@unisonlabs/sixminute-admin 0.1.1183-next → 0.1.1185-next

package/dist/sixminute-admin.mjs

@@ -21,7 +21,7 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 
 // tools/admin/src/build-info.ts
-var BUILT = { version: "0.1.1183-next", commit: "1ef7d5cae5e04dc99660239f6ff1b537c9fb4c37", surface: "6002dfcedab0aa31" };
+var BUILT = { version: "0.1.1185-next", commit: "c9217149ea9d39117eeed671cb624b48d802ad69", surface: "60ffe6d6d98eb32b" };
 
 // tools/admin/src/run.ts
 import { rmSync as rmSync3 } from "node:fs";
@@ -4894,7 +4894,8 @@ var RoleSchema = exports_external.enum(["timekeeper", "billing", "admin"]);
 var TenantPolicySchema = exports_external.object({
   excluded_bundles: exports_external.array(exports_external.string().min(1)).default([]),
   security_tier: exports_external.enum(["standard", "confidential"]).default("standard"),
-  raw_archive: exports_external.boolean().default(false)
+  raw_archive: exports_external.boolean().default(false),
+  research_export: exports_external.boolean().default(false)
 }).default({});
 var NARRATIVE_GUIDANCE_MAX_CHARS = 1500;
 var GUIDANCE_CONTROL = /[\u0000-\u0009\u000B-\u001F\u007F-\u009F]/;
@@ -5721,6 +5722,10 @@ var AdminRawArchiveSetSchema = exports_external.object({ allowed: exports_extern
 var AdminTenantFlagsSchema = exports_external.object({
   tenant: exports_external.object({ id: TenantIdSchema, name: exports_external.string(), internal: exports_external.boolean(), raw_archive: exports_external.boolean() })
 });
+var AdminResearchExportSetSchema = exports_external.object({ research_export: exports_external.boolean() });
+var AdminResearchExportFlagSchema = exports_external.object({
+  tenant: exports_external.object({ id: TenantIdSchema, name: exports_external.string(), research_export: exports_external.boolean() })
+});
 var AdminDeviceVersionSchema = exports_external.object({
   id: DeviceIdSchema,
   name: exports_external.string(),
@@ -7123,6 +7128,14 @@ is required; without one every command answers 403.
         itself off at its next policy read. allow refuses a tenant that is not
         internal and exits 2, and the database refuses it again.
 
+  sixminute-admin research-export allow --env <env> --tenant tenant_... [--json]
+  sixminute-admin research-export revoke --env <env> --tenant tenant_... [--json]
+        Records the firm's WRITTEN instruction to keep research data for it, or
+        withdraws it (policy research_export, false until set). Run allow only
+        on that written instruction. Without it no research card is stored for
+        the firm, from the next completion; revoking deletes no card already
+        stored, which the 30-day purge removes.
+
   sixminute-admin research export --env <env> --tenant tenant_... --from YYYY-MM-DD --to YYYY-MM-DD --out <dir> [--json]
         Unseals one firm's research cards over a day range onto this machine
         and writes two jsonl files in --out: a new folder is created 0700, and
@@ -7510,6 +7523,8 @@ async function runAdmin(argv, deps) {
     return runTierSet(run2);
   if (group === "raw-archive")
     return runRawArchive(run2, subcommand);
+  if (group === "research-export")
+    return runResearchExportFlag(run2, subcommand);
   if (group === "research" && subcommand === "export")
     return runResearchExport(run2);
   if (group === "entries" && subcommand === "purge")
@@ -7616,6 +7631,7 @@ async function runTenantShow(run2) {
     `internal      ${t.internal}`,
     `security_tier ${t.security_tier}`,
     `raw_archive   ${t.policy.raw_archive}`,
+    `research_export ${t.policy.research_export}`,
     `connector     ${t.connector === null ? "none" : `${t.connector.kind}  ${t.connector.status}`}`,
     `members       ${t.members.active} active of ${t.members.total}`
   ]);
@@ -7633,7 +7649,8 @@ async function runTierSet(run2) {
       `tenant        ${tenant.id}  ${tenant.name}`,
       `security_tier ${tenant.security_tier}`,
       "",
-      "Research cards are stored for this firm for 30 days, sealed under the research key."
+      "Research cards are stored for this firm for 30 days, sealed under the research key, only while it has",
+      "instructed it in writing (research-export allow)."
     ]);
   }
   const deleted = done.cards_deleted ?? 0;
@@ -7685,6 +7702,20 @@ async function runRawArchive(run2, subcommand) {
     allow ? "A person on this tenant can now switch on the raw capture archive on their own device, in Capture settings." : "Every device on this tenant switches its raw archive off at its next policy read."
   ]);
 }
+async function runResearchExportFlag(run2, subcommand) {
+  if (subcommand !== "allow" && subcommand !== "revoke") {
+    throw new AdminUsageError(`unknown command: research-export ${subcommand ?? ""}`.trim());
+  }
+  const allow = subcommand === "allow";
+  const tenantId = required(run2.flags, "tenant", "which firm's written instruction is being recorded");
+  const { tenant } = AdminResearchExportFlagSchema.parse(expectOk(await call(run2.api, "PUT", tenantPath(tenantId, "/research-export"), { research_export: allow })));
+  return render(run2, { tenant }, [
+    `tenant          ${tenant.id}  ${tenant.name}`,
+    `research_export ${tenant.research_export}`,
+    "",
+    allow ? "Research cards are stored for this firm from its next completion, for 30 days, sealed under the research key." : "No research card is stored for this firm from its next completion. Cards already stored stay until the 30-day purge."
+  ]);
+}
 async function runVersions(run2) {
   const tenantId = required(run2.flags, "tenant", "whose devices");
   const found = AdminDeviceVersionListSchema.parse(expectOk(await call(run2.api, "GET", tenantPath(tenantId, "/devices"))));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unisonlabs/sixminute-admin",
-  "version": "0.1.1183-next",
+  "version": "0.1.1185-next",
   "description": "Sixminute operator tool: the admin commands of the Sixminute API, run with your own operator sign-in.",
   "license": "UNLICENSED",
   "repository": {