# 4. cp9 purge keeps a minimal public API

Status: Accepted

## Context

Manual workflow dispatch and CLI invocation should expose cleanup *intent*, not
dangerous runtime mechanics. If the account id or cleanup role were ordinary
public args, a caller could accidentally point destructive cleanup at the wrong
account.

## Decision

`cp9 purge` exposes only cleanup-intent public args:

- `dry-run`
- `region`
- optional paired `owner` / `session`

The account id, cleanup role ARN, aws-nuke binary path, max seconds, poll
interval, retry sleep, and aws-nuke wait retries are operator/environment
configuration (`CP9_CLEANUP_*`, `CP9_AWS_NUKE_BIN`), not ordinary public args.
There is no short alias for `purge`.

Mode is inferred from inputs: neither owner nor session is broad expired mode;
both is exact mode; exactly one fails fast (see ADR 0006 for exact-mode TTL).

## Consequences

- Ordinary callers cannot change the cleanup account by passing an argument.
- The command surface reads as intent ("purge these expired/exact resources").
- Operators still control account/role/timeouts through the environment.