Operator CLI
pipeo secrets
Generate the sealing keys, and reseal destination secrets to the current key.
secrets keygen prints a new sealing key pair and MAC key as environment settings: the public key for the admin API, the private keys for the worker.
secrets reseal moves stored destination secrets from the older format to secrets sealed to the worker’s public key (ADR 0008). --dry-run reports what would change.
pnpm pipeo secrets keygen [--kid seal1]
pnpm pipeo secrets reseal [--dry-run]The CLI runs from a checkout of the Pipeo repository (pnpm pipeo ...) and talks to Postgres directly, bypassing workspace isolation by design. It is for operators, not workspace members.