@m-kopa/launchpad-cli 0.25.0 → 0.27.0

package/dist/cli.js

@@ -19,21 +19,33 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.25.0";
+var CLI_VERSION = "0.27.0";
 
 // src/config.ts
 import * as os from "node:os";
 import * as path from "node:path";
 var DEFAULT_BOT_URL = "https://launchpad-portal-bot.mkopa-launchpad.workers.dev";
+var DEFAULT_AUTH_GATEWAY_URL = "https://auth.launchpad.m-kopa.us";
 function loadConfig(env = process.env) {
   const rawBotUrl = env.LAUNCHPAD_BOT_URL ?? DEFAULT_BOT_URL;
   const botUrl = rawBotUrl.replace(/\/+$/, "");
+  const rawGatewayUrl = env.LAUNCHPAD_AUTH_GATEWAY_URL ?? DEFAULT_AUTH_GATEWAY_URL;
+  const authGatewayUrl = rawGatewayUrl.replace(/\/+$/, "");
+  const authLegacy = env.LAUNCHPAD_AUTH_LEGACY === "1";
   const sessionPath = env.LAUNCHPAD_SESSION_PATH ?? path.join(os.homedir(), ".launchpad", "session.json");
   const cacheDir = env.LAUNCHPAD_CACHE_DIR ?? path.join(os.homedir(), ".launchpad", "cache");
   const stateDir = env.LAUNCHPAD_STATE_DIR ?? path.join(os.homedir(), ".launchpad", "state");
   const rawPlatformRepo = env.LAUNCHPAD_PLATFORM_REPO;
   const platformRepoPath = rawPlatformRepo !== undefined && rawPlatformRepo.length > 0 ? path.resolve(rawPlatformRepo) : null;
-  return { botUrl, sessionPath, cacheDir, stateDir, platformRepoPath };
+  return {
+    botUrl,
+    authGatewayUrl,
+    authLegacy,
+    sessionPath,
+    cacheDir,
+    stateDir,
+    platformRepoPath
+  };
 }
 
 // src/http/errors.ts
@@ -64,7 +76,7 @@ class TransportError extends Error {
 }
 
 // src/auth/flow.ts
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 
 // src/auth/callback-server.ts
 import { createServer } from "node:http";
@@ -371,6 +383,10 @@ import * as fs from "node:fs/promises";
 import * as path2 from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
 var SESSION_VERSION = 1;
+var GATEWAY_SESSION_VERSION = 2;
+function isGatewaySession(s) {
+  return s.version === GATEWAY_SESSION_VERSION;
+}
 
 class SessionParseError extends Error {
   code = "session_parse_error";
@@ -394,8 +410,11 @@ async function readSession(sessionPath) {
     throw new SessionParseError(`session file at ${sessionPath} is not an object`);
   }
   const obj = parsed;
+  if (obj.version === GATEWAY_SESSION_VERSION) {
+    return parseGatewaySession(obj, sessionPath);
+  }
   if (obj.version !== SESSION_VERSION) {
-    throw new SessionParseError(`unsupported session version ${String(obj.version)} at ${sessionPath}; expected ${SESSION_VERSION}`);
+    throw new SessionParseError(`unsupported session version ${String(obj.version)} at ${sessionPath}; expected ${SESSION_VERSION} or ${GATEWAY_SESSION_VERSION}`);
   }
   for (const k of [
     "accessToken",
@@ -416,6 +435,20 @@ async function readSession(sessionPath) {
   }
   return obj;
 }
+function parseGatewaySession(obj, sessionPath) {
+  if (obj.kind !== "gateway") {
+    throw new SessionParseError(`session file at ${sessionPath}: version 2 with unknown kind ${String(obj.kind)}`);
+  }
+  for (const k of ["accessToken", "refreshToken", "gatewayUrl", "issuedAt"]) {
+    if (typeof obj[k] !== "string") {
+      throw new SessionParseError(`session file at ${sessionPath}: missing or non-string ${k}`);
+    }
+  }
+  if (typeof obj.accessTokenExpiresAt !== "number") {
+    throw new SessionParseError(`session file at ${sessionPath}: missing or non-number accessTokenExpiresAt`);
+  }
+  return obj;
+}
 async function writeSession(sessionPath, session) {
   const dir = path2.dirname(sessionPath);
   await fs.mkdir(dir, { recursive: true, mode: 448 });
@@ -453,6 +486,9 @@ function describe4(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
+// src/auth/gateway-flow.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+
 // src/auth/browser.ts
 import { spawn } from "node:child_process";
 
@@ -487,16 +523,185 @@ function chooseOpener(platform, url) {
   }
 }
 
+// src/auth/gateway-flow.ts
+var CLI_SESSION_AUTH_PATH = "/__cli_session_auth";
+var CLI_SESSION_TOKEN_PATH = "/__cli_session_token";
+var CLI_LOGOUT_PATH = "/__cli_logout";
+
+class GatewayUnavailableError extends Error {
+  code = "gateway_unavailable";
+}
+
+class GatewayTokenError extends Error {
+  code = "gateway_token_error";
+  httpStatus;
+  constructor(message, httpStatus) {
+    super(message);
+    this.name = "GatewayTokenError";
+    if (httpStatus !== undefined)
+      this.httpStatus = httpStatus;
+  }
+}
+
+class GatewayRateLimitError extends Error {
+  code = "gateway_rate_limited";
+  retryAfterSec;
+  constructor(retryAfterSec) {
+    super(`gateway rate-limited the request — retry in ${retryAfterSec}s (your session is intact)`);
+    this.name = "GatewayRateLimitError";
+    this.retryAfterSec = retryAfterSec;
+  }
+}
+async function gatewayLogin(opts) {
+  const fetcher = opts.fetcher ?? fetch;
+  const opener = opts.browserOpener ?? ((url) => openBrowser(url));
+  await probeGateway(opts.gatewayUrl, fetcher);
+  const state = randomBytes3(16).toString("hex");
+  const server = await bindCallbackServer(state);
+  try {
+    const redirectUri = `http://127.0.0.1:${server.port}/callback`;
+    const pkce = generatePkcePair();
+    const u = new URL(`${opts.gatewayUrl}${CLI_SESSION_AUTH_PATH}`);
+    u.searchParams.set("cb", redirectUri);
+    u.searchParams.set("code_challenge", pkce.challenge);
+    u.searchParams.set("state", state);
+    const authUrl = u.toString();
+    opts.onAuthUrl?.(authUrl);
+    try {
+      await opener(authUrl);
+    } catch (e) {
+      opts.onAuthUrl?.(`(could not auto-open browser: ${describe5(e)} — copy the URL above into a browser instead)`);
+    }
+    const callback = await server.result;
+    const pair = await postSessionTokenForm(opts.gatewayUrl, new URLSearchParams({
+      grant_type: "authorization_code",
+      code: callback.code,
+      code_verifier: pkce.verifier
+    }), fetcher);
+    const session = {
+      version: GATEWAY_SESSION_VERSION,
+      kind: "gateway",
+      accessToken: pair.accessToken,
+      refreshToken: pair.refreshToken,
+      accessTokenExpiresAt: Date.now() + pair.expiresInSec * 1000,
+      gatewayUrl: opts.gatewayUrl,
+      issuedAt: new Date().toISOString()
+    };
+    await writeSession(opts.sessionPath, session);
+    return session;
+  } finally {
+    await server.close();
+  }
+}
+async function refreshGatewayTokens(params, fetcher = fetch) {
+  return postSessionTokenForm(params.gatewayUrl, new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: params.refreshToken
+  }), fetcher);
+}
+async function revokeGatewaySession(params, fetcher = fetch) {
+  const url = `${params.gatewayUrl}${CLI_LOGOUT_PATH}`;
+  let res;
+  try {
+    res = await fetcher(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ refresh_token: params.refreshToken }).toString()
+    });
+  } catch (e) {
+    throw new GatewayTokenError(`logout endpoint: network error: ${describe5(e)}`);
+  }
+  if (res.status === 429) {
+    throw new GatewayRateLimitError(readRetryAfter(res));
+  }
+  if (res.status !== 204 && !res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new GatewayTokenError(`logout endpoint returned HTTP ${res.status}: ${detail.slice(0, 200)}`, res.status);
+  }
+}
+async function probeGateway(gatewayUrl, fetcher) {
+  const url = `${gatewayUrl}${CLI_SESSION_AUTH_PATH}`;
+  let res;
+  try {
+    res = await fetcher(url, { method: "GET" });
+  } catch (e) {
+    throw new GatewayUnavailableError(`auth gateway unreachable at ${gatewayUrl}: ${describe5(e)}`);
+  }
+  if (res.status === 429) {
+    throw new GatewayRateLimitError(readRetryAfter(res));
+  }
+  if (res.status !== 400) {
+    throw new GatewayUnavailableError(`auth gateway at ${gatewayUrl} is not serving the cli-session grant (HTTP ${res.status} from ${CLI_SESSION_AUTH_PATH})`);
+  }
+}
+async function postSessionTokenForm(gatewayUrl, form, fetcher) {
+  const url = `${gatewayUrl}${CLI_SESSION_TOKEN_PATH}`;
+  let res;
+  try {
+    res = await fetcher(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: form.toString()
+    });
+  } catch (e) {
+    throw new GatewayTokenError(`session token endpoint: network error: ${describe5(e)}`);
+  }
+  if (res.status === 429) {
+    throw new GatewayRateLimitError(readRetryAfter(res));
+  }
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new GatewayTokenError(`session token endpoint returned HTTP ${res.status}: ${detail.slice(0, 200)}`, res.status);
+  }
+  let parsed;
+  try {
+    parsed = await res.json();
+  } catch (e) {
+    throw new GatewayTokenError(`session token endpoint: non-JSON response: ${describe5(e)}`);
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    throw new GatewayTokenError(`session token endpoint: response is not an object`);
+  }
+  const obj = parsed;
+  if (typeof obj.access_token !== "string") {
+    throw new GatewayTokenError(`session token endpoint: response missing access_token`);
+  }
+  if (typeof obj.refresh_token !== "string") {
+    throw new GatewayTokenError(`session token endpoint: response missing refresh_token`);
+  }
+  const expiresIn = obj.expires_in;
+  if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new GatewayTokenError(`session token endpoint: response missing positive finite numeric expires_in (got ${String(expiresIn)})`);
+  }
+  return {
+    accessToken: obj.access_token,
+    refreshToken: obj.refresh_token,
+    expiresInSec: expiresIn
+  };
+}
+function readRetryAfter(res) {
+  const raw = res.headers.get("retry-after");
+  const n = raw === null ? NaN : Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : 60;
+}
+function describe5(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+
 // src/auth/flow.ts
 class LoginRequiredError extends Error {
   code = "login_required";
 }
 var REFRESH_SKEW_MS = 30000;
+var MAX_ABSORBED_RETRY_AFTER_SEC = 10;
 async function login(opts) {
   const fetcher = opts.fetcher ?? fetch;
   const opener = opts.browserOpener ?? ((url) => openBrowser(url));
   const endpoints = await discoverOauthEndpoints(opts.botUrl, fetcher);
-  const state = randomBytes3(16).toString("hex");
+  const state = randomBytes4(16).toString("hex");
   const server = await bindCallbackServer(state);
   try {
     const redirectUri = `http://127.0.0.1:${server.port}/callback`;
@@ -514,7 +719,7 @@ async function login(opts) {
     try {
       await opener(authUrl);
     } catch (e) {
-      opts.onAuthUrl?.(`(could not auto-open browser: ${describe5(e)} — copy the URL above into a browser instead)`);
+      opts.onAuthUrl?.(`(could not auto-open browser: ${describe6(e)} — copy the URL above into a browser instead)`);
     }
     const callback = await server.result;
     const tokens = await exchangeCodeForTokens({
@@ -541,7 +746,7 @@ async function login(opts) {
     await server.close();
   }
 }
-async function getValidAccessToken(sessionPath, fetcher = fetch, now = Date.now) {
+async function getValidAccessToken(sessionPath, fetcher = fetch, now = Date.now, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
   const session = await readSession(sessionPath);
   if (session === null) {
     throw new LoginRequiredError("no session — run `launchpad login`");
@@ -549,6 +754,9 @@ async function getValidAccessToken(sessionPath, fetcher = fetch, now = Date.now)
   if (session.accessTokenExpiresAt - REFRESH_SKEW_MS > now()) {
     return { accessToken: session.accessToken, session };
   }
+  if (isGatewaySession(session)) {
+    return refreshGatewaySession(session, sessionPath, fetcher, now, sleep);
+  }
   if (session.resource === undefined) {
     throw new LoginRequiredError("session was written by a pre-0.7.1 CLI and is missing the resource indicator — run `launchpad login`");
   }
@@ -576,7 +784,39 @@ async function getValidAccessToken(sessionPath, fetcher = fetch, now = Date.now)
   await writeSession(sessionPath, refreshed);
   return { accessToken: refreshed.accessToken, session: refreshed };
 }
-function describe5(e) {
+async function refreshGatewaySession(session, sessionPath, fetcher, now, sleep) {
+  let pair;
+  try {
+    try {
+      pair = await refreshGatewayTokens({ gatewayUrl: session.gatewayUrl, refreshToken: session.refreshToken }, fetcher);
+    } catch (e) {
+      if (e instanceof GatewayRateLimitError && e.retryAfterSec <= MAX_ABSORBED_RETRY_AFTER_SEC) {
+        await sleep(e.retryAfterSec * 1000);
+        pair = await refreshGatewayTokens({ gatewayUrl: session.gatewayUrl, refreshToken: session.refreshToken }, fetcher);
+      } else {
+        throw e;
+      }
+    }
+  } catch (e) {
+    if (e instanceof GatewayTokenError && (e.httpStatus === 400 || e.httpStatus === 401)) {
+      await clearSession(sessionPath).catch(() => {
+        return;
+      });
+      throw new LoginRequiredError(`session revoked or expired — run \`launchpad login\` (gateway said: ${e.message})`);
+    }
+    throw e;
+  }
+  const refreshed = {
+    ...session,
+    accessToken: pair.accessToken,
+    refreshToken: pair.refreshToken,
+    accessTokenExpiresAt: now() + pair.expiresInSec * 1000,
+    issuedAt: new Date(now()).toISOString()
+  };
+  await writeSession(sessionPath, refreshed);
+  return { accessToken: refreshed.accessToken, session: refreshed };
+}
+function describe6(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function buildAuthorizationUrl(params) {
@@ -598,7 +838,7 @@ async function apiJson(cfg, opts, fetcher = fetch) {
   try {
     parsed = await res.json();
   } catch (e) {
-    throw new TransportError(`bot returned non-JSON body for ${opts.path}: ${describe6(e)}`);
+    throw new TransportError(`bot returned non-JSON body for ${opts.path}: ${describe7(e)}`);
   }
   return parsed;
 }
@@ -640,7 +880,7 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
   try {
     res = await fetcher(url, init);
   } catch (e) {
-    throw new TransportError(`network error calling ${url}: ${describe6(e)}`);
+    throw new TransportError(`network error calling ${url}: ${describe7(e)}`);
   }
   if (res.status === 401) {
     const detail = await peek(res);
@@ -671,7 +911,7 @@ async function peek(res) {
     return "";
   }
 }
-function describe6(e) {
+function describe7(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -701,7 +941,7 @@ async function runApps(_args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad apps failed: ${describe7(e)}`);
+    io.err(`launchpad apps failed: ${describe8(e)}`);
     return 1;
   }
 }
@@ -749,7 +989,7 @@ function formatRelative(iso) {
     return `${hr}h ago`;
   return `${Math.floor(hr / 24)}d ago`;
 }
-function describe7(e) {
+function describe8(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -1046,7 +1286,7 @@ async function runClone(args, io) {
       io.err(`launchpad clone: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad clone failed: ${describe8(e)}`);
+    io.err(`launchpad clone failed: ${describe9(e)}`);
     return 1;
   }
 }
@@ -1063,7 +1303,7 @@ function formatBytes(n) {
     return `${(n / 1024).toFixed(1)}KB`;
   return `${(n / (1024 * 1024)).toFixed(1)}MB`;
 }
-function describe8(e) {
+function describe9(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -1129,7 +1369,7 @@ async function runCreate(args, io) {
       io.err(`launchpad create: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad create failed: ${describe9(e)}`);
+    io.err(`launchpad create failed: ${describe10(e)}`);
     return 1;
   }
 }
@@ -1214,13 +1454,13 @@ function printUsage(io) {
   ].join(`
 `));
 }
-function describe9(e) {
+function describe10(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync4 } from "node:fs";
-import * as path6 from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import * as path7 from "node:path";
 
 // src/bundle/orchestrate.ts
 import { readFileSync as readFileSync4 } from "node:fs";
@@ -3306,8 +3546,8 @@ async function bundleAndDeploy(args) {
 }
 
 // src/commands/deploy.ts
-import { parse as parseYaml4 } from "yaml";
-import { readFileSync as readFileSync6 } from "node:fs";
+import { parse as parseYaml5 } from "yaml";
+import { readFileSync as readFileSync7 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -3882,7 +4122,7 @@ async function pollUntilApplied(args) {
         path: `/apps/${args.slug}/manifest/state`
       }, args.fetcher);
     } catch (e) {
-      args.io.err(`! state fetch failed (will retry): ${describe10(e)}`);
+      args.io.err(`! state fetch failed (will retry): ${describe11(e)}`);
       await sleep(args.pollIntervalSec * 1000);
       continue;
     }
@@ -3942,7 +4182,7 @@ function deletePinIfPresent(cfg, slug, io) {
     rmSync(pinPath, { force: true });
     io.out(`  (cleaned up obsolete pin file ${pinPath})`);
   } catch (e) {
-    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe10(e)}`);
+    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe11(e)}`);
   }
 }
 async function loadSlugForResume(opts, io) {
@@ -3966,7 +4206,7 @@ async function defaultPrompt(question) {
     rl.close();
   }
 }
-function describe10(e) {
+function describe11(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError(e, slug, io) {
@@ -3990,7 +4230,7 @@ function mapHttpError(e, slug, io) {
     io.err(`launchpad deploy --apply: ${e.message}`);
     return 1;
   }
-  io.err(`launchpad deploy --apply failed: ${describe10(e)}`);
+  io.err(`launchpad deploy --apply failed: ${describe11(e)}`);
   return 2;
 }
 function renderManifestError(loaded, io) {
@@ -4032,7 +4272,7 @@ async function runDeployDryRun(opts, io, deps = {}) {
   try {
     manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
   } catch (e) {
-    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe11(e)}`;
+    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe12(e)}`;
     if (opts.json) {
       io.out(JSON.stringify({ ok: false, kind: "git-error", message: msg }));
     } else {
@@ -4081,7 +4321,7 @@ function defaultGitHeadSha(cwd) {
   });
   return out.trim();
 }
-function describe11(e) {
+function describe12(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError2(e, slug, json, io) {
@@ -4367,6 +4607,46 @@ function handleNetworkError(e, io, slug, verb) {
   return 1;
 }
 
+// src/commands/infer-slug.ts
+import * as path6 from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
+import { parse as parseYaml4 } from "yaml";
+var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
+function inferSlugFromCwd(cwd) {
+  const base = path6.basename(cwd);
+  const m = base.match(DIRNAME_RE);
+  return m === null ? null : m[1];
+}
+function resolveManifestSlug(parsed) {
+  if (parsed === null || typeof parsed !== "object" || typeof parsed.metadata !== "object" || parsed.metadata === null) {
+    return null;
+  }
+  const meta = parsed.metadata;
+  if (typeof meta.slug === "string")
+    return meta.slug;
+  if (typeof meta.name === "string")
+    return meta.name;
+  return null;
+}
+function inferSlugFromManifestFile(manifestPath) {
+  if (!existsSync4(manifestPath))
+    return null;
+  try {
+    return resolveManifestSlug(parseYaml4(readFileSync6(manifestPath, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function inferSlug(opts) {
+  const manifestPath = path6.resolve(opts.cwd, opts.file ?? "launchpad.yaml");
+  const fromManifest = inferSlugFromManifestFile(manifestPath);
+  const fromDir = inferSlugFromCwd(opts.cwd);
+  if (fromManifest !== null && fromDir !== null && fromManifest !== fromDir) {
+    opts.warn?.(`note: directory name suggests "${fromDir}" but ${path6.basename(manifestPath)} ` + `declares "${fromManifest}" — using the manifest. ` + `(Pass <slug> or --slug to override.)`);
+  }
+  return fromManifest ?? fromDir;
+}
+
 // src/commands/deploy.ts
 var deployCommand = {
   name: "deploy",
@@ -4374,27 +4654,17 @@ var deployCommand = {
   run: runDeploy
 };
 var SLUG_RE4 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 async function runDeploy(args, io) {
   const flags = parseDeployFlags(args);
   if (typeof flags === "string") {
     io.err(`launchpad deploy: ${flags}`);
+    const isFlagMisuse = flags.includes("is only valid with") || flags.includes("does not accept") || flags.includes("mutually exclusive");
+    if (isFlagMisuse) {
+      io.err("       (run `launchpad deploy` with no flags from your app directory for a content deploy)");
+      return 64;
+    }
     io.err("");
-    io.err(`usage: launchpad deploy [--message <text>] [--slug <slug>]
-` + "       (slug defaults to the current directory's `launchpad-app-<slug>` suffix)\n" + `
-` + `M-892 modes:
-` + `       launchpad deploy --resume <slug>
-` + `       launchpad deploy --abandon <slug>
-` + `       launchpad deploy --new --slug <slug> --display-name <name>
-` + `                        --app-type <${APP_TYPES.join("|")}>
-` + `                        --allowed-group <G_KEY> [--allowed-group ...]
-` + `
-` + `Scope 6 dry-run (manifest-driven preview, read-only):
-` + `       launchpad deploy --dry-run [--file <manifest>] [--json]
-` + `
-` + `Scope 6 apply (manifest-driven, writes TF + runs terraform apply):
-` + `       launchpad deploy --apply --platform-repo <path>
-` + "                        [--file <manifest>] [--re-pin] [--yes]");
+    io.err(deployUsage());
     return 64;
   }
   if (flags.mode.kind === "dry-run") {
@@ -4428,8 +4698,8 @@ async function runDeploy(args, io) {
     }, io);
   }
   const cwd = process.cwd();
-  const manifestPath = path6.join(cwd, "launchpad.yaml");
-  if (existsSync4(manifestPath)) {
+  const manifestPath = path7.join(cwd, "launchpad.yaml");
+  if (existsSync5(manifestPath)) {
     return runModelADeploy({ cwd, manifestPath, argv: args, io });
   }
   const parsed = parseArgs2(args);
@@ -4441,9 +4711,9 @@ async function runDeploy(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad deploy: could not infer slug from cwd (${path6.basename(process.cwd())});
+      io.err(`launchpad deploy: could not infer slug from cwd (${path7.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -4463,10 +4733,10 @@ async function runDeploy(args, io) {
       return 1;
     }
     let contentManifestYaml = null;
-    const contentManifestPath = path6.join(process.cwd(), "launchpad.yaml");
-    if (existsSync4(contentManifestPath)) {
+    const contentManifestPath = path7.join(process.cwd(), "launchpad.yaml");
+    if (existsSync5(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync6(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync7(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -4540,10 +4810,28 @@ async function runDeploy(args, io) {
       io.err(`launchpad deploy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad deploy failed: ${describe12(e)}`);
+    io.err(`launchpad deploy failed: ${describe13(e)}`);
     return 1;
   }
 }
+function deployUsage() {
+  return `usage: launchpad deploy [--message <text>] [--slug <slug>]
+` + `       (slug comes from launchpad.yaml at cwd when present — Model A —
+` + "        else from the current directory's `launchpad-app-<slug>` suffix)\n" + `
+` + `provisioning modes:
+` + `       launchpad deploy --resume <slug>
+` + `       launchpad deploy --abandon <slug>
+` + `       launchpad deploy --new --slug <slug> --display-name <name>
+` + `                        --app-type <${APP_TYPES.join("|")}>
+` + `                        --allowed-group <G_KEY> [--allowed-group ...]
+` + `
+` + `manifest-driven dry-run (read-only preview):
+` + `       launchpad deploy --dry-run [--file <manifest>] [--json]
+` + `
+` + `manifest-driven apply (runs server-side via portal-bot):
+` + `       launchpad deploy --apply [--file <manifest>] [--at <sha>] [--re-pin]
+` + "                        [--yes] [--resume-pr <n>] [--timeout-minutes <n>]";
+}
 function parseArgs2(args) {
   let message = null;
   let slug = null;
@@ -4570,11 +4858,6 @@ function parseArgs2(args) {
   }
   return { slug, message };
 }
-function inferSlugFromCwd(cwd) {
-  const base = path6.basename(cwd);
-  const m = base.match(DIRNAME_RE);
-  return m === null ? null : m[1];
-}
 function makeBytesFetcher(bytes, pathSuffix) {
   return async (input, init) => {
     const targetUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -4599,7 +4882,7 @@ function formatBytes2(n) {
     return `${(n / 1024).toFixed(1)}KB`;
   return `${(n / (1024 * 1024)).toFixed(1)}MB`;
 }
-function describe12(e) {
+function describe13(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function surfaceDeployExtras(body, io, slug) {
@@ -4624,29 +4907,18 @@ function surfaceDeployExtras(body, io, slug) {
     io.out(`  Full list: \`launchpad status ${slug}\`.`);
   }
 }
-function resolveManifestSlug(parsed) {
-  if (parsed === null || typeof parsed !== "object" || typeof parsed.metadata !== "object" || parsed.metadata === null) {
-    return null;
-  }
-  const meta = parsed.metadata;
-  if (typeof meta.slug === "string")
-    return meta.slug;
-  if (typeof meta.name === "string")
-    return meta.name;
-  return null;
-}
 async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
   try {
-    const metaSlug = resolveManifestSlug(parseYaml4(readFileSync6(manifestPath, "utf8")));
+    const metaSlug = resolveManifestSlug(parseYaml5(readFileSync7(manifestPath, "utf8")));
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
       return 64;
     }
     slug = metaSlug;
   } catch (e) {
-    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe12(e)}`);
+    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe13(e)}`);
     return 1;
   }
   if (!SLUG_RE4.test(slug)) {
@@ -4658,7 +4930,7 @@ async function runModelADeploy(args) {
   try {
     cfg = loadConfig();
   } catch (e) {
-    io.err(`launchpad deploy: ${describe12(e)}`);
+    io.err(`launchpad deploy: ${describe13(e)}`);
     return 1;
   }
   let result;
@@ -4670,7 +4942,7 @@ async function runModelADeploy(args) {
       io.err("       run `launchpad login` to refresh your session.");
       return 1;
     }
-    io.err(`launchpad deploy: unexpected error: ${describe12(e)}`);
+    io.err(`launchpad deploy: unexpected error: ${describe13(e)}`);
     return 1;
   }
   switch (result.kind) {
@@ -4715,6 +4987,11 @@ async function runModelADeploy(args) {
           io.err(`         - ${String(f.path)} [${String(f.rule)}]`);
         }
       }
+      if (errorCode === "bundle_policy_violation" || errorCode === "app_boundary_violation" || errorCode === "bad_build_command") {
+        io.err("");
+        io.err("       Nothing was committed or claimed by this attempt — fix the");
+        io.err("       listed file(s) and re-run `launchpad deploy`; the retry is clean.");
+      }
       return 1;
     }
     case "ok": {
@@ -4740,9 +5017,12 @@ async function runModelADeploy(args) {
         io.out("");
         io.out(message);
         io.out("");
+        io.out(`Your bundle ships with this provisioning run — when lifecycle reaches "live",`);
+        io.out("this deploy's content is what's serving. No second deploy needed.");
+        io.out("");
         io.out("Next steps:");
         io.out(`  launchpad status ${slug}     # watch lifecycle (provisioning → live)`);
-        io.out(`  launchpad deploy             # re-run once lifecycle is "live"`);
+        io.out(`  launchpad deploy             # only if the app comes up live WITHOUT your content (rare)`);
         return 0;
       }
       if (typeof success.commit_sha !== "string" || typeof success.repo !== "string") {
@@ -4771,14 +5051,13 @@ async function runModelADeploy(args) {
 }
 
 // src/commands/envvars.ts
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 var envvarsCommand = {
   name: "envvars",
   summary: "list / set / remove production env vars (slug-scoped)",
   run: runEnvvars
 };
 var SLUG_RE5 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE2 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 var ENV_KEY_RE = /^[A-Z][A-Z0-9_]*$/;
 async function runEnvvars(args, io) {
   const parsed = parseArgs3(args);
@@ -4790,9 +5069,9 @@ async function runEnvvars(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd2(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad envvars: could not infer slug from cwd (${path7.basename(process.cwd())});
+      io.err(`launchpad envvars: could not infer slug from cwd (${path8.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -4860,7 +5139,7 @@ async function runEnvvars(args, io) {
       io.err(`launchpad envvars: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad envvars failed: ${describe13(e)}`);
+    io.err(`launchpad envvars failed: ${describe14(e)}`);
     return 1;
   }
 }
@@ -4938,11 +5217,6 @@ function parseArgs3(args) {
   }
   return null;
 }
-function inferSlugFromCwd2(cwd) {
-  const base = path7.basename(cwd);
-  const m = base.match(DIRNAME_RE2);
-  return m === null ? null : m[1];
-}
 function renderList(envVars, io) {
   if (envVars.length === 0) {
     io.out("(no env vars set)");
@@ -4962,13 +5236,13 @@ function renderList(envVars, io) {
     io.out(fmt(row));
   }
 }
-function describe13(e) {
+function describe14(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/generate.ts
-import { mkdirSync, readFileSync as readFileSync7, writeFileSync } from "node:fs";
-import { dirname as dirname4, resolve as resolve6, relative as relative3 } from "node:path";
+import { mkdirSync, readFileSync as readFileSync8, writeFileSync } from "node:fs";
+import { dirname as dirname4, resolve as resolve7, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
   summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
@@ -4981,14 +5255,14 @@ async function runGenerate(args, io) {
     io.err("Usage: launchpad generate [--file <path>] [--dry-run] [--force] [--json]");
     return 64;
   }
-  const manifestPath = resolve6(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve7(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
   const appRoot = dirname4(manifestPath);
-  const wranglerPath = resolve6(appRoot, "container", "wrangler.toml");
-  const workflowPath = resolve6(appRoot, ".github", "workflows", "deploy.yml");
+  const wranglerPath = resolve7(appRoot, "container", "wrangler.toml");
+  const workflowPath = resolve7(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
   const workflowOut = generateGithubDeployWorkflow(result.manifest);
   if (flags.dryRun) {
@@ -5003,7 +5277,7 @@ async function runGenerate(args, io) {
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
-function applyOne(artefact, path8, out, force) {
+function applyOne(artefact, path9, out, force) {
   if (out.kind === "not-applicable") {
     return {
       artefact,
@@ -5011,32 +5285,32 @@ function applyOne(artefact, path8, out, force) {
       warnings: []
     };
   }
-  const existing = readIfExists(path8);
+  const existing = readIfExists(path9);
   if (existing.kind === "read-error") {
     return {
       artefact,
-      action: { kind: "write-error", path: path8, message: existing.message },
+      action: { kind: "write-error", path: path9, message: existing.message },
       warnings: out.warnings
     };
   }
   if (existing.kind === "ok" && existing.content === out.content) {
-    return { artefact, action: { kind: "unchanged", path: path8 }, warnings: out.warnings };
+    return { artefact, action: { kind: "unchanged", path: path9 }, warnings: out.warnings };
   }
   if (existing.kind === "ok" && existing.content !== out.content && !force) {
     return {
       artefact,
-      action: { kind: "would-overwrite", path: path8 },
+      action: { kind: "would-overwrite", path: path9 },
       warnings: out.warnings
     };
   }
   try {
-    mkdirSync(dirname4(path8), { recursive: true });
-    writeFileSync(path8, out.content, "utf8");
+    mkdirSync(dirname4(path9), { recursive: true });
+    writeFileSync(path9, out.content, "utf8");
     return {
       artefact,
       action: {
         kind: "written",
-        path: path8,
+        path: path9,
         bytes: Buffer.byteLength(out.content, "utf8")
       },
       warnings: out.warnings
@@ -5046,16 +5320,16 @@ function applyOne(artefact, path8, out, force) {
       artefact,
       action: {
         kind: "write-error",
-        path: path8,
+        path: path9,
         message: err.message ?? String(err)
       },
       warnings: out.warnings
     };
   }
 }
-function readIfExists(path8) {
+function readIfExists(path9) {
   try {
-    return { kind: "ok", content: readFileSync7(path8, "utf8") };
+    return { kind: "ok", content: readFileSync8(path9, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -5266,7 +5540,7 @@ function parseFlags(args) {
 }
 
 // src/groups/client.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname5, join as join9 } from "node:path";
 var CACHE_TTL_MS = 60 * 60 * 1000;
 var CACHE_FILENAME = "groups.json";
@@ -5294,7 +5568,7 @@ async function fetchGroups(cfg, opts = {}) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       throw e;
     }
-    return { kind: "error", message: describe14(e) };
+    return { kind: "error", message: describe15(e) };
   }
   if (typeof response !== "object" || response === null || !Array.isArray(response.groups) || !response.groups.every(isEntraGroup)) {
     return {
@@ -5307,10 +5581,10 @@ async function fetchGroups(cfg, opts = {}) {
   writeCache(cachePath, { fetchedAt, groups });
   return { kind: "ok", source: "fresh", fetchedAt, groups };
 }
-function readCache(path8) {
+function readCache(path9) {
   let raw;
   try {
-    raw = readFileSync8(path8, "utf8");
+    raw = readFileSync9(path9, "utf8");
   } catch {
     return null;
   }
@@ -5338,13 +5612,13 @@ function isEntraGroup(value) {
   const g = value;
   return typeof g.id === "string" && typeof g.displayName === "string" && (typeof g.mailNickname === "string" || g.mailNickname === null);
 }
-function writeCache(path8, envelope) {
+function writeCache(path9, envelope) {
   try {
-    mkdirSync2(dirname5(path8), { recursive: true });
-    writeFileSync2(path8, JSON.stringify(envelope), "utf8");
+    mkdirSync2(dirname5(path9), { recursive: true });
+    writeFileSync2(path9, JSON.stringify(envelope), "utf8");
   } catch {}
 }
-function describe14(e) {
+function describe15(e) {
   return e instanceof Error ? e.message : String(e);
 }
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -5382,13 +5656,13 @@ function decodeJwtPayload(token) {
   try {
     json = Buffer.from(b64UrlToB64(payload), "base64").toString("utf8");
   } catch (e) {
-    throw new JwtParseError(`could not base64-decode JWT payload: ${describe15(e)}`);
+    throw new JwtParseError(`could not base64-decode JWT payload: ${describe16(e)}`);
   }
   let parsed;
   try {
     parsed = JSON.parse(json);
   } catch (e) {
-    throw new JwtParseError(`JWT payload is not JSON: ${describe15(e)}`);
+    throw new JwtParseError(`JWT payload is not JSON: ${describe16(e)}`);
   }
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new JwtParseError(`JWT payload is not an object`);
@@ -5399,7 +5673,7 @@ function b64UrlToB64(s) {
   const padded = s.padEnd(s.length + (4 - s.length % 4) % 4, "=");
   return padded.replace(/-/g, "+").replace(/_/g, "/");
 }
-function describe15(e) {
+function describe16(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -5426,7 +5700,7 @@ async function runGroupsWhoami(args, io) {
   try {
     payload = decodeJwtPayload(session.accessToken);
   } catch (e) {
-    const message = e instanceof JwtParseError ? e.message : describe16(e);
+    const message = e instanceof JwtParseError ? e.message : describe17(e);
     if (json) {
       io.out(JSON.stringify({ ok: false, kind: "jwt-parse-error", message }));
     } else {
@@ -5507,7 +5781,7 @@ function parseFlags2(args) {
   }
   return { kind: "ok", json };
 }
-function describe16(e) {
+function describe17(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -5610,7 +5884,7 @@ async function loadGroups(io, refresh, json) {
       }
       return { kind: "error", code: 3 };
     }
-    renderFetchError(io, describe17(e), json);
+    renderFetchError(io, describe18(e), json);
     return { kind: "error", code: 2 };
   }
 }
@@ -5805,23 +6079,23 @@ function renderTable2(io, groups) {
   for (const r of rows)
     io.out(fmt(r));
 }
-function describe17(e) {
+function describe18(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync5, readFileSync as readFileSync9, statSync } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync10, statSync } from "node:fs";
 import { join as join10 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync5(join10(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync5(join10(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync5(join10(cwd, n)));
+  const hasPackageJson = existsSync6(join10(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync6(join10(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync6(join10(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -5867,7 +6141,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync5(join10(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync6(join10(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -5890,7 +6164,7 @@ function detectPackageManager(cwd) {
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
     const p = join10(cwd, name);
-    if (existsSync5(p)) {
+    if (existsSync6(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -5902,7 +6176,7 @@ function detectVitePresence(cwd) {
 function detectAppType(cwd) {
   const fnDir = join10(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync5(fnDir)) {
+  if (existsSync6(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -5913,7 +6187,7 @@ function detectAppType(cwd) {
 }
 function detectBuildCommand(cwd, pm) {
   const pkgJsonPath = join10(cwd, "package.json");
-  if (!existsSync5(pkgJsonPath)) {
+  if (!existsSync6(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -5921,7 +6195,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync9(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync10(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -5956,7 +6230,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync9(vite.path, "utf8");
+    text = readFileSync10(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -5985,8 +6259,8 @@ async function runInit(args, io, prompt) {
     return 64;
   }
   const { inputs, options } = parsed;
-  const outPath = resolve7(process.cwd(), options.out);
-  if (existsSync6(outPath) && !options.force) {
+  const outPath = resolve8(process.cwd(), options.out);
+  if (existsSync7(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -6033,7 +6307,7 @@ async function runInit(args, io, prompt) {
   }
   io.out(`✓ wrote ${outPath}`);
   if (options.gitignore) {
-    const gitignorePath = resolve7(process.cwd(), ".gitignore");
+    const gitignorePath = resolve8(process.cwd(), ".gitignore");
     try {
       const changed = ensureGitignoreEntries(gitignorePath, [".env", ".env.local"]);
       if (changed.length > 0) {
@@ -6402,10 +6676,10 @@ function buildManifest(inputs, detected) {
 function renderYaml(manifest) {
   return yamlStringify(manifest, { lineWidth: 0 });
 }
-function ensureGitignoreEntries(path8, entries) {
+function ensureGitignoreEntries(path9, entries) {
   let current = "";
-  if (existsSync6(path8)) {
-    current = readFileSync10(path8, "utf8");
+  if (existsSync7(path9)) {
+    current = readFileSync11(path9, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -6423,7 +6697,7 @@ function ensureGitignoreEntries(path8, entries) {
     }
   }
   if (added.length > 0) {
-    writeFileSync3(path8, out, { encoding: "utf8" });
+    writeFileSync3(path9, out, { encoding: "utf8" });
   }
   return added;
 }
@@ -6441,68 +6715,122 @@ async function defaultPrompt2(question, fallback) {
 }
 
 // src/commands/login.ts
-var loginCommand = {
-  name: "login",
-  summary: "authenticate (browser-based PKCE) and store a session",
-  run: runLogin
-};
-async function runLogin(_args, io) {
+var REAL_DEPS = { gatewayLogin, legacyLogin: login };
+var loginCommand = makeLoginCommand();
+function makeLoginCommand(deps = REAL_DEPS) {
+  return {
+    name: "login",
+    summary: "authenticate (browser-based PKCE) and store a session",
+    run: (args, io) => runLogin(args, io, deps)
+  };
+}
+async function runLogin(_args, io, deps) {
   try {
     const cfg = loadConfig();
-    io.out("Opening browser to authenticate with Cloudflare Access…");
+    if (cfg.authLegacy) {
+      io.out("LAUNCHPAD_AUTH_LEGACY=1 — using the legacy Cloudflare Access flow (deprecated; this path will be removed when the dual-auth window closes).");
+      return await runLegacyLogin(io, cfg.botUrl, cfg.sessionPath, deps);
+    }
+    io.out("Opening browser to sign in via the Launchpad auth gateway…");
     io.out("(if it doesn't open automatically, copy the URL below)");
     io.out("");
-    const session = await login({
-      botUrl: cfg.botUrl,
-      sessionPath: cfg.sessionPath,
-      onAuthUrl: (url) => {
-        io.out(url);
-        io.out("");
-      }
-    });
-    const expiresIn = Math.max(0, Math.round((session.accessTokenExpiresAt - Date.now()) / 1000));
-    io.out(`Logged in. Session stored at ${cfg.sessionPath}`);
-    io.out(`Access token expires in ~${expiresIn}s; refreshes silently.`);
-    return 0;
+    try {
+      const session = await deps.gatewayLogin({
+        gatewayUrl: cfg.authGatewayUrl,
+        sessionPath: cfg.sessionPath,
+        onAuthUrl: (url) => {
+          io.out(url);
+          io.out("");
+        }
+      });
+      const expiresIn = Math.max(0, Math.round((session.accessTokenExpiresAt - Date.now()) / 1000));
+      io.out(`Logged in. Session stored at ${cfg.sessionPath}`);
+      io.out(`Access token expires in ~${expiresIn}s; refreshes silently.`);
+      return 0;
+    } catch (e) {
+      io.err(`Gateway login failed: ${describe19(e)}`);
+      io.err("Falling back to the legacy Cloudflare Access flow (DEPRECATED — this fallback will be removed when the dual-auth window closes).");
+      io.err("");
+      return await runLegacyLogin(io, cfg.botUrl, cfg.sessionPath, deps);
+    }
   } catch (e) {
-    io.err(`launchpad login failed: ${describe18(e)}`);
+    io.err(`launchpad login failed: ${describe19(e)}`);
     return 1;
   }
 }
-function describe18(e) {
+async function runLegacyLogin(io, botUrl, sessionPath, deps) {
+  io.out("Opening browser to authenticate with Cloudflare Access…");
+  io.out("(if it doesn't open automatically, copy the URL below)");
+  io.out("");
+  const session = await deps.legacyLogin({
+    botUrl,
+    sessionPath,
+    onAuthUrl: (url) => {
+      io.out(url);
+      io.out("");
+    }
+  });
+  const expiresIn = Math.max(0, Math.round((session.accessTokenExpiresAt - Date.now()) / 1000));
+  io.out(`Logged in. Session stored at ${sessionPath}`);
+  io.out(`Access token expires in ~${expiresIn}s; refreshes silently.`);
+  return 0;
+}
+function describe19(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/logout.ts
-var logoutCommand = {
-  name: "logout",
-  summary: "clear the persisted session",
-  run: runLogout
-};
-async function runLogout(_args, io) {
+var REAL_DEPS2 = { revoke: revokeGatewaySession };
+var logoutCommand = makeLogoutCommand();
+function makeLogoutCommand(deps = REAL_DEPS2) {
+  return {
+    name: "logout",
+    summary: "revoke the session server-side and clear it locally",
+    run: (args, io) => runLogout(args, io, deps)
+  };
+}
+async function runLogout(_args, io, deps) {
   try {
     const cfg = loadConfig();
+    let session = null;
+    try {
+      session = await readSession(cfg.sessionPath);
+    } catch (e) {
+      if (!(e instanceof SessionParseError))
+        throw e;
+      io.err(`warning: session file is corrupt (${e.message}) — clearing it without a server-side revoke.`);
+    }
+    if (session !== null && isGatewaySession(session)) {
+      try {
+        await deps.revoke({
+          gatewayUrl: session.gatewayUrl,
+          refreshToken: session.refreshToken
+        });
+        io.out("Server-side session revoked.");
+      } catch (e) {
+        io.err(`warning: could not revoke the session server-side (${describe20(e)}) — clearing the local session anyway. Any in-flight access token expires within 15 minutes.`);
+      }
+    }
     const had = await clearSession(cfg.sessionPath);
     io.out(had ? `Logged out. Session cleared at ${cfg.sessionPath}` : "Already logged out.");
     return 0;
   } catch (e) {
-    io.err(`launchpad logout failed: ${describe19(e)}`);
+    io.err(`launchpad logout failed: ${describe20(e)}`);
     return 1;
   }
 }
-function describe19(e) {
+function describe20(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/logs.ts
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 var logsCommand = {
   name: "logs",
   summary: "show recent Pages deployment history (slug-scoped)",
   run: runLogs
 };
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE3 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 var DEFAULT_LINES = 10;
 var MAX_LINES = 25;
 async function runLogs(args, io) {
@@ -6516,9 +6844,9 @@ async function runLogs(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd3(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad logs: could not infer slug from cwd (${path8.basename(process.cwd())});
+      io.err(`launchpad logs: could not infer slug from cwd (${path9.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -6561,7 +6889,7 @@ async function runLogs(args, io) {
       io.err(`launchpad logs: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad logs failed: ${describe20(e)}`);
+    io.err(`launchpad logs failed: ${describe21(e)}`);
     return 1;
   }
 }
@@ -6596,11 +6924,6 @@ function parseArgs5(args) {
   }
   return { slug, lines };
 }
-function inferSlugFromCwd3(cwd) {
-  const base = path8.basename(cwd);
-  const m = base.match(DIRNAME_RE3);
-  return m === null ? null : m[1];
-}
 function renderDeployments(deployments, io) {
   if (deployments.length === 0) {
     io.out("(no deployments yet)");
@@ -6646,19 +6969,18 @@ function formatRelative2(iso) {
     return `${hr}h ago`;
   return `${Math.floor(hr / 24)}d ago`;
 }
-function describe20(e) {
+function describe21(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/merge.ts
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var mergeCommand = {
   name: "merge",
   summary: "squash-merge a review-passed PR (slug-scoped)",
   run: runMerge
 };
 var SLUG_RE7 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE4 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 var HANDLED_STATUSES = [409, 422, 502, 503];
 async function runMerge(args, io) {
   const parsed = parseArgs6(args);
@@ -6671,9 +6993,9 @@ async function runMerge(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd4(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad merge: could not infer slug from cwd (${path9.basename(process.cwd())});
+      io.err(`launchpad merge: could not infer slug from cwd (${path10.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -6696,7 +7018,7 @@ async function runMerge(args, io) {
       try {
         body = await res.json();
       } catch (e) {
-        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe21(e)}`);
+        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe22(e)}`);
         return 1;
       }
       io.out("");
@@ -6736,7 +7058,7 @@ async function runMerge(args, io) {
       io.err(`launchpad merge: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad merge failed: ${describe21(e)}`);
+    io.err(`launchpad merge failed: ${describe22(e)}`);
     return 1;
   }
 }
@@ -6770,11 +7092,6 @@ function parseArgs6(args) {
     return null;
   return { slug, prNumber };
 }
-function inferSlugFromCwd4(cwd) {
-  const base = path9.basename(cwd);
-  const m = base.match(DIRNAME_RE4);
-  return m === null ? null : m[1];
-}
 function renderBotError(status, env, io, prNumber = null) {
   const code = env?.error ?? "unknown";
   const detail = env?.message;
@@ -6825,12 +7142,12 @@ function renderBotError(status, env, io, prNumber = null) {
       io.err(`launchpad merge: bot returned ${status} ${code}${detail !== undefined ? `: ${detail}` : ""}`);
   }
 }
-function describe21(e) {
+function describe22(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/plan.ts
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -6843,7 +7160,7 @@ async function runPlan(args, io) {
     io.err("Usage: launchpad plan [--file <path>] [--json]");
     return 64;
   }
-  const manifestPath = resolve8(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   return flags.json ? renderJson(result, io) : renderHuman(result, io);
 }
@@ -7026,7 +7343,7 @@ var SLUG_RE8 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var SLUG_MIN_LENGTH = 3;
 var SLUG_MAX_LENGTH = 58;
 async function runDestroy(args, io, prompt, isTty) {
-  const parsed = parseArgs7(args);
+  const parsed = parseArgs7(args, process.cwd(), (l) => io.err(l));
   if (typeof parsed === "string") {
     io.err(`launchpad destroy: ${parsed}`);
     printUsage3(io);
@@ -7077,11 +7394,11 @@ async function runDestroy(args, io, prompt, isTty) {
       io.err(`launchpad destroy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad destroy failed: ${describe22(e)}`);
+    io.err(`launchpad destroy failed: ${describe23(e)}`);
     return 1;
   }
 }
-function parseArgs7(args, cwd = process.cwd()) {
+function parseArgs7(args, cwd = process.cwd(), warn) {
   let slug = null;
   let confirmSlug = null;
   let yes = false;
@@ -7128,7 +7445,7 @@ function parseArgs7(args, cwd = process.cwd()) {
     i += 1;
   }
   if (slug === null) {
-    const inferred = inferSlugFromCwd(cwd);
+    const inferred = inferSlug({ cwd, warn });
     if (inferred === null) {
       return `slug not provided + cannot infer from cwd. ` + `Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
@@ -7278,7 +7595,7 @@ function printUsage3(io) {
   ].join(`
 `));
 }
-function describe22(e) {
+function describe23(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -7288,8 +7605,8 @@ import { stringify as stringifyYaml } from "yaml";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
-  const path10 = opts.includeManifest === true ? `/apps/${encodeURIComponent(slug)}/manifest/state?include=manifest` : `/apps/${encodeURIComponent(slug)}/manifest/state`;
-  const raw = await apiJson(cfg, { path: path10 }, fetcher);
+  const path11 = opts.includeManifest === true ? `/apps/${encodeURIComponent(slug)}/manifest/state?include=manifest` : `/apps/${encodeURIComponent(slug)}/manifest/state`;
+  const raw = await apiJson(cfg, { path: path11 }, fetcher);
   return {
     slug: raw.slug,
     hasAppFile: raw.hasAppFile,
@@ -7302,8 +7619,8 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
 
 // src/deploy/manifest-status.ts
 async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
-  const path10 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
-  return apiJson(cfg, { path: path10 }, fetcher);
+  const path11 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
+  return apiJson(cfg, { path: path11 }, fetcher);
 }
 
 // src/deploy/deployment-status.ts
@@ -7347,7 +7664,7 @@ var pullCommand = {
 };
 var SLUG_RE9 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 async function runPull(args, io) {
-  const parsed = parseArgs8(args);
+  const parsed = parseArgs8(args, process.cwd(), (l) => io.err(l));
   if (typeof parsed === "string") {
     io.err(`launchpad pull: ${parsed}`);
     printUsage4(io);
@@ -7422,7 +7739,7 @@ async function runPull(args, io) {
       io.err(`launchpad pull: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad pull failed: ${describe23(e)}`);
+    io.err(`launchpad pull failed: ${describe24(e)}`);
     return 1;
   }
 }
@@ -7433,7 +7750,7 @@ async function fetchLiveDeploymentBestEffort(cfg, slug) {
     return null;
   }
 }
-function parseArgs8(args, cwd = process.cwd()) {
+function parseArgs8(args, cwd = process.cwd(), warn) {
   let slug = null;
   let out = null;
   let status = false;
@@ -7474,7 +7791,7 @@ function parseArgs8(args, cwd = process.cwd()) {
     i += 1;
   }
   if (slug === null) {
-    const inferred = inferSlugFromCwd(cwd);
+    const inferred = inferSlug({ cwd, warn });
     if (inferred === null) {
       return `slug not provided + cannot infer from cwd. ` + `Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
@@ -7492,8 +7809,9 @@ function printUsage4(io) {
     "       Reads the deployed launchpad.yaml for an app via the bot.",
     "       No local platform-repo or terraform required.",
     "",
-    "       When run inside launchpad-app-<slug>/, slug is inferred from",
-    "       the directory name. Explicit --slug or positional override.",
+    "       With no slug, it is inferred from the local launchpad.yaml's",
+    "       declared slug first, then from a launchpad-app-<slug>/",
+    "       directory name. Explicit --slug or positional override.",
     "",
     "       --status   read the role-redacted status block (what your",
     "                  role may see) instead of the spec manifest.",
@@ -7502,18 +7820,188 @@ function printUsage4(io) {
   ].join(`
 `));
 }
-function describe23(e) {
+function describe24(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
+// src/commands/recover.ts
+var recoverCommand = {
+  name: "recover",
+  summary: "repair a terminal-failed app record by reconciling against live state",
+  run: runRecover
+};
+var SLUG_RE10 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+async function runRecover(args, io) {
+  const parsed = parseRecoverArgs(args, process.cwd(), (l) => io.err(l));
+  if (typeof parsed === "string") {
+    io.err(`launchpad recover: ${parsed}`);
+    printUsage5(io);
+    return 64;
+  }
+  const cfg = loadConfig();
+  try {
+    io.out(`Reconciling "${parsed.slug}" against live Cloudflare state …`);
+    const res = await apiRaw(cfg, {
+      method: "POST",
+      path: `/apps/${parsed.slug}/recover`,
+      jsonBody: undefined,
+      nonThrowingStatuses: [409, 503]
+    });
+    const body = await res.json().catch(() => null);
+    if (parsed.json) {
+      io.out(JSON.stringify({ httpStatus: res.status, ...body ?? {} }, null, 2));
+      return res.status === 200 ? 0 : 1;
+    }
+    if (res.status === 200 && body !== null && "outcome" in body) {
+      renderSuccess2(body, io);
+      return 0;
+    }
+    if (res.status === 503) {
+      const msg = body !== null && "message" in body && typeof body.message === "string" ? body.message : "live state unavailable — nothing was changed; retry shortly.";
+      io.err(`launchpad recover: ${msg}`);
+      return 1;
+    }
+    if (res.status === 409 && body !== null && "error" in body) {
+      renderRefusal(parsed.slug, body, io);
+      return 1;
+    }
+    io.err(`launchpad recover: bot returned an unexpected HTTP ${res.status} response.`);
+    return 1;
+  } catch (e) {
+    return mapError(e, parsed.slug, io);
+  }
+}
+function renderSuccess2(body, io) {
+  if (body.outcome === "noop_already_healthy") {
+    io.out(`${body.slug}: already healthy — nothing to recover.`);
+    io.out(`  ${body.message}`);
+    return;
+  }
+  io.out(`${body.slug}: REPAIRED — registry record reconciled to live.`);
+  if (body.before !== undefined) {
+    io.out(`  before: ${body.before.lifecycle}` + (body.before.reason !== null ? ` (${body.before.reason})` : ""));
+  }
+  if (body.after !== undefined) {
+    io.out(`  after:  ${body.after.lifecycle}`);
+  }
+  const checked = body.checked;
+  if (checked !== undefined) {
+    io.out(`  verified: Pages project "${checked.pagesProject}" exists` + (checked.latestDeployment !== null ? `; latest production deployment ${checked.latestDeployment.id} ` + `(${checked.latestDeployment.buildStatus}, ${checked.latestDeployment.createdOn})` : ""));
+    if (checked.olderContentServing) {
+      io.out("  note: the LATEST build failed — an older successful deployment is what's serving.");
+    }
+  }
+  io.out("");
+  io.out(`Run \`launchpad status ${body.slug}\` — it now reports the live deployment truth.`);
+}
+function renderRefusal(slug, body, io) {
+  io.err(`launchpad recover: refused — "${slug}" was NOT repaired.`);
+  if (typeof body.message === "string") {
+    io.err(`  ${body.message}`);
+  }
+  const checked = body.checked;
+  if (checked !== undefined) {
+    io.err("  checked:");
+    io.err(`    Pages project "${checked.pagesProject}": ${checked.projectExists ? "exists" : "MISSING"}`);
+    if (checked.latestDeployment !== null) {
+      io.err(`    latest production deployment: ${checked.latestDeployment.id} (${checked.latestDeployment.buildStatus})`);
+    } else if (checked.projectExists) {
+      io.err("    latest production deployment: none");
+    }
+  }
+}
+function mapError(e, slug, io) {
+  if (e instanceof UnauthenticatedError) {
+    io.err(`launchpad recover: ${e.message}`);
+    io.err("  session expired, run `launchpad login`");
+    return 1;
+  }
+  if (e instanceof ForbiddenError) {
+    io.err(`launchpad recover: not authorised for app "${slug}" (you must be an owner or editor).`);
+    return 1;
+  }
+  if (e instanceof NotFoundError) {
+    io.err(`launchpad recover: app "${slug}" not found.`);
+    return 1;
+  }
+  if (e instanceof ApiError || e instanceof TransportError) {
+    io.err(`launchpad recover: ${e.message}`);
+    return 1;
+  }
+  io.err(`launchpad recover failed: ${e instanceof Error ? e.message : String(e)}`);
+  return 1;
+}
+function parseRecoverArgs(args, cwd = process.cwd(), warn) {
+  let slug = null;
+  let json = false;
+  let i = 0;
+  while (i < args.length) {
+    const a = args[i] ?? "";
+    if (a === "--slug") {
+      const v = args[i + 1];
+      if (v === undefined)
+        return "missing value for --slug";
+      if (slug !== null)
+        return "cannot mix --slug with positional slug (or pass --slug twice)";
+      slug = v;
+      i += 2;
+      continue;
+    }
+    if (a === "--json") {
+      json = true;
+      i += 1;
+      continue;
+    }
+    if (a.startsWith("--")) {
+      return `unknown flag "${a}"`;
+    }
+    if (slug !== null) {
+      return "cannot mix --slug with positional slug (or pass two positional slugs)";
+    }
+    slug = a;
+    i += 1;
+  }
+  if (slug === null) {
+    slug = inferSlug({ cwd, warn });
+  }
+  if (slug === null) {
+    return "slug not provided + cannot infer from cwd. " + "Pass <slug> or --slug <slug>, cd into launchpad-app-<slug>/, or run from a directory with launchpad.yaml.";
+  }
+  if (!SLUG_RE10.test(slug)) {
+    return `invalid slug "${slug}" — expected ${SLUG_RE10.source}`;
+  }
+  return { slug, json };
+}
+function printUsage5(io) {
+  io.err([
+    "usage: launchpad recover [<slug>] [--slug <slug>] [--json]",
+    "",
+    "       Repair an app whose registry record is stuck at a terminal",
+    "       provisioning failure although the app is actually live (e.g. a",
+    "       since-fixed platform bug failed the record after content shipped).",
+    "",
+    "       The bot verifies LIVE Cloudflare state first: the record is only",
+    "       repaired when the Pages project exists and a successful production",
+    "       deployment is serving. A not-live app is refused with what was",
+    "       checked — recover never fabricates a live state.",
+    "",
+    "       Recovering an already-healthy app is a no-op success.",
+    "",
+    "Flags:",
+    "       --slug <slug>   override cwd inference.",
+    "       --json          emit machine-readable JSON to stdout."
+  ].join(`
+`));
+}
+
 // src/commands/status.ts
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 var statusCommand = {
   name: "status",
   summary: "show drift between local launchpad.yaml and deployed state",
   run: runStatus
 };
-var SLUG_RE10 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+var SLUG_RE11 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 async function fetchLifecycle(cfg, slug) {
   try {
     return await apiJson(cfg, { path: `/apps/${slug}/lifecycle` });
@@ -7541,14 +8029,14 @@ function mapBotError(e, slug, io) {
     io.err(`launchpad status: ${e.message}`);
     return 2;
   }
-  io.err(`launchpad status failed: ${describe24(e)}`);
+  io.err(`launchpad status failed: ${describe25(e)}`);
   return 2;
 }
 async function runStatus(args, io) {
-  const parsed = parseArgs9(args);
+  const parsed = parseArgs9(args, process.cwd(), (l) => io.err(l));
   if (typeof parsed === "string") {
     io.err(`launchpad status: ${parsed}`);
-    printUsage5(io);
+    printUsage6(io);
     return 64;
   }
   const cfg = loadConfig();
@@ -7562,34 +8050,36 @@ async function runStatus(args, io) {
     emit3(lifecycleOutput(parsed.slug, lifecycle), parsed.json, io);
     return 0;
   }
-  let localYaml;
+  let localYaml = null;
   try {
-    localYaml = readFileSync11(parsed.file, "utf8");
+    localYaml = readFileSync12(parsed.file, "utf8");
   } catch (e) {
-    io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe24(e)}`);
-    if (lifecycle !== null && lifecycle.state === "live") {
-      io.err(`  (app "${parsed.slug}" is live — cd into its launchpad-app-${parsed.slug}/ to check drift.)`);
+    if (!isEnoent(e)) {
+      io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe25(e)}`);
+      return 2;
     }
-    return 2;
   }
-  let localObj;
-  try {
-    const { parse: parseYaml5 } = await import("yaml");
-    localObj = parseYaml5(localYaml);
-  } catch (e) {
-    io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe24(e)}`);
-    return 2;
-  }
-  const localParse = parseManifest(localObj);
-  if (localParse.kind !== "ok") {
-    io.err(`launchpad status: ${parsed.file} failed schema validation:`);
-    for (const issue of localParse.issues) {
-      io.err(`  - ${issue.path}: ${issue.message}`);
+  let local = null;
+  if (localYaml !== null) {
+    let localObj;
+    try {
+      const { parse: parseYaml6 } = await import("yaml");
+      localObj = parseYaml6(localYaml);
+    } catch (e) {
+      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe25(e)}`);
+      return 2;
     }
-    return 2;
+    const localParse = parseManifest(localObj);
+    if (localParse.kind !== "ok") {
+      io.err(`launchpad status: ${parsed.file} failed schema validation:`);
+      for (const issue of localParse.issues) {
+        io.err(`  - ${issue.path}: ${issue.message}`);
+      }
+      return 2;
+    }
+    local = localParse.manifest;
+    warnSecretShape(local.production_env, io);
   }
-  const local = localParse.manifest;
-  warnSecretShape(local.production_env, io);
   let state;
   try {
     state = await fetchManifestState(cfg, parsed.slug, { includeManifest: true });
@@ -7605,7 +8095,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: live deployment state unavailable (${describe24(e)}) — ` + `the report below is from the platform manifest view only.`);
+    io.err(`launchpad status: live deployment state unavailable (${describe25(e)}) — ` + `the report below is from the platform manifest view only.`);
   }
   let standingExceptions = null;
   try {
@@ -7614,7 +8104,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: standing-exception inventory unavailable (${describe24(e)}).`);
+    io.err(`launchpad status: standing-exception inventory unavailable (${describe25(e)}).`);
   }
   if (state.manifestYaml === null || state.manifestYaml === undefined) {
     const live = deployment?.liveDeployment ?? null;
@@ -7623,6 +8113,7 @@ async function runStatus(args, io) {
     const out = {
       state: contentIsLive ? "live_content_untracked" : liveButEmpty ? "live_no_content" : "no_deployed_manifest",
       slug: parsed.slug,
+      ...local === null ? { drift: null } : {},
       deployedSha: state.lastAppliedManifestSha,
       headSha: state.appRepoHeadSha,
       hasOpenPr: state.openPr !== null,
@@ -7635,12 +8126,36 @@ async function runStatus(args, io) {
     emit3(out, parsed.json, io);
     return 0;
   }
+  if (local === null) {
+    const out = {
+      state: "live_drift_unknown",
+      slug: parsed.slug,
+      drift: null,
+      deployedSha: state.lastAppliedManifestSha,
+      headSha: state.appRepoHeadSha,
+      hasOpenPr: state.openPr !== null,
+      openPrNumber: state.openPr?.number ?? null,
+      driftFields: [],
+      driftDetails: [],
+      ...deploymentKnown ? { deployment } : {},
+      ...standingExceptions !== null ? { standingExceptions } : {}
+    };
+    emit3(out, parsed.json, io);
+    if (parsed.strict) {
+      if (deployment?.liveDeployment?.buildStatus === "failure") {
+        io.err(`launchpad status: --strict: live build FAILED ` + `(drift not evaluated — no local launchpad.yaml here).`);
+        return 1;
+      }
+      io.err(`launchpad status: --strict: drift not evaluated — no local ` + `launchpad.yaml here; live state looks healthy, exiting 0.`);
+    }
+    return 0;
+  }
   let deployedObj;
   try {
-    const { parse: parseYaml5 } = await import("yaml");
-    deployedObj = parseYaml5(state.manifestYaml);
+    const { parse: parseYaml6 } = await import("yaml");
+    deployedObj = parseYaml6(state.manifestYaml);
   } catch (e) {
-    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe24(e)}`);
+    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe25(e)}`);
     return 2;
   }
   const deployedParse = parseManifest(deployedObj);
@@ -7673,17 +8188,17 @@ async function runStatus(args, io) {
 }
 function computeDrift(local, deployed) {
   const diffs = [];
-  const cmp = (path10, l, d) => {
+  const cmp = (path11, l, d) => {
     const li = l ?? null;
     const di = d ?? null;
     if (typeof li === "object" || typeof di === "object") {
       if (JSON.stringify(li) !== JSON.stringify(di)) {
-        diffs.push({ path: path10, local: l, deployed: d });
+        diffs.push({ path: path11, local: l, deployed: d });
       }
       return;
     }
     if (li !== di) {
-      diffs.push({ path: path10, local: l, deployed: d });
+      diffs.push({ path: path11, local: l, deployed: d });
     }
   };
   cmp("metadata.name", local.metadata.name, deployed.metadata.name);
@@ -7748,18 +8263,28 @@ function emit3(out, asJson, io) {
       return;
     case "live_no_content":
       io.out(`${out.slug}: live — no content deployed yet. Run \`launchpad deploy\`.`);
+      surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
     case "no_deployed_manifest":
       io.out(`${out.slug}: no deployed manifest yet — run \`launchpad deploy\`.`);
+      surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
     case "live_content_untracked":
       io.out(`${out.slug}: live — content deployed via ` + `${triggerLabel(out.deployment?.liveDeployment?.trigger)} (no platform-tracked manifest; this app deploys outside \`launchpad deploy\`).`);
+      surfaceNoLocalManifestNote(out, io);
+      surfaceHeadVsDeployed(out, io);
+      surfaceDeployment(out, io);
+      surfaceExceptions(out, io);
+      return;
+    case "live_drift_unknown":
+      io.out(`${out.slug}: live` + (out.deployedSha ? ` (content @ ${out.deployedSha.slice(0, 7)})` : ""));
+      surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
@@ -7783,6 +8308,11 @@ function emit3(out, asJson, io) {
       return;
   }
 }
+function surfaceNoLocalManifestNote(out, io) {
+  if (out.drift !== null)
+    return;
+  io.out("  no local launchpad.yaml here — drift not checked " + "(cd into the app directory or pass --file to compare)");
+}
 function triggerLabel(trigger) {
   if (trigger === "git-push")
     return "git push";
@@ -7870,7 +8400,7 @@ function warnSecretShape(env, io) {
     }
   }
 }
-function parseArgs9(args, cwd = process.cwd()) {
+function parseArgs9(args, cwd = process.cwd(), warn) {
   let slug = null;
   let file = "./launchpad.yaml";
   let json = false;
@@ -7917,54 +8447,68 @@ function parseArgs9(args, cwd = process.cwd()) {
     i += 1;
   }
   if (slug === null) {
-    const inferred = inferSlugFromCwd(cwd);
+    const inferred = inferSlug({ cwd, file, warn });
     if (inferred === null) {
       return `slug not provided + cannot infer from cwd. Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
     slug = inferred;
   }
-  if (!SLUG_RE10.test(slug)) {
-    return `invalid slug "${slug}" — expected ${SLUG_RE10.source}`;
+  if (!SLUG_RE11.test(slug)) {
+    return `invalid slug "${slug}" — expected ${SLUG_RE11.source}`;
   }
   return { slug, file, json, strict };
 }
-function printUsage5(io) {
+function printUsage6(io) {
   io.err([
     "usage: launchpad status [<slug>] [--slug <slug>] [--file <path>] [--json] [--strict]",
     "",
     "       Compare local launchpad.yaml against the deployed state.",
     "       No local platform-repo or terraform required.",
     "",
-    "       When run inside launchpad-app-<slug>/, slug is inferred from",
-    "       the directory name. Explicit --slug or positional override.",
+    "       With no explicit slug, it is inferred from (in order): the",
+    "       local manifest's declared slug (./launchpad.yaml or --file),",
+    "       then a launchpad-app-<slug>/ directory name. An explicit",
+    "       --slug or positional always overrides; when the manifest and",
+    "       the directory name disagree, the manifest wins (with a note).",
+    "",
+    "       With a known slug but NO local manifest, status degrades to",
+    "       the live-truth-only view (lifecycle + deployment; drift not",
+    "       checked) and exits 0.",
     "",
     "Flags:",
     "       --file <path>   local manifest path (default: ./launchpad.yaml).",
-    "                       Does NOT influence slug resolution.",
-    "       --slug <slug>   override cwd inference.",
+    "                       Also consulted for slug inference; --slug or a",
+    "                       positional slug still overrides.",
+    "       --slug <slug>   override inference.",
     "       --json          emit machine-readable JSON to stdout.",
     "       --strict        exit 1 on drift. Default is report-only (exit 0).",
+    "                       With no local manifest, drift can't be evaluated:",
+    "                       exit 0 unless the live build itself failed.",
     "",
     "Exit codes:",
-    "       0 = in sync, OR drift in default (report-only) mode.",
-    "       1 = drift, when --strict is set.",
-    "       2 = error (network, auth, missing local manifest, etc.)."
+    "       0 = in sync, OR drift in default (report-only) mode, OR the",
+    "           live-truth-only view (no local manifest).",
+    "       1 = drift, when --strict is set (or a failed live build under",
+    "           --strict with no local manifest).",
+    "       2 = error (network, auth, unreadable/invalid local manifest, etc.)."
   ].join(`
 `));
 }
-function describe24(e) {
+function describe25(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function isEnoent(e) {
+  return typeof e === "object" && e !== null && e.code === "ENOENT";
+}
 
 // src/commands/review.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var reviewCommand = {
   name: "review",
   summary: "show the review state for a PR (slug-scoped)",
   run: runReview
 };
-var SLUG_RE11 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var DIRNAME_RE5 = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
+var SLUG_RE12 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 async function runReview(args, io) {
   const parsed = parseArgs10(args);
   if (parsed === null) {
@@ -7976,16 +8520,16 @@ async function runReview(args, io) {
   if (parsed.slug !== null) {
     slug = parsed.slug;
   } else {
-    const inferred = inferSlugFromCwd5(process.cwd());
+    const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad review: could not infer slug from cwd (${path10.basename(process.cwd())});
+      io.err(`launchpad review: could not infer slug from cwd (${path11.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
     slug = inferred;
   }
-  if (!SLUG_RE11.test(slug)) {
-    io.err(`launchpad review: invalid slug "${slug}" — expected ${SLUG_RE11.source}`);
+  if (!SLUG_RE12.test(slug)) {
+    io.err(`launchpad review: invalid slug "${slug}" — expected ${SLUG_RE12.source}`);
     return 64;
   }
   try {
@@ -8028,7 +8572,7 @@ async function runReview(args, io) {
       io.err(`launchpad review: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad review failed: ${describe25(e)}`);
+    io.err(`launchpad review failed: ${describe26(e)}`);
     return 1;
   }
 }
@@ -8060,11 +8604,6 @@ function parseArgs10(args) {
   }
   return { slug, prNumber };
 }
-function inferSlugFromCwd5(cwd) {
-  const base = path10.basename(cwd);
-  const m = base.match(DIRNAME_RE5);
-  return m === null ? null : m[1];
-}
 function renderReview(r, io) {
   const rv = r.review;
   io.out(`Review of PR #${rv.prNumber} (${rv.slug})`);
@@ -8111,12 +8650,12 @@ function severityRank(s) {
       return 3;
   }
 }
-function describe25(e) {
+function describe26(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -8171,7 +8710,7 @@ async function runRollback(opts, io, deps = {}) {
       cwd: process.cwd()
     });
   } catch (e) {
-    io.err(`launchpad rollback: git rev-parse failed to start: ${describe26(e)}`);
+    io.err(`launchpad rollback: git rev-parse failed to start: ${describe27(e)}`);
     return 2;
   }
   if (revParse.exitCode !== 0) {
@@ -8186,7 +8725,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     show = await runner.run("git", ["show", `${verifiedSha}:${manifestRelpath}`], { cwd: process.cwd() });
   } catch (e) {
-    io.err(`launchpad rollback: git show failed to start: ${describe26(e)}`);
+    io.err(`launchpad rollback: git show failed to start: ${describe27(e)}`);
     return 2;
   }
   if (show.exitCode !== 0) {
@@ -8220,7 +8759,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     writeFileSync5(manifestPath, historicalYaml, "utf8");
   } catch (e) {
-    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe26(e)}`);
+    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe27(e)}`);
     return 2;
   }
   io.out(`Restored ${manifestPath} from ${verifiedSha.slice(0, 12)}.`);
@@ -8240,16 +8779,16 @@ async function runRollback(opts, io, deps = {}) {
     yes: true
   }, io, applyDeps);
 }
-function readCurrentManifest(path11) {
-  if (!existsSync7(path11))
+function readCurrentManifest(path12) {
+  if (!existsSync8(path12))
     return null;
   let raw;
   try {
-    raw = readFileSync12(path11, "utf8");
+    raw = readFileSync13(path12, "utf8");
   } catch {
     return null;
   }
-  const parsed = parseManifest2(raw, path11);
+  const parsed = parseManifest2(raw, path12);
   if (parsed.kind !== "ok")
     return null;
   return summarise(parsed.manifest);
@@ -8302,7 +8841,7 @@ async function defaultPrompt4(question) {
     rl.close();
   }
 }
-function describe26(e) {
+function describe27(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError3(result, io) {
@@ -8401,7 +8940,7 @@ function parseArgs11(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync14 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 
 // src/secrets/env-parse.ts
@@ -8456,16 +8995,16 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath3(process.cwd(), opts.env ?? ".env");
-  if (!existsSync8(envPath)) {
+  if (!existsSync9(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync13(envPath, "utf8");
+    envText = readFileSync14(envPath, "utf8");
   } catch (e) {
-    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe27(e)}`);
+    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe28(e)}`);
     return 2;
   }
   const parsed = parseEnv(envText);
@@ -8596,10 +9135,10 @@ function mapPushError(e, slug, name, io) {
     io.err(`✗ secrets push ${name}: ${e.message}`);
     return 1;
   }
-  io.err(`✗ secrets push ${name} failed: ${describe27(e)}`);
+  io.err(`✗ secrets push ${name} failed: ${describe28(e)}`);
   return 2;
 }
-function describe27(e) {
+function describe28(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError4(result, io) {
@@ -8735,32 +9274,32 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15 } from "node:fs";
 import { resolve as resolvePath5 } from "node:path";
-import { parse as parseYaml5 } from "yaml";
+import { parse as parseYaml6 } from "yaml";
 var CELL_LABEL2 = {
   present: "PRESENT",
   missing: "MISSING",
   not_deployed: "NOT_DEPLOYED"
 };
 function loadSet(fleetFile, setName, io) {
-  const path11 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync9(path11)) {
-    io.err(`✗ ${path11}`);
+  const path12 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
+  if (!existsSync10(path12)) {
+    io.err(`✗ ${path12}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml5(readFileSync14(path11, "utf8"));
+    obj = parseYaml6(readFileSync15(path12, "utf8"));
   } catch (e) {
-    io.err(`✗ ${path11}`);
+    io.err(`✗ ${path12}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
   const parsed = parseFleetSecretSets(obj);
   if (!parsed.ok) {
-    io.err(`✗ ${path11}`);
+    io.err(`✗ ${path12}`);
     io.err(`  ${parsed.issues.length} schema issue(s):`);
     for (const i of parsed.issues)
       io.err(`    ${i.path}: ${i.message}`);
@@ -8769,7 +9308,7 @@ function loadSet(fleetFile, setName, io) {
   const set = parsed.manifest.secretSets.find((s) => s.name === setName);
   if (set === undefined) {
     const names = parsed.manifest.secretSets.map((s) => s.name).join(", ");
-    io.err(`✗ secret-set "${setName}" not found in ${path11}`);
+    io.err(`✗ secret-set "${setName}" not found in ${path12}`);
     io.err(`  declared sets: ${names}`);
     return 1;
   }
@@ -8837,14 +9376,14 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath5(process.cwd(), opts.env ?? ".env");
-  if (!existsSync9(envPath)) {
+  if (!existsSync10(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync14(envPath, "utf8");
+    envText = readFileSync15(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -8988,8 +9527,8 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync10, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { existsSync as existsSync11, writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -8997,7 +9536,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -9011,8 +9550,8 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve9(process.cwd(), flags.out);
-  if (existsSync10(outPath) && !flags.force) {
+  const outPath = resolve10(process.cwd(), flags.out);
+  if (existsSync11(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
@@ -9300,8 +9839,8 @@ function printHelp2(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname6, join as join11, resolve as resolve10 } from "node:path";
-import { promises as fs5, existsSync as existsSync11 } from "node:fs";
+import { dirname as dirname6, join as join11, resolve as resolve11 } from "node:path";
+import { promises as fs5, existsSync as existsSync12 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 var BUNDLE_PREFIX = "launchpad-";
 var BUNDLED_SKILLS = [
@@ -9343,7 +9882,7 @@ async function runSkills(args, io) {
         return 64;
     }
   } catch (e) {
-    io.err(`launchpad skills ${action}: ${describe28(e)}`);
+    io.err(`launchpad skills ${action}: ${describe29(e)}`);
     return 1;
   }
 }
@@ -9368,11 +9907,11 @@ function resolveInstallEnv() {
 function defaultBundleDir() {
   const here = dirname6(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve10(here, "..", "skills"),
-    resolve10(here, "..", "..", "skills")
+    resolve11(here, "..", "skills"),
+    resolve11(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync11(join11(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync12(join11(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -9452,10 +9991,10 @@ async function doList(io) {
   }
   return 0;
 }
-async function readVersion(path11) {
+async function readVersion(path12) {
   let text;
   try {
-    text = await fs5.readFile(path11, "utf8");
+    text = await fs5.readFile(path12, "utf8");
   } catch {
     return null;
   }
@@ -9465,15 +10004,15 @@ async function readVersion(path11) {
   const m = /^version:\s*(.+?)\s*$/m.exec(front);
   return m === null ? null : m[1] ?? null;
 }
-async function isDir(path11) {
+async function isDir(path12) {
   try {
-    const stat = await fs5.stat(path11);
+    const stat = await fs5.stat(path12);
     return stat.isDirectory();
   } catch {
     return false;
   }
 }
-function describe28(e) {
+function describe29(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -9481,13 +10020,13 @@ function describe28(e) {
 import { execFile, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname7, resolve as resolve11, relative as relative4, isAbsolute as isAbsolute2, join as join12 } from "node:path";
+import { dirname as dirname7, resolve as resolve12, relative as relative4, isAbsolute as isAbsolute2, join as join12 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync15, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync16, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
-import { createHash as createHash2, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes5 } from "node:crypto";
 var CHANNEL_BASE = "https://get.launchpad.m-kopa.us";
 var CLI_AUTH_URL = `${CHANNEL_BASE}/__cli_auth`;
 var CLI_TOKEN_URL = `${CHANNEL_BASE}/__cli_token`;
@@ -9497,7 +10036,7 @@ function base64url(b) {
   return b.toString("base64url");
 }
 function pkcePair() {
-  const verifier = base64url(randomBytes4(32));
+  const verifier = base64url(randomBytes5(32));
   const challenge = base64url(createHash2("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
@@ -9526,9 +10065,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve11) => {
-    server.once("error", () => resolve11(false));
-    server.listen(0, "127.0.0.1", () => resolve11(true));
+  const bound = await new Promise((resolve12) => {
+    server.once("error", () => resolve12(false));
+    server.listen(0, "127.0.0.1", () => resolve12(true));
   });
   if (!bound)
     return null;
@@ -9543,7 +10082,7 @@ async function startLoopback(state, timeoutMs) {
 async function runChannelLoopbackUpdate(deps) {
   const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const { verifier, challenge } = pkcePair();
-  const state = base64url(randomBytes4(16));
+  const state = base64url(randomBytes5(16));
   const loopback = await startLoopback(state, timeoutMs);
   if (!loopback)
     return { ok: false, reason: "no-browser", detail: "could not bind a loopback port" };
@@ -9712,7 +10251,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync15(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync16(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -9775,7 +10314,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve11(dirname7(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve12(dirname7(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -9783,7 +10322,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve11(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve12(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -9919,8 +10458,8 @@ function printHelp4(io) {
 }
 
 // src/commands/validate.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { dirname as dirname8, resolve as resolve12 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { dirname as dirname8, resolve as resolve13 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -9934,12 +10473,12 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path11 = resolve12(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifest(path11);
+  const path12 = resolve13(process.cwd(), file ?? "launchpad.yaml");
+  const result = loadManifest(path12);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
-  const boundary = checkBoundary(path11, result.manifest.app !== undefined);
+  const boundary = checkBoundary(path12, result.manifest.app !== undefined);
   const groupCheck = strictGroups ? await checkGroups(allowedEntraGroups(result.manifest.access)) : { kind: "skipped" };
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
@@ -9953,7 +10492,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync16(manifestPath, "utf8");
+    manifestYaml = readFileSync17(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -9994,7 +10533,7 @@ async function checkGroup(allowedGroup, cfg) {
     if (e instanceof ForbiddenError) {
       return { kind: "forbidden", message: e.message };
     }
-    return { kind: "network", message: describe29(e) };
+    return { kind: "network", message: describe30(e) };
   }
 }
 async function checkGroups(groups) {
@@ -10207,7 +10746,7 @@ function parseArgs12(args) {
   }
   return { kind: "ok", file, json, strictGroups };
 }
-function describe29(e) {
+function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10256,11 +10795,11 @@ async function runWhoami(_args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad whoami failed: ${describe30(e)}`);
+    io.err(`launchpad whoami failed: ${describe31(e)}`);
     return 1;
   }
 }
-function describe30(e) {
+function describe31(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10268,14 +10807,14 @@ function describe30(e) {
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
 import { join as join13 } from "node:path";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
 var CACHE_FILE = join13(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync17(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync18(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -10391,6 +10930,7 @@ var COMMANDS = [
   generateCommand,
   pullCommand,
   statusCommand,
+  recoverCommand,
   destroyCommand,
   rollbackCommand,
   groupsCommand,