AI integration prompt

You are helping me integrate the DNC LATAM API.

Use these public sources as the source of truth:
- Documentation: https://docs.dnclatam.com
- OpenAPI 3.1: https://api.dnclatam.com/openapi.json

Before writing implementation code, inspect the current OpenAPI contract when
network access is available. Do not invent endpoints, fields, limits, status
codes, or retry behavior.

Security and privacy constraints:
- Treat API keys and phone numbers as sensitive data.
- Never ask me to paste a live API key or customer phone list into chat.
- Use placeholders and synthetic phone numbers in every example.
- Keep the API key in a server-side secret or environment variable.
- Never expose the key in browser or mobile client code.
- Never log Authorization, request phone arrays, prohibited, safe, or invalid
  number arrays, raw idempotency keys, or response bodies containing phone
  numbers.
- Send real requests only from my controlled environment directly to
  https://api.dnclatam.com.

Core request contract:
- POST https://api.dnclatam.com/v1/scrub
- Authorization: Bearer dnc_live_...
- Idempotency-Key is required.
- Body: {"country":"mx"|"ar","phones":["..."]}
- Generate one opaque random idempotency key per logical request.
- Reuse that key only for an exact retry of the same country and phone array.
- Never put PII in the idempotency key.

Response semantics:
- prohibited_numbers_to_call: structurally valid original inputs found in the
  selected DNC registry; do not call them.
- safe_numbers_to_call: structurally valid original inputs not found in that
  registry at the time of the check. Here, safe is limited to this DNC registry
  result; it does not prove consent, reachability, or universal legal
  permission to call.
- invalid_numbers: inputs that could not be normalized, each with input and
  reason.
- summary.total_checked counts all submitted elements, including invalid
  inputs and duplicates.
- summary contains prohibited_numbers, safe_numbers, and invalid_numbers
  counts, and their sum equals summary.total_checked.
- Do not generate or parse the obsolete matched, clean, invalid, or stats
  response fields.
- Preserve duplicates and understand that response arrays contain the original
  input strings.

Reliability requirements:
- Distinguish rate_limit_exceeded from monthly_quota_exceeded.
- Honor Retry-After for retryable 409, 429, and 503 responses.
- Retry only the exact logical request with the same idempotency key.
- Use bounded exponential backoff with jitter for transient failures.
- Do not retry validation, authentication, billing, entitlement, quota, or
  idempotency-conflict errors without corrective action.

When answering:
1. State any assumptions.
2. Provide production-oriented server-side code.
3. Include structured error handling and safe, aggregate-only observability.
4. Include a synthetic test that does not consume or reveal customer data.
5. Explain how I can verify authentication, idempotency, response partitioning,
   retries, and zero-data-retention behavior.

My requested language/framework and integration task:
[DESCRIBE THE TASK HERE]

Build a TypeScript service for a Node.js worker that scrubs Mexico batches,
returns `safe_numbers_to_call` to the caller, and retries temporary capacity
errors.

Review my Python integration for incorrect idempotency and unsafe logging.
Do not call the API; return findings and corrected code only.

Explain a 409 idempotency_key_reused response and show how to model logical
request IDs in our queue.