@m-kopa/launchpad-cli 0.39.0 → 0.41.0

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.39.0";
+var CLI_VERSION = "0.41.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -75,6 +75,28 @@ class TransportError extends Error {
   code = "transport_error";
 }
 
+// src/report/fault-signal.ts
+var last = null;
+function recordFault(err) {
+  if (err === null || typeof err !== "object")
+    return;
+  const code = err.code;
+  if (typeof code !== "string")
+    return;
+  const status = err.status;
+  last = typeof status === "number" ? { code, status } : { code };
+}
+function recordedFault(err) {
+  recordFault(err);
+  return err;
+}
+function clearFault() {
+  last = null;
+}
+function peekFault() {
+  return last;
+}
+
 // src/auth/flow.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 
@@ -838,7 +860,7 @@ async function apiJson(cfg, opts, fetcher = fetch) {
   try {
     parsed = await res.json();
   } catch (e) {
-    throw new TransportError(`bot returned non-JSON body for ${opts.path}: ${describe7(e)}`);
+    throw recordedFault(new TransportError(`bot returned non-JSON body for ${opts.path}: ${describe7(e)}`));
   }
   return parsed;
 }
@@ -880,27 +902,28 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
   try {
     res = await fetcher(url, init);
   } catch (e) {
-    throw new TransportError(`network error calling ${url}: ${describe7(e)}`);
+    throw recordedFault(new TransportError(`network error calling ${url}: ${describe7(e)}`));
   }
   if (res.status === 401) {
     const detail = await peek(res);
-    throw new UnauthenticatedError(`bot returned 401 for ${opts.path}: ${detail} — run \`launchpad login\``);
+    throw recordedFault(new UnauthenticatedError(`bot returned 401 for ${opts.path}: ${detail} — run \`launchpad login\``));
   }
   if (res.status === 403) {
     const detail = await peek(res);
-    throw new ForbiddenError(`bot returned 403 for ${opts.path}: ${detail}`);
+    throw recordedFault(new ForbiddenError(`bot returned 403 for ${opts.path}: ${detail}`));
   }
   if (res.status === 404) {
     const detail = await peek(res);
-    throw new NotFoundError(`bot returned 404 for ${opts.path}: ${detail}`);
+    throw recordedFault(new NotFoundError(`bot returned 404 for ${opts.path}: ${detail}`));
   }
   if (!res.ok) {
     if (opts.nonThrowingStatuses?.includes(res.status) === true) {
       return res;
     }
     const detail = await peek(res);
-    throw new ApiError(`bot returned HTTP ${res.status} for ${opts.path}: ${detail}`, res.status);
+    throw recordedFault(new ApiError(`bot returned HTTP ${res.status} for ${opts.path}: ${detail}`, res.status));
   }
+  clearFault();
   return res;
 }
 async function peek(res) {
@@ -2183,6 +2206,9 @@ var AppBoundarySchema = z.object({
   exclude: z.array(z.string().min(1)).optional()
 }).strict();
 var ProductionEnvSchema = z.record(z.string().regex(ENV_NAME_REGEX, "production_env keys must be UPPER_SNAKE_CASE"), z.string());
+var VerifySchema = z.object({
+  protected_path: z.string().min(1).regex(/^\//, "verify.protected_path must be a root-relative path beginning with '/'")
+}).strict();
 var ManifestSchema = z.object({
   apiVersion: z.literal("launchpad.m-kopa.us/v1alpha1"),
   kind: z.literal("App"),
@@ -2196,9 +2222,33 @@ var ManifestSchema = z.object({
   targets: z.array(TargetSchema).optional(),
   build: BuildSchema.optional(),
   production_env: ProductionEnvSchema.optional(),
-  app: AppBoundarySchema.optional()
+  app: AppBoundarySchema.optional(),
+  verify: VerifySchema.optional(),
+  confine_origin: z.boolean().optional(),
+  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
+  if (m.confine_origin !== undefined) {
+    if (isContainer) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin is only valid for gateway pages apps (static/react/react+api); container apps have no pages.dev surface."
+      });
+    } else if (m.auth === "access") {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
+      });
+    } else if (m.deployment.type === "static" && m.confine_origin === false) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin: false is not allowed for static apps — they have no verifier, so an unconfined apex would be world-readable (ADR 0031)."
+      });
+    }
+  }
   if (isContainer && m.auth === "gateway") {
     ctx.addIssue({
       code: z.ZodIssueCode.custom,
@@ -2790,6 +2840,9 @@ var SpecSchema = z2.object({
   auth: z2.enum(AUTH_MODES).optional(),
   build: BuildSchema.optional(),
   app: AppBoundarySchema.optional(),
+  verify: VerifySchema.optional(),
+  confine_origin: z2.boolean().optional(),
+  catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
   env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
   containers: z2.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
@@ -2812,6 +2865,27 @@ var SpecSchema = z2.object({
       message: "containers[] is required when appType is 'container'"
     });
   }
+  if (s.confine_origin !== undefined) {
+    if (isContainer) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin is only valid for gateway pages apps; container apps have no pages.dev surface."
+      });
+    } else if (s.auth === "access") {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
+      });
+    } else if (s.appType === "static" && s.confine_origin === false) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin: false is not allowed for static apps — an unconfined apex with no verifier is world-readable (ADR 0031)."
+      });
+    }
+  }
   if (!isContainer && s.containers !== undefined) {
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
@@ -3320,9 +3394,45 @@ function emitSecretStep(lines, binding) {
 // ../launchpad-engine/dist/per-app-workspace.js
 var CF_ACCOUNT_ID = "c07cb17c9f742e8144c4828b3693ca65";
 var R2_S3_ENDPOINT = `https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com`;
+// ../launchpad-engine/dist/access-drift.js
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function canonicalUuid(s) {
+  const t = s.trim();
+  return UUID_RE.test(t) ? t.toLowerCase() : null;
+}
+function normalise(tokens, side, resolve6) {
+  const uuids = new Set;
+  const unresolved = [];
+  for (const raw of tokens) {
+    const direct = canonicalUuid(raw);
+    const uuid = direct ?? (() => {
+      const resolved = resolve6(raw);
+      return resolved === null ? null : canonicalUuid(resolved);
+    })();
+    if (uuid === null) {
+      unresolved.push({ side, token: raw });
+    } else {
+      uuids.add(uuid);
+    }
+  }
+  return { uuids, unresolved };
+}
+function detectAccessDrift(declaredTokens, enforcedTokens, resolve6) {
+  const declared = normalise(declaredTokens, "manifest", resolve6);
+  const enforced = normalise(enforcedTokens, "enforced", resolve6);
+  const manifestOnly = [...declared.uuids].filter((u) => !enforced.uuids.has(u)).sort();
+  const liveOnly = [...enforced.uuids].filter((u) => !declared.uuids.has(u)).sort();
+  const unresolved = [...declared.unresolved, ...enforced.unresolved];
+  return {
+    manifestOnly,
+    liveOnly,
+    unresolved,
+    inSync: manifestOnly.length === 0 && liveOnly.length === 0 && unresolved.length === 0
+  };
+}
 // ../launchpad-engine/dist/fleet-manifest.js
 import { z as z3 } from "zod";
-var UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var TF_RESIDENCIES = ["per-app-workspace", "main-tf"];
 var APP_SHAPES = [
   "pages",
@@ -3349,7 +3459,7 @@ var FLEET_TIERS = [
   "out-of-scope"
 ];
 var DEVICE_POSTURE = ["gateway-eligible", "retained-access"];
-var GroupId = z3.string().regex(UUID_RE, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
+var GroupId = z3.string().regex(UUID_RE2, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
 var FleetAppSchema = z3.object({
   slug: z3.string().regex(SLUG_REGEX),
   residency: z3.enum(TF_RESIDENCIES),
@@ -3621,8 +3731,8 @@ async function bundleAndDeploy(args) {
 }
 
 // src/deploy/verify-deploy.ts
-import { readFileSync as readFileSync7, existsSync as existsSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync8, existsSync as existsSync4 } from "node:fs";
+import { join as join9 } from "node:path";
 
 // src/deploy/deployment-status.ts
 async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
@@ -3837,7 +3947,7 @@ function redactDiagnostic(text, maxLen = MAX_DIAGNOSTIC_LEN) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
@@ -3849,6 +3959,7 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
     lastAppliedManifestSha: raw.lastAppliedManifestSha,
     appRepoHeadSha: raw.appRepoHeadSha ?? null,
     openPr: raw.openPr,
+    enforcedGroups: raw.enforcedGroups ?? null,
     ...raw.manifestYaml !== undefined ? { manifestYaml: raw.manifestYaml } : {}
   };
 }
@@ -3893,6 +4004,110 @@ function inferSlug(opts) {
   return fromManifest ?? fromDir;
 }
 
+// src/groups/client.ts
+import { mkdirSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
+import { dirname as dirname5, join as join8 } from "node:path";
+var CACHE_TTL_MS = 60 * 60 * 1000;
+var CACHE_FILENAME = "groups.json";
+async function fetchGroups(cfg, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const cachePath = join8(cfg.cacheDir, CACHE_FILENAME);
+  if (opts.forceRefresh !== true) {
+    const cached = readCache(cachePath);
+    if (cached !== null) {
+      const ageMs = now() - Date.parse(cached.fetchedAt);
+      if (Number.isFinite(ageMs) && ageMs >= 0 && ageMs < CACHE_TTL_MS) {
+        return {
+          kind: "ok",
+          source: "cache",
+          fetchedAt: cached.fetchedAt,
+          groups: cached.groups
+        };
+      }
+    }
+  }
+  let response;
+  try {
+    response = await apiJson(cfg, { path: "/groups" }, opts.fetcher);
+  } catch (e) {
+    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
+      throw e;
+    }
+    return { kind: "error", message: describe11(e) };
+  }
+  if (typeof response !== "object" || response === null || !Array.isArray(response.groups) || !response.groups.every(isEntraGroup)) {
+    return {
+      kind: "error",
+      message: "bot returned a malformed groups response"
+    };
+  }
+  const groups = response.groups;
+  const fetchedAt = new Date(now()).toISOString();
+  writeCache(cachePath, { fetchedAt, groups });
+  return { kind: "ok", source: "fresh", fetchedAt, groups };
+}
+function readCache(path8) {
+  let raw;
+  try {
+    raw = readFileSync6(path8, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return null;
+  const p = parsed;
+  if (typeof p.fetchedAt !== "string")
+    return null;
+  if (!Array.isArray(p.groups))
+    return null;
+  for (const g of p.groups)
+    if (!isEntraGroup(g))
+      return null;
+  return p;
+}
+function isEntraGroup(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const g = value;
+  return typeof g.id === "string" && typeof g.displayName === "string" && (typeof g.mailNickname === "string" || g.mailNickname === null);
+}
+function writeCache(path8, envelope) {
+  try {
+    mkdirSync(dirname5(path8), { recursive: true });
+    writeFileSync(path8, JSON.stringify(envelope), "utf8");
+  } catch {}
+}
+function describe11(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid2(value) {
+  return UUID_PATTERN.test(value);
+}
+function findGroup(groups, nameOrId) {
+  if (isUuid2(nameOrId)) {
+    const lower = nameOrId.toLowerCase();
+    const hit = groups.find((g) => g.id.toLowerCase() === lower);
+    return hit ? { kind: "found", group: hit } : { kind: "not-found" };
+  }
+  const matches = groups.filter((g) => g.displayName === nameOrId || g.mailNickname !== null && g.mailNickname === nameOrId);
+  if (matches.length === 0)
+    return { kind: "not-found" };
+  if (matches.length === 1)
+    return { kind: "found", group: matches[0] };
+  return { kind: "ambiguous", matches };
+}
+function searchGroups(groups, query) {
+  const q = query.toLowerCase();
+  return groups.filter((g) => g.displayName.toLowerCase().includes(q) || g.mailNickname !== null && g.mailNickname.toLowerCase().includes(q) || g.id.toLowerCase().includes(q));
+}
+
 // src/watch/capabilities.ts
 function isUtf8(env) {
   const v = `${env.LC_ALL ?? ""}|${env.LC_CTYPE ?? ""}|${env.LANG ?? ""}`.toLowerCase();
@@ -4525,7 +4740,7 @@ function mapBotError(e, slug, io) {
     io.err(`launchpad status: ${e.message}`);
     return 2;
   }
-  io.err(`launchpad status failed: ${describe11(e)}`);
+  io.err(`launchpad status failed: ${describe12(e)}`);
   return 2;
 }
 async function runStatus(args, io) {
@@ -4551,10 +4766,10 @@ async function runStatus(args, io) {
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync6(parsed.file, "utf8");
+    localYaml = readFileSync7(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
-      io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe11(e)}`);
+      io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe12(e)}`);
       return 2;
     }
   }
@@ -4565,7 +4780,7 @@ async function runStatus(args, io) {
       const { parse: parseYaml4 } = await import("yaml");
       localObj = parseYaml4(localYaml);
     } catch (e) {
-      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe11(e)}`);
+      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe12(e)}`);
       return 2;
     }
     const localParse = parseManifest(localObj);
@@ -4594,7 +4809,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: live deployment state unavailable (${describe11(e)}) — ` + `the report below is from the platform manifest view only.`);
+    io.err(`launchpad status: live deployment state unavailable (${describe12(e)}) — ` + `the report below is from the platform manifest view only.`);
   }
   let standingExceptions = null;
   try {
@@ -4603,7 +4818,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: standing-exception inventory unavailable (${describe11(e)}).`);
+    io.err(`launchpad status: standing-exception inventory unavailable (${describe12(e)}).`);
   }
   if (state.manifestYaml === null || state.manifestYaml === undefined) {
     const live = deployment?.liveDeployment ?? null;
@@ -4655,7 +4870,7 @@ async function runStatus(args, io) {
     const { parse: parseYaml4 } = await import("yaml");
     deployedObj = parseYaml4(state.manifestYaml);
   } catch (e) {
-    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe11(e)}`);
+    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe12(e)}`);
     return 2;
   }
   const deployedParse = parseManifest(deployedObj);
@@ -4668,6 +4883,16 @@ async function runStatus(args, io) {
   }
   const deployed = deployedParse.manifest;
   const drift = computeDrift(local, deployed);
+  let accessDrift;
+  if (state.enforcedGroups !== null) {
+    let resolver;
+    try {
+      resolver = await buildGroupResolver(cfg);
+    } catch (e) {
+      return mapBotError(e, parsed.slug, io);
+    }
+    accessDrift = detectAccessDrift(allowedEntraGroups(local.access), state.enforcedGroups, resolver);
+  }
   const result = {
     state: drift.length === 0 ? "in_sync" : "drift",
     slug: parsed.slug,
@@ -4678,14 +4903,30 @@ async function runStatus(args, io) {
     driftFields: drift.map((d) => d.path),
     driftDetails: drift,
     ...deploymentKnown ? { deployment } : {},
-    ...standingExceptions !== null ? { standingExceptions } : {}
+    ...standingExceptions !== null ? { standingExceptions } : {},
+    ...accessDrift !== undefined ? { accessDrift } : {}
   };
   emit3(result, parsed.json, io);
-  if (result.state === "drift" && parsed.strict) {
+  if (parsed.strict && (result.state === "drift" || accessDrift?.inSync === false)) {
     return 1;
   }
   return 0;
 }
+async function buildGroupResolver(cfg) {
+  try {
+    const res = await fetchGroups(cfg);
+    if (res.kind !== "ok")
+      return () => null;
+    return (nameOrId) => {
+      const hit = findGroup(res.groups, nameOrId);
+      return hit.kind === "found" ? hit.group.id : null;
+    };
+  } catch (e) {
+    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError)
+      throw e;
+    return () => null;
+  }
+}
 function computeDrift(local, deployed) {
   const diffs = [];
   const cmp = (path8, l, d) => {
@@ -4797,6 +5038,7 @@ function emit3(out, asJson, io) {
     case "in_sync":
       io.out(`${out.slug}: live, in sync` + (out.deployedSha ? ` (content @ ${out.deployedSha.slice(0, 7)})` : ""));
       surfaceHeadVsDeployed(out, io);
+      surfaceAccessDrift(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
@@ -4808,11 +5050,28 @@ function emit3(out, asJson, io) {
         io.out(`    deployed: ${formatValue(d.deployed)}`);
       }
       surfaceHeadVsDeployed(out, io);
+      surfaceAccessDrift(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
   }
 }
+function surfaceAccessDrift(out, io) {
+  const ad = out.accessDrift;
+  if (ad === undefined || ad.inSync)
+    return;
+  io.out("  ⚠ ACCESS DRIFT — your declared groups are not what the gateway enforces:");
+  if (ad.liveOnly.length > 0) {
+    io.out(`    enforced but NOT declared (over-grant — still reachable): ${ad.liveOnly.join(", ")}`);
+  }
+  if (ad.manifestOnly.length > 0) {
+    io.out(`    declared but NOT enforced (locked out despite the manifest): ${ad.manifestOnly.join(", ")}`);
+  }
+  for (const u of ad.unresolved) {
+    io.out(`    unresolved group (${u.side}): ${u.token}`);
+  }
+  io.out("    `launchpad deploy` will NOT fix this — access changes go via the gated TF route.");
+}
 function surfaceNoLocalManifestNote(out, io) {
   if (out.drift !== null)
     return;
@@ -5005,7 +5264,7 @@ function printUsage2(io) {
   ].join(`
 `));
 }
-function describe11(e) {
+function describe12(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function isEnoent(e) {
@@ -5016,10 +5275,10 @@ function isEnoent(e) {
 var VERIFY_MISMATCH_EXIT = 65;
 var NO_DEPLOYMENT_EXIT = 69;
 function readLocalEntrypoint(cwd) {
-  for (const rel of ["index.html", join8("static", "index.html")]) {
-    const p = join8(cwd, rel);
+  for (const rel of ["index.html", join9("static", "index.html")]) {
+    const p = join9(cwd, rel);
     if (existsSync4(p))
-      return new Uint8Array(readFileSync7(p));
+      return new Uint8Array(readFileSync8(p));
   }
   return null;
 }
@@ -5253,7 +5512,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 
 // src/commands/deploy.ts
 import { parse as parseYaml5 } from "yaml";
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -5694,15 +5953,15 @@ function parseDeployFlags(args) {
 
 // src/deploy/apply.ts
 import { existsSync as existsSync5, rmSync } from "node:fs";
-import { resolve as resolvePath, join as join9 } from "node:path";
+import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { parse as parseYaml4, YAMLParseError } from "yaml";
 function loadManifest(path8) {
   let raw;
   try {
-    raw = readFileSync8(path8, "utf8");
+    raw = readFileSync9(path8, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -5871,7 +6130,7 @@ async function pollUntilApplied(args) {
         path: `/apps/${args.slug}/manifest/state`
       }, args.fetcher);
     } catch (e) {
-      args.io.err(`! state fetch failed (will retry): ${describe12(e)}`);
+      args.io.err(`! state fetch failed (will retry): ${describe13(e)}`);
       await sleep(args.pollIntervalSec * 1000);
       continue;
     }
@@ -5924,14 +6183,14 @@ function sleep(ms) {
   return new Promise((res) => setTimeout(res, ms));
 }
 function deletePinIfPresent(cfg, slug, io) {
-  const pinPath = join9(cfg.stateDir, slug, "group.json");
+  const pinPath = join10(cfg.stateDir, slug, "group.json");
   if (!existsSync5(pinPath))
     return;
   try {
     rmSync(pinPath, { force: true });
     io.out(`  (cleaned up obsolete pin file ${pinPath})`);
   } catch (e) {
-    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe12(e)}`);
+    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe13(e)}`);
   }
 }
 async function loadSlugForResume(opts, io) {
@@ -5955,7 +6214,7 @@ async function defaultPrompt(question) {
     rl.close();
   }
 }
-function describe12(e) {
+function describe13(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError(e, slug, io) {
@@ -5979,7 +6238,7 @@ function mapHttpError(e, slug, io) {
     io.err(`launchpad deploy --apply: ${e.message}`);
     return 1;
   }
-  io.err(`launchpad deploy --apply failed: ${describe12(e)}`);
+  io.err(`launchpad deploy --apply failed: ${describe13(e)}`);
   return 2;
 }
 function renderManifestError(loaded, io) {
@@ -6021,7 +6280,7 @@ async function runDeployDryRun(opts, io, deps = {}) {
   try {
     manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
   } catch (e) {
-    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe13(e)}`;
+    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe14(e)}`;
     if (opts.json) {
       io.out(JSON.stringify({ ok: false, kind: "git-error", message: msg }));
     } else {
@@ -6070,7 +6329,7 @@ function defaultGitHeadSha(cwd) {
   });
   return out.trim();
 }
-function describe13(e) {
+function describe14(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError2(e, slug, json, io) {
@@ -6454,7 +6713,7 @@ async function runDeploy(args, io) {
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
     if (existsSync6(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync9(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync10(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -6528,7 +6787,7 @@ async function runDeploy(args, io) {
       io.err(`launchpad deploy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad deploy failed: ${describe14(e)}`);
+    io.err(`launchpad deploy failed: ${describe15(e)}`);
     return 1;
   }
 }
@@ -6600,7 +6859,7 @@ function formatBytes2(n) {
     return `${(n / 1024).toFixed(1)}KB`;
   return `${(n / (1024 * 1024)).toFixed(1)}MB`;
 }
-function describe14(e) {
+function describe15(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function surfaceDeployExtras(body, io, slug, allowStale = false) {
@@ -6633,6 +6892,17 @@ function surfaceDeployExtras(body, io, slug, allowStale = false) {
     }
     io.out(`  Full list: \`launchpad status ${slug}\`.`);
   }
+  const adw = body.access_drift_warning;
+  if (adw !== undefined) {
+    io.err("warning: ACCESS DRIFT — declared groups don't match what the gateway enforces:");
+    if (adw.liveOnly !== undefined && adw.liveOnly.length > 0) {
+      io.err(`         enforced but NOT declared (over-grant): ${adw.liveOnly.join(", ")}`);
+    }
+    if (adw.manifestOnly !== undefined && adw.manifestOnly.length > 0) {
+      io.err(`         declared but NOT enforced: ${adw.manifestOnly.join(", ")}`);
+    }
+    io.err(`         reconcile access via the gated TF route — \`launchpad deploy\` can't (it ships content only).`);
+  }
 }
 function isStaleBlock(body) {
   const code = body?.error;
@@ -6665,7 +6935,7 @@ async function runModelADeploy(args) {
   let slug;
   let appType = "static";
   try {
-    const manifestObj = parseYaml5(readFileSync9(manifestPath, "utf8"));
+    const manifestObj = parseYaml5(readFileSync10(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
@@ -6677,7 +6947,7 @@ async function runModelADeploy(args) {
       appType = dtype;
     }
   } catch (e) {
-    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe14(e)}`);
+    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe15(e)}`);
     return 1;
   }
   const noVerify = args.argv.includes("--no-verify");
@@ -6707,7 +6977,7 @@ async function runModelADeploy(args) {
   try {
     cfg = loadConfig();
   } catch (e) {
-    io.err(`launchpad deploy: ${describe14(e)}`);
+    io.err(`launchpad deploy: ${describe15(e)}`);
     return 1;
   }
   const deployBaseline = noVerify ? null : await readDeploymentBaseline(realCommitWaitDeps(cfg), slug);
@@ -6736,7 +7006,7 @@ async function runModelADeploy(args) {
       io.err("       run `launchpad login` to refresh your session.");
       return 1;
     }
-    io.err(`launchpad deploy: unexpected error: ${describe14(e)}`);
+    io.err(`launchpad deploy: unexpected error: ${describe15(e)}`);
     return 1;
   }
   switch (result.kind) {
@@ -6769,6 +7039,23 @@ async function runModelADeploy(args) {
         surfaceStaleBlock(body, io);
         return 1;
       }
+      if (result.status === 409 && errorCode === "access_drift") {
+        io.err(`launchpad deploy: refused — ACCESS DRIFT on "${slug}".`);
+        const liveOnly = Array.isArray(body.live_only) ? body.live_only : [];
+        const manifestOnly = Array.isArray(body.manifest_only) ? body.manifest_only : [];
+        if (liveOnly.length > 0) {
+          io.err(`       enforced but NOT declared (over-grant): ${liveOnly.map(String).join(", ")}`);
+        }
+        if (manifestOnly.length > 0) {
+          io.err(`       declared but NOT enforced: ${manifestOnly.map(String).join(", ")}`);
+        }
+        io.err("");
+        io.err("       Your manifest's access groups don't match what the gateway enforces.");
+        io.err("       `launchpad deploy` ships content only and cannot change access — reconcile");
+        io.err("       via the gated TF route (see the access-change runbook), then redeploy.");
+        io.err("       Nothing was committed by this attempt.");
+        return 1;
+      }
       io.err(`launchpad deploy: bot rejected the upload (HTTP ${result.status}, ${errorCode}).`);
       if (typeof body.message === "string") {
         io.err(`       ${body.message}`);
@@ -6864,7 +7151,7 @@ async function runModelADeploy(args) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml6 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -6945,7 +7232,7 @@ function readLocalAppType(cwd, file) {
   if (!existsSync7(manifestPath))
     return null;
   try {
-    const obj = parseYaml6(readFileSync10(manifestPath, "utf8"));
+    const obj = parseYaml6(readFileSync11(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -7127,7 +7414,7 @@ async function runEnvvars(args, io) {
       io.err(`launchpad envvars: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad envvars failed: ${describe15(e)}`);
+    io.err(`launchpad envvars failed: ${describe16(e)}`);
     return 1;
   }
 }
@@ -7224,13 +7511,13 @@ function renderList(envVars, io) {
     io.out(fmt(row));
   }
 }
-function describe15(e) {
+function describe16(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/generate.ts
-import { mkdirSync, readFileSync as readFileSync11, writeFileSync } from "node:fs";
-import { dirname as dirname5, resolve as resolve8, relative as relative3 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname6, resolve as resolve8, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
   summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
@@ -7248,7 +7535,7 @@ async function runGenerate(args, io) {
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
-  const appRoot = dirname5(manifestPath);
+  const appRoot = dirname6(manifestPath);
   const wranglerPath = resolve8(appRoot, "container", "wrangler.toml");
   const workflowPath = resolve8(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
@@ -7292,8 +7579,8 @@ function applyOne(artefact, path10, out, force) {
     };
   }
   try {
-    mkdirSync(dirname5(path10), { recursive: true });
-    writeFileSync(path10, out.content, "utf8");
+    mkdirSync2(dirname6(path10), { recursive: true });
+    writeFileSync2(path10, out.content, "utf8");
     return {
       artefact,
       action: {
@@ -7317,7 +7604,7 @@ function applyOne(artefact, path10, out, force) {
 }
 function readIfExists(path10) {
   try {
-    return { kind: "ok", content: readFileSync11(path10, "utf8") };
+    return { kind: "ok", content: readFileSync12(path10, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -7527,110 +7814,6 @@ function parseFlags(args) {
   return { kind: "ok", file, dryRun, force, json };
 }
 
-// src/groups/client.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, join as join11 } from "node:path";
-var CACHE_TTL_MS = 60 * 60 * 1000;
-var CACHE_FILENAME = "groups.json";
-async function fetchGroups(cfg, opts = {}) {
-  const now = opts.now ?? Date.now;
-  const cachePath = join11(cfg.cacheDir, CACHE_FILENAME);
-  if (opts.forceRefresh !== true) {
-    const cached = readCache(cachePath);
-    if (cached !== null) {
-      const ageMs = now() - Date.parse(cached.fetchedAt);
-      if (Number.isFinite(ageMs) && ageMs >= 0 && ageMs < CACHE_TTL_MS) {
-        return {
-          kind: "ok",
-          source: "cache",
-          fetchedAt: cached.fetchedAt,
-          groups: cached.groups
-        };
-      }
-    }
-  }
-  let response;
-  try {
-    response = await apiJson(cfg, { path: "/groups" }, opts.fetcher);
-  } catch (e) {
-    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
-      throw e;
-    }
-    return { kind: "error", message: describe16(e) };
-  }
-  if (typeof response !== "object" || response === null || !Array.isArray(response.groups) || !response.groups.every(isEntraGroup)) {
-    return {
-      kind: "error",
-      message: "bot returned a malformed groups response"
-    };
-  }
-  const groups = response.groups;
-  const fetchedAt = new Date(now()).toISOString();
-  writeCache(cachePath, { fetchedAt, groups });
-  return { kind: "ok", source: "fresh", fetchedAt, groups };
-}
-function readCache(path10) {
-  let raw;
-  try {
-    raw = readFileSync12(path10, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null)
-    return null;
-  const p = parsed;
-  if (typeof p.fetchedAt !== "string")
-    return null;
-  if (!Array.isArray(p.groups))
-    return null;
-  for (const g of p.groups)
-    if (!isEntraGroup(g))
-      return null;
-  return p;
-}
-function isEntraGroup(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const g = value;
-  return typeof g.id === "string" && typeof g.displayName === "string" && (typeof g.mailNickname === "string" || g.mailNickname === null);
-}
-function writeCache(path10, envelope) {
-  try {
-    mkdirSync2(dirname6(path10), { recursive: true });
-    writeFileSync2(path10, JSON.stringify(envelope), "utf8");
-  } catch {}
-}
-function describe16(e) {
-  return e instanceof Error ? e.message : String(e);
-}
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isUuid(value) {
-  return UUID_PATTERN.test(value);
-}
-function findGroup(groups, nameOrId) {
-  if (isUuid(nameOrId)) {
-    const lower = nameOrId.toLowerCase();
-    const hit = groups.find((g) => g.id.toLowerCase() === lower);
-    return hit ? { kind: "found", group: hit } : { kind: "not-found" };
-  }
-  const matches = groups.filter((g) => g.displayName === nameOrId || g.mailNickname !== null && g.mailNickname === nameOrId);
-  if (matches.length === 0)
-    return { kind: "not-found" };
-  if (matches.length === 1)
-    return { kind: "found", group: matches[0] };
-  return { kind: "ambiguous", matches };
-}
-function searchGroups(groups, query) {
-  const q = query.toLowerCase();
-  return groups.filter((g) => g.displayName.toLowerCase().includes(q) || g.mailNickname !== null && g.mailNickname.toLowerCase().includes(q) || g.id.toLowerCase().includes(q));
-}
-
 // src/auth/jwt.ts
 class JwtParseError extends Error {
   code = "jwt_parse_error";
@@ -8048,7 +8231,7 @@ async function runResolve(args, io) {
     return 1;
   }
   io.out(hit.group.id);
-  if (!isUuid(key)) {
+  if (!isUuid2(key)) {
     io.err(`# resolved "${key}" → ${hit.group.displayName}`);
   }
   return 0;
@@ -13720,6 +13903,52 @@ function printHelp6(io, commands) {
   io.out("silent until the grant session expires.");
 }
 
+// src/report/classify-fault.ts
+var PLATFORM_FAULT_EXIT_CODES = [69];
+function classifyFault(input3) {
+  if (input3.exitCode === 0)
+    return false;
+  if (PLATFORM_FAULT_EXIT_CODES.includes(input3.exitCode))
+    return true;
+  const f = input3.lastFault;
+  if (f === null)
+    return false;
+  if (f.code === "transport_error")
+    return true;
+  if (f.code === "api_error")
+    return (f.status ?? 0) >= 500;
+  return false;
+}
+
+// src/report/report-nudge.ts
+function nudgeSuppressed(ctx) {
+  if (ctx.env.CI)
+    return true;
+  if (!ctx.stderrIsTTY)
+    return true;
+  if (ctx.argv.includes("--json"))
+    return true;
+  const verb = ctx.argv[0];
+  if (verb === "bug" || verb === "feature")
+    return true;
+  return false;
+}
+function printNudge(io) {
+  io.err('This looks like a platform issue, not something you did — you can report it with `launchpad bug "<what you were trying to do>"` (the last command is attached automatically; don\'t paste secrets).');
+}
+function maybeReportNudge(io, ctx) {
+  if (nudgeSuppressed(ctx))
+    return;
+  if (!classifyFault({ exitCode: ctx.exitCode, lastFault: ctx.lastFault }))
+    return;
+  printNudge(io);
+}
+function maybeCrashReportNudge(io, ctx) {
+  if (nudgeSuppressed(ctx))
+    return;
+  printNudge(io);
+}
+
 // src/cli.ts
 var io = {
   out: (line) => {
@@ -13737,6 +13966,13 @@ dispatch(args, io).then((code) => {
   const elapsedMs = Date.now() - startedAt;
   process.exitCode = code;
   notifyAfterCommand(io, args);
+  maybeReportNudge(io, {
+    argv: args,
+    env: process.env,
+    stderrIsTTY: Boolean(process.stderr.isTTY),
+    exitCode: code,
+    lastFault: peekFault()
+  });
   maybeFirstRunNoticeReal(io, args);
   recordAfterCommandReal(args, code, elapsedMs);
 }).catch((err) => {
@@ -13745,6 +13981,11 @@ dispatch(args, io).then((code) => {
   process.stderr.write(`launchpad: unexpected error: ${msg}
 `);
   process.exitCode = 70;
+  maybeCrashReportNudge(io, {
+    argv: args,
+    env: process.env,
+    stderrIsTTY: Boolean(process.stderr.isTTY)
+  });
   maybeFirstRunNoticeReal(io, args);
   recordAfterCommandReal(args, 70, elapsedMs);
 });