npm - @clef-sh/ui - Versions diffs - 0.1.14 → 0.1.15-beta.98 - Mend

@clef-sh/ui 0.1.14 → 0.1.15-beta.98

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/dist/client/assets/index-rBYybJbt.js +26 -0
package/dist/client/index.html +1 -1
package/dist/client-lib/components/Sidebar.d.ts +1 -1
package/dist/client-lib/components/Sidebar.d.ts.map +1 -1
package/dist/server/api.d.ts.map +1 -1
package/dist/server/api.js +275 -87
package/dist/server/api.js.map +1 -1
package/package.json +1 -1
package/src/client/App.tsx +8 -0
package/src/client/components/Sidebar.tsx +15 -1
package/src/client/screens/ManifestScreen.test.tsx +394 -0
package/src/client/screens/ManifestScreen.tsx +977 -0
package/src/client/screens/MatrixView.tsx +10 -1
package/src/client/screens/NamespaceEditor.tsx +13 -3
package/src/client/screens/ResetScreen.test.tsx +397 -0
package/src/client/screens/ResetScreen.tsx +614 -0
package/dist/client/assets/index-CVpAmirt.js +0 -26

package/dist/client/index.html CHANGED Viewed

@@ -42,7 +42,7 @@
         color: #3d4455;
       }
     </style>
-    <script type="module" crossorigin src="/assets/index-CVpAmirt.js"></script>
+    <script type="module" crossorigin src="/assets/index-rBYybJbt.js"></script>
   </head>
   <body>
     <div id="root"></div>

package/dist/client-lib/components/Sidebar.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { ClefManifest, MatrixStatus, GitStatus as GitStatusType } from "@clef-sh/core";
-export type ViewName = "matrix" | "editor" | "diff" | "lint" | "scan" | "import" | "recipients" | "identities" | "backend" | "history";
+export type ViewName = "matrix" | "editor" | "diff" | "lint" | "scan" | "import" | "recipients" | "identities" | "backend" | "reset" | "history" | "manifest";
 interface SidebarProps {
     activeView: ViewName;
     setView: (view: ViewName) => void;

package/dist/client-lib/components/Sidebar.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"Sidebar.d.ts","sourceRoot":"","sources":["../../../src/client/components/Sidebar.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5F,MAAM,MAAM,QAAQ,GAChB,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,MAAM,GACN,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,SAAS,GACT,SAAS,CAAC;~~AAEd~~,UAAU,YAAY;IACpB,UAAU,EAAE,QAAQ,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,OAAO,CAAC,EACtB,UAAU,EACV,OAAO,EACP,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,GACf,EAAE,YAAY,~~2CAgOd~~"}
1	+ {"version":3,"file":"Sidebar.d.ts","sourceRoot":"","sources":["../../../src/client/components/Sidebar.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5F,MAAM,MAAM,QAAQ,GAChB,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,MAAM,GACN,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,SAAS,GACT,OAAO,GACP,SAAS,GACT,UAAU,CAAC;AAEf,UAAU,YAAY;IACpB,UAAU,EAAE,QAAQ,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,OAAO,CAAC,EACtB,UAAU,EACV,OAAO,EACP,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,GACf,EAAE,YAAY,2CA4Od"}

package/dist/server/api.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/server/api.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAOpD,OAAO,EAUL,gBAAgB,~~EAejB~~,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,~~CAomCrD~~"}
1	+ {"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/server/api.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAOpD,OAAO,EAUL,gBAAgB,EAmBjB,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CA41CrD"}

package/dist/server/api.js CHANGED Viewed

@@ -115,11 +115,14 @@ function createApiRouter(deps) {
     const schemaValidator = new core_1.SchemaValidator();
     const lintRunner = new core_1.LintRunner(matrix, schemaValidator, sops);
     const git = new core_1.GitIntegration(deps.runner);
+    const tx = new core_1.TransactionManager(git);
     const scanRunner = new core_1.ScanRunner(deps.runner);
-    const recipientManager = new core_1.RecipientManager(sops, matrix);
-    const serviceIdManager = new core_1.ServiceIdentityManager(sops, matrix);
-    const backendMigrator = new core_1.BackendMigrator(sops, matrix);
-    const bulkOps = new core_1.BulkOps();
+    const recipientManager = new core_1.RecipientManager(sops, matrix, tx);
+    const serviceIdManager = new core_1.ServiceIdentityManager(sops, matrix, tx);
+    const backendMigrator = new core_1.BackendMigrator(sops, matrix, tx);
+    const resetManager = new core_1.ResetManager(matrix, sops, schemaValidator, tx);
+    const bulkOps = new core_1.BulkOps(tx);
+    const structureManager = new core_1.StructureManager(matrix, sops, tx);
     // In-session scan cache
     let lastScanResult = null;
     let lastScanAt = null;
@@ -206,7 +209,10 @@ function createApiRouter(deps) {
         try {
             const manifest = loadManifest();
             const { ns, env, key } = req.params;
-            const { value, random, confirmed } = req.body;
+            const { value, random, confirmed, commit: commitFlag, } = req.body;
+            // Auto-commit by default. The edit-multiple-rows-then-batch-commit
+            // flow in NamespaceEditor.handleSave passes commit:false to defer.
+            const shouldCommit = commitFlag !== false;
             if (!random && (value === undefined || value === null)) {
                 res.status(400).json({
                     error: "Request body must include 'value' or 'random: true'.",
@@ -231,87 +237,71 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            const filePath = `${deps.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
+            const relCellPath = manifest.file_pattern
+                .replace("{namespace}", ns)
+                .replace("{environment}", env);
+            const filePath = `${deps.repoRoot}/${relCellPath}`;
             const decrypted = await sops.decrypt(filePath);
-            if (random) {
-                // Generate random value server-side and mark as pending
-                const randomValue = (0, core_1.generateRandomValue)();
-                const previousValue = decrypted.values[key];
-                decrypted.values[key] = randomValue;
-                await sops.encrypt(filePath, decrypted.values, manifest, env);
-                try {
+            // Inside the mutate callback we do the actual encrypt + metadata
+            // update. When auto-commit is enabled this runs inside tx.run; when
+            // disabled (batched edit flow) it runs directly.
+            let response = { success: true, key };
+            const doWork = async () => {
+                if (random) {
+                    decrypted.values[key] = (0, core_1.generateRandomValue)();
+                    await sops.encrypt(filePath, decrypted.values, manifest, env);
+                    // Metadata update failure used to trigger an in-method rollback
+                    // here. Inside tx.run, that rollback comes for free via git
+                    // reset, so we just let the throw propagate.
                     await (0, core_1.markPendingWithRetry)(filePath, [key], "clef ui");
+                    response = { success: true, key, pending: true };
                 }
-                catch {
-                    // Both retry attempts failed — roll back the encrypt
-                    try {
-                        if (previousValue !== undefined) {
-                            decrypted.values[key] = previousValue;
+                else {
+                    decrypted.values[key] = String(value);
+                    await sops.encrypt(filePath, decrypted.values, manifest, env);
+                    // Validate against schema if defined
+                    const nsDef = manifest.namespaces.find((n) => n.name === ns);
+                    if (nsDef?.schema) {
+                        try {
+                            const schema = schemaValidator.loadSchema(path.join(deps.repoRoot, nsDef.schema));
+                            const result = schemaValidator.validate({ [key]: String(value) }, schema);
+                            const violations = [...result.errors, ...result.warnings];
+                            if (violations.length > 0) {
+                                response = {
+                                    success: true,
+                                    key,
+                                    warnings: violations.map((v) => v.message),
+                                };
+                            }
                         }
-                        else {
-                            delete decrypted.values[key];
+                        catch {
+                            // Schema load failed — skip validation, not fatal
                         }
-                        await sops.encrypt(filePath, decrypted.values, manifest, env);
                     }
-                    catch {
-                        // Rollback also failed — return 500 with context
-                        return res.status(500).json({
-                            error: "Partial failure",
-                            message: "Value was encrypted but pending state could not be recorded. " +
-                                "Rollback also failed. The key may have a random placeholder value. " +
-                                "Check the file manually.",
-                            code: "PARTIAL_FAILURE",
-                        });
-                    }
-                    return res.status(500).json({
-                        error: "Pending state could not be recorded",
-                        message: "The operation was rolled back. No changes were made.",
-                        code: "PENDING_FAILURE",
-                    });
-                }
-                res.json({ success: true, key, pending: true });
-            }
-            else {
-                decrypted.values[key] = String(value);
-                await sops.encrypt(filePath, decrypted.values, manifest, env);
-                // Validate against schema if defined (B1)
-                const nsDef = manifest.namespaces.find((n) => n.name === ns);
-                if (nsDef?.schema) {
+                    // Resolve pending state if the key was pending
                     try {
-                        const schema = schemaValidator.loadSchema(path.join(deps.repoRoot, nsDef.schema));
-                        const result = schemaValidator.validate({ [key]: String(value) }, schema);
-                        const violations = [...result.errors, ...result.warnings];
-                        if (violations.length > 0) {
-                            // Resolve pending state if the key was pending
-                            try {
-                                await (0, core_1.markResolved)(filePath, [key]);
-                            }
-                            catch {
-                                // Metadata update failed — non-fatal
-                            }
-                            return res.json({
-                                success: true,
-                                key,
-                                warnings: violations.map((v) => v.message),
-                            });
-                        }
+                        await (0, core_1.markResolved)(filePath, [key]);
                     }
                     catch {
-                        // Schema load failed — skip validation, not fatal
+                        // Metadata update failed — non-fatal
                     }
                 }
-                // Resolve pending state if the key was pending
-                try {
-                    await (0, core_1.markResolved)(filePath, [key]);
-                }
-                catch {
-                    // Metadata update failed — non-fatal
-                }
-                res.json({ success: true, key });
+            };
+            if (shouldCommit) {
+                await tx.run(deps.repoRoot, {
+                    description: `clef ui: set ${ns}/${env}/${key}`,
+                    paths: [relCellPath, relCellPath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml")],
+                    mutate: doWork,
+                });
+            }
+            else {
+                await doWork();
             }
+            res.json(response);
         }
-        catch {
-            res.status(500).json({ error: "Failed to set value", code: "SET_ERROR" });
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to set value";
+            res.status(500).json({ error: message, code: "SET_ERROR" });
         }
     });
     // DELETE /api/namespace/:ns/:env/:key
@@ -320,7 +310,8 @@ function createApiRouter(deps) {
         try {
             const manifest = loadManifest();
             const { ns, env, key } = req.params;
-            const { confirmed } = (req.body ?? {});
+            const { confirmed, commit: commitFlag } = (req.body ?? {});
+            const shouldCommit = commitFlag !== false;
             const nsExists = manifest.namespaces.some((n) => n.name === ns);
             const envExists = manifest.environments.some((e) => e.name === env);
             if (!nsExists || !envExists) {
@@ -338,7 +329,10 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            const filePath = `${deps.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
+            const relCellPath = manifest.file_pattern
+                .replace("{namespace}", ns)
+                .replace("{environment}", env);
+            const filePath = `${deps.repoRoot}/${relCellPath}`;
             const decrypted = await sops.decrypt(filePath);
             if (!(key in decrypted.values)) {
                 res.status(404).json({
@@ -347,19 +341,31 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            delete decrypted.values[key];
-            await sops.encrypt(filePath, decrypted.values, manifest, env);
-            // Clean up pending metadata if it exists
-            try {
-                await (0, core_1.markResolved)(filePath, [key]);
+            const doWork = async () => {
+                delete decrypted.values[key];
+                await sops.encrypt(filePath, decrypted.values, manifest, env);
+                try {
+                    await (0, core_1.markResolved)(filePath, [key]);
+                }
+                catch {
+                    // Best effort — orphaned metadata is annoying but not dangerous
+                }
+            };
+            if (shouldCommit) {
+                await tx.run(deps.repoRoot, {
+                    description: `clef ui: delete ${ns}/${env}/${key}`,
+                    paths: [relCellPath, relCellPath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml")],
+                    mutate: doWork,
+                });
             }
-            catch {
-                // Best effort — orphaned metadata is annoying but not dangerous
+            else {
+                await doWork();
             }
             res.json({ success: true, key });
         }
-        catch {
-            res.status(500).json({ error: "Failed to delete key", code: "DELETE_ERROR" });
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to delete key";
+            res.status(500).json({ error: message, code: "DELETE_ERROR" });
         }
     });
     // POST /api/namespace/:ns/:env/:key/accept — resolve pending state without changing the value
@@ -418,7 +424,7 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            await bulkOps.copyValue(key, fromCell, toCell, sops, manifest);
+            await bulkOps.copyValue(key, fromCell, toCell, sops, manifest, deps.repoRoot);
             res.json({ success: true, key, from: `${fromNs}/${fromEnv}`, to: `${toNs}/${toEnv}` });
         }
         catch (err) {
@@ -661,7 +667,7 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            const importRunner = new core_1.ImportRunner(sops);
+            const importRunner = new core_1.ImportRunner(sops, tx);
             const result = await importRunner.import(target, null, content, manifest, deps.repoRoot, {
                 format,
                 dryRun: true,
@@ -714,7 +720,7 @@ function createApiRouter(deps) {
                 res.json({ imported: [], skipped: [], failed: [] });
                 return;
             }
-            const importRunner = new core_1.ImportRunner(sops);
+            const importRunner = new core_1.ImportRunner(sops, tx);
             const result = await importRunner.import(target, null, content, manifest, deps.repoRoot, {
                 format,
                 keys,
@@ -931,6 +937,143 @@ function createApiRouter(deps) {
             res.status(500).json({ error: message, code: "SERVICE_IDENTITY_ERROR" });
         }
     });
+    // ── Manifest Structure (namespaces + environments) ─────────────────
+    //
+    // Each endpoint maps to a StructureManager method. Errors from the manager
+    // are mapped to HTTP status codes:
+    //   400 — invalid input (missing/wrong-type body field, invalid identifier)
+    //   404 — name not found in the manifest
+    //   409 — name collision (entity already exists, or rename target taken)
+    //   412 — refusal precondition (protected env, last namespace/env, orphaned SI)
+    //   500 — anything else (filesystem, sops, transaction failure)
+    /**
+     * Map a thrown error from StructureManager to an HTTP status. The manager
+     * throws plain `Error` instances with descriptive messages — we sniff the
+     * message text to pick the right status. Brittle but contained: every
+     * sniff matches a string the manager itself produces.
+     */
+    function structureErrorStatus(err) {
+        const message = err instanceof Error ? err.message : "";
+        if (/not found/.test(message))
+            return { status: 404, code: "NOT_FOUND" };
+        if (/already exists/.test(message))
+            return { status: 409, code: "CONFLICT" };
+        if (/Invalid (namespace|environment) name/.test(message))
+            return { status: 400, code: "BAD_REQUEST" };
+        if (/is protected|last (namespace|environment)|only scope/.test(message))
+            return { status: 412, code: "PRECONDITION_FAILED" };
+        return { status: 500, code: "STRUCTURE_ERROR" };
+    }
+    // POST /api/namespaces — add a new namespace and scaffold cells
+    router.post("/namespaces", async (req, res) => {
+        try {
+            const { name, description, schema } = req.body;
+            if (!name || typeof name !== "string") {
+                res.status(400).json({ error: "name is required.", code: "BAD_REQUEST" });
+                return;
+            }
+            const manifest = loadManifest();
+            await structureManager.addNamespace(name, { description, schema }, manifest, deps.repoRoot);
+            res.status(201).json({ name, description: description ?? "", schema });
+        }
+        catch (err) {
+            const { status, code } = structureErrorStatus(err);
+            const message = err instanceof Error ? err.message : "Failed to add namespace";
+            res.status(status).json({ error: message, code });
+        }
+    });
+    // PATCH /api/namespaces/:name — edit description, schema, or rename
+    router.patch("/namespaces/:name", async (req, res) => {
+        try {
+            const name = req.params.name;
+            const { rename, description, schema } = req.body;
+            if (rename === undefined && description === undefined && schema === undefined) {
+                res.status(400).json({
+                    error: "At least one of rename, description, or schema is required.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            const manifest = loadManifest();
+            await structureManager.editNamespace(name, { rename, description, schema }, manifest, deps.repoRoot);
+            res.json({ name: rename ?? name, previousName: rename ? name : undefined });
+        }
+        catch (err) {
+            const { status, code } = structureErrorStatus(err);
+            const message = err instanceof Error ? err.message : "Failed to edit namespace";
+            res.status(status).json({ error: message, code });
+        }
+    });
+    // DELETE /api/namespaces/:name — remove namespace and cascade through SIs
+    router.delete("/namespaces/:name", async (req, res) => {
+        try {
+            const name = req.params.name;
+            const manifest = loadManifest();
+            await structureManager.removeNamespace(name, manifest, deps.repoRoot);
+            res.json({ ok: true });
+        }
+        catch (err) {
+            const { status, code } = structureErrorStatus(err);
+            const message = err instanceof Error ? err.message : "Failed to remove namespace";
+            res.status(status).json({ error: message, code });
+        }
+    });
+    // POST /api/environments — add a new environment and scaffold cells
+    router.post("/environments", async (req, res) => {
+        try {
+            const { name, description, protected: isProtected, } = req.body;
+            if (!name || typeof name !== "string") {
+                res.status(400).json({ error: "name is required.", code: "BAD_REQUEST" });
+                return;
+            }
+            const manifest = loadManifest();
+            await structureManager.addEnvironment(name, { description, protected: isProtected }, manifest, deps.repoRoot);
+            res
+                .status(201)
+                .json({ name, description: description ?? "", protected: isProtected ?? false });
+        }
+        catch (err) {
+            const { status, code } = structureErrorStatus(err);
+            const message = err instanceof Error ? err.message : "Failed to add environment";
+            res.status(status).json({ error: message, code });
+        }
+    });
+    // PATCH /api/environments/:name — edit description, protected, or rename
+    router.patch("/environments/:name", async (req, res) => {
+        try {
+            const name = req.params.name;
+            const { rename, description, protected: isProtected, } = req.body;
+            if (rename === undefined && description === undefined && isProtected === undefined) {
+                res.status(400).json({
+                    error: "At least one of rename, description, or protected is required.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            const manifest = loadManifest();
+            await structureManager.editEnvironment(name, { rename, description, protected: isProtected }, manifest, deps.repoRoot);
+            res.json({ name: rename ?? name, previousName: rename ? name : undefined });
+        }
+        catch (err) {
+            const { status, code } = structureErrorStatus(err);
+            const message = err instanceof Error ? err.message : "Failed to edit environment";
+            res.status(status).json({ error: message, code });
+        }
+    });
+    // DELETE /api/environments/:name — remove env and cascade through SIs
+    router.delete("/environments/:name", async (req, res) => {
+        try {
+            const name = req.params.name;
+            const manifest = loadManifest();
+            await structureManager.removeEnvironment(name, manifest, deps.repoRoot);
+            res.json({ ok: true });
+        }
+        catch (err) {
+            const { status, code } = structureErrorStatus(err);
+            const message = err instanceof Error ? err.message : "Failed to remove environment";
+            res.status(status).json({ error: message, code });
+        }
+    });
     // ── Backend Migration ──────────────────────────────────────────────
     router.get("/backend-config", (_req, res) => {
         try {
@@ -1009,6 +1152,51 @@ function createApiRouter(deps) {
             res.status(500).json({ error: message, code: "MIGRATION_ERROR" });
         }
     });
+    // ── Destructive Reset ───────────────────────────────────────────────
+    //
+    // Disaster-recovery endpoint. Abandons the current encrypted contents of
+    // a scope (env / namespace / cell) and re-scaffolds fresh placeholders,
+    // optionally switching to a new SOPS backend in the same transaction.
+    // The UI gates this with a typed-confirmation modal — there is no
+    // server-side `confirmed` field because every other destructive endpoint
+    // (DELETE namespaces, DELETE environments) follows the same pattern of
+    // letting the UI carry the confirmation responsibility.
+    router.post("/reset", async (req, res) => {
+        try {
+            const { scope, backend, key, keys } = req.body;
+            if (!scope || typeof scope !== "object" || !("kind" in scope)) {
+                res.status(400).json({
+                    error: "Reset requires a scope. Provide { kind: 'env'|'namespace'|'cell', ... }.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            const manifest = loadManifest();
+            // Surface a clean 4xx for unknown scope before any destructive work.
+            // ResetManager re-validates internally as defence in depth.
+            try {
+                (0, core_1.validateResetScope)(scope, manifest);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Invalid reset scope";
+                res.status(404).json({ error: message, code: "NOT_FOUND" });
+                return;
+            }
+            const result = await resetManager.reset({ scope, backend, key, keys }, manifest, deps.repoRoot);
+            res.json({ success: true, result });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Reset failed";
+            // Validation-style errors that ResetManager throws after the scope
+            // check passes — bad backend/key combination, scope matches zero
+            // cells. Map these to 400 so the UI can render them as user errors
+            // rather than server errors.
+            const isUserError = /requires a key|does not take a key|matches zero cells/.test(message);
+            const status = isUserError ? 400 : 500;
+            const code = isUserError ? "BAD_REQUEST" : "RESET_ERROR";
+            res.status(status).json({ error: message, code });
+        }
+    });
     function dispose() {
         lastScanResult = null;
         lastScanAt = null;