apply

Apply the planned changes to your cloud provider. Creates, updates, replaces, and destroys resources as needed.

Usage

kyku apply [options]

Options

Flag	Default	Description
-e, --env <environment>	default	Environment workspace
-c, --config <path>	./infrastructure.ts	Path to config file
--auto-approve	false	Skip confirmation prompt
--dry-run	false	Show plan without making changes
-p, --passphrase <phrase>	—	Passphrase for encrypted state
--plan <path>	—	Load plan from a file
--force-stale-plan	false	Apply a saved plan even if state serial or config hash no longer match
--target <selector>	—	Apply matching resources and their dependency ancestors. Repeatable. Selector is an exact id, an id glob (vm-*), or tags.key=value on resource.tags.
--exclude <selector>	—	Omit matching resources. Errors if anything left in the graph still depends on them. Same selector forms as --target.
--no-auto-rollback	false	Leave partial state in place if apply fails. Default is to restore the pre-apply backup (state only — leftover cloud resources are not destroyed).
--rollback-destroy	false	After a failed apply restores state, destroy leftover cloud resources that have a verified providerId. Prompt unless --auto-approve. Unverified ids stay ORPHAN.

Examples

# Apply with confirmation prompt
kyku apply

# Apply automatically (skip prompt)
kyku apply --auto-approve

# Apply to production
kyku apply --env=prod --auto-approve

# Dry run — show plan without applying
kyku apply --dry-run

# Apply from a saved plan file
kyku plan --out plan.json
kyku apply --plan plan.json

# Override a stale plan file (serial or config hash mismatch)
kyku apply --plan plan.json --force-stale-plan --auto-approve

# Apply one resource and the things it depends on
kyku apply --target vm-web --auto-approve

# Apply every id matching a glob (each match still pulls in ancestors)
kyku apply --target 'vm-*' --auto-approve

# Apply resources tagged env=prod on resource.tags
kyku apply --target tags.env=prod --auto-approve

# Skip a resource (fails if something else still depends on it)
kyku apply --exclude bucket-old --auto-approve

# Apply with a passphrase for state decryption
kyku apply --passphrase "your-secure-passphrase"

Behavior

• Resources are created/updated in dependency order (roots first)
• Independent resources are created concurrently (controlled by --parallelism)
• Replace is destroy-then-create
• Destroy order is reverse of create order (leaves first)
• State is encrypted and saved after each change
• If any planned replace is caused by a create-only customConfig field rather than a portable field change, the confirmation prompt calls it out separately and requires typing replace to proceed, in addition to the normal [y/N] prompt — a config value causing a destroy-and-recreate is easy to miss in a longer plan otherwise. Skipped entirely under --auto-approve, same as the rest of the confirmation flow.
• A saved --plan file is schema-validated on load. Invalid JSON or a missing stateSerial / stateLineage / configHash prints a clear error (exit 1), never a stack trace.
• After a successful apply the state serial increments, so applying the same file again is refused unless you pass --force-stale-plan. A config edit after plan --out is also refused (hash mismatch).
• --target / --exclude scope the change set the same way as kyku plan (exact id, id glob, or tags.key=value). Applying a targeted plan leaves state for omitted resources unchanged and prints a drift warning. kyku destroy --target uses the same selectors but expands dependents (the reverse of plan/apply).
• A failed apply restores the pre-apply state backup when at least one mutation was persisted (SIGINT after persist included). Leftover cloud resources are printed as ORPHAN and are not destroyed unless you pass --rollback-destroy (verified providerId only, reverse dependency order, same retry/verify as destroy). --auto-approve skips the leftover-destroy prompt. Pass --no-auto-rollback to leave partial state in place; kyku rollback can still restore the backup later.

Progress Display

Kyku shows real-time progress with resource name, action, and status (running/done/failed). Failed resources don’t block other independent resources but the overall apply is marked as failed.

Exit Codes

Code	Meaning
0	Success / no changes
1	General error
3	Apply failed
4	Canceled by user