@aiaiai-pt/frankctl 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to `@aiaiai-pt/frankctl` are documented here. This project
 adheres to [Semantic Versioning](https://semver.org/).
 
+## 0.7.0
+
+- Add discoverable, parameterized CIRA source-to-ontology template packs through
+  `templates list|show|render`; rendered output uses the existing declarative
+  `pipelines apply -f` path.
+- Package only the CIRA manifests explicitly allowlisted by pack metadata, with
+  no credentials, non-applyable Source examples, or ontology schema mutations.
+
+## 0.6.0
+
+- Add write-only structured Source credential create/rotate/attach/detach
+  commands and manifest fields backed by tenant-scoped Vault references.
+- Expose safe BackingDataset replay reason and effective-SyncSpec fingerprint
+  evidence, including explicit force replay confirmation.
+- Honor `--client-secret-stdin` for headless password login and reject combining
+  it with `--password-stdin`, since one stream cannot safely delimit two secrets.
+
 ## 0.5.1
 
 - Make `pipelines apply --wait` consume the precision-safe ontology

package/README.md

@@ -17,6 +17,10 @@ Requires Node.js >= 18. The binary is `frankctl`.
 frankctl auth login            # authenticate against your Frank instance
 frankctl --api-url https://frank.example.com sources list
 frankctl pipelines apply -f pipeline.yaml
+
+# Or render a curated vertical through the same apply path
+frankctl templates render cira -o cira.yaml
+frankctl pipelines apply -f cira.yaml --dry-run-server --live-ontology
 ```
 
 Full command reference: the [Frank docs](https://franksdocs.nomadriver.co) and `frankctl <command> --help`.
@@ -35,8 +39,10 @@ frankctl --help
 - `frankctl status`
 - `frankctl auth login|logout|status|token`
 - `frankctl config set|get|list`
+- `frankctl templates list|show|render`
 - `frankctl pipelines list|get|validate|apply|export`
 - `frankctl sources list|get|create|update|delete|discover|sync|logs|history`
+- `frankctl sources credentials set|rotate`
 - `frankctl backing-datasets list|get|create|update|delete|sync|entities` (alias: `frankctl bd`; `sync --force` replays unchanged data/spec)
 - `frankctl sources streams list|set|refresh-schema`
 - `frankctl transforms list|get|runs|logs|trigger`
@@ -65,12 +71,11 @@ Docs use the kubectl-style envelope (`apiVersion: frank.platform/v1`,
 Pipeline → BackingDataset), resolves cross-doc name references to UUIDs,
 and POSTs each doc with `?if-not-exists=true`. `frankctl pipelines export
 <id> -o yaml` round-trips an existing pipeline back to a multi-doc YAML
-file for private review. Current Source config uses literal credentials,
-`frankctl` performs no environment interpolation, and export preserves that
-config. Split secret-bearing Sources into an untracked mode-0600 file before
-committing the non-secret Pipeline/BackingDataset declarations. See
-`../docs/guides/cli.md` for the full reference and Frank issue #602 for the
-future Vault-backed reference contract.
+file for review. Declared credential values are written separately with
+`frankctl sources credentials set|rotate --values-file -` and stored in Vault;
+they are never accepted in ordinary `source_config` or returned by export.
+Git-owned Sources contain only ordinary configuration and the tenant-owned
+opaque `credential_ref`. See `../docs/guides/cli.md` for the full reference.
 
 Relationship-bearing BackingDatasets declare their prerequisites in
 `metadata.dependsOn` and explicitly use `spec.sync_mode: manual`. The graph is