@m-kopa/launchpad-cli 0.27.4 → 0.27.5

package/CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.27.5 — 2026-06-16
+
+Post-deploy verification — `launchpad deploy` confirms the live deployment
+serves what you shipped (sp-dplvfy).
+
+- After a content deploy commits, the CLI now **waits for the Cloudflare Pages
+  build to settle and then checks the served deployment matches your shipped
+  `index.html`** (by hash). A mismatch — the silent-revert class where the
+  build reads the entrypoint from a different path than your files land at —
+  fails the deploy with exit `65` and a build-config diagnosis, instead of a
+  misleading "success". A failed build exits `1` (with a log excerpt); a build
+  still pending within the timeout is a soft, non-failing outcome.
+- Static apps get a byte/hash compare; react/react+api get a reachability check.
+  Content is compared by hash + length only — never echoed back.
+- New `--no-verify` (skip the wait/check) and `--verify-timeout=<seconds>`
+  (default 180) flags. A status-read hiccup degrades to "couldn't verify"
+  rather than failing a committed deploy.
+
 ## 0.27.4 — 2026-06-16
 
 Self-serve developer-access grants (sp-grnted, Bundle 1).

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.27.4";
+var CLI_VERSION = "0.27.5";
 
 // src/config.ts
 import * as os from "node:os";
@@ -1525,7 +1525,7 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
@@ -3616,9 +3616,212 @@ async function bundleAndDeploy(args) {
   };
 }
 
+// src/deploy/verify-deploy.ts
+import { readFileSync as readFileSync5, existsSync as existsSync3 } from "node:fs";
+import { join as join8 } from "node:path";
+
+// src/deploy/deployment-status.ts
+async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
+  let raw;
+  try {
+    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/exceptions` }, fetcher);
+  } catch (e) {
+    if (e instanceof NotFoundError)
+      return null;
+    throw e;
+  }
+  if (!Array.isArray(raw.exceptions))
+    return null;
+  return raw.exceptions.filter((e) => typeof e === "object" && e !== null && typeof e.path === "string" && typeof e.rule === "string" && typeof e.detectedAt === "string" && typeof e.deployRef === "string");
+}
+async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
+  let raw;
+  try {
+    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/deployment-status` }, fetcher);
+  } catch (e) {
+    if (e instanceof NotFoundError)
+      return null;
+    throw e;
+  }
+  if (typeof raw.supported !== "boolean")
+    return null;
+  return {
+    slug: typeof raw.slug === "string" ? raw.slug : slug,
+    supported: raw.supported,
+    liveDeployment: raw.liveDeployment ?? null,
+    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null
+  };
+}
+
+// src/deploy/wait-for-deployment.ts
+var DEFAULT_POLL_INTERVAL_MS = 5000;
+function realWaitDeps(cfg) {
+  return {
+    fetchStatus: (slug) => fetchDeploymentStatus(cfg, slug),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    now: () => Date.now()
+  };
+}
+async function waitForDeployment(args, deps) {
+  const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const start = deps.now();
+  for (;; ) {
+    let status;
+    try {
+      status = await deps.fetchStatus(args.slug);
+    } catch {
+      return { kind: "unknown" };
+    }
+    if (status === null)
+      return { kind: "unknown" };
+    if (!status.supported)
+      return { kind: "unsupported" };
+    const live = status.liveDeployment;
+    if (live) {
+      if (live.buildStatus === "success") {
+        return { kind: "success", deploymentUrl: live.url };
+      }
+      if (live.buildStatus === "failure") {
+        return { kind: "failure", logExcerpt: live.logExcerpt, failedStage: live.failedStage };
+      }
+    }
+    if (deps.now() - start >= args.timeoutMs)
+      return { kind: "pending" };
+    await deps.sleep(pollIntervalMs);
+  }
+}
+
+// src/deploy/served-verify.ts
+import { createHash as createHash2 } from "node:crypto";
+function sha256(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function toBytes(v) {
+  return typeof v === "string" ? new TextEncoder().encode(v) : v;
+}
+async function verifyServed(args, deps = { fetch }) {
+  let res;
+  try {
+    res = await deps.fetch(args.servedUrl, { method: "GET" });
+  } catch (e) {
+    return {
+      kind: "unreachable",
+      reason: `could not reach ${args.servedUrl}: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (!res.ok) {
+    return {
+      kind: "unreachable",
+      status: res.status,
+      reason: `served URL returned HTTP ${res.status}`
+    };
+  }
+  if (args.appType !== "static") {
+    return { kind: "match" };
+  }
+  let servedBytes;
+  try {
+    servedBytes = new Uint8Array(await res.arrayBuffer());
+  } catch (e) {
+    return {
+      kind: "unreachable",
+      reason: `could not read served body: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  const shippedBytes = toBytes(args.shippedEntrypoint);
+  const servedHash = sha256(servedBytes);
+  const shippedHash = sha256(shippedBytes);
+  if (servedHash === shippedHash)
+    return { kind: "match" };
+  return {
+    kind: "mismatch",
+    servedHash,
+    shippedHash,
+    servedLen: servedBytes.byteLength,
+    shippedLen: shippedBytes.byteLength
+  };
+}
+
+// src/deploy/verify-deploy.ts
+var VERIFY_MISMATCH_EXIT = 65;
+function readLocalEntrypoint(cwd) {
+  for (const rel of ["index.html", join8("static", "index.html")]) {
+    const p = join8(cwd, rel);
+    if (existsSync3(p))
+      return new Uint8Array(readFileSync5(p));
+  }
+  return null;
+}
+function realVerifyDeployDeps(cfg) {
+  return {
+    wait: waitForDeployment,
+    verify: verifyServed,
+    readLocalEntrypoint,
+    waitDeps: realWaitDeps(cfg),
+    verifyDeps: { fetch }
+  };
+}
+async function runDeployVerification(args, io, deps) {
+  io.out("");
+  io.out("Verifying the live deployment serves what you shipped …");
+  const settle = await deps.wait({ slug: args.slug, timeoutMs: args.timeoutMs }, deps.waitDeps);
+  switch (settle.kind) {
+    case "unsupported":
+      io.out("  (skipped — this app has no Pages deployment surface)");
+      return 0;
+    case "unknown":
+      io.out(`  (couldn't read deployment status — verify manually with \`launchpad status ${args.slug}\`)`);
+      return 0;
+    case "pending":
+      io.out(`⏳ Build still in progress after ${Math.round(args.timeoutMs / 1000)}s — couldn't verify yet.`);
+      io.out(`   Re-check the outcome: \`launchpad status ${args.slug}\``);
+      return 0;
+    case "failure":
+      io.err("✗ The Cloudflare Pages build FAILED — your content is NOT live.");
+      if (settle.failedStage)
+        io.err(`  failed stage: ${settle.failedStage}`);
+      if (settle.logExcerpt)
+        io.err(`  ${settle.logExcerpt}`);
+      io.err(`  Full logs: \`launchpad status ${args.slug}\``);
+      return 1;
+    case "success":
+      return verifySuccess(args, settle.deploymentUrl, io, deps);
+  }
+}
+async function verifySuccess(args, deploymentUrl, io, deps) {
+  if (deploymentUrl === null || deploymentUrl.length === 0) {
+    io.out("  (build succeeded but no served URL was reported — verify manually)");
+    return 0;
+  }
+  const entrypoint = deps.readLocalEntrypoint(args.cwd);
+  if (entrypoint === null) {
+    io.out("  (no local index.html found to compare against — skipped)");
+    return 0;
+  }
+  const verdict = await deps.verify({ servedUrl: deploymentUrl, shippedEntrypoint: entrypoint, appType: args.appType }, deps.verifyDeps);
+  switch (verdict.kind) {
+    case "match":
+      io.out("✓ Verified — the live deployment serves exactly what you shipped.");
+      return 0;
+    case "unreachable":
+      io.out(`  (couldn't reach the served URL to verify: ${verdict.reason}) — check manually`);
+      return 0;
+    case "mismatch":
+      io.err("");
+      io.err("✗ LIVE SERVES DIFFERENT CONTENT THAN YOU SHIPPED.");
+      io.err("  Your deploy committed, but the served page does not match your local index.html.");
+      io.err("  The app's build likely reads the entrypoint from a different path than your files");
+      io.err("  landed — e.g. it serves `static/index.html` while your content is at the repo root");
+      io.err("  (or vice-versa). This is the silent-revert class; your content did NOT go live.");
+      io.err(`  served ${verdict.servedLen}B (sha ${verdict.servedHash.slice(0, 12)}) ≠ shipped ${verdict.shippedLen}B (sha ${verdict.shippedHash.slice(0, 12)})`);
+      io.err(`  Check the app's Pages build config; see \`launchpad status ${args.slug}\`.`);
+      return VERIFY_MISMATCH_EXIT;
+  }
+}
+
 // src/commands/deploy.ts
 import { parse as parseYaml5 } from "yaml";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -3894,6 +4097,19 @@ function parseDeployFlags(args) {
       i += 2;
       continue;
     }
+    if (a === "--no-verify") {
+      i += 1;
+      continue;
+    }
+    if (a.startsWith("--verify-timeout=")) {
+      const v = a.slice("--verify-timeout=".length);
+      const n = Number(v);
+      if (!Number.isFinite(n) || n <= 0 || Math.floor(n) !== n) {
+        return `invalid --verify-timeout "${v}" — expected positive integer seconds`;
+      }
+      i += 1;
+      continue;
+    }
     return `unknown argument "${a}"`;
   }
   if (modeFlagsSeen > 1) {
@@ -4045,16 +4261,16 @@ function parseDeployFlags(args) {
 }
 
 // src/deploy/apply.ts
-import { existsSync as existsSync3, rmSync } from "node:fs";
-import { resolve as resolvePath, join as join8 } from "node:path";
+import { existsSync as existsSync4, rmSync } from "node:fs";
+import { resolve as resolvePath, join as join9 } from "node:path";
 
 // src/manifest/load.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { parse as parseYaml3, YAMLParseError } from "yaml";
 function loadManifest(path7) {
   let raw;
   try {
-    raw = readFileSync5(path7, "utf8");
+    raw = readFileSync6(path7, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -4276,8 +4492,8 @@ function sleep(ms) {
   return new Promise((res) => setTimeout(res, ms));
 }
 function deletePinIfPresent(cfg, slug, io) {
-  const pinPath = join8(cfg.stateDir, slug, "group.json");
-  if (!existsSync3(pinPath))
+  const pinPath = join9(cfg.stateDir, slug, "group.json");
+  if (!existsSync4(pinPath))
     return;
   try {
     rmSync(pinPath, { force: true });
@@ -4710,7 +4926,7 @@ function handleNetworkError(e, io, slug, verb) {
 
 // src/commands/infer-slug.ts
 import * as path7 from "node:path";
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "node:fs";
 import { parse as parseYaml4 } from "yaml";
 var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 function inferSlugFromCwd(cwd) {
@@ -4730,10 +4946,10 @@ function resolveManifestSlug(parsed) {
   return null;
 }
 function inferSlugFromManifestFile(manifestPath) {
-  if (!existsSync4(manifestPath))
+  if (!existsSync5(manifestPath))
     return null;
   try {
-    return resolveManifestSlug(parseYaml4(readFileSync6(manifestPath, "utf8")));
+    return resolveManifestSlug(parseYaml4(readFileSync7(manifestPath, "utf8")));
   } catch {
     return null;
   }
@@ -4800,7 +5016,7 @@ async function runDeploy(args, io) {
   }
   const cwd = process.cwd();
   const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync5(manifestPath)) {
+  if (existsSync6(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : { allowStale: false, rebaseOntoHead: false, overrideStale: null };
     return runModelADeploy({
       cwd,
@@ -4844,9 +5060,9 @@ async function runDeploy(args, io) {
     }
     let contentManifestYaml = null;
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync5(contentManifestPath)) {
+    if (existsSync6(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync7(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync8(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -5055,17 +5271,31 @@ function surfaceStaleBlock(body, io) {
 async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
+  let appType = "static";
   try {
-    const metaSlug = resolveManifestSlug(parseYaml5(readFileSync7(manifestPath, "utf8")));
+    const manifestObj = parseYaml5(readFileSync8(manifestPath, "utf8"));
+    const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
       return 64;
     }
     slug = metaSlug;
+    const dtype = manifestObj?.deployment?.type;
+    if (dtype === "static" || dtype === "react" || dtype === "react+api" || dtype === "container") {
+      appType = dtype;
+    }
   } catch (e) {
     io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe13(e)}`);
     return 1;
   }
+  const noVerify = args.argv.includes("--no-verify");
+  let verifyTimeoutMs = 180000;
+  const vtFlag = args.argv.find((a) => a.startsWith("--verify-timeout="));
+  if (vtFlag !== undefined) {
+    const secs = Number.parseInt(vtFlag.slice("--verify-timeout=".length), 10);
+    if (Number.isFinite(secs) && secs > 0)
+      verifyTimeoutMs = secs * 1000;
+  }
   if (!SLUG_RE4.test(slug)) {
     io.err(`launchpad deploy: invalid slug "${slug}" in manifest — expected ${SLUG_RE4.source}`);
     return 64;
@@ -5174,11 +5404,11 @@ async function runModelADeploy(args) {
       }
       if (success.status === "provisioning_started") {
         const submissionId = typeof success.submissionId === "string" ? success.submissionId : "(missing)";
-        const appType = typeof success.appType === "string" ? success.appType : "(missing)";
+        const appType2 = typeof success.appType === "string" ? success.appType : "(missing)";
         const message = typeof success.message === "string" ? success.message : "Bot accepted the upload and started provisioning.";
         io.out(`✓ First-time deploy — provisioning workflow started for ${slug}`);
         io.out(`  submission: ${submissionId}`);
-        io.out(`  appType:    ${appType}`);
+        io.out(`  appType:    ${appType2}`);
         io.out("");
         io.out(message);
         io.out("");
@@ -5209,8 +5439,11 @@ async function runModelADeploy(args) {
       surfaceDeployExtras(success, io, slug, args.allowStale);
       io.out("");
       io.out("Committed; build pending — Cloudflare Pages is building this deploy now.");
-      io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
-      return 0;
+      if (noVerify) {
+        io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
+        return 0;
+      }
+      return runDeployVerification({ slug, cwd, appType, timeoutMs: verifyTimeoutMs }, io, realVerifyDeployDeps(cfg));
     }
   }
 }
@@ -5406,7 +5639,7 @@ function describe14(e) {
 }
 
 // src/commands/generate.ts
-import { mkdirSync, readFileSync as readFileSync8, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync as readFileSync9, writeFileSync } from "node:fs";
 import { dirname as dirname5, resolve as resolve8, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
@@ -5494,7 +5727,7 @@ function applyOne(artefact, path10, out, force) {
 }
 function readIfExists(path10) {
   try {
-    return { kind: "ok", content: readFileSync8(path10, "utf8") };
+    return { kind: "ok", content: readFileSync9(path10, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -5705,13 +5938,13 @@ function parseFlags(args) {
 }
 
 // src/groups/client.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname6, join as join11 } from "node:path";
 var CACHE_TTL_MS = 60 * 60 * 1000;
 var CACHE_FILENAME = "groups.json";
 async function fetchGroups(cfg, opts = {}) {
   const now = opts.now ?? Date.now;
-  const cachePath = join10(cfg.cacheDir, CACHE_FILENAME);
+  const cachePath = join11(cfg.cacheDir, CACHE_FILENAME);
   if (opts.forceRefresh !== true) {
     const cached = readCache(cachePath);
     if (cached !== null) {
@@ -5749,7 +5982,7 @@ async function fetchGroups(cfg, opts = {}) {
 function readCache(path10) {
   let raw;
   try {
-    raw = readFileSync9(path10, "utf8");
+    raw = readFileSync10(path10, "utf8");
   } catch {
     return null;
   }
@@ -6250,17 +6483,17 @@ function describe18(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync6, readFileSync as readFileSync10, statSync } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync11, statSync } from "node:fs";
+import { join as join12 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync6(join11(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync6(join11(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync6(join11(cwd, n)));
+  const hasPackageJson = existsSync7(join12(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync7(join12(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync7(join12(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -6306,7 +6539,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync6(join11(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync7(join12(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -6328,8 +6561,8 @@ function detectPackageManager(cwd) {
 }
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
-    const p = join11(cwd, name);
-    if (existsSync6(p)) {
+    const p = join12(cwd, name);
+    if (existsSync7(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -6339,9 +6572,9 @@ function detectVitePresence(cwd) {
   };
 }
 function detectAppType(cwd) {
-  const fnDir = join11(cwd, "functions");
+  const fnDir = join12(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync6(fnDir)) {
+  if (existsSync7(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -6351,8 +6584,8 @@ function detectAppType(cwd) {
   return { kind: "ok", value: hasFunctionsDir ? "react+api" : "react" };
 }
 function detectBuildCommand(cwd, pm) {
-  const pkgJsonPath = join11(cwd, "package.json");
-  if (!existsSync6(pkgJsonPath)) {
+  const pkgJsonPath = join12(cwd, "package.json");
+  if (!existsSync7(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -6360,7 +6593,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync10(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -6395,7 +6628,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync10(vite.path, "utf8");
+    text = readFileSync11(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -6425,7 +6658,7 @@ async function runInit(args, io, prompt) {
   }
   const { inputs, options } = parsed;
   const outPath = resolve9(process.cwd(), options.out);
-  if (existsSync7(outPath) && !options.force) {
+  if (existsSync8(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -6843,8 +7076,8 @@ function renderYaml(manifest) {
 }
 function ensureGitignoreEntries(path10, entries) {
   let current = "";
-  if (existsSync7(path10)) {
-    current = readFileSync11(path10, "utf8");
+  if (existsSync8(path10)) {
+    current = readFileSync12(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -7833,39 +8066,6 @@ async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
   return apiJson(cfg, { path: path12 }, fetcher);
 }
 
-// src/deploy/deployment-status.ts
-async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
-  let raw;
-  try {
-    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/exceptions` }, fetcher);
-  } catch (e) {
-    if (e instanceof NotFoundError)
-      return null;
-    throw e;
-  }
-  if (!Array.isArray(raw.exceptions))
-    return null;
-  return raw.exceptions.filter((e) => typeof e === "object" && e !== null && typeof e.path === "string" && typeof e.rule === "string" && typeof e.detectedAt === "string" && typeof e.deployRef === "string");
-}
-async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
-  let raw;
-  try {
-    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/deployment-status` }, fetcher);
-  } catch (e) {
-    if (e instanceof NotFoundError)
-      return null;
-    throw e;
-  }
-  if (typeof raw.supported !== "boolean")
-    return null;
-  return {
-    slug: typeof raw.slug === "string" ? raw.slug : slug,
-    supported: raw.supported,
-    liveDeployment: raw.liveDeployment ?? null,
-    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null
-  };
-}
-
 // src/commands/pull.ts
 var pullCommand = {
   name: "pull",
@@ -8205,7 +8405,7 @@ function printUsage5(io) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 var statusCommand = {
   name: "status",
   summary: "show drift between local launchpad.yaml and deployed state",
@@ -8262,7 +8462,7 @@ async function runStatus(args, io) {
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync12(parsed.file, "utf8");
+    localYaml = readFileSync13(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
       io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe25(e)}`);
@@ -8865,7 +9065,7 @@ function describe26(e) {
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -8990,11 +9190,11 @@ async function runRollback(opts, io, deps = {}) {
   }, io, applyDeps);
 }
 function readCurrentManifest(path13) {
-  if (!existsSync8(path13))
+  if (!existsSync9(path13))
     return null;
   let raw;
   try {
-    raw = readFileSync13(path13, "utf8");
+    raw = readFileSync14(path13, "utf8");
   } catch {
     return null;
   }
@@ -9150,7 +9350,7 @@ function parseArgs11(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 
 // src/secrets/env-parse.ts
@@ -9205,14 +9405,14 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath3(process.cwd(), opts.env ?? ".env");
-  if (!existsSync9(envPath)) {
+  if (!existsSync10(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync14(envPath, "utf8");
+    envText = readFileSync15(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push: failed to read ${envPath}: ${describe28(e)}`);
     return 2;
@@ -9484,7 +9684,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolvePath5 } from "node:path";
 import { parse as parseYaml6 } from "yaml";
 var CELL_LABEL2 = {
@@ -9494,14 +9694,14 @@ var CELL_LABEL2 = {
 };
 function loadSet(fleetFile, setName, io) {
   const path13 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync10(path13)) {
+  if (!existsSync11(path13)) {
     io.err(`✗ ${path13}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml6(readFileSync15(path13, "utf8"));
+    obj = parseYaml6(readFileSync16(path13, "utf8"));
   } catch (e) {
     io.err(`✗ ${path13}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
@@ -9586,14 +9786,14 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath5(process.cwd(), opts.env ?? ".env");
-  if (!existsSync10(envPath)) {
+  if (!existsSync11(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync15(envPath, "utf8");
+    envText = readFileSync16(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -9737,7 +9937,7 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync11, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync12, writeFileSync as writeFileSync6 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
@@ -9761,7 +9961,7 @@ async function runSecretsTemplate(args, io) {
     return 0;
   }
   const outPath = resolve11(process.cwd(), flags.out);
-  if (existsSync11(outPath) && !flags.force) {
+  if (existsSync12(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
@@ -10049,8 +10249,8 @@ function printHelp2(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname7, join as join12, resolve as resolve12 } from "node:path";
-import { promises as fs6, existsSync as existsSync12 } from "node:fs";
+import { dirname as dirname7, join as join13, resolve as resolve12 } from "node:path";
+import { promises as fs6, existsSync as existsSync13 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 var BUNDLE_PREFIX = "launchpad-";
 var BUNDLED_SKILLS = [
@@ -10111,7 +10311,7 @@ function printHelp3(io) {
 }
 function resolveInstallEnv() {
   const bundleDir = process.env.LAUNCHPAD_SKILLS_BUNDLE_DIR ?? defaultBundleDir();
-  const userSkillsDir = process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join12(homedir2(), ".claude", "skills");
+  const userSkillsDir = process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join13(homedir2(), ".claude", "skills");
   return { bundleDir, userSkillsDir };
 }
 function defaultBundleDir() {
@@ -10121,7 +10321,7 @@ function defaultBundleDir() {
     resolve12(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync12(join12(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync13(join13(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -10142,12 +10342,12 @@ async function doInstall(io) {
   }
   let installed = 0;
   for (const skill of BUNDLED_SKILLS) {
-    const src = join12(env.bundleDir, skill);
+    const src = join13(env.bundleDir, skill);
     if (!await isDir(src)) {
       io.err(`launchpad skills install: bundled skill "${skill}" missing from ${env.bundleDir} — package is incomplete.`);
       return 1;
     }
-    const dest = join12(env.userSkillsDir, skill);
+    const dest = join13(env.userSkillsDir, skill);
     await fs6.rm(dest, { recursive: true, force: true });
     await fs6.cp(src, dest, { recursive: true });
     installed++;
@@ -10172,7 +10372,7 @@ async function doUninstall(io) {
       continue;
     if (!isBundleManaged(entry.name))
       continue;
-    const target = join12(env.userSkillsDir, entry.name);
+    const target = join13(env.userSkillsDir, entry.name);
     await fs6.rm(target, { recursive: true, force: true });
     removed++;
     io.out(`✗ removed ${target}`);
@@ -10195,7 +10395,7 @@ async function doList(io) {
   }
   const width = managedDirs.reduce((n, s) => Math.max(n, s.length), 0);
   for (const name of managedDirs) {
-    const skillFile = join12(env.userSkillsDir, name, "SKILL.md");
+    const skillFile = join13(env.userSkillsDir, name, "SKILL.md");
     const version = await readVersion(skillFile);
     io.out(`  ${name.padEnd(width + 2)}${version ?? "(no version)"}`);
   }
@@ -10230,13 +10430,13 @@ function describe29(e) {
 import { execFile, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname8, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join13 } from "node:path";
+import { dirname as dirname8, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join14 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync16, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync17, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
-import { createHash as createHash2, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes5 } from "node:crypto";
 var CHANNEL_BASE = "https://get.launchpad.m-kopa.us";
 var CLI_AUTH_URL = `${CHANNEL_BASE}/__cli_auth`;
 var CLI_TOKEN_URL = `${CHANNEL_BASE}/__cli_token`;
@@ -10247,7 +10447,7 @@ function base64url(b) {
 }
 function pkcePair() {
   const verifier = base64url(randomBytes5(32));
-  const challenge = base64url(createHash2("sha256").update(verifier).digest());
+  const challenge = base64url(createHash3("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
 async function startLoopback(state, timeoutMs) {
@@ -10353,7 +10553,7 @@ var PKG = "@m-kopa/launchpad-cli";
 var REGISTRY = "https://registry.npmjs.org";
 var CHANNEL_VERSION_URL = "https://get.launchpad.m-kopa.us/version.json";
 var CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
-var CHANNEL_MARKER = join13(homedir3(), ".launchpad", "channel");
+var CHANNEL_MARKER = join14(homedir3(), ".launchpad", "channel");
 var EXIT_UPDATE_AVAILABLE = 10;
 var UPGRADE_ARGS = {
   npm: ["install", "-g", `${PKG}@latest`],
@@ -10463,8 +10663,8 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join13(tmpdir(), "launchpad-update-"));
-  const file = join13(dir, "install.sh");
+  const dir = mkdtempSync(join14(tmpdir(), "launchpad-update-"));
+  const file = join14(dir, "install.sh");
   try {
     writeFileSync7(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
@@ -10488,7 +10688,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync16(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync17(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -10695,7 +10895,7 @@ function printHelp4(io) {
 }
 
 // src/commands/validate.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import { dirname as dirname9, resolve as resolve14 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -10729,7 +10929,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync17(manifestPath, "utf8");
+    manifestYaml = readFileSync18(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -11234,21 +11434,21 @@ var revokeEditorCommand = makeEditorCommand("revoke");
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync2,
   writeFileSync as writeFileSync8
 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
-var CACHE_FILE = join14(homedir4(), ".launchpad", "update-check.json");
+var CACHE_FILE = join15(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync18(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync19(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -11261,15 +11461,15 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync3(join14(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync3(join15(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
 var SKILL_PREFIX = "launchpad-";
-var SKILLS_HINT_MARKER = join14(homedir4(), ".launchpad", "skills-hint-shown");
+var SKILLS_HINT_MARKER = join15(homedir4(), ".launchpad", "skills-hint-shown");
 function skillsTargetDir() {
-  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join14(homedir4(), ".claude", "skills");
+  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir4(), ".claude", "skills");
 }
 function readInstalledSkills() {
   try {
@@ -11277,14 +11477,14 @@ function readInstalledSkills() {
     const bundle = readdirSync2(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
     if (!bundle)
       return { present: false, version: null };
-    return { present: true, version: readSkillVersion(join14(dir, bundle.name, "SKILL.md")) };
+    return { present: true, version: readSkillVersion(join15(dir, bundle.name, "SKILL.md")) };
   } catch {
     return { present: false, version: null };
   }
 }
 function readSkillVersion(path13) {
   try {
-    const text = readFileSync18(path13, "utf8");
+    const text = readFileSync19(path13, "utf8");
     const fenceEnd = text.indexOf(`
 ---`, 4);
     const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
@@ -11296,14 +11496,14 @@ function readSkillVersion(path13) {
 }
 function absentHintShown() {
   try {
-    return existsSync13(SKILLS_HINT_MARKER);
+    return existsSync14(SKILLS_HINT_MARKER);
   } catch {
     return false;
   }
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync3(join14(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync3(join15(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}

package/dist/commands/deploy-flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;gEAC4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CAqW9E"}
+{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;gEAC4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CAqX9E"}

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAuDA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AA+KD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAyDA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AA+KD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/deploy/served-verify.d.ts

@@ -0,0 +1,31 @@
+export type VerifyAppType = "static" | "react" | "react+api" | "container";
+export type VerifyVerdict = {
+    readonly kind: "match";
+} | {
+    readonly kind: "mismatch";
+    readonly servedHash: string;
+    readonly shippedHash: string;
+    readonly servedLen: number;
+    readonly shippedLen: number;
+} | {
+    readonly kind: "unreachable";
+    readonly status?: number;
+    readonly reason: string;
+};
+export interface VerifyDeps {
+    readonly fetch: typeof fetch;
+}
+export interface VerifyArgs {
+    /** The served deployment URL to fetch (the public `<id>.pages.dev`). */
+    readonly servedUrl: string;
+    /** The locally-shipped entrypoint (index.html) bytes or text. */
+    readonly shippedEntrypoint: Uint8Array | string;
+    readonly appType: VerifyAppType;
+}
+/**
+ * Fetch the served entrypoint and compare to what was shipped. Never
+ * throws — a network failure or non-2xx becomes an `unreachable`
+ * verdict so the caller decides how to report it.
+ */
+export declare function verifyServed(args: VerifyArgs, deps?: VerifyDeps): Promise<VerifyVerdict>;
+//# sourceMappingURL=served-verify.d.ts.map

package/dist/deploy/served-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"served-verify.d.ts","sourceRoot":"","sources":["../../src/deploy/served-verify.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAE3E,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAUD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAsB,GAC3B,OAAO,CAAC,aAAa,CAAC,CA8CxB"}

package/dist/deploy/verify-deploy.d.ts

@@ -0,0 +1,25 @@
+import type { CliIo, ExitCode } from "../dispatcher.js";
+import { type SettleOutcome, type WaitArgs, type WaitDeps } from "./wait-for-deployment.js";
+import { type VerifyVerdict, type VerifyArgs, type VerifyDeps, type VerifyAppType } from "./served-verify.js";
+import type { CliConfig } from "../config.js";
+/** EX_DATAERR — the live deployment serves content that doesn't match what shipped. */
+export declare const VERIFY_MISMATCH_EXIT = 65;
+export interface VerifyDeployArgs {
+    readonly slug: string;
+    readonly cwd: string;
+    readonly appType: VerifyAppType;
+    readonly timeoutMs: number;
+}
+export interface VerifyDeployDeps {
+    readonly wait: (args: WaitArgs, deps: WaitDeps) => Promise<SettleOutcome>;
+    readonly verify: (args: VerifyArgs, deps: VerifyDeps) => Promise<VerifyVerdict>;
+    /** Read the local shipped entrypoint (root `index.html`, else `static/index.html`). */
+    readonly readLocalEntrypoint: (cwd: string) => Uint8Array | null;
+    readonly waitDeps: WaitDeps;
+    readonly verifyDeps: VerifyDeps;
+}
+/** Real entrypoint reader: prefer root `index.html`, fall back to `static/index.html`. */
+export declare function readLocalEntrypoint(cwd: string): Uint8Array | null;
+export declare function realVerifyDeployDeps(cfg: CliConfig): VerifyDeployDeps;
+export declare function runDeployVerification(args: VerifyDeployArgs, io: CliIo, deps: VerifyDeployDeps): Promise<ExitCode>;
+//# sourceMappingURL=verify-deploy.d.ts.map

package/dist/deploy/verify-deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-deploy.d.ts","sourceRoot":"","sources":["../../src/deploy/verify-deploy.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,QAAQ,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,uFAAuF;IACvF,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,0FAA0F;AAC1F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAMlE;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,GAAG,gBAAgB,CAQrE;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,QAAQ,CAAC,CA4BnB"}

package/dist/deploy/wait-for-deployment.d.ts

@@ -0,0 +1,37 @@
+import type { CliConfig } from "../config.js";
+import { type DeploymentStatusView } from "./deployment-status.js";
+export type SettleOutcome = {
+    readonly kind: "success";
+    readonly deploymentUrl: string | null;
+} | {
+    readonly kind: "failure";
+    readonly logExcerpt?: string | undefined;
+    readonly failedStage?: string | undefined;
+} | {
+    readonly kind: "pending";
+} | {
+    readonly kind: "unsupported";
+} | {
+    readonly kind: "unknown";
+};
+export interface WaitDeps {
+    /** Read the live deployment status (defaults to the real bot call). */
+    readonly fetchStatus: (slug: string) => Promise<DeploymentStatusView | null>;
+    /** Sleep between polls (injected so tests don't actually wait). */
+    readonly sleep: (ms: number) => Promise<void>;
+    /** Monotonic clock in ms (injected so tests control elapsed time). */
+    readonly now: () => number;
+}
+export interface WaitArgs {
+    readonly slug: string;
+    readonly timeoutMs: number;
+    readonly pollIntervalMs?: number;
+}
+export declare function realWaitDeps(cfg: CliConfig): WaitDeps;
+/**
+ * Poll until the Pages build settles or the timeout elapses. Never
+ * throws on a transient status read; an old bot (null) degrades to
+ * `unknown`, a non-Pages app to `unsupported`.
+ */
+export declare function waitForDeployment(args: WaitArgs, deps: WaitDeps): Promise<SettleOutcome>;
+//# sourceMappingURL=wait-for-deployment.d.ts.map

package/dist/deploy/wait-for-deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait-for-deployment.d.ts","sourceRoot":"","sources":["../../src/deploy/wait-for-deployment.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE1F,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACjH;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,MAAM,WAAW,QAAQ;IACvB,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,QAAQ,CAMrD;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CA+B9F"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.27.4";
+export declare const CLI_VERSION = "0.27.5";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.27.4",
+  "version": "0.27.5",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.27.4
+version: 0.27.5
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.27.4
+version: 0.27.5
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket). Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.27.4
+version: 0.27.5
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.27.4
+version: 0.27.5
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.27.4
+version: 0.27.5
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.27.4
+version: 0.27.5
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->