@m-kopa/launchpad-cli 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -6,6 +6,50 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.24.0 — 2026-06-11
+
+### Changed
+
+- **`launchpad status` is truthful for ALL deploy mechanisms** (sp-devlp1 AC6).
+  Status now reads the app's LIVE Cloudflare Pages deployment state via the
+  bot's new `/apps/<slug>/deployment-status` endpoint: last deployment time,
+  its trigger (git push vs `launchpad deploy`), and the build outcome. An app
+  that deploys via CF Pages native git integration (push-to-main) reports
+  `live — content deployed via git push` instead of the misleading
+  "no content deployed" (the sp-gitst1 incident class). `--json` carries a
+  `deployment` block and the new `live_content_untracked` state.
+- **Failed builds are visible** (sp-devlp1 AC7). When the latest production
+  build failed, `launchpad status` shows the failed stage, a build-log
+  excerpt (proxied via the bot), what is still serving, and the CLI next
+  step — killing the sp-reloc1 silent-failed-build class. In-progress builds
+  say so. `launchpad deploy` (bundle path) and `launchpad merge` end with an
+  explicit "build pending — run `launchpad status`" handoff.
+- **`launchpad pull`'s "no content deployed" claim comes from the live
+  source** (AC6): an app with live git-integration content gets a truthful
+  "has live content; deploys outside `launchpad deploy`" message.
+- **Error messages never direct you at resources you can't access** (AC8).
+  Reworded messages that pointed at the Cloudflare dashboard / GitHub PR
+  page; every failure path names a CLI command (or local file fix) as the
+  next step, enforced by a message-catalogue audit test.
+
+### Added
+
+- **App-boundary allowlist bundling** (sp-devlp1 / AC4 + AC5). Both deploy
+  paths (Model A CWD bundle + the content-PR path) filter the file list
+  through the engine's app-boundary contract: with an `app:` block in
+  `launchpad.yaml`, ONLY the declared app ships; without one, the whole
+  tree minus the platform deny-list ships (compat) and stripped files are
+  warned. `.launchpadignore` (repo root, gitignore subset, no `!`) adds
+  excludes. The build-inputs check fails a deploy whose `build.command`
+  references inputs missing from the bundle (sp-reloc1 class).
+- **`launchpad validate` boundary checks**: warns to declare `app:` on
+  pre-contract manifests, surfaces the strips the next deploy would
+  perform, and exits 1 on declared-contract deny-list hits or confident
+  build-input misses. `--json` gains an `appBoundary` block.
+- **`launchpad init` emits the `app:` contract explicitly** (root `.` +
+  the per-appType default include list) so new manifests never rely on
+  the inferred fallback.
+
 ## 0.23.0 — 2026-06-11
 
 ### Changed

package/dist/bundle/boundary.d.ts

@@ -0,0 +1,26 @@
+export type BoundaryFilterResult = {
+    kind: "ok";
+    /** The post-boundary bundle file list (repo-relative, sorted). */
+    files: readonly string[];
+    /** Stripped-file notices (inferred mode) — surface to the user. */
+    warnings: readonly string[];
+    /** True when the manifest declares no `app:` block. */
+    inferred: boolean;
+} | {
+    kind: "error";
+    message: string;
+};
+export interface ApplyBoundaryArgs {
+    /** Repo root the relative `files` resolve against. */
+    readonly cwd: string;
+    /** Raw `launchpad.yaml` bytes, or null when absent/unreadable. */
+    readonly manifestYaml: string | null;
+    /** Candidate file list (from the walker / `git ls-files`). */
+    readonly files: readonly string[];
+}
+/**
+ * Filter a candidate bundle file list through the app-boundary
+ * contract. See module header for the severity policy.
+ */
+export declare function applyBoundaryToFiles(args: ApplyBoundaryArgs): BoundaryFilterResult;
+//# sourceMappingURL=boundary.d.ts.map

package/dist/bundle/boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../../src/bundle/boundary.ts"],"names":[],"mappings":"AAuCA,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,IAAI,CAAC;IACX,kEAAkE;IAClE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mEAAmE;IACnE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,EAAE,OAAO,CAAC;CACnB,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,oBAAoB,CA8FlF"}

package/dist/bundle/orchestrate.d.ts

@@ -12,6 +12,9 @@ export type BundleAndDeployResult = {
 } | {
     kind: "no-manifest";
     message: string;
+} | {
+    kind: "boundary-error";
+    message: string;
 } | {
     kind: "pack-error";
     message: string;
@@ -32,6 +35,8 @@ export type BundleAndDeployResult = {
     compressedBytes: number;
     /** The cron Worker script name that was built + shipped, if any. */
     workerScript: string | null;
+    /** App-boundary strip notices (pre-contract manifests) — surface to the user. */
+    boundaryWarnings: readonly string[];
 };
 /**
  * Bundle the user's CWD and ship it to the bot.

package/dist/bundle/orchestrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrate.d.ts","sourceRoot":"","sources":["../../src/bundle/orchestrate.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGtE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvD;IACE,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAoFhC"}
+{"version":3,"file":"orchestrate.d.ts","sourceRoot":"","sources":["../../src/bundle/orchestrate.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAItE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvD;IACE,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAkGhC"}