@m-kopa/launchpad-cli 0.23.0

package/dist/commands/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/commands/rollback.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,eAAe,EAAE,OAI7B,CAAC"}

package/dist/commands/secrets-template.d.ts

@@ -0,0 +1,3 @@
+import type { CliIo, ExitCode } from "../dispatcher.js";
+export declare function runSecretsTemplate(args: readonly string[], io: CliIo): Promise<ExitCode>;
+//# sourceMappingURL=secrets-template.d.ts.map

package/dist/commands/secrets-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-template.d.ts","sourceRoot":"","sources":["../../src/commands/secrets-template.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgBxD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}

package/dist/commands/secrets.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "../dispatcher.js";
+export declare const secretsCommand: Command;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAgBjE,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC"}

package/dist/commands/skills.d.ts

@@ -0,0 +1,13 @@
+import type { Command } from "../dispatcher.js";
+export declare const skillsCommand: Command;
+interface InstallEnv {
+    readonly bundleDir: string;
+    readonly userSkillsDir: string;
+}
+/**
+ * Compute install paths. Factored out so tests can swap `homedir()`
+ * + the bundle dir via env without rewiring fs internals.
+ */
+export declare function resolveInstallEnv(): InstallEnv;
+export {};
+//# sourceMappingURL=skills.d.ts.map

package/dist/commands/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/commands/skills.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAoCjE,eAAO,MAAM,aAAa,EAAE,OAK3B,CAAC;AA2CF,UAAU,UAAU;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAQ9C"}

package/dist/commands/status.d.ts

@@ -0,0 +1,54 @@
+import { type Manifest } from "@m-kopa/launchpad-engine";
+import type { Command } from "../dispatcher.js";
+export declare const statusCommand: Command;
+interface StatusArgs {
+    readonly slug: string;
+    readonly file: string;
+    readonly json: boolean;
+    readonly strict: boolean;
+}
+/** What status reports, in machine-readable form for downstream
+ *  consumers (M-1187 destroy, M-1189 update-skill). The lifecycle states
+ *  (provisioning / provisioning_failed / live_no_content) were added by
+ *  sp-st5hw9; in_sync / drift / no_deployed_manifest are unchanged. */
+export interface StatusJsonOutput {
+    readonly state: "provisioning" | "provisioning_failed" | "live_no_content" | "in_sync" | "drift" | "no_deployed_manifest" | "destroying" | "destroyed" | "destroy_failed";
+    readonly slug: string;
+    /** Provisioning/failed only — the current (or failing) workflow stage. */
+    readonly stage?: string | null;
+    /** provisioning_failed only — the failure message. */
+    readonly failedReason?: string | null;
+    /** Provisioning/failed only — the workflow submission id. */
+    readonly submissionId?: string | null;
+    readonly deployedSha: string | null;
+    readonly headSha: string | null;
+    readonly hasOpenPr: boolean;
+    readonly openPrNumber: number | null;
+    /** Field paths that differ (e.g. ["metadata.owner", "production_env.API_BASE"]). */
+    readonly driftFields: readonly string[];
+    /** Per-field detail: local-value vs deployed-value for each drift field. */
+    readonly driftDetails: ReadonlyArray<{
+        readonly path: string;
+        readonly local: unknown;
+        readonly deployed: unknown;
+    }>;
+}
+/**
+ * Compute drift over the v1 closed field set (AC5).
+ *
+ * The visitor is hand-rolled (one switch per path) rather than a
+ * generic deep-diff. This is the implementation of the equivalence
+ * relation defined in M-1188 AC3: the v1 field set IS the contract;
+ * fields outside it are ignored.
+ *
+ * Returns an empty array iff `local` and `deployed` are equivalent.
+ */
+export declare function computeDrift(local: Manifest, deployed: Manifest): ReadonlyArray<{
+    path: string;
+    local: unknown;
+    deployed: unknown;
+}>;
+/** Pure arg parser. Exported for tests. */
+export declare function parseArgs(args: readonly string[], cwd?: string): StatusArgs | string;
+export {};
+//# sourceMappingURL=status.d.ts.map

package/dist/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAuBD;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB,GACjB,SAAS,GACT,OAAO,GACP,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;CACJ;AAwLD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAgJD,2CAA2C;AAC3C,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,GAC1B,UAAU,GAAG,MAAM,CAgErB"}

package/dist/commands/update.d.ts

@@ -0,0 +1,114 @@
+import { type ChannelUpdateResult } from "./channel-auth.js";
+import type { CliIo, Command, ExitCode } from "../dispatcher.js";
+/** Browser-based installer the platform channel directs users to for upgrades. */
+export declare const CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
+export type PackageManager = "npm" | "bun" | "pnpm";
+/** Which distribution channel installed this CLI (ADR 0014). */
+export type InstallChannel = "github" | "platform";
+/**
+ * Resolve a package-manager binary name for the current platform.
+ *
+ * On Windows, `npm` and `pnpm` are shipped as `.cmd` shims (there is
+ * no bare `npm.exe` / `pnpm.exe`). Node's `child_process.execFile` /
+ * `spawn` invoke `CreateProcess`, which does NOT consult `PATHEXT`
+ * — libuv tries only the literal filename and `<name>.exe`. So
+ * `execFile("npm", …)` fails with `ENOENT` on every Windows host,
+ * even when `npm` works perfectly from `cmd` / PowerShell (which DO
+ * consult `PATHEXT`). The user's `~$ launchpad update` then
+ * surfaced as "npm was not found on PATH" — misleading; npm is on
+ * PATH, libuv just won't resolve the shim (M-1056).
+ *
+ * Appending `.cmd` lets libuv find the shim — but finding it is
+ * necessary, not sufficient. `.cmd` is a batch script, not a PE
+ * binary; `CreateProcess` cannot execute it directly and fails the
+ * spawn with `EINVAL`. The shell wrapper supplied by
+ * `pmSpawnOptions` (below) is what actually runs the script — see
+ * that helper for the full story. `bun` ships as `bun.exe`, which
+ * libuv finds via its `.exe` fallback and `CreateProcess` can
+ * execute natively, so `bun` is left unchanged. Non-Windows
+ * platforms keep the bare name.
+ */
+export declare function resolvePmBin(pm: PackageManager): string;
+/**
+ * Spawn options needed to execute the resolved PM binary on the
+ * current platform. On Windows, `npm.cmd` / `pnpm.cmd` are batch
+ * scripts — even with the explicit `.cmd` suffix from `resolvePmBin`,
+ * `CreateProcess` cannot run them directly and fails with `EINVAL`.
+ * Going through `cmd.exe` via `shell: true` is the documented Node
+ * fix. Every arg passed to a PM in this file is hardcoded (PKG /
+ * REGISTRY / UPGRADE_ARGS / the literal subcommand strings), so no
+ * user input ever reaches the shell — `shell: true` is safe here.
+ */
+export declare function pmSpawnOptions(platform?: NodeJS.Platform): {
+    shell: boolean;
+};
+export declare const updateCommand: Command;
+export interface UpdateArgs {
+    readonly check: boolean;
+    readonly via: PackageManager | null;
+    readonly help: boolean;
+    /** Non-null when the argv was malformed (unknown flag / bad --via). */
+    readonly error: string | null;
+}
+/**
+ * Parse `launchpad update` argv. Supports `--check`, `--help`/`-h`,
+ * and `--via <pm>` / `--via=<pm>`. Anything else is an error.
+ */
+export declare function parseUpdateArgs(args: readonly string[]): UpdateArgs;
+/**
+ * Compare two `MAJOR.MINOR.PATCH` version strings. Pre-release and
+ * build metadata (anything after `-` or `+`) is stripped — the CLI
+ * publishes plain numeric versions. Returns -1 / 0 / 1 for
+ * a < b / a == b / a > b. Unparseable segments coerce to 0.
+ */
+export declare function compareVersions(a: string, b: string): -1 | 0 | 1;
+export type LatestResult = {
+    readonly kind: "ok";
+    readonly version: string;
+} | {
+    readonly kind: "auth";
+    readonly detail: string;
+} | {
+    readonly kind: "registry";
+    readonly detail: string;
+};
+export type { ChannelUpdateResult };
+export interface UpdateDeps {
+    readonly cliVersion: string;
+    /** Distribution channel this CLI was installed from (ADR 0014). */
+    readonly channel: InstallChannel;
+    readonly fetchLatestVersion: () => Promise<LatestResult>;
+    readonly detectPm: () => Promise<PackageManager | null>;
+    readonly runUpgrade: (pm: PackageManager) => Promise<number>;
+    /**
+     * Platform-channel self-update: authenticate to the Entra-OIDC gateway via
+     * the loopback CLI-auth grant (one browser bounce, no manual step; ADR 0023),
+     * fetch the staff-gated installer from get.launchpad.m-kopa.us with the
+     * short-lived bearer, and run it (the installer is self-contained and
+     * SHA-256 self-verifying — it `npm install -g`s the embedded package).
+     */
+    readonly runChannelInstaller: () => Promise<ChannelUpdateResult>;
+}
+/**
+ * Channel-aware "what is the latest published version" resolver, shared
+ * by the explicit `update` command and the passive startup notifier's
+ * background refresh (`update-notifier.ts`). Single source of truth for
+ * the channel→fetcher mapping so the notifier can never drift from what
+ * `update` itself reports.
+ */
+export declare function resolveLatestVersion(): Promise<LatestResult>;
+/**
+ * Which channel installed this CLI. The platform installer (M-1047)
+ * writes `~/.launchpad/channel` containing `platform`; a GitHub
+ * Packages install writes nothing. Absence — or any unreadable /
+ * unrecognised marker — resolves to `github`, the safe default that
+ * covers every install predating the platform channel.
+ */
+export declare function detectInstallChannel(): InstallChannel;
+/**
+ * Pure(ish) command core — all external effects arrive via `deps`,
+ * so unit tests drive every branch without touching the network or
+ * spawning a package manager.
+ */
+export declare function runUpdate(args: readonly string[], io: CliIo, deps: UpdateDeps): Promise<ExitCode>;
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAuDA,OAAO,EAA4B,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAWjE,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAYrE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAEpD,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AASnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,MAAM,CAGvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAEpB;AAED,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAIF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CA4BnE;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAiBhE;AAID,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAI3D,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAClE;AA0DD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,YAAY,CAAC,CAI5D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAQrD;AA0JD;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,QAAQ,CAAC,CAqGnB"}

package/dist/commands/validate.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "../dispatcher.js";
+export declare const validateCommand: Command;
+//# sourceMappingURL=validate.d.ts.map

package/dist/commands/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,eAAe,EAAE,OAI7B,CAAC"}

package/dist/commands/whoami.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "../dispatcher.js";
+export declare const whoamiCommand: Command;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAGjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,11 @@
+/** Production bot URL (Cloudflare Workers `*.workers.dev` host). */
+export declare const DEFAULT_BOT_URL = "https://launchpad-portal-bot.mkopa-launchpad.workers.dev";
+export interface CliConfig {
+    readonly botUrl: string;
+    readonly sessionPath: string;
+    readonly cacheDir: string;
+    readonly stateDir: string;
+    readonly platformRepoPath: string | null;
+}
+export declare function loadConfig(env?: NodeJS.ProcessEnv): CliConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA4CA,oEAAoE;AACpE,eAAO,MAAM,eAAe,6DACgC,CAAC;AAE7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAgB1E"}

package/dist/deploy/apply.d.ts

@@ -0,0 +1,29 @@
+import { type CliConfig } from "../config.js";
+import type { CliIo, ExitCode } from "../dispatcher.js";
+export interface ApplyOptions {
+    readonly file: string | null;
+    /** Refused with exit 64 — kept for one release of deprecation
+     *  visibility per AC-OC1. */
+    readonly platformRepo: string | null;
+    /** Accepted-but-ignored (group resolution is bot-side now).
+     *  Removal in v0.13 alongside `--platform-repo`. */
+    readonly rePin: boolean;
+    readonly yes: boolean;
+    /** Re-attach to an in-flight apply for `--resume <prNumber>`. */
+    readonly resumePrNumber?: number;
+    /** Override the 90-minute default polling timeout (AC-U2). */
+    readonly timeoutMinutes?: number;
+}
+export interface ApplyDeps {
+    readonly prompt?: (question: string) => Promise<string>;
+    readonly clock?: () => Date;
+    readonly config?: CliConfig;
+    /** Inject `fetch` for tests; defaults to `globalThis.fetch`. */
+    readonly fetcher?: typeof fetch;
+    /** Inject `git rev-parse` resolution for tests. */
+    readonly gitHeadSha?: (cwd: string) => string;
+    /** Polling interval seconds (defaults to 10s; tests use 0). */
+    readonly pollIntervalSeconds?: number;
+}
+export declare function runDeployApply(opts: ApplyOptions, io: CliIo, deps?: ApplyDeps): Promise<ExitCode>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/deploy/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/deploy/apply.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAwCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyLnB"}

package/dist/deploy/dry-run.d.ts

@@ -0,0 +1,13 @@
+import type { CliIo, ExitCode } from "../dispatcher.js";
+import type { CliConfig } from "../config.js";
+export interface DryRunOptions {
+    readonly file: string | null;
+    readonly json: boolean;
+}
+export interface DryRunDeps {
+    readonly config?: CliConfig;
+    readonly fetcher?: typeof fetch;
+    readonly gitHeadSha?: (cwd: string) => string;
+}
+export declare function runDeployDryRun(opts: DryRunOptions, io: CliIo, deps?: DryRunDeps): Promise<ExitCode>;
+//# sourceMappingURL=dry-run.d.ts.map

package/dist/deploy/dry-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dry-run.d.ts","sourceRoot":"","sources":["../../src/deploy/dry-run.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/C;AAgBD,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CAmEnB"}

package/dist/deploy/git-files.d.ts

@@ -0,0 +1,33 @@
+import { spawn } from "node:child_process";
+export declare class GitFilesError extends Error {
+    readonly code: "git_files_error";
+}
+/**
+ * Paths the bot owns and rejects unconditionally on `deploy-pr`
+ * (see `PROTECTED_PATHS` in `portal-bot/src/deploy-pr.ts`). Mirrored
+ * here so the CLI excludes them up front rather than shipping a
+ * tarball the bot will reject.
+ *
+ * The bot uses `base_tree` mode on the commit, so files we omit
+ * from the tarball keep their base-branch contents — there's no
+ * destructive consequence to filtering these out.
+ *
+ * Keep in lock-step with the bot's list. A future endpoint that
+ * exposes this list would let the CLI fetch it dynamically; for
+ * v1 the set is small and rarely changes.
+ */
+export declare const PROTECTED_PATHS: ReadonlySet<string>;
+export interface ListFilesOptions {
+    readonly cwd: string;
+    readonly spawner?: typeof spawn;
+}
+/**
+ * Return the deploy-eligible file paths under `cwd`, relative to
+ * `cwd`. Paths use forward slashes (git's native format) so they
+ * tar-pack cleanly cross-platform.
+ *
+ * Throws `GitFilesError` if git isn't installed or `cwd` isn't a
+ * git working tree.
+ */
+export declare function listDeployFiles(opts: ListFilesOptions): Promise<readonly string[]>;
+//# sourceMappingURL=git-files.d.ts.map

package/dist/deploy/git-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-files.d.ts","sourceRoot":"","sources":["../../src/deploy/git-files.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAU9C,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAqBxF"}

package/dist/deploy/group-pin.d.ts

@@ -0,0 +1,66 @@
+export interface GroupPin {
+    /** The manifest's `access.allowed_entra_group` at the moment of
+     *  pinning. Treated as a label; rename in Entra doesn't break
+     *  the pin. */
+    readonly pinnedName: string;
+    /** Entra Object ID UUID. The canonical identifier from this
+     *  pin onwards. */
+    readonly pinnedUuid: string;
+    /** ISO-8601 UTC timestamp of when the pin was written. */
+    readonly pinnedAt: string;
+}
+/**
+ * Read the per-app group pin. Returns `null` when the file is
+ * missing, malformed, or has the wrong shape — every "not a
+ * valid pin" state collapses to `null` so callers can branch
+ * on a single check.
+ */
+export declare function readGroupPin(stateDir: string, slug: string): GroupPin | null;
+/**
+ * Write the per-app group pin, creating the slug directory if
+ * needed. Throws if the write fails (apply needs to know).
+ */
+export declare function writeGroupPin(stateDir: string, slug: string, pin: GroupPin): void;
+/**
+ * Compare an existing pin against the manifest's current group
+ * name and a freshly-resolved UUID for that name. The four
+ * outcomes drive the apply verb's UX:
+ *
+ *   - `consistent`     — pin matches both the manifest's name
+ *                        AND the fresh resolution. Apply uses
+ *                        the pinned UUID unchanged.
+ *   - `manifest-renamed` — pin's UUID is still the right group
+ *                        but the manifest's name field has
+ *                        changed. Apply uses the pinned UUID;
+ *                        the manifest can be updated at the
+ *                        caller's leisure.
+ *   - `entra-renamed`  — manifest's name no longer resolves to
+ *                        the pinned UUID. Either the group was
+ *                        renamed in Entra (a fresh resolve of
+ *                        the manifest's name now returns a
+ *                        DIFFERENT UUID), or the operator
+ *                        intends to switch to a different group.
+ *                        Apply should surface this loudly and
+ *                        require explicit re-pin.
+ *   - `pin-missing`    — no pin yet. First-deploy case; apply
+ *                        writes the pin.
+ */
+export type PinComparison = {
+    kind: "pin-missing";
+} | {
+    kind: "consistent";
+    pinnedUuid: string;
+} | {
+    kind: "manifest-renamed";
+    pinnedUuid: string;
+    oldName: string;
+    newName: string;
+} | {
+    kind: "entra-renamed";
+    pinnedUuid: string;
+    pinnedName: string;
+    currentResolvedUuid: string;
+    manifestName: string;
+};
+export declare function comparePin(pin: GroupPin | null, manifestName: string, freshUuid: string): PinComparison;
+//# sourceMappingURL=group-pin.d.ts.map

package/dist/deploy/group-pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-pin.d.ts","sourceRoot":"","sources":["../../src/deploy/group-pin.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,QAAQ;IACvB;;mBAEe;IACf,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;uBACmB;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAiC5E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAIjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClF;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,wBAAgB,UAAU,CACxB,GAAG,EAAE,QAAQ,GAAG,IAAI,EACpB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,aAAa,CA6Bf"}

package/dist/deploy/manifest-state.d.ts

@@ -0,0 +1,20 @@
+import type { CliConfig } from "../config.js";
+export interface ManifestStateResponse {
+    readonly slug: string;
+    readonly hasAppFile: boolean;
+    readonly lastAppliedManifestSha: string | null;
+    readonly appRepoHeadSha: string | null;
+    readonly openPr: {
+        readonly number: number;
+        readonly url: string;
+        readonly branch: string;
+    } | null;
+    readonly manifestYaml?: string | null;
+}
+/** Fetch `/apps/<slug>/manifest/state`. With `includeManifest: true`,
+ *  the response also carries the deployed `launchpad.yaml` body at
+ *  `lastAppliedManifestSha`. */
+export declare function fetchManifestState(cfg: CliConfig, slug: string, opts?: {
+    includeManifest?: boolean;
+}, fetcher?: typeof fetch): Promise<ManifestStateResponse>;
+//# sourceMappingURL=manifest-state.d.ts.map

package/dist/deploy/manifest-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-state.d.ts","sourceRoot":"","sources":["../../src/deploy/manifest-state.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAcD;;gCAEgC;AAChC,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,EACxC,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAehC"}

package/dist/deploy/manifest-status.d.ts

@@ -0,0 +1,11 @@
+import type { CliConfig } from "../config.js";
+export interface ManifestStatusResponse {
+    readonly slug: string;
+    readonly role: string;
+    readonly lastAppliedManifestSha: string;
+    readonly hasStatus: boolean;
+    readonly status: Record<string, unknown>;
+}
+/** Fetch `/apps/<slug>/manifest/status` (role-redacted by the bot). */
+export declare function fetchManifestStatus(cfg: CliConfig, slug: string, fetcher?: typeof fetch): Promise<ManifestStatusResponse>;
+//# sourceMappingURL=manifest-status.d.ts.map

package/dist/deploy/manifest-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-status.d.ts","sourceRoot":"","sources":["../../src/deploy/manifest-status.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,uEAAuE;AACvE,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CAGjC"}

package/dist/deploy/resolve.d.ts

@@ -0,0 +1,53 @@
+import { type PinComparison } from "./group-pin.js";
+import type { CliConfig } from "../config.js";
+import type { Manifest } from "../manifest/schema.js";
+export type ResolutionResult = {
+    kind: "ok";
+    /** UUID emitted into the TF block. Comes from the pin when
+     *  present (D3); otherwise from the fresh Graph resolution. */
+    uuid: string;
+    /** UUID returned by the *fresh* graph lookup (irrespective of
+     *  the pin). Apply uses this to decide whether the pin is
+     *  drifted relative to current Entra state. Empty string when
+     *  the manifest's name no longer resolves at all (deleted
+     *  group with a stale pin still on disk). */
+    freshUuid: string;
+    /** Display name of the resolved group at the time of the
+     *  fresh lookup (`displayName` in the bot's response). */
+    displayName: string;
+    /** Whether the bot's groups list came from cache or a fresh
+     *  fetch. Separate from the pin status below. */
+    source: "cache" | "fresh";
+    /** D3 pin comparison against the fresh resolve. Drives the
+     *  output: "would-be-pinned", "consistent", "manifest
+     *  renamed", or "Entra-side rename detected". */
+    pin: PinComparison;
+} | {
+    kind: "not-found";
+    key: string;
+} | {
+    kind: "ambiguous";
+    key: string;
+    matches: readonly {
+        id: string;
+        displayName: string;
+    }[];
+} | {
+    kind: "unauthenticated";
+    message: string;
+} | {
+    kind: "forbidden";
+    message: string;
+} | {
+    kind: "network";
+    message: string;
+};
+/**
+ * Resolve the manifest's group reference against the visible
+ * groups list + D3 pin file. Pure read-side — never writes the
+ * pin, never invalidates the cache. The apply path writes the
+ * pin only after `terraform apply` succeeds; the dry-run never
+ * writes it at all.
+ */
+export declare function resolveGroup(manifest: Manifest, cfg: CliConfig): Promise<ResolutionResult>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/deploy/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/deploy/resolve.ts"],"names":[],"mappings":"AA0BA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,IAAI,CAAC;IACX;mEAC+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;iDAI6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB;8DAC0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB;qDACiD;IACjD,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B;;qDAEiD;IACjD,GAAG,EAAE,aAAa,CAAC;CACpB,GACD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GAC3F;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,CAAC,CA8E3B"}

package/dist/deploy/rollback.d.ts

@@ -0,0 +1,23 @@
+import { type ApplyDeps } from "./apply.js";
+import { type CommandRunner } from "./runner.js";
+import type { CliIo, ExitCode } from "../dispatcher.js";
+export interface RollbackOptions {
+    readonly sha: string;
+    readonly file: string | null;
+    /** Accepted-but-warned (no-op). Removed in v0.13. */
+    readonly platformRepo: string | null;
+    /** Accepted-but-warned (no-op). Removed in v0.13. */
+    readonly rePin: boolean;
+    readonly yes: boolean;
+}
+export interface RollbackDeps {
+    readonly runner?: CommandRunner;
+    readonly prompt?: (question: string) => Promise<string>;
+    /** Inject the apply dep bag so tests share one runner + one
+     *  clock between the rollback verification + the inner apply
+     *  call. Defaults pass `undefined`, which makes the inner apply
+     *  fall back to nodeRunner / real clock. */
+    readonly applyDeps?: ApplyDeps;
+}
+export declare function runRollback(opts: RollbackOptions, io: CliIo, deps?: RollbackDeps): Promise<ExitCode>;
+//# sourceMappingURL=rollback.d.ts.map

package/dist/deploy/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/deploy/rollback.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAIxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD;;;gDAG4C;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAUD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CAmInB"}

package/dist/deploy/runner.d.ts

@@ -0,0 +1,29 @@
+export interface CommandResult {
+    /** Process exit code. `null` from spawn → -1 here so callers
+     *  always have a numeric comparison target. */
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export interface CommandRunner {
+    run(cmd: string, args: readonly string[], opts?: {
+        cwd?: string;
+        env?: NodeJS.ProcessEnv;
+        /** Optional stdin payload written to the child after spawn.
+         *  Required by `secrets push`'s `wrangler secret put` calls,
+         *  which read the value from stdin. Existing callers
+         *  (terraform plan/apply/show via apply/pull/drift) pass
+         *  nothing and continue to get `stdio: ["ignore", …]`. */
+        stdin?: string;
+    }): Promise<CommandResult>;
+}
+/**
+ * Production runner — shells out via `child_process.spawn`.
+ *
+ * Exposed as a const (not a class) so tests that want to stub
+ * a single method can spread it: `{ ...nodeRunner, run: stub }`.
+ * The exported binding is the type-aware singleton; do not
+ * mutate it at runtime.
+ */
+export declare const nodeRunner: CommandRunner;
+//# sourceMappingURL=runner.d.ts.map

package/dist/deploy/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/deploy/runner.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,aAAa;IAC5B;mDAC+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;QACxB;;;;kEAI0D;QAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GACA,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,aAyCxB,CAAC"}

package/dist/deploy/stage-exit-codes.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Closed enum of terminal-failure stages the workflow may halt at.
+ * Mirrors `TERMINAL_FAILURE_STAGES` in `portal-bot/src/stages.ts`.
+ */
+export declare const TERMINAL_FAILURE_STAGES: readonly ["validator_rejected", "tf_apply_failed", "bot_pr_ci_failed", "abandoned", "failed"];
+export type TerminalFailureStage = (typeof TERMINAL_FAILURE_STAGES)[number];
+/**
+ * Stage → exit code map. Numbers are deliberately chosen so a wrapper
+ * can `case $? in 32) … 33) … esac` and tell apart the failure
+ * classes without parsing CLI stdout.
+ *
+ * | Stage                  | Code | Meaning (operator-facing)                                |
+ * |------------------------|------|----------------------------------------------------------|
+ * | validator_rejected     |  32  | Bot's PR failed shape-validator. Operator must fix the   |
+ * |                        |      | template / generator drift, then re-file.                |
+ * | tf_apply_failed        |  33  | `terraform apply` failed. Usually transient (Cf API      |
+ * |                        |      | rate limit / cert issuance latency). Use `--resume`.     |
+ * | bot_pr_ci_failed       |  34  | A required check (lint/audit/typecheck/etc) failed on    |
+ * |                        |      | the bot's PR. Operator must push a fix to the bot PR.    |
+ * | abandoned              |  35  | Operator released the slug via `--abandon`.              |
+ * | failed                 |  36  | Generic terminal failure (legacy; pre-M-892).            |
+ *
+ * 0 = success / `ready_for_content`. 1 = generic CLI error (network,
+ * auth, bad argv) per the dispatcher's existing contract. 64 = usage
+ * (EX_USAGE). The 32-36 band sits clear of both.
+ */
+export declare const STAGE_EXIT_CODES: Readonly<Record<TerminalFailureStage, number>>;
+/**
+ * Resolve the exit code for a stage. Defaults to 36 (`failed`'s code)
+ * for any unknown stage — defensive against the bot growing a new
+ * stage string before the CLI catches up. The CLI also surfaces the
+ * unknown stage name verbatim in stderr so operators see what they
+ * got.
+ */
+export declare function exitCodeForStage(stage: string): number;
+/**
+ * Type guard: is this stage one the CLI considers terminal-failure?
+ * Used to break out of the polling loop.
+ */
+export declare function isTerminalFailureStage(stage: string): stage is TerminalFailureStage;
+//# sourceMappingURL=stage-exit-codes.d.ts.map

package/dist/deploy/stage-exit-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage-exit-codes.d.ts","sourceRoot":"","sources":["../../src/deploy/stage-exit-codes.ts"],"names":[],"mappings":"AAyBA;;;GAGG;AACH,eAAO,MAAM,uBAAuB,+FAM1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CACrC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAO5B,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,oBAAoB,CAE/B"}