@m-kopa/launchpad-cli 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -6,6 +6,27 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.25.0 — 2026-06-11
+
+### Changed
+
+- **Redeploying an unchanged app is a clean no-op** (sp-devlp1 AC1 / ADR
+  0025). The bot diffs the bundle against the managed repo's `main` (git
+  tree-diff) before gating: nothing changed → `launchpad deploy` prints
+  "Nothing to deploy" and exits 0 — no policy failure, no junk commit, no
+  rebuild. Deploys that DO change files commit only the changed files.
+- **Policy gates judge what you changed, not what you have** (AC2).
+  Already-live files are never re-flagged; their pre-existing violations
+  surface as a non-blocking drift report (and in `launchpad status`'s new
+  standing-exceptions block). Secrets are the exception: a secret anywhere
+  in the upload — including one already on `main` — always blocks, with
+  rotation guidance.
+- **`deploy --apply` no longer requires local git state** (AC3). The bot
+  resolves `launchpad.yaml` at the managed repo's `main` HEAD; your local
+  history can share zero commits with the managed repo. New `--at <sha>`
+  pins a specific managed-repo commit; `rollback` now uses it too (fixing
+  its local-HEAD keying).
+
 ## 0.24.0 — 2026-06-11
 
 ### Changed

package/dist/bundle/upload.d.ts

@@ -1,5 +1,17 @@
 import type { CliConfig } from "../config.js";
 import type { WorkerArtifact } from "./cron-bundle.js";
+/** Drift report riding on a success response (sp-devlp1 T3 / D2):
+ *  policy violations observed in content already live on managed
+ *  main — non-blocking, recorded server-side in the queryable
+ *  standing-exception inventory. */
+export interface StandingExceptionsSummary {
+    readonly count: number;
+    readonly entries: ReadonlyArray<{
+        readonly path: string;
+        readonly rule: string;
+    }>;
+    readonly message?: string;
+}
 /**
  * Response shape from the bot's deploy-bundle endpoint when the
  * bundle was committed to the per-app repo (HTTP 202, status="accepted").
@@ -10,6 +22,26 @@ export interface DeployBundleAccepted {
     readonly commit_sha: string;
     readonly repo: string;
     readonly message: string;
+    /** "delta" (gates judged the changed-set) or "full" (fallback). */
+    readonly gating?: "delta" | "full";
+    readonly committed_file_count?: number;
+    /** Files the bot's server-side app-boundary stripped (inferred
+     *  contract, never-shippable paths). */
+    readonly boundary_stripped?: readonly string[];
+    readonly standing_exceptions?: StandingExceptionsSummary;
+}
+/**
+ * Response shape when managed main already matches the upload
+ * byte-for-byte (HTTP 200, sp-devlp1 AC1): no commit was created,
+ * no CF Pages build was triggered.
+ */
+export interface DeployBundleNothingToDeploy {
+    readonly outcome: "nothing-to-deploy";
+    readonly slug: string;
+    readonly head_sha: string;
+    readonly message: string;
+    readonly boundary_stripped?: readonly string[];
+    readonly standing_exceptions?: StandingExceptionsSummary;
 }
 /**
  * Response shape when the slug was never registered before and the
@@ -27,8 +59,8 @@ export interface DeployBundleProvisioningStarted {
     readonly appType: string;
     readonly message: string;
 }
-/** Either 202 success shape. */
-export type DeployBundleSuccess = DeployBundleAccepted | DeployBundleProvisioningStarted;
+/** Any success shape (202 accepted / 202 provisioning / 200 no-op). */
+export type DeployBundleSuccess = DeployBundleAccepted | DeployBundleProvisioningStarted | DeployBundleNothingToDeploy;
 /** Structured error shape from the bot on validation failure. */
 export interface DeployBundleError {
     readonly error: string;

package/dist/bundle/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/bundle/upload.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAgBvD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gCAAgC;AAChC,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,+BAA+B,CAAC;AAEpC,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAsF7B"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/bundle/upload.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAgBvD;;;oCAGoC;AACpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;4CACwC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;CAC1D;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,+BAA+B,GAC/B,2BAA2B,CAAC;AAEhC,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAgG7B"}

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.24.0";
+var CLI_VERSION = "0.25.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -1432,6 +1432,9 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
   if (res.status === 202) {
     return { kind: "ok", response: body };
   }
+  if (res.status === 200 && typeof body === "object" && body !== null && body.outcome === "nothing-to-deploy") {
+    return { kind: "ok", response: body };
+  }
   return {
     kind: "error",
     status: res.status,
@@ -3380,6 +3383,7 @@ function parseDeployFlags(args) {
   let yes = false;
   let resumePrNumber = null;
   let timeoutMinutes = null;
+  let atSha = null;
   let modeFlagsSeen = 0;
   let i = 0;
   while (i < args.length) {
@@ -3532,6 +3536,17 @@ function parseDeployFlags(args) {
       i += 2;
       continue;
     }
+    if (a === "--at") {
+      const v = args[i + 1];
+      if (v === undefined)
+        return `missing value for ${a}`;
+      if (!/^[0-9a-f]{40}$/.test(v)) {
+        return `invalid --at "${v}" — expected a 40-char lowercase hex git SHA from the MANAGED repo`;
+      }
+      atSha = v;
+      i += 2;
+      continue;
+    }
     if (a === "--resume-pr") {
       const v = args[i + 1];
       if (v === undefined)
@@ -3601,6 +3616,7 @@ function parseDeployFlags(args) {
         rePin,
         yes,
         resumePrNumber,
+        atSha,
         timeoutMinutes
       },
       message: null,
@@ -3610,6 +3626,9 @@ function parseDeployFlags(args) {
   if (resumePrNumber !== null) {
     return "--resume-pr is only valid with --apply";
   }
+  if (atSha !== null) {
+    return "--at is only valid with --apply";
+  }
   if (timeoutMinutes !== null) {
     return "--timeout-minutes is only valid with --apply";
   }
@@ -3687,7 +3706,6 @@ function parseDeployFlags(args) {
 // src/deploy/apply.ts
 import { existsSync as existsSync3, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join7 } from "node:path";
-import { execFileSync } from "node:child_process";
 
 // src/manifest/load.ts
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -3780,29 +3798,23 @@ async function runDeployApply(opts, io, deps = {}) {
     io.err(`launchpad deploy --apply: manifest's metadata.name '${slug}' is not a valid slug`);
     return 1;
   }
-  let manifestSha;
-  try {
-    manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
-  } catch (e) {
-    io.err(`launchpad deploy --apply: failed to resolve git HEAD in ${process.cwd()}: ${describe10(e)}`);
-    io.err("  Apply needs a clean commit so portal-bot can fetch launchpad.yaml at that sha.");
-    return 2;
-  }
-  if (!MANIFEST_SHA_REGEX.test(manifestSha)) {
-    io.err(`launchpad deploy --apply: git HEAD returned an unexpected sha shape: '${manifestSha}'`);
-    return 2;
+  if (opts.atSha !== undefined && !MANIFEST_SHA_REGEX.test(opts.atSha)) {
+    io.err(`launchpad deploy --apply: --at expects a 40-char lowercase hex git SHA, got '${opts.atSha}'`);
+    return 64;
   }
-  io.out(`Planning apply for ${slug} @ ${manifestSha.slice(0, 7)} …`);
+  io.out(opts.atSha !== undefined ? `Planning apply for ${slug} @ ${opts.atSha.slice(0, 7)} (managed repo) …` : `Planning apply for ${slug} (bot resolves managed main HEAD) …`);
   let plan;
   try {
     plan = await apiJson(cfg, {
       method: "POST",
       path: `/apps/${slug}/manifest/plan`,
-      jsonBody: { manifestSha }
+      jsonBody: opts.atSha !== undefined ? { manifestSha: opts.atSha } : {}
     }, fetcher);
   } catch (e) {
     return mapHttpError(e, slug, io);
   }
+  const manifestSha = plan.manifestSha;
+  io.out(`Manifest pinned @ ${manifestSha.slice(0, 7)} (managed repo provenance).`);
   for (const w of plan.warnings)
     io.err(`! ${w}`);
   io.out("");
@@ -3922,14 +3934,6 @@ function sleep(ms) {
     return Promise.resolve();
   return new Promise((res) => setTimeout(res, ms));
 }
-function defaultGitHeadSha(cwd) {
-  const out = execFileSync("git", ["rev-parse", "HEAD"], {
-    cwd,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  return out.trim();
-}
 function deletePinIfPresent(cfg, slug, io) {
   const pinPath = join7(cfg.stateDir, slug, "group.json");
   if (!existsSync3(pinPath))
@@ -4012,7 +4016,7 @@ function renderManifestError(loaded, io) {
 }
 
 // src/deploy/dry-run.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { resolve as resolve5 } from "node:path";
 var MANIFEST_SHA_REGEX2 = /^[0-9a-f]{40}$/;
 async function runDeployDryRun(opts, io, deps = {}) {
@@ -4026,7 +4030,7 @@ async function runDeployDryRun(opts, io, deps = {}) {
   const slug = loaded.manifest.metadata.name;
   let manifestSha;
   try {
-    manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha2)(process.cwd());
+    manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
   } catch (e) {
     const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe11(e)}`;
     if (opts.json) {
@@ -4069,8 +4073,8 @@ async function runDeployDryRun(opts, io, deps = {}) {
   }
   return 0;
 }
-function defaultGitHeadSha2(cwd) {
-  const out = execFileSync2("git", ["rev-parse", "HEAD"], {
+function defaultGitHeadSha(cwd) {
+  const out = execFileSync("git", ["rev-parse", "HEAD"], {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -4402,6 +4406,7 @@ async function runDeploy(args, io) {
       platformRepo: flags.mode.platformRepo,
       rePin: flags.mode.rePin,
       yes: flags.mode.yes,
+      ...flags.mode.atSha !== null ? { atSha: flags.mode.atSha } : {},
       ...flags.mode.resumePrNumber !== null ? { resumePrNumber: flags.mode.resumePrNumber } : {},
       ...flags.mode.timeoutMinutes !== null ? { timeoutMinutes: flags.mode.timeoutMinutes } : {}
     }, io);
@@ -4597,6 +4602,28 @@ function formatBytes2(n) {
 function describe12(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function surfaceDeployExtras(body, io, slug) {
+  if (body.boundary_stripped !== undefined && body.boundary_stripped.length > 0) {
+    io.err(`warning: the bot stripped ${body.boundary_stripped.length} never-shippable file(s) server-side:`);
+    for (const p of body.boundary_stripped.slice(0, 10)) {
+      io.err(`         - ${p}`);
+    }
+    if (body.boundary_stripped.length > 10) {
+      io.err(`         … and ${body.boundary_stripped.length - 10} more`);
+    }
+  }
+  const se = body.standing_exceptions;
+  if (se !== undefined && se.count > 0) {
+    io.out(`  ${se.count} standing policy exception(s) observed in content already live on main (non-blocking):`);
+    for (const e of se.entries.slice(0, 5)) {
+      io.out(`    - ${e.path} [${e.rule}]`);
+    }
+    if (se.entries.length > 5) {
+      io.out(`    … and ${se.entries.length - 5} more`);
+    }
+    io.out(`  Full list: \`launchpad status ${slug}\`.`);
+  }
+}
 function resolveManifestSlug(parsed) {
   if (parsed === null || typeof parsed !== "object" || typeof parsed.metadata !== "object" || parsed.metadata === null) {
     return null;
@@ -4694,10 +4721,19 @@ async function runModelADeploy(args) {
       for (const w of result.boundaryWarnings) {
         io.err(`warning: ${w}`);
       }
-      if (result.result.status === "provisioning_started") {
-        const submissionId = typeof result.result.submissionId === "string" ? result.result.submissionId : "(missing)";
-        const appType = typeof result.result.appType === "string" ? result.result.appType : "(missing)";
-        const message = typeof result.result.message === "string" ? result.result.message : "Bot accepted the upload and started provisioning.";
+      const success = result.result;
+      if ("outcome" in success) {
+        io.out("Nothing to deploy — your app is already live at this content.");
+        if (typeof success.head_sha === "string") {
+          io.out(`  (managed main @ ${success.head_sha.slice(0, 8)} matches the bundle)`);
+        }
+        surfaceDeployExtras(success, io, slug);
+        return 0;
+      }
+      if (success.status === "provisioning_started") {
+        const submissionId = typeof success.submissionId === "string" ? success.submissionId : "(missing)";
+        const appType = typeof success.appType === "string" ? success.appType : "(missing)";
+        const message = typeof success.message === "string" ? success.message : "Bot accepted the upload and started provisioning.";
         io.out(`✓ First-time deploy — provisioning workflow started for ${slug}`);
         io.out(`  submission: ${submissionId}`);
         io.out(`  appType:    ${appType}`);
@@ -4709,12 +4745,12 @@ async function runModelADeploy(args) {
         io.out(`  launchpad deploy             # re-run once lifecycle is "live"`);
         return 0;
       }
-      if (typeof result.result.commit_sha !== "string" || typeof result.result.repo !== "string") {
+      if (typeof success.commit_sha !== "string" || typeof success.repo !== "string") {
         io.err(`launchpad deploy: bot returned an unexpected 202 body — missing commit_sha or repo.`);
-        io.err(`       got: ${JSON.stringify(result.result)}`);
+        io.err(`       got: ${JSON.stringify(success)}`);
         return 1;
       }
-      io.out(`✓ Bundle accepted — committed as ${result.result.commit_sha.slice(0, 8)} on ${result.result.repo}`);
+      io.out(`✓ Bundle accepted — committed as ${success.commit_sha.slice(0, 8)} on ${success.repo}`);
       io.out(`  ${result.fileCount} files (${formatBytes2(result.compressedBytes)} gzipped)`);
       if (result.workerScript !== null) {
         io.out(`  cron Worker '${result.workerScript}' bundled + shipped (the bot deploys it after the commit)`);
@@ -4722,9 +4758,10 @@ async function runModelADeploy(args) {
       if (result.walk.skipped.length > 0) {
         io.out(`  ${result.walk.skipped.length} entries skipped (.gitignore / default-ignore / symlink)`);
       }
-      if (typeof result.result.message === "string") {
-        io.out(`  ${result.result.message}`);
+      if (typeof success.message === "string") {
+        io.out(`  ${success.message}`);
       }
+      surfaceDeployExtras(success, io, slug);
       io.out("");
       io.out("Committed; build pending — Cloudflare Pages is building this deploy now.");
       io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
@@ -7270,6 +7307,19 @@ async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
 }
 
 // src/deploy/deployment-status.ts
+async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
+  let raw;
+  try {
+    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/exceptions` }, fetcher);
+  } catch (e) {
+    if (e instanceof NotFoundError)
+      return null;
+    throw e;
+  }
+  if (!Array.isArray(raw.exceptions))
+    return null;
+  return raw.exceptions.filter((e) => typeof e === "object" && e !== null && typeof e.path === "string" && typeof e.rule === "string" && typeof e.detectedAt === "string" && typeof e.deployRef === "string");
+}
 async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
   let raw;
   try {
@@ -7557,6 +7607,15 @@ async function runStatus(args, io) {
     }
     io.err(`launchpad status: live deployment state unavailable (${describe24(e)}) — ` + `the report below is from the platform manifest view only.`);
   }
+  let standingExceptions = null;
+  try {
+    standingExceptions = await fetchStandingExceptions(cfg, parsed.slug);
+  } catch (e) {
+    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
+      return mapBotError(e, parsed.slug, io);
+    }
+    io.err(`launchpad status: standing-exception inventory unavailable (${describe24(e)}).`);
+  }
   if (state.manifestYaml === null || state.manifestYaml === undefined) {
     const live = deployment?.liveDeployment ?? null;
     const contentIsLive = live !== null && (live.buildStatus === "success" || deployment?.lastSuccessfulDeployment != null);
@@ -7570,7 +7629,8 @@ async function runStatus(args, io) {
       openPrNumber: state.openPr?.number ?? null,
       driftFields: [],
       driftDetails: [],
-      ...deploymentKnown ? { deployment } : {}
+      ...deploymentKnown ? { deployment } : {},
+      ...standingExceptions !== null ? { standingExceptions } : {}
     };
     emit3(out, parsed.json, io);
     return 0;
@@ -7602,7 +7662,8 @@ async function runStatus(args, io) {
     openPrNumber: state.openPr?.number ?? null,
     driftFields: drift.map((d) => d.path),
     driftDetails: drift,
-    ...deploymentKnown ? { deployment } : {}
+    ...deploymentKnown ? { deployment } : {},
+    ...standingExceptions !== null ? { standingExceptions } : {}
   };
   emit3(result, parsed.json, io);
   if (result.state === "drift" && parsed.strict) {
@@ -7689,21 +7750,25 @@ function emit3(out, asJson, io) {
       io.out(`${out.slug}: live — no content deployed yet. Run \`launchpad deploy\`.`);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "no_deployed_manifest":
       io.out(`${out.slug}: no deployed manifest yet — run \`launchpad deploy\`.`);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "live_content_untracked":
       io.out(`${out.slug}: live — content deployed via ` + `${triggerLabel(out.deployment?.liveDeployment?.trigger)} (no platform-tracked manifest; this app deploys outside \`launchpad deploy\`).`);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "in_sync":
       io.out(`${out.slug}: live, in sync` + (out.deployedSha ? ` (content @ ${out.deployedSha.slice(0, 7)})` : ""));
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "drift":
       io.out(`${out.slug}: live, drift: ${out.driftFields.join(", ")}`);
@@ -7714,6 +7779,7 @@ function emit3(out, asJson, io) {
       }
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
   }
 }
@@ -7763,6 +7829,16 @@ function surfaceDeployment(out, io) {
     }
   }
 }
+function surfaceExceptions(out, io) {
+  const exceptions = out.standingExceptions;
+  if (exceptions === undefined || exceptions.length === 0)
+    return;
+  io.out(`  standing exceptions: ${exceptions.length} policy violation(s) in content already live on main (non-blocking):`);
+  for (const e of exceptions) {
+    io.out(`    - ${e.path} [${e.rule}]`);
+  }
+  io.out("    these never block a deploy that doesn't change them, but they are never grandfathered silently — clean them up in a future deploy.");
+}
 function surfaceHeadVsDeployed(out, io) {
   if (out.headSha !== null && out.deployedSha !== null && out.headSha !== out.deployedSha) {
     const short = (s) => s.slice(0, 7);
@@ -8160,6 +8236,7 @@ async function runRollback(opts, io, deps = {}) {
     file: opts.file,
     platformRepo: null,
     rePin: false,
+    atSha: verifiedSha,
     yes: true
   }, io, applyDeps);
 }

package/dist/commands/deploy-flags.d.ts

@@ -54,6 +54,12 @@ export type DeployMode = {
      * so we use a distinct flag here.
      */
     readonly resumePrNumber: number | null;
+    /**
+     * `--at <sha>` (sp-devlp1 AC3) — pin the manifest to a specific
+     * MANAGED-repo sha. Default (null) lets the bot resolve managed
+     * main HEAD; local git state is irrelevant either way.
+     */
+    readonly atSha: string | null;
     /**
      * `--timeout-minutes <n>` — override the 90-minute default
      * polling timeout (AC-U2). Apply-only.

package/dist/commands/deploy-flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CAsT9E"}
+{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CAqU9E"}

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAgDA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAuPD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3D;AAiED,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAYxC;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAalE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAgDA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAwPD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3D;AA6GD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAYxC;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAalE"}

package/dist/commands/status.d.ts

@@ -1,4 +1,4 @@
-import { type DeploymentStatusView } from "../deploy/deployment-status.js";
+import { type DeploymentStatusView, type StandingExceptionView } from "../deploy/deployment-status.js";
 import { type Manifest } from "@m-kopa/launchpad-engine";
 import type { Command } from "../dispatcher.js";
 export declare const statusCommand: Command;
@@ -42,6 +42,10 @@ export interface StatusJsonOutput {
      *  Absent when the bot pre-dates the endpoint; null when fetched but
      *  the app has no Pages surface. */
     readonly deployment?: DeploymentStatusView | null;
+    /** Standing-exception inventory (sp-devlp1 T3 / D2): non-blocking
+     *  policy violations in content already live on managed main.
+     *  Absent when the bot pre-dates the endpoint. */
+    readonly standingExceptions?: readonly StandingExceptionView[];
 }
 /**
  * Compute drift over the v1 closed field set (AC5).

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAyCA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAuBD;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO,GACP,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnD;AAwND;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAmOD,2CAA2C;AAC3C,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,GAC1B,UAAU,GAAG,MAAM,CAgErB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAyCA,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAuBD;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO,GACP,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAChE;AAyOD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AA4PD,2CAA2C;AAC3C,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,GAC1B,UAAU,GAAG,MAAM,CAgErB"}

package/dist/deploy/apply.d.ts

@@ -9,6 +9,11 @@ export interface ApplyOptions {
      *  Removal in v0.13 alongside `--platform-repo`. */
     readonly rePin: boolean;
     readonly yes: boolean;
+    /** `--at <sha>` — pin the manifest to a specific MANAGED-repo sha
+     *  instead of letting the bot resolve managed main HEAD (sp-devlp1
+     *  AC3). The sha must exist in the managed repo; a local-only sha
+     *  is rejected by the bot with a pointer at the no-sha path. */
+    readonly atSha?: string;
     /** Re-attach to an in-flight apply for `--resume <prNumber>`. */
     readonly resumePrNumber?: number;
     /** Override the 90-minute default polling timeout (AC-U2). */
@@ -20,8 +25,6 @@ export interface ApplyDeps {
     readonly config?: CliConfig;
     /** Inject `fetch` for tests; defaults to `globalThis.fetch`. */
     readonly fetcher?: typeof fetch;
-    /** Inject `git rev-parse` resolution for tests. */
-    readonly gitHeadSha?: (cwd: string) => string;
     /** Polling interval seconds (defaults to 10s; tests use 0). */
     readonly pollIntervalSeconds?: number;
 }

package/dist/deploy/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/deploy/apply.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAwCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyLnB"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/deploy/apply.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;oEAGgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAwCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAoLnB"}

package/dist/deploy/deployment-status.d.ts

@@ -27,6 +27,24 @@ export interface DeploymentStatusView {
         readonly url: string | null;
     } | null;
 }
+/** One standing-exception inventory entry (sp-devlp1 T3 / D2) — a
+ *  policy/boundary/build-command violation observed in content already
+ *  live on managed main. Non-blocking; recorded by the bot on every
+ *  deploy that observes it. Mirror of the bot's `StandingException`. */
+export interface StandingExceptionView {
+    readonly path: string;
+    readonly rule: string;
+    readonly detectedAt: string;
+    readonly deployRef: string;
+}
+/**
+ * Fetch the app's standing-exception inventory via
+ * `GET /apps/<slug>/exceptions` (owner/editor/break-glass). Returns
+ * `null` when the bot pre-dates the endpoint (404) or the response is
+ * shape-less — callers omit the block in that case. Auth errors
+ * propagate.
+ */
+export declare function fetchStandingExceptions(cfg: CliConfig, slug: string, fetcher?: typeof fetch): Promise<readonly StandingExceptionView[] | null>;
 /**
  * Fetch the live deployment status. Returns `null` when the bot
  * pre-dates the endpoint (404) or the response doesn't carry the

package/dist/deploy/deployment-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-status.d.ts","sourceRoot":"","sources":["../../src/deploy/deployment-status.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,GAAG,SAAS,CAAC;AAC/D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,QAAQ,CAAC,wBAAwB,EAAE;QACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,IAAI,CAAC;CACV;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuBtC"}
+{"version":3,"file":"deployment-status.d.ts","sourceRoot":"","sources":["../../src/deploy/deployment-status.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,GAAG,SAAS,CAAC;AAC/D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,QAAQ,CAAC,wBAAwB,EAAE;QACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,IAAI,CAAC;CACV;AAED;;;wEAGwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAsBlD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuBtC"}

package/dist/deploy/rollback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/deploy/rollback.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAIxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD;;;gDAG4C;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAUD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CAmInB"}
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/deploy/rollback.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAIxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD;;;gDAG4C;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAUD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CAyInB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.24.0";
+export declare const CLI_VERSION = "0.25.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) and the stack-fit pre-flight that the bot enforces server-side. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.24.0
+version: 0.25.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and tails the resulting content PR. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.24.0
+version: 0.25.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket). Renders the M-892 stage trace for legacy in-flight provisioning. Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.24.0
+version: 0.25.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, Access app, custom hostname, platform-repo TF entries, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.24.0
+version: 0.25.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the Cf Access session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.24.0
+version: 0.25.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.24.0
+version: 0.25.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->