@m-kopa/launchpad-cli 0.39.0 → 0.41.0

package/CHANGELOG.md

@@ -6,6 +6,90 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.41.0 — 2026-06-28
+
+Docs & skills: documented the **app catalogue** — a new
+[`concepts/catalogue`](./docs/concepts/catalogue.md) page (listed by default,
+opt out with `catalogue: { listed: false }`, and why **listing is not access**),
+plus a **runtime-vs-administrative access** section (owner / co-owner / editor)
+in the auth concept. Bundled skills refreshed (synced in place by
+`launchpad update`): the `launchpad-status` skill now points access-drift
+reconciliation at `launchpad deploy --apply`, `launchpad-deploy` notes the
+catalogue opt-out at scaffold time, and `launchpad-content-pr` surfaces
+`redeploy` as a general verb (activate a pushed secret on a Pages tier / force a
+clean rebuild).
+
+Feature (PS-1755 / PS-1762, T3): **`launchpad deploy` now refuses to ship
+content when a gateway app's declared access groups don't match what the gateway
+enforces** — the bot checks this server-side (unbypassable) on every deploy to
+an existing gateway app and rejects with a clear message naming both directions
+(over-grant + declared-not-enforced). `launchpad deploy` ships content only and
+can't reconcile access; change it via the gated Terraform route, then redeploy.
+The refuse is gated by a **default-OFF** server-side kill-switch, so the
+operational rollout controls go-live and benign pre-existing drift can't break
+deploys on day one; while OFF, drift is surfaced as a warning instead. See
+[`deploy`](./docs/commands/deploy.md).
+
+Feature (PS-1755 / PS-1763, T4): **`launchpad status` now reports access
+drift** for gateway apps — whether the gateway actually enforces the Entra
+groups your manifest declares. Because changing `access.allowed_entra_groups`
+and re-running `launchpad deploy` ships content only (it does not re-apply the
+gateway policy), the declared and enforced allow-lists can silently diverge.
+
+- Surfaces both directions: **enforced but not declared** (an over-grant — still
+  reachable) and **declared but not enforced** (locked out despite the manifest).
+  Group names and UUIDs for the same group are treated as equal.
+- `--strict` now exits `1` on access drift as well as manifest drift; `--json`
+  carries an `accessDrift` object. Non-gateway (Cloudflare Access) apps and
+  older bots show no access-drift line.
+- A fleet-wide audit across all gateway apps lives at
+  `scripts/fleet/access-drift-audit.mjs` (`--list` for the offline app
+  enumeration). See [`status`](./docs/commands/status.md).
+
+Feature (sp-bx7q2m, PS-1572 / PS-1584): the platform now runs a **server-side
+anonymous-reachability check** at deploy time and blocks a deploy whose
+`pages.dev` origin serves content/data to unauthenticated callers — closing the
+class behind the dsr-photo-watch leak at the deploy layer.
+
+- New optional manifest key **`verify.protected_path`** (`react`/`react+api`):
+  declare a representative protected route (e.g. `/api/health`) the deploy gate
+  probes anonymously and requires to return `401`/`403`, not `2xx`. `static`
+  apps need no declaration — their whole origin is probed. See the
+  [`verify`](./docs/manifest/index.md#verify-deploy-gate-checks) reference.
+- `launchpad validate` accepts and shape-checks the new `verify` block
+  (root-relative path required). Backward-compatible — omitting it is valid.
+- Enforcement is server-side in portal-bot; this CLI release only adds the
+  manifest field + validation. Version bump deferred to merge.
+- New optional manifest key **`confine_origin`** (boolean, gateway pages apps):
+  opt a `react`/`react+api` app's `<id>.pages.dev` apex into service-token
+  confinement, once it verifies the gateway's `X-Launchpad-User-Assertion`
+  header. Default unchanged (verifier apps unconfined, static always confined);
+  `false` is rejected on static apps. See the
+  [`confine_origin`](./docs/manifest/index.md#confine_origin-apex-confinement)
+  reference (PS-1572 / ADR 0031).
+
+## 0.40.0 — 2026-06-21
+
+Feature (sp-rptndg, PS-1601): `launchpad` now nudges you toward `launchpad bug`
+when a command fails because the **platform** misbehaved — so the reporting verbs
+are discoverable at the moment they're needed, not only to people who already
+know they exist.
+
+- A single one-line, **non-actionable** reminder prints (stderr) on platform
+  faults only: a bot 5xx, a network error, `✗ NO NEW DEPLOYMENT WAS CREATED`
+  (exit 69), or an unexpected crash. Classified by the typed HTTP error, **not**
+  an exit-code allowlist — the common platform faults (5xx / network) are caught
+  and returned as exit 1 inside commands, so an exit-code check would miss them.
+- Stays **quiet** for your-side failures (auth/401, forbidden/403,
+  not-found/404, `ApiError` 4xx, bad input, usage errors) and on non-interactive
+  output (CI, pipes, `--json`).
+- It **never files anything** — filing still shows you the report and asks you to
+  confirm first; the report carries only the last command name, never its args.
+- The `launchpad-deploy` and `launchpad-deploy-status` skills now point an agent
+  at `/launchpad-report` on a platform fault, preserving "never file silently".
+
+No portal-bot change.
+
 ## 0.39.0 — 2026-06-20
 
 Feature (sp-bld9kq, PS-1590): `launchpad deploy` now confirms a Cloudflare