Add New Tag
 `));
 });
 program.command("import <file>").description("Import contacts from CSV, vCard (.vcf), or JSON file").action(async (file) => {
-  if (!existsSync5(file)) {
+  if (!existsSync8(file)) {
     console.error(chalk.red(`
 File not found: ${file}
 `));
     process.exit(1);
   }
-  const ext = extname2(file).toLowerCase();
+  const ext = extname3(file).toLowerCase();
   const formatMap = {
     ".csv": "csv",
     ".vcf": "vcf",
@@ -6733,7 +7193,7 @@ Unsupported file type: ${ext}. Use .csv, .vcf, or .json
 `));
     process.exit(1);
   }
-  const data = readFileSync3(file, "utf8");
+  const data = readFileSync5(file, "utf8");
   console.log(chalk.blue(`
 Importing ${format.toUpperCase()} from ${file}...
 `));
@@ -6764,7 +7224,7 @@ Invalid format: ${format}. Use csv, vcf, or json
   const { contacts } = listContacts({ limit: 1e5 });
   const output = await exportContacts(format, contacts);
   if (opts.output) {
-    writeFileSync3(opts.output, output, "utf8");
+    writeFileSync4(opts.output, output, "utf8");
     console.log(chalk.green(`
 \u2713 Exported ${contacts.length} contact(s) to ${opts.output}
 `));
@@ -7036,9 +7496,9 @@ program.command("init").description("Show setup info, stats, and configuration")
   console.log();
 });
 program.command("backup").description("Backup the contacts database").option("--output <path>", "Output path").option("--list", "List existing backups").action((opts) => {
-  const backupDir = join5(process.env["HOME"] || "~", ".contacts", "backups");
+  const backupDir = join6(process.env["HOME"] || "~", ".contacts", "backups");
   if (opts.list) {
-    if (!existsSync5(backupDir)) {
+    if (!existsSync8(backupDir)) {
       console.log(chalk.gray(`
 No backups found.
 `));
@@ -7055,7 +7515,7 @@ No backups found.
 Existing Backups:
 `));
     for (const f of files) {
-      const filePath = join5(backupDir, f);
+      const filePath = join6(backupDir, f);
       const size2 = statSync(filePath).size;
       const mtime = statSync(filePath).mtime.toISOString().slice(0, 19).replace("T", " ");
       console.log(`  ${chalk.cyan(f)}  ${chalk.gray(`${(size2 / 1024).toFixed(1)} KB  ${mtime}`)}`);
@@ -7064,15 +7524,15 @@ Existing Backups:
     return;
   }
   const src = getDbPath();
-  if (!existsSync5(src)) {
+  if (!existsSync8(src)) {
     console.error(chalk.red(`
 Database not found: ${src}
 `));
     process.exit(1);
   }
-  mkdirSync4(backupDir, { recursive: true });
+  mkdirSync5(backupDir, { recursive: true });
   const ts = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
-  const dest = opts.output || join5(backupDir, `contacts-${ts}.db`);
+  const dest = opts.output || join6(backupDir, `contacts-${ts}.db`);
   copyFileSync2(src, dest);
   const size = statSync(dest).size;
   console.log(chalk.green(`
@@ -8407,4 +8867,256 @@ logoCmd.command("show <company-id>").description("Show the path to a company's l
     console.log(chalk.yellow(`No logo set for ${company.name}`));
   }
 });
+program.command("set-sensitivity <id> <level>").description("Set contact sensitivity level (normal, confidential, restricted)").action((id, level) => {
+  if (!["normal", "confidential", "restricted"].includes(level)) {
+    console.error(chalk.red(`
+Invalid sensitivity level: ${level}. Use: normal, confidential, restricted
+`));
+    process.exit(1);
+  }
+  const contact = getContact(id);
+  updateContact(id, { sensitivity: level });
+  console.log(chalk.green(`
+Sensitivity set to ${level} for ${contact.display_name}
+`));
+});
+var vaultCmd = program.command("vault").description("Manage the encrypted document vault");
+function promptPassphrase(promptText) {
+  const { createInterface } = __require("readline");
+  return new Promise((resolve2) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    process.stdout.write(promptText);
+    rl.question("", (answer) => {
+      rl.close();
+      resolve2(answer);
+    });
+  });
+}
+vaultCmd.command("init").description("Initialize the encrypted vault").option("--passphrase <pass>", "Passphrase (non-interactive)").action(async (opts) => {
+  const { initVault: initVault2, isVaultInitialized: isVaultInitialized2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  if (isVaultInitialized2()) {
+    console.log(chalk.yellow(`
+Vault already initialized. Use "contacts vault unlock" to access it.
+`));
+    return;
+  }
+  let passphrase;
+  if (opts.passphrase) {
+    passphrase = opts.passphrase;
+  } else {
+    passphrase = await promptPassphrase("Enter vault passphrase: ");
+    if (!passphrase) {
+      console.error(chalk.red("Passphrase is required."));
+      process.exit(1);
+    }
+    const confirm2 = await promptPassphrase("Confirm passphrase: ");
+    if (passphrase !== confirm2) {
+      console.error(chalk.red("Passphrases do not match."));
+      process.exit(1);
+    }
+  }
+  initVault2(passphrase);
+  console.log(chalk.green(`
+Vault initialized and unlocked.
+`));
+});
+vaultCmd.command("unlock").description("Unlock the vault").option("--passphrase <pass>", "Passphrase (non-interactive)").action(async (opts) => {
+  const { unlockVault: unlockVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  const passphrase = opts.passphrase || await promptPassphrase("Enter vault passphrase: ");
+  const ok = unlockVault2(passphrase);
+  if (!ok) {
+    console.error(chalk.red(`
+Invalid passphrase.
+`));
+    process.exit(1);
+  }
+  console.log(chalk.green(`
+Vault unlocked.
+`));
+});
+vaultCmd.command("lock").description("Lock the vault").action(async () => {
+  const { lockVault: lockVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  lockVault2();
+  console.log(chalk.green(`
+Vault locked.
+`));
+});
+vaultCmd.command("status").description("Show vault status").action(async () => {
+  const { isVaultInitialized: isVaultInitialized2, isVaultUnlocked: isVaultUnlocked2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+  const initialized = isVaultInitialized2();
+  const unlocked = isVaultUnlocked2();
+  console.log(chalk.bold.blue(`
+Vault Status:`));
+  console.log(`  Initialized: ${initialized ? chalk.green("yes") : chalk.red("no")}`);
+  console.log(`  Unlocked:    ${unlocked ? chalk.green("yes") : chalk.red("no")}`);
+  if (initialized) {
+    const db = getDatabase();
+    try {
+      const docCount = db.query("SELECT COUNT(*) as n FROM contact_documents").get().n;
+      console.log(`  Documents:   ${chalk.cyan(String(docCount))}`);
+    } catch {}
+  }
+  console.log();
+});
+var docsCmd = program.command("docs").description("Manage encrypted contact documents");
+docsCmd.command("add <contact-id>").description("Add an encrypted document").option("--type <type>", "Document type (passport, national_id, tax_id, ssn, drivers_license, bank_account, visa, insurance, contract, certificate, medical_record, prescription, allergy_list, vaccination, blood_type, health_insurance, medical_condition, emergency_contact_medical, other)", "other").option("--label <label>", "Document label").option("--value <value>", "Document value (required)").option("--file <path>", "File to encrypt and attach").option("--expires <date>", "Expiry date (YYYY-MM-DD)").action(async (contactId, opts) => {
+  const { addDocument: addDocument2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  if (!opts.value) {
+    console.error(chalk.red("--value is required"));
+    process.exit(1);
+  }
+  const doc = addDocument2({
+    contact_id: contactId,
+    doc_type: opts.type || "other",
+    label: opts.label,
+    value: opts.value,
+    file_path: opts.file,
+    expires_at: opts.expires
+  });
+  console.log(chalk.green(`
+Document added: ${doc.doc_type} (${doc.id})
+`));
+});
+docsCmd.command("list <contact-id>").description("List documents for a contact (metadata only)").action(async (contactId) => {
+  const { listDocuments: listDocuments2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  const docs = listDocuments2(contactId);
+  if (!docs.length) {
+    console.log(chalk.gray(`
+No documents found.
+`));
+    return;
+  }
+  console.log();
+  renderTable(["Type", "Label", "Has File", "Expires", "Created"], docs.map((d) => ({
+    Type: d.doc_type,
+    Label: d.label || "",
+    "Has File": d.has_file ? "yes" : "no",
+    Expires: d.expires_at ? d.expires_at.slice(0, 10) : "",
+    Created: d.created_at.slice(0, 10)
+  })));
+  console.log(chalk.gray(`
+${docs.length} document(s)
+`));
+});
+docsCmd.command("show <doc-id>").description("Show a document with decrypted value (vault must be unlocked)").action(async (docId) => {
+  const { getDocument: getDocument2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  const doc = getDocument2(docId);
+  console.log(chalk.bold.blue(`
+Document: ${doc.doc_type}`));
+  if (doc.label)
+    console.log(chalk.gray("  Label:   ") + doc.label);
+  console.log(chalk.gray("  Value:   ") + doc.value);
+  console.log(chalk.gray("  Has File:") + (doc.has_file ? " yes" : " no"));
+  if (doc.expires_at)
+    console.log(chalk.gray("  Expires: ") + doc.expires_at.slice(0, 10));
+  console.log(chalk.gray(`  ID: ${doc.id}
+`));
+});
+docsCmd.command("remove <doc-id>").description("Delete a document").action(async (docId) => {
+  const { deleteDocument: deleteDocument2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  deleteDocument2(docId);
+  console.log(chalk.green(`
+Document deleted: ${docId}
+`));
+});
+docsCmd.command("scan <image-path>").description("Scan a document image using AI vision").option("--contact <id>", "Contact ID to associate with").option("--type <type>", "Document type hint").action(async (imagePath, opts) => {
+  const { scanDocument: scanDocument2 } = await Promise.resolve().then(() => (init_document_scanner(), exports_document_scanner));
+  console.log(chalk.blue(`
+Scanning document...
+`));
+  const result = await scanDocument2(imagePath, opts.type);
+  console.log(chalk.bold(`  Type: ${result.document_type}  Confidence: ${(result.confidence * 100).toFixed(0)}%
+`));
+  console.log(chalk.yellow("  Extracted fields:"));
+  for (const [k, v] of Object.entries(result.fields)) {
+    console.log(`    ${chalk.gray(k.padEnd(20))} ${v}`);
+  }
+  console.log();
+});
+docsCmd.command("types").description("List all valid document types").action(async () => {
+  const { DOCUMENT_TYPES: DOCUMENT_TYPES2 } = await Promise.resolve().then(() => (init_documents(), exports_documents));
+  console.log(chalk.bold.blue(`
+Document Types:
+`));
+  for (const t of DOCUMENT_TYPES2) {
+    console.log(`  ${chalk.cyan(t)}`);
+  }
+  console.log();
+});
+var healthCmd = program.command("health").description("Manage contact health data (vault required)");
+healthCmd.command("show <id>").description("Show health data for a contact").action(async (id) => {
+  const { getHealthData: getHealthData2 } = await Promise.resolve().then(() => (init_health(), exports_health));
+  const contact = getContact(id);
+  const health = getHealthData2(id);
+  if (!health) {
+    console.log(chalk.gray(`
+No health data for ${contact.display_name}.
+`));
+    return;
+  }
+  console.log(chalk.bold.blue(`
+Health: ${contact.display_name}
+`));
+  if (health.blood_type)
+    console.log(chalk.gray("  Blood Type:      ") + health.blood_type);
+  if (health.allergies.length)
+    console.log(chalk.gray("  Allergies:       ") + health.allergies.join(", "));
+  if (health.medical_conditions.length)
+    console.log(chalk.gray("  Conditions:      ") + health.medical_conditions.join(", "));
+  if (health.medications.length)
+    console.log(chalk.gray("  Medications:     ") + health.medications.join(", "));
+  if (health.emergency_contacts.length) {
+    console.log(chalk.yellow(`
+  Emergency Contacts:`));
+    for (const ec of health.emergency_contacts) {
+      console.log(`    ${chalk.bold(ec.name)}  ${ec.phone}  ${chalk.gray(ec.relationship)}`);
+    }
+  }
+  if (health.health_insurance_provider)
+    console.log(chalk.gray(`
+  Insurance:       `) + `${health.health_insurance_provider} (${health.health_insurance_id || "no ID"})`);
+  if (health.primary_physician)
+    console.log(chalk.gray("  Physician:       ") + `${health.primary_physician} ${health.primary_physician_phone || ""}`);
+  console.log(chalk.gray("  Organ Donor:     ") + (health.organ_donor ? "yes" : "no"));
+  if (health.notes)
+    console.log(chalk.gray("  Notes:           ") + health.notes);
+  console.log();
+});
+healthCmd.command("set <id>").description("Set health data for a contact").option("--blood-type <type>", "Blood type (e.g. A+, O-)").option("--allergies <list>", "Comma-separated allergies").option("--conditions <list>", "Comma-separated medical conditions").option("--medications <list>", "Comma-separated medications").option("--insurance-provider <name>", "Health insurance provider").option("--insurance-id <id>", "Health insurance ID").option("--physician <name>", "Primary physician").option("--physician-phone <phone>", "Physician phone").option("--organ-donor", "Mark as organ donor").option("--notes <text>", "Health notes").action(async (id, opts) => {
+  const { setHealthData: setHealthData2 } = await Promise.resolve().then(() => (init_health(), exports_health));
+  const contact = getContact(id);
+  const input = {};
+  if (opts.bloodType)
+    input.blood_type = opts.bloodType;
+  if (opts.allergies)
+    input.allergies = opts.allergies.split(",").map((s) => s.trim());
+  if (opts.conditions)
+    input.medical_conditions = opts.conditions.split(",").map((s) => s.trim());
+  if (opts.medications)
+    input.medications = opts.medications.split(",").map((s) => s.trim());
+  if (opts.insuranceProvider)
+    input.health_insurance_provider = opts.insuranceProvider;
+  if (opts.insuranceId)
+    input.health_insurance_id = opts.insuranceId;
+  if (opts.physician)
+    input.primary_physician = opts.physician;
+  if (opts.physicianPhone)
+    input.primary_physician_phone = opts.physicianPhone;
+  if (opts.organDonor !== undefined)
+    input.organ_donor = opts.organDonor;
+  if (opts.notes)
+    input.notes = opts.notes;
+  setHealthData2(id, input);
+  console.log(chalk.green(`
+Health data updated for ${contact.display_name}
+`));
+});
+healthCmd.command("clear <id>").description("Delete all health data for a contact").action(async (id) => {
+  const { deleteHealthData: deleteHealthData2 } = await Promise.resolve().then(() => (init_health(), exports_health));
+  const contact = getContact(id);
+  deleteHealthData2(id);
+  console.log(chalk.green(`
+Health data cleared for ${contact.display_name}
+`));
+});
 program.parse(process.argv);