@pipefy/pipefy-process-coder 0.1.0

package/src/commands/apply.ts

@@ -0,0 +1,1144 @@
+import { createInterface } from 'node:readline/promises';
+import { loadReference } from '../workspace/reference.ts';
+import { bool, str, type Parsed } from '../cli/args.ts';
+import { writeJson } from '../util/fsx.ts';
+import { basename, resolve } from 'node:path';
+import { UserError, bold, debug, dim, green, info, ok, out, red, stripAnsi, warn, yellow } from '../util/log.ts';
+import { readTree } from '../workspace/read.ts';
+ import { writeTree } from '../workspace/write.ts';
+ import { unpack } from '../codec/unpack.ts';
+ import { packEnvelope } from '../codec/pack.ts';
+ import { upsertRepo, writeLock } from '../workspace/lock.ts';
+import { renderStamp, stampCreated } from '../workspace/stamp.ts';
+import { adoptCreatedIds, mergeAdoptedIntoBaseline, renderAdopted } from '../apply/adopt.ts';
+import { baselineFile, planFile, planFileFor, findPlanFile } from '../workspace/layout.ts';
+import { diffTrees } from '../diff/diff.ts';
+import { compile } from '../apply/compile.ts';
+import { readAutomationCatalogue } from '../pipefy/automations.ts';
+import { execute } from '../apply/execute.ts';
+import type { Plan, PlanOptions } from '../apply/types.ts';
+import { validateTree, blockingErrors } from '../validate/index.ts';
+import { connect, openWorkspace, resolveWorkspace } from './context.ts';
+import { checkGit } from '../util/git.ts';
+import { loadBaseline, loadBaselineEnvelope, refFor } from './diff.ts';
+import { loadPlan, renderPlan, warnUnverifiedSteps } from './plan.ts';
+import { verifyRepo } from './verify.ts';
+import { restoreToVersion } from './misc.ts';
+import { RunRecorder, invocation, type RunOutcome } from '../report/run.ts';
+import {
+  applyFlows,
+  diffFlowsAgainstLive,
+  planFlowRevert,
+  planFlows,
+  renderFlowPlan,
+  reportDatapillDrift,
+  verifyFlowDatapills,
+} from './flows.ts';
+import type { FlowPlan } from '../apply/flowops.ts';
+import type { FlowsSection } from '../workspace/flows.ts';
+import type { AgentPlan } from '../apply/agentops.ts';
+import type { AgentsSection } from '../workspace/agents.ts';
+import type { Capabilities } from '../pipefy/capability.ts';
+
+/**
+ * What each half of an apply did, for the *one* revert offer at the end.
+ *
+ * `pipe apply` used to offer three unrelated rollbacks — pipe structure via
+ * `pipe rollback`'s snapshot, flows via their own reverse plan, and nothing
+ * at all for agents — surfaced as separate prompts at separate moments. That
+ * is not how a user experiences "the apply": it is one action, and if any
+ * part of it fails partway, the honest question is "revert everything this
+ * apply changed", once, with the details of what that actually means for
+ * each part that touched anything. `offerUnifiedRevert` is that one prompt;
+ * these three shapes are what each half reports about itself so it can be
+ * asked.
+ */
+type PipeHalfOutcome = {
+  attempted: boolean;
+  doneCount: number;
+  preApplyVersionId: string | null;
+};
+type FlowHalfOutcome = { attempted: boolean; failed: boolean; doneCount: number; before: FlowsSection | null };
+type AgentHalfOutcome = { attempted: boolean; failed: boolean; doneCount: number; before: AgentsSection | null };
+
+const NOT_ATTEMPTED_FLOW: FlowHalfOutcome = { attempted: false, failed: false, doneCount: 0, before: null };
+const NOT_ATTEMPTED_AGENT: AgentHalfOutcome = { attempted: false, failed: false, doneCount: 0, before: null };
+
+export const help = `pipe apply [workspace] [options]
+
+  --repo <id>            apply only this repo (default: every repo in the workspace)
+  --exclude <id,...>     apply every repo except these (id, api id, or name)
+  --plan <id>            apply a saved plan instead of recompiling
+  --resume <id>          resume a plan that failed partway
+  --yes                  do not ask for confirmation
+  --dry-run              walk the plan without sending anything
+  --continue-on-error    keep going after a failed step
+  --no-verify            skip the post-apply comparison entirely
+  --post-snapshot        take a fresh snapshot after applying, for a full live
+                         read-back verify and adopt (asked about otherwise;
+                         default no — it also spends the pre-apply rollback
+                         snapshot's restorability, see \`pipe rollback\`)
+  --no-pre-snapshot      do not snapshot before applying (not recommended)
+  --automation-recreate  delete+create automations instead of updating them in place
+  --allow-card-moves     permit phase deletes
+  --force                apply the supported changes even if others are blocked
+  --report               write a run report into runs/ (payload copy included)
+  --no-flows             do not apply iPaaS flow changes
+  --allow-flow-enable    permit enabling a flow (arms it against live traffic)`;
+
+/**
+ * `pipe apply` — PLAN.md §5, steps 5 to 7.
+ *
+ *   snapshot prod, labelled pre-apply/<ts>  ->  execute step by step, persisting
+ *   status so a failure is resumable  ->  read back and diff against intent
+ *
+ * There is no draft rehearsal step: `createRepoDraft` does not resolve on this
+ * endpoint (PLAN.md §1.2), and the draft's relation semantics are unknown and
+ * potentially dangerous (§9). When it becomes available, it slots in before the
+ * pre-apply snapshot with no other change.
+ */
+/**
+ * The flow half of an apply.
+ *
+ * A flow reads the pipe — a datapill names a field by slug, a trigger names a
+ * phase — so the pipe is applied first and this runs after it. Extracted so it is
+ * also reachable when the pipe half is clean, which is the ordinary case for a
+ * flow-only change; the early return was reporting "nothing to apply" over real
+ * pending work.
+ *
+ * Returns the exit code the caller passes through, plus what it did — the
+ * latter is what lets the *one* combined revert offer at the end of
+ * `applyOneRepo` know whether flows have anything worth reverting at all.
+ */
+const applyFlowHalf = async (
+  p: Parsed,
+  root: string,
+  dir: string,
+  repoId: number,
+  net: Awaited<ReturnType<typeof connect>>,
+  dryRun: boolean,
+): Promise<{ exitCode: number; outcome: FlowHalfOutcome }> => {
+  const notAttempted = { exitCode: 0, outcome: NOT_ATTEMPTED_FLOW };
+  if (bool(p, 'no-flows')) return notAttempted;
+  const { readFlows } = await import('../workspace/flows.ts');
+  const authored = await readFlows(dir);
+  if (!authored) return notAttempted;
+
+  try {
+    const { changeSet: flowChanges, live } = await diffFlowsAgainstLive(net.ipaas, repoId, dir);
+    const flowPlan = planFlows(flowChanges, {
+      allowArm: bool(p, 'allow-flow-enable'),
+      connections: live.connections,
+    });
+
+    if (flowPlan.blocked.length) {
+      info('');
+      out(renderFlowPlan(flowPlan));
+      if (!bool(p, 'force')) {
+        throw new UserError(
+          `${flowPlan.blocked.length} flow change(s) cannot be applied`,
+          'revert those edits, or re-run with --force to apply only the rest',
+        );
+      }
+    }
+
+    if (!flowPlan.steps.length) return notAttempted;
+
+    info('');
+    out(renderFlowPlan(flowPlan));
+    const flowResult = await applyFlows(net.ipaas, repoId, flowPlan, {
+      dryRun,
+      continueOnError: bool(p, 'continue-on-error'),
+    });
+    for (const step of flowPlan.steps) if (step.error) warn(`${step.id} ${step.description}: ${step.error}`);
+
+    if (!dryRun && flowResult.done > 0) {
+      /**
+       * The check nothing else can make. A migrating write path rewrites a
+       * datapill's single ['output'] into a doubled one: structurally valid,
+       * accepted by the platform's own validator, and resolving to nothing at
+       * runtime. Only comparing the stored string against the intended one finds it.
+       */
+      const drift = await verifyFlowDatapills(net.ipaas, repoId, authored);
+      reportDatapillDrift(drift);
+      if (drift.length) {
+        warn(
+          'the flow was written but does not hold what was sent — do not enable it until this is resolved',
+        );
+      }
+
+      // Adopt: a flow id the create just minted exists only in the read-back.
+      const { pullAndWriteFlows } = await import('./flows.ts');
+      await pullAndWriteFlows(net.ipaas, repoId, dir, { workspaceRoot: root });
+      info(dim('   flows re-read from the pipe — new flow ids are now in the files'));
+    }
+
+    return {
+      exitCode: flowResult.failed ? 1 : 0,
+      outcome: { attempted: true, failed: flowResult.failed > 0, doneCount: flowResult.done, before: dryRun ? null : live },
+    };
+  } catch (e) {
+    if (e instanceof UserError) throw e;
+    warn(`flows were not applied: ${(e as Error).message}`);
+    return notAttempted;
+  }
+};
+
+/**
+ * Show pending flow work before the confirmation prompt asks about the pipe
+ * steps, so "N steps. Apply...?" is not answered blind to a flow `pipe plan`
+ * already showed. A saved plan file (`--plan` / `--resume`) never carried the
+ * flow plan at all — it is a separate, unsaved computation — so without this
+ * the only place a flow step is visible is inside `pipe plan`'s own output.
+ *
+ * Preview only: it changes nothing, and `applyFlowHalf` below recomputes the
+ * same diff for real right before sending it.
+ */
+const previewFlowHalf = async (p: Parsed, dir: string, repoId: number, net: Awaited<ReturnType<typeof connect>>): Promise<void> => {
+  if (bool(p, 'no-flows')) return;
+  const { readFlows } = await import('../workspace/flows.ts');
+  if (!(await readFlows(dir))) return;
+  try {
+    const { changeSet: flowChanges, live } = await diffFlowsAgainstLive(net.ipaas, repoId, dir);
+    const flowPlan = planFlows(flowChanges, { allowArm: bool(p, 'allow-flow-enable'), connections: live.connections });
+    const rendered = renderFlowPlan(flowPlan);
+    if (rendered.trim()) {
+      info('');
+      out(bold('flows'));
+      out(rendered);
+    }
+  } catch (e) {
+    info(dim(`   flows not previewed: ${(e as Error).message}`));
+  }
+};
+
+/**
+ * The agent half of an apply.
+ *
+ * Offline for the diff — the agent baseline is the file `pipe pull` wrote, not a
+ * live read — but the send itself needs the client, same as the pipe half.
+ * Mirrors `applyFlowHalf`: reachable when the pipe half is clean (a
+ * behavior-only edit is ordinary), when the pipe plan is blocked (an agent
+ * change should still land), and after a normal successful apply (which never
+ * touches agents on its own).
+ */
+const applyAgentHalf = async (
+  p: Parsed,
+  root: string,
+  dir: string,
+  repoId: number,
+  repoUuid: string | null | undefined,
+  net: Awaited<ReturnType<typeof connect>>,
+  dryRun: boolean,
+): Promise<{ exitCode: number; outcome: AgentHalfOutcome }> => {
+  const notAttempted = { exitCode: 0, outcome: NOT_ATTEMPTED_AGENT };
+  if (bool(p, 'json')) return notAttempted;
+  try {
+    const { diffAgentsFor, planAgents, renderAgentPlan, applyAgentSteps, pullAndWriteAgents, pullAgentsFor } = await import(
+      './agents.ts'
+    );
+    const agentChanges = await diffAgentsFor(root, repoId, dir);
+    if (!agentChanges.changes.length) return notAttempted;
+
+    const agentPlan = await planAgents(net.client, agentChanges);
+    info('');
+    out(bold('agents'));
+    out(renderAgentPlan(agentPlan));
+
+    /**
+     * Unlike the flow half, the agent diff is offline against the local
+     * baseline (module doc comment, agents.ts) — nothing before this point
+     * has read the pipe's agents live. Without capturing that read here,
+     * a partial agent failure would have no rollback point at all, the same
+     * gap flows had before `planFlowRevert` existed.
+     */
+    const before = dryRun ? null : await pullAgentsFor(net.client, repoUuid);
+
+    const result = await applyAgentSteps(net.client, agentPlan, {
+      dryRun,
+      continueOnError: bool(p, 'continue-on-error'),
+    });
+
+    if (!dryRun && result.done > 0) {
+      /**
+       * Adopt: an agent/behavior id the create just minted exists only in the
+       * read-back. `pullAndWriteAgents` alone only rewrites `agent.json` —
+       * `agent.json` never carries behaviors (workspace/agents.ts) — so
+       * without folding the fresh read into `tree.automations` and writing
+       * the tree back, the `behaviors/` folders this apply just changed would
+       * sit stale (still showing the pre-apply ids), and the next `pipe diff`
+       * would see the new content as unauthored. Mirrors `pipe pull`'s own
+       * sequence (commands/pull.ts).
+       */
+      const section = await pullAndWriteAgents(net.client, repoId, repoUuid, dir, { workspaceRoot: root });
+      if (section.meta.coverage === 'complete') {
+        const { foldFreshBehaviors } = await import('../workspace/agents.ts');
+        const tree = await readTree(dir);
+        tree.automations = foldFreshBehaviors(tree.automations, section.agents);
+        await writeTree(dir, tree);
+      }
+      info(dim('   agents re-read from the pipe — new agent/behavior ids are now in the files'));
+    }
+
+    return {
+      exitCode: result.failed ? 1 : 0,
+      outcome: { attempted: true, failed: result.failed > 0, doneCount: result.done, before },
+    };
+  } catch (e) {
+    if (e instanceof UserError) throw e;
+    warn(`agents were not applied: ${(e as Error).message}`);
+    return notAttempted;
+  }
+};
+
+/**
+ * Show pending agent work before the confirmation prompt, same reason as
+ * `previewFlowHalf`: a saved plan file never carries the agent plan, so
+ * without this the only place an agent step is visible is `pipe plan`'s own
+ * output. Preview only — `applyAgentHalf` recomputes the diff for real.
+ */
+const previewAgentHalf = async (
+  p: Parsed,
+  root: string,
+  dir: string,
+  repoId: number,
+  net: Awaited<ReturnType<typeof connect>>,
+): Promise<void> => {
+  if (bool(p, 'json')) return;
+  try {
+    const { diffAgentsFor, planAgents, renderAgentPlan } = await import('./agents.ts');
+    const agentChanges = await diffAgentsFor(root, repoId, dir);
+    if (!agentChanges.changes.length) return;
+    const agentPlan = await planAgents(net.client, agentChanges);
+    const rendered = renderAgentPlan(agentPlan);
+    if (rendered.trim()) {
+      info('');
+      out(bold('agents'));
+      out(rendered);
+    }
+  } catch (e) {
+    info(dim(`   agents not previewed: ${(e as Error).message}`));
+  }
+};
+
+/**
+ * Other repos in this workspace that still have pending changes.
+ *
+ * An apply covers one repo, and a workspace holds several. Saying nothing reads
+ * as "the workspace is applied", which is the misreading that matters: a database
+ * is never the root — it is reached through a connector field or a relation — so
+ * a database edit always sits in a repo that some other `pipe apply` was not
+ * looking at. The no-op path needs this most, because "nothing to apply" is the
+ * most confident-sounding way to be wrong.
+ *
+ * Offline, and after the fact, so it can neither delay nor fail the apply.
+ */
+const reportPendingElsewhere = async (
+  p: Parsed,
+  root: string,
+  lock: { repos: Array<{ id: number; name: string | null; apiId: string; dir: string }> },
+  appliedId: number,
+) => {
+  if (str(p, 'repo') || lock.repos.length < 2) return;
+  const { loadBaseline } = await import('./diff.ts');
+  const { diffTrees } = await import('../diff/diff.ts');
+  const pending: string[] = [];
+  for (const other of lock.repos.filter((r) => r.id !== appliedId)) {
+    try {
+      const n = diffTrees(
+        await loadBaseline(root, other.id),
+        await readTree(resolve(root, other.dir)),
+        { mode: 'same-repo' },
+      ).changes.length;
+      if (n) pending.push(`${other.name} — ${n} change${n === 1 ? '' : 's'}   pipe apply --repo ${other.apiId}`);
+    } catch {
+      // A repo that cannot be read here is already reported by `pipe validate`.
+    }
+  }
+  if (!pending.length) return;
+  info('');
+  warn(`${pending.length} other repo(s) in this workspace still have pending changes:`);
+  for (const line of pending) info(dim(`   ${line}`));
+};
+
+/**
+ * Local version control is the rollback path Pipefy's own snapshot cannot be:
+ * `pipe rollback` only restores the *latest* snapshot, and this apply's own
+ * read-back becomes the latest, so the pre-apply snapshot stops being
+ * restorable the moment the apply that took it finishes. A git commit taken
+ * before applying has no such expiry.
+ *
+ * Silent when a git repo already covers this workspace. Never blocks or
+ * fails the apply — a missing `git` is a suggestion, not a prerequisite.
+ */
+const warnIfUnversioned = async (p: Parsed) => {
+  let root: string;
+  try {
+    root = await resolveWorkspace(p);
+  } catch {
+    return; // no workspace here — openWorkspace below reports the real error
+  }
+
+  const git = await checkGit(root);
+  if (git.tracked) return;
+
+  info('');
+  if (!git.installed) {
+    warn('git is not installed — this workspace has no local version history');
+    info(dim('   install it: https://git-scm.com/downloads'));
+  } else {
+    warn('this workspace is not a git repository — it has no local version history');
+  }
+  info(dim('   run `git init && git add -A && git commit -m "baseline"` here, and commit before each `pipe apply`'));
+  info(dim('   `pipe rollback` only restores the latest snapshot (see `pipe doctor`) — a local commit covers the rest'));
+};
+
+/**
+ * `pipe apply` — the whole workspace by default.
+ *
+ * It used to apply one repo, the root unless `--repo` said otherwise, which was
+ * the wrong default once databases arrived: a database can never be the root, so
+ * "apply" left database edits sitting there and said nothing. `pipe diff` reads
+ * the whole workspace, and apply is the other half of that sentence.
+ *
+ * Each repo still applies **independently** — its own plan file, its own
+ * pre-apply snapshot, its own read-back and verify — because they are separate
+ * repos with separate baselines, and a failure in one must not roll back or
+ * abandon another that already succeeded. So this is a loop over the real thing,
+ * not a merged mega-plan.
+ *
+ * `--repo` still means "only this one", and `--plan` / `--resume` stay
+ * single-repo because a saved plan belongs to exactly one.
+ */
+export const run = async (p: Parsed): Promise<number> => {
+  await warnIfUnversioned(p);
+
+  const single = str(p, 'repo') || str(p, 'plan') || str(p, 'resume');
+  if (single) return applyOneRepo(p);
+
+  const { lock } = await openWorkspace(p);
+  const excluded = new Set(
+    (str(p, 'exclude') ?? '')
+      .split(',')
+      .map((x) => x.trim())
+      .filter(Boolean),
+  );
+  const selected = lock.repos.filter(
+    (r) => !excluded.has(String(r.id)) && !excluded.has(r.apiId) && !excluded.has((r.name ?? '').toLowerCase()),
+  );
+
+  for (const name of excluded) {
+    if (!lock.repos.some((r) => String(r.id) === name || r.apiId === name || (r.name ?? '').toLowerCase() === name)) {
+      warn(`--exclude ${name} matches no repo in this workspace`);
+    }
+  }
+
+  if (selected.length <= 1) return applyOneRepo(p);
+
+  info('');
+  info(
+    bold(`applying ${selected.length} repo(s)`) +
+      dim(` — ${selected.map((r) => r.name ?? r.id).join(', ')}`) +
+      (excluded.size ? dim(`  (excluding ${[...excluded].join(', ')})`) : ''),
+  );
+
+  let worst = 0;
+  const outcomes: string[] = [];
+  for (const r of selected) {
+    info('');
+    info(bold(`── ${r.kind} ${r.name ?? r.id} ${dim(`(${r.apiId})`)}`));
+    /**
+     * Forcing `--repo` is what makes the inner call single-repo, and it also
+     * suppresses its own "other repos still have pending changes" note, which
+     * would be noise inside a loop that is already handling them.
+     */
+    const code = await applyOneRepo({ ...p, flags: { ...p.flags, repo: String(r.id) } });
+    worst = Math.max(worst, code);
+    outcomes.push(`${code === 0 ? 'ok' : `exit ${code}`}  ${r.name ?? r.id}`);
+  }
+
+  info('');
+  out(bold('workspace'));
+  for (const line of outcomes) out(`  ${line}`);
+  return worst;
+};
+
+const applyOneRepo = async (p: Parsed): Promise<number> => {
+  const { root, lock, repo, repoDir: dir } = await openWorkspace(p);
+  const dryRun = bool(p, 'dry-run');
+  const net = await connect(p);
+  const caps = await net.capabilities();
+
+  const resumeId = str(p, 'resume');
+  const planId = str(p, 'plan');
+
+  /**
+   * The run record, off unless asked for.
+   *
+   * A report folder holds a full copy of the pipe, so writing one on every apply
+   * would grow the workspace without bound and put webhook URLs and
+   * HTTP-request credentials in one more place. The record an apply *needs* is
+   * the plan file under `.ppc/plans/`, which is written either way and is what
+   * `--resume` reads. `runs/` is the optional human account of what happened.
+   *
+   * Started before anything is compiled, so that a refusal — the most
+   * interesting outcome to look back at, because nothing was sent and the reason
+   * is in the classifier — is recorded too.
+   */
+  const rec = !bool(p, 'report')
+    ? null
+    : new RunRecorder(dryRun ? 'dry-run' : 'apply', {
+        workspace: root,
+        repo: { id: repo.id, uuid: repo.uuid, name: repo.name ?? String(repo.id), kind: repo.kind },
+        command: invocation(),
+      });
+
+  let plan: Plan;
+  if (resumeId || planId) {
+    plan = await loadPlan(root, (resumeId ?? planId) as string);
+    if (resumeId) {
+      const remaining = plan.steps.filter((s) => s.status !== 'done').length;
+      info(`resuming plan ${plan.id} — ${remaining} of ${plan.steps.length} steps still to run`);
+      // A skipped step on a resume is retried: it was skipped because an id was
+      // missing, and the resume may now have it.
+      for (const s of plan.steps) if (s.status === 'skipped' || s.status === 'failed' || s.status === 'running') s.status = 'pending';
+    }
+  } else {
+    const edited = await readTree(dir);
+    const baseline = await loadBaseline(root, repo.id);
+
+    const { readAgents } = await import('../workspace/agents.ts');
+    const findings = validateTree(edited, {
+      knownRepoIds: lock.repos.map((r) => r.id),
+      baseline,
+      reference: await loadReference(root),
+      agents: await readAgents(dir),
+    });
+    const blocking = blockingErrors(findings);
+    if (blocking.length) {
+      throw new UserError(
+        `${blocking.length} validation error${blocking.length === 1 ? '' : 's'}`,
+        'run `pipe validate` to see them',
+      );
+    }
+
+    rec?.before(await loadBaselineEnvelope(root, repo.id));
+
+    const changeSet = diffTrees(baseline, edited);
+    if (!changeSet.changes.length) {
+      /**
+       * The pipe half is clean. That is not the same as nothing to apply: flows
+       * are part of this loop, and a flow-only change is the ordinary case.
+       */
+      const exitCode = await finishApply(p, root, dir, repo, net, dryRun, caps, {
+        attempted: false,
+        doneCount: 0,
+        preApplyVersionId: null,
+      });
+      if (!exitCode) ok('nothing to apply to the pipe — the workspace matches the baseline');
+      await reportPendingElsewhere(p, root, lock, repo.id);
+      // No run folder for a no-op: one per no-op would bury the runs that changed
+      // something, and "nothing happened" is not worth a payload copy.
+      return exitCode;
+    }
+
+    const options: PlanOptions = {
+      automationStrategy: bool(p, 'automation-recreate') ? 'recreate' : 'update',
+      allowCardMoves: bool(p, 'allow-card-moves'),
+      force: bool(p, 'force'),
+    };
+    plan = await compile(changeSet, {
+      client: net.client,
+      capabilities: caps,
+      repoId: repo.id,
+      repoUuid: repo.uuid,
+      workspace: root,
+      organizationId: lock.organizationId,
+    /**
+     * The automation catalogue, so a wrong event or action parameter is refused
+     * here rather than discovered as "is invalid" mid-apply. Read from the public
+     * API; a failure to read it means the check is skipped, never that the plan is
+     * blocked.
+     */
+    automationCatalogue: await readAutomationCatalogue(net.client, repo.id).catch(() => undefined),
+      livePhaseIds: edited.phases.map((ph) => Number(ph['id'])).filter(Number.isFinite),
+      repoKind: repo.kind,
+    /** A database has one form, so its column order is that form's fields by index. */
+    tableFieldOrder:
+      repo.kind === 'table'
+        ? [...(edited.phases[0]?.fields ?? [])].sort((a, b) => Number(a['index'] ?? 0) - Number(b['index'] ?? 0))
+        : undefined,
+    baselineTableFieldOrder:
+      repo.kind === 'table'
+        ? [...(baseline?.phases[0]?.fields ?? [])]
+            .sort((a, b) => Number(a['index'] ?? 0) - Number(b['index'] ?? 0))
+            .map((f) => String(f['slug'] ?? ''))
+        : undefined,
+      fieldUuidById: Object.fromEntries(
+        edited.phases
+          .flatMap((ph) => ph.fields)
+          .filter((fl) => fl['id'] && fl['uuid'])
+          .map((fl) => [String(fl['id']), String(fl['uuid'])]),
+      ),
+      /** For `updateTable.title_field_id`, which refuses the numeric id. */
+      fieldSlugById: Object.fromEntries(
+        edited.phases
+          .flatMap((ph) => ph.fields)
+          .filter((fl) => fl['id'] && fl['slug'])
+          .map((fl) => [String(fl['id']), String(fl['slug'])]),
+      ),
+      startFormPhaseId:
+      (edited.phases.find((ph) => Number(ph['index'] ?? -1) === 0)?.['id'] as number | undefined) ?? null,
+    conditionOrder: Object.fromEntries(
+        [...new Set(edited.field_conditions.map((fc) => String(fc['phase_id'] ?? '')))]
+          .filter((phaseId) => phaseId !== '')
+          .map((phaseId) => [
+            phaseId,
+            edited.field_conditions
+              .filter((fc) => String(fc['phase_id'] ?? '') === phaseId)
+              .slice()
+              .sort((a, b) => Number(a['index'] ?? 0) - Number(b['index'] ?? 0))
+              .map((fc) => ({ name: String(fc['name'] ?? ''), id: fc['id'] ? Number(fc['id']) : null })),
+          ]),
+      ),
+      baselineConditionOrder: Object.fromEntries(
+        [...new Set((baseline?.field_conditions ?? []).map((fc) => String(fc['phase_id'] ?? '')))]
+          .filter((phaseId) => phaseId !== '')
+          .map((phaseId) => [
+            phaseId,
+            (baseline?.field_conditions ?? [])
+              .filter((fc) => String(fc['phase_id'] ?? '') === phaseId)
+              .slice()
+              .sort((a, b) => Number(a['index'] ?? 0) - Number(b['index'] ?? 0))
+              .map((fc) => String(fc['id'])),
+          ]),
+      ),
+    }, options);
+  }
+
+  out(renderPlan(plan));
+  info('');
+  rec?.fromPlan(plan);
+
+  if (plan.blocked.length && !plan.options.force) {
+    const message = `${plan.blocked.length} change${plan.blocked.length === 1 ? '' : 's'} in this workspace cannot be applied`;
+    const exitCode = await finishApply(p, root, dir, repo, net, dryRun, caps, {
+      attempted: false,
+      doneCount: 0,
+      preApplyVersionId: null,
+    });
+    if (exitCode) return exitCode;
+    await reportRun(rec, 'refused', message);
+    throw new UserError(message, 'revert those edits, or re-run with --force to apply only the supported ones');
+  }
+
+  warnUnverifiedSteps(plan);
+
+  await previewFlowHalf(p, dir, repo.id, net);
+  await previewAgentHalf(p, root, dir, repo.id, net);
+
+  const destructive = plan.steps.filter((s) => s.destructive);
+  if (!dryRun && !bool(p, 'yes')) {
+    const confirmed = await confirm(
+      destructive.length
+        ? `${plan.steps.length} steps, ${red(`${destructive.length} destructive`)}. Apply to pipe ${repo.id} (${repo.name})?`
+        : `${plan.steps.length} steps. Apply to pipe ${repo.id} (${repo.name})?`,
+    );
+    if (!confirmed) {
+      info('aborted');
+      return 130;
+    }
+  }
+
+  // ── pre-apply snapshot: the rollback point ────────────────────────────────
+  if (!dryRun && caps.snapshots && !bool(p, 'no-pre-snapshot')) {
+    const label = `pre-apply/${new Date().toISOString()}`;
+    try {
+      const versionId = await net.snapshots.create(repo.id);
+      await net.snapshots.waitFor(repo.id, versionId);
+      await net.snapshots.rename(repo.id, versionId, label);
+      plan.preApplyVersionId = versionId;
+      rec?.note(`pre-apply snapshot ${versionId} labelled ${label}`);
+      ok(`pre-apply snapshot ${versionId.slice(0, 8)} labelled ${label}`);
+      /**
+       * What this snapshot is actually worth, stated honestly.
+       *
+       * A restore mutation does exist here — `restoreRepoToSnapshot` — but it
+       * only accepts the **latest** uploaded snapshot, and the read-back this
+       * command takes to verify becomes the latest. So the pre-apply snapshot is
+       * a rollback point right up until the apply finishes, and a record after
+       * that. Saying "no one-command rollback", as this used to, was wrong; so
+       * would be implying it can undo a completed apply.
+       */
+      if (!caps.restoreRepoSnapshot) {
+        warn('no restore mutation on this endpoint — this snapshot is a record, not a rollback point');
+      } else if (caps.restoreLatestOnly) {
+        info(
+          dim(
+            `   restorable with \`pipe rollback --repo ${repo.id} --version ${versionId}\` until something ` +
+              'snapshots this repo again — including the read-back at the end of this apply',
+          ),
+        );
+      }
+    } catch (e) {
+      warn(`could not take a pre-apply snapshot: ${(e as Error).message}`);
+      const go = bool(p, 'yes') || (await confirm('Continue without a rollback point?'));
+      if (!go) return 130;
+    }
+  } else if (!dryRun && !caps.snapshots) {
+    warn('this endpoint has no snapshots, so there is no rollback point. A failed apply is repaired forward.');
+  }
+
+  /**
+   * Resuming writes back to the file that already exists, under whatever name it
+   * was left with, instead of starting a second copy under the bare id.
+   */
+  const path = (await findPlanFile(root, plan.id)) ?? planFile(root, plan.id);
+  await writeJson(path, plan);
+
+  const result = await execute(plan, {
+    client: net.client,
+    internal: net.internal,
+    planPath: path,
+    dryRun,
+    continueOnError: bool(p, 'continue-on-error'),
+  });
+
+  /**
+   * Stamp the outcome into the filename, so `.ppc/plans/` says what happened
+   * without opening anything. Renamed only after the executor has stopped
+   * writing to the file, and never on a dry run, which sent nothing.
+   */
+  let planPath = path;
+  if (!dryRun) {
+    const settled = planFileFor(root, plan.id, plan.status);
+    if (settled !== path) {
+      try {
+        const { rename } = await import('node:fs/promises');
+        await rename(path, settled);
+        planPath = settled;
+      } catch (e) {
+        debug(`could not rename the plan file: ${(e as Error).message}`);
+      }
+    }
+  }
+
+  // The executor's own summary line already reported the counts.
+
+  /**
+   * Adopting a created entity's id no longer needs a live read-back at all:
+   * the id came back on the create mutation's own response, already sitting
+   * in `result.idMap` (idmap.ts), which is exactly where `%{_new:<uuid>}`
+   * substitution for *later* steps in this same run got it from. This runs
+   * whether the apply fully succeeded, partially failed, or was resumed from
+   * a saved plan — creates before the failure need the same adoption a fully
+   * successful run does, and unconditionally is simpler than two copies of
+   * the same logic split across the branches below.
+   *
+   * `edited`/`changeSet` from the compile branch above are not reused,
+   * because `--resume`/`--plan` never populate them at all. Re-reading and
+   * re-diffing here instead is the one code path both cases share: diffing
+   * the same (unedited-since-compile) tree against the same baseline
+   * reproduces the same change keys, so `changeByKey` still finds the row a
+   * step's `changeKey` refers to.
+   */
+  let adopted: ReturnType<typeof adoptCreatedIds> = [];
+  if (!dryRun && result.done > 0) {
+    try {
+      const finalTree = await readTree(dir);
+      const previousEnvelope = await loadBaselineEnvelope(root, repo.id);
+      const previousTree = previousEnvelope ? unpack(previousEnvelope) : null;
+      // No baseline at all means this repo was never pulled properly — the
+      // compile branch above would already have refused before execute() ran.
+      if (previousTree) {
+        const finalChangeSet = diffTrees(previousTree, finalTree);
+        adopted = adoptCreatedIds(finalChangeSet, plan, result.idMap);
+
+        if (adopted.length) {
+          const patched = result.idMap.rewrite(finalTree) as typeof finalTree;
+          await writeTree(dir, patched);
+          const changedBaseline = mergeAdoptedIntoBaseline(previousTree, patched, adopted);
+          if (changedBaseline) await writeJson(baselineFile(root, repo.id), packEnvelope(previousTree));
+          for (const line of renderAdopted(adopted)) {
+            info(line);
+            rec?.note(line);
+          }
+          info(dim('   no read-back needed for this — the id came from the create response itself'));
+        }
+      }
+    } catch (e) {
+      warn(`could not adopt created ids: ${(e as Error).message}`);
+      rec?.warn(`could not adopt created ids: ${(e as Error).message}`);
+      info(dim('   re-pull before re-planning, or the next apply may create them again'));
+    }
+  }
+
+  if (result.failed) {
+    info('');
+    warn(`plan ${plan.id} is ${plan.status}`);
+
+    /**
+     * Pipe-only: a pipe-side failure means flows and agents were never
+     * attempted in this run (they read the pipe, so it goes first) — nothing
+     * else to fold into the offer.
+     */
+    await offerUnifiedRevert(
+      p,
+      net,
+      repo,
+      dir,
+      root,
+      {
+        pipe: { attempted: true, doneCount: result.done, preApplyVersionId: plan.preApplyVersionId ?? null },
+        flow: NOT_ATTEMPTED_FLOW,
+        agent: NOT_ATTEMPTED_AGENT,
+      },
+      caps,
+    );
+
+    await reportRun(
+      rec,
+      result.done > 0 ? 'partial' : 'failed',
+      `${result.done} of ${plan.steps.length} steps applied, ${result.failed} failed` +
+        `${result.skipped ? `, ${result.skipped} skipped` : ''}`,
+    );
+
+    info('');
+    info(dim(`   the record of this attempt is .ppc/plans/${basename(planPath)}`));
+    info(`${yellow('resume')}  pipe apply --resume ${plan.id}   ${dim('replays the saved requests as they were compiled')}`);
+    info(`${yellow('re-plan')} pipe apply                        ${dim('recompiles — use this after changing pipe itself')}`);
+    if (plan.preApplyVersionId && caps.restoreRepoSnapshot) {
+      info(`${yellow('roll back')}  pipe rollback --version ${plan.preApplyVersionId} --repo ${repo.id}   ${dim('pipe structure only — not flows, not anything already sent or fired')}`);
+    }
+    return 1;
+  }
+
+  if (!dryRun && !bool(p, 'no-verify')) {
+    info('');
+    /**
+     * A fresh snapshot is never taken here on its own initiative — that is
+     * exactly what makes the pre-apply rollback point stop being restorable
+     * (see the comment where it was taken, and `pipe rollback`'s own). Ids are
+     * already adopted above without one, so what is being asked for here is
+     * strictly extra: a full live comparison, and a wholesale adopt of
+     * whatever the server filled in that the create response did not carry
+     * (slug, color_uuid, and the like — never anything the author has an
+     * opinion about; see AGENTS.md "verify against intent, not identity").
+     */
+    const takeSnapshot = caps.snapshots && (bool(p, 'post-snapshot') || (await confirmPostSnapshot(p)));
+    const verified = await verifyRepo({
+      net,
+      root,
+      lock,
+      repo,
+      expectedTreeDir: dir,
+      idMap: result.idMap,
+      preferReconstruct: !takeSnapshot,
+    });
+    if (!verified.ok) {
+      warn(
+        takeSnapshot
+          ? 'verification found differences between what was applied and what the workspace asks for:'
+          : 'a free, GraphQL-reconstructed comparison found differences — coverage gaps may hide more (see below):',
+      );
+      out(verified.render);
+
+      /**
+       * `result.failed` is false to have reached this branch — every step
+       * reported success. A mismatch here does not mean nothing happened; it
+       * means verify's comparison could not recognise what did. That is exactly
+       * what a server-minted uuid causes: the entity this apply just created
+       * reads as "delete the live one, create the authored one" instead of
+       * "these are the same thing", because the tree still names it by the
+       * uuid the author made up, not the one the server actually assigned —
+       * `adoptCreatedIds` above already fixed the *id*, but not the uuid the
+       * server may have minted independently of it.
+       *
+       * Only worth running against a real read: reconciling against a
+       * GraphQL reconstruction's partial coverage risks the same "adopt an
+       * absence as a deletion" mistake the coverage doctrine exists to avoid.
+       */
+      if (takeSnapshot) {
+        const authored = await readTree(dir);
+        const previous = await loadBaselineEnvelope(root, repo.id);
+        const stamp = stampCreated(authored, unpack(verified.envelope), previous ? unpack(previous) : null);
+        if (stamp.changed) {
+          await writeTree(dir, authored);
+          for (const line of renderStamp(stamp)) {
+            info(line);
+            rec?.note(stripAnsi(line).trim());
+          }
+        }
+        await writeJson(baselineFile(root, repo.id), verified.envelope);
+        info(
+          dim(
+            stamp.changed
+              ? '   baseline updated from the read-back; ids for what was created are now in the files too'
+              : '   baseline updated from the read-back; the files are otherwise untouched, so `--resume` still works',
+          ),
+        );
+      } else {
+        info(dim('   not adopting from this read — it may be missing groups the create responses already fixed for real'));
+      }
+      rec?.after(verified.envelope);
+      rec?.verified(false, 'the applied pipe does not satisfy the workspace intent');
+      await reportRun(rec, 'partial', `all ${result.done} steps applied, but verification found differences`);
+      return 1;
+    }
+    ok(takeSnapshot ? 'verified — the pipe now matches the workspace' : 'verified against a free GraphQL reconstruction — the pipe matches the workspace');
+    rec?.after(verified.envelope);
+    rec?.verified(true);
+
+    if (takeSnapshot) {
+      /**
+       * Adopt the live state as both the workspace and the baseline —
+       * strictly more complete than the id-only adoption above, since it also
+       * picks up whatever the server filled in on its own (slug, color_uuid,
+       * the connector flags). Only reachable here, on a real read: adopting a
+       * reconstruction wholesale would discard whatever group its coverage
+       * cannot see, which the id-only adoption above never risks.
+       */
+      const live = unpack(verified.envelope);
+      /**
+       * A live read-back has no idea which automations are agent behaviors — that
+       * only exists in the `agents/` folders already on disk. Without re-tagging
+       * here, this write would move every behavior back into `automations/` on
+       * every single successful apply.
+       */
+      const { tagBehaviors, behaviorDirMapOnDisk } = await import('../workspace/agents.ts');
+      live.automations = tagBehaviors(live.automations, await behaviorDirMapOnDisk(dir));
+      await writeTree(dir, live);
+      await writeJson(baselineFile(root, repo.id), verified.envelope);
+      upsertRepo(lock, refFor(repo), root, live);
+      await writeLock(root, lock);
+      info(dim('   workspace and baseline updated from the applied state — server-assigned ids are now in the files'));
+    }
+    info(dim(`   applied plan recorded as .ppc/plans/${basename(planPath)}`));
+
+    await reportPendingElsewhere(p, root, lock, repo.id);
+  }
+
+  await reportRun(
+    rec,
+    'ok',
+    dryRun
+      ? `${plan.steps.length} steps simulated, nothing sent`
+      : `${result.done} steps applied${bool(p, 'no-verify') ? ', not verified' : ' and verified'}`,
+  );
+
+  /**
+   * The pipe half succeeded, and that is not the only thing this apply owes:
+   * the other two call sites cover "nothing to apply to the pipe" and "the
+   * pipe plan is blocked", but a normal, non-blocked pipe change reached this
+   * point without ever touching flows. `pipe plan` computes and prints the
+   * flow plan on its own, so it looked applied — it was never sent.
+   *
+   * The pipe outcome passed here is what lets a *later* flow or agent
+   * failure still offer to undo the pipe changes that landed in this same
+   * run — they succeeded, but "this apply" as a whole did not.
+   */
+  return finishApply(p, root, dir, repo, net, dryRun, caps, {
+    attempted: true,
+    doneCount: result.done,
+    preApplyVersionId: plan.preApplyVersionId ?? null,
+  });
+};
+
+/**
+ * Write the run folder and say where it went.
+ *
+ * Every exit from `pipe apply` that did something goes through here — success,
+ * partial, refusal — because the run whose report is missing is always the one
+ * that went wrong.
+ */
+const reportRun = async (rec: RunRecorder | null, outcome: RunOutcome, summary: string) => {
+  if (!rec) return;
+  const res = await rec.write(outcome, summary);
+  if (!res) return;
+  if (res.error) {
+    warn(`could not write the run report: ${res.error}`);
+    return;
+  }
+  info(dim(`   run recorded in runs/${rec.id}/`));
+};
+
+const confirm = async (question: string): Promise<boolean> => {
+  if (!process.stdin.isTTY) {
+    warn('not a tty — pass --yes to apply non-interactively');
+    return false;
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await rl.question(`${question} [y/N] `);
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+};
+
+/**
+ * Whether to spend a fresh snapshot on a full live verify/adopt.
+ *
+ * Never the default, and never asked at all non-interactively: `confirm`
+ * already declines on a non-tty, and `--yes` means "proceed without asking",
+ * which for something this endpoint cannot be asked to undo means declining,
+ * not accepting silently.
+ */
+const confirmPostSnapshot = async (p: Parsed): Promise<boolean> => {
+  if (bool(p, 'yes')) return false;
+  return confirm('Create a fresh snapshot for a full live verify and adopt? (spends the pre-apply rollback point)');
+};
+
+/**
+ * Run flows, then agents if flows did not fail, and — if anything across
+ * pipe, flow or agent failed — ask the *one* combined revert question.
+ * Every exit from `applyOneRepo` that could still touch flows or agents
+ * goes through this, so there is exactly one place that decides whether a
+ * revert is worth offering, no matter which half actually failed.
+ */
+const finishApply = async (
+  p: Parsed,
+  root: string,
+  dir: string,
+  repo: { id: number; uuid: string | null | undefined },
+  net: Awaited<ReturnType<typeof connect>>,
+  dryRun: boolean,
+  caps: Capabilities,
+  pipeOutcome: PipeHalfOutcome,
+): Promise<number> => {
+  const flowResult = await applyFlowHalf(p, root, dir, repo.id, net, dryRun);
+  const agentResult = flowResult.outcome.failed
+    ? { exitCode: 0, outcome: NOT_ATTEMPTED_AGENT }
+    : await applyAgentHalf(p, root, dir, repo.id, repo.uuid, net, dryRun);
+
+  const anyFailed = flowResult.outcome.failed || agentResult.outcome.failed;
+  if (!dryRun && anyFailed) {
+    await offerUnifiedRevert(p, net, repo, dir, root, { pipe: pipeOutcome, flow: flowResult.outcome, agent: agentResult.outcome }, caps);
+  }
+  return flowResult.exitCode || agentResult.exitCode ? 1 : 0;
+};
+
+/**
+ * The one revert question `pipe apply` ever asks. Offered whenever pipe,
+ * flow or agent failed partway, and — deliberately — whenever any of the
+ * *other* two succeeded fully during the same run: "this apply" is one
+ * action from where the user sits, so a failure anywhere in it means the
+ * honest question is "revert everything it changed", not three separate
+ * prompts scoped to whichever half happened to error.
+ *
+ * Each half gets reverted the way its own platform actually allows,
+ * because there is no such thing as one API that reverses all three:
+ *
+ * - **Pipe structure** — `restoreRepoToSnapshot`, Pipefy's own mechanism,
+ *   restoring the pre-apply snapshot. Only offered while that snapshot is
+ *   still the latest one (`caps.restoreLatestOnly`) — nothing before this
+ *   point takes a second snapshot on its own initiative, so it normally
+ *   still is.
+ * - **iPaaS flows** and **AI agents** have no snapshot at all. Each is
+ *   reverted by diffing the *current* live state against the read taken
+ *   right before this apply touched it, and sending that reverse plan
+ *   through the same compiler/executor an ordinary apply uses
+ *   (`planFlowRevert`, `planAgentRevert`) — built for exactly this,
+ *   verified live (see AGENTS.md).
+ *
+ * Rendered in full, for every part that has anything to revert, before the
+ * one question is asked. Reverted in the reverse of the order they were
+ * applied — agents, then flows, then pipe structure — on confirmation.
+ * Declining leaves everything exactly as this apply left it.
+ *
+ * Still true, and said so explicitly if nothing here can help: no revert,
+ * Pipefy's or this tool's, un-sends an email or un-fires a webhook an
+ * automation already triggered. That is the platform's own irreversibility.
+ */
+const offerUnifiedRevert = async (
+  p: Parsed,
+  net: Awaited<ReturnType<typeof connect>>,
+  repo: { id: number; uuid: string | null | undefined },
+  dir: string,
+  root: string,
+  outcome: { pipe: PipeHalfOutcome; flow: FlowHalfOutcome; agent: AgentHalfOutcome },
+  caps: Capabilities,
+): Promise<void> => {
+  const parts: string[] = [];
+
+  let pipeRestorable = false;
+  if (outcome.pipe.attempted && outcome.pipe.doneCount > 0 && outcome.pipe.preApplyVersionId && caps.restoreRepoSnapshot) {
+    if (caps.restoreLatestOnly) {
+      const latest = (await net.snapshots.list(repo.id, 1))[0];
+      pipeRestorable = !latest || latest.versionId === outcome.pipe.preApplyVersionId;
+      if (!pipeRestorable) {
+        info(dim('   the pre-apply snapshot is no longer the latest, so pipe structure cannot be rolled back automatically'));
+      }
+    } else {
+      pipeRestorable = true;
+    }
+    if (pipeRestorable) parts.push(`pipe structure (${outcome.pipe.doneCount} step(s), via the pre-apply snapshot)`);
+  }
+
+  let flowRevertPlan: FlowPlan | null = null;
+  if (outcome.flow.attempted && outcome.flow.before && outcome.flow.doneCount > 0) {
+    const { plan } = await planFlowRevert(net.ipaas, repo.id, outcome.flow.before);
+    if (plan.steps.length) {
+      flowRevertPlan = plan;
+      parts.push(`iPaaS flows (${plan.steps.length} step(s))`);
+    }
+  }
+
+  let agentRevertPlan: AgentPlan | null = null;
+  if (outcome.agent.attempted && outcome.agent.before && outcome.agent.doneCount > 0) {
+    const { planAgentRevert } = await import('./agents.ts');
+    const { plan } = await planAgentRevert(net.client, repo.uuid, outcome.agent.before);
+    if (plan.steps.length) {
+      agentRevertPlan = plan;
+      parts.push(`AI agents (${plan.steps.length} step(s))`);
+    }
+  }
+
+  if (!parts.length) return;
+
+  info('');
+  warn('this apply did not fully succeed');
+  out(bold('reverting would do this:'));
+  if (pipeRestorable) out(`  pipe structure — restore the pre-apply snapshot`);
+  if (flowRevertPlan) out(renderFlowPlan(flowRevertPlan));
+  if (agentRevertPlan) {
+    const { renderAgentPlan } = await import('./agents.ts');
+    out(renderAgentPlan(agentRevertPlan));
+  }
+  info(
+    dim(
+      '   no revert, Pipefy\'s or this tool\'s, un-sends an email or un-fires a webhook an automation already triggered',
+    ),
+  );
+
+  const wantsRevert = bool(p, 'yes') ? false : await confirm(`Revert everything this apply changed — ${parts.join(', ')}?`);
+  if (!wantsRevert) return;
+
+  if (agentRevertPlan) {
+    const { applyAgentSteps, pullAndWriteAgents } = await import('./agents.ts');
+    const r = await applyAgentSteps(net.client, agentRevertPlan, { dryRun: false, continueOnError: true });
+    for (const step of agentRevertPlan.steps) if (step.error) warn(`${step.id} ${step.description}: ${step.error}`);
+    ok(r.failed ? `agent revert partially failed — ${r.done} of ${agentRevertPlan.steps.length} step(s) landed` : 'agents reverted to the pre-apply state');
+    const section = await pullAndWriteAgents(net.client, repo.id, repo.uuid, dir, { workspaceRoot: root });
+    if (section.meta.coverage === 'complete') {
+      const { foldFreshBehaviors } = await import('../workspace/agents.ts');
+      const tree = await readTree(dir);
+      tree.automations = foldFreshBehaviors(tree.automations, section.agents);
+      await writeTree(dir, tree);
+    }
+  }
+
+  if (flowRevertPlan) {
+    const r = await applyFlows(net.ipaas, repo.id, flowRevertPlan, { dryRun: false, continueOnError: true });
+    for (const step of flowRevertPlan.steps) if (step.error) warn(`${step.id} ${step.description}: ${step.error}`);
+    ok(r.failed ? `flow revert partially failed — ${r.done} of ${flowRevertPlan.steps.length} step(s) landed` : 'flow(s) reverted to the pre-apply state');
+    const { pullAndWriteFlows } = await import('./flows.ts');
+    await pullAndWriteFlows(net.ipaas, repo.id, dir, { workspaceRoot: root });
+  }
+
+  if (pipeRestorable) {
+    await restoreToVersion(net, repo.id, outcome.pipe.preApplyVersionId as string, caps);
+  }
+
+  info(dim('   re-read from the pipe after the revert — files and baseline reflect what actually landed'));
+};