@intentius/chant 0.18.8 → 0.18.11

package/dist/cli/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AASnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAsP9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AASnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAkR9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}

package/dist/cli/handlers/lifecycle.d.ts

@@ -7,6 +7,14 @@ export declare function runLifecycleSnapshot(ctx: CommandContext): Promise<numbe
  * chant lifecycle show <environment> [lexicon]
  */
 export declare function runLifecycleShow(ctx: CommandContext): Promise<number>;
+/**
+ * chant lifecycle rollback [<environment>] --to <ref>
+ *
+ * Open a PR restoring `sourceDir` to a prior git revision (#873). Source-level,
+ * reviewable, no cloud mutation — a human merges, then a gated apply rolls the
+ * env back. The `<env>` positional is PR context.
+ */
+export declare function runLifecycleRollback(ctx: CommandContext): Promise<number>;
 /**
  * chant lifecycle diff <environment> [lexicon]
  */

package/dist/cli/handlers/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAoBlD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoC3E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C3E;AAuTD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6G3E;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAoBlD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoC3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C3E;AA6TD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6G3E;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E"}

package/dist/cli/handlers/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA0ClD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM;;;;GAO5F;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEpE;AAoFD,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCtE;AA0CD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CnE;AA2DD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBtE;AAID,2LAA2L;AAC3L,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BtE;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAchE;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+D1E;AA4ND;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiFrE;AA4KD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA0ClD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM;;;;GAO5F;AA8BD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEpE;AAoFD,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCtE;AA0CD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CnE;AA2DD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBtE;AAID,2LAA2L;AAC3L,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BtE;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAchE;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+D1E;AAkOD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiFrE;AAuLD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}

package/dist/lifecycle/rollback.d.ts

@@ -0,0 +1,23 @@
+/** Branch name for a rollback PR. Pure. */
+export declare function rollbackBranchName(env: string | undefined, shortRef: string): string;
+/** PR title for a rollback. Pure. */
+export declare function rollbackTitle(env: string | undefined, ref: string): string;
+/** PR body — explains that merging + applying completes the rollback. Pure. */
+export declare function rollbackBody(env: string | undefined, ref: string, sourceDir: string): string;
+export interface RollbackResult {
+    /** true when the source already matched the ref — nothing to roll back. */
+    noop: boolean;
+    branch?: string;
+    prUrl?: string;
+}
+/**
+ * Open a rollback PR restoring `sourceDir` to `ref`. Isolated worktree; the
+ * caller's branch is untouched. Throws on an unknown ref or a git/gh failure.
+ */
+export declare function rollbackToRevision(opts: {
+    ref: string;
+    env: string | undefined;
+    sourceDir: string;
+    cwd: string;
+}): Promise<RollbackResult>;
+//# sourceMappingURL=rollback.d.ts.map

package/dist/lifecycle/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/lifecycle/rollback.ts"],"names":[],"mappings":"AAiBA,2CAA2C;AAC3C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAO5F;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CA6B1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.18.8",
+  "version": "0.18.11",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/build.test.ts

@@ -201,6 +201,39 @@ export const testEntity = {
     expect(existsSync(join(testDir, "dist", "ops", "alb-deploy", "worker.ts"))).toBe(true);
   });
 
+  test("op worker files go to <project>/dist/ops even with no --output (#878)", async () => {
+    // The generated Op worker must land where `chant run <op> --temporal` reads it
+    // (`<project>/dist/ops/<name>/worker.ts`) even when the build has no --output
+    // (a Temporal Op project often has no primary resource manifest to route).
+    const opSerializer: Serializer = {
+      name: "multi",
+      rulePrefix: "MULTI",
+      serialize: () => ({
+        primary: "{}",
+        files: {
+          "ops/durable-hello/workflow.ts": "// workflow\n",
+          "ops/durable-hello/worker.ts": "// worker\n",
+          "ops/durable-hello/activities.ts": "// activities\n",
+        },
+      }),
+    };
+    await writeFile(
+      join(testDir, "infra.ts"),
+      `export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexicon: "multi", kind: "resource", props: {}, attributes: {} };`,
+    );
+
+    const result = await buildCommand({
+      path: testDir,
+      format: "json",
+      serializers: [opSerializer],
+      // no `output`
+    } as BuildOptions);
+
+    expect(result.errors).toEqual([]);
+    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "worker.ts"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "workflow.ts"))).toBe(true);
+  });
+
   // ── #284 bug 2: array-of-objects must serialize to valid YAML ──────────
   test("yaml format serializes an array of objects to valid, round-trippable YAML", async () => {
     // A serializer that emits a CloudFormation-shaped template with a tag list.

package/src/cli/commands/build.ts

@@ -264,6 +264,34 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
       }
     }
 
+    // Op worker artifacts (`ops/<name>/{workflow,worker,activities}.ts`) always
+    // go to `<project>/dist/ops/` — the fixed location `chant run <op> --temporal`
+    // reads (`join(projectPath, "dist", "ops", ...)`) — independent of `--output`,
+    // which routes the primary resource manifest. Without this, a bare `chant build`
+    // only printed them to stderr and `--output foo.yaml` scattered them next to
+    // `foo.yaml`, so the durable-run worker was never where `run --temporal` looks.
+    const projectDist = resolve(options.path ?? ".", "dist");
+    let opsWritten = 0;
+    for (const [filename, content] of [...additionalFiles]) {
+      if (!filename.startsWith("ops/")) continue;
+      additionalFiles.delete(filename);
+      try {
+        const targetPath = join(projectDist, filename);
+        mkdirSync(dirname(targetPath), { recursive: true });
+        writeFileSync(targetPath, content);
+        opsWritten += 1;
+      } catch (err) {
+        errors.push(
+          formatError({
+            message: `Failed to write Op worker file ${filename}: ${err instanceof Error ? err.message : String(err)}`,
+          }),
+        );
+      }
+    }
+    if (opsWritten > 0) {
+      console.error(formatInfo(`Wrote ${opsWritten} Op worker file(s) under ${join(options.path ?? ".", "dist", "ops")}/`));
+    }
+
     if (options.output) {
       // Write to file — ensure parent directories exist for both the primary
       // output path and any nested additional-file paths (e.g. ops/<name>/...).

package/src/cli/handlers/lifecycle.ts

@@ -6,6 +6,7 @@ import { computeBuildDigest, diffDigests } from "../../lifecycle/digest";
 import { diffLive, diffLiveArtifacts, diffSnapshots, type LiveDiffResult, type LiveArtifactDiffResult, type SnapshotDiffResult } from "../../lifecycle/live-diff";
 import { buildChangeSet, renderChangeSet, gitlabMrReport, type ChangeSet } from "../../lifecycle/change-set";
 import { affectedStacks } from "../../lifecycle/affected";
+import { rollbackToRevision } from "../../lifecycle/rollback";
 import { loadChantConfig } from "../../config";
 import { formatError, formatWarning, formatSuccess, formatBold } from "../format";
 import type { CommandContext } from "../registry";
@@ -146,6 +147,38 @@ export async function runLifecycleShow(ctx: CommandContext): Promise<number> {
   return 0;
 }
 
+/**
+ * chant lifecycle rollback [<environment>] --to <ref>
+ *
+ * Open a PR restoring `sourceDir` to a prior git revision (#873). Source-level,
+ * reviewable, no cloud mutation — a human merges, then a gated apply rolls the
+ * env back. The `<env>` positional is PR context.
+ */
+export async function runLifecycleRollback(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+  const environment = args.extraPositional; // optional — PR context/title
+  const ref = args.migrateTo; // the --to value
+  if (!ref) {
+    console.error(formatError({ message: "Target revision required: chant lifecycle rollback [<env>] --to <ref>" }));
+    return 1;
+  }
+  const { config } = await loadChantConfig(resolve("."));
+  const sourceDir = config.sourceDir ?? ".";
+  try {
+    const result = await rollbackToRevision({ ref, env: environment, sourceDir, cwd: resolve(".") });
+    if (result.noop) {
+      console.error(formatSuccess(`${sourceDir} already matches ${ref} — nothing to roll back`));
+      return 0;
+    }
+    console.log(result.prUrl); // the PR URL — the consumer (behold) reads this from stdout
+    console.error(formatSuccess(`Opened rollback PR on ${result.branch}`));
+    return 0;
+  } catch (err) {
+    console.error(formatError({ message: `rollback failed — ${err instanceof Error ? err.message : String(err)}` }));
+    return 1;
+  }
+}
+
 /**
  * chant lifecycle diff <environment> [lexicon]
  */
@@ -317,7 +350,10 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<number> {
   let totalLexiconsChecked = 0;
   // Collected per-lexicon results, emitted as one JSON object when --json is set
   // (parsed by programmatic consumers, e.g. behold's inspect diff — #852).
-  const byLexicon: Record<string, { resources?: LiveDiffResult; artifacts?: LiveArtifactDiffResult }> = {};
+  const byLexicon: Record<
+    string,
+    { resources?: LiveDiffResult; observed?: Record<string, ResourceMetadata>; artifacts?: LiveArtifactDiffResult }
+  > = {};
 
   for (const lexiconName of args.lexicons) {
     const plugin = args.plugins.find((p) => p.name === lexiconName);
@@ -379,8 +415,11 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<number> {
       const observedThen = prevSnapshot?.resources;
       const diff = diffLive({ declared, observedNow, observedThen });
       totalDrift += diff.driftedSinceSnapshot.length + diff.missing.length + diff.orphan.length + diff.disappeared.length;
-      if (args.json) (byLexicon[lexiconName] ??= {}).resources = diff;
-      else renderLiveDiff(lexiconName, args.environment, diff);
+      if (args.json) {
+        const entry = (byLexicon[lexiconName] ??= {});
+        entry.resources = diff;
+        entry.observed = observedNow; // live state (#862) — status/attributes per resource
+      } else renderLiveDiff(lexiconName, args.environment, diff);
       lexiconChecked = true;
     }
 

package/src/cli/handlers/run.ts

@@ -59,6 +59,32 @@ export async function makeTemporalClient(profileName: string | undefined, projec
   return { client, profile, config };
 }
 
+/**
+ * Register the Keyword search attributes the generated workflow upserts
+ * (`OpName`, `Phase`, plus any op-declared) on the namespace, so the first
+ * workflow task does not fail with `BadSearchAttributes`. Registered one at a
+ * time so an already-present attribute (`ALREADY_EXISTS`) does not block the
+ * rest. Only used for the autoStart dev server — a real server (autoStart=false)
+ * is expected to have these pre-registered (it may reject registration).
+ */
+async function ensureSearchAttributes(client: unknown, namespace: string, names: string[]): Promise<void> {
+  const operatorService = (
+    client as { connection?: { operatorService?: { addSearchAttributes?: (r: unknown) => Promise<unknown> } } }
+  ).connection?.operatorService;
+  if (!operatorService?.addSearchAttributes) return;
+  const KEYWORD = 2; // Temporal IndexedValueType KEYWORD
+  for (const name of names) {
+    try {
+      await operatorService.addSearchAttributes({ namespace, searchAttributes: { [name]: KEYWORD } });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (!/already|exists/i.test(msg)) {
+        console.error(formatWarning({ message: `Could not register search attribute "${name}": ${msg}` }));
+      }
+    }
+  }
+}
+
 // ── chant run list ──────────────────────────────────���─────────────────────────
 
 export async function runOpList(ctx: CommandContext): Promise<number> {
@@ -803,6 +829,12 @@ async function runComponentTemporal(ctx: CommandContext, selector: string): Prom
     return 1;
   }
 
+  // Register the search attributes the generated component workflow upserts
+  // (ComponentName/Phase) on the autoStart dev server (mirrors runOpTemporal).
+  if (profile.autoStart) {
+    await ensureSearchAttributes(client, profile.namespace, ["ComponentName", "Phase"]);
+  }
+
   const profileName = ctx.args.profile ??
     (((chantConfig as Record<string, unknown>).temporal as Record<string, unknown> | undefined)?.defaultProfile as string | undefined) ??
     "local";
@@ -1098,6 +1130,17 @@ async function runOpTemporal(ctx: CommandContext): Promise<number> {
     return 1;
   }
 
+  // On the autoStart dev server, register the search attributes the generated
+  // workflow upserts (OpName/Phase + any op-declared) so the first workflow task
+  // does not fail with BadSearchAttributes.
+  if (profile.autoStart) {
+    await ensureSearchAttributes(client, profile.namespace, [
+      "OpName",
+      "Phase",
+      ...Object.keys((config as { searchAttributes?: Record<string, string> }).searchAttributes ?? {}),
+    ]);
+  }
+
   // Spawn worker process
   const profileName = ctx.args.profile ??
     (((chantConfig as Record<string, unknown>).temporal as Record<string, unknown> | undefined)?.defaultProfile as string | undefined) ??

package/src/cli/main.ts

@@ -16,7 +16,7 @@ import { runInit, runInitLexicon } from "./handlers/init";
 import { runList, runDescribe, runImport, runAudit, runUpdate, runDoctor } from "./handlers/misc";
 import { runVendor } from "./handlers/vendor";
 import { runMigrate } from "./handlers/migrate";
-import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleUnknown } from "./handlers/lifecycle";
+import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleUnknown } from "./handlers/lifecycle";
 import { runComponentsStatus, runComponentsReleaseRecord, runComponentsUnknown } from "./handlers/components";
 import { runGraph } from "./handlers/graph";
 import { runOp, runOpList, runOpStatus, runOpSignal, runOpCancel, runOpLog } from "./handlers/run";
@@ -445,6 +445,7 @@ const registry: CommandDef[] = [
   { name: "lifecycle snapshot", requiresPlugins: true, handler: runLifecycleSnapshot },
   { name: "lifecycle show", handler: runLifecycleShow },
   { name: "lifecycle diff", requiresPlugins: true, handler: runLifecycleDiff },
+  { name: "lifecycle rollback", handler: runLifecycleRollback },
   { name: "lifecycle plan", requiresPlugins: true, handler: runLifecyclePlan },
   { name: "lifecycle affected", requiresPlugins: true, handler: runLifecycleAffected },
   { name: "lifecycle log", handler: runLifecycleLog },

package/src/lifecycle/rollback.test.ts

@@ -0,0 +1,25 @@
+import { describe, test, expect } from "vitest";
+import { rollbackBranchName, rollbackTitle, rollbackBody } from "./rollback";
+
+describe("rollback helpers (#873)", () => {
+  test("branch name includes env and short ref", () => {
+    expect(rollbackBranchName("prod", "a1b2c3d")).toBe("chant/rollback-prod-a1b2c3d");
+  });
+
+  test("branch name falls back to 'src' when env is absent", () => {
+    expect(rollbackBranchName(undefined, "a1b2c3d")).toBe("chant/rollback-src-a1b2c3d");
+  });
+
+  test("title names the env and ref", () => {
+    expect(rollbackTitle("prod", "v1.2.0")).toBe("rollback prod source to v1.2.0");
+    expect(rollbackTitle(undefined, "v1.2.0")).toBe("rollback source to v1.2.0");
+  });
+
+  test("body references the sourceDir, ref, and the gated-apply step", () => {
+    const body = rollbackBody("prod", "abc123", "src");
+    expect(body).toContain("`src`");
+    expect(body).toContain("`abc123`");
+    expect(body).toContain("the prod environment");
+    expect(body).toMatch(/approval gate|Sync|apply/i);
+  });
+});

package/src/lifecycle/rollback.ts

@@ -0,0 +1,83 @@
+/**
+ * lifecycle rollback (#873) — open a PR that restores the source to a prior git
+ * revision. Rollback = make an env match a past state of the declared source; the
+ * PR's diff *is* the rollback delta. No cloud mutation here — a human merges, then
+ * the existing gated apply rolls the env back.
+ *
+ * Runs entirely in an isolated `git worktree` (like {@link ./affected}), so the
+ * caller's working branch/tree is never touched — important because the consumer
+ * (behold) serves a live checkout.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const execFileAsync = promisify(execFile);
+
+/** Branch name for a rollback PR. Pure. */
+export function rollbackBranchName(env: string | undefined, shortRef: string): string {
+  return `chant/rollback-${env ?? "src"}-${shortRef}`;
+}
+
+/** PR title for a rollback. Pure. */
+export function rollbackTitle(env: string | undefined, ref: string): string {
+  return `rollback ${env ? env + " " : ""}source to ${ref}`;
+}
+
+/** PR body — explains that merging + applying completes the rollback. Pure. */
+export function rollbackBody(env: string | undefined, ref: string, sourceDir: string): string {
+  const target = env ? `the ${env} environment` : "the environment";
+  return (
+    `Restores \`${sourceDir}\` to its state at \`${ref}\`.\n\n` +
+    `The diff below is the rollback delta. Merge this PR, then apply (Sync) to roll ${target} back — ` +
+    `a destructive apply still passes through its approval gate. No cloud change was made by opening this PR.`
+  );
+}
+
+export interface RollbackResult {
+  /** true when the source already matched the ref — nothing to roll back. */
+  noop: boolean;
+  branch?: string;
+  prUrl?: string;
+}
+
+/**
+ * Open a rollback PR restoring `sourceDir` to `ref`. Isolated worktree; the
+ * caller's branch is untouched. Throws on an unknown ref or a git/gh failure.
+ */
+export async function rollbackToRevision(opts: {
+  ref: string;
+  env: string | undefined;
+  sourceDir: string;
+  cwd: string;
+}): Promise<RollbackResult> {
+  const { ref, env, sourceDir, cwd } = opts;
+  const git = (args: string[], wd: string): Promise<{ stdout: string }> => execFileAsync("git", args, { cwd: wd });
+
+  const repoRoot = (await git(["rev-parse", "--show-toplevel"], cwd)).stdout.trim();
+  // Verify the ref resolves to a commit (throws with a clear message otherwise).
+  await execFileAsync("git", ["rev-parse", "--verify", `${ref}^{commit}`], { cwd: repoRoot });
+  const shortRef = (await git(["rev-parse", "--short", ref], repoRoot)).stdout.trim();
+  const branch = rollbackBranchName(env, shortRef);
+  const wt = join(tmpdir(), `chant-rollback-${shortRef}-${process.pid}`);
+
+  await git(["worktree", "add", wt, "-b", branch, "HEAD"], repoRoot);
+  try {
+    // Restore just the source tree to the target revision (stages the changes).
+    await git(["checkout", ref, "--", sourceDir], wt);
+    const staged = (await git(["status", "--porcelain", "--", sourceDir], wt)).stdout.trim();
+    if (!staged) return { noop: true };
+
+    await git(["commit", "-m", rollbackTitle(env, ref)], wt);
+    await git(["push", "-u", "origin", branch], wt);
+    const { stdout } = await execFileAsync(
+      "gh",
+      ["pr", "create", "--title", rollbackTitle(env, ref), "--body", rollbackBody(env, ref, sourceDir), "--head", branch],
+      { cwd: wt },
+    );
+    return { noop: false, branch, prUrl: stdout.trim() };
+  } finally {
+    await git(["worktree", "remove", "--force", wt], repoRoot).catch(() => {});
+  }
+}