@m-kopa/launchpad-cli 0.32.2 → 0.34.0

package/CHANGELOG.md

@@ -6,6 +6,67 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.34.0 — 2026-06-18
+
+New verb: **`launchpad redeploy [<slug>]`** (sp-rdpl41) — trigger a fresh
+deployment of an app's **already-live content** so deploy-time config (a
+just-pushed secret, env var, or binding) re-binds, without editing any files.
+Closes the "pushed a secret, `launchpad deploy` says nothing to deploy, the
+secret stays inactive" foot-gun: a Cloudflare Pages app binds env/secrets only
+on a NEW deployment, but `deploy` is content-hash idempotent and no-ops on
+unchanged content.
+
+- **Distinct from `deploy` (ADR 0025).** `redeploy` makes **no git commit** and
+  never no-ops — it asks the bot to build what's already live. Activation stays
+  in the bot trust boundary (it holds the sole CF token); the verb is a thin
+  client over `POST /apps/<slug>/redeploy`.
+- **Falsifiable success signal.** Reports the **new Cloudflare deployment id**
+  (distinct from the previously-live one — proof the production env was
+  re-snapshotted), then served-verifies the live URL. If CF returns the same id
+  (no new deployment), it says so and exits non-zero — never a phantom
+  activation.
+- **Tier-aware.** Pages apps get a triggered deployment; Worker/container apps
+  bind on next invocation, so `redeploy` is an explicit no-op for them.
+- **`secrets push` offers it.** When a push writes a **Pages** surface, `push`
+  now ends with a tier-aware next-step: an interactive prompt
+  (`Redeploy … now? [y/N]`), `--redeploy`/`--yes` to activate without a prompt,
+  or — non-interactively — the `launchpad redeploy <slug>` hint (no silent prod
+  deploy; push and deploy stay decoupled). Worker-only pushes don't nag.
+- **Honest react verification.** Served-verify now reports a distinct
+  **reachability-only** outcome ("✓ Live and reachable (HTTP 200)") for
+  react/react+api apps instead of falsely claiming "serves exactly what you
+  shipped" — their build transforms source → output, so byte-equality can't be
+  checked. This makes both `deploy` and `redeploy` honest: a redeploy can't
+  silently ship a different build to prod under the guise of "just reactivating
+  a secret".
+
+## 0.33.0 — 2026-06-17
+
+New verb: **`launchpad watch [<slug>]`** (and `launchpad status <slug> --watch`) —
+watch an app provision to live in real time (sp-wtch7q). Run it in a second
+terminal after a first `launchpad deploy` instead of re-running `launchpad status`
+by hand.
+
+- **Live phase pipeline.** The 15 provisioning stages are grouped into six phases
+  (Repo · Build · Infra · Certificate · Access · Verify) with a spinner on the
+  active phase, `stage N/15`, and **client-side** per-phase timers (the lifecycle
+  exposes only the current stage, so timings are measured from observed transitions
+  and omitted — never faked — for stages that completed before the watch attached).
+- **Graceful terminal frames.** On live, the app URL front and centre; on failure,
+  the failing stage + reason + the exact recovery command. `Ctrl-C` stops *watching*
+  only — provisioning continues.
+- **Capability-tiered, cross-platform.** A terminal probe selects the richest safe
+  renderer — inline live-redraw → ASCII-glyph fallback → append-only → plain — and
+  **degrades, never assumes** (Windows legacy code pages get ASCII, not garbage).
+  Piped / CI / non-TTY output is plain, escape-free text. The platform's **first
+  Windows CI matrix** (windows-latest × Git-Bash/PowerShell/cmd) runs the watcher's
+  degraded tiers.
+- **Safe by construction.** Every bot-supplied string is escape-sanitised before it
+  reaches the terminal (no terminal-escape injection). **Zero new runtime deps** —
+  the ANSI is hand-rolled, now guarded by an assertive zero-runtime-dep CI check.
+- A richer full-screen ("alt-screen") mode is planned as a later opt-in experimental
+  variant; this release ships the inline renderer.
+
 ## 0.32.2 — 2026-06-17
 
 Docs: skill-accuracy sweep. Audited all bundled skills against the live