okengine 0.11.2 → 0.12.0

package/src/console/server/flows.ts

@@ -12,23 +12,40 @@ import {
   issueSession,
   PasswordPolicyError,
   scopesForRoles,
-  userPrincipal,
   type IssuedSession,
 } from "../../auth/index.ts";
 import { DryRunWriteIsolationError } from "../../kernel/dry-run.ts";
 import { fail, flow, http, type AnyFlowDef, type Binding } from "../../kernel/index.ts";
 import type { Flow as ManifestFlow, ResourceRef } from "../../manifest/types.ts";
+import { eventHasIrreversible, runReplay } from "../../cli/replay.ts";
+import { createRunsRuntime } from "../../runs/runtime.ts";
 import type { WideEvent } from "../../runs/types.ts";
 import { bindHttp } from "./bind.ts";
 import { touchLoginRateLimit } from "./auth-rate.ts";
-import { verifyClaimCode } from "./claim.ts";
-import { maskWideEventForConsole, piiFieldNamesFromManifest } from "./runs-pii.ts";
+import { clearClaimCodeArtifact, verifyClaimCode } from "./claim.ts";
+import { maskPiiValue, maskWideEventForConsole, piiFieldNamesFromManifest } from "./runs-pii.ts";
+import { ConsoleRunsQueryError, RUNS_QUERY_PII_GAP, RUNS_QUERY_TIMEOUT_MS } from "./runs-query.ts";
+import { DuckQueryTimeoutError } from "../../runs/duckdb.ts";
 import { ClockResourceNotFoundError, ScheduleNotOverridableError } from "./clock.ts";
 import { createFileDiff, emitStructuralDiff } from "./structural.ts";
 import type { ConsoleState } from "./state.ts";
 import { consoleFailureMessage } from "./i18n.ts";
+import { CONSOLE_PASSWORD_POLICY } from "../password-policy.ts";
 import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
-import { tenancyDeclared } from "./store.ts";
+import { resolveInvokeAs } from "./invoke-user-flow.ts";
+import { isKnownConsoleSqlGate, StoreFileNotFoundError, tenancyDeclared } from "./store.ts";
+import {
+  PG_STAT_STATEMENTS_NOT_CREATED,
+  PG_STAT_STATEMENTS_NOT_PRELOADED,
+  STORE_SQL_LOCKS_POLL_MS,
+  STORE_SQL_STATS_PII_GAP,
+  StoreSqlStatsError,
+} from "./store-stats.ts";
+import {
+  STORE_KV_STATS_SERVER_WIDE_GAP,
+  STORE_KV_STATS_SLOWLOG_ARGS_GAP,
+  StoreKvStatsError,
+} from "./store-kv-stats.ts";
 
 export { PUBLIC_CONSOLE_FLOWS };
 
@@ -41,7 +58,7 @@ const ClaimIn = z.object({
   claimCode: z.string().min(1),
   email: z.string().email(),
   name: z.string().min(1),
-  /** Matches default operator password policy (minLength 12). */
+  /** Matches {@link CONSOLE_PASSWORD_POLICY} (enforced again in createOperator). */
   password: z.string().min(12),
 });
 
@@ -102,18 +119,26 @@ const RunsListOut = z.object({
       replica: z.enum(["primary", "replica"]).nullable(),
       replicaLagMs: z.number().nullable(),
       cost: z.number().nullable(),
+      inputTokens: z.number().nullable(),
+      outputTokens: z.number().nullable(),
       promptVersion: z.number().nullable(),
       buildVersion: z.string().nullable(),
       startedAt: z.number(),
       endedAt: z.number(),
       durationMs: z.number(),
       error: z.string().nullable(),
+      /** Human message from the run ledger when present. */
+      errorMessage: z.string().nullable(),
       sampled: z.enum(["full", "error", "sample", "boost"]),
       effects: z.array(EffectEntryOut),
       /** `fx.log` lines — a field on the run, not a parallel stream. */
       logs: z.array(LogLineOut),
       /** All queryable dimensions for population analysis. */
       dimensions: z.record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null()])),
+      /** Validated flow input snapshot for replay — null when absent. */
+      input: z.unknown().nullable(),
+      /** Flow return value snapshot — null when absent (failures / legacy). */
+      output: z.unknown().nullable(),
     }),
   ),
 });
@@ -128,6 +153,17 @@ const TracesReplayOut = z.object({
   rootId: z.string(),
   dryRun: z.boolean(),
   at: z.number(),
+  flow: z.string(),
+});
+
+const ReplayUnavailable = z.object({
+  rootId: z.string(),
+  reason: z.enum(["no_stored_input"]),
+});
+
+const ReplayFailed = z.object({
+  rootId: z.string(),
+  message: z.string(),
 });
 
 const SignalEndpointOut = z.object({
@@ -278,19 +314,44 @@ const IdentitiesOut = z.object({
 const InvokeIn = z.object({
   flowId: z.string().min(1),
   body: z.unknown(),
-  asUserId: z.string().min(1),
+  /** Seeded identity when Invoke As → User. Omit for Operator / Public / policy. */
+  asUserId: z.string().min(1).optional(),
+  /** `public` or a policy Gate. Omit for Operator bypass. */
+  asGate: z.string().min(1).optional(),
+  /** Path params for HTTP routes with `:param` segments. */
+  pathParams: z.record(z.string(), z.string()).optional(),
   /** Typed confirmation phrase for irreversible production invokes. */
   confirmation: z.string().optional(),
   /** Recorded reason for irreversible production invokes. */
   reason: z.string().optional(),
+  /** Return classified PII in the handler response (audited). */
+  revealPii: z.boolean().optional(),
 });
 
 const InvokeOut = z.object({
   ok: z.literal(true),
   flowId: z.string(),
   asUserId: z.string(),
+  asGate: z.string().nullable().optional(),
   trigger: z.enum(["http", "signal", "clock", "internal", "durable"]),
   response: z.unknown(),
+  /** True when classified PII keys were redacted. */
+  masked: z.boolean(),
+  /** HTTP-ish status from the host when available (200 / 4xx). */
+  status: z.number().optional(),
+  /** Host typed failure when the target flow returned `fail(...)`. */
+  failure: z
+    .object({
+      code: z.string(),
+      data: z.unknown().optional(),
+      message: z.string().optional(),
+    })
+    .optional(),
+  runId: z.string().optional(),
+  /** Host telemetry cache dimension when the invoke adapter reported one. */
+  cache: z.enum(["hit", "miss", "none"]).optional(),
+  /** Handler duration from the host execute (high-res ms). */
+  durationMs: z.number().optional(),
   peakTier: z.enum(["none", "reads", "writes", "emits", "external", "capabilities"]),
   auditedAt: z.number(),
 });
@@ -302,6 +363,9 @@ const ClaimFailed = z.object({
   reasons: z.array(z.string()).optional(),
 });
 const AuthFailed = z.object({});
+const QueryRejected = z.object({ reason: z.string() });
+const QueryTimeout = z.object({ timeoutMs: z.number() });
+const QueryFailed = z.object({ reason: z.string() });
 const AuthRateLimited = z.object({ reason: z.string() });
 const NotFound = z.object({ flowId: z.string() });
 const InvokeDenied = z.object({ reason: z.string() });
@@ -313,8 +377,8 @@ const ConfirmRequired = z.object({
     "EDIT",
     "DELETE",
     "PURGE",
-    "SET",
     "ROTATE",
+    "ROTATE_MASTER",
     "REVOKE",
     "RUN",
     "SEND",
@@ -460,7 +524,13 @@ const ChannelSendTestOut = z.object({
   at: z.number(),
 });
 
-const VaultNotFound = z.object({ name: z.string() });
+const VaultNotFound = z.object({
+  name: z.string(),
+  reason: z.string().optional(),
+});
+const VaultSealed = z.object({ reason: z.string() });
+const VaultRotateBusy = z.object({ reason: z.string() });
+const VaultUnsupported = z.object({ reason: z.string() });
 const ClockNotFound = z.object({ kind: z.enum(["cron", "run"]), id: z.string() });
 const ScheduleNotOverridable = z.object({ name: z.string() });
 
@@ -522,6 +592,38 @@ const ClockListOut = z.object({
   ),
 });
 
+const InstanceClockLeaseOut = z.object({
+  name: z.string(),
+  leaseUntil: z.number(),
+});
+
+const InstanceJournalLeaseOut = z.object({
+  runId: z.string(),
+  flow: z.string(),
+  leaseUntil: z.number(),
+});
+
+const InstanceDetailOut = z.object({
+  id: z.string(),
+  startedAt: z.number(),
+  heartbeatAt: z.number(),
+  leaseExpiresAt: z.number(),
+  env: z.enum(["dev", "test", "prod"]),
+  pid: z.number().optional(),
+  clock: z.array(InstanceClockLeaseOut),
+  journal: z.array(InstanceJournalLeaseOut),
+});
+
+const InstancesListOut = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("empty") }),
+  z.object({
+    kind: z.literal("fleet"),
+    now: z.number(),
+    alive: z.number(),
+    instances: z.array(InstanceDetailOut),
+  }),
+]);
+
 const ClockRunNowIn = z.object({
   name: z.string().min(1),
   confirmation: z.string().optional(),
@@ -567,7 +669,7 @@ const ClockWakeEarlyOut = z.object({
 });
 
 const VaultResolutionStepOut = z.object({
-  source: z.enum(["process.env", ".env.local", ".env.docker", "driver", "dev-fallback"]),
+  source: z.enum(["process.env", ".env.local", "driver", "dev-fallback"]),
   present: z.boolean(),
   won: z.boolean(),
 });
@@ -588,12 +690,13 @@ const VaultRowOut = z.object({
   fingerprints: z.record(z.string(), z.string()),
   fingerprint: z.string().nullable(),
   cleartext: z.string().nullable(),
-  winner: z.enum(["process.env", ".env.local", ".env.docker", "driver", "dev-fallback"]).nullable(),
+  winner: z.enum(["process.env", ".env.local", "driver", "dev-fallback"]).nullable(),
   resolution: z.array(VaultResolutionStepOut),
   readers: z.array(z.string()),
   blastRadius: VaultBlastRadiusOut,
   lastReadAt: z.number().nullable(),
   sharedFingerprintEnvs: z.array(z.string()),
+  origin: z.enum(["source", "console"]).optional(),
 });
 
 const VaultBuiltinStatusOut = z.object({
@@ -613,6 +716,7 @@ const VaultBackendOut = z.object({
   builtin: z.boolean(),
   status: VaultBuiltinStatusOut.nullable(),
   unavailable: z.string().nullable(),
+  provider: z.string().nullable(),
 });
 
 const VaultListOut = z.object({
@@ -625,9 +729,19 @@ const VaultWriteIn = z.object({
   name: z.string().min(1),
   value: z.string().min(1),
   confirmation: z.string().optional(),
-  reason: z.string().optional(),
+  reason: z.string().min(3),
+});
+
+const VaultCreateIn = z.object({
+  name: z.string().min(1),
+  value: z.string().min(1),
+  kind: z.enum(["secret", "config"]),
+  description: z.string().optional(),
+  rotate: z.string().optional(),
 });
 
+const VaultExists = z.object({ name: z.string() });
+
 const VaultWriteOut = z.object({
   ok: z.literal(true),
   name: z.string(),
@@ -635,6 +749,40 @@ const VaultWriteOut = z.object({
   at: z.number(),
 });
 
+const VaultAuditRowOut = z.object({
+  id: z.string(),
+  seq: z.number(),
+  action: z.string(),
+  path: z.string().nullable(),
+  actorType: z.string(),
+  actorId: z.string().nullable(),
+  success: z.boolean(),
+  errorCode: z.string().nullable(),
+  errorMessage: z.string().nullable(),
+  requestId: z.string().nullable(),
+  createdAt: z.number(),
+});
+
+const VaultAuditVerifyOut = z.object({
+  ok: z.boolean(),
+  brokenAt: z.string().nullable(),
+  reason: z.enum(["link", "payload"]).nullable(),
+  row: VaultAuditRowOut.nullable(),
+});
+
+const VaultRotateMasterIn = z.object({
+  confirmation: z.string().optional(),
+  reason: z.string().optional(),
+});
+
+const VaultRotateMasterOut = z.object({
+  ok: z.literal(true),
+  kekVersion: z.number(),
+  remaining: z.number(),
+  masterKey: z.string().nullable(),
+  at: z.number(),
+});
+
 const AiMetricOut = z.object({
   samples: z.array(z.number()),
   mean: z.number(),
@@ -1261,6 +1409,7 @@ const StoreListOut = z.object({
         z.object({
           name: z.string(),
           effectRef: z.string(),
+          kind: z.enum(["table", "index", "function", "trigger", "extension", "policy"]).optional(),
           writers: z.array(z.string()),
           readers: z.array(z.string()),
           cache: z.object({
@@ -1271,6 +1420,7 @@ const StoreListOut = z.object({
           willNotFire: WillNotFireOut,
           piiColumns: z.array(z.string()),
           columnDescriptions: z.record(z.string(), z.string()),
+          rls: z.boolean().optional(),
         }),
       ),
       replicaLagMs: z.number().nullable(),
@@ -1282,6 +1432,7 @@ const StoreListOut = z.object({
         })
         .nullable(),
       contentAddressed: z.boolean(),
+      driverId: z.enum(["memory", "fs", "s3"]).optional(),
       warnings: z.array(
         z.object({
           code: z.string(),
@@ -1300,7 +1451,9 @@ const StoreQueryIn = z.object({
   prefix: z.string().optional(),
   limit: z.number().min(1).max(500).optional(),
   vector: z.array(z.number()).optional(),
+  q: z.string().optional(),
   topK: z.number().min(1).max(100).optional(),
+  revealPii: z.boolean().optional(),
 });
 
 const StoreQueryOut = z.object({
@@ -1311,6 +1464,9 @@ const StoreQueryOut = z.object({
       z.object({
         key: z.string(),
         value: z.unknown().optional(),
+        ttlMs: z.number().nullable().optional(),
+        sizeBytes: z.number().optional(),
+        originalName: z.string().optional(),
         warnings: z.array(z.object({ code: z.string(), message: z.string() })).optional(),
       }),
     )
@@ -1342,6 +1498,23 @@ const StoreRevealOut = z.object({
   at: z.number(),
 });
 
+const StoreFileGetIn = z.object({
+  ref: z.string().min(1),
+  key: z.string().min(1),
+  tenant: z.string().optional(),
+});
+
+const StoreFileGetOut = z.object({
+  key: z.string(),
+  sizeBytes: z.number(),
+  contentType: z.string(),
+  encoding: z.enum(["utf8", "base64"]),
+  body: z.string(),
+  truncated: z.boolean(),
+  originalName: z.string().optional(),
+  warnings: z.array(z.object({ code: z.string(), message: z.string() })),
+});
+
 const StoreEditIn = z.object({
   ref: z.string().min(1),
   child: z.string().optional(),
@@ -1402,12 +1575,158 @@ const StoreSqlIn = z.object({
   sql: z.string().min(1),
   tenant: z.string().optional(),
   allowWrite: z.boolean().optional(),
+  revealPii: z.boolean().optional(),
+  asGate: z.string().min(1).optional(),
 });
 
 const StoreSqlOut = z.object({
   rows: z.array(z.record(z.string(), z.unknown())),
   masked: z.boolean(),
   routedRole: z.enum(["primary", "replica"]),
+  asGate: z.string().nullable(),
+  gateApplied: z.boolean(),
+});
+
+const StoreSqlStatsIn = z.object({
+  ref: z.string().min(1),
+  tenant: z.string().optional(),
+});
+
+const StoreSqlStatsOut = z.object({
+  statements: z.array(
+    z.object({
+      queryid: z.string().nullable(),
+      query: z.string().nullable(),
+      calls: z.number(),
+      totalExecMs: z.number(),
+      meanExecMs: z.number(),
+      minExecMs: z.number(),
+      maxExecMs: z.number(),
+      rows: z.number(),
+      sharedBlksHit: z.number(),
+      sharedBlksRead: z.number(),
+      cacheHitRate: z.number().nullable(),
+    }),
+  ),
+  kpis: z.object({
+    slowQueries: z.number(),
+    cacheHitRate: z.number().nullable(),
+    avgRowsPerCall: z.number().nullable(),
+  }),
+  limitation: z.literal(STORE_SQL_STATS_PII_GAP),
+  rowCount: z.number(),
+  truncated: z.boolean(),
+  advisor: z.object({
+    available: z.boolean(),
+    installed: z.boolean(),
+    hypopgAvailable: z.boolean(),
+  }),
+});
+
+const StoreSqlLocksIn = z.object({
+  ref: z.string().min(1),
+  tenant: z.string().optional(),
+  revealPii: z.boolean().optional(),
+});
+
+const StoreSqlLocksOut = z.object({
+  rows: z.array(
+    z.object({
+      blockedPid: z.number().nullable(),
+      blockedUser: z.string().nullable(),
+      blockedQuery: z.string().nullable(),
+      blockedAt: z.string().nullable(),
+      blockingPid: z.number().nullable(),
+      blockingUser: z.string().nullable(),
+      blockingQuery: z.string().nullable(),
+      blockingState: z.string().nullable(),
+      waitEventType: z.string().nullable(),
+      waitEvent: z.string().nullable(),
+    }),
+  ),
+  masked: z.boolean(),
+  limitation: z.literal(STORE_SQL_STATS_PII_GAP),
+  pollingMs: z.literal(STORE_SQL_LOCKS_POLL_MS),
+});
+
+const StoreSqlAdviseIn = z.object({
+  ref: z.string().min(1),
+  query: z.string().min(1),
+  tenant: z.string().optional(),
+});
+
+const StoreSqlAdviseOut = z.object({
+  startupCostBefore: z.unknown(),
+  startupCostAfter: z.unknown(),
+  totalCostBefore: z.unknown(),
+  totalCostAfter: z.unknown(),
+  indexStatements: z.array(z.string()),
+  errors: z.array(z.string()),
+});
+
+const PgStatStatementsNotPreloaded = z.object({ reason: z.string() });
+const PgStatStatementsUnsupported = z.object({ reason: z.string() });
+const PgStatStatementsNotCreated = z.object({ reason: z.string() });
+
+const StoreKvStatsIn = z.object({
+  ref: z.string().min(1),
+  tenant: z.string().optional(),
+  revealPii: z.boolean().optional(),
+});
+
+const StoreKvStatsOut = z.object({
+  engine: z.enum(["redis", "memory"]),
+  kpis: z.object({
+    hitRate: z.number().nullable(),
+    opsPerSec: z.number().nullable(),
+    evictedKeys: z.number().nullable(),
+    expiredKeys: z.number().nullable(),
+  }),
+  commands: z.array(
+    z.object({
+      command: z.string(),
+      calls: z.number(),
+      usec: z.number(),
+      usecPerCall: z.number().nullable(),
+    }),
+  ),
+  slowlog: z.array(
+    z.object({
+      id: z.number(),
+      timestamp: z.number(),
+      durationUs: z.number(),
+      command: z.string(),
+      args: z.array(z.string()),
+    }),
+  ),
+  latency: z.array(
+    z.object({
+      event: z.string(),
+      latestUs: z.number().nullable(),
+      allTimeUs: z.number().nullable(),
+    }),
+  ),
+  limitation: z.literal(STORE_KV_STATS_SERVER_WIDE_GAP),
+  slowlogLimitation: z.literal(STORE_KV_STATS_SLOWLOG_ARGS_GAP),
+  masked: z.boolean(),
+  namespacePrefix: z.string(),
+});
+
+const KvStatsUnsupported = z.object({ reason: z.string() });
+
+const RunsQueryIn = z.object({
+  sql: z.string().min(1),
+  revealPii: z.boolean().optional(),
+});
+
+const RunsQueryOut = z.object({
+  rows: z.array(z.record(z.string(), z.unknown())),
+  truncated: z.boolean(),
+  rowCount: z.number(),
+  masked: z.literal("column-keys"),
+  durationMs: z.number(),
+  limitation: z.literal(RUNS_QUERY_PII_GAP),
+  injectedLimit: z.boolean(),
 });
 
 const StorePreviewIn = z.object({
@@ -1450,7 +1769,7 @@ export function createConsoleBindings(state: ConsoleState): {
       readonly logout: AnyFlowDef;
     };
     readonly manifest: { readonly get: AnyFlowDef };
-    readonly runs: { readonly list: AnyFlowDef };
+    readonly runs: { readonly list: AnyFlowDef; readonly query: AnyFlowDef };
     readonly action: { readonly ping: AnyFlowDef };
     readonly structural: {
       readonly propose: AnyFlowDef;
@@ -1472,16 +1791,24 @@ export function createConsoleBindings(state: ConsoleState): {
       readonly list: AnyFlowDef;
       readonly query: AnyFlowDef;
       readonly reveal: AnyFlowDef;
+      readonly object: AnyFlowDef;
       readonly edit: AnyFlowDef;
       readonly delete: AnyFlowDef;
       readonly purgeCache: AnyFlowDef;
       readonly sql: AnyFlowDef;
       readonly preview: AnyFlowDef;
+      readonly stats: AnyFlowDef;
+      readonly locks: AnyFlowDef;
+      readonly advise: AnyFlowDef;
+      readonly kvStats: AnyFlowDef;
     };
     readonly vault: {
       readonly list: AnyFlowDef;
       readonly set: AnyFlowDef;
+      readonly create: AnyFlowDef;
       readonly rotate: AnyFlowDef;
+      readonly rotateMaster: AnyFlowDef;
+      readonly auditVerify: AnyFlowDef;
     };
     readonly ai: {
       readonly list: AnyFlowDef;
@@ -1513,6 +1840,9 @@ export function createConsoleBindings(state: ConsoleState): {
       readonly editSchedule: AnyFlowDef;
       readonly wakeEarly: AnyFlowDef;
     };
+    readonly instances: {
+      readonly list: AnyFlowDef;
+    };
     readonly channel: {
       readonly list: AnyFlowDef;
       readonly preview: AnyFlowDef;
@@ -1529,6 +1859,7 @@ export function createConsoleBindings(state: ConsoleState): {
   const sessionLogout = createSessionLogout();
   const manifestGet = createManifestGet(state);
   const runsList = createRunsList(state);
+  const runsQuery = createRunsQuery(state);
   const actionPing = createActionPing(state);
   const structuralPropose = createStructuralPropose(state);
   const flowsIdentities = createFlowsIdentities(state);
@@ -1541,14 +1872,22 @@ export function createConsoleBindings(state: ConsoleState): {
   const storeList = createStoreList(state);
   const storeQuery = createStoreQuery(state);
   const storeReveal = createStoreReveal(state);
+  const storeObject = createStoreObject(state);
   const storeEdit = createStoreEdit(state);
   const storeDelete = createStoreDelete(state);
   const storePurgeCache = createStorePurgeCache(state);
   const storeSql = createStoreSql(state);
   const storePreview = createStorePreview(state);
+  const storeStats = createStoreSqlStats(state);
+  const storeLocks = createStoreSqlLocks(state);
+  const storeAdvise = createStoreSqlAdvise(state);
+  const storeKvStats = createStoreKvStats(state);
   const vaultList = createVaultList(state);
   const vaultSet = createVaultSet(state);
+  const vaultCreate = createVaultCreate(state);
   const vaultRotate = createVaultRotate(state);
+  const vaultRotateMaster = createVaultRotateMaster(state);
+  const vaultAuditVerify = createVaultAuditVerify(state);
   const aiList = createAiList(state);
   const gatesList = createGatesList(state);
   const gatesSimulate = createGatesSimulate(state);
@@ -1563,6 +1902,7 @@ export function createConsoleBindings(state: ConsoleState): {
   const diffList = createDiffList(state);
   const pluginsList = createPluginsList(state);
   const clockList = createClockList(state);
+  const instancesList = createInstancesList(state);
   const clockRunNow = createClockRunNow(state);
   const clockPause = createClockPause(state);
   const clockEditSchedule = createClockEditSchedule(state);
@@ -1581,6 +1921,7 @@ export function createConsoleBindings(state: ConsoleState): {
     bindHttp(http.post("/console/session/logout"), sessionLogout),
     bindHttp(http.get("/console/manifest"), manifestGet),
     bindHttp(http.get("/console/runs"), runsList),
+    bindHttp(http.post("/console/runs/query"), runsQuery),
     bindHttp(http.post("/console/action/ping"), actionPing),
     bindHttp(http.post("/console/structural/propose"), structuralPropose),
     bindHttp(http.get("/console/flows/identities"), flowsIdentities),
@@ -1591,22 +1932,30 @@ export function createConsoleBindings(state: ConsoleState): {
     bindHttp(http.post("/console/signals/dry-run-replay"), signalsDryRunReplay),
     bindHttp(http.post("/console/signals/discard"), signalsDiscard),
     bindHttp(http.get("/console/store"), storeList),
-    bindHttp(http.post("/console/store/query"), storeQuery),
+    bindHttp(http.query("/console/store/query"), storeQuery),
     bindHttp(http.post("/console/store/reveal"), storeReveal),
+    bindHttp(http.post("/console/store/object"), storeObject),
     bindHttp(http.post("/console/store/edit"), storeEdit),
     bindHttp(http.post("/console/store/delete"), storeDelete),
     bindHttp(http.post("/console/store/purge-cache"), storePurgeCache),
     bindHttp(http.post("/console/store/sql"), storeSql),
     bindHttp(http.post("/console/store/preview"), storePreview),
+    bindHttp(http.query("/console/store/sql/stats"), storeStats),
+    bindHttp(http.query("/console/store/sql/locks"), storeLocks),
+    bindHttp(http.query("/console/store/kv/stats"), storeKvStats),
+    bindHttp(http.post("/console/store/sql/advise"), storeAdvise),
     bindHttp(http.get("/console/vault"), vaultList),
     bindHttp(http.post("/console/vault/set"), vaultSet),
+    bindHttp(http.post("/console/vault/create"), vaultCreate),
     bindHttp(http.post("/console/vault/rotate"), vaultRotate),
+    bindHttp(http.post("/console/vault/rotate-master"), vaultRotateMaster),
+    bindHttp(http.get("/console/vault/audit/verify"), vaultAuditVerify),
     bindHttp(http.get("/console/ai"), aiList),
     bindHttp(http.get("/console/gates"), gatesList),
-    bindHttp(http.post("/console/gates/simulate"), gatesSimulate),
-    bindHttp(http.post("/console/gates/powers"), gatesPowers),
+    bindHttp(http.query("/console/gates/simulate"), gatesSimulate),
+    bindHttp(http.query("/console/gates/powers"), gatesPowers),
     bindHttp(http.get("/console/access"), accessList),
-    bindHttp(http.post("/console/access/effective"), accessEffective),
+    bindHttp(http.query("/console/access/effective"), accessEffective),
     bindHttp(http.post("/console/access/key-blast"), accessKeyBlast),
     bindHttp(http.post("/console/access/keys"), accessCreateKeyFlow),
     bindHttp(http.post("/console/access/keys/revoke"), accessRevokeKeyFlow),
@@ -1615,12 +1964,13 @@ export function createConsoleBindings(state: ConsoleState): {
     bindHttp(http.get("/console/diff"), diffList),
     bindHttp(http.get("/console/plugins"), pluginsList),
     bindHttp(http.get("/console/clock"), clockList),
+    bindHttp(http.get("/console/instances"), instancesList),
     bindHttp(http.post("/console/clock/run-now"), clockRunNow),
     bindHttp(http.post("/console/clock/pause"), clockPause),
     bindHttp(http.post("/console/clock/edit-schedule"), clockEditSchedule),
     bindHttp(http.post("/console/clock/wake-early"), clockWakeEarly),
     bindHttp(http.get("/console/channels"), channelsList),
-    bindHttp(http.post("/console/channels/preview"), channelPreview),
+    bindHttp(http.query("/console/channels/preview"), channelPreview),
     bindHttp(http.post("/console/channels/verify-auth"), channelVerifyAuth),
     bindHttp(http.post("/console/channels/reveal"), channelReveal),
     bindHttp(http.post("/console/channels/send-test"), channelSendTest),
@@ -1632,7 +1982,7 @@ export function createConsoleBindings(state: ConsoleState): {
       setup: { status: setupStatus, claim: setupClaim },
       session: { login: sessionLogin, me: sessionMe, logout: sessionLogout },
       manifest: { get: manifestGet },
-      runs: { list: runsList },
+      runs: { list: runsList, query: runsQuery },
       action: { ping: actionPing },
       structural: { propose: structuralPropose },
       flows: { identities: flowsIdentities, invoke: flowsInvoke },
@@ -1647,16 +1997,24 @@ export function createConsoleBindings(state: ConsoleState): {
         list: storeList,
         query: storeQuery,
         reveal: storeReveal,
+        object: storeObject,
         edit: storeEdit,
         delete: storeDelete,
         purgeCache: storePurgeCache,
         sql: storeSql,
         preview: storePreview,
+        stats: storeStats,
+        locks: storeLocks,
+        advise: storeAdvise,
+        kvStats: storeKvStats,
       },
       vault: {
         list: vaultList,
         set: vaultSet,
+        create: vaultCreate,
         rotate: vaultRotate,
+        rotateMaster: vaultRotateMaster,
+        auditVerify: vaultAuditVerify,
       },
       ai: { list: aiList },
       gates: {
@@ -1682,6 +2040,7 @@ export function createConsoleBindings(state: ConsoleState): {
         editSchedule: clockEditSchedule,
         wakeEarly: clockWakeEarly,
       },
+      instances: { list: instancesList },
       channel: {
         list: channelsList,
         preview: channelPreview,
@@ -1726,6 +2085,7 @@ function createSetupClaim(state: ConsoleState) {
           email: input.email,
           name: input.name,
           password: input.password,
+          passwordPolicy: CONSOLE_PASSWORD_POLICY,
         });
       } catch (err) {
         if (err instanceof PasswordPolicyError) {
@@ -1746,6 +2106,7 @@ function createSetupClaim(state: ConsoleState) {
         throw err;
       }
       await state.persistOperator(op.id);
+      clearClaimCodeArtifact(state.cwd);
       const issued = await issueOperatorSession(state, op.id);
       fx.log.info("console.setup.claim", { operatorId: op.id });
       return sessionPayload(op.id, op.email, op.name, issued);
@@ -1819,6 +2180,50 @@ function createManifestGet(state: ConsoleState) {
   });
 }
 
+function createRunsQuery(state: ConsoleState) {
+  return flow("console.runs.query", {
+    plane: "operator",
+    in: RunsQueryIn,
+    out: RunsQueryOut,
+    errors: { AuthFailed, QueryRejected, QueryTimeout, QueryFailed },
+    do: async (input: z.infer<typeof RunsQueryIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      if (input.revealPii === true) {
+        fx.log.info("console.runs.query.reveal", {
+          operatorId: fx.operator.id,
+        });
+      }
+      try {
+        const result = await state.queryPersistedRuns({
+          sql: input.sql,
+          revealPii: input.revealPii === true,
+        });
+        fx.log.info("console.runs.query", {
+          operatorId: fx.operator.id,
+          revealPii: input.revealPii === true,
+          rowCount: result.rowCount,
+          truncated: result.truncated,
+        });
+        return result;
+      } catch (err) {
+        if (err instanceof DuckQueryTimeoutError) {
+          return fail("QueryTimeout", { timeoutMs: err.timeoutMs });
+        }
+        if (err instanceof ConsoleRunsQueryError) {
+          if (err.code === "QueryTimeout") {
+            const match = /^timeout:(\d+)$/.exec(err.reason);
+            return fail("QueryTimeout", {
+              timeoutMs: match ? Number(match[1]) : RUNS_QUERY_TIMEOUT_MS,
+            });
+          }
+          return fail(err.code, { reason: err.reason });
+        }
+        return fail("QueryFailed", { reason: err instanceof Error ? err.message : String(err) });
+      }
+    },
+  });
+}
+
 function createRunsList(state: ConsoleState) {
   return flow("console.runs.list", {
     plane: "operator",
@@ -1828,8 +2233,12 @@ function createRunsList(state: ConsoleState) {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const all = await state.listRuns();
       const piiFields = piiFieldNamesFromManifest(state.manifest);
+      // Drop prior list polls — they are operator chrome, not Traces rows,
+      // and must never re-enter the projection (nested-output bomb).
       return {
-        runs: all.map((r) => projectRun(r, piiFields)),
+        runs: all
+          .filter((r) => r.flow !== "console.runs.list")
+          .map((r) => projectRun(r, piiFields)),
       };
     },
   });
@@ -1865,12 +2274,15 @@ export function projectRun(r: WideEvent, piiFields: ReadonlySet<string> = new Se
     replica: r.replica ?? null,
     replicaLagMs: r.replicaLagMs ?? null,
     cost: r.cost ?? null,
+    inputTokens: r.inputTokens ?? null,
+    outputTokens: r.outputTokens ?? null,
     promptVersion: r.promptVersion ?? null,
     buildVersion: r.buildVersion ?? null,
     startedAt: r.startedAt,
     endedAt: r.endedAt,
     durationMs: r.durationMs,
     error: masked.error?.code ?? null,
+    errorMessage: masked.error?.message ?? null,
     sampled: masked.error ? ("error" as const) : ("sample" as const),
     effects: masked.effects.map((e) => ({
       kind: e.kind,
@@ -1886,6 +2298,8 @@ export function projectRun(r: WideEvent, piiFields: ReadonlySet<string> = new Se
       at: line.at,
     })),
     dimensions,
+    input: masked.input === undefined ? null : masked.input,
+    output: masked.output === undefined ? null : masked.output,
   };
 }
 
@@ -1894,23 +2308,61 @@ function createTracesReplay(state: ConsoleState) {
     plane: "operator",
     in: TracesReplayIn,
     out: TracesReplayOut,
-    errors: { AuthFailed, NotFound },
+    errors: { AuthFailed, NotFound, ReplayUnavailable, ReplayFailed },
     do: async (input: z.infer<typeof TracesReplayIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const all = await state.listRuns();
       const root = all.find((r) => r.id === input.rootId);
       if (!root) return fail("NotFound", { flowId: input.rootId });
+      if (root.input === undefined) {
+        return fail("ReplayUnavailable", {
+          rootId: input.rootId,
+          reason: "no_stored_input" as const,
+        });
+      }
+
+      const irreversible = eventHasIrreversible(root);
+      const dryRun = input.dryRun || irreversible;
+
+      const runs = createRunsRuntime({ driver: "memory" });
+      await runs.open();
+      await runs.append(root);
+
+      const lines: string[] = [];
+      const code = await runReplay({
+        requestId: input.rootId,
+        cwd: state.cwd,
+        dryRun: dryRun ? true : undefined,
+        live: dryRun ? undefined : true,
+        runs,
+        write: (t) => lines.push(t),
+        ...(state.replayTrace
+          ? {
+              executeReplay: async (_entry: string, event: WideEvent, d: boolean) =>
+                state.replayTrace!({ event, dryRun: d }),
+            }
+          : {}),
+      });
+
+      if (code !== 0) {
+        return fail("ReplayFailed", {
+          rootId: input.rootId,
+          message: lines.join("").trim() || "replay failed",
+        });
+      }
+
       fx.log.info("console.traces.replay", {
         operatorId: fx.operator.id,
         rootId: input.rootId,
-        dryRun: input.dryRun,
+        dryRun,
         flow: root.flow,
       });
       return {
         ok: true as const,
         rootId: input.rootId,
-        dryRun: input.dryRun,
+        dryRun,
         at: Date.now(),
+        flow: root.flow,
       };
     },
   });
@@ -2166,7 +2618,7 @@ function createFlowsInvoke(state: ConsoleState) {
     in: InvokeIn,
     out: InvokeOut,
     errors: { AuthFailed, NotFound, InvokeDenied, ConfirmRequired },
-    do: (input: z.infer<typeof InvokeIn>, fx) => {
+    do: async (input: z.infer<typeof InvokeIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const manifest = state.manifest;
       const declared = manifest?.flows?.[input.flowId];
@@ -2174,19 +2626,18 @@ function createFlowsInvoke(state: ConsoleState) {
         return fail("NotFound", { flowId: input.flowId });
       }
 
-      const identity = state.identities.find((i) => i.id === input.asUserId);
-      if (!identity || identity.status !== "active") {
-        return fail("InvokeDenied", { reason: "identity not found or disabled" });
+      const assumed = resolveInvokeAs(
+        {
+          ...(input.asUserId !== undefined ? { asUserId: input.asUserId } : {}),
+          ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
+        },
+        state.identities,
+        manifest ?? null,
+      );
+      if (!assumed.ok) {
+        return fail("InvokeDenied", { reason: assumed.reason });
       }
 
-      // Operators hold no application scopes — `console:flows:invoke-as`
-      // (covered by session `console:*`) is the grant to assume a user principal.
-      const assumed = userPrincipal({
-        userId: identity.id,
-        scopes: identity.scopes,
-        verified: true,
-      });
-
       const peakTier = peakTierOf(declared);
       if (peakTier === "external" && state.production) {
         if (input.confirmation !== "INVOKE" || (input.reason?.trim().length ?? 0) < 3) {
@@ -2197,23 +2648,71 @@ function createFlowsInvoke(state: ConsoleState) {
         }
       }
 
+      const invoke = state.invokeUserFlow;
+      if (!invoke) {
+        return fail("InvokeDenied", { reason: "host invoke not configured" });
+      }
+
       const trigger = triggerKindOf(declared);
-      const response = stubResponse(declared, input.body);
+      const host = await invoke({
+        flowId: input.flowId,
+        body: input.body,
+        ...(input.pathParams !== undefined ? { pathParams: input.pathParams } : {}),
+        principal: assumed.principal,
+        operatorId: fx.operator.id,
+        ...(assumed.bypassGates ? { bypassGates: true } : {}),
+        ...(input.reason !== undefined ? { reason: input.reason } : {}),
+        ...(input.revealPii === true ? { revealPii: true } : {}),
+      });
+
+      const reveal = input.revealPii === true;
+      const piiFields = piiFieldNamesFromManifest(manifest);
+      if (reveal) {
+        fx.log.info("console.flows.invoke.reveal", {
+          operatorId: fx.operator.id,
+          flowId: input.flowId,
+        });
+      }
+      const response = reveal ? host.output : maskPiiValue(host.output, piiFields);
+      const failure =
+        host.failure === undefined
+          ? undefined
+          : {
+              ...host.failure,
+              ...(host.failure.data !== undefined
+                ? {
+                    data: reveal ? host.failure.data : maskPiiValue(host.failure.data, piiFields),
+                  }
+                : {}),
+            };
+
       fx.log.info("console.flows.invoke", {
         operatorId: fx.operator.id,
         flowId: input.flowId,
-        asUserId: assumed.userId,
-        scopes: [...assumed.scopes],
+        asUserId: assumed.asUserId,
+        asGate: assumed.asGate,
+        scopes: [...assumed.principal.scopes],
         peakTier,
         reason: input.reason,
+        status: host.status,
+        failure: host.failure?.code,
+        runId: host.runId,
+        revealPii: reveal,
       });
 
       return {
         ok: true as const,
         flowId: input.flowId,
-        asUserId: input.asUserId,
+        asUserId: assumed.asUserId,
+        asGate: assumed.asGate,
         trigger,
         response,
+        masked: !reveal,
+        ...(host.status !== undefined ? { status: host.status } : {}),
+        ...(failure !== undefined ? { failure } : {}),
+        ...(host.runId !== undefined ? { runId: host.runId } : {}),
+        ...(host.cache !== undefined ? { cache: host.cache } : {}),
+        ...(host.durationMs !== undefined ? { durationMs: host.durationMs } : {}),
         peakTier,
         auditedAt: state.now(),
       };
@@ -2242,37 +2741,6 @@ function triggerKindOf(flow: ManifestFlow): "http" | "signal" | "clock" | "inter
   return "internal";
 }
 
-/**
- * Deterministic stub response for Console invoke — echoes the request under
- * `echo` and fills required `out` string fields when declared.
- *
- * @param flow - Manifest flow
- * @param body - Request body
- */
-function stubResponse(flow: ManifestFlow, body: unknown): unknown {
-  const out = flow.out;
-  if (out && typeof out === "object" && !Array.isArray(out)) {
-    const props = (out.properties ?? {}) as Record<string, unknown>;
-    const required = Array.isArray(out.required) ? (out.required as string[]) : Object.keys(props);
-    const result: Record<string, unknown> = { echo: body };
-    for (const key of required) {
-      if (key === "id") result.id = `inv_${hashShort(body)}`;
-      else if (!(key in result)) result[key] = null;
-    }
-    return result;
-  }
-  return { echo: body, ok: true };
-}
-
-function hashShort(value: unknown): string {
-  const text = JSON.stringify(value) ?? "";
-  let h = 0;
-  for (let i = 0; i < text.length; i++) {
-    h = (h * 31 + text.charCodeAt(i)) >>> 0;
-  }
-  return h.toString(16).padStart(8, "0");
-}
-
 async function issueOperatorSession(
   state: ConsoleState,
   operatorId: string,
@@ -2347,6 +2815,14 @@ function createStoreQuery(state: ConsoleState) {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
       if (tenantFail) return tenantFail;
+      if (input.revealPii === true) {
+        fx.log.info("console.store.query.reveal", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          child: input.child,
+          tenant: input.tenant,
+        });
+      }
       return state.queryStore({
         ref: input.ref as ResourceRef,
         child: input.child,
@@ -2354,7 +2830,9 @@ function createStoreQuery(state: ConsoleState) {
         prefix: input.prefix,
         limit: input.limit,
         vector: input.vector,
+        q: input.q,
         topK: input.topK,
+        revealPii: input.revealPii === true,
       });
     },
   });
@@ -2396,6 +2874,42 @@ function createStoreReveal(state: ConsoleState) {
   });
 }
 
+function createStoreObject(state: ConsoleState) {
+  return flow("console.store.object", {
+    plane: "operator",
+    in: StoreFileGetIn,
+    out: StoreFileGetOut,
+    errors: { AuthFailed, TenantRequired, StoreNotFound },
+    do: async (input: z.infer<typeof StoreFileGetIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      const tenantFail = requireTenantIfDeclared(state, input.tenant);
+      if (tenantFail) return tenantFail;
+      try {
+        const result = await state.getStoreFile({
+          ref: input.ref as ResourceRef,
+          key: input.key,
+          tenant: input.tenant,
+        });
+        fx.log.info("console.store.object", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          key: input.key,
+          sizeBytes: result.sizeBytes,
+          tenant: input.tenant,
+        });
+        return result;
+      } catch (err) {
+        if (err instanceof StoreFileNotFoundError) {
+          return fail("StoreNotFound", { ref: `${input.ref}:${input.key}` });
+        }
+        return fail("StoreNotFound", {
+          ref: `${input.ref}: ${err instanceof Error ? err.message : String(err)}`,
+        });
+      }
+    },
+  });
+}
+
 function createStoreEdit(state: ConsoleState) {
   return flow("console.store.edit", {
     plane: "operator",
@@ -2552,14 +3066,36 @@ function createStoreSql(state: ConsoleState) {
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
       if (tenantFail) return tenantFail;
       try {
+        if (input.revealPii === true) {
+          fx.log.info("console.store.sql.reveal", {
+            operatorId: fx.operator.id,
+            ref: input.ref,
+            tenant: input.tenant,
+          });
+        }
+        if (input.asGate !== undefined && !isKnownConsoleSqlGate(state.manifest, input.asGate)) {
+          return fail("StoreNotFound", { ref: `unknown gate: ${input.asGate}` });
+        }
+        if (input.asGate !== undefined) {
+          fx.log.info("console.store.sql.asGate", {
+            operatorId: fx.operator.id,
+            ref: input.ref,
+            gate: input.asGate,
+            tenant: input.tenant,
+          });
+        }
         const result = await state.runStoreSql(input.ref as ResourceRef, input.sql, {
           allowWrite: input.allowWrite === true,
+          revealPii: input.revealPii === true,
           tenant: input.tenant,
+          ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
         });
         fx.log.info("console.store.sql", {
           operatorId: fx.operator.id,
           ref: input.ref,
           allowWrite: input.allowWrite === true,
+          revealPii: input.revealPii === true,
+          asGate: input.asGate ?? null,
           rowCount: result.rows.length,
         });
         return result;
@@ -2572,6 +3108,177 @@ function createStoreSql(state: ConsoleState) {
   });
 }
 
+function failStoreSqlStats(err: unknown) {
+  if (err instanceof StoreSqlStatsError) {
+    if (err.code === PG_STAT_STATEMENTS_NOT_PRELOADED) {
+      return fail("PgStatStatementsNotPreloaded", { reason: err.message });
+    }
+    if (err.code === PG_STAT_STATEMENTS_NOT_CREATED) {
+      return fail("PgStatStatementsNotCreated", { reason: err.message });
+    }
+    return fail("PgStatStatementsUnsupported", { reason: err.message });
+  }
+  return fail("PgStatStatementsUnsupported", {
+    reason: err instanceof Error ? err.message : String(err),
+  });
+}
+
+function createStoreSqlStats(state: ConsoleState) {
+  return flow("console.store.sql.stats", {
+    plane: "operator",
+    in: StoreSqlStatsIn,
+    out: StoreSqlStatsOut,
+    errors: {
+      AuthFailed,
+      TenantRequired,
+      StoreNotFound,
+      PgStatStatementsNotPreloaded,
+      PgStatStatementsUnsupported,
+      PgStatStatementsNotCreated,
+    },
+    do: async (input: z.infer<typeof StoreSqlStatsIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      const tenantFail = requireTenantIfDeclared(state, input.tenant);
+      if (tenantFail) return tenantFail;
+      try {
+        const result = await state.queryStoreSqlStats(input.ref as ResourceRef);
+        fx.log.info("console.store.sql.stats", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          rowCount: result.rowCount,
+        });
+        return result;
+      } catch (err) {
+        return failStoreSqlStats(err);
+      }
+    },
+  });
+}
+
+function createStoreSqlLocks(state: ConsoleState) {
+  return flow("console.store.sql.locks", {
+    plane: "operator",
+    in: StoreSqlLocksIn,
+    out: StoreSqlLocksOut,
+    errors: {
+      AuthFailed,
+      TenantRequired,
+      StoreNotFound,
+      PgStatStatementsNotPreloaded,
+      PgStatStatementsUnsupported,
+      PgStatStatementsNotCreated,
+    },
+    do: async (input: z.infer<typeof StoreSqlLocksIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      const tenantFail = requireTenantIfDeclared(state, input.tenant);
+      if (tenantFail) return tenantFail;
+      if (input.revealPii === true) {
+        fx.log.info("console.store.sql.stats.reveal", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          tenant: input.tenant,
+        });
+      }
+      try {
+        const result = await state.queryStoreSqlLocks(input.ref as ResourceRef, {
+          revealPii: input.revealPii === true,
+        });
+        fx.log.info("console.store.sql.locks", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          revealPii: input.revealPii === true,
+          rowCount: result.rows.length,
+        });
+        return result;
+      } catch (err) {
+        return failStoreSqlStats(err);
+      }
+    },
+  });
+}
+
+function createStoreSqlAdvise(state: ConsoleState) {
+  return flow("console.store.sql.advise", {
+    plane: "operator",
+    in: StoreSqlAdviseIn,
+    out: StoreSqlAdviseOut,
+    errors: {
+      AuthFailed,
+      TenantRequired,
+      StoreNotFound,
+      PgStatStatementsNotPreloaded,
+      PgStatStatementsUnsupported,
+      PgStatStatementsNotCreated,
+    },
+    do: async (input: z.infer<typeof StoreSqlAdviseIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      const tenantFail = requireTenantIfDeclared(state, input.tenant);
+      if (tenantFail) return tenantFail;
+      try {
+        const result = await state.adviseStoreSqlIndex(input.ref as ResourceRef, input.query);
+        fx.log.info("console.store.sql.advise", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          suggestionCount: result.indexStatements.length,
+        });
+        return result;
+      } catch (err) {
+        return failStoreSqlStats(err);
+      }
+    },
+  });
+}
+
+function failStoreKvStats(err: unknown) {
+  if (err instanceof StoreKvStatsError) {
+    return fail("KvStatsUnsupported", { reason: err.message });
+  }
+  return fail("KvStatsUnsupported", {
+    reason: err instanceof Error ? err.message : String(err),
+  });
+}
+
+function createStoreKvStats(state: ConsoleState) {
+  return flow("console.store.kv.stats", {
+    plane: "operator",
+    in: StoreKvStatsIn,
+    out: StoreKvStatsOut,
+    errors: {
+      AuthFailed,
+      TenantRequired,
+      StoreNotFound,
+      KvStatsUnsupported,
+    },
+    do: async (input: z.infer<typeof StoreKvStatsIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      const tenantFail = requireTenantIfDeclared(state, input.tenant);
+      if (tenantFail) return tenantFail;
+      if (input.revealPii === true) {
+        fx.log.info("console.store.kv.stats.reveal", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          tenant: input.tenant,
+        });
+      }
+      try {
+        const result = await state.queryStoreKvStats(input.ref as ResourceRef, {
+          revealPii: input.revealPii === true,
+        });
+        fx.log.info("console.store.kv.stats", {
+          operatorId: fx.operator.id,
+          ref: input.ref,
+          revealPii: input.revealPii === true,
+          engine: result.engine,
+          slowlogCount: result.slowlog.length,
+        });
+        return result;
+      } catch (err) {
+        return failStoreKvStats(err);
+      }
+    },
+  });
+}
+
 function createStorePreview(state: ConsoleState) {
   return flow("console.store.preview", {
     plane: "operator",
@@ -2634,25 +3341,56 @@ function createVaultList(state: ConsoleState) {
   });
 }
 
+function createVaultCreate(state: ConsoleState) {
+  return flow("console.vault.create", {
+    plane: "operator",
+    in: VaultCreateIn,
+    out: VaultWriteOut,
+    errors: { AuthFailed, VaultExists, VaultNotFound },
+    do: async (input: z.infer<typeof VaultCreateIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      try {
+        const result = await state.createVault({
+          name: input.name,
+          value: input.value,
+          kind: input.kind,
+          ...(input.description !== undefined ? { description: input.description } : {}),
+          ...(input.rotate !== undefined ? { rotate: input.rotate } : {}),
+        });
+        fx.log.info("console.vault.create", {
+          operatorId: fx.operator.id,
+          name: result.name,
+          kind: input.kind,
+          fingerprint: result.fingerprint,
+        });
+        return {
+          ok: true as const,
+          name: result.name,
+          fingerprint: result.fingerprint,
+          at: state.now(),
+        };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("already declared")) {
+          return fail("VaultExists", { name: input.name });
+        }
+        return fail("VaultNotFound", { name: `${input.name}: ${message}` });
+      }
+    },
+  });
+}
+
 function createVaultSet(state: ConsoleState) {
   return flow("console.vault.set", {
     plane: "operator",
     in: VaultWriteIn,
     out: VaultWriteOut,
-    errors: { AuthFailed, VaultNotFound, ConfirmRequired },
+    errors: { AuthFailed, VaultNotFound },
     do: async (input: z.infer<typeof VaultWriteIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (!(await vaultNameKnown(state, input.name))) {
         return fail("VaultNotFound", { name: input.name });
       }
-      if (state.production) {
-        if (input.confirmation !== "SET" || !input.reason || input.reason.length < 3) {
-          return fail("ConfirmRequired", {
-            phrase: "SET" as const,
-            reason: "Type SET and provide a reason to write a secret in production",
-          });
-        }
-      }
       try {
         const result = await state.setVault({
           name: input.name,
@@ -2673,7 +3411,8 @@ function createVaultSet(state: ConsoleState) {
         };
       } catch (err) {
         return fail("VaultNotFound", {
-          name: `${input.name}: ${err instanceof Error ? err.message : String(err)}`,
+          name: input.name,
+          reason: err instanceof Error ? err.message : String(err),
         });
       }
     },
@@ -2685,20 +3424,12 @@ function createVaultRotate(state: ConsoleState) {
     plane: "operator",
     in: VaultWriteIn,
     out: VaultWriteOut,
-    errors: { AuthFailed, VaultNotFound, ConfirmRequired },
+    errors: { AuthFailed, VaultNotFound },
     do: async (input: z.infer<typeof VaultWriteIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (!(await vaultNameKnown(state, input.name))) {
         return fail("VaultNotFound", { name: input.name });
       }
-      // Rotate always requires typed confirm (console §6 · §9.8).
-      if (input.confirmation !== "ROTATE" || !input.reason || input.reason.length < 3) {
-        return fail("ConfirmRequired", {
-          phrase: "ROTATE" as const,
-          reason:
-            "Type ROTATE and provide a reason — in-flight durable runs may wake holding the new key",
-        });
-      }
       try {
         const result = await state.rotateVault({
           name: input.name,
@@ -2718,7 +3449,8 @@ function createVaultRotate(state: ConsoleState) {
         };
       } catch (err) {
         return fail("VaultNotFound", {
-          name: `${input.name}: ${err instanceof Error ? err.message : String(err)}`,
+          name: input.name,
+          reason: err instanceof Error ? err.message : String(err),
         });
       }
     },
@@ -2731,10 +3463,83 @@ function createVaultRotate(state: ConsoleState) {
  * @param state - Console state
  * @param name - Contract name
  */
+function createVaultRotateMaster(state: ConsoleState) {
+  return flow("console.vault.rotateMaster", {
+    plane: "operator",
+    in: VaultRotateMasterIn,
+    out: VaultRotateMasterOut,
+    errors: { AuthFailed, ConfirmRequired, VaultSealed, VaultRotateBusy, VaultUnsupported },
+    do: async (input: z.infer<typeof VaultRotateMasterIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      if (input.confirmation !== "ROTATE_MASTER" || !input.reason || input.reason.length < 3) {
+        return fail("ConfirmRequired", {
+          phrase: "ROTATE_MASTER" as const,
+          reason:
+            "Type ROTATE_MASTER and provide a reason — both master keys stay live until remaining is 0",
+        });
+      }
+      try {
+        const result = await state.rotateMaster();
+        fx.log.info("console.vault.rotateMaster", {
+          operatorId: fx.operator.id,
+          kekVersion: result.kekVersion,
+          remaining: result.remaining,
+          reason: input.reason,
+        });
+        return {
+          ok: true as const,
+          kekVersion: result.kekVersion,
+          remaining: result.remaining,
+          masterKey: result.masterKey,
+          at: state.now(),
+        };
+      } catch (err) {
+        return mapVaultOperatorError(err);
+      }
+    },
+  });
+}
+
+function createVaultAuditVerify(state: ConsoleState) {
+  return flow("console.vault.auditVerify", {
+    plane: "operator",
+    out: VaultAuditVerifyOut,
+    errors: { AuthFailed, VaultUnsupported },
+    do: async (_input, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      try {
+        const result = await state.verifyVaultAudit();
+        fx.log.info("console.vault.audit.verify", {
+          operatorId: fx.operator.id,
+          ok: result.ok,
+          brokenAt: result.brokenAt,
+        });
+        return result;
+      } catch (err) {
+        return mapVaultOperatorError(err);
+      }
+    },
+  });
+}
+
+/**
+ * Map Console vault errors onto typed flow failures.
+ *
+ * @param err - Caught error
+ */
+function mapVaultOperatorError(err: unknown) {
+  const code =
+    err && typeof err === "object" && "code" in err ? (err as { code: string }).code : undefined;
+  const reason = err instanceof Error ? err.message : String(err);
+  if (code === "VaultSealed") return fail("VaultSealed", { reason });
+  if (code === "VaultRotateBusy") return fail("VaultRotateBusy", { reason });
+  if (code === "VaultUnsupported") return fail("VaultUnsupported", { reason });
+  return fail("VaultUnsupported", { reason });
+}
+
 async function vaultNameKnown(state: ConsoleState, name: string): Promise<boolean> {
   if (state.manifest?.vault?.[name]) return true;
   if (state.vaultRuntime?.contracts.has(name)) return true;
-  if (state.vaultRuntime?.names().includes(name)) return true;
   const listed = await state.listVault();
   return listed.secrets.some((s) => s.name === name);
 }
@@ -3159,6 +3964,18 @@ function createClockList(state: ConsoleState) {
   });
 }
 
+function createInstancesList(state: ConsoleState) {
+  return flow("console.instances.list", {
+    plane: "operator",
+    out: InstancesListOut,
+    errors: { AuthFailed },
+    do: async (_input, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      return state.listInstances();
+    },
+  });
+}
+
 function createClockRunNow(state: ConsoleState) {
   return flow("console.clock.runNow", {
     plane: "operator",