conduyt 1.4.0 → 1.5.0

package/README.md

@@ -37,6 +37,8 @@ conduyt deals list --pipeline <id>      # list deals
 conduyt pipelines                       # list pipelines and stages
 conduyt search "acme corp"              # search across the CRM
 conduyt insights summary                # run an AI insight query
+conduyt privacy export <id>             # GDPR data-portability export (owner/admin)
+conduyt privacy forget <id> --confirm FORGET  # GDPR erasure — IRREVERSIBLE, owner only
 conduyt api GET /api/v1/companies       # raw authenticated request (escape hatch)
 conduyt config show                     # show resolved config (key masked)
 ```

package/dist/index.js

@@ -1480,6 +1480,36 @@ dnc
     assertUuid(id, "dnc id");
     return client.del(`/api/v1/dnc/${encodeURIComponent(id)}`);
 }));
+// ---- privacy (GDPR) ----
+const privacy = program
+    .command("privacy")
+    .description("GDPR data export and right-to-be-forgotten erasure");
+privacy
+    .command("export <id>")
+    .description("Export a contact's full portable data as JSON (GDPR data portability). Owner/admin key.")
+    .action(run(async (client, id) => {
+    assertUuid(id, "contact id");
+    return client.get(`/api/v1/contacts/${encodeURIComponent(id)}/gdpr-export`);
+}));
+privacy
+    .command("forget <id>")
+    .description("IRREVERSIBLE GDPR right-to-be-forgotten erasure — permanently anonymizes the contact and erases their personal data everywhere it appears (messages, notes, deals, files, automations, exports) across the whole account. Suppression tombstones are kept. THERE IS NO UNDO. Owner key. Requires --confirm FORGET.")
+    // Require an explicit VALUE (--confirm FORGET), not a bare boolean flag: a
+    // boolean --confirm would treat `--confirm false` as true (leaving "false" as
+    // an ignored extra arg) and erase anyway — a real automation footgun for an
+    // irreversible command. Reject excess args so that stray token can't slip by.
+    .allowExcessArguments(false)
+    .option("--confirm <word>", "required — pass exactly FORGET to authorize the irreversible erasure")
+    .action(run(async (client, id, opts) => {
+    assertUuid(id, "contact id");
+    if (opts.confirm !== "FORGET") {
+        fail("Refusing to erase: pass --confirm FORGET to authorize this irreversible erasure. It permanently anonymizes the contact and erases their personal data everywhere — there is no undo.");
+    }
+    // The API demands { confirm: "FORGET" }; the CLI mirrors that literal so
+    // the destructive intent is explicit at both layers. A 409 is retryable
+    // (concurrent merge / in-flight automation).
+    return client.post(`/api/v1/contacts/${encodeURIComponent(id)}/gdpr-forget`, { confirm: "FORGET" });
+}));
 // ---- ai ----
 const ai = program.command("ai").description("AI assistant and insight endpoints");
 ai

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "conduyt",
-  "version": "1.4.0",
-  "description": "Command-line interface for Conduyt CRM — manage contacts, deals, pipelines, and run insight queries from your terminal.",
+  "version": "1.5.0",
+  "description": "Command-line interface for Conduyt CRM \u2014 manage contacts, deals, pipelines, and run insight queries from your terminal.",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -18,7 +18,8 @@
     "build": "tsc",
     "typecheck": "tsc --noEmit",
     "start": "tsx src/index.ts",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test": "node --import tsx --test src/*.test.ts"
   },
   "keywords": [
     "conduyt",