@m-kopa/launchpad-cli 0.32.2 → 0.33.0

package/CHANGELOG.md

@@ -6,6 +6,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.33.0 — 2026-06-17
+
+New verb: **`launchpad watch [<slug>]`** (and `launchpad status <slug> --watch`) —
+watch an app provision to live in real time (sp-wtch7q). Run it in a second
+terminal after a first `launchpad deploy` instead of re-running `launchpad status`
+by hand.
+
+- **Live phase pipeline.** The 15 provisioning stages are grouped into six phases
+  (Repo · Build · Infra · Certificate · Access · Verify) with a spinner on the
+  active phase, `stage N/15`, and **client-side** per-phase timers (the lifecycle
+  exposes only the current stage, so timings are measured from observed transitions
+  and omitted — never faked — for stages that completed before the watch attached).
+- **Graceful terminal frames.** On live, the app URL front and centre; on failure,
+  the failing stage + reason + the exact recovery command. `Ctrl-C` stops *watching*
+  only — provisioning continues.
+- **Capability-tiered, cross-platform.** A terminal probe selects the richest safe
+  renderer — inline live-redraw → ASCII-glyph fallback → append-only → plain — and
+  **degrades, never assumes** (Windows legacy code pages get ASCII, not garbage).
+  Piped / CI / non-TTY output is plain, escape-free text. The platform's **first
+  Windows CI matrix** (windows-latest × Git-Bash/PowerShell/cmd) runs the watcher's
+  degraded tiers.
+- **Safe by construction.** Every bot-supplied string is escape-sanitised before it
+  reaches the terminal (no terminal-escape injection). **Zero new runtime deps** —
+  the ANSI is hand-rolled, now guarded by an assertive zero-runtime-dep CI check.
+- A richer full-screen ("alt-screen") mode is planned as a later opt-in experimental
+  variant; this release ships the inline renderer.
+
 ## 0.32.2 — 2026-06-17
 
 Docs: skill-accuracy sweep. Audited all bundled skills against the live

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.32.2";
+var CLI_VERSION = "0.33.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -8406,6 +8406,593 @@ function printUsage5(io) {
 
 // src/commands/status.ts
 import { readFileSync as readFileSync13 } from "node:fs";
+
+// src/watch/capabilities.ts
+function isUtf8(env) {
+  const v = `${env.LC_ALL ?? ""}|${env.LC_CTYPE ?? ""}|${env.LANG ?? ""}`.toLowerCase();
+  return v.includes("utf-8") || v.includes("utf8");
+}
+function knownModernTerminal(env) {
+  if (env.WT_SESSION)
+    return true;
+  if (env.ConEmuANSI === "ON")
+    return true;
+  const prog = (env.TERM_PROGRAM ?? "").toLowerCase();
+  return prog === "iterm.app" || prog === "apple_terminal" || prog === "vscode" || prog === "ghostty" || prog === "wezterm";
+}
+function probeCapabilities(p) {
+  const isTTY = p.isTTY === true;
+  if (!isTTY)
+    return { isTTY: false, ansi: false, unicode: false };
+  const term = (p.env.TERM ?? "").toLowerCase();
+  const dumb = term === "dumb";
+  const ansi = !dumb && (p.platform !== "win32" || knownModernTerminal(p.env) || term.startsWith("xterm"));
+  const unicode = isUtf8(p.env) || knownModernTerminal(p.env) || p.platform === "darwin";
+  return { isTTY, ansi, unicode };
+}
+function selectTier(caps) {
+  if (!caps.isTTY)
+    return "plain";
+  if (!caps.ansi)
+    return "append";
+  return caps.unicode ? "inline" : "ascii";
+}
+function detectTier(stream = process.stdout) {
+  const caps = probeCapabilities({
+    platform: process.platform,
+    env: process.env,
+    isTTY: stream.isTTY === true
+  });
+  return { caps, tier: selectTier(caps) };
+}
+
+// src/watch/phases.ts
+var PHASE_NAMES = [
+  "Repo",
+  "Build",
+  "Infra",
+  "Certificate",
+  "Access",
+  "Verify"
+];
+var STAGE_ORDER = [
+  "pending",
+  "repo_created",
+  "bootstrap_pr_opened",
+  "bootstrap_pr_merged",
+  "content_seeded",
+  "tf_pr_opened",
+  "tf_pr_merged",
+  "tf_applied",
+  "cert_active",
+  "policy_attached",
+  "tf_env_pr_opened",
+  "tf_env_pr_merged",
+  "tf_env_applied",
+  "ready_for_content",
+  "deployment_verified"
+];
+var TOTAL_STAGES = STAGE_ORDER.length;
+var STAGE_TO_PHASE = {
+  pending: "Repo",
+  repo_created: "Repo",
+  bootstrap_pr_opened: "Repo",
+  bootstrap_pr_merged: "Repo",
+  content_seeded: "Build",
+  tf_pr_opened: "Infra",
+  tf_pr_merged: "Infra",
+  tf_applied: "Infra",
+  cert_active: "Certificate",
+  policy_attached: "Access",
+  tf_env_pr_opened: "Access",
+  tf_env_pr_merged: "Access",
+  tf_env_applied: "Access",
+  ready_for_content: "Verify",
+  deployment_verified: "Verify"
+};
+var FAILURE_STAGE_TO_PHASE = {
+  validator_rejected: "Repo",
+  bot_pr_ci_failed: "Infra",
+  tf_apply_failed: "Infra",
+  abandoned: "Repo",
+  failed: "Verify"
+};
+function ordinalOfStage(stage) {
+  const i = STAGE_ORDER.indexOf(stage);
+  return i < 0 ? null : i + 1;
+}
+function phaseOfStage(stage) {
+  return STAGE_TO_PHASE[stage] ?? FAILURE_STAGE_TO_PHASE[stage] ?? null;
+}
+function phaseIndex(phase) {
+  return PHASE_NAMES.indexOf(phase);
+}
+
+// src/watch/model.ts
+class WatchModel {
+  slug;
+  startedAtMs = null;
+  stageFirstSeen = new Map;
+  observedOrder = [];
+  currentStage = null;
+  terminal = null;
+  failure = null;
+  liveUrl = null;
+  constructor(slug) {
+    this.slug = slug;
+  }
+  ingest(view, nowMs) {
+    if (this.startedAtMs === null)
+      this.startedAtMs = nowMs;
+    if (view.stage && !this.stageFirstSeen.has(view.stage)) {
+      this.stageFirstSeen.set(view.stage, nowMs);
+      this.observedOrder.push(view.stage);
+    }
+    if (view.stage)
+      this.currentStage = view.stage;
+    if (view.liveUrl)
+      this.liveUrl = view.liveUrl;
+    if (view.state === "live") {
+      this.terminal = "live";
+    } else if (view.state === "failed") {
+      this.terminal = "failed";
+      this.failure = view.failedAt ?? this.failure;
+      if (view.failedAt?.stage)
+        this.currentStage = view.failedAt.stage;
+    }
+  }
+  isTerminal() {
+    return this.terminal !== null;
+  }
+  snapshot(nowMs) {
+    const started = this.startedAtMs ?? nowMs;
+    const activePhase = this.currentStage !== null ? phaseOfStage(this.currentStage) : null;
+    const activeIdx = activePhase !== null ? phaseIndex(activePhase) : -1;
+    const phases = PHASE_NAMES.map((name) => {
+      const idx = phaseIndex(name);
+      let status;
+      if (this.terminal === "live") {
+        status = "done";
+      } else if (this.terminal === "failed") {
+        if (idx < activeIdx)
+          status = "done";
+        else if (idx === activeIdx)
+          status = "failed";
+        else
+          status = "pending";
+      } else if (activeIdx < 0) {
+        status = "pending";
+      } else if (idx < activeIdx) {
+        status = "done";
+      } else if (idx === activeIdx) {
+        status = "active";
+      } else {
+        status = "pending";
+      }
+      return { name, status, elapsedMs: this.phaseElapsed(name, nowMs) };
+    });
+    const stageOrdinal = this.terminal === "live" ? TOTAL_STAGES : this.currentStage !== null ? ordinalOfStage(this.currentStage) : null;
+    return {
+      slug: this.slug,
+      phases,
+      currentStage: this.currentStage,
+      stageOrdinal,
+      totalStages: TOTAL_STAGES,
+      terminal: this.terminal,
+      failure: this.failure ? {
+        stage: this.failure.stage,
+        message: this.failure.message,
+        retryable: this.failure.retryable
+      } : null,
+      liveUrl: this.liveUrl,
+      startedAtMs: started,
+      elapsedTotalMs: Math.max(0, nowMs - started)
+    };
+  }
+  phaseElapsed(phase, nowMs) {
+    let startMs = null;
+    for (const stage of this.observedOrder) {
+      if (phaseOfStage(stage) === phase) {
+        const seen = this.stageFirstSeen.get(stage);
+        if (seen !== undefined && (startMs === null || seen < startMs)) {
+          startMs = seen;
+        }
+      }
+    }
+    if (startMs === null)
+      return null;
+    const targetIdx = phaseIndex(phase);
+    let endMs = null;
+    for (const stage of this.observedOrder) {
+      const p = phaseOfStage(stage);
+      if (p !== null && phaseIndex(p) > targetIdx) {
+        const seen = this.stageFirstSeen.get(stage);
+        if (seen !== undefined && (endMs === null || seen < endMs)) {
+          endMs = seen;
+        }
+      }
+    }
+    if (endMs === null)
+      endMs = nowMs;
+    return Math.max(0, endMs - startMs);
+  }
+}
+
+// src/watch/engine.ts
+var DEFAULTS = {
+  pollIntervalMs: 2000,
+  backoffFactor: 1.5,
+  maxBackoffMs: 30000,
+  maxDurationMs: 20 * 60 * 1000
+};
+async function runWatchLoop(slug, deps, options = {}) {
+  const opts = { ...DEFAULTS, ...options };
+  const model = new WatchModel(slug);
+  const startedAt = deps.now();
+  let backoffMs = opts.pollIntervalMs;
+  let lastSnapshot = null;
+  while (true) {
+    if (deps.signal.aborted)
+      return { outcome: "interrupted", snapshot: lastSnapshot };
+    let nextDelay = opts.pollIntervalMs;
+    try {
+      const view = await deps.fetchLifecycle();
+      if (view === null) {
+        return { outcome: "not_found", snapshot: lastSnapshot };
+      }
+      model.ingest(view, deps.now());
+      lastSnapshot = model.snapshot(deps.now());
+      if (model.isTerminal()) {
+        deps.onTerminal(lastSnapshot);
+        return {
+          outcome: lastSnapshot.terminal === "live" ? "live" : "failed",
+          snapshot: lastSnapshot
+        };
+      }
+      deps.onTick(lastSnapshot);
+      backoffMs = opts.pollIntervalMs;
+    } catch (error) {
+      backoffMs = Math.min(backoffMs * opts.backoffFactor, opts.maxBackoffMs);
+      nextDelay = backoffMs;
+      deps.onPollError?.(error, nextDelay);
+    }
+    if (deps.signal.aborted)
+      return { outcome: "interrupted", snapshot: lastSnapshot };
+    if (deps.now() - startedAt >= opts.maxDurationMs) {
+      return { outcome: "timeout", snapshot: lastSnapshot };
+    }
+    await deps.sleep(nextDelay, deps.signal);
+  }
+}
+function makeRealSleep() {
+  return (ms, signal) => new Promise((resolve11) => {
+    if (signal.aborted)
+      return resolve11();
+    const t = setTimeout(resolve11, ms);
+    signal.addEventListener("abort", () => {
+      clearTimeout(t);
+      resolve11();
+    }, { once: true });
+  });
+}
+
+// src/watch/sanitize.ts
+function isControlCodePoint(cp) {
+  return cp <= 31 || cp >= 127 && cp <= 159;
+}
+function sanitizeForTerminal(input2) {
+  let out = "";
+  for (const ch of input2) {
+    const cp = ch.codePointAt(0);
+    if (cp !== undefined && !isControlCodePoint(cp))
+      out += ch;
+  }
+  return out;
+}
+function sanitizeField(input2, max = 160) {
+  if (input2 == null)
+    return "";
+  const clean = sanitizeForTerminal(input2);
+  if (clean.length <= max)
+    return clean;
+  return clean.slice(0, Math.max(0, max - 1)) + "…";
+}
+
+// src/watch/render.ts
+var GLYPHS = {
+  unicode: {
+    done: "✓",
+    pending: "○",
+    fail: "✗",
+    active: ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"],
+    sep: "·",
+    arrow: "→",
+    dash: "—"
+  },
+  ascii: {
+    done: "v",
+    pending: ".",
+    fail: "x",
+    active: ["|", "/", "-", "\\"],
+    sep: "-",
+    arrow: "->",
+    dash: "-"
+  }
+};
+var ESC = "\x1B";
+var CURSOR_HIDE = `${ESC}[?25l`;
+var CURSOR_SHOW = `${ESC}[?25h`;
+var cursorUp = (n) => n > 0 ? `${ESC}[${n}A` : "";
+var CLEAR_FROM_CURSOR = `${ESC}[0J`;
+function styleForTier(tier) {
+  return tier === "inline" ? "unicode" : "ascii";
+}
+function launchpadUrl(slug) {
+  return `https://${sanitizeField(slug, 80)}.launchpad.m-kopa.us`;
+}
+function formatDuration(ms, dash = "—") {
+  if (ms == null)
+    return dash;
+  const total = Math.floor(ms / 1000);
+  const m = Math.floor(total / 60);
+  const s = total % 60;
+  return `${m}:${String(s).padStart(2, "0")}`;
+}
+function phaseGlyph(g, status, spinnerFrame) {
+  switch (status) {
+    case "done":
+      return g.done;
+    case "failed":
+      return g.fail;
+    case "active":
+      return g.active[spinnerFrame % g.active.length] ?? g.active[0];
+    default:
+      return g.pending;
+  }
+}
+function headerSpinner(g, spinnerFrame) {
+  return g.active[spinnerFrame % g.active.length] ?? g.active[0];
+}
+var PAD = 12;
+function renderProvisioningFrame(s, opts) {
+  const g = GLYPHS[opts.style];
+  const slug = sanitizeField(s.slug, 80);
+  const lines = [];
+  lines.push(`  launchpad ${g.sep} provisioning ${slug}      ${headerSpinner(g, opts.spinnerFrame)} ${formatDuration(s.elapsedTotalMs, g.dash)}`);
+  lines.push("");
+  for (const p of s.phases) {
+    const glyph = phaseGlyph(g, p.status, opts.spinnerFrame);
+    const name = p.name.padEnd(PAD);
+    const detail = p.status === "active" ? "..." : p.status === "done" ? formatDuration(p.elapsedMs, g.dash) : "";
+    lines.push(`  ${glyph} ${name} ${detail}`);
+  }
+  lines.push("");
+  const stage = s.currentStage ? sanitizeField(s.currentStage, 40) : g.dash;
+  const ord = s.stageOrdinal ?? "?";
+  lines.push(`  stage ${ord}/${s.totalStages} ${g.sep} ${stage}`);
+  lines.push(`  Ctrl-C to stop watching ${g.sep} provisioning continues`);
+  return lines.join(`
+`);
+}
+function renderAppendLine(s, opts) {
+  const g = GLYPHS[opts.style];
+  const active = s.phases.find((p) => p.status === "active");
+  const phase = active ? active.name : s.terminal === "live" ? "live" : "...";
+  const stage = s.currentStage ? sanitizeField(s.currentStage, 40) : g.dash;
+  return `  ${headerSpinner(g, opts.spinnerFrame)} ${phase} ${g.sep} stage ${s.stageOrdinal ?? "?"}/${s.totalStages} ${g.sep} ${stage} ${g.sep} ${formatDuration(s.elapsedTotalMs, g.dash)}`;
+}
+function renderPlainLine(s) {
+  const slug = sanitizeField(s.slug, 80);
+  if (s.terminal === "live") {
+    const url = s.liveUrl ? sanitizeField(s.liveUrl, 120) : launchpadUrl(s.slug);
+    return `${slug}: live -> ${url}`;
+  }
+  if (s.terminal === "failed") {
+    const stage2 = s.failure ? sanitizeField(s.failure.stage, 40) : "unknown";
+    const reason = s.failure ? sanitizeField(s.failure.message, 200) : "";
+    return `${slug}: failed at ${stage2}${reason ? ` - ${reason}` : ""}`;
+  }
+  const stage = s.currentStage ? sanitizeField(s.currentStage, 40) : "pending";
+  return `${slug}: provisioning (stage: ${stage}) [${s.stageOrdinal ?? "?"}/${s.totalStages}]`;
+}
+function renderLiveFrame(s, opts) {
+  const g = GLYPHS[opts.style];
+  const slug = sanitizeField(s.slug, 80);
+  const url = s.liveUrl ? sanitizeField(s.liveUrl, 120) : launchpadUrl(s.slug);
+  const row = s.phases.map((p) => `${p.name} ${g.done}`).join("   ");
+  return [
+    `  launchpad ${g.sep} ${slug} is LIVE`,
+    "",
+    `  ${row}`,
+    "",
+    `  Live ${g.arrow} ${url}`
+  ].join(`
+`);
+}
+function renderFailedFrame(s, opts) {
+  const g = GLYPHS[opts.style];
+  const slug = sanitizeField(s.slug, 80);
+  const row = s.phases.map((p) => `${p.name} ${p.status === "failed" ? g.fail : p.status === "done" ? g.done : g.pending}`).join("   ");
+  const stage = s.failure ? sanitizeField(s.failure.stage, 40) : "—";
+  const reason = s.failure ? sanitizeField(s.failure.message, 200) : "unknown";
+  const recovery = s.failure?.retryable === false ? "recover" : "deploy --resume";
+  return [
+    `  launchpad ${g.sep} ${slug} ${g.dash} provisioning failed`,
+    "",
+    `  ${row}`,
+    "",
+    `  ${g.fail} ${stage}: ${reason}`,
+    `  Next ${g.arrow} launchpad ${recovery} ${slug}`
+  ].join(`
+`);
+}
+
+class Renderer {
+  write;
+  tier;
+  prevLines = 0;
+  spinnerFrame = 0;
+  cursorHidden = false;
+  style;
+  constructor(write, tier) {
+    this.write = write;
+    this.tier = tier;
+    this.style = styleForTier(tier);
+  }
+  tick(s) {
+    if (this.tier === "plain")
+      return;
+    this.spinnerFrame += 1;
+    if (this.tier === "append") {
+      this.write(renderAppendLine(s, { style: this.style, spinnerFrame: this.spinnerFrame }) + `
+`);
+      return;
+    }
+    if (!this.cursorHidden) {
+      this.write(CURSOR_HIDE);
+      this.cursorHidden = true;
+    }
+    this.redraw(renderProvisioningFrame(s, { style: this.style, spinnerFrame: this.spinnerFrame }));
+  }
+  terminal(s) {
+    if (this.tier === "plain")
+      return;
+    const frame = s.terminal === "live" ? renderLiveFrame(s, { style: this.style }) : renderFailedFrame(s, { style: this.style });
+    if (this.tier === "append") {
+      this.write(frame + `
+`);
+    } else {
+      this.redraw(frame);
+    }
+    this.restoreCursor();
+  }
+  restoreCursor() {
+    if (this.cursorHidden) {
+      this.write(CURSOR_SHOW);
+      this.cursorHidden = false;
+    }
+  }
+  redraw(body) {
+    const out = (this.prevLines > 0 ? cursorUp(this.prevLines) + CLEAR_FROM_CURSOR : "") + body + `
+`;
+    this.write(out);
+    this.prevLines = body.split(`
+`).length;
+  }
+}
+
+// src/watch/index.ts
+async function fetchLifecycleView(cfg, slug) {
+  try {
+    return await apiJson(cfg, {
+      path: `/apps/${slug}/lifecycle`
+    });
+  } catch (e) {
+    if (e instanceof NotFoundError)
+      return null;
+    throw e;
+  }
+}
+function mapWatchError(e, slug, io) {
+  if (e instanceof UnauthenticatedError) {
+    io.err(`launchpad watch: ${e.message}`);
+    io.err("  session expired, run `launchpad login`");
+    return 2;
+  }
+  if (e instanceof ForbiddenError) {
+    io.err(`launchpad watch: not authorised for app "${slug}" (owner or editor required)`);
+    return 2;
+  }
+  if (e instanceof NotFoundError) {
+    io.err(`launchpad watch: app "${slug}" not found`);
+    return 2;
+  }
+  if (e instanceof ApiError || e instanceof TransportError) {
+    io.err(`launchpad watch: ${e.message}`);
+    return 2;
+  }
+  io.err(`launchpad watch failed: ${e instanceof Error ? e.message : String(e)}`);
+  return 2;
+}
+function defaultSignalRegistrar(handler) {
+  process.on("SIGINT", handler);
+  process.on("SIGTERM", handler);
+  return () => {
+    process.off("SIGINT", handler);
+    process.off("SIGTERM", handler);
+  };
+}
+async function runWatch(slug, io, deps = {}) {
+  const cfg = loadConfig();
+  const now = deps.now ?? (() => Date.now());
+  const stdout = deps.stdout ?? process.stdout;
+  let first;
+  try {
+    first = await fetchLifecycleView(cfg, slug);
+  } catch (e) {
+    return mapWatchError(e, slug, io);
+  }
+  if (first === null) {
+    io.err(`launchpad watch: no app "${slug}" to watch (unknown slug, or first deploy not started)`);
+    return 1;
+  }
+  if (first.state === "destroyed" || first.state === "destroying" || first.state === "destroy_failed") {
+    io.out(`${slug}: ${first.state} — nothing to watch.`);
+    return 0;
+  }
+  const { tier } = detectTier(stdout);
+  const renderer = new Renderer((s) => stdout.write(s), tier);
+  const controller = new AbortController;
+  const registrar = deps.onSignal ?? defaultSignalRegistrar;
+  const unregister = registrar(() => {
+    controller.abort();
+    renderer.restoreCursor();
+  });
+  const onTick = (s) => {
+    if (tier === "plain")
+      io.out(renderPlainLine(s));
+    else
+      renderer.tick(s);
+  };
+  const onTerminal = (s) => {
+    if (tier === "plain")
+      io.out(renderPlainLine(s));
+    else
+      renderer.terminal(s);
+  };
+  try {
+    const res = await runWatchLoop(slug, {
+      fetchLifecycle: () => fetchLifecycleView(cfg, slug),
+      now,
+      sleep: makeRealSleep(),
+      signal: controller.signal,
+      onTick,
+      onTerminal
+    }, deps.engineOptions);
+    switch (res.outcome) {
+      case "live":
+        return 0;
+      case "failed":
+        return 1;
+      case "not_found":
+        io.err(`launchpad watch: app "${slug}" is no longer known to the platform`);
+        return 1;
+      case "interrupted":
+        io.err(`
+stopped watching ${slug} — provisioning continues. Re-run \`launchpad watch ${slug}\`.`);
+        return 130;
+      case "timeout":
+        io.err(`
+still provisioning after the watch window — re-run \`launchpad watch ${slug}\` or check \`launchpad status ${slug}\`.`);
+        return 0;
+    }
+  } finally {
+    unregister();
+    renderer.restoreCursor();
+  }
+}
+
+// src/commands/status.ts
 var statusCommand = {
   name: "status",
   summary: "show drift between local launchpad.yaml and deployed state",
@@ -8449,6 +9036,9 @@ async function runStatus(args, io) {
     printUsage6(io);
     return 64;
   }
+  if (parsed.watch) {
+    return runWatch(parsed.slug, io);
+  }
   const cfg = loadConfig();
   let lifecycle;
   try {
@@ -8815,6 +9405,7 @@ function parseArgs9(args, cwd = process.cwd(), warn) {
   let file = "./launchpad.yaml";
   let json = false;
   let strict = false;
+  let watch = false;
   let i = 0;
   while (i < args.length) {
     const a = args[i] ?? "";
@@ -8847,6 +9438,11 @@ function parseArgs9(args, cwd = process.cwd(), warn) {
       i += 1;
       continue;
     }
+    if (a === "--watch") {
+      watch = true;
+      i += 1;
+      continue;
+    }
     if (a.startsWith("--")) {
       return `unknown flag "${a}"`;
     }
@@ -8866,7 +9462,7 @@ function parseArgs9(args, cwd = process.cwd(), warn) {
   if (!SLUG_RE11.test(slug)) {
     return `invalid slug "${slug}" — expected ${SLUG_RE11.source}`;
   }
-  return { slug, file, json, strict };
+  return { slug, file, json, strict, watch };
 }
 function printUsage6(io) {
   io.err([
@@ -8911,6 +9507,53 @@ function isEnoent(e) {
   return typeof e === "object" && e !== null && e.code === "ENOENT";
 }
 
+// src/commands/watch.ts
+var SLUG_RE12 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+function printUsage7(io) {
+  io.err("usage: launchpad watch [<slug>] [--slug <slug>] [--file <path>]");
+  io.err("       Watch an app provision to live in real time.");
+}
+function resolveWatchSlug(args, cwd, warn) {
+  let explicit;
+  let file;
+  for (let i = 0;i < args.length; i += 1) {
+    const a = args[i];
+    if (a === "--slug") {
+      explicit = args[++i];
+    } else if (a === "--file") {
+      file = args[++i];
+    } else if (a === "--watch") {} else if (a.startsWith("-")) {
+      return { error: `unknown flag: ${a}` };
+    } else if (explicit === undefined) {
+      explicit = a;
+    } else {
+      return { error: `unexpected argument: ${a}` };
+    }
+  }
+  const slug = explicit ?? inferSlug({ cwd, file, warn }) ?? undefined;
+  if (slug === undefined) {
+    return { error: "no slug given and none could be inferred from the current directory" };
+  }
+  if (!SLUG_RE12.test(slug)) {
+    return { error: `invalid slug: "${slug}"` };
+  }
+  return { slug };
+}
+async function runWatchCommand(args, io) {
+  const resolved = resolveWatchSlug(args, process.cwd(), (l) => io.err(l));
+  if ("error" in resolved) {
+    io.err(`launchpad watch: ${resolved.error}`);
+    printUsage7(io);
+    return 64;
+  }
+  return runWatch(resolved.slug, io);
+}
+var watchCommand = {
+  name: "watch",
+  summary: "watch an app provision to live in real time",
+  run: runWatchCommand
+};
+
 // src/commands/review.ts
 import * as path12 from "node:path";
 var reviewCommand = {
@@ -8918,7 +9561,7 @@ var reviewCommand = {
   summary: "show the review state for a PR (slug-scoped)",
   run: runReview
 };
-var SLUG_RE12 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+var SLUG_RE13 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 async function runReview(args, io) {
   const parsed = parseArgs10(args);
   if (parsed === null) {
@@ -8938,8 +9581,8 @@ async function runReview(args, io) {
     }
     slug = inferred;
   }
-  if (!SLUG_RE12.test(slug)) {
-    io.err(`launchpad review: invalid slug "${slug}" — expected ${SLUG_RE12.source}`);
+  if (!SLUG_RE13.test(slug)) {
+    io.err(`launchpad review: invalid slug "${slug}" — expected ${SLUG_RE13.source}`);
     return 64;
   }
   try {
@@ -11851,6 +12494,7 @@ var COMMANDS = [
   generateCommand,
   pullCommand,
   statusCommand,
+  watchCommand,
   recoverCommand,
   destroyCommand,
   rollbackCommand,

package/dist/commands/status.d.ts

@@ -1,3 +1,4 @@
+import { type CliConfig } from "../config.js";
 import { type DeploymentStatusView, type StandingExceptionView } from "../deploy/deployment-status.js";
 import { type Manifest } from "@m-kopa/launchpad-engine";
 import type { Command } from "../dispatcher.js";
@@ -7,6 +8,24 @@ interface StatusArgs {
     readonly file: string;
     readonly json: boolean;
     readonly strict: boolean;
+    /** `--watch`: delegate to the live `launchpad watch` renderer (sp-wtch7q). */
+    readonly watch: boolean;
+}
+/** The bot's `/apps/<slug>/lifecycle` response (sp-st5hw9) — mirrors the
+ *  bot-side `LifecycleResponse`. Lets status show provisioning progress + a
+ *  clear failed state instead of the misleading "no deployed manifest yet". */
+interface LifecycleView {
+    readonly slug: string;
+    readonly state: "provisioning" | "live" | "failed" | "destroying" | "destroyed" | "destroy_failed";
+    readonly stage?: string;
+    readonly submissionId?: string;
+    readonly failedAt?: {
+        readonly stage: string;
+        readonly message: string;
+        readonly retryable: boolean;
+    };
+    readonly liveUrl?: string;
+    readonly lifecycleReason?: string;
 }
 /** What status reports, in machine-readable form for downstream
  *  consumers (M-1187 destroy, M-1189 update-skill). The lifecycle states
@@ -56,6 +75,11 @@ export interface StatusJsonOutput {
      *  Absent when the bot pre-dates the endpoint. */
     readonly standingExceptions?: readonly StandingExceptionView[];
 }
+/** Fetch the app's provisioning lifecycle (sp-st5hw9). Returns null when the
+ *  bot doesn't recognise the slug OR predates the endpoint — BOTH surface as a
+ *  404, so the caller degrades to the manifest-diff path (which raises a real
+ *  not-found itself for a truly-unknown slug). Auth / forbidden propagate. */
+export declare function fetchLifecycle(cfg: CliConfig, slug: string): Promise<LifecycleView | null>;
 /**
  * Compute drift over the v1 closed field set (AC5).
  *

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA6CA,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAuBD;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;oEAEgE;OAC9D,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAChE;AAuRD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAuRD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CAqErB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAE5F,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAID;;+EAE+E;AAC/E,UAAU,aAAa;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;oEAEgE;OAC9D,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAChE;AAED;;;8EAG8E;AAC9E,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AA4QD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAuRD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CA2ErB"}

package/dist/commands/watch.d.ts

@@ -0,0 +1,9 @@
+import type { Command } from "../dispatcher.js";
+/** Resolve the slug from args or the cwd, or return an error string. */
+export declare function resolveWatchSlug(args: readonly string[], cwd: string, warn: (line: string) => void): {
+    slug: string;
+} | {
+    error: string;
+};
+export declare const watchCommand: Command;
+//# sourceMappingURL=watch.d.ts.map

package/dist/commands/watch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,kBAAkB,CAAC;AAWjE,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA2BtC;AAYD,eAAO,MAAM,YAAY,EAAE,OAI1B,CAAC"}

package/dist/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAmDA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAiCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CAmBnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAoDA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAkCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CAmBnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.32.2";
+export declare const CLI_VERSION = "0.33.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/watch/capabilities.d.ts

@@ -0,0 +1,23 @@
+export type RenderTier = "inline" | "ascii" | "append" | "plain";
+export interface TerminalCaps {
+    readonly isTTY: boolean;
+    /** Cursor-control / VT escape sequences are safe to emit. */
+    readonly ansi: boolean;
+    /** Unicode box/braille glyphs render correctly. */
+    readonly unicode: boolean;
+}
+export interface ProbeEnv {
+    readonly platform: NodeJS.Platform;
+    readonly env: NodeJS.ProcessEnv;
+    readonly isTTY: boolean;
+}
+export declare function probeCapabilities(p: ProbeEnv): TerminalCaps;
+export declare function selectTier(caps: TerminalCaps): RenderTier;
+/** Convenience: probe the live process + pick a tier. */
+export declare function detectTier(stream?: {
+    isTTY?: boolean;
+}): {
+    caps: TerminalCaps;
+    tier: RenderTier;
+};
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/watch/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/watch/capabilities.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAqBD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,GAAG,YAAY,CAsB3D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,UAAU,CAIzD;AAED,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,MAAM,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAmB,GAAG;IACxE,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;CAClB,CAOA"}

package/dist/watch/engine.d.ts

@@ -0,0 +1,35 @@
+import { type LifecycleSnapshot, type WatchSnapshot } from "./model.js";
+export type WatchOutcome = "live" | "failed" | "timeout" | "interrupted" | "not_found";
+export interface WatchEngineDeps {
+    /** One poll. Resolves to the lifecycle, or null when the slug is
+     *  unknown to the bot (terminal: nothing to watch). Throws on transient
+     *  / network / 5xx errors (the loop backs off and retries). */
+    readonly fetchLifecycle: () => Promise<LifecycleSnapshot | null>;
+    readonly now: () => number;
+    /** Resolves after `ms`, or early if `signal` aborts. */
+    readonly sleep: (ms: number, signal: AbortSignal) => Promise<void>;
+    /** Aborts the watch (wired to SIGINT/SIGTERM by the caller). */
+    readonly signal: AbortSignal;
+    /** Called every poll with the latest snapshot (the live frame). */
+    readonly onTick: (snapshot: WatchSnapshot) => void;
+    /** Called once on a terminal state (live/failed) with the final frame. */
+    readonly onTerminal: (snapshot: WatchSnapshot) => void;
+    /** Non-fatal: a transient poll error the loop is retrying. */
+    readonly onPollError?: (error: unknown, nextRetryMs: number) => void;
+}
+export interface WatchEngineOptions {
+    readonly pollIntervalMs?: number;
+    readonly backoffFactor?: number;
+    readonly maxBackoffMs?: number;
+    readonly maxDurationMs?: number;
+}
+export interface WatchResult {
+    readonly outcome: WatchOutcome;
+    /** The last snapshot rendered (null only if the very first poll said
+     *  the slug is unknown). */
+    readonly snapshot: WatchSnapshot | null;
+}
+export declare function runWatchLoop(slug: string, deps: WatchEngineDeps, options?: WatchEngineOptions): Promise<WatchResult>;
+/** Real interruptible sleep (production). */
+export declare function makeRealSleep(): (ms: number, signal: AbortSignal) => Promise<void>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/watch/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/watch/engine.ts"],"names":[],"mappings":"AAQA,OAAO,EAAc,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,QAAQ,GACR,SAAS,GACT,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,WAAW,eAAe;IAC9B;;mEAE+D;IAC/D,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;IACnD,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;IACvD,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACtE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AASD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B;gCAC4B;IAC5B,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CACzC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,CA2CtB;AAED,6CAA6C;AAC7C,wBAAgB,aAAa,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAclF"}

package/dist/watch/index.d.ts

@@ -0,0 +1,19 @@
+import type { CliIo, ExitCode } from "../dispatcher.js";
+import { type WatchEngineOptions } from "./engine.js";
+export interface RunWatchDeps {
+    readonly now?: () => number;
+    readonly stdout?: {
+        isTTY?: boolean;
+        write: (s: string) => void;
+    };
+    /** Test seam for signal registration; defaults to process. */
+    readonly onSignal?: (handler: () => void) => () => void;
+    readonly engineOptions?: WatchEngineOptions;
+}
+/**
+ * Watch a slug provision to live. Returns an exit code:
+ *   0 live (or timed-out-but-still-going); 1 failed / not-found;
+ *   2 auth/transport; 130 interrupted (Ctrl-C).
+ */
+export declare function runWatch(slug: string, io: CliIo, deps?: RunWatchDeps): Promise<ExitCode>;
+//# sourceMappingURL=index.d.ts.map

package/dist/watch/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/watch/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAA+B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA6CnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IAClE,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC;CAC7C;AAWD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2ElG"}

package/dist/watch/model.d.ts

@@ -0,0 +1,69 @@
+import { type PhaseName } from "./phases.js";
+/** The subset of the bot's LifecycleView the watcher consumes. */
+export interface LifecycleSnapshot {
+    readonly state: "provisioning" | "live" | "failed" | "destroying" | "destroyed" | "destroy_failed";
+    readonly stage?: string;
+    readonly failedAt?: {
+        readonly stage: string;
+        readonly message: string;
+        readonly retryable: boolean;
+    };
+    readonly liveUrl?: string;
+}
+export type PhaseStatus = "pending" | "active" | "done" | "failed";
+export interface PhaseView {
+    readonly name: PhaseName;
+    readonly status: PhaseStatus;
+    /** Observed client-side elapsed for this phase, or null when unknown
+     *  (the phase completed before the watch attached, or hasn't started). */
+    readonly elapsedMs: number | null;
+}
+export type Terminal = "live" | "failed" | null;
+export interface WatchSnapshot {
+    readonly slug: string;
+    readonly phases: readonly PhaseView[];
+    readonly currentStage: string | null;
+    /** N in "stage N/15" (15 when live). */
+    readonly stageOrdinal: number | null;
+    readonly totalStages: number;
+    readonly terminal: Terminal;
+    readonly failure: {
+        readonly stage: string;
+        readonly message: string;
+        readonly retryable: boolean;
+    } | null;
+    readonly liveUrl: string | null;
+    readonly startedAtMs: number;
+    readonly elapsedTotalMs: number;
+}
+/**
+ * Accumulates lifecycle observations into a renderable snapshot. One
+ * instance per watch session; `ingest` is called once per poll tick.
+ */
+export declare class WatchModel {
+    private readonly slug;
+    private startedAtMs;
+    /** First time each stage was observed (client-side). */
+    private readonly stageFirstSeen;
+    /** Order in which stages were first observed. */
+    private readonly observedOrder;
+    private currentStage;
+    private terminal;
+    private failure;
+    private liveUrl;
+    constructor(slug: string);
+    /** Fold one poll result into the model. */
+    ingest(view: LifecycleSnapshot, nowMs: number): void;
+    /** True once a terminal (live/failed) state has been observed. */
+    isTerminal(): boolean;
+    /** Render the current snapshot as of `nowMs`. */
+    snapshot(nowMs: number): WatchSnapshot;
+    /**
+     * Observed elapsed for a phase: from the first observed stage in the
+     * phase to the first observed stage of a LATER phase (or `nowMs` if the
+     * phase is still the active one). null when we never observed the
+     * phase's start (it completed before the watch attached).
+     */
+    private phaseElapsed;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/watch/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/watch/model.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,SAAS,EAKf,MAAM,aAAa,CAAC;AAErB,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;8EAC0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,UAAU;IAWT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAVjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,wDAAwD;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,iDAAiD;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,OAAO,CAA8C;IAC7D,OAAO,CAAC,OAAO,CAAuB;gBAET,IAAI,EAAE,MAAM;IAEzC,2CAA2C;IAC3C,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAmBpD,kEAAkE;IAClE,UAAU,IAAI,OAAO;IAIrB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa;IAsDtC;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CA4BrB"}

package/dist/watch/phases.d.ts

@@ -0,0 +1,20 @@
+/** The six phases, in display order. */
+export declare const PHASE_NAMES: readonly ["Repo", "Build", "Infra", "Certificate", "Access", "Verify"];
+export type PhaseName = (typeof PHASE_NAMES)[number];
+/**
+ * The 15 working stages in happy-path order. `done` is terminal and is
+ * NOT a working stage — reaching it means the Verify phase is complete
+ * (the app is live). `stage N/15` uses a stage's index in this array.
+ */
+export declare const STAGE_ORDER: readonly ["pending", "repo_created", "bootstrap_pr_opened", "bootstrap_pr_merged", "content_seeded", "tf_pr_opened", "tf_pr_merged", "tf_applied", "cert_active", "policy_attached", "tf_env_pr_opened", "tf_env_pr_merged", "tf_env_applied", "ready_for_content", "deployment_verified"];
+export declare const TOTAL_STAGES: 15;
+/** 1-based ordinal of a working stage, or null if not a working stage. */
+export declare function ordinalOfStage(stage: string): number | null;
+/**
+ * The phase a stage belongs to. Returns null for an unrecognised stage
+ * (the model then keeps the last-known active phase rather than guessing).
+ */
+export declare function phaseOfStage(stage: string): PhaseName | null;
+/** Index of a phase in PHASE_NAMES (display/ordering), or -1. */
+export declare function phaseIndex(phase: PhaseName): number;
+//# sourceMappingURL=phases.d.ts.map

package/dist/watch/phases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phases.d.ts","sourceRoot":"","sources":["../../src/watch/phases.ts"],"names":[],"mappings":"AAWA,wCAAwC;AACxC,eAAO,MAAM,WAAW,wEAOd,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,WAAW,4RAgBd,CAAC;AAEX,eAAO,MAAM,YAAY,IAAqB,CAAC;AAmC/C,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAE5D;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEnD"}

package/dist/watch/render.d.ts

@@ -0,0 +1,55 @@
+import type { RenderTier } from "./capabilities.js";
+import type { WatchSnapshot } from "./model.js";
+type GlyphStyle = "unicode" | "ascii";
+export declare const CURSOR_HIDE = "\u001B[?25l";
+export declare const CURSOR_SHOW = "\u001B[?25h";
+export declare function styleForTier(tier: RenderTier): GlyphStyle;
+export declare function launchpadUrl(slug: string): string;
+/** ms → "M:SS" (or `dash` when unknown/null). */
+export declare function formatDuration(ms: number | null, dash?: string): string;
+/** The live provisioning frame (multi-line) for inline/ascii tiers. */
+export declare function renderProvisioningFrame(s: WatchSnapshot, opts: {
+    style: GlyphStyle;
+    spinnerFrame: number;
+}): string;
+/** One-line compact update for the append-only tier. */
+export declare function renderAppendLine(s: WatchSnapshot, opts: {
+    style: GlyphStyle;
+    spinnerFrame: number;
+}): string;
+/**
+ * Plain, ASCII-only, escape-free line for the non-TTY tier (pipes / CI).
+ * Mirrors the existing `launchpad status` one-liner style so piped output
+ * stays familiar and never carries control sequences.
+ */
+export declare function renderPlainLine(s: WatchSnapshot): string;
+/** Final LIVE frame. */
+export declare function renderLiveFrame(s: WatchSnapshot, opts: {
+    style: GlyphStyle;
+}): string;
+/** Final FAILED frame. */
+export declare function renderFailedFrame(s: WatchSnapshot, opts: {
+    style: GlyphStyle;
+}): string;
+/**
+ * Owns the cursor mechanics for the redraw tiers. `write` receives raw
+ * strings (the renderer's own trusted ANSI + already-sanitised content).
+ */
+export declare class Renderer {
+    private readonly write;
+    private readonly tier;
+    private prevLines;
+    private spinnerFrame;
+    private cursorHidden;
+    private readonly style;
+    constructor(write: (s: string) => void, tier: RenderTier);
+    /** Per-poll live frame. No-op for the plain tier (caller handles it). */
+    tick(s: WatchSnapshot): void;
+    /** Final frame; settles the view (no spinner) and restores the cursor. */
+    terminal(s: WatchSnapshot): void;
+    /** Restore the terminal on any exit path (also called from signal handlers). */
+    restoreCursor(): void;
+    private redraw;
+}
+export {};
+//# sourceMappingURL=render.d.ts.map

package/dist/watch/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/watch/render.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAe,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7D,KAAK,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAoCtC,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAIzC,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAEzD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,SAAM,GAAG,MAAM,CAMpE;AAqBD,uEAAuE;AACvE,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,aAAa,EAChB,IAAI,EAAE;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAkBR;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,aAAa,EAChB,IAAI,EAAE;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAMR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAaxD;AAED,wBAAwB;AACxB,wBAAgB,eAAe,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,MAAM,CAYrF;AAED,0BAA0B;AAC1B,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,MAAM,CAiBvF;AAED;;;GAGG;AACH,qBAAa,QAAQ;IAOjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPvB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;gBAGhB,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EAC1B,IAAI,EAAE,UAAU;IAKnC,yEAAyE;IACzE,IAAI,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI;IAc5B,0EAA0E;IAC1E,QAAQ,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI;IAchC,gFAAgF;IAChF,aAAa,IAAI,IAAI;IAOrB,OAAO,CAAC,MAAM;CAKf"}

package/dist/watch/sanitize.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Strip all control characters from an untrusted string so nothing it
+ * contains can be interpreted as a terminal control sequence. Printable
+ * text (incl. full Unicode) is preserved; an ESC that would introduce a
+ * CSI/OSC sequence is removed, so the rest renders as inert literal text.
+ */
+export declare function sanitizeForTerminal(input: string): string;
+/**
+ * Sanitise + bound a value to a single line of at most `max` glyphs, so a
+ * pathologically long bot string can't blow the layout. Adds an ellipsis
+ * when truncated.
+ */
+export declare function sanitizeField(input: string | null | undefined, max?: number): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/watch/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/watch/sanitize.ts"],"names":[],"mappings":"AAkBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,SAAM,GAAG,MAAM,CAKjF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
@@ -50,6 +50,7 @@
     "lint": "eslint src tests",
     "typecheck": "tsc --noEmit",
     "check:version-sync": "bash scripts/check-version-sync.sh",
+    "check:runtime-deps": "node scripts/check-runtime-deps.mjs",
     "check:installer-syntax": "bash scripts/check-installer-syntax.sh",
     "check:skill-contract": "bash scripts/sync-skill-contract.sh --check",
     "check:skill-bash-dialect": "bash scripts/check-skill-bash-dialect.sh",

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.32.2
+version: 0.33.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.32.2
+version: 0.33.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -271,8 +271,10 @@ fresh slug auto-provisions:
   5–10 minutes. **Your bundle ships with the provisioning run** — when
   lifecycle reaches `live`, this deploy's content is what's serving.
   **No second deploy needed**; re-deploying is only for the rare case
-  where the app comes up live *without* your content. Watch with
-  `launchpad status <slug>`.
+  where the app comes up live *without* your content. **Watch it go
+  live in real time with `launchpad watch <slug>`** (a self-updating
+  view of the provisioning pipeline that exits when the app is live or
+  failed); `launchpad status <slug>` is the one-shot equivalent.
 - **Subsequent deploys** (slug already live): the bot extracts the
   tarball, runs the ingest gates (see below), commits the bundle
   straight onto `main` of `launchpad-app-<slug>` via the GitHub App
@@ -314,8 +316,9 @@ re-trying.
 
 The CLI exits as soon as the bot acknowledges the upload (202). For
 subsequent deploys it prints the commit short-SHA + repo; for first
-deploys it prints provisioning guidance. Use `launchpad status
-<slug>` to watch lifecycle progress to its terminal state.
+deploys it prints provisioning guidance. Run `launchpad watch <slug>`
+to watch lifecycle progress live to its terminal state (or
+`launchpad status <slug>` for a one-shot check).
 
 Flags — there is nothing useful to pass on the Model A path:
 

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
-description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket). Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.32.2
+description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
+version: 0.33.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -56,6 +56,7 @@ inference source resolves.
 
 | Question | Verb |
 |---|---|
+| Watch a first deploy provision to live in real time | `launchpad watch <slug>` — see § Watch below |
 | Is my local manifest in sync with what's deployed? | `launchpad status <slug>` |
 | What lifecycle bucket is the app in? | `launchpad apps` |
 | What was actually deployed? | `launchpad pull <slug>` |
@@ -63,8 +64,34 @@ inference source resolves.
 | What broke the most recent deploy? | `launchpad status <slug> --json` + the bot's PR check trail |
 | It says `failed` but the app is live in a browser | `launchpad recover <slug>` — see § Recover below |
 
-The Model A default is `launchpad status <slug>`. The other verbs
-are specialisations.
+The Model A default is `launchpad status <slug>` (a one-shot read).
+For an in-flight first deploy, `launchpad watch <slug>` is the live
+view. The other verbs are specialisations.
+
+## Watch — live provisioning (`launchpad watch`)
+
+For a first deploy still provisioning, `launchpad watch <slug>` (alias:
+`launchpad status <slug> --watch`) renders the pipeline live and updates
+in place until the app is **live** or **failed** — no manual re-running:
+
+```bash
+launchpad watch <slug>
+```
+
+- The 15 workflow stages are grouped into six phases (Repo · Build ·
+  Infra · Certificate · Access · Verify) with a spinner on the active
+  phase and a `stage N/15` counter. Slug inference matches
+  `launchpad status` (manifest slug, then the `launchpad-app-<slug>/`
+  dirname).
+- On **live** it settles to a final frame with the app URL; on
+  **failed** it shows the failing stage, the reason, and the exact
+  recovery command (`launchpad deploy --resume <slug>`, or
+  `launchpad recover <slug>` for a terminal-failed-but-live record —
+  see § Recover). Exit `0` live, `1` failed, `130` on `Ctrl-C`.
+- `Ctrl-C` stops **watching** only — it never affects provisioning.
+- It adapts to the terminal (full glyphs → ASCII → plain when piped/CI),
+  so it is safe to run anywhere. It is **read-only** — it polls the same
+  lifecycle `launchpad status` reads, and makes no change.
 
 ## Standard (Model A) status
 
@@ -77,6 +104,8 @@ the canonical reference). Lifecycle-shaped states:
 
 - **`provisioning`** — first deploy still in flight. The live
   workflow stage is shown inline (`stage: …`); see § Stage taxonomy.
+  To watch it advance to its terminal state live, use
+  `launchpad watch <slug>` (§ Watch).
 - **`provisioning_failed`** — provisioning failed; the failing stage
   and reason are shown inline. If the app is actually live, see
   § Recover.

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.32.2
+version: 0.33.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.32.2
+version: 0.33.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.32.2
+version: 0.33.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.32.2
+version: 0.33.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->