@markwharton/eh-payroll 1.0.0 → 1.1.0

package/dist/client.d.ts

@@ -6,7 +6,7 @@
  *
  * @see https://api.keypay.com.au/
  */
-import type { EHConfig, EHEmployeeOptions, EHStandardHours, EHEmployeeGroup, EHRosterShift, EHRosterShiftOptions, EHKioskEmployee, EHKioskStaffOptions, EHErrorInfo, EHReportField, EHEmployeeDetailsReportOptions } from './types.js';
+import type { EHConfig, EHEmployeeOptions, EHSingleEmployeeOptions, EHStandardHours, EHEmployeeGroup, EHRosterShift, EHRosterShiftOptions, EHKioskEmployee, EHKioskStaffOptions, EHErrorInfo, EHReportField, EHEmployeeDetailsReportOptions } from './types.js';
 import type { EHAuEmployee } from './employee-types.generated.js';
 /**
  * Employment Hero Payroll API Client
@@ -68,7 +68,7 @@ export declare class EHClient {
     /**
      * Get a single employee by ID
      */
-    getEmployee(employeeId: number): Promise<{
+    getEmployee(employeeId: number, options?: EHSingleEmployeeOptions): Promise<{
         employee?: EHAuEmployee;
         error?: EHErrorInfo;
     }>;

package/dist/client.js

@@ -6,7 +6,8 @@
  *
  * @see https://api.keypay.com.au/
  */
-import { buildBasicAuthHeader } from './utils.js';
+import { AU_EMPLOYEE_OPERATIONAL_FIELDS, AU_EMPLOYEE_FIELDS, EMPLOYEE_GROUP_FIELDS, ROSTER_SHIFT_FIELDS, KIOSK_EMPLOYEE_FIELDS, } from './types.js';
+import { buildBasicAuthHeader, pickFields } from './utils.js';
 import { parseEHErrorResponse } from './errors.js';
 import { EH_API_BASE, EH_REGION_URLS } from './constants.js';
 import { TTLCache, getErrorMessage, fetchWithRetry } from '@markwharton/api-core';
@@ -155,11 +156,14 @@ export class EHClient {
      * Get all employees (unstructured format)
      */
     async getEmployees(options) {
+        const fields = options?.includePii ? AU_EMPLOYEE_FIELDS : AU_EMPLOYEE_OPERATIONAL_FIELDS;
         const parts = ['employees'];
         if (options?.payScheduleId != null)
             parts.push(`ps:${options.payScheduleId}`);
         if (options?.locationId != null)
             parts.push(`loc:${options.locationId}`);
+        if (options?.includePii)
+            parts.push('pii');
         const cacheKey = parts.join(':');
         return this.cached(cacheKey, this.cacheTtl.employeesTtl, async () => {
             const params = new URLSearchParams();
@@ -167,24 +171,43 @@ export class EHClient {
                 params.set('filter.payScheduleId', String(options.payScheduleId));
             if (options?.locationId != null)
                 params.set('filter.locationId', String(options.locationId));
-            const queryString = params.toString();
-            const url = queryString
-                ? `${this.baseUrl}/business/${this.businessId}/employee/unstructured?${queryString}`
-                : `${this.baseUrl}/business/${this.businessId}/employee/unstructured`;
-            const { data, error } = await this.fetchAndParse(url, async (r) => {
-                return await r.json();
-            });
-            return error ? { error } : { employees: data };
+            params.set('$top', String(DEFAULT_PAGE_SIZE));
+            try {
+                const allEmployees = [];
+                let skip = 0;
+                while (true) {
+                    params.set('$skip', String(skip));
+                    const url = `${this.baseUrl}/business/${this.businessId}/employee/unstructured?${params}`;
+                    const response = await this.fetch(url);
+                    if (!response.ok) {
+                        const errorText = await response.text();
+                        const { message } = parseEHErrorResponse(errorText, response.status);
+                        return { error: { message, statusCode: response.status } };
+                    }
+                    const page = (await response.json())
+                        .map(item => pickFields(item, fields));
+                    allEmployees.push(...page);
+                    if (page.length < DEFAULT_PAGE_SIZE)
+                        break;
+                    skip += DEFAULT_PAGE_SIZE;
+                }
+                return { employees: allEmployees };
+            }
+            catch (error) {
+                return { error: { message: getErrorMessage(error), statusCode: 0 } };
+            }
         });
     }
     /**
      * Get a single employee by ID
      */
-    async getEmployee(employeeId) {
-        return this.cached(`employee:${employeeId}`, this.cacheTtl.employeesTtl, async () => {
+    async getEmployee(employeeId, options) {
+        const fields = options?.includePii ? AU_EMPLOYEE_FIELDS : AU_EMPLOYEE_OPERATIONAL_FIELDS;
+        const cacheKey = options?.includePii ? `employee:${employeeId}:pii` : `employee:${employeeId}`;
+        return this.cached(cacheKey, this.cacheTtl.employeesTtl, async () => {
             const url = `${this.baseUrl}/business/${this.businessId}/employee/unstructured/${employeeId}`;
             const { data, error } = await this.fetchAndParse(url, async (r) => {
-                return await r.json();
+                return pickFields(await r.json(), fields);
             });
             return error ? { error } : { employee: data };
         });
@@ -212,11 +235,33 @@ export class EHClient {
      */
     async getEmployeeGroups() {
         return this.cached('groups', this.cacheTtl.groupsTtl, async () => {
-            const url = `${this.baseUrl}/business/${this.businessId}/employeegroup`;
-            const { data, error } = await this.fetchAndParse(url, async (r) => {
-                return await r.json();
+            const params = new URLSearchParams({
+                '$top': String(DEFAULT_PAGE_SIZE),
             });
-            return error ? { error } : { groups: data };
+            try {
+                const allGroups = [];
+                let skip = 0;
+                while (true) {
+                    params.set('$skip', String(skip));
+                    const url = `${this.baseUrl}/business/${this.businessId}/employeegroup?${params}`;
+                    const response = await this.fetch(url);
+                    if (!response.ok) {
+                        const errorText = await response.text();
+                        const { message } = parseEHErrorResponse(errorText, response.status);
+                        return { error: { message, statusCode: response.status } };
+                    }
+                    const page = (await response.json())
+                        .map(item => pickFields(item, EMPLOYEE_GROUP_FIELDS));
+                    allGroups.push(...page);
+                    if (page.length < DEFAULT_PAGE_SIZE)
+                        break;
+                    skip += DEFAULT_PAGE_SIZE;
+                }
+                return { groups: allGroups };
+            }
+            catch (error) {
+                return { error: { message: getErrorMessage(error), statusCode: 0 } };
+            }
         });
     }
     // ============================================================================
@@ -309,7 +354,8 @@ export class EHClient {
                         const { message } = parseEHErrorResponse(errorText, response.status);
                         return { error: { message, statusCode: response.status } };
                     }
-                    const page = await response.json();
+                    const page = (await response.json())
+                        .map(item => pickFields(item, ROSTER_SHIFT_FIELDS));
                     allShifts.push(...page);
                     if (page.length < DEFAULT_PAGE_SIZE)
                         break;
@@ -341,7 +387,8 @@ export class EHClient {
             ? `${this.baseUrl}/business/${this.businessId}/kiosk/${kioskId}/staff?${queryString}`
             : `${this.baseUrl}/business/${this.businessId}/kiosk/${kioskId}/staff`;
         const { data, error } = await this.fetchAndParse(url, async (r) => {
-            return await r.json();
+            return (await r.json())
+                .map(item => pickFields(item, KIOSK_EMPLOYEE_FIELDS));
         });
         return error ? { error } : { staff: data };
     }

package/dist/index.d.ts

@@ -20,10 +20,11 @@
  * ```
  */
 export { EHClient } from './client.js';
-export type { EHConfig, EHCacheConfig, EHRetryConfig, EHEmployee, EHEmployeeOptions, EHStandardHours, EHEmployeeGroup, EHRosterShift, EHRosterShiftOptions, EHAttendanceStatus, EHKioskEmployee, EHKioskStaffOptions, EHReportField, EHEmployeeDetailsReportOptions, EHErrorInfo, } from './types.js';
+export type { EHConfig, EHCacheConfig, EHRetryConfig, EHEmployee, EHEmployeeOptions, EHSingleEmployeeOptions, EHStandardHours, EHEmployeeGroup, EHRosterShift, EHRosterShiftOptions, EHAttendanceStatus, EHKioskEmployee, EHKioskStaffOptions, EHReportField, EHEmployeeDetailsReportOptions, EHErrorInfo, } from './types.js';
+export { AU_EMPLOYEE_OPERATIONAL_FIELDS, AU_EMPLOYEE_PII_FIELDS, AU_EMPLOYEE_FIELDS, EMPLOYEE_GROUP_FIELDS, ROSTER_SHIFT_FIELDS, KIOSK_EMPLOYEE_FIELDS, } from './types.js';
 export type { EHAuEmployee } from './employee-types.generated.js';
 export { RateLimiter } from './rate-limiter.js';
-export { buildBasicAuthHeader } from './utils.js';
+export { buildBasicAuthHeader, pickFields } from './utils.js';
 export { getErrorMessage } from '@markwharton/api-core';
 export { EH_API_BASE, EH_REGION_URLS } from './constants.js';
 export type { EHRegion } from './constants.js';

package/dist/index.js

@@ -21,10 +21,12 @@
  */
 // Main client
 export { EHClient } from './client.js';
+// Field key constants (whitelists for pickFields)
+export { AU_EMPLOYEE_OPERATIONAL_FIELDS, AU_EMPLOYEE_PII_FIELDS, AU_EMPLOYEE_FIELDS, EMPLOYEE_GROUP_FIELDS, ROSTER_SHIFT_FIELDS, KIOSK_EMPLOYEE_FIELDS, } from './types.js';
 // Rate limiting
 export { RateLimiter } from './rate-limiter.js';
 // Utilities
-export { buildBasicAuthHeader } from './utils.js';
+export { buildBasicAuthHeader, pickFields } from './utils.js';
 export { getErrorMessage } from '@markwharton/api-core';
 // Constants
 export { EH_API_BASE, EH_REGION_URLS } from './constants.js';

package/dist/types.d.ts

@@ -158,6 +158,10 @@ export interface EHKioskEmployee {
     employeeStartDate: string | null;
     /** Employee group IDs */
     employeeGroupIds: number[];
+    /** Whether current shift is a long shift */
+    longShift: boolean;
+    /** Last recorded time in UTC */
+    recordedTimeUtc: string | null;
 }
 /**
  * Options for getEmployees
@@ -167,6 +171,15 @@ export interface EHEmployeeOptions {
     payScheduleId?: number;
     /** Filter by location ID */
     locationId?: number;
+    /** Include PII fields (default: false — operational fields only) */
+    includePii?: boolean;
+}
+/**
+ * Options for getEmployee (single)
+ */
+export interface EHSingleEmployeeOptions {
+    /** Include PII fields (default: false — operational fields only) */
+    includePii?: boolean;
 }
 /**
  * Options for getRosterShifts
@@ -239,3 +252,21 @@ export interface EHErrorInfo {
     /** HTTP status code from the response */
     statusCode: number;
 }
+/** Whitelisted fields for EHKioskEmployee */
+export declare const KIOSK_EMPLOYEE_FIELDS: readonly ["employeeId", "firstName", "surname", "name", "status", "clockOnTimeUtc", "breakStartTimeUtc", "currentShiftId", "employeeStartDate", "employeeGroupIds", "longShift", "recordedTimeUtc"];
+/** Whitelisted fields for EHEmployeeGroup */
+export declare const EMPLOYEE_GROUP_FIELDS: readonly ["id", "name"];
+/** Whitelisted fields for EHRosterShift */
+export declare const ROSTER_SHIFT_FIELDS: readonly ["id", "employeeId", "employeeName", "locationId", "locationName", "workTypeId", "workTypeName", "startTime", "endTime", "notes", "published", "accepted"];
+/**
+ * Operational fields for EHAuEmployee (52 fields)
+ * Identity, employment structure, pay config, scheduling, leave, AU compliance.
+ */
+export declare const AU_EMPLOYEE_OPERATIONAL_FIELDS: readonly ["id", "externalId", "firstName", "surname", "status", "startDate", "endDate", "anniversaryDate", "dateCreated", "employmentType", "jobTitle", "employmentAgreement", "employmentAgreementId", "paySchedule", "payRateTemplate", "rate", "rateUnit", "hoursPerWeek", "hoursPerDay", "primaryPayCategory", "payConditionRuleSet", "overrideTemplateRate", "automaticallyPayEmployee", "primaryLocation", "locations", "tags", "workTypes", "reportingDimensionValues", "leaveAccrualStartDateType", "leaveTemplate", "leaveYearStart", "isEnabledForTimesheets", "rosteringNotificationChoices", "paySlipNotificationType", "terminationReason", "australianResident", "awardId", "businessAwardPackage", "automaticallyApplyPublicHolidayNotWorkedEarningsLines", "closelyHeldEmployee", "closelyHeldReporting", "disableAutoProgression", "dvlPaySlipDescription", "employingEntityId", "includeInPortableLongServiceLeaveReport", "portableLongServiceLeaveId", "isExemptFromFloodLevy", "isExemptFromPayrollTax", "isSeasonalWorker", "maximumQuarterlySuperContributionsBase", "superThresholdAmount", "singleTouchPayroll"];
+/**
+ * PII fields for EHAuEmployee (87 fields)
+ * Personal data, contact info, bank accounts, addresses, tax, super, emergency contacts.
+ */
+export declare const AU_EMPLOYEE_PII_FIELDS: readonly ["dateOfBirth", "gender", "title", "middleName", "preferredName", "previousSurname", "emailAddress", "homePhone", "mobilePhone", "workPhone", "bankAccount1_AccountName", "bankAccount1_AccountNumber", "bankAccount1_AllocatedPercentage", "bankAccount1_BSB", "bankAccount1_FixedAmount", "bankAccount2_AccountName", "bankAccount2_AccountNumber", "bankAccount2_AllocatedPercentage", "bankAccount2_BSB", "bankAccount2_FixedAmount", "bankAccount3_AccountName", "bankAccount3_AccountNumber", "bankAccount3_AllocatedPercentage", "bankAccount3_BSB", "bankAccount3_FixedAmount", "emergencyContact1_Address", "emergencyContact1_AlternateContactNumber", "emergencyContact1_ContactNumber", "emergencyContact1_Name", "emergencyContact1_Relationship", "emergencyContact2_Address", "emergencyContact2_AlternateContactNumber", "emergencyContact2_ContactNumber", "emergencyContact2_Name", "emergencyContact2_Relationship", "postalStreetAddress", "postalAddressLine2", "postalPostCode", "postalCountry", "postalState", "postalSuburb", "postalAddressIsOverseas", "residentialStreetAddress", "residentialAddressLine2", "residentialPostCode", "residentialCountry", "residentialState", "residentialSuburb", "residentialAddressIsOverseas", "taxFileNumber", "taxCategory", "taxVariation", "claimTaxFreeThreshold", "claimMedicareLevyReduction", "medicareLevyExemption", "medicareLevyReductionDependentCount", "medicareLevyReductionSpouse", "medicareLevySurchargeWithholdingTier", "seniorsTaxOffset", "otherTaxOffset", "stslDebt", "hasWithholdingVariation", "dateTaxFileDeclarationReported", "dateTaxFileDeclarationSigned", "superFund1_AllocatedPercentage", "superFund1_EmployerNominatedFund", "superFund1_FixedAmount", "superFund1_FundName", "superFund1_MemberNumber", "superFund1_ProductCode", "superFund2_AllocatedPercentage", "superFund2_EmployerNominatedFund", "superFund2_FixedAmount", "superFund2_FundName", "superFund2_MemberNumber", "superFund2_ProductCode", "superFund3_AllocatedPercentage", "superFund3_EmployerNominatedFund", "superFund3_FixedAmount", "superFund3_FundName", "superFund3_MemberNumber", "superFund3_ProductCode", "contractorABN", "employingEntityABN", "hasApprovedWorkingHolidayVisa", "workingHolidayVisaCountry", "workingHolidayVisaStartDate"];
+/** All whitelisted fields for EHAuEmployee (operational + PII) */
+export declare const AU_EMPLOYEE_FIELDS: readonly ["id", "externalId", "firstName", "surname", "status", "startDate", "endDate", "anniversaryDate", "dateCreated", "employmentType", "jobTitle", "employmentAgreement", "employmentAgreementId", "paySchedule", "payRateTemplate", "rate", "rateUnit", "hoursPerWeek", "hoursPerDay", "primaryPayCategory", "payConditionRuleSet", "overrideTemplateRate", "automaticallyPayEmployee", "primaryLocation", "locations", "tags", "workTypes", "reportingDimensionValues", "leaveAccrualStartDateType", "leaveTemplate", "leaveYearStart", "isEnabledForTimesheets", "rosteringNotificationChoices", "paySlipNotificationType", "terminationReason", "australianResident", "awardId", "businessAwardPackage", "automaticallyApplyPublicHolidayNotWorkedEarningsLines", "closelyHeldEmployee", "closelyHeldReporting", "disableAutoProgression", "dvlPaySlipDescription", "employingEntityId", "includeInPortableLongServiceLeaveReport", "portableLongServiceLeaveId", "isExemptFromFloodLevy", "isExemptFromPayrollTax", "isSeasonalWorker", "maximumQuarterlySuperContributionsBase", "superThresholdAmount", "singleTouchPayroll", "dateOfBirth", "gender", "title", "middleName", "preferredName", "previousSurname", "emailAddress", "homePhone", "mobilePhone", "workPhone", "bankAccount1_AccountName", "bankAccount1_AccountNumber", "bankAccount1_AllocatedPercentage", "bankAccount1_BSB", "bankAccount1_FixedAmount", "bankAccount2_AccountName", "bankAccount2_AccountNumber", "bankAccount2_AllocatedPercentage", "bankAccount2_BSB", "bankAccount2_FixedAmount", "bankAccount3_AccountName", "bankAccount3_AccountNumber", "bankAccount3_AllocatedPercentage", "bankAccount3_BSB", "bankAccount3_FixedAmount", "emergencyContact1_Address", "emergencyContact1_AlternateContactNumber", "emergencyContact1_ContactNumber", "emergencyContact1_Name", "emergencyContact1_Relationship", "emergencyContact2_Address", "emergencyContact2_AlternateContactNumber", "emergencyContact2_ContactNumber", "emergencyContact2_Name", "emergencyContact2_Relationship", "postalStreetAddress", "postalAddressLine2", "postalPostCode", "postalCountry", "postalState", "postalSuburb", "postalAddressIsOverseas", "residentialStreetAddress", "residentialAddressLine2", "residentialPostCode", "residentialCountry", "residentialState", "residentialSuburb", "residentialAddressIsOverseas", "taxFileNumber", "taxCategory", "taxVariation", "claimTaxFreeThreshold", "claimMedicareLevyReduction", "medicareLevyExemption", "medicareLevyReductionDependentCount", "medicareLevyReductionSpouse", "medicareLevySurchargeWithholdingTier", "seniorsTaxOffset", "otherTaxOffset", "stslDebt", "hasWithholdingVariation", "dateTaxFileDeclarationReported", "dateTaxFileDeclarationSigned", "superFund1_AllocatedPercentage", "superFund1_EmployerNominatedFund", "superFund1_FixedAmount", "superFund1_FundName", "superFund1_MemberNumber", "superFund1_ProductCode", "superFund2_AllocatedPercentage", "superFund2_EmployerNominatedFund", "superFund2_FixedAmount", "superFund2_FundName", "superFund2_MemberNumber", "superFund2_ProductCode", "superFund3_AllocatedPercentage", "superFund3_EmployerNominatedFund", "superFund3_FixedAmount", "superFund3_FundName", "superFund3_MemberNumber", "superFund3_ProductCode", "contractorABN", "employingEntityABN", "hasApprovedWorkingHolidayVisa", "workingHolidayVisaCountry", "workingHolidayVisaStartDate"];

package/dist/types.js

@@ -4,4 +4,104 @@
  * Types for the Employment Hero Payroll (KeyPay) API.
  * Based on the API reference and KeyPay .NET SDK models.
  */
-export {};
+// ============================================================================
+// Field Key Constants (whitelists for pickFields)
+// ============================================================================
+/** Whitelisted fields for EHKioskEmployee */
+export const KIOSK_EMPLOYEE_FIELDS = [
+    'employeeId', 'firstName', 'surname', 'name', 'status',
+    'clockOnTimeUtc', 'breakStartTimeUtc', 'currentShiftId',
+    'employeeStartDate', 'employeeGroupIds', 'longShift', 'recordedTimeUtc',
+];
+/** Whitelisted fields for EHEmployeeGroup */
+export const EMPLOYEE_GROUP_FIELDS = [
+    'id', 'name',
+];
+/** Whitelisted fields for EHRosterShift */
+export const ROSTER_SHIFT_FIELDS = [
+    'id', 'employeeId', 'employeeName', 'locationId', 'locationName',
+    'workTypeId', 'workTypeName', 'startTime', 'endTime',
+    'notes', 'published', 'accepted',
+];
+/**
+ * Operational fields for EHAuEmployee (52 fields)
+ * Identity, employment structure, pay config, scheduling, leave, AU compliance.
+ */
+export const AU_EMPLOYEE_OPERATIONAL_FIELDS = [
+    // Identity
+    'id', 'externalId', 'firstName', 'surname', 'status',
+    // Dates
+    'startDate', 'endDate', 'anniversaryDate', 'dateCreated',
+    // Employment
+    'employmentType', 'jobTitle', 'employmentAgreement', 'employmentAgreementId',
+    // Pay
+    'paySchedule', 'payRateTemplate', 'rate', 'rateUnit', 'hoursPerWeek', 'hoursPerDay',
+    'primaryPayCategory', 'payConditionRuleSet', 'overrideTemplateRate', 'automaticallyPayEmployee',
+    // Location/org
+    'primaryLocation', 'locations', 'tags', 'workTypes', 'reportingDimensionValues',
+    // Leave
+    'leaveAccrualStartDateType', 'leaveTemplate', 'leaveYearStart',
+    // Flags
+    'isEnabledForTimesheets', 'rosteringNotificationChoices', 'paySlipNotificationType', 'terminationReason',
+    // AU compliance
+    'australianResident', 'awardId', 'businessAwardPackage',
+    'automaticallyApplyPublicHolidayNotWorkedEarningsLines',
+    'closelyHeldEmployee', 'closelyHeldReporting',
+    'disableAutoProgression', 'dvlPaySlipDescription',
+    'employingEntityId',
+    'includeInPortableLongServiceLeaveReport', 'portableLongServiceLeaveId',
+    'isExemptFromFloodLevy', 'isExemptFromPayrollTax', 'isSeasonalWorker',
+    'maximumQuarterlySuperContributionsBase', 'superThresholdAmount',
+    'singleTouchPayroll',
+];
+/**
+ * PII fields for EHAuEmployee (87 fields)
+ * Personal data, contact info, bank accounts, addresses, tax, super, emergency contacts.
+ */
+export const AU_EMPLOYEE_PII_FIELDS = [
+    // Personal
+    'dateOfBirth', 'gender', 'title', 'middleName', 'preferredName', 'previousSurname',
+    // Contact
+    'emailAddress', 'homePhone', 'mobilePhone', 'workPhone',
+    // Bank accounts
+    'bankAccount1_AccountName', 'bankAccount1_AccountNumber',
+    'bankAccount1_AllocatedPercentage', 'bankAccount1_BSB', 'bankAccount1_FixedAmount',
+    'bankAccount2_AccountName', 'bankAccount2_AccountNumber',
+    'bankAccount2_AllocatedPercentage', 'bankAccount2_BSB', 'bankAccount2_FixedAmount',
+    'bankAccount3_AccountName', 'bankAccount3_AccountNumber',
+    'bankAccount3_AllocatedPercentage', 'bankAccount3_BSB', 'bankAccount3_FixedAmount',
+    // Emergency contacts
+    'emergencyContact1_Address', 'emergencyContact1_AlternateContactNumber',
+    'emergencyContact1_ContactNumber', 'emergencyContact1_Name', 'emergencyContact1_Relationship',
+    'emergencyContact2_Address', 'emergencyContact2_AlternateContactNumber',
+    'emergencyContact2_ContactNumber', 'emergencyContact2_Name', 'emergencyContact2_Relationship',
+    // Postal address
+    'postalStreetAddress', 'postalAddressLine2', 'postalPostCode', 'postalCountry',
+    'postalState', 'postalSuburb', 'postalAddressIsOverseas',
+    // Residential address
+    'residentialStreetAddress', 'residentialAddressLine2', 'residentialPostCode', 'residentialCountry',
+    'residentialState', 'residentialSuburb', 'residentialAddressIsOverseas',
+    // Tax
+    'taxFileNumber', 'taxCategory', 'taxVariation',
+    'claimTaxFreeThreshold', 'claimMedicareLevyReduction',
+    'medicareLevyExemption', 'medicareLevyReductionDependentCount',
+    'medicareLevyReductionSpouse', 'medicareLevySurchargeWithholdingTier',
+    'seniorsTaxOffset', 'otherTaxOffset', 'stslDebt',
+    'hasWithholdingVariation', 'dateTaxFileDeclarationReported', 'dateTaxFileDeclarationSigned',
+    // Super funds
+    'superFund1_AllocatedPercentage', 'superFund1_EmployerNominatedFund',
+    'superFund1_FixedAmount', 'superFund1_FundName', 'superFund1_MemberNumber', 'superFund1_ProductCode',
+    'superFund2_AllocatedPercentage', 'superFund2_EmployerNominatedFund',
+    'superFund2_FixedAmount', 'superFund2_FundName', 'superFund2_MemberNumber', 'superFund2_ProductCode',
+    'superFund3_AllocatedPercentage', 'superFund3_EmployerNominatedFund',
+    'superFund3_FixedAmount', 'superFund3_FundName', 'superFund3_MemberNumber', 'superFund3_ProductCode',
+    // ABNs
+    'contractorABN', 'employingEntityABN',
+    // Visa
+    'hasApprovedWorkingHolidayVisa', 'workingHolidayVisaCountry', 'workingHolidayVisaStartDate',
+];
+/** All whitelisted fields for EHAuEmployee (operational + PII) */
+export const AU_EMPLOYEE_FIELDS = [
+    ...AU_EMPLOYEE_OPERATIONAL_FIELDS,
+    ...AU_EMPLOYEE_PII_FIELDS,
+];

package/dist/utils.d.ts

@@ -7,3 +7,8 @@
  * EH API uses the API key as the username with an empty password.
  */
 export declare function buildBasicAuthHeader(apiKey: string): string;
+/**
+ * Pick only specified keys from an object.
+ * Strips any upstream fields not in the whitelist.
+ */
+export declare function pickFields<T>(obj: Record<string, unknown>, keys: readonly string[]): T;

package/dist/utils.js

@@ -12,3 +12,19 @@
 export function buildBasicAuthHeader(apiKey) {
     return 'Basic ' + btoa(apiKey + ':');
 }
+// ============================================================================
+// Field Stripping
+// ============================================================================
+/**
+ * Pick only specified keys from an object.
+ * Strips any upstream fields not in the whitelist.
+ */
+export function pickFields(obj, keys) {
+    const result = {};
+    for (const key of keys) {
+        if (key in obj) {
+            result[key] = obj[key];
+        }
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markwharton/eh-payroll",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Employment Hero Payroll API client",
   "type": "module",
   "main": "dist/index.js",