@m-kopa/launchpad-cli 0.39.0 → 0.41.0

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AA+KD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/commands/status.d.ts

@@ -1,6 +1,6 @@
 import { type CliConfig } from "../config.js";
 import { type DeploymentStatusView, type StandingExceptionView } from "../deploy/deployment-status.js";
-import { type Manifest } from "@m-kopa/launchpad-engine";
+import { type Manifest, type AccessDrift } from "@m-kopa/launchpad-engine";
 import type { Command } from "../dispatcher.js";
 export declare const statusCommand: Command;
 interface StatusArgs {
@@ -78,6 +78,13 @@ export interface StatusJsonOutput {
      *  policy violations in content already live on managed main.
      *  Absent when the bot pre-dates the endpoint. */
     readonly standingExceptions?: readonly StandingExceptionView[];
+    /** PS-1755 / PS-1763 (T4): access drift between the LOCAL declared groups
+     *  (`access.allowed_entra_groups`) and the ENFORCED gateway-KV allow-list
+     *  the bot read from the app's TF. Distinct from the content-drift
+     *  `access.allowed_entra_groups` row (which is local-vs-deployed *manifest*):
+     *  this is "what I declare" vs "what the gateway actually enforces".
+     *  Absent when not a gateway-KV app (`enforcedGroups` null / old bot). */
+    readonly accessDrift?: AccessDrift;
 }
 /** Fetch the app's provisioning lifecycle (sp-st5hw9). Returns null when the
  *  bot doesn't recognise the slug OR predates the endpoint — BOTH surface as a

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAG5F,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAID;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;;;;;2EAMuE;OACrE,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAChE;AAED;;;8EAG8E;AAC9E,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAgSD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAkSD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CA2ErB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,WAAW,EAEjB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAID;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;;;;;2EAMuE;OACrE,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC/D;;;;;8EAK0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED;;;8EAG8E;AAC9E,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAkVD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAgUD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CA2ErB"}

package/dist/deploy/manifest-state.d.ts

@@ -9,6 +9,13 @@ export interface ManifestStateResponse {
         readonly url: string;
         readonly branch: string;
     } | null;
+    /** PS-1763 (T4): the ENFORCED gateway allow-list — the per-app
+     *  `<slug>_policy` KV `groups` array, as raw tokens (UUIDs +
+     *  `entra_groups.<Name>` refs) parsed from the app's TF source. `null` for
+     *  an app with no `<slug>_policy` block (a CF Access app / the gateway —
+     *  a different enforcement mechanism, out of scope for gateway-KV drift).
+     *  Older bots (pre-PS-1763) omit it → normalised to `null`. */
+    readonly enforcedGroups: readonly string[] | null;
     readonly manifestYaml?: string | null;
 }
 /** Fetch `/apps/<slug>/manifest/state`. With `includeManifest: true`,

package/dist/deploy/manifest-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-state.d.ts","sourceRoot":"","sources":["../../src/deploy/manifest-state.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAcD;;gCAEgC;AAChC,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,EACxC,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAehC"}
+{"version":3,"file":"manifest-state.d.ts","sourceRoot":"","sources":["../../src/deploy/manifest-state.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;mEAK+D;IAC/D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAeD;;gCAEgC;AAChC,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,EACxC,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAgBhC"}

package/dist/http/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/http/api-client.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA2FnB"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/http/api-client.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA8FnB"}

package/dist/report/classify-fault.d.ts

@@ -0,0 +1,28 @@
+import type { RecordedFault } from "./fault-signal.js";
+/**
+ * Exit codes that are themselves platform-fault signals, independent of any
+ * recorded HTTP fault. Today only 69 = no-new-deployment (sp-bld9kq): the
+ * commit committed but Cloudflare never built it.
+ *
+ * NB the unhandled-crash exit (70, EX_SOFTWARE) is NOT here — it is emitted
+ * only from `cli.ts`'s top-level `.catch`, which nudges directly; a returned
+ * code never carries it.
+ */
+export declare const PLATFORM_FAULT_EXIT_CODES: readonly number[];
+export interface FaultClassifierInput {
+    readonly exitCode: number;
+    readonly lastFault: RecordedFault | null;
+}
+/**
+ * True iff the failure warrants a "file a bug" nudge.
+ *
+ * - exit 0 (incl. the soft pending/superseded/not-registered-yet outcomes)
+ *   is never a fault.
+ * - A platform-fault exit code (69) is a direct signal.
+ * - Otherwise classify by the last typed HTTP fault: `TransportError`
+ *   (network) and `ApiError` with status >= 500 (bot/server 5xx) are platform
+ *   faults; `ApiError` 4xx, 401/403/404, and any non-HTTP failure (local input,
+ *   usage) are NOT.
+ */
+export declare function classifyFault(input: FaultClassifierInput): boolean;
+//# sourceMappingURL=classify-fault.d.ts.map

package/dist/report/classify-fault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify-fault.d.ts","sourceRoot":"","sources":["../../src/report/classify-fault.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAS,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;CAC1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAUlE"}

package/dist/report/fault-signal.d.ts

@@ -0,0 +1,23 @@
+/** The discriminant + (for `ApiError`) status of the last typed HTTP error. */
+export interface RecordedFault {
+    readonly code: string;
+    readonly status?: number;
+}
+/**
+ * Record the last typed error. Accepts any of the `http/errors.ts` classes
+ * (all carry a string `.code`; `ApiError` also carries `.status`). A non-error
+ * or code-less value is ignored, so a stray throw can never poison the signal.
+ */
+export declare function recordFault(err: unknown): void;
+/**
+ * Record then return the error — sugar for `throw recordedFault(new ApiError(…))`
+ * at the HTTP client throw sites, so recording can't be forgotten next to a throw.
+ */
+export declare function recordedFault<T>(err: T): T;
+/** Clear the recorded fault — called by the HTTP client on a 2xx success. */
+export declare function clearFault(): void;
+/** Read the last recorded fault (null if none / cleared). */
+export declare function peekFault(): RecordedFault | null;
+/** Test-only: reset module state between cases. */
+export declare function _resetFaultForTesting(): void;
+//# sourceMappingURL=fault-signal.d.ts.map

package/dist/report/fault-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fault-signal.d.ts","sourceRoot":"","sources":["../../src/report/fault-signal.ts"],"names":[],"mappings":"AAgBA,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAM9C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAG1C;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,IAAI,aAAa,GAAG,IAAI,CAEhD;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/report/report-nudge.d.ts

@@ -0,0 +1,33 @@
+import type { CliIo } from "../dispatcher.js";
+import type { RecordedFault } from "./fault-signal.js";
+export interface NudgeContext {
+    /** The raw command args; only argv[0] (the verb) is ever read. */
+    readonly argv: readonly string[];
+    readonly env: Record<string, string | undefined>;
+    readonly stderrIsTTY: boolean;
+    readonly exitCode: number;
+    readonly lastFault: RecordedFault | null;
+}
+/** Quiet in non-interactive / machine contexts, and never nudge the report
+ *  verbs themselves. Mirrors update-notifier's isSuppressed. */
+export declare function nudgeSuppressed(ctx: {
+    readonly argv: readonly string[];
+    readonly env: Record<string, string | undefined>;
+    readonly stderrIsTTY: boolean;
+}): boolean;
+/**
+ * Print the nudge for a finished command iff its failure classifies as a
+ * platform fault and we're on an interactive terminal. No-op otherwise.
+ */
+export declare function maybeReportNudge(io: CliIo, ctx: NudgeContext): void;
+/**
+ * Print the nudge for the unhandled-crash path (cli.ts top-level `.catch`,
+ * exit 70). A crash is a platform fault by definition, so no classifier call —
+ * but still TTY/CI-gated and report-verb-skipped.
+ */
+export declare function maybeCrashReportNudge(io: CliIo, ctx: {
+    readonly argv: readonly string[];
+    readonly env: Record<string, string | undefined>;
+    readonly stderrIsTTY: boolean;
+}): void;
+//# sourceMappingURL=report-nudge.d.ts.map

package/dist/report/report-nudge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-nudge.d.ts","sourceRoot":"","sources":["../../src/report/report-nudge.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;CAC1C;AAED;gEACgE;AAChE,wBAAgB,eAAe,CAAC,GAAG,EAAE;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B,GAAG,OAAO,CAOV;AAYD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI,CAInE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;IACpD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B,GAAG,IAAI,CAGP"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.39.0";
+export declare const CLI_VERSION = "0.41.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
@@ -49,6 +49,8 @@
     "test:watch": "vitest",
     "lint": "eslint src tests",
     "typecheck": "tsc --noEmit",
+    "typecheck:catalogue": "tsc -p channel/catalogue/tsconfig.json --noEmit",
+    "build:catalogue": "esbuild channel/catalogue/src/main.ts --bundle --format=esm --minify --target=es2020 --legal-comments=none --outfile=channel/catalogue/dist/app.js",
     "check:version-sync": "bash scripts/check-version-sync.sh",
     "check:runtime-deps": "node scripts/check-runtime-deps.mjs",
     "check:installer-syntax": "bash scripts/check-installer-syntax.sh",

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -248,6 +248,11 @@ Once you've shipped first content, the daily-use verbs are:
   currently-deployed `launchpad.yaml`.
 - **`launchpad deploy`** — bundle the working tree; the bot commits
   it directly to the app repo's `main`.
+- **`launchpad redeploy <slug>`** — re-run a Pages build of the
+  current commit *without* changing content. Use it to **activate a
+  secret you just pushed** (Cloudflare binds env only on a new build,
+  so `secrets push` alone won't take effect on a Pages tier) or to
+  force a clean rebuild. See `/commands/redeploy`.
 - **`launchpad envvars`** — list / set / remove non-secret
   production env vars.
 - **`launchpad secrets template`** — emit `.env.example` from the

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -130,6 +130,16 @@ This is interactive by default. It will ask for:
   layouts; the user overrides if needed.
 - **allowed_entra_groups** — one or more, comma-separated; see §A.3.
 
+By default the app is **listed in the app catalogue**
+(get.launchpad/catalogue — the employee-facing app directory). Listing
+is discovery only and grants no one access. To keep an internal-only
+app out of it, add to `launchpad.yaml`:
+
+```yaml
+catalogue:
+  listed: false
+```
+
 Non-interactive form for scripting:
 
 ```bash
@@ -511,3 +521,18 @@ the in-flight case.
   strips the user JWT and 401s every user (see "Gateway auth").
 - Do **not** `wrangler secret put` for a two-tier app — `launchpad secrets
   push` with `targets: all` seeds both tiers via the bot.
+
+## When a deploy fails because the platform misbehaved
+
+If `launchpad deploy` (or `status`) fails for a reason that is **not** the
+user's — a bot 5xx, a network error, `✗ NO NEW DEPLOYMENT WAS CREATED` /
+exit 69, or an unexpected crash — i.e. it looks like **our** fault, not a typo
+or a missing permission — offer to file it via the **`/launchpad-report`** skill
+(`launchpad bug "<what they were trying to do>"`). The CLI prints a one-line
+nudge on these; offer proactively.
+
+Follow `/launchpad-report`'s rules: **never file silently** — show the user the
+exact title + body you'll send and get their confirmation first, and never paste
+secret-bearing commands/values into the report body. Do **not** offer to file
+for a user-side failure (auth/401, not-found/404, a bad manifest, a dirty tree) —
+fix those instead.

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -360,3 +360,16 @@ such a link anyway.
   `launchpad apps`. Use `launchpad status <slug> --json` for any
   downstream automation (`launchpad apps` has no `--json`; for
   per-app automation go through `status --json` instead).
+
+## When a status check fails because the platform misbehaved
+
+If `launchpad status` / `watch` / `recover` fails for a reason that is **not**
+the user's — a bot 5xx, a network error, `✗ NO NEW DEPLOYMENT WAS CREATED` /
+exit 69, or an unexpected crash — offer to file it via the
+**`/launchpad-report`** skill (`launchpad bug "<what they were trying to do>"`).
+The CLI prints a one-line nudge on these; offer proactively.
+
+Follow `/launchpad-report`'s rules: **never file silently** — show the exact
+title + body and confirm first, and never paste secret-bearing commands/values
+into the body. Do **not** offer to file for a user-side failure (auth/401,
+not-found/404) — resolve those instead.

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.39.0
+version: 0.41.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -336,6 +336,15 @@ Group binding changed in your local manifest. This is the
 `allowed-groups-change: true` label from a non-author human reviewer
 (AC-S4) before it can auto-merge.
 
+Reconcile it with **`launchpad deploy --apply`** — a plain
+`launchpad deploy` ships content only and does **not** re-apply the
+gateway's access policy. On a gateway app where enforcement is on, the
+bot **refuses** a content deploy while the manifest's groups diverge
+from what the gateway actually enforces (so access changes can't be
+silently dropped); `--apply` is the gated route that reconciles the
+enforced KV allow-list to the manifest. `launchpad status --strict`
+exits non-zero on any drift, so it can gate CI.
+
 ## Related skills
 
 - **`/launchpad-deploy`** — provision a new app (`launchpad init`