paisa-mcp 0.3.0 → 0.4.0

package/dist/index.js

@@ -38033,6 +38033,44 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === undefined)
+    return;
+  if (schema === undefined)
+    return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise)
+    throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === undefined ? outcome.value : undefined;
+}
+function inputResponse(responses, key) {
+  if (responses === undefined || typeof responses !== "object" || responses === null)
+    return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry))
+    return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"]))
+    return {
+      kind: "roots",
+      roots: candidate["roots"]
+    };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== undefined)
+    return {
+      kind: "sampling",
+      result: candidate
+    };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
@@ -53145,6 +53183,90 @@ class PaisaApiClient {
   }
 }
 
+// ../../node_modules/.bun/@nimit9+signet-lib@0.1.15+d40099021b198cb0/node_modules/@nimit9/signet-lib/dist/crypto/index.js
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+async function decryptFields(input2, paths, { decrypt, isCiphertext }) {
+  const undecrypted = [];
+  const pending = [];
+  const looksEncrypted = (value, path) => {
+    if (!isCiphertext)
+      return true;
+    try {
+      return isCiphertext(value, path) !== false;
+    } catch {
+      return true;
+    }
+  };
+  const decryptInto = (target, key, value, path) => {
+    pending.push((async () => {
+      try {
+        const plain = await decrypt(value, path);
+        if (typeof plain !== "string")
+          throw new TypeError("decrypt returned a non-string");
+        target[key] = plain;
+      } catch {
+        target[key] = null;
+        undecrypted.push(path);
+      }
+    })());
+  };
+  const copies = new Map;
+  const mine = new WeakSet;
+  const copyOf = (v) => {
+    if (mine.has(v))
+      return v;
+    let c = copies.get(v);
+    if (!c) {
+      c = Array.isArray(v) ? [...v] : { ...v };
+      copies.set(v, c);
+      mine.add(c);
+    }
+    return c;
+  };
+  const walk = (node2, keys, at, set2) => {
+    if (Array.isArray(node2)) {
+      const arr = copyOf(node2);
+      set2(arr);
+      arr.forEach((item, i) => {
+        walk(item, keys, at ? `${at}.${i}` : String(i), (v) => {
+          arr[i] = v;
+        });
+      });
+      return;
+    }
+    if (!isObj(node2) || keys.length === 0)
+      return;
+    const [key, ...rest] = keys;
+    if (!Object.hasOwn(node2, key))
+      return;
+    const obj = copyOf(node2);
+    set2(obj);
+    const path = at ? `${at}.${key}` : key;
+    const value = obj[key];
+    if (rest.length > 0) {
+      walk(value, rest, path, (v) => {
+        obj[key] = v;
+      });
+      return;
+    }
+    if (typeof value === "string" && value !== "" && looksEncrypted(value, path)) {
+      decryptInto(obj, key, value, path);
+    }
+  };
+  let data = input2;
+  for (const p of paths) {
+    const keys = p.split(".").filter(Boolean);
+    if (keys.length === 0)
+      continue;
+    walk(data, keys, "", (v) => {
+      data = v;
+    });
+  }
+  await Promise.all(pending);
+  undecrypted.sort();
+  return { data, undecrypted };
+}
+
 // src/crypto.ts
 var import_hash_wasm = __toESM(require_index_umd(), 1);
 var ENCRYPTED_TXN_FIELDS = ["description", "referenceNumber", "notes"];
@@ -53207,16 +53329,6 @@ async function decryptField(encrypted, key) {
   const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
   return new TextDecoder().decode(plaintext);
 }
-async function decryptObjectFields(obj, fields, key) {
-  for (const field of fields) {
-    const val = obj[field];
-    if (typeof val !== "string" || !val)
-      continue;
-    try {
-      obj[field] = await decryptField(val, key);
-    } catch {}
-  }
-}
 async function encryptObjectFields(obj, fields, key) {
   for (const field of fields) {
     const val = obj[field];
@@ -53225,25 +53337,55 @@ async function encryptObjectFields(obj, fields, key) {
     obj[field] = await encryptField(val, key);
   }
 }
+var CIPHERTEXT_CHARSET_RE = /^[A-Za-z0-9+/]+={0,2}$/;
+var MIN_CIPHERTEXT_B64_LEN = 40;
+function looksLikeCiphertext(value) {
+  return value.length >= MIN_CIPHERTEXT_B64_LEN && CIPHERTEXT_CHARSET_RE.test(value);
+}
+async function decryptFieldsFailClosed(input2, paths, key) {
+  return decryptFields(input2, paths, {
+    decrypt: (ciphertext) => decryptField(ciphertext, key),
+    isCiphertext: (value) => looksLikeCiphertext(value)
+  });
+}
+var TXN_DECRYPT_PATHS = [
+  ...ENCRYPTED_TXN_FIELDS,
+  ...ENCRYPTED_MERCHANT_FIELDS.map((f) => `merchant.${f}`)
+];
 async function decryptTransactionFields(items, key) {
-  for (const item of items) {
-    await decryptObjectFields(item, ENCRYPTED_TXN_FIELDS, key);
-    const merchant = item.merchant;
-    if (merchant && typeof merchant === "object") {
-      await decryptObjectFields(merchant, ENCRYPTED_MERCHANT_FIELDS, key);
-    }
-  }
+  return decryptFieldsFailClosed(items, TXN_DECRYPT_PATHS, key);
 }
 async function decryptMerchantFields(items, key) {
-  for (const item of items) {
-    await decryptObjectFields(item, ENCRYPTED_MERCHANT_FIELDS, key);
-  }
+  return decryptFieldsFailClosed(items, ENCRYPTED_MERCHANT_FIELDS, key);
 }
 async function encryptTransactionFields(items, key) {
   for (const item of items) {
     await encryptObjectFields(item, ENCRYPTED_TXN_FIELDS, key);
   }
 }
+async function decryptPersonCiphers(input2, key) {
+  const { data, undecrypted } = await decryptFields(input2, ["cipher"], {
+    decrypt: async (ciphertext) => {
+      const json2 = await decryptField(ciphertext, key);
+      JSON.parse(json2);
+      return json2;
+    }
+  });
+  const merge3 = (row) => {
+    if (!row || typeof row !== "object")
+      return;
+    const r = row;
+    if (typeof r.cipher !== "string")
+      return;
+    const fields = JSON.parse(r.cipher);
+    Object.assign(r, fields, { cipher: null });
+  };
+  if (Array.isArray(data))
+    data.forEach(merge3);
+  else
+    merge3(data);
+  return { data, undecrypted };
+}
 var VERIFIER_PLAINTEXT = "paisa-verify-v1";
 async function checkVerifier(key, encryptedVerifier) {
   try {
@@ -53552,6 +53694,145 @@ function applyAnnotations(tools) {
     return { ...tool, title: meta3.title, annotations: meta3.annotations };
   });
 }
+
+// src/lib/confirm.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+var ANSWER_KEY = "confirm";
+function clientCanConfirm(mcp, initializeCapabilities) {
+  const envelope = mcp.mcpReq.envelope;
+  const caps = envelope?.[CLIENT_CAPABILITIES_META_KEY] ?? initializeCapabilities();
+  return Boolean(caps?.elicitation);
+}
+function planFingerprint(plan) {
+  const canonical = (v) => Array.isArray(v) ? v.map(canonical) : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).filter(([, x]) => x !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([k, x]) => [k, canonical(x)])) : v;
+  return createHash("sha256").update(JSON.stringify(canonical(plan))).digest("hex");
+}
+var STATE_KEY = randomBytes(32);
+function sign(nonce, fingerprint) {
+  return createHmac("sha256", STATE_KEY).update(`${nonce}.${fingerprint}`).digest("hex");
+}
+function mintState(fingerprint) {
+  const nonce = randomBytes(16).toString("hex");
+  return `${nonce}.${sign(nonce, fingerprint)}`;
+}
+function verifyState(state, fingerprint) {
+  if (typeof state !== "string")
+    return false;
+  const [nonce, mac3, ...rest] = state.split(".");
+  if (!nonce || !mac3 || rest.length)
+    return false;
+  const expected = Buffer.from(sign(nonce, fingerprint), "hex");
+  const given = Buffer.from(mac3, "hex");
+  return given.length === expected.length && timingSafeEqual(given, expected);
+}
+function confirmPlan(mcp, message, plan, initializeCapabilities = () => {
+  return;
+}) {
+  if (!clientCanConfirm(mcp, initializeCapabilities))
+    return { kind: "unsupported" };
+  const fingerprint = planFingerprint(plan);
+  const responses = mcp.mcpReq.inputResponses;
+  const answered = responses !== undefined && ANSWER_KEY in responses;
+  const echoed = mcp.mcpReq.requestState?.();
+  if (answered && verifyState(echoed, fingerprint)) {
+    const content = acceptedContent(responses, ANSWER_KEY);
+    if (content?.confirm === true)
+      return { kind: "confirmed" };
+    return {
+      kind: "declined",
+      result: { cancelled: true, message: "Cancelled by the user. Nothing was changed." }
+    };
+  }
+  return {
+    kind: "ask",
+    result: inputRequired({
+      inputRequests: {
+        [ANSWER_KEY]: inputRequired.elicit({
+          message,
+          requestedSchema: {
+            type: "object",
+            properties: {
+              confirm: { type: "boolean", title: "Confirm", description: "This can't be undone." }
+            },
+            required: ["confirm"]
+          }
+        })
+      },
+      requestState: mintState(fingerprint)
+    })
+  };
+}
+function withConfirmation(tool, describe3, initializeCapabilities) {
+  const run = tool.handler;
+  return {
+    ...tool,
+    handler: (args, ctx) => {
+      const message = describe3(args);
+      if (message === null || !ctx?.mcp)
+        return run(args, ctx);
+      const outcome = confirmPlan(ctx.mcp, message, { tool: tool.name, args }, initializeCapabilities);
+      if (outcome.kind === "confirmed" || outcome.kind === "unsupported")
+        return run(args, ctx);
+      return outcome.result;
+    }
+  };
+}
+var safeDate = (v) => typeof v === "string" && /^\d{4}-\d{2}-\d{2}$/.test(v) ? v : v === undefined ? "any" : "a date";
+var safeAmount = (v) => typeof v === "string" && /^\d+(\.\d{1,2})?$/.test(v) || typeof v === "number" ? String(v) : null;
+var plural2 = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function describeTransactionFilters(f) {
+  const parts = [];
+  if (f.startDate || f.endDate)
+    parts.push(`dated ${safeDate(f.startDate)} to ${safeDate(f.endDate)}`);
+  if (f.type)
+    parts.push(`${f.type}s only`);
+  if (f.categoryType)
+    parts.push(`category type ${f.categoryType}`);
+  if (f.categoryId)
+    parts.push("in one category");
+  if (f.uncategorized)
+    parts.push("uncategorized");
+  if (f.amountMin !== undefined || f.amountMax !== undefined)
+    parts.push(`amount ₹${f.amountMin ?? 0} to ${f.amountMax === undefined ? "any" : `₹${f.amountMax}`}`);
+  if (f.owner)
+    parts.push("one owner");
+  if (f.search)
+    parts.push("matching a text search");
+  return parts.length ? parts.join(", ") : "with no filters (ALL transactions)";
+}
+var describeDeletes = {
+  transactions: (a) => {
+    if (a.id)
+      return "Permanently delete 1 transaction?";
+    if (Array.isArray(a.ids))
+      return `Permanently delete ${plural2(a.ids.length, "transaction")}?`;
+    return `Permanently delete every transaction ${describeTransactionFilters(a.filters ?? {})}?`;
+  },
+  entity: (a) => {
+    const entity = String(a.entity ?? "item").replace(/_/g, " ");
+    const n = Array.isArray(a.ids) ? a.ids.length : 1;
+    const extra = a.entity === "merchant" ? " Their transactions are kept but unlinked." : a.entity === "debt" ? " Its history is lost; settling keeps it." : "";
+    return `Permanently delete ${plural2(n, entity)}?${extra}`;
+  },
+  mergeMerchants: (a) => {
+    const n = Array.isArray(a.duplicateIds) ? a.duplicateIds.length : 0;
+    return `Merge ${plural2(n, "duplicate merchant")} into the one you're keeping? Their transactions move over and the duplicates are deleted.`;
+  },
+  encryptionMode: (a) => `Switch encryption mode to ${a.encryptionMode === "private" ? "private" : "standard"}?`,
+  settleDebt: (a) => {
+    if (a.action !== "settle")
+      return null;
+    const amount = a.settledAmount === undefined ? "0" : safeAmount(a.settledAmount);
+    return amount === null ? "Settle this debt? It will be closed with the remaining balance you gave." : `Settle this debt? It will be closed with a remaining balance of ₹${amount}.`;
+  }
+};
+var CONFIRMED_TOOLS = {
+  delete_transactions: describeDeletes.transactions,
+  delete_entity: describeDeletes.entity,
+  merge_merchants: describeDeletes.mergeMerchants,
+  set_encryption_mode: describeDeletes.encryptionMode,
+  manage_debt: describeDeletes.settleDebt
+};
 // src/lib/union-tool.ts
 function variant(input2, run) {
   return { input: input2, run };
@@ -53862,7 +54143,8 @@ var dashboardOutputSchema = exports_external.object({
   recentTransactions: exports_external.array(exports_external.record(exports_external.string(), exports_external.unknown())),
   netWorth: exports_external.record(exports_external.string(), exports_external.unknown()).nullable(),
   debtSummary: exports_external.object({ totalOutstanding: exports_external.number(), totalEmi: exports_external.number(), count: exports_external.number() }).nullable(),
-  budgetVsActual: exports_external.array(budgetVsActualEntrySchema)
+  budgetVsActual: exports_external.array(budgetVsActualEntrySchema),
+  undecrypted: exports_external.array(exports_external.string()).optional()
 });
 var spendingTrendsSchema = exports_external.object({
   success: exports_external.literal(true),
@@ -53897,7 +54179,8 @@ var spendingTrendsSchema = exports_external.object({
     total: exports_external.number(),
     count: exports_external.number()
   })),
-  budgetVsActual: exports_external.array(budgetVsActualEntrySchema)
+  budgetVsActual: exports_external.array(budgetVsActualEntrySchema),
+  undecrypted: exports_external.array(exports_external.string()).optional()
 });
 var categoryAnalyticsSchema = exports_external.object({
   success: exports_external.literal(true),
@@ -53912,7 +54195,7 @@ var categoryAnalyticsSchema = exports_external.object({
   recentTransactions: exports_external.array(exports_external.object({
     id: exports_external.string(),
     date: exports_external.string(),
-    description: exports_external.string(),
+    description: exports_external.string().nullable(),
     amount: exports_external.number(),
     type: exports_external.string(),
     owner: exports_external.string(),
@@ -53926,7 +54209,8 @@ var categoryAnalyticsSchema = exports_external.object({
     total: exports_external.number(),
     count: exports_external.number()
   })),
-  stats: exports_external.object({ total: exports_external.number(), avgMonthly: exports_external.number(), count: exports_external.number() })
+  stats: exports_external.object({ total: exports_external.number(), avgMonthly: exports_external.number(), count: exports_external.number() }),
+  undecrypted: exports_external.array(exports_external.string()).optional()
 });
 var merchantAnalyticsSchema = exports_external.object({
   success: exports_external.literal(true),
@@ -53941,7 +54225,7 @@ var merchantAnalyticsSchema = exports_external.object({
   recentTransactions: exports_external.array(exports_external.object({
     id: exports_external.string(),
     date: exports_external.string(),
-    description: exports_external.string(),
+    description: exports_external.string().nullable(),
     amount: exports_external.number(),
     type: exports_external.string(),
     owner: exports_external.string(),
@@ -53956,7 +54240,8 @@ var merchantAnalyticsSchema = exports_external.object({
     total: exports_external.number(),
     count: exports_external.number()
   })),
-  stats: exports_external.object({ total: exports_external.number(), avgMonthly: exports_external.number(), count: exports_external.number() })
+  stats: exports_external.object({ total: exports_external.number(), avgMonthly: exports_external.number(), count: exports_external.number() }),
+  undecrypted: exports_external.array(exports_external.string()).optional()
 });
 var analyticsOutputSchema = exports_external.union([
   spendingTrendsSchema,
@@ -53965,37 +54250,17 @@ var analyticsOutputSchema = exports_external.union([
 ]);
 
 // src/tools/analytics.ts
-async function dec(value, key) {
-  if (typeof value !== "string" || !value)
-    return value;
-  try {
-    return await decryptField(value, key);
-  } catch {
-    return value;
-  }
-}
 async function decryptAnalytics(data, key) {
   if (!data || typeof data !== "object")
-    return;
-  const d = data;
-  const topMerchants = d.topMerchants;
-  if (Array.isArray(topMerchants)) {
-    for (const m of topMerchants)
-      m.name = await dec(m.name, key);
-  }
-  const recent = d.recentTransactions;
-  if (Array.isArray(recent)) {
-    for (const t of recent) {
-      t.description = await dec(t.description, key);
-      if ("merchantName" in t)
-        t.merchantName = await dec(t.merchantName, key);
-    }
-  }
-  const merchant = d.merchant;
-  if (merchant && typeof merchant === "object") {
-    merchant.cleanName = await dec(merchant.cleanName, key);
-    merchant.rawId = await dec(merchant.rawId, key);
-  }
+    return data;
+  const { data: decrypted, undecrypted } = await decryptFieldsFailClosed(data, [
+    "topMerchants.name",
+    "recentTransactions.description",
+    "recentTransactions.merchantName",
+    "merchant.cleanName",
+    "merchant.rawId"
+  ], key);
+  return undecrypted.length ? { ...decrypted, undecrypted } : decrypted;
 }
 function analyticsTools(client, crypto3) {
   return [
@@ -54023,7 +54288,7 @@ function analyticsTools(client, crypto3) {
             break;
         }
         if (crypto3)
-          await decryptAnalytics(data, crypto3.key);
+          data = await decryptAnalytics(data, crypto3.key);
         return data;
       }
     })
@@ -54091,7 +54356,10 @@ function dashboardTools(client, crypto3) {
       handler: async (params) => {
         const data = await client.get("/api/dashboard", params.months ? { months: params.months } : undefined);
         if (crypto3 && Array.isArray(data?.recentTransactions)) {
-          await decryptTransactionFields(data.recentTransactions, crypto3.key);
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.recentTransactions, crypto3.key);
+          data.recentTransactions = decrypted;
+          if (undecrypted.length)
+            return { ...data, undecrypted };
         }
         return data;
       }
@@ -54643,13 +54911,17 @@ function merchantVariants(client, crypto3) {
   return {
     list: variant(exports_external.object({ rawId: exports_external.string().optional().describe("merchants: find one by UPI ID or name") }), async ({ rawId }) => {
       const data = await client.get("/api/merchants");
-      if (crypto3 && data.data)
-        await decryptMerchantFields(data.data, crypto3.key);
+      let undecrypted = [];
+      if (crypto3 && data.data) {
+        const dec = await decryptMerchantFields(data.data, crypto3.key);
+        data.data = dec.data;
+        undecrypted = dec.undecrypted;
+      }
       if (!rawId)
-        return data;
+        return undecrypted.length ? { ...data, undecrypted } : data;
       const needle = rawId.toLowerCase();
       const merchants = (data.data ?? []).filter((m) => String(m.rawId ?? "").toLowerCase() === needle || String(m.cleanName ?? "").toLowerCase().includes(needle));
-      return { ...data, data: merchants };
+      return { ...data, data: merchants, ...undecrypted.length ? { undecrypted } : {} };
     }),
     upsert: variant(exports_external.object({
       id: exports_external.string().optional().describe("Merchant UUID — pass to update, omit to create"),
@@ -54758,22 +55030,19 @@ function personVariants(client, crypto3) {
       if (id) {
         const data2 = await client.get(`/api/persons/${id}`);
         if (crypto3 && data2.data.cipher) {
-          const fields = await decryptPersonCipher(data2.data.cipher, crypto3.key);
-          Object.assign(data2.data, fields, { cipher: null });
+          const { data: decrypted, undecrypted } = await decryptPersonCiphers(data2.data, crypto3.key);
+          data2.data = decrypted;
+          if (undecrypted.length)
+            return { ...data2, undecrypted };
         }
         return data2;
       }
       const data = await client.get("/api/persons");
       if (crypto3 && data.data) {
-        for (const person of data.data) {
-          const cipher = person.cipher;
-          if (cipher) {
-            try {
-              const fields = await decryptPersonCipher(cipher, crypto3.key);
-              Object.assign(person, fields, { cipher: null });
-            } catch {}
-          }
-        }
+        const { data: decrypted, undecrypted } = await decryptPersonCiphers(data.data, crypto3.key);
+        data.data = decrypted;
+        if (undecrypted.length)
+          return { ...data, undecrypted };
       }
       return data;
     }),
@@ -58567,9 +58836,8 @@ async function fetchAllRowsPaged(client, crypto3, params = {}, maxPages = 100) {
     if (cursor)
       q2.cursor = cursor;
     const res = await client.get("/api/transactions", q2);
-    const batch = res.data ?? [];
-    if (crypto3)
-      await decryptTransactionFields(batch, crypto3.key);
+    const batch0 = res.data ?? [];
+    const batch = crypto3 ? (await decryptTransactionFields(batch0, crypto3.key)).data : batch0;
     out.push(...batch.map(toTxnRow));
     if (!res.hasMore || !res.nextCursor || batch.length === 0 || res.nextCursor === cursor)
       break;
@@ -59034,9 +59302,8 @@ async function runRescan(client, crypto3) {
     bag = (await loadBag(client)).bag;
   } catch {}
   const merchantsRes = await client.get("/api/merchants");
-  const allMerchants = merchantsRes.data ?? [];
-  if (crypto3)
-    await decryptMerchantFields(allMerchants, crypto3.key);
+  const allMerchants0 = merchantsRes.data ?? [];
+  const allMerchants = crypto3 ? (await decryptMerchantFields(allMerchants0, crypto3.key)).data : allMerchants0;
   const globalMerchants = allMerchants.filter((m2) => !m2.householdId && m2.cleanName).map((m2) => ({ id: m2.id, name: m2.cleanName }));
   const localMerchants = allMerchants.filter((m2) => m2.householdId && m2.cleanName).map((m2) => ({ id: m2.id, name: m2.cleanName }));
   const merchantCategoryById = new Map(allMerchants.filter((m2) => m2.categoryId).map((m2) => [m2.id, m2.categoryId]));
@@ -59133,9 +59400,13 @@ function transactionTools(client, crypto3) {
         if (!full)
           apiParams.view = "lean";
         const data = await client.get("/api/transactions", Object.fromEntries(Object.entries(apiParams).filter(([, v2]) => v2 !== undefined).map(([k2, v2]) => [k2, String(v2)])));
-        const rows = data.data ?? [];
-        if (crypto3)
-          await decryptTransactionFields(rows, crypto3.key);
+        let rows = data.data ?? [];
+        let undecrypted = [];
+        if (crypto3) {
+          const dec = await decryptTransactionFields(rows, crypto3.key);
+          rows = dec.data;
+          undecrypted = dec.undecrypted;
+        }
         const personNames = new Map;
         if (rows.some((r2) => r2.personId)) {
           for (const p2 of await loadDecryptedPersons(client, crypto3))
@@ -59147,12 +59418,14 @@ function transactionTools(client, crypto3) {
             if (person && personNames.has(person.id))
               person.name = personNames.get(person.id) ?? "";
           }
-          return data;
+          data.data = rows;
+          return undecrypted.length ? { ...data, undecrypted } : data;
         }
         const out = {
           rows: rows.map((r2) => toLeanRow(r2, personNames)),
           ...data.hasMore ? { more: true, cursor: data.nextCursor } : {},
-          ...data.summary ? { spent: data.summary.spent, income: data.summary.income } : {}
+          ...data.summary ? { spent: data.summary.spent, income: data.summary.income } : {},
+          ...undecrypted.length ? { undecrypted } : {}
         };
         return out;
       }
@@ -59278,8 +59551,11 @@ function transactionTools(client, crypto3) {
         }
         if (action === "list") {
           const data2 = await client.get("/api/transactions/duplicates");
-          if (crypto3 && data2.data)
-            await decryptTransactionFields(data2.data, crypto3.key);
+          if (crypto3 && data2.data) {
+            const { data: decrypted, undecrypted } = await decryptTransactionFields(data2.data, crypto3.key);
+            data2.data = decrypted;
+            return withTruncationWarning(undecrypted.length ? { ...data2, undecrypted } : data2);
+          }
           return withTruncationWarning(data2);
         }
         const data = await client.post("/api/transactions/duplicates/resolve", {
@@ -59299,8 +59575,11 @@ function transactionTools(client, crypto3) {
       }),
       handler: async ({ accountId, startDate, endDate }) => {
         const data = await client.get("/api/transactions/reconciliation-context", { accountId, startDate, endDate });
-        if (crypto3 && data.data)
-          await decryptTransactionFields(data.data, crypto3.key);
+        if (crypto3 && data.data) {
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.data, crypto3.key);
+          data.data = decrypted;
+          return withTruncationWarning(undecrypted.length ? { ...data, undecrypted } : data);
+        }
         return withTruncationWarning(data);
       }
     }),
@@ -59392,8 +59671,11 @@ function transactionTools(client, crypto3) {
       input: exports_external.object({ ccAccountId: exports_external.string().uuid() }),
       handler: async ({ ccAccountId }) => {
         const data = await client.get("/api/transactions/settlement-candidates", { ccAccountId });
-        if (crypto3 && data.data)
-          await decryptTransactionFields(data.data, crypto3.key);
+        if (crypto3 && data.data) {
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.data, crypto3.key);
+          data.data = decrypted;
+          return withTruncationWarning(undecrypted.length ? { ...data, undecrypted } : data);
+        }
         return withTruncationWarning(data);
       }
     }),
@@ -59403,11 +59685,15 @@ function transactionTools(client, crypto3) {
       input: exports_external.object({ id: exports_external.string().uuid() }),
       handler: async ({ id }) => {
         const res = await client.get(`/api/transactions/${id}`);
-        const row = res.data;
+        let row = res.data;
         if (!row)
           return res;
-        if (crypto3)
-          await decryptTransactionFields([row], crypto3.key);
+        let undecrypted = [];
+        if (crypto3) {
+          const dec = await decryptTransactionFields([row], crypto3.key);
+          row = dec.data[0];
+          undecrypted = dec.undecrypted;
+        }
         const lean = Object.fromEntries([
           "id",
           "date",
@@ -59423,7 +59709,7 @@ function transactionTools(client, crypto3) {
           "isDuplicate",
           "source"
         ].filter((k2) => row[k2] !== undefined).map((k2) => [k2, row[k2]]));
-        return lean;
+        return undecrypted.length ? { ...lean, undecrypted } : lean;
       }
     })
   ];
@@ -59448,7 +59734,9 @@ function exportTools(client, crypto3) {
           format: "json"
         });
         if (crypto3 && Array.isArray(data?.transactions)) {
-          await decryptTransactionFields(data.transactions, crypto3.key);
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.transactions, crypto3.key);
+          data.transactions = decrypted;
+          return withTruncationWarning(undecrypted.length ? { ...data, undecrypted } : data);
         }
         return withTruncationWarning(data);
       }
@@ -59456,7 +59744,7 @@ function exportTools(client, crypto3) {
   ];
 }
 
-// ../../node_modules/.bun/@nimit9+signet-ai@0.1.11+a8a356da5edd5fb9/node_modules/@nimit9/signet-ai/dist/jev.js
+// ../../node_modules/.bun/@nimit9+signet-ai@0.1.11+53d0ad1559459462/node_modules/@nimit9/signet-ai/dist/jev.js
 var JEV_DEFAULT_MODEL = "jev-1.13.0";
 var JEV_DEFAULT_MIN_CONFIDENCE = 0.95;
 var JEV_DEFAULT_TIMEOUT_MS = 8000;
@@ -59942,9 +60230,8 @@ async function runStatementImport(deps, args) {
     throw new Error(`${basename(args.filePath)} parsed to 0 transactions (format ${format}). If it is a statement with real activity, the layout may not be supported.`);
   }
   const dates = txns.map((t2) => t2.date).sort();
-  const existing = await fetchReconciliationContext(client, account.id, dates[0], dates[dates.length - 1]);
-  if (crypto3)
-    await decryptTransactionFields(existing, crypto3.key);
+  const existing0 = await fetchReconciliationContext(client, account.id, dates[0], dates[dates.length - 1]);
+  const existing = crypto3 ? (await decryptTransactionFields(existing0, crypto3.key)).data : existing0;
   const present = existing.map((r2) => ({ ...r2, isDuplicate: false, isIgnored: false }));
   const result = reconcile(present, { ...statement, transactions: txns });
   const fresh = result.unmatched;
@@ -60282,7 +60569,7 @@ function registerResources(server, tools) {
 // package.json
 var package_default = {
   name: "paisa-mcp",
-  version: "0.3.0",
+  version: "0.4.0",
   repository: {
     type: "git",
     url: "git+https://github.com/nimit9/paisa.git",
@@ -60310,7 +60597,7 @@ var package_default = {
     "@modelcontextprotocol/client": "^2.1.0",
     "@modelcontextprotocol/server": "^2.1.0",
     "@nimit9/signet-ai": "^0.1.11",
-    "@nimit9/signet-lib": "^0.1.14",
+    "@nimit9/signet-lib": "^0.1.15",
     "@nimit9/signet-server": "^0.2.2",
     "@paisa/parsers": "workspace:*",
     "@paisa/reconciliation": "workspace:*",
@@ -60338,7 +60625,13 @@ function paisaErrorResult(err) {
   });
 }
 function buildServer(client, crypto3) {
-  const tools = applyAnnotations(REGISTRATIONS.flatMap((group) => group.tools(client, crypto3)));
+  let initializeCapabilities = () => {
+    return;
+  };
+  const tools = applyAnnotations(REGISTRATIONS.flatMap((group) => group.tools(client, crypto3)).map((t2) => {
+    const describe3 = CONFIRMED_TOOLS[t2.name];
+    return describe3 ? withConfirmation(t2, describe3, () => initializeCapabilities()) : t2;
+  }));
   for (const t2 of tools)
     if (t2.input)
       withCompactJsonSchema(t2.input);
@@ -60348,6 +60641,7 @@ function buildServer(client, crypto3) {
     tools,
     errorResult: paisaErrorResult
   });
+  initializeCapabilities = () => server.server.getClientCapabilities();
   registerResources(server, tools);
   registerPrompts(server);
   return server;
@@ -60374,5 +60668,5 @@ main().catch((err) => {
   process.exit(1);
 });
 
-//# debugId=C64445D8B55EDCFA64756E2164756E21
+//# debugId=F56B7BEACF2C363564756E2164756E21
 //# sourceMappingURL=index.js.map