@solidnumber/cli 2.17.0 → 2.18.0

package/dist/commands/apply.d.ts

@@ -10,8 +10,18 @@
  *
  *   solid apply infra.yaml
  *   solid apply infra.yaml --dry-run        # plan only, no writes
+ *   solid apply infra.yaml --strict         # refuse if production moved since the last apply
  *   solid apply infra.yaml --prune --yes    # also delete unmanaged resources
  *   solid apply --kinds                      # list supported kinds
+ *
+ *   solid apply drift infra.yaml             # three-way: manifest vs lock vs production
+ *   solid apply rollback infra.yaml          # revert the last run from its recorded pre-images
+ *   solid apply history infra.yaml           # the runs the lock remembers
+ *   solid apply export business.yaml         # write the live tenant as a manifest
+ *
+ * Every non-dry-run apply writes `<manifest>.lock.json` beside the manifest:
+ * server ids, the managed fields as applied, and a pre-image for every write.
+ * Commit it with the manifest — it is what drift and rollback read.
  */
 import { Command } from 'commander';
 export declare const applyCommand: Command;

package/dist/commands/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/commands/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBpC,eAAO,MAAM,YAAY,SA+GrB,CAAC"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/commands/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0IpC,eAAO,MAAM,YAAY,SAiHrB,CAAC"}

package/dist/commands/apply.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -16,108 +49,230 @@ exports.applyCommand = void 0;
  *
  *   solid apply infra.yaml
  *   solid apply infra.yaml --dry-run        # plan only, no writes
+ *   solid apply infra.yaml --strict         # refuse if production moved since the last apply
  *   solid apply infra.yaml --prune --yes    # also delete unmanaged resources
  *   solid apply --kinds                      # list supported kinds
+ *
+ *   solid apply drift infra.yaml             # three-way: manifest vs lock vs production
+ *   solid apply rollback infra.yaml          # revert the last run from its recorded pre-images
+ *   solid apply history infra.yaml           # the runs the lock remembers
+ *   solid apply export business.yaml         # write the live tenant as a manifest
+ *
+ * Every non-dry-run apply writes `<manifest>.lock.json` beside the manifest:
+ * server ids, the managed fields as applied, and a pre-image for every write.
+ * Commit it with the manifest — it is what drift and rollback read.
  */
 const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
-const node_fs_1 = require("node:fs");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const yaml = __importStar(require("js-yaml"));
 const api_client_1 = require("../lib/api-client");
+const config_1 = require("../lib/config");
 const json_output_1 = require("../lib/json-output");
 const command_kit_1 = require("../lib/command-kit");
 const dry_run_1 = require("../lib/dry-run");
+const tenant_guard_1 = require("../lib/tenant-guard");
 const engine_1 = require("../lib/apply/engine");
 const registry_1 = require("../lib/apply/registry");
+const lock_1 = require("../lib/apply/lock");
 const ICON = {
     create: chalk_1.default.green('+ create'),
     update: chalk_1.default.yellow('~ update'),
     noop: chalk_1.default.dim('= unchanged'),
     prune: chalk_1.default.red('- prune'),
-    unsupported: chalk_1.default.magenta('! immutable'),
+    unsupported: chalk_1.default.magenta('! unsupported'),
 };
-exports.applyCommand = new commander_1.Command('apply')
-    .description('Reconcile the company to a declarative manifest (create/update/prune)')
-    .argument('[file]', 'Manifest file (YAML or JSON). Use "-" for stdin.')
-    .option('--dry-run', 'Show the plan without making any changes')
-    .option('--prune', 'Delete managed resources that are absent from the manifest')
-    .option('--yes', 'Skip the confirmation prompt (required for --prune in non-interactive use)')
-    .option('--json', 'Machine-readable plan/result')
-    .option('--kinds', 'List the resource kinds apply supports, then exit')
-    .action(async (file, options) => {
-    if (options.kinds) {
-        const kinds = (0, registry_1.knownKinds)();
-        if ((0, json_output_1.isJsonOutput)(options))
-            return void (0, json_output_1.emitJson)({ kinds });
-        console.log(chalk_1.default.bold('Supported kinds:'));
-        for (const k of kinds)
-            console.log(`  ${k}`);
-        return;
+const DRIFT_ICON = {
+    in_sync: chalk_1.default.dim('= in sync'),
+    manifest_changed: chalk_1.default.yellow('~ manifest changed'),
+    live_changed: chalk_1.default.red('! production changed'),
+    conflict: chalk_1.default.red('!! conflict'),
+    missing: chalk_1.default.magenta('? missing on server'),
+    never_applied: chalk_1.default.dim('· never applied'),
+    removed_from_manifest: chalk_1.default.yellow('- removed from manifest'),
+};
+function cliVersion() {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8')).version;
     }
-    (0, command_kit_1.requireCompanyContext)();
-    if (!file) {
-        console.error(chalk_1.default.red('Missing manifest file. Usage: solid apply <file> (or "-" for stdin).'));
-        process.exit(2);
+    catch {
+        return 'unknown';
     }
+}
+function readManifest(file) {
     let text;
     try {
-        text = file === '-' ? (0, node_fs_1.readFileSync)(0, 'utf8') : (0, node_fs_1.readFileSync)(file, 'utf8');
+        text = file === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(file, 'utf8');
     }
     catch (e) {
         console.error(chalk_1.default.red(`Cannot read manifest: ${e instanceof Error ? e.message : String(e)}`));
         process.exit(2);
     }
-    let resources;
     try {
-        resources = (0, engine_1.parseManifest)(text);
+        return (0, engine_1.parseManifest)(text);
     }
     catch (e) {
         console.error(chalk_1.default.red(`Invalid manifest: ${e instanceof Error ? e.message : String(e)}`));
         process.exit(2);
     }
-    if (resources.length === 0) {
-        console.error(chalk_1.default.yellow('Manifest declares no resources.'));
-        process.exit(0);
-    }
-    const dryRun = !!options.dryRun || (0, dry_run_1.isDryRun)();
-    // Group by kind so we fetch each collection's current state once.
+}
+function groupByKind(resources) {
     const byKind = new Map();
     for (const r of resources) {
         const arr = byKind.get(r.kind) ?? [];
         arr.push(r);
         byKind.set(r.kind, arr);
     }
-    const allActions = [];
-    const planByKind = [];
+    return byKind;
+}
+async function fetchLive(kinds, json) {
+    const live = new Map();
     try {
-        for (const [kind, desired] of byKind) {
-            const recon = (0, registry_1.reconcilerFor)(kind); // parseManifest already validated
+        for (const kind of kinds) {
+            const recon = (0, registry_1.reconcilerFor)(kind);
             const resp = await api_client_1.apiClient.get(recon.list);
-            const current = (0, engine_1.extractList)(resp.data, recon);
-            const actions = (0, engine_1.planKind)(recon, desired, current, { prune: options.prune });
-            planByKind.push({ kind, actions });
-            allActions.push(...actions);
+            live.set(kind, { recon, items: (0, engine_1.extractList)(resp.data, recon) });
         }
     }
     catch (e) {
         const err = (0, api_client_1.handleApiError)(e);
-        if ((0, json_output_1.isJsonOutput)(options)) {
+        if (json) {
             (0, json_output_1.emitJson)({ error: err.message });
             process.exit(1);
         }
         console.error(chalk_1.default.red(`Failed to read current state: ${err.message}`));
         process.exit(1);
     }
+    return live;
+}
+/** Lock handling for a manifest path: null when the manifest is stdin or --no-lock. */
+function lockFor(file, useLock, json) {
+    if (!useLock || file === '-')
+        return null;
+    const lockPath = (0, lock_1.lockPathFor)(path.resolve(file));
+    if ((0, tenant_guard_1.isProtectedRoot)(path.dirname(lockPath))) {
+        // Never write tenant state into $HOME or the platform monorepo.
+        if (!json)
+            (0, tenant_guard_1.refuseProtectedRoot)(path.dirname(lockPath));
+        (0, json_output_1.emitJson)({ error: 'refusing to write a lockfile in a protected directory; use --no-lock or move the manifest' });
+        process.exit(1);
+    }
+    try {
+        return { path: lockPath, lock: (0, lock_1.readLock)(lockPath) };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (json) {
+            (0, json_output_1.emitJson)({ error: msg });
+            process.exit(1);
+        }
+        console.error(chalk_1.default.red(msg));
+        process.exit(1);
+    }
+}
+function printResults(results) {
+    for (const r of results) {
+        const tag = ICON[r.action] ?? r.action;
+        const suffix = r.status === 'failed' ? chalk_1.default.red(`  FAILED: ${r.error}`)
+            : r.reason ? chalk_1.default.dim(`  (${r.reason})`) : '';
+        console.log(`  ${tag}  ${chalk_1.default.cyan(r.kind)}/${r.identity}${suffix}`);
+    }
+}
+function printDrift(entries) {
+    for (const e of entries) {
+        console.log(`  ${DRIFT_ICON[e.state]}  ${chalk_1.default.cyan(e.kind)}/${e.identity}`);
+        for (const d of e.live_diff ?? []) {
+            console.log(chalk_1.default.dim(`      ${d.field}: applied ${JSON.stringify(d.lock)} → production ${JSON.stringify(d.live)}`));
+        }
+        for (const d of e.manifest_diff ?? []) {
+            console.log(chalk_1.default.dim(`      ${d.field}: applied ${JSON.stringify(d.lock)} → manifest ${JSON.stringify(d.manifest)}`));
+        }
+    }
+}
+// ── solid apply <file> ───────────────────────────────────────────────────────
+exports.applyCommand = new commander_1.Command('apply')
+    .description('Reconcile the company to a declarative manifest (create/update/prune); drift, rollback, history, export')
+    // Parent flags (--json, --yes, --dry-run, --kinds) must not swallow the
+    // subcommands' own flags: `solid apply drift site.yaml --json` is drift's --json.
+    .enablePositionalOptions()
+    .argument('[file]', 'Manifest file (YAML or JSON). Use "-" for stdin.')
+    .option('--dry-run', 'Show the plan without making any changes')
+    .option('--prune', 'Delete managed resources that are absent from the manifest')
+    .option('--yes', 'Skip the prune confirmation')
+    .option('--strict', 'Refuse to write if production changed since the last apply (what `solid apply drift` reports)')
+    .option('--no-lock', 'Do not read or write <manifest>.lock.json')
+    .option('--json', 'Machine-readable plan/result')
+    .option('--kinds', 'List the resource kinds apply supports, then exit')
+    .action(async (file, options) => {
+    const json = (0, json_output_1.isJsonOutput)(options);
+    if (options.kinds) {
+        const kinds = (0, registry_1.knownKinds)();
+        if (json)
+            return void (0, json_output_1.emitJson)({ kinds });
+        console.log(chalk_1.default.bold('Supported kinds:'));
+        for (const k of kinds)
+            console.log(`  ${k}`);
+        return;
+    }
+    (0, command_kit_1.requireCompanyContext)();
+    if (!file) {
+        console.error(chalk_1.default.red('Missing manifest file. Usage: solid apply <file> (or "-" for stdin).'));
+        process.exit(2);
+    }
+    const resources = readManifest(file);
+    if (resources.length === 0) {
+        console.error(chalk_1.default.yellow('Manifest declares no resources.'));
+        process.exit(0);
+    }
+    const dryRun = !!options.dryRun || (0, dry_run_1.isDryRun)();
+    const lockState = lockFor(file, options.lock !== false, json);
+    const byKind = groupByKind(resources);
+    const live = await fetchLive(byKind.keys(), json);
+    // --strict: production must be where the last apply left it, or we do nothing.
+    let drift;
+    if (options.strict) {
+        if (!lockState) {
+            const msg = '--strict needs a lockfile (manifest from a file, without --no-lock)';
+            if (json) {
+                (0, json_output_1.emitJson)({ error: msg });
+                process.exit(2);
+            }
+            console.error(chalk_1.default.red(msg));
+            process.exit(2);
+        }
+        drift = (0, lock_1.classifyDrift)(resources, lockState.lock, live);
+        const moved = drift.filter(lock_1.isProductionDrift);
+        if (moved.length > 0 && !dryRun) {
+            if (json) {
+                (0, json_output_1.emitJson)({ error: 'production changed since the last apply', drift: moved });
+                process.exit(3);
+            }
+            console.error(chalk_1.default.red(`Refusing to apply: ${moved.length} resource(s) changed in production since the last apply.`));
+            printDrift(moved);
+            console.error(chalk_1.default.dim('Re-apply without --strict to overwrite production, or update the manifest to match it.'));
+            process.exit(3);
+        }
+    }
+    const allActions = [];
+    const planByKind = [];
+    for (const [kind, desired] of byKind) {
+        const { recon, items } = live.get(kind);
+        const actions = (0, engine_1.planKind)(recon, desired, items, { prune: options.prune });
+        planByKind.push({ kind, actions });
+        allActions.push(...actions);
+    }
     const changes = allActions.filter((a) => a.action === 'create' || a.action === 'update' || a.action === 'prune');
     const prunes = allActions.filter((a) => a.action === 'prune');
     // Confirm destructive prunes before any write (unless --yes / --dry-run / --json).
-    if (!dryRun && prunes.length > 0 && !options.yes && !(0, json_output_1.isJsonOutput)(options)) {
+    if (!dryRun && prunes.length > 0 && !options.yes && !json) {
         const ok = await (0, command_kit_1.confirm)(`Prune ${prunes.length} resource(s)? This deletes them.`);
         if (!ok) {
             console.error(chalk_1.default.yellow('Aborted.'));
             process.exit(1);
         }
     }
-    if (!dryRun && prunes.length > 0 && !options.yes && (0, json_output_1.isJsonOutput)(options)) {
+    if (!dryRun && prunes.length > 0 && !options.yes && json) {
         (0, json_output_1.emitJson)({ error: 'Refusing to prune without --yes in non-interactive/json mode', prunes: prunes.length });
         process.exit(1);
     }
@@ -127,23 +282,253 @@ exports.applyCommand = new commander_1.Command('apply')
         results.push(...(await (0, engine_1.executePlan)(api_client_1.apiClient, recon, actions, dryRun)));
     }
     const counts = (0, engine_1.tallyResults)(results);
-    if ((0, json_output_1.isJsonOutput)(options)) {
-        return void (0, json_output_1.emitJson)({ dryRun, counts, actions: results });
+    let lockWritten;
+    let runId;
+    if (!dryRun && lockState) {
+        const base = lockState.lock ?? (0, lock_1.emptyLock)(config_1.config.companyId, file, cliVersion());
+        const merged = (0, lock_1.mergeRun)(base, results, { cliVersion: cliVersion() });
+        (0, lock_1.writeLock)(lockState.path, merged.lock);
+        lockWritten = lockState.path;
+        runId = merged.run.run_id;
     }
-    for (const r of results) {
-        const tag = ICON[r.action] ?? r.action;
-        const suffix = r.status === 'failed' ? chalk_1.default.red(`  FAILED: ${r.error}`)
-            : r.reason ? chalk_1.default.dim(`  (${r.reason})`) : '';
-        console.log(`  ${tag}  ${chalk_1.default.cyan(r.kind)}/${r.identity}${suffix}`);
+    if (json) {
+        return void (0, json_output_1.emitJson)({ dryRun, counts, actions: results, lock: lockWritten ?? null, run_id: runId ?? null, drift: drift ?? undefined });
     }
+    printResults(results);
     const verb = dryRun ? 'Plan' : 'Applied';
     console.log(`\n${chalk_1.default.bold(verb)}: ${counts.create} to create, ${counts.update} to update, ` +
         `${counts.noop} unchanged, ${counts.prune} to prune` +
         (counts.failed ? chalk_1.default.red(`, ${counts.failed} failed`) : '') +
-        (counts.unsupported ? chalk_1.default.magenta(`, ${counts.unsupported} immutable`) : ''));
+        (counts.unsupported ? chalk_1.default.magenta(`, ${counts.unsupported} unsupported`) : ''));
     if (dryRun && changes.length > 0)
         console.log(chalk_1.default.dim('Run without --dry-run to apply.'));
+    if (lockWritten)
+        console.log(chalk_1.default.dim(`Lock: ${path.relative(process.cwd(), lockWritten)}  run ${runId}`));
     if (counts.failed > 0)
         process.exit(1);
 });
+// ── solid apply drift <file> ─────────────────────────────────────────────────
+exports.applyCommand
+    .command('drift')
+    .description('Three-way comparison: manifest (git) vs lock (last apply) vs production. Exit 1 when production moved.')
+    .argument('<file>', 'Manifest file')
+    .option('--fail-on-any', 'Also exit 1 for manifest changes, missing and never-applied resources')
+    .option('--json', 'Machine-readable report')
+    .action(async (file, options) => {
+    const json = (0, json_output_1.isJsonOutput)(options);
+    (0, command_kit_1.requireCompanyContext)();
+    const resources = readManifest(file);
+    const lockPath = (0, lock_1.lockPathFor)(path.resolve(file));
+    let lock = null;
+    try {
+        lock = (0, lock_1.readLock)(lockPath);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (json) {
+            (0, json_output_1.emitJson)({ error: msg });
+            process.exit(1);
+        }
+        console.error(chalk_1.default.red(msg));
+        process.exit(1);
+    }
+    const live = await fetchLive(groupByKind(resources).keys(), json);
+    const entries = (0, lock_1.classifyDrift)(resources, lock, live);
+    const production = entries.filter(lock_1.isProductionDrift);
+    const pending = entries.filter((e) => !(0, lock_1.isProductionDrift)(e) && e.state !== 'in_sync');
+    const code = production.length > 0 ? 1 : (options.failOnAny && pending.length > 0 ? 1 : 0);
+    if (json) {
+        (0, json_output_1.emitJson)({
+            lock: lock ? path.relative(process.cwd(), lockPath) : null,
+            last_applied: lock?.applied_at ?? null,
+            production_drift: production.length, pending: pending.length,
+            entries,
+        });
+        process.exit(code);
+    }
+    if (!lock)
+        console.log(chalk_1.default.yellow(`No lockfile at ${path.relative(process.cwd(), lockPath)} — nothing has been applied from this manifest yet, so there is no baseline.`));
+    else
+        console.log(chalk_1.default.dim(`Baseline: ${path.relative(process.cwd(), lockPath)} (applied ${lock.applied_at})`));
+    printDrift(entries);
+    console.log(`\n${chalk_1.default.bold('Drift')}: ${production.length} changed in production, ${pending.length} pending from git, ` +
+        `${entries.filter((e) => e.state === 'in_sync').length} in sync`);
+    if (production.length)
+        console.log(chalk_1.default.dim('Production moved since the last apply. `solid apply <file>` overwrites it; update the manifest to keep it.'));
+    process.exit(code);
+});
+// ── solid apply rollback <file> ──────────────────────────────────────────────
+exports.applyCommand
+    .command('rollback')
+    .description('Revert a recorded run from its pre-images, most recent write first, then verify. Ordered, not atomic.')
+    .argument('<file>', 'Manifest file (its lock holds the runs)')
+    .option('--run <id>', 'Run to revert (default: the last apply run)')
+    .option('--dry-run', 'Show the revert plan without writing')
+    .option('--yes', 'Skip confirmation')
+    .option('--json', 'Machine-readable result')
+    .action(async (file, options) => {
+    const json = (0, json_output_1.isJsonOutput)(options);
+    (0, command_kit_1.requireCompanyContext)();
+    const lockState = lockFor(file, true, json);
+    if (!lockState.lock || lockState.lock.runs.length === 0) {
+        const msg = `No runs recorded in ${path.relative(process.cwd(), lockState.path)} — nothing to roll back.`;
+        if (json) {
+            (0, json_output_1.emitJson)({ error: msg });
+            process.exit(1);
+        }
+        console.error(chalk_1.default.yellow(msg));
+        process.exit(1);
+    }
+    const lock = lockState.lock;
+    const run = options.run
+        ? lock.runs.find((r) => r.run_id === options.run)
+        : [...lock.runs].reverse().find((r) => r.kind === 'apply' && r.actions.length > 0);
+    if (!run) {
+        const msg = options.run ? `Run ${options.run} not found; see \`solid apply history ${file}\`` : 'No apply run with writes to revert.';
+        if (json) {
+            (0, json_output_1.emitJson)({ error: msg });
+            process.exit(1);
+        }
+        console.error(chalk_1.default.red(msg));
+        process.exit(1);
+    }
+    const dryRun = !!options.dryRun || (0, dry_run_1.isDryRun)();
+    const { actions, skipped } = (0, lock_1.buildRollbackPlan)(run, registry_1.reconcilerFor);
+    if (!json) {
+        console.log(chalk_1.default.bold(`Reverting run ${run.run_id} (${run.at}) — ${actions.length} action(s)` + (skipped.length ? `, ${skipped.length} not revertible` : '')));
+        for (const a of actions)
+            console.log(`  ${ICON[a.action]}  ${chalk_1.default.cyan(a.kind)}/${a.identity}`);
+        for (const s of skipped)
+            console.log(`  ${chalk_1.default.magenta('! skip')}  ${chalk_1.default.cyan(s.kind)}/${s.identity}  ${chalk_1.default.dim(`(${s.reason})`)}`);
+    }
+    if (actions.length === 0) {
+        if (json)
+            return void (0, json_output_1.emitJson)({ run_id: run.run_id, dryRun, actions: [], skipped });
+        console.log(chalk_1.default.yellow('\nNothing revertible in this run.'));
+        return;
+    }
+    if (!dryRun && !options.yes) {
+        if (json) {
+            (0, json_output_1.emitJson)({ error: 'Refusing to roll back without --yes in json mode', run_id: run.run_id, actions, skipped });
+            process.exit(1);
+        }
+        const ok = await (0, command_kit_1.confirm)(`Revert ${actions.length} write(s) on production?`);
+        if (!ok) {
+            console.error(chalk_1.default.yellow('Aborted.'));
+            process.exit(1);
+        }
+    }
+    // Execute per kind, preserving reverse order within the run.
+    const results = [];
+    for (const a of actions) {
+        const recon = (0, registry_1.reconcilerFor)(a.kind);
+        results.push(...(await (0, engine_1.executePlan)(api_client_1.apiClient, recon, [a], dryRun)));
+    }
+    // Verification pass: re-read and check each reverted update now matches its target.
+    const verified = [];
+    if (!dryRun) {
+        const live = await fetchLive(new Set(actions.map((a) => a.kind)), json);
+        for (const a of actions) {
+            if (a.action !== 'update' || !a.spec)
+                continue;
+            const { recon, items } = live.get(a.kind);
+            const item = items.find((i) => String(i[recon.identity]) === a.identity);
+            const ok = !!item && Object.keys(a.spec).every((k) => JSON.stringify(item[k] ?? null) === JSON.stringify(a.spec[k] ?? null));
+            verified.push({ kind: a.kind, identity: a.identity, ok });
+        }
+        const merged = (0, lock_1.mergeRun)(lock, results, { cliVersion: cliVersion(), kind: 'rollback', reverts: run.run_id });
+        (0, lock_1.writeLock)(lockState.path, merged.lock);
+    }
+    const counts = (0, engine_1.tallyResults)(results);
+    const failedVerify = verified.filter((v) => !v.ok);
+    if (json) {
+        (0, json_output_1.emitJson)({ reverted: run.run_id, dryRun, counts, actions: results, skipped, verified });
+        process.exit(counts.failed || failedVerify.length ? 1 : 0);
+    }
+    console.log();
+    printResults(results);
+    for (const v of verified)
+        console.log(`  ${v.ok ? chalk_1.default.green('✓ verified') : chalk_1.default.red('✗ mismatch')}  ${chalk_1.default.cyan(v.kind)}/${v.identity}`);
+    console.log(`\n${chalk_1.default.bold(dryRun ? 'Revert plan' : 'Reverted')}: ${counts.create} recreated, ${counts.update} restored, ${counts.prune} removed` +
+        (counts.failed ? chalk_1.default.red(`, ${counts.failed} failed`) : '') + (failedVerify.length ? chalk_1.default.red(`, ${failedVerify.length} did not verify`) : ''));
+    if (!dryRun)
+        console.log(chalk_1.default.dim('Rollback is ordered and verified, not atomic: a failure above leaves earlier reverts in place.'));
+    if (counts.failed || failedVerify.length)
+        process.exit(1);
+});
+// ── solid apply history <file> ───────────────────────────────────────────────
+exports.applyCommand
+    .command('history')
+    .description('Runs recorded in the lockfile (what each apply or rollback wrote)')
+    .argument('<file>', 'Manifest file')
+    .option('--json', 'Machine-readable list')
+    .action((file, options) => {
+    const json = (0, json_output_1.isJsonOutput)(options);
+    const lockPath = (0, lock_1.lockPathFor)(path.resolve(file));
+    let lock = null;
+    try {
+        lock = (0, lock_1.readLock)(lockPath);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (json) {
+            (0, json_output_1.emitJson)({ error: msg });
+            process.exit(1);
+        }
+        console.error(chalk_1.default.red(msg));
+        process.exit(1);
+    }
+    if (json)
+        return void (0, json_output_1.emitJson)({ lock: lock ? path.relative(process.cwd(), lockPath) : null, runs: lock?.runs ?? [], resources: Object.keys(lock?.resources ?? {}).length });
+    if (!lock) {
+        console.log(chalk_1.default.yellow(`No lockfile at ${path.relative(process.cwd(), lockPath)}.`));
+        return;
+    }
+    console.log(chalk_1.default.dim(`${path.relative(process.cwd(), lockPath)} — ${Object.keys(lock.resources).length} resource(s) tracked, company ${lock.company_id}`));
+    for (const r of lock.runs) {
+        const c = { create: 0, update: 0, prune: 0 };
+        for (const a of r.actions)
+            c[a.action]++;
+        const tag = r.kind === 'rollback' ? chalk_1.default.yellow(`rollback of ${r.reverts}`) : chalk_1.default.green('apply');
+        console.log(`  ${r.run_id}  ${r.at}  ${tag}  +${c.create} ~${c.update} -${c.prune}  ${chalk_1.default.dim(`cli ${r.cli_version}`)}`);
+    }
+});
+// ── solid apply export [file] ────────────────────────────────────────────────
+exports.applyCommand
+    .command('export')
+    .description('Write the live tenant as an apply manifest (all kinds, or --kinds a,b)')
+    .argument('[file]', 'Output file (default: stdout)')
+    .option('--kinds <list>', 'Comma-separated kinds to export (default: all)')
+    .option('--json', 'Emit JSON instead of YAML')
+    .action(async (file, options) => {
+    const json = (0, json_output_1.isJsonOutput)(options);
+    (0, command_kit_1.requireCompanyContext)();
+    const kinds = options.kinds ? options.kinds.split(',').map((k) => k.trim()).filter(Boolean) : (0, registry_1.knownKinds)();
+    const unknown = kinds.filter((k) => !(0, registry_1.reconcilerFor)(k));
+    if (unknown.length) {
+        console.error(chalk_1.default.red(`Unknown kind(s): ${unknown.join(', ')} — see \`solid apply --kinds\``));
+        process.exit(2);
+    }
+    if (file)
+        (0, tenant_guard_1.refuseProtectedRoot)(path.dirname(path.resolve(file)));
+    const live = await fetchLive(kinds, json);
+    const docs = [];
+    for (const kind of kinds) {
+        const { recon, items } = live.get(kind);
+        for (const item of items)
+            docs.push({ kind, spec: (0, lock_1.shapeForExport)(recon, item) });
+    }
+    const text = json
+        ? JSON.stringify({ resources: docs.map((d) => ({ kind: d.kind, ...d.spec })) }, null, 2) + '\n'
+        : (0, lock_1.toManifestYaml)(docs, (o) => yaml.dump(o, { lineWidth: 120, noRefs: true }));
+    if (file) {
+        fs.writeFileSync(file, text);
+        if (json)
+            return void (0, json_output_1.emitJson)({ file, resources: docs.length, kinds });
+        console.log(chalk_1.default.green(`Wrote ${docs.length} resource(s) across ${kinds.length} kind(s) to ${file}`));
+        console.log(chalk_1.default.dim('Review before applying elsewhere: per-company ids (agent_id, site_id) do not travel between tenants.'));
+        return;
+    }
+    process.stdout.write(text);
+});
 //# sourceMappingURL=apply.js.map