@unisonlabs/sixminute-admin 0.1.1187-next → 0.1.1189-next

package/dist/sixminute-admin.mjs

@@ -21,7 +21,7 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 
 // tools/admin/src/build-info.ts
-var BUILT = { version: "0.1.1187-next", commit: "5cffde7fe2a9dc58715a34d8b5f8cc0eb041a328", surface: "60ffe6d6d98eb32b" };
+var BUILT = { version: "0.1.1189-next", commit: "a271427030da8b939def7b46b2abf6f07482db17", surface: "9cd8ad25f1495c42" };
 
 // tools/admin/src/run.ts
 import { rmSync as rmSync3 } from "node:fs";
@@ -4895,7 +4895,8 @@ var TenantPolicySchema = exports_external.object({
   excluded_bundles: exports_external.array(exports_external.string().min(1)).default([]),
   security_tier: exports_external.enum(["standard", "confidential"]).default("standard"),
   raw_archive: exports_external.boolean().default(false),
-  research_export: exports_external.boolean().default(false)
+  research_export: exports_external.boolean().default(false),
+  context_retention_days: exports_external.number().int().min(0).max(365).default(30)
 }).default({});
 var NARRATIVE_GUIDANCE_MAX_CHARS = 1500;
 var GUIDANCE_CONTROL = /[\u0000-\u0009\u000B-\u001F\u007F-\u009F]/;
@@ -5682,6 +5683,33 @@ var ResearchExportResultSchema = exports_external.discriminatedUnion("tier", [
   ResearchExportConfidentialSchema,
   ResearchExportSealedSchema
 ]);
+var ResearchContextExportSchema = exports_external.object({
+  export_id: exports_external.string(),
+  tenant_id: exports_external.string(),
+  tenant_name: exports_external.string(),
+  from: exports_external.string(),
+  to: exports_external.string(),
+  operator: exports_external.string(),
+  contexts: exports_external.array(exports_external.object({
+    member_id: exports_external.string(),
+    recording_id: exports_external.string(),
+    seq: exports_external.number().int(),
+    t_start: exports_external.string(),
+    t_end: exports_external.string(),
+    context: exports_external.unknown()
+  })),
+  steps: exports_external.array(exports_external.object({
+    run_id: exports_external.string(),
+    kind: exports_external.string(),
+    member_id: exports_external.string(),
+    subject_from: exports_external.string(),
+    name: exports_external.string(),
+    prompt_fingerprint: exports_external.string().nullable(),
+    usage: exports_external.unknown(),
+    output: exports_external.unknown(),
+    created_at: exports_external.string()
+  }))
+});
 // packages/contracts/src/admin-tenants.ts
 var AdminTenantParamsSchema = exports_external.object({ tenant: TenantIdSchema });
 var AdminSecurityTierSchema = exports_external.enum(["standard", "confidential"]);
@@ -5762,6 +5790,26 @@ var AdminEntriesPurgeResultSchema = exports_external.object({
   rows: exports_external.object({ demo: exports_external.array(AdminPurgeRowSchema), unmatched: exports_external.array(AdminPurgeRowSchema) }),
   deleted: exports_external.object({ demo: exports_external.number().int(), unmatched: exports_external.number().int(), total: exports_external.number().int() }).nullable()
 });
+var AdminContextRetentionSetSchema = exports_external.object({ days: exports_external.number().int().min(1).max(365) });
+var AdminContextRetentionResultSchema = exports_external.object({
+  tenant: exports_external.object({ id: TenantIdSchema, name: exports_external.string() }),
+  days: exports_external.number().int(),
+  previous: exports_external.number().int(),
+  shifted: exports_external.object({
+    interval_contexts: exports_external.number().int(),
+    pipeline_runs: exports_external.number().int(),
+    pipeline_steps: exports_external.number().int(),
+    derivation_cache: exports_external.number().int(),
+    intervals: exports_external.number().int()
+  })
+});
+var AdminSealedBackfillResultSchema = exports_external.object({
+  tenant: TenantIdSchema,
+  decisions_sealed: exports_external.number().int(),
+  intervals_aged: exports_external.number().int(),
+  judged_sealed: exports_external.number().int(),
+  done: exports_external.boolean()
+});
 // packages/contracts/src/admin-firm-acting.ts
 var ACTING_AS_HEADER = "X-Six-Minute-Acting-As";
 var TeamApplyRequestSchema = exports_external.object({
@@ -5998,6 +6046,49 @@ var ServedConfigBundleSchema = ConfigBundleSchema.extend({
   prompts: ServedConfigPromptsSchema,
   vocabularies: ServedConfigVocabulariesSchema
 });
+// packages/contracts/src/device.ts
+var DEVICE_CREDENTIAL_PREFIX = "smd_";
+var ENROLLMENT_CODE_PREFIX = "sme_";
+var EnrollmentCodeSchema = exports_external.object({
+  code: exports_external.string().startsWith(ENROLLMENT_CODE_PREFIX),
+  expires_at: TimestampSchema
+});
+var DeviceEnrollSchema = exports_external.object({
+  code: exports_external.string().startsWith(ENROLLMENT_CODE_PREFIX).max(200),
+  device_id: DeviceIdSchema,
+  name: DeviceRegistrationSchema.shape.name,
+  platform: DeviceSchema.shape.platform
+});
+var DeviceEnrolledSchema = exports_external.object({
+  credential: exports_external.string().startsWith(DEVICE_CREDENTIAL_PREFIX),
+  device: DeviceSchema
+});
+var DevicePolicySchema = exports_external.object({
+  excluded_bundles: exports_external.array(exports_external.string()),
+  raw_archive: exports_external.boolean(),
+  swallow_short_pauses: exports_external.boolean().nullable(),
+  unit_minutes: UnitMinutesSchema,
+  context_retention_days: exports_external.number().int().nonnegative(),
+  minimum_version: exports_external.string().nullable()
+});
+var RecordingStopSchema = exports_external.object({
+  after_seq: exports_external.number().int().nonnegative(),
+  at: TimestampSchema,
+  reason: exports_external.enum(["person", "quit", "update", "sign-out", "roll"])
+});
+var RecordingSkipSchema = exports_external.object({ seq: exports_external.number().int().positive() });
+var RecordingClockSchema = exports_external.object({
+  device_clock: TimestampSchema,
+  last_witness_at: TimestampSchema.nullable(),
+  silence_end_after: TimestampSchema.nullable()
+});
+var RecordingParamsSchema = exports_external.object({ id: RecordingIdSchema });
+var ContextAcceptedSchema = exports_external.object({
+  accepted: exports_external.number().int().positive(),
+  run_id: RunIdSchema.optional(),
+  recording_id: RecordingIdSchema.optional()
+});
+var DeviceCredentialParamsSchema = exports_external.object({ id: DeviceIdSchema });
 // packages/contracts/src/recording.ts
 var RecordingSchema = exports_external.object({
   id: RecordingIdSchema,
@@ -6392,6 +6483,32 @@ var LocalHostEventSchema = exports_external.discriminatedUnion("name", [
   }).strict()
 ]);
 var LocalMethodSchema = exports_external.enum(["GET", "POST", "PATCH", "DELETE"]);
+// packages/contracts/src/pipeline-status.ts
+var PipelineStatusQuerySchema = exports_external.object({
+  since: exports_external.string().regex(/^\d{1,18}$/, "expected a version number").optional()
+});
+var PipelineRecordingStatusSchema = exports_external.object({
+  recording_id: RecordingIdSchema,
+  device_id: DeviceIdSchema,
+  decided_through: TimestampSchema.nullable(),
+  behind_seconds: exports_external.number().int().nonnegative(),
+  stopped_at: TimestampSchema.nullable()
+});
+var PipelineStatusSchema = exports_external.object({
+  version: exports_external.number().int().nonnegative(),
+  recordings: exports_external.array(PipelineRecordingStatusSchema),
+  deciding: exports_external.object({ recording_id: RecordingIdSchema, from: TimestampSchema, to: TimestampSchema }).nullable(),
+  generate: exports_external.object({
+    running: exports_external.object({
+      run_id: RunIdSchema,
+      kind: exports_external.enum(["generate", "regenerate", "propose"]),
+      day: LocalDaySchema,
+      step: exports_external.object({ name: exports_external.string(), at: TimestampSchema, entry_from: TimestampSchema.optional() })
+    }).nullable(),
+    pending: exports_external.array(exports_external.object({ day: LocalDaySchema, from: TimestampSchema, to: TimestampSchema })),
+    failed: exports_external.object({ run_id: RunIdSchema, day: LocalDaySchema, error_class: exports_external.string() }).nullable()
+  })
+});
 // packages/contracts/src/pipeline.ts
 var ContextStopReasonSchema = exports_external.enum(["person", "quit", "update", "sign-out", "roll"]);
 var IntervalContextHeaderSchema = exports_external.object({
@@ -6763,23 +6880,23 @@ async function deviceLogin(io, environment) {
   if (!started.ok) {
     throw new AdminUsageError(`WorkOS answered ${started.status} to the sign-in request for ${environment.name}. CLI Auth must be enabled ` + "for this environment in the WorkOS dashboard.");
   }
-  const device = await started.json();
-  if (typeof device.device_code !== "string" || typeof device.user_code !== "string") {
+  const device2 = await started.json();
+  if (typeof device2.device_code !== "string" || typeof device2.user_code !== "string") {
     throw new Error("WorkOS answered the sign-in request without a device code");
   }
-  const url = typeof device.verification_uri_complete === "string" ? device.verification_uri_complete : typeof device.verification_uri === "string" ? device.verification_uri : null;
+  const url = typeof device2.verification_uri_complete === "string" ? device2.verification_uri_complete : typeof device2.verification_uri === "string" ? device2.verification_uri : null;
   if (url === null)
     throw new Error("WorkOS answered the sign-in request without a url to confirm it at");
   io.say(`Sign in to ${environment.name} in your browser: ${url}`);
-  io.say(`Confirm that it shows the code ${device.user_code}.`);
+  io.say(`Confirm that it shows the code ${device2.user_code}.`);
   io.openBrowser(url);
-  let interval = (typeof device.interval === "number" && device.interval > 0 ? device.interval : 5) * 1000;
-  const deadline = io.now() + (typeof device.expires_in === "number" ? device.expires_in : 300) * 1000;
+  let interval = (typeof device2.interval === "number" && device2.interval > 0 ? device2.interval : 5) * 1000;
+  const deadline = io.now() + (typeof device2.expires_in === "number" ? device2.expires_in : 300) * 1000;
   for (;; ) {
     await io.sleep(interval);
     const answer = await authenticate(io, {
       grant_type: DEVICE_GRANT,
-      device_code: device.device_code,
+      device_code: device2.device_code,
       client_id: environment.clientId
     });
     if (answer.status === 200) {
@@ -7219,6 +7336,24 @@ is required; without one every command answers 403.
         The unseal runs as you, with your own Google sign-in (gcloud auth
         login); only the people granted the research key can open a card.
 
+  sixminute-admin retention set --env <env> --tenant tenant_... --days <1-365> [--json]
+        Sets how many days the cloud keeps the firm's interval contexts after
+        each interval's day (30 unless its agreement says otherwise), and moves
+        every stored expiry of the firm by the difference at once: a shorter
+        setting deletes at the next hourly purge. Summaries, labels and entries
+        are not affected.
+
+  sixminute-admin backfill sealed --env <env> --tenant tenant_... [--json]
+        Seals the firm's interval summaries and labels and its entries' judged
+        drafts under its own key, and gives intervals stored before the context
+        store an age, a bounded pass at a time until nothing is left.
+
+  sixminute-admin research contexts --env <env> --tenant tenant_... --from YYYY-MM-DD --to YYYY-MM-DD --out <dir> [--json]
+        A firm's research data (R10): its interval contexts and the step ledger
+        over a day range, written as two jsonl files in --out (a new folder
+        0700, as research export). Refused unless the firm instructed it in
+        writing (research-export allow); the audit row is written first.
+
   sixminute-admin entries purge --env <env> --tenant tenant_... --author member_... (--demo | --unmatched | both) [--dry-run] [--yes] [--json]
         Removes entry rows from one firm. A person may only soft-delete
         their own draft (2026-09-25) and nothing but a merge removes a row
@@ -7595,6 +7730,12 @@ async function runAdmin(argv, deps) {
     return runResearchExportFlag(run2, subcommand);
   if (group === "research" && subcommand === "export")
     return runResearchExport(run2);
+  if (group === "research" && subcommand === "contexts")
+    return runResearchContexts(run2);
+  if (group === "retention" && subcommand === "set")
+    return runRetentionSet(run2);
+  if (group === "backfill" && subcommand === "sealed")
+    return runBackfillSealed(run2);
   if (group === "entries" && subcommand === "purge")
     return runEntriesPurge(run2);
   if (group === "connector")
@@ -7784,6 +7925,65 @@ async function runResearchExportFlag(run2, subcommand) {
     allow ? "Research cards are stored for this firm from its next completion, for 30 days, sealed under the research key." : "No research card is stored for this firm from its next completion. Cards already stored stay until the 30-day purge."
   ]);
 }
+async function runRetentionSet(run2) {
+  const tenantId = required(run2.flags, "tenant", "whose retention");
+  const days = Number(required(run2.flags, "days", "how many days after each interval's day its context is kept"));
+  if (!Number.isInteger(days) || days < 1 || days > 365)
+    throw new AdminUsageError("--days is a whole number from 1 to 365.");
+  const done = AdminContextRetentionResultSchema.parse(expectOk(await call(run2.api, "PUT", tenantPath(tenantId, "/context-retention"), { days })));
+  const moved = Object.entries(done.shifted).map(([table2, rows]) => `${table2} ${rows}`).join(", ");
+  return render(run2, done, [
+    `tenant        ${done.tenant.id}  ${done.tenant.name}`,
+    `retention     ${done.previous} -> ${done.days} days`,
+    `moved         ${moved}`
+  ]);
+}
+async function runBackfillSealed(run2) {
+  const tenantId = required(run2.flags, "tenant", "whose rows to seal");
+  const total = { decisions_sealed: 0, intervals_aged: 0, judged_sealed: 0 };
+  for (;; ) {
+    const pass = AdminSealedBackfillResultSchema.parse(expectOk(await call(run2.api, "POST", tenantPath(tenantId, "/backfill/sealed"))));
+    total.decisions_sealed += pass.decisions_sealed;
+    total.intervals_aged += pass.intervals_aged;
+    total.judged_sealed += pass.judged_sealed;
+    if (pass.done)
+      break;
+  }
+  return render(run2, { tenant: tenantId, ...total }, [
+    `tenant        ${tenantId}`,
+    `sealed        ${total.decisions_sealed} interval decision(s), ${total.judged_sealed} judged draft(s)`,
+    `aged          ${total.intervals_aged} interval(s)`
+  ]);
+}
+async function runResearchContexts(run2) {
+  const { flags } = run2;
+  const tenantId = required(flags, "tenant", "an export is one firm's contexts and steps");
+  const from = dayOf2(flags, "from", "the first day of the range");
+  const to = dayOf2(flags, "to", "the day the range stops before; --to is not included");
+  if (from >= to)
+    throw new AdminUsageError("--from must be before --to; the range is half-open and an empty one exports nothing.");
+  const out = resolve(required(flags, "out", "where to write the files; an export lives on this machine and nowhere else"));
+  const claimed = claimExportDirectory(out);
+  let done;
+  try {
+    done = ResearchContextExportSchema.parse(expectOk(await call(run2.api, "POST", tenantPath(tenantId, "/research-exports/contexts"), { from, to })));
+  } catch (err) {
+    releaseExportDirectory(out, claimed);
+    throw err;
+  }
+  const contextsPath = join2(out, `contexts-${tenantId}-${from}-${to}.jsonl`);
+  const stepsPath = join2(out, `steps-${tenantId}-${from}-${to}.jsonl`);
+  writePrivateFile(contextsPath, jsonLines(done.contexts));
+  writePrivateFile(stepsPath, jsonLines(done.steps));
+  return render(run2, { tenant_id: tenantId, from: done.from, to: done.to, contexts: done.contexts.length, steps: done.steps.length, files: [contextsPath, stepsPath], operator: done.operator }, [
+    `tenant        ${tenantId}  ${done.tenant_name}`,
+    `range         ${from} to ${to} (--to not included)`,
+    `contexts      ${done.contexts.length}`,
+    `steps         ${done.steps.length}`,
+    `files         ${contextsPath}`,
+    `              ${stepsPath}`
+  ]);
+}
 async function runVersions(run2) {
   const tenantId = required(run2.flags, "tenant", "whose devices");
   const found = AdminDeviceVersionListSchema.parse(expectOk(await call(run2.api, "GET", tenantPath(tenantId, "/devices"))));
@@ -8439,7 +8639,11 @@ ${ADMIN_USAGE}`);
 
 // tools/admin/src/surface.ts
 import { createHash } from "node:crypto";
-var MACHINE_ADMIN_PATHS = ["/v1/admin/research/purge", "/v1/admin/connectors/sync"];
+var MACHINE_ADMIN_PATHS = [
+  "/v1/admin/research/purge",
+  "/v1/admin/connectors/sync",
+  "/v1/admin/context/purge"
+];
 function canonicalJson(value) {
   if (Array.isArray(value))
     return `[${value.map((item) => item === undefined ? "null" : canonicalJson(item)).join(",")}]`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unisonlabs/sixminute-admin",
-  "version": "0.1.1187-next",
+  "version": "0.1.1189-next",
   "description": "Sixminute operator tool: the admin commands of the Sixminute API, run with your own operator sign-in.",
   "license": "UNLICENSED",
   "repository": {