The zipline command reference

Redeem an operator enroll token for an operator client cert. Cache-first and idempotent; fails if the cached cert is not an operator cert (OU ≠ operator).

Show the current operator certificate identity. Reads the cached cert (common name, OU, expiry, cert dir) - no control-plane round-trip.

List context profiles (* marks the current).

Select the current context.

Set a field - runtime_address, operator_cert_dir, or output - on the current context.

Show the current context.

Records the runtime address and cert dir in a named context, sets it current, and - if a token is supplied - enrolls into the same cert dir.

Apply a pipeline spec (YAML via -f or stdin).

Dry-run a pipeline spec and print the diff (YAML via -f or stdin) - route changes, source-restart flag, commit-mode change.

Print a pipeline spec as YAML.

List pipelines (name, state, bound instance).

Print a pipeline's status (state, instance, incidents) plus a per-slot table (role, route, state, placement, profile).

Delete a pipeline.

Bind an instance id to a pipeline (source) or a sink slot (--route).

Clear the binding for a pipeline (or a single sink slot with --route; the route stays in the spec and is re-bindable).

Disable a sink route (in-proc or external): detach + release floor, keep binding, re-enablable.

Enable a previously-disabled sink route (attach from-now).

Pause a sink route (--route) or the source (no --route): HOLD; resume keeps the cursor (no gap).

Resume a paused sink route (--route) or the source (no --route).

Accept the loss of a corrupt frame on a stalled route. Give a route, or --all (mutually exclusive).

Add a route to a pipeline (read-modify-write over apply).

Remove a route from a pipeline (read-modify-write over apply).

Set a pipeline's commit mode (read-modify-write over apply).

List runtime instances (instance, display, role, bound). Role is source or sink; bound shows the pipeline or (unbound).

Store a secret value under a ref. The value is positional (never lands in flag history), crosses mTLS, and is never printed back.

List stored secret refs (names only, never values).

Remove a secret by ref.

Create or update a connector profile from a YAML file.

List stored connector profiles (name + type).

Get a connector profile by name (prints YAML).

Remove a connector profile by name.

Package the in-binary descriptor for a type into a .zcp. Reflects the in-binary registry; no daemon needed.

Pretty-print the in-binary descriptor + ConfigSchema for a type.

Print this binary's connector baseline (wire protocol + built-ins: file, kafka, mssql, postgres).

Static-eval a .zcp on the runtime and persist its descriptor. The CLI never loads or compiles the connector.

List the runtime catalog (built-ins ∪ added) - type, direction, version.

Fetch + pretty-print one catalog descriptor by type (the remote twin of describe).

Run the G7 conformance suite for a type in a subprocess and optionally record it on the runtime.

connector __conformance-child is an internal hidden subprocess re-invoked by connector test - not meant to be called directly.

Mint a single-use enroll token for a handle. The handle class determines the OU the CA stamps.

List all enroll-token handles known to the CA (handle, expires_at, used, outstanding).

Burn an enroll-token handle (marks it Used; idempotent).

Open the live operator cockpit: six screens over the control plane covering throughput, pipelines, topology, instances, incidents, and a log tail. Takes no arguments. Running zipline with no subcommand on an interactive terminal opens it too. Full walkthrough.

Aggregate pipeline + instance overview in a single dial - a summary line, a pipelines table, and an instances table.

Print the zipline version (stamped at build).