@m-kopa/launchpad-cli 0.24.0 → 0.26.1

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.24.0";
+var CLI_VERSION = "0.26.1";
 
 // src/config.ts
 import * as os from "node:os";
@@ -1219,8 +1219,8 @@ function describe9(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync4 } from "node:fs";
-import * as path6 from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import * as path7 from "node:path";
 
 // src/bundle/orchestrate.ts
 import { readFileSync as readFileSync4 } from "node:fs";
@@ -1432,6 +1432,9 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
   if (res.status === 202) {
     return { kind: "ok", response: body };
   }
+  if (res.status === 200 && typeof body === "object" && body !== null && body.outcome === "nothing-to-deploy") {
+    return { kind: "ok", response: body };
+  }
   return {
     kind: "error",
     status: res.status,
@@ -3303,8 +3306,8 @@ async function bundleAndDeploy(args) {
 }
 
 // src/commands/deploy.ts
-import { parse as parseYaml4 } from "yaml";
-import { readFileSync as readFileSync6 } from "node:fs";
+import { parse as parseYaml5 } from "yaml";
+import { readFileSync as readFileSync7 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -3380,6 +3383,7 @@ function parseDeployFlags(args) {
   let yes = false;
   let resumePrNumber = null;
   let timeoutMinutes = null;
+  let atSha = null;
   let modeFlagsSeen = 0;
   let i = 0;
   while (i < args.length) {
@@ -3532,6 +3536,17 @@ function parseDeployFlags(args) {
       i += 2;
       continue;
     }
+    if (a === "--at") {
+      const v = args[i + 1];
+      if (v === undefined)
+        return `missing value for ${a}`;
+      if (!/^[0-9a-f]{40}$/.test(v)) {
+        return `invalid --at "${v}" — expected a 40-char lowercase hex git SHA from the MANAGED repo`;
+      }
+      atSha = v;
+      i += 2;
+      continue;
+    }
     if (a === "--resume-pr") {
       const v = args[i + 1];
       if (v === undefined)
@@ -3601,6 +3616,7 @@ function parseDeployFlags(args) {
         rePin,
         yes,
         resumePrNumber,
+        atSha,
         timeoutMinutes
       },
       message: null,
@@ -3610,6 +3626,9 @@ function parseDeployFlags(args) {
   if (resumePrNumber !== null) {
     return "--resume-pr is only valid with --apply";
   }
+  if (atSha !== null) {
+    return "--at is only valid with --apply";
+  }
   if (timeoutMinutes !== null) {
     return "--timeout-minutes is only valid with --apply";
   }
@@ -3687,7 +3706,6 @@ function parseDeployFlags(args) {
 // src/deploy/apply.ts
 import { existsSync as existsSync3, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join7 } from "node:path";
-import { execFileSync } from "node:child_process";
 
 // src/manifest/load.ts
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -3780,29 +3798,23 @@ async function runDeployApply(opts, io, deps = {}) {
     io.err(`launchpad deploy --apply: manifest's metadata.name '${slug}' is not a valid slug`);
     return 1;
   }
-  let manifestSha;
-  try {
-    manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
-  } catch (e) {
-    io.err(`launchpad deploy --apply: failed to resolve git HEAD in ${process.cwd()}: ${describe10(e)}`);
-    io.err("  Apply needs a clean commit so portal-bot can fetch launchpad.yaml at that sha.");
-    return 2;
-  }
-  if (!MANIFEST_SHA_REGEX.test(manifestSha)) {
-    io.err(`launchpad deploy --apply: git HEAD returned an unexpected sha shape: '${manifestSha}'`);
-    return 2;
+  if (opts.atSha !== undefined && !MANIFEST_SHA_REGEX.test(opts.atSha)) {
+    io.err(`launchpad deploy --apply: --at expects a 40-char lowercase hex git SHA, got '${opts.atSha}'`);
+    return 64;
   }
-  io.out(`Planning apply for ${slug} @ ${manifestSha.slice(0, 7)} …`);
+  io.out(opts.atSha !== undefined ? `Planning apply for ${slug} @ ${opts.atSha.slice(0, 7)} (managed repo) …` : `Planning apply for ${slug} (bot resolves managed main HEAD) …`);
   let plan;
   try {
     plan = await apiJson(cfg, {
       method: "POST",
       path: `/apps/${slug}/manifest/plan`,
-      jsonBody: { manifestSha }
+      jsonBody: opts.atSha !== undefined ? { manifestSha: opts.atSha } : {}
     }, fetcher);
   } catch (e) {
     return mapHttpError(e, slug, io);
   }
+  const manifestSha = plan.manifestSha;
+  io.out(`Manifest pinned @ ${manifestSha.slice(0, 7)} (managed repo provenance).`);
   for (const w of plan.warnings)
     io.err(`! ${w}`);
   io.out("");
@@ -3922,14 +3934,6 @@ function sleep(ms) {
     return Promise.resolve();
   return new Promise((res) => setTimeout(res, ms));
 }
-function defaultGitHeadSha(cwd) {
-  const out = execFileSync("git", ["rev-parse", "HEAD"], {
-    cwd,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  return out.trim();
-}
 function deletePinIfPresent(cfg, slug, io) {
   const pinPath = join7(cfg.stateDir, slug, "group.json");
   if (!existsSync3(pinPath))
@@ -4012,7 +4016,7 @@ function renderManifestError(loaded, io) {
 }
 
 // src/deploy/dry-run.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { resolve as resolve5 } from "node:path";
 var MANIFEST_SHA_REGEX2 = /^[0-9a-f]{40}$/;
 async function runDeployDryRun(opts, io, deps = {}) {
@@ -4026,7 +4030,7 @@ async function runDeployDryRun(opts, io, deps = {}) {
   const slug = loaded.manifest.metadata.name;
   let manifestSha;
   try {
-    manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha2)(process.cwd());
+    manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
   } catch (e) {
     const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe11(e)}`;
     if (opts.json) {
@@ -4069,8 +4073,8 @@ async function runDeployDryRun(opts, io, deps = {}) {
   }
   return 0;
 }
-function defaultGitHeadSha2(cwd) {
-  const out = execFileSync2("git", ["rev-parse", "HEAD"], {
+function defaultGitHeadSha(cwd) {
+  const out = execFileSync("git", ["rev-parse", "HEAD"], {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -4363,6 +4367,46 @@ function handleNetworkError(e, io, slug, verb) {
   return 1;
 }
 
+// src/commands/infer-slug.ts
+import * as path6 from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
+import { parse as parseYaml4 } from "yaml";
+var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
+function inferSlugFromCwd(cwd) {
+  const base = path6.basename(cwd);
+  const m = base.match(DIRNAME_RE);
+  return m === null ? null : m[1];
+}
+function resolveManifestSlug(parsed) {
+  if (parsed === null || typeof parsed !== "object" || typeof parsed.metadata !== "object" || parsed.metadata === null) {
+    return null;
+  }
+  const meta = parsed.metadata;
+  if (typeof meta.slug === "string")
+    return meta.slug;
+  if (typeof meta.name === "string")
+    return meta.name;
+  return null;
+}
+function inferSlugFromManifestFile(manifestPath) {
+  if (!existsSync4(manifestPath))
+    return null;
+  try {
+    return resolveManifestSlug(parseYaml4(readFileSync6(manifestPath, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function inferSlug(opts) {
+  const manifestPath = path6.resolve(opts.cwd, opts.file ?? "launchpad.yaml");
+  const fromManifest = inferSlugFromManifestFile(manifestPath);
+  const fromDir = inferSlugFromCwd(opts.cwd);
+  if (fromManifest !== null && fromDir !== null && fromManifest !== fromDir) {
+    opts.warn?.(`note: directory name suggests "${fromDir}" but ${path6.basename(manifestPath)} ` + `declares "${fromManifest}" — using the manifest. ` + `(Pass <slug> or --slug to override.)`);
+  }
+  return fromManifest ?? fromDir;
+}
+
 // src/commands/deploy.ts
 var deployCommand = {
   name: "deploy",
@@ -4370,27 +4414,17 @@ var deployCommand = {
   run: runDeploy
 };
 var SLUG_RE4 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 async function runDeploy(args, io) {
   const flags = parseDeployFlags(args);
   if (typeof flags === "string") {
     io.err(`launchpad deploy: ${flags}`);
+    const isFlagMisuse = flags.includes("is only valid with") || flags.includes("does not accept") || flags.includes("mutually exclusive");
+    if (isFlagMisuse) {
+      io.err("       (run `launchpad deploy` with no flags from your app directory for a content deploy)");
+      return 64;
+    }
     io.err("");
-    io.err(`usage: launchpad deploy [--message <text>] [--slug <slug>]
-` + "       (slug defaults to the current directory's `launchpad-app-<slug>` suffix)\n" + `
-` + `M-892 modes:
-` + `       launchpad deploy --resume <slug>
-` + `       launchpad deploy --abandon <slug>
-` + `       launchpad deploy --new --slug <slug> --display-name <name>
-` + `                        --app-type <${APP_TYPES.join("|")}>
-` + `                        --allowed-group <G_KEY> [--allowed-group ...]
-` + `
-` + `Scope 6 dry-run (manifest-driven preview, read-only):
-` + `       launchpad deploy --dry-run [--file <manifest>] [--json]
-` + `
-` + `Scope 6 apply (manifest-driven, writes TF + runs terraform apply):
-` + `       launchpad deploy --apply --platform-repo <path>
-` + "                        [--file <manifest>] [--re-pin] [--yes]");
+    io.err(deployUsage());
     return 64;
   }
   if (flags.mode.kind === "dry-run") {
@@ -4402,6 +4436,7 @@ async function runDeploy(args, io) {
       platformRepo: flags.mode.platformRepo,
       rePin: flags.mode.rePin,
       yes: flags.mode.yes,
+      ...flags.mode.atSha !== null ? { atSha: flags.mode.atSha } : {},
       ...flags.mode.resumePrNumber !== null ? { resumePrNumber: flags.mode.resumePrNumber } : {},
       ...flags.mode.timeoutMinutes !== null ? { timeoutMinutes: flags.mode.timeoutMinutes } : {}
     }, io);
@@ -4423,8 +4458,8 @@ async function runDeploy(args, io) {
     }, io);
   }
   const cwd = process.cwd();
-  const manifestPath = path6.join(cwd, "launchpad.yaml");
-  if (existsSync4(manifestPath)) {
+  const manifestPath = path7.join(cwd, "launchpad.yaml");
+  if (existsSync5(manifestPath)) {
     return runModelADeploy({ cwd, manifestPath, argv: args, io });
   }
   const parsed = parseArgs2(args);
@@ -4436,9 +4471,9 @@ async function runDeploy(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad deploy: could not infer slug from cwd (${path6.basename(process.cwd())});
+      io.err(`launchpad deploy: could not infer slug from cwd (${path7.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -4458,10 +4493,10 @@ async function runDeploy(args, io) {
       return 1;
     }
     let contentManifestYaml = null;
-    const contentManifestPath = path6.join(process.cwd(), "launchpad.yaml");
-    if (existsSync4(contentManifestPath)) {
+    const contentManifestPath = path7.join(process.cwd(), "launchpad.yaml");
+    if (existsSync5(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync6(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync7(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -4539,6 +4574,24 @@ async function runDeploy(args, io) {
     return 1;
   }
 }
+function deployUsage() {
+  return `usage: launchpad deploy [--message <text>] [--slug <slug>]
+` + `       (slug comes from launchpad.yaml at cwd when present — Model A —
+` + "        else from the current directory's `launchpad-app-<slug>` suffix)\n" + `
+` + `provisioning modes:
+` + `       launchpad deploy --resume <slug>
+` + `       launchpad deploy --abandon <slug>
+` + `       launchpad deploy --new --slug <slug> --display-name <name>
+` + `                        --app-type <${APP_TYPES.join("|")}>
+` + `                        --allowed-group <G_KEY> [--allowed-group ...]
+` + `
+` + `manifest-driven dry-run (read-only preview):
+` + `       launchpad deploy --dry-run [--file <manifest>] [--json]
+` + `
+` + `manifest-driven apply (runs server-side via portal-bot):
+` + `       launchpad deploy --apply [--file <manifest>] [--at <sha>] [--re-pin]
+` + "                        [--yes] [--resume-pr <n>] [--timeout-minutes <n>]";
+}
 function parseArgs2(args) {
   let message = null;
   let slug = null;
@@ -4565,11 +4618,6 @@ function parseArgs2(args) {
   }
   return { slug, message };
 }
-function inferSlugFromCwd(cwd) {
-  const base = path6.basename(cwd);
-  const m = base.match(DIRNAME_RE);
-  return m === null ? null : m[1];
-}
 function makeBytesFetcher(bytes, pathSuffix) {
   return async (input, init) => {
     const targetUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -4597,22 +4645,33 @@ function formatBytes2(n) {
 function describe12(e) {
   return e instanceof Error ? e.message : String(e);
 }
-function resolveManifestSlug(parsed) {
-  if (parsed === null || typeof parsed !== "object" || typeof parsed.metadata !== "object" || parsed.metadata === null) {
-    return null;
+function surfaceDeployExtras(body, io, slug) {
+  if (body.boundary_stripped !== undefined && body.boundary_stripped.length > 0) {
+    io.err(`warning: the bot stripped ${body.boundary_stripped.length} never-shippable file(s) server-side:`);
+    for (const p of body.boundary_stripped.slice(0, 10)) {
+      io.err(`         - ${p}`);
+    }
+    if (body.boundary_stripped.length > 10) {
+      io.err(`         … and ${body.boundary_stripped.length - 10} more`);
+    }
+  }
+  const se = body.standing_exceptions;
+  if (se !== undefined && se.count > 0) {
+    io.out(`  ${se.count} standing policy exception(s) observed in content already live on main (non-blocking):`);
+    for (const e of se.entries.slice(0, 5)) {
+      io.out(`    - ${e.path} [${e.rule}]`);
+    }
+    if (se.entries.length > 5) {
+      io.out(`    … and ${se.entries.length - 5} more`);
+    }
+    io.out(`  Full list: \`launchpad status ${slug}\`.`);
   }
-  const meta = parsed.metadata;
-  if (typeof meta.slug === "string")
-    return meta.slug;
-  if (typeof meta.name === "string")
-    return meta.name;
-  return null;
 }
 async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
   try {
-    const metaSlug = resolveManifestSlug(parseYaml4(readFileSync6(manifestPath, "utf8")));
+    const metaSlug = resolveManifestSlug(parseYaml5(readFileSync7(manifestPath, "utf8")));
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
       return 64;
@@ -4688,16 +4747,30 @@ async function runModelADeploy(args) {
           io.err(`         - ${String(f.path)} [${String(f.rule)}]`);
         }
       }
+      if (errorCode === "bundle_policy_violation" || errorCode === "app_boundary_violation" || errorCode === "bad_build_command") {
+        io.err("");
+        io.err("       Nothing was committed or claimed by this attempt — fix the");
+        io.err("       listed file(s) and re-run `launchpad deploy`; the retry is clean.");
+      }
       return 1;
     }
     case "ok": {
       for (const w of result.boundaryWarnings) {
         io.err(`warning: ${w}`);
       }
-      if (result.result.status === "provisioning_started") {
-        const submissionId = typeof result.result.submissionId === "string" ? result.result.submissionId : "(missing)";
-        const appType = typeof result.result.appType === "string" ? result.result.appType : "(missing)";
-        const message = typeof result.result.message === "string" ? result.result.message : "Bot accepted the upload and started provisioning.";
+      const success = result.result;
+      if ("outcome" in success) {
+        io.out("Nothing to deploy — your app is already live at this content.");
+        if (typeof success.head_sha === "string") {
+          io.out(`  (managed main @ ${success.head_sha.slice(0, 8)} matches the bundle)`);
+        }
+        surfaceDeployExtras(success, io, slug);
+        return 0;
+      }
+      if (success.status === "provisioning_started") {
+        const submissionId = typeof success.submissionId === "string" ? success.submissionId : "(missing)";
+        const appType = typeof success.appType === "string" ? success.appType : "(missing)";
+        const message = typeof success.message === "string" ? success.message : "Bot accepted the upload and started provisioning.";
         io.out(`✓ First-time deploy — provisioning workflow started for ${slug}`);
         io.out(`  submission: ${submissionId}`);
         io.out(`  appType:    ${appType}`);
@@ -4709,12 +4782,12 @@ async function runModelADeploy(args) {
         io.out(`  launchpad deploy             # re-run once lifecycle is "live"`);
         return 0;
       }
-      if (typeof result.result.commit_sha !== "string" || typeof result.result.repo !== "string") {
+      if (typeof success.commit_sha !== "string" || typeof success.repo !== "string") {
         io.err(`launchpad deploy: bot returned an unexpected 202 body — missing commit_sha or repo.`);
-        io.err(`       got: ${JSON.stringify(result.result)}`);
+        io.err(`       got: ${JSON.stringify(success)}`);
         return 1;
       }
-      io.out(`✓ Bundle accepted — committed as ${result.result.commit_sha.slice(0, 8)} on ${result.result.repo}`);
+      io.out(`✓ Bundle accepted — committed as ${success.commit_sha.slice(0, 8)} on ${success.repo}`);
       io.out(`  ${result.fileCount} files (${formatBytes2(result.compressedBytes)} gzipped)`);
       if (result.workerScript !== null) {
         io.out(`  cron Worker '${result.workerScript}' bundled + shipped (the bot deploys it after the commit)`);
@@ -4722,9 +4795,10 @@ async function runModelADeploy(args) {
       if (result.walk.skipped.length > 0) {
         io.out(`  ${result.walk.skipped.length} entries skipped (.gitignore / default-ignore / symlink)`);
       }
-      if (typeof result.result.message === "string") {
-        io.out(`  ${result.result.message}`);
+      if (typeof success.message === "string") {
+        io.out(`  ${success.message}`);
       }
+      surfaceDeployExtras(success, io, slug);
       io.out("");
       io.out("Committed; build pending — Cloudflare Pages is building this deploy now.");
       io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
@@ -4734,14 +4808,13 @@ async function runModelADeploy(args) {
 }
 
 // src/commands/envvars.ts
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 var envvarsCommand = {
   name: "envvars",
   summary: "list / set / remove production env vars (slug-scoped)",
   run: runEnvvars
 };
 var SLUG_RE5 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE2 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 var ENV_KEY_RE = /^[A-Z][A-Z0-9_]*$/;
 async function runEnvvars(args, io) {
   const parsed = parseArgs3(args);
@@ -4753,9 +4826,9 @@ async function runEnvvars(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd2(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad envvars: could not infer slug from cwd (${path7.basename(process.cwd())});
+      io.err(`launchpad envvars: could not infer slug from cwd (${path8.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -4901,11 +4974,6 @@ function parseArgs3(args) {
   }
   return null;
 }
-function inferSlugFromCwd2(cwd) {
-  const base = path7.basename(cwd);
-  const m = base.match(DIRNAME_RE2);
-  return m === null ? null : m[1];
-}
 function renderList(envVars, io) {
   if (envVars.length === 0) {
     io.out("(no env vars set)");
@@ -4930,8 +4998,8 @@ function describe13(e) {
 }
 
 // src/commands/generate.ts
-import { mkdirSync, readFileSync as readFileSync7, writeFileSync } from "node:fs";
-import { dirname as dirname4, resolve as resolve6, relative as relative3 } from "node:path";
+import { mkdirSync, readFileSync as readFileSync8, writeFileSync } from "node:fs";
+import { dirname as dirname4, resolve as resolve7, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
   summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
@@ -4944,14 +5012,14 @@ async function runGenerate(args, io) {
     io.err("Usage: launchpad generate [--file <path>] [--dry-run] [--force] [--json]");
     return 64;
   }
-  const manifestPath = resolve6(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve7(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
   const appRoot = dirname4(manifestPath);
-  const wranglerPath = resolve6(appRoot, "container", "wrangler.toml");
-  const workflowPath = resolve6(appRoot, ".github", "workflows", "deploy.yml");
+  const wranglerPath = resolve7(appRoot, "container", "wrangler.toml");
+  const workflowPath = resolve7(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
   const workflowOut = generateGithubDeployWorkflow(result.manifest);
   if (flags.dryRun) {
@@ -4966,7 +5034,7 @@ async function runGenerate(args, io) {
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
-function applyOne(artefact, path8, out, force) {
+function applyOne(artefact, path9, out, force) {
   if (out.kind === "not-applicable") {
     return {
       artefact,
@@ -4974,32 +5042,32 @@ function applyOne(artefact, path8, out, force) {
       warnings: []
     };
   }
-  const existing = readIfExists(path8);
+  const existing = readIfExists(path9);
   if (existing.kind === "read-error") {
     return {
       artefact,
-      action: { kind: "write-error", path: path8, message: existing.message },
+      action: { kind: "write-error", path: path9, message: existing.message },
       warnings: out.warnings
     };
   }
   if (existing.kind === "ok" && existing.content === out.content) {
-    return { artefact, action: { kind: "unchanged", path: path8 }, warnings: out.warnings };
+    return { artefact, action: { kind: "unchanged", path: path9 }, warnings: out.warnings };
   }
   if (existing.kind === "ok" && existing.content !== out.content && !force) {
     return {
       artefact,
-      action: { kind: "would-overwrite", path: path8 },
+      action: { kind: "would-overwrite", path: path9 },
       warnings: out.warnings
     };
   }
   try {
-    mkdirSync(dirname4(path8), { recursive: true });
-    writeFileSync(path8, out.content, "utf8");
+    mkdirSync(dirname4(path9), { recursive: true });
+    writeFileSync(path9, out.content, "utf8");
     return {
       artefact,
       action: {
         kind: "written",
-        path: path8,
+        path: path9,
         bytes: Buffer.byteLength(out.content, "utf8")
       },
       warnings: out.warnings
@@ -5009,16 +5077,16 @@ function applyOne(artefact, path8, out, force) {
       artefact,
       action: {
         kind: "write-error",
-        path: path8,
+        path: path9,
         message: err.message ?? String(err)
       },
       warnings: out.warnings
     };
   }
 }
-function readIfExists(path8) {
+function readIfExists(path9) {
   try {
-    return { kind: "ok", content: readFileSync7(path8, "utf8") };
+    return { kind: "ok", content: readFileSync8(path9, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -5229,7 +5297,7 @@ function parseFlags(args) {
 }
 
 // src/groups/client.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname5, join as join9 } from "node:path";
 var CACHE_TTL_MS = 60 * 60 * 1000;
 var CACHE_FILENAME = "groups.json";
@@ -5270,10 +5338,10 @@ async function fetchGroups(cfg, opts = {}) {
   writeCache(cachePath, { fetchedAt, groups });
   return { kind: "ok", source: "fresh", fetchedAt, groups };
 }
-function readCache(path8) {
+function readCache(path9) {
   let raw;
   try {
-    raw = readFileSync8(path8, "utf8");
+    raw = readFileSync9(path9, "utf8");
   } catch {
     return null;
   }
@@ -5301,10 +5369,10 @@ function isEntraGroup(value) {
   const g = value;
   return typeof g.id === "string" && typeof g.displayName === "string" && (typeof g.mailNickname === "string" || g.mailNickname === null);
 }
-function writeCache(path8, envelope) {
+function writeCache(path9, envelope) {
   try {
-    mkdirSync2(dirname5(path8), { recursive: true });
-    writeFileSync2(path8, JSON.stringify(envelope), "utf8");
+    mkdirSync2(dirname5(path9), { recursive: true });
+    writeFileSync2(path9, JSON.stringify(envelope), "utf8");
   } catch {}
 }
 function describe14(e) {
@@ -5774,17 +5842,17 @@ function describe17(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync5, readFileSync as readFileSync9, statSync } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync10, statSync } from "node:fs";
 import { join as join10 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync5(join10(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync5(join10(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync5(join10(cwd, n)));
+  const hasPackageJson = existsSync6(join10(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync6(join10(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync6(join10(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -5830,7 +5898,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync5(join10(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync6(join10(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -5853,7 +5921,7 @@ function detectPackageManager(cwd) {
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
     const p = join10(cwd, name);
-    if (existsSync5(p)) {
+    if (existsSync6(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -5865,7 +5933,7 @@ function detectVitePresence(cwd) {
 function detectAppType(cwd) {
   const fnDir = join10(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync5(fnDir)) {
+  if (existsSync6(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -5876,7 +5944,7 @@ function detectAppType(cwd) {
 }
 function detectBuildCommand(cwd, pm) {
   const pkgJsonPath = join10(cwd, "package.json");
-  if (!existsSync5(pkgJsonPath)) {
+  if (!existsSync6(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -5884,7 +5952,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync9(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync10(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -5919,7 +5987,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync9(vite.path, "utf8");
+    text = readFileSync10(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -5948,8 +6016,8 @@ async function runInit(args, io, prompt) {
     return 64;
   }
   const { inputs, options } = parsed;
-  const outPath = resolve7(process.cwd(), options.out);
-  if (existsSync6(outPath) && !options.force) {
+  const outPath = resolve8(process.cwd(), options.out);
+  if (existsSync7(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -5996,7 +6064,7 @@ async function runInit(args, io, prompt) {
   }
   io.out(`✓ wrote ${outPath}`);
   if (options.gitignore) {
-    const gitignorePath = resolve7(process.cwd(), ".gitignore");
+    const gitignorePath = resolve8(process.cwd(), ".gitignore");
     try {
       const changed = ensureGitignoreEntries(gitignorePath, [".env", ".env.local"]);
       if (changed.length > 0) {
@@ -6365,10 +6433,10 @@ function buildManifest(inputs, detected) {
 function renderYaml(manifest) {
   return yamlStringify(manifest, { lineWidth: 0 });
 }
-function ensureGitignoreEntries(path8, entries) {
+function ensureGitignoreEntries(path9, entries) {
   let current = "";
-  if (existsSync6(path8)) {
-    current = readFileSync10(path8, "utf8");
+  if (existsSync7(path9)) {
+    current = readFileSync11(path9, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -6386,7 +6454,7 @@ function ensureGitignoreEntries(path8, entries) {
     }
   }
   if (added.length > 0) {
-    writeFileSync3(path8, out, { encoding: "utf8" });
+    writeFileSync3(path9, out, { encoding: "utf8" });
   }
   return added;
 }
@@ -6458,14 +6526,13 @@ function describe19(e) {
 }
 
 // src/commands/logs.ts
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 var logsCommand = {
   name: "logs",
   summary: "show recent Pages deployment history (slug-scoped)",
   run: runLogs
 };
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE3 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 var DEFAULT_LINES = 10;
 var MAX_LINES = 25;
 async function runLogs(args, io) {
@@ -6479,9 +6546,9 @@ async function runLogs(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd3(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad logs: could not infer slug from cwd (${path8.basename(process.cwd())});
+      io.err(`launchpad logs: could not infer slug from cwd (${path9.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -6559,11 +6626,6 @@ function parseArgs5(args) {
   }
   return { slug, lines };
 }
-function inferSlugFromCwd3(cwd) {
-  const base = path8.basename(cwd);
-  const m = base.match(DIRNAME_RE3);
-  return m === null ? null : m[1];
-}
 function renderDeployments(deployments, io) {
   if (deployments.length === 0) {
     io.out("(no deployments yet)");
@@ -6614,14 +6676,13 @@ function describe20(e) {
 }
 
 // src/commands/merge.ts
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var mergeCommand = {
   name: "merge",
   summary: "squash-merge a review-passed PR (slug-scoped)",
   run: runMerge
 };
 var SLUG_RE7 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE4 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 var HANDLED_STATUSES = [409, 422, 502, 503];
 async function runMerge(args, io) {
   const parsed = parseArgs6(args);
@@ -6634,9 +6695,9 @@ async function runMerge(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd4(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad merge: could not infer slug from cwd (${path9.basename(process.cwd())});
+      io.err(`launchpad merge: could not infer slug from cwd (${path10.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -6733,11 +6794,6 @@ function parseArgs6(args) {
     return null;
   return { slug, prNumber };
 }
-function inferSlugFromCwd4(cwd) {
-  const base = path9.basename(cwd);
-  const m = base.match(DIRNAME_RE4);
-  return m === null ? null : m[1];
-}
 function renderBotError(status, env, io, prNumber = null) {
   const code = env?.error ?? "unknown";
   const detail = env?.message;
@@ -6793,7 +6849,7 @@ function describe21(e) {
 }
 
 // src/commands/plan.ts
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -6806,7 +6862,7 @@ async function runPlan(args, io) {
     io.err("Usage: launchpad plan [--file <path>] [--json]");
     return 64;
   }
-  const manifestPath = resolve8(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   return flags.json ? renderJson(result, io) : renderHuman(result, io);
 }
@@ -6989,7 +7045,7 @@ var SLUG_RE8 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var SLUG_MIN_LENGTH = 3;
 var SLUG_MAX_LENGTH = 58;
 async function runDestroy(args, io, prompt, isTty) {
-  const parsed = parseArgs7(args);
+  const parsed = parseArgs7(args, process.cwd(), (l) => io.err(l));
   if (typeof parsed === "string") {
     io.err(`launchpad destroy: ${parsed}`);
     printUsage3(io);
@@ -7044,7 +7100,7 @@ async function runDestroy(args, io, prompt, isTty) {
     return 1;
   }
 }
-function parseArgs7(args, cwd = process.cwd()) {
+function parseArgs7(args, cwd = process.cwd(), warn) {
   let slug = null;
   let confirmSlug = null;
   let yes = false;
@@ -7091,7 +7147,7 @@ function parseArgs7(args, cwd = process.cwd()) {
     i += 1;
   }
   if (slug === null) {
-    const inferred = inferSlugFromCwd(cwd);
+    const inferred = inferSlug({ cwd, warn });
     if (inferred === null) {
       return `slug not provided + cannot infer from cwd. ` + `Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
@@ -7251,8 +7307,8 @@ import { stringify as stringifyYaml } from "yaml";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
-  const path10 = opts.includeManifest === true ? `/apps/${encodeURIComponent(slug)}/manifest/state?include=manifest` : `/apps/${encodeURIComponent(slug)}/manifest/state`;
-  const raw = await apiJson(cfg, { path: path10 }, fetcher);
+  const path11 = opts.includeManifest === true ? `/apps/${encodeURIComponent(slug)}/manifest/state?include=manifest` : `/apps/${encodeURIComponent(slug)}/manifest/state`;
+  const raw = await apiJson(cfg, { path: path11 }, fetcher);
   return {
     slug: raw.slug,
     hasAppFile: raw.hasAppFile,
@@ -7265,11 +7321,24 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
 
 // src/deploy/manifest-status.ts
 async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
-  const path10 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
-  return apiJson(cfg, { path: path10 }, fetcher);
+  const path11 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
+  return apiJson(cfg, { path: path11 }, fetcher);
 }
 
 // src/deploy/deployment-status.ts
+async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
+  let raw;
+  try {
+    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/exceptions` }, fetcher);
+  } catch (e) {
+    if (e instanceof NotFoundError)
+      return null;
+    throw e;
+  }
+  if (!Array.isArray(raw.exceptions))
+    return null;
+  return raw.exceptions.filter((e) => typeof e === "object" && e !== null && typeof e.path === "string" && typeof e.rule === "string" && typeof e.detectedAt === "string" && typeof e.deployRef === "string");
+}
 async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
   let raw;
   try {
@@ -7297,7 +7366,7 @@ var pullCommand = {
 };
 var SLUG_RE9 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 async function runPull(args, io) {
-  const parsed = parseArgs8(args);
+  const parsed = parseArgs8(args, process.cwd(), (l) => io.err(l));
   if (typeof parsed === "string") {
     io.err(`launchpad pull: ${parsed}`);
     printUsage4(io);
@@ -7383,7 +7452,7 @@ async function fetchLiveDeploymentBestEffort(cfg, slug) {
     return null;
   }
 }
-function parseArgs8(args, cwd = process.cwd()) {
+function parseArgs8(args, cwd = process.cwd(), warn) {
   let slug = null;
   let out = null;
   let status = false;
@@ -7424,7 +7493,7 @@ function parseArgs8(args, cwd = process.cwd()) {
     i += 1;
   }
   if (slug === null) {
-    const inferred = inferSlugFromCwd(cwd);
+    const inferred = inferSlug({ cwd, warn });
     if (inferred === null) {
       return `slug not provided + cannot infer from cwd. ` + `Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
@@ -7442,8 +7511,9 @@ function printUsage4(io) {
     "       Reads the deployed launchpad.yaml for an app via the bot.",
     "       No local platform-repo or terraform required.",
     "",
-    "       When run inside launchpad-app-<slug>/, slug is inferred from",
-    "       the directory name. Explicit --slug or positional override.",
+    "       With no slug, it is inferred from the local launchpad.yaml's",
+    "       declared slug first, then from a launchpad-app-<slug>/",
+    "       directory name. Explicit --slug or positional override.",
     "",
     "       --status   read the role-redacted status block (what your",
     "                  role may see) instead of the spec manifest.",
@@ -7456,14 +7526,184 @@ function describe23(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
+// src/commands/recover.ts
+var recoverCommand = {
+  name: "recover",
+  summary: "repair a terminal-failed app record by reconciling against live state",
+  run: runRecover
+};
+var SLUG_RE10 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+async function runRecover(args, io) {
+  const parsed = parseRecoverArgs(args, process.cwd(), (l) => io.err(l));
+  if (typeof parsed === "string") {
+    io.err(`launchpad recover: ${parsed}`);
+    printUsage5(io);
+    return 64;
+  }
+  const cfg = loadConfig();
+  try {
+    io.out(`Reconciling "${parsed.slug}" against live Cloudflare state …`);
+    const res = await apiRaw(cfg, {
+      method: "POST",
+      path: `/apps/${parsed.slug}/recover`,
+      jsonBody: undefined,
+      nonThrowingStatuses: [409, 503]
+    });
+    const body = await res.json().catch(() => null);
+    if (parsed.json) {
+      io.out(JSON.stringify({ httpStatus: res.status, ...body ?? {} }, null, 2));
+      return res.status === 200 ? 0 : 1;
+    }
+    if (res.status === 200 && body !== null && "outcome" in body) {
+      renderSuccess2(body, io);
+      return 0;
+    }
+    if (res.status === 503) {
+      const msg = body !== null && "message" in body && typeof body.message === "string" ? body.message : "live state unavailable — nothing was changed; retry shortly.";
+      io.err(`launchpad recover: ${msg}`);
+      return 1;
+    }
+    if (res.status === 409 && body !== null && "error" in body) {
+      renderRefusal(parsed.slug, body, io);
+      return 1;
+    }
+    io.err(`launchpad recover: bot returned an unexpected HTTP ${res.status} response.`);
+    return 1;
+  } catch (e) {
+    return mapError(e, parsed.slug, io);
+  }
+}
+function renderSuccess2(body, io) {
+  if (body.outcome === "noop_already_healthy") {
+    io.out(`${body.slug}: already healthy — nothing to recover.`);
+    io.out(`  ${body.message}`);
+    return;
+  }
+  io.out(`${body.slug}: REPAIRED — registry record reconciled to live.`);
+  if (body.before !== undefined) {
+    io.out(`  before: ${body.before.lifecycle}` + (body.before.reason !== null ? ` (${body.before.reason})` : ""));
+  }
+  if (body.after !== undefined) {
+    io.out(`  after:  ${body.after.lifecycle}`);
+  }
+  const checked = body.checked;
+  if (checked !== undefined) {
+    io.out(`  verified: Pages project "${checked.pagesProject}" exists` + (checked.latestDeployment !== null ? `; latest production deployment ${checked.latestDeployment.id} ` + `(${checked.latestDeployment.buildStatus}, ${checked.latestDeployment.createdOn})` : ""));
+    if (checked.olderContentServing) {
+      io.out("  note: the LATEST build failed — an older successful deployment is what's serving.");
+    }
+  }
+  io.out("");
+  io.out(`Run \`launchpad status ${body.slug}\` — it now reports the live deployment truth.`);
+}
+function renderRefusal(slug, body, io) {
+  io.err(`launchpad recover: refused — "${slug}" was NOT repaired.`);
+  if (typeof body.message === "string") {
+    io.err(`  ${body.message}`);
+  }
+  const checked = body.checked;
+  if (checked !== undefined) {
+    io.err("  checked:");
+    io.err(`    Pages project "${checked.pagesProject}": ${checked.projectExists ? "exists" : "MISSING"}`);
+    if (checked.latestDeployment !== null) {
+      io.err(`    latest production deployment: ${checked.latestDeployment.id} (${checked.latestDeployment.buildStatus})`);
+    } else if (checked.projectExists) {
+      io.err("    latest production deployment: none");
+    }
+  }
+}
+function mapError(e, slug, io) {
+  if (e instanceof UnauthenticatedError) {
+    io.err(`launchpad recover: ${e.message}`);
+    io.err("  session expired, run `launchpad login`");
+    return 1;
+  }
+  if (e instanceof ForbiddenError) {
+    io.err(`launchpad recover: not authorised for app "${slug}" (you must be an owner or editor).`);
+    return 1;
+  }
+  if (e instanceof NotFoundError) {
+    io.err(`launchpad recover: app "${slug}" not found.`);
+    return 1;
+  }
+  if (e instanceof ApiError || e instanceof TransportError) {
+    io.err(`launchpad recover: ${e.message}`);
+    return 1;
+  }
+  io.err(`launchpad recover failed: ${e instanceof Error ? e.message : String(e)}`);
+  return 1;
+}
+function parseRecoverArgs(args, cwd = process.cwd(), warn) {
+  let slug = null;
+  let json = false;
+  let i = 0;
+  while (i < args.length) {
+    const a = args[i] ?? "";
+    if (a === "--slug") {
+      const v = args[i + 1];
+      if (v === undefined)
+        return "missing value for --slug";
+      if (slug !== null)
+        return "cannot mix --slug with positional slug (or pass --slug twice)";
+      slug = v;
+      i += 2;
+      continue;
+    }
+    if (a === "--json") {
+      json = true;
+      i += 1;
+      continue;
+    }
+    if (a.startsWith("--")) {
+      return `unknown flag "${a}"`;
+    }
+    if (slug !== null) {
+      return "cannot mix --slug with positional slug (or pass two positional slugs)";
+    }
+    slug = a;
+    i += 1;
+  }
+  if (slug === null) {
+    slug = inferSlug({ cwd, warn });
+  }
+  if (slug === null) {
+    return "slug not provided + cannot infer from cwd. " + "Pass <slug> or --slug <slug>, cd into launchpad-app-<slug>/, or run from a directory with launchpad.yaml.";
+  }
+  if (!SLUG_RE10.test(slug)) {
+    return `invalid slug "${slug}" — expected ${SLUG_RE10.source}`;
+  }
+  return { slug, json };
+}
+function printUsage5(io) {
+  io.err([
+    "usage: launchpad recover [<slug>] [--slug <slug>] [--json]",
+    "",
+    "       Repair an app whose registry record is stuck at a terminal",
+    "       provisioning failure although the app is actually live (e.g. a",
+    "       since-fixed platform bug failed the record after content shipped).",
+    "",
+    "       The bot verifies LIVE Cloudflare state first: the record is only",
+    "       repaired when the Pages project exists and a successful production",
+    "       deployment is serving. A not-live app is refused with what was",
+    "       checked — recover never fabricates a live state.",
+    "",
+    "       Recovering an already-healthy app is a no-op success.",
+    "",
+    "Flags:",
+    "       --slug <slug>   override cwd inference.",
+    "       --json          emit machine-readable JSON to stdout."
+  ].join(`
+`));
+}
+
 // src/commands/status.ts
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 var statusCommand = {
   name: "status",
   summary: "show drift between local launchpad.yaml and deployed state",
   run: runStatus
 };
-var SLUG_RE10 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+var SLUG_RE11 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 async function fetchLifecycle(cfg, slug) {
   try {
     return await apiJson(cfg, { path: `/apps/${slug}/lifecycle` });
@@ -7495,10 +7735,10 @@ function mapBotError(e, slug, io) {
   return 2;
 }
 async function runStatus(args, io) {
-  const parsed = parseArgs9(args);
+  const parsed = parseArgs9(args, process.cwd(), (l) => io.err(l));
   if (typeof parsed === "string") {
     io.err(`launchpad status: ${parsed}`);
-    printUsage5(io);
+    printUsage6(io);
     return 64;
   }
   const cfg = loadConfig();
@@ -7512,34 +7752,36 @@ async function runStatus(args, io) {
     emit3(lifecycleOutput(parsed.slug, lifecycle), parsed.json, io);
     return 0;
   }
-  let localYaml;
+  let localYaml = null;
   try {
-    localYaml = readFileSync11(parsed.file, "utf8");
+    localYaml = readFileSync12(parsed.file, "utf8");
   } catch (e) {
-    io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe24(e)}`);
-    if (lifecycle !== null && lifecycle.state === "live") {
-      io.err(`  (app "${parsed.slug}" is live — cd into its launchpad-app-${parsed.slug}/ to check drift.)`);
+    if (!isEnoent(e)) {
+      io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe24(e)}`);
+      return 2;
     }
-    return 2;
-  }
-  let localObj;
-  try {
-    const { parse: parseYaml5 } = await import("yaml");
-    localObj = parseYaml5(localYaml);
-  } catch (e) {
-    io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe24(e)}`);
-    return 2;
   }
-  const localParse = parseManifest(localObj);
-  if (localParse.kind !== "ok") {
-    io.err(`launchpad status: ${parsed.file} failed schema validation:`);
-    for (const issue of localParse.issues) {
-      io.err(`  - ${issue.path}: ${issue.message}`);
+  let local = null;
+  if (localYaml !== null) {
+    let localObj;
+    try {
+      const { parse: parseYaml6 } = await import("yaml");
+      localObj = parseYaml6(localYaml);
+    } catch (e) {
+      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe24(e)}`);
+      return 2;
     }
-    return 2;
+    const localParse = parseManifest(localObj);
+    if (localParse.kind !== "ok") {
+      io.err(`launchpad status: ${parsed.file} failed schema validation:`);
+      for (const issue of localParse.issues) {
+        io.err(`  - ${issue.path}: ${issue.message}`);
+      }
+      return 2;
+    }
+    local = localParse.manifest;
+    warnSecretShape(local.production_env, io);
   }
-  const local = localParse.manifest;
-  warnSecretShape(local.production_env, io);
   let state;
   try {
     state = await fetchManifestState(cfg, parsed.slug, { includeManifest: true });
@@ -7557,6 +7799,15 @@ async function runStatus(args, io) {
     }
     io.err(`launchpad status: live deployment state unavailable (${describe24(e)}) — ` + `the report below is from the platform manifest view only.`);
   }
+  let standingExceptions = null;
+  try {
+    standingExceptions = await fetchStandingExceptions(cfg, parsed.slug);
+  } catch (e) {
+    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
+      return mapBotError(e, parsed.slug, io);
+    }
+    io.err(`launchpad status: standing-exception inventory unavailable (${describe24(e)}).`);
+  }
   if (state.manifestYaml === null || state.manifestYaml === undefined) {
     const live = deployment?.liveDeployment ?? null;
     const contentIsLive = live !== null && (live.buildStatus === "success" || deployment?.lastSuccessfulDeployment != null);
@@ -7564,21 +7815,47 @@ async function runStatus(args, io) {
     const out = {
       state: contentIsLive ? "live_content_untracked" : liveButEmpty ? "live_no_content" : "no_deployed_manifest",
       slug: parsed.slug,
+      ...local === null ? { drift: null } : {},
+      deployedSha: state.lastAppliedManifestSha,
+      headSha: state.appRepoHeadSha,
+      hasOpenPr: state.openPr !== null,
+      openPrNumber: state.openPr?.number ?? null,
+      driftFields: [],
+      driftDetails: [],
+      ...deploymentKnown ? { deployment } : {},
+      ...standingExceptions !== null ? { standingExceptions } : {}
+    };
+    emit3(out, parsed.json, io);
+    return 0;
+  }
+  if (local === null) {
+    const out = {
+      state: "live_drift_unknown",
+      slug: parsed.slug,
+      drift: null,
       deployedSha: state.lastAppliedManifestSha,
       headSha: state.appRepoHeadSha,
       hasOpenPr: state.openPr !== null,
       openPrNumber: state.openPr?.number ?? null,
       driftFields: [],
       driftDetails: [],
-      ...deploymentKnown ? { deployment } : {}
+      ...deploymentKnown ? { deployment } : {},
+      ...standingExceptions !== null ? { standingExceptions } : {}
     };
     emit3(out, parsed.json, io);
+    if (parsed.strict) {
+      if (deployment?.liveDeployment?.buildStatus === "failure") {
+        io.err(`launchpad status: --strict: live build FAILED ` + `(drift not evaluated — no local launchpad.yaml here).`);
+        return 1;
+      }
+      io.err(`launchpad status: --strict: drift not evaluated — no local ` + `launchpad.yaml here; live state looks healthy, exiting 0.`);
+    }
     return 0;
   }
   let deployedObj;
   try {
-    const { parse: parseYaml5 } = await import("yaml");
-    deployedObj = parseYaml5(state.manifestYaml);
+    const { parse: parseYaml6 } = await import("yaml");
+    deployedObj = parseYaml6(state.manifestYaml);
   } catch (e) {
     io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe24(e)}`);
     return 2;
@@ -7602,7 +7879,8 @@ async function runStatus(args, io) {
     openPrNumber: state.openPr?.number ?? null,
     driftFields: drift.map((d) => d.path),
     driftDetails: drift,
-    ...deploymentKnown ? { deployment } : {}
+    ...deploymentKnown ? { deployment } : {},
+    ...standingExceptions !== null ? { standingExceptions } : {}
   };
   emit3(result, parsed.json, io);
   if (result.state === "drift" && parsed.strict) {
@@ -7612,17 +7890,17 @@ async function runStatus(args, io) {
 }
 function computeDrift(local, deployed) {
   const diffs = [];
-  const cmp = (path10, l, d) => {
+  const cmp = (path11, l, d) => {
     const li = l ?? null;
     const di = d ?? null;
     if (typeof li === "object" || typeof di === "object") {
       if (JSON.stringify(li) !== JSON.stringify(di)) {
-        diffs.push({ path: path10, local: l, deployed: d });
+        diffs.push({ path: path11, local: l, deployed: d });
       }
       return;
     }
     if (li !== di) {
-      diffs.push({ path: path10, local: l, deployed: d });
+      diffs.push({ path: path11, local: l, deployed: d });
     }
   };
   cmp("metadata.name", local.metadata.name, deployed.metadata.name);
@@ -7687,23 +7965,37 @@ function emit3(out, asJson, io) {
       return;
     case "live_no_content":
       io.out(`${out.slug}: live — no content deployed yet. Run \`launchpad deploy\`.`);
+      surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "no_deployed_manifest":
       io.out(`${out.slug}: no deployed manifest yet — run \`launchpad deploy\`.`);
+      surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "live_content_untracked":
       io.out(`${out.slug}: live — content deployed via ` + `${triggerLabel(out.deployment?.liveDeployment?.trigger)} (no platform-tracked manifest; this app deploys outside \`launchpad deploy\`).`);
+      surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
+      return;
+    case "live_drift_unknown":
+      io.out(`${out.slug}: live` + (out.deployedSha ? ` (content @ ${out.deployedSha.slice(0, 7)})` : ""));
+      surfaceNoLocalManifestNote(out, io);
+      surfaceHeadVsDeployed(out, io);
+      surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "in_sync":
       io.out(`${out.slug}: live, in sync` + (out.deployedSha ? ` (content @ ${out.deployedSha.slice(0, 7)})` : ""));
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
     case "drift":
       io.out(`${out.slug}: live, drift: ${out.driftFields.join(", ")}`);
@@ -7714,9 +8006,15 @@ function emit3(out, asJson, io) {
       }
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
       return;
   }
 }
+function surfaceNoLocalManifestNote(out, io) {
+  if (out.drift !== null)
+    return;
+  io.out("  no local launchpad.yaml here — drift not checked " + "(cd into the app directory or pass --file to compare)");
+}
 function triggerLabel(trigger) {
   if (trigger === "git-push")
     return "git push";
@@ -7763,6 +8061,16 @@ function surfaceDeployment(out, io) {
     }
   }
 }
+function surfaceExceptions(out, io) {
+  const exceptions = out.standingExceptions;
+  if (exceptions === undefined || exceptions.length === 0)
+    return;
+  io.out(`  standing exceptions: ${exceptions.length} policy violation(s) in content already live on main (non-blocking):`);
+  for (const e of exceptions) {
+    io.out(`    - ${e.path} [${e.rule}]`);
+  }
+  io.out("    these never block a deploy that doesn't change them, but they are never grandfathered silently — clean them up in a future deploy.");
+}
 function surfaceHeadVsDeployed(out, io) {
   if (out.headSha !== null && out.deployedSha !== null && out.headSha !== out.deployedSha) {
     const short = (s) => s.slice(0, 7);
@@ -7794,7 +8102,7 @@ function warnSecretShape(env, io) {
     }
   }
 }
-function parseArgs9(args, cwd = process.cwd()) {
+function parseArgs9(args, cwd = process.cwd(), warn) {
   let slug = null;
   let file = "./launchpad.yaml";
   let json = false;
@@ -7841,54 +8149,68 @@ function parseArgs9(args, cwd = process.cwd()) {
     i += 1;
   }
   if (slug === null) {
-    const inferred = inferSlugFromCwd(cwd);
+    const inferred = inferSlug({ cwd, file, warn });
     if (inferred === null) {
       return `slug not provided + cannot infer from cwd. Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
     slug = inferred;
   }
-  if (!SLUG_RE10.test(slug)) {
-    return `invalid slug "${slug}" — expected ${SLUG_RE10.source}`;
+  if (!SLUG_RE11.test(slug)) {
+    return `invalid slug "${slug}" — expected ${SLUG_RE11.source}`;
   }
   return { slug, file, json, strict };
 }
-function printUsage5(io) {
+function printUsage6(io) {
   io.err([
     "usage: launchpad status [<slug>] [--slug <slug>] [--file <path>] [--json] [--strict]",
     "",
     "       Compare local launchpad.yaml against the deployed state.",
     "       No local platform-repo or terraform required.",
     "",
-    "       When run inside launchpad-app-<slug>/, slug is inferred from",
-    "       the directory name. Explicit --slug or positional override.",
+    "       With no explicit slug, it is inferred from (in order): the",
+    "       local manifest's declared slug (./launchpad.yaml or --file),",
+    "       then a launchpad-app-<slug>/ directory name. An explicit",
+    "       --slug or positional always overrides; when the manifest and",
+    "       the directory name disagree, the manifest wins (with a note).",
+    "",
+    "       With a known slug but NO local manifest, status degrades to",
+    "       the live-truth-only view (lifecycle + deployment; drift not",
+    "       checked) and exits 0.",
     "",
     "Flags:",
     "       --file <path>   local manifest path (default: ./launchpad.yaml).",
-    "                       Does NOT influence slug resolution.",
-    "       --slug <slug>   override cwd inference.",
+    "                       Also consulted for slug inference; --slug or a",
+    "                       positional slug still overrides.",
+    "       --slug <slug>   override inference.",
     "       --json          emit machine-readable JSON to stdout.",
     "       --strict        exit 1 on drift. Default is report-only (exit 0).",
+    "                       With no local manifest, drift can't be evaluated:",
+    "                       exit 0 unless the live build itself failed.",
     "",
     "Exit codes:",
-    "       0 = in sync, OR drift in default (report-only) mode.",
-    "       1 = drift, when --strict is set.",
-    "       2 = error (network, auth, missing local manifest, etc.)."
+    "       0 = in sync, OR drift in default (report-only) mode, OR the",
+    "           live-truth-only view (no local manifest).",
+    "       1 = drift, when --strict is set (or a failed live build under",
+    "           --strict with no local manifest).",
+    "       2 = error (network, auth, unreadable/invalid local manifest, etc.)."
   ].join(`
 `));
 }
 function describe24(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function isEnoent(e) {
+  return typeof e === "object" && e !== null && e.code === "ENOENT";
+}
 
 // src/commands/review.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var reviewCommand = {
   name: "review",
   summary: "show the review state for a PR (slug-scoped)",
   run: runReview
 };
-var SLUG_RE11 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE5 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
+var SLUG_RE12 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 async function runReview(args, io) {
   const parsed = parseArgs10(args);
   if (parsed === null) {
@@ -7900,16 +8222,16 @@ async function runReview(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd5(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad review: could not infer slug from cwd (${path10.basename(process.cwd())});
+      io.err(`launchpad review: could not infer slug from cwd (${path11.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
     slug = inferred;
   }
-  if (!SLUG_RE11.test(slug)) {
-    io.err(`launchpad review: invalid slug "${slug}" — expected ${SLUG_RE11.source}`);
+  if (!SLUG_RE12.test(slug)) {
+    io.err(`launchpad review: invalid slug "${slug}" — expected ${SLUG_RE12.source}`);
     return 64;
   }
   try {
@@ -7984,11 +8306,6 @@ function parseArgs10(args) {
   }
   return { slug, prNumber };
 }
-function inferSlugFromCwd5(cwd) {
-  const base = path10.basename(cwd);
-  const m = base.match(DIRNAME_RE5);
-  return m === null ? null : m[1];
-}
 function renderReview(r, io) {
   const rv = r.review;
   io.out(`Review of PR #${rv.prNumber} (${rv.slug})`);
@@ -8040,7 +8357,7 @@ function describe25(e) {
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -8160,19 +8477,20 @@ async function runRollback(opts, io, deps = {}) {
     file: opts.file,
     platformRepo: null,
     rePin: false,
+    atSha: verifiedSha,
     yes: true
   }, io, applyDeps);
 }
-function readCurrentManifest(path11) {
-  if (!existsSync7(path11))
+function readCurrentManifest(path12) {
+  if (!existsSync8(path12))
     return null;
   let raw;
   try {
-    raw = readFileSync12(path11, "utf8");
+    raw = readFileSync13(path12, "utf8");
   } catch {
     return null;
   }
-  const parsed = parseManifest2(raw, path11);
+  const parsed = parseManifest2(raw, path12);
   if (parsed.kind !== "ok")
     return null;
   return summarise(parsed.manifest);
@@ -8324,7 +8642,7 @@ function parseArgs11(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync14 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 
 // src/secrets/env-parse.ts
@@ -8379,14 +8697,14 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath3(process.cwd(), opts.env ?? ".env");
-  if (!existsSync8(envPath)) {
+  if (!existsSync9(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync13(envPath, "utf8");
+    envText = readFileSync14(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push: failed to read ${envPath}: ${describe27(e)}`);
     return 2;
@@ -8658,32 +8976,32 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15 } from "node:fs";
 import { resolve as resolvePath5 } from "node:path";
-import { parse as parseYaml5 } from "yaml";
+import { parse as parseYaml6 } from "yaml";
 var CELL_LABEL2 = {
   present: "PRESENT",
   missing: "MISSING",
   not_deployed: "NOT_DEPLOYED"
 };
 function loadSet(fleetFile, setName, io) {
-  const path11 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync9(path11)) {
-    io.err(`✗ ${path11}`);
+  const path12 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
+  if (!existsSync10(path12)) {
+    io.err(`✗ ${path12}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml5(readFileSync14(path11, "utf8"));
+    obj = parseYaml6(readFileSync15(path12, "utf8"));
   } catch (e) {
-    io.err(`✗ ${path11}`);
+    io.err(`✗ ${path12}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
   const parsed = parseFleetSecretSets(obj);
   if (!parsed.ok) {
-    io.err(`✗ ${path11}`);
+    io.err(`✗ ${path12}`);
     io.err(`  ${parsed.issues.length} schema issue(s):`);
     for (const i of parsed.issues)
       io.err(`    ${i.path}: ${i.message}`);
@@ -8692,7 +9010,7 @@ function loadSet(fleetFile, setName, io) {
   const set = parsed.manifest.secretSets.find((s) => s.name === setName);
   if (set === undefined) {
     const names = parsed.manifest.secretSets.map((s) => s.name).join(", ");
-    io.err(`✗ secret-set "${setName}" not found in ${path11}`);
+    io.err(`✗ secret-set "${setName}" not found in ${path12}`);
     io.err(`  declared sets: ${names}`);
     return 1;
   }
@@ -8760,14 +9078,14 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath5(process.cwd(), opts.env ?? ".env");
-  if (!existsSync9(envPath)) {
+  if (!existsSync10(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync14(envPath, "utf8");
+    envText = readFileSync15(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -8911,8 +9229,8 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync10, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { existsSync as existsSync11, writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -8920,7 +9238,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -8934,8 +9252,8 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve9(process.cwd(), flags.out);
-  if (existsSync10(outPath) && !flags.force) {
+  const outPath = resolve10(process.cwd(), flags.out);
+  if (existsSync11(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
@@ -9223,8 +9541,8 @@ function printHelp2(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname6, join as join11, resolve as resolve10 } from "node:path";
-import { promises as fs5, existsSync as existsSync11 } from "node:fs";
+import { dirname as dirname6, join as join11, resolve as resolve11 } from "node:path";
+import { promises as fs5, existsSync as existsSync12 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 var BUNDLE_PREFIX = "launchpad-";
 var BUNDLED_SKILLS = [
@@ -9291,11 +9609,11 @@ function resolveInstallEnv() {
 function defaultBundleDir() {
   const here = dirname6(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve10(here, "..", "skills"),
-    resolve10(here, "..", "..", "skills")
+    resolve11(here, "..", "skills"),
+    resolve11(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync11(join11(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync12(join11(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -9375,10 +9693,10 @@ async function doList(io) {
   }
   return 0;
 }
-async function readVersion(path11) {
+async function readVersion(path12) {
   let text;
   try {
-    text = await fs5.readFile(path11, "utf8");
+    text = await fs5.readFile(path12, "utf8");
   } catch {
     return null;
   }
@@ -9388,9 +9706,9 @@ async function readVersion(path11) {
   const m = /^version:\s*(.+?)\s*$/m.exec(front);
   return m === null ? null : m[1] ?? null;
 }
-async function isDir(path11) {
+async function isDir(path12) {
   try {
-    const stat = await fs5.stat(path11);
+    const stat = await fs5.stat(path12);
     return stat.isDirectory();
   } catch {
     return false;
@@ -9404,9 +9722,9 @@ function describe28(e) {
 import { execFile, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname7, resolve as resolve11, relative as relative4, isAbsolute as isAbsolute2, join as join12 } from "node:path";
+import { dirname as dirname7, resolve as resolve12, relative as relative4, isAbsolute as isAbsolute2, join as join12 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync15, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync16, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
@@ -9449,9 +9767,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve11) => {
-    server.once("error", () => resolve11(false));
-    server.listen(0, "127.0.0.1", () => resolve11(true));
+  const bound = await new Promise((resolve12) => {
+    server.once("error", () => resolve12(false));
+    server.listen(0, "127.0.0.1", () => resolve12(true));
   });
   if (!bound)
     return null;
@@ -9635,7 +9953,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync15(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync16(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -9698,7 +10016,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve11(dirname7(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve12(dirname7(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -9706,7 +10024,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve11(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve12(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -9842,8 +10160,8 @@ function printHelp4(io) {
 }
 
 // src/commands/validate.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { dirname as dirname8, resolve as resolve12 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { dirname as dirname8, resolve as resolve13 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -9857,12 +10175,12 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path11 = resolve12(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifest(path11);
+  const path12 = resolve13(process.cwd(), file ?? "launchpad.yaml");
+  const result = loadManifest(path12);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
-  const boundary = checkBoundary(path11, result.manifest.app !== undefined);
+  const boundary = checkBoundary(path12, result.manifest.app !== undefined);
   const groupCheck = strictGroups ? await checkGroups(allowedEntraGroups(result.manifest.access)) : { kind: "skipped" };
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
@@ -9876,7 +10194,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync16(manifestPath, "utf8");
+    manifestYaml = readFileSync17(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -10191,14 +10509,14 @@ function describe30(e) {
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
 import { join as join13 } from "node:path";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
 var CACHE_FILE = join13(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync17(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync18(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -10314,6 +10632,7 @@ var COMMANDS = [
   generateCommand,
   pullCommand,
   statusCommand,
+  recoverCommand,
   destroyCommand,
   rollbackCommand,
   groupsCommand,