@m-kopa/launchpad-cli 0.40.0 → 0.41.1

package/CHANGELOG.md

@@ -6,6 +6,85 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.41.1 — 2026-06-30
+
+Docs & skills correctness fix: **any Entra group in the tenant can gate an
+app — it does not need to be assigned to the Launchpad enterprise
+application** (PS-1733, live 2026-06-25). The docs and bundled skills still
+described the retired "assigned-only" rule, which led to users being wrongly
+told to ask IT to assign a group (e.g. `G_information_security`) before they
+could use it. Corrected across the auth concept, manifest reference,
+`first-app`/`auth` guides, and the `validate` / `groups` / `deploy` command
+pages, and in the `launchpad-deploy` / `launchpad-content-pr` skills. Key
+clarification: `launchpad groups` and `launchpad validate --strict-groups`
+resolve only against the **assigned** set and will **falsely reject** a valid
+unassigned group — use **`launchpad deploy --dry-run`** to pre-check any
+tenant group (it resolves against the whole tenant, exactly as the real
+submit). A reference is rejected only when the group is unknown, ineligible (a
+distribution list / hidden-membership group), or an ambiguous display name.
+
+## 0.41.0 — 2026-06-28
+
+Docs & skills: documented the **app catalogue** — a new
+[`concepts/catalogue`](./docs/concepts/catalogue.md) page (listed by default,
+opt out with `catalogue: { listed: false }`, and why **listing is not access**),
+plus a **runtime-vs-administrative access** section (owner / co-owner / editor)
+in the auth concept. Bundled skills refreshed (synced in place by
+`launchpad update`): the `launchpad-status` skill now points access-drift
+reconciliation at `launchpad deploy --apply`, `launchpad-deploy` notes the
+catalogue opt-out at scaffold time, and `launchpad-content-pr` surfaces
+`redeploy` as a general verb (activate a pushed secret on a Pages tier / force a
+clean rebuild).
+
+Feature (PS-1755 / PS-1762, T3): **`launchpad deploy` now refuses to ship
+content when a gateway app's declared access groups don't match what the gateway
+enforces** — the bot checks this server-side (unbypassable) on every deploy to
+an existing gateway app and rejects with a clear message naming both directions
+(over-grant + declared-not-enforced). `launchpad deploy` ships content only and
+can't reconcile access; change it via the gated Terraform route, then redeploy.
+The refuse is gated by a **default-OFF** server-side kill-switch, so the
+operational rollout controls go-live and benign pre-existing drift can't break
+deploys on day one; while OFF, drift is surfaced as a warning instead. See
+[`deploy`](./docs/commands/deploy.md).
+
+Feature (PS-1755 / PS-1763, T4): **`launchpad status` now reports access
+drift** for gateway apps — whether the gateway actually enforces the Entra
+groups your manifest declares. Because changing `access.allowed_entra_groups`
+and re-running `launchpad deploy` ships content only (it does not re-apply the
+gateway policy), the declared and enforced allow-lists can silently diverge.
+
+- Surfaces both directions: **enforced but not declared** (an over-grant — still
+  reachable) and **declared but not enforced** (locked out despite the manifest).
+  Group names and UUIDs for the same group are treated as equal.
+- `--strict` now exits `1` on access drift as well as manifest drift; `--json`
+  carries an `accessDrift` object. Non-gateway (Cloudflare Access) apps and
+  older bots show no access-drift line.
+- A fleet-wide audit across all gateway apps lives at
+  `scripts/fleet/access-drift-audit.mjs` (`--list` for the offline app
+  enumeration). See [`status`](./docs/commands/status.md).
+
+Feature (sp-bx7q2m, PS-1572 / PS-1584): the platform now runs a **server-side
+anonymous-reachability check** at deploy time and blocks a deploy whose
+`pages.dev` origin serves content/data to unauthenticated callers — closing the
+class behind the dsr-photo-watch leak at the deploy layer.
+
+- New optional manifest key **`verify.protected_path`** (`react`/`react+api`):
+  declare a representative protected route (e.g. `/api/health`) the deploy gate
+  probes anonymously and requires to return `401`/`403`, not `2xx`. `static`
+  apps need no declaration — their whole origin is probed. See the
+  [`verify`](./docs/manifest/index.md#verify-deploy-gate-checks) reference.
+- `launchpad validate` accepts and shape-checks the new `verify` block
+  (root-relative path required). Backward-compatible — omitting it is valid.
+- Enforcement is server-side in portal-bot; this CLI release only adds the
+  manifest field + validation. Version bump deferred to merge.
+- New optional manifest key **`confine_origin`** (boolean, gateway pages apps):
+  opt a `react`/`react+api` app's `<id>.pages.dev` apex into service-token
+  confinement, once it verifies the gateway's `X-Launchpad-User-Assertion`
+  header. Default unchanged (verifier apps unconfined, static always confined);
+  `false` is rejected on static apps. See the
+  [`confine_origin`](./docs/manifest/index.md#confine_origin-apex-confinement)
+  reference (PS-1572 / ADR 0031).
+
 ## 0.40.0 — 2026-06-21
 
 Feature (sp-rptndg, PS-1601): `launchpad` now nudges you toward `launchpad bug`

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.40.0";
+var CLI_VERSION = "0.41.1";
 
 // src/config.ts
 import * as os from "node:os";
@@ -2206,6 +2206,9 @@ var AppBoundarySchema = z.object({
   exclude: z.array(z.string().min(1)).optional()
 }).strict();
 var ProductionEnvSchema = z.record(z.string().regex(ENV_NAME_REGEX, "production_env keys must be UPPER_SNAKE_CASE"), z.string());
+var VerifySchema = z.object({
+  protected_path: z.string().min(1).regex(/^\//, "verify.protected_path must be a root-relative path beginning with '/'")
+}).strict();
 var ManifestSchema = z.object({
   apiVersion: z.literal("launchpad.m-kopa.us/v1alpha1"),
   kind: z.literal("App"),
@@ -2219,9 +2222,33 @@ var ManifestSchema = z.object({
   targets: z.array(TargetSchema).optional(),
   build: BuildSchema.optional(),
   production_env: ProductionEnvSchema.optional(),
-  app: AppBoundarySchema.optional()
+  app: AppBoundarySchema.optional(),
+  verify: VerifySchema.optional(),
+  confine_origin: z.boolean().optional(),
+  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
+  if (m.confine_origin !== undefined) {
+    if (isContainer) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin is only valid for gateway pages apps (static/react/react+api); container apps have no pages.dev surface."
+      });
+    } else if (m.auth === "access") {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
+      });
+    } else if (m.deployment.type === "static" && m.confine_origin === false) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin: false is not allowed for static apps — they have no verifier, so an unconfined apex would be world-readable (ADR 0031)."
+      });
+    }
+  }
   if (isContainer && m.auth === "gateway") {
     ctx.addIssue({
       code: z.ZodIssueCode.custom,
@@ -2813,6 +2840,9 @@ var SpecSchema = z2.object({
   auth: z2.enum(AUTH_MODES).optional(),
   build: BuildSchema.optional(),
   app: AppBoundarySchema.optional(),
+  verify: VerifySchema.optional(),
+  confine_origin: z2.boolean().optional(),
+  catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
   env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
   containers: z2.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
@@ -2835,6 +2865,27 @@ var SpecSchema = z2.object({
       message: "containers[] is required when appType is 'container'"
     });
   }
+  if (s.confine_origin !== undefined) {
+    if (isContainer) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin is only valid for gateway pages apps; container apps have no pages.dev surface."
+      });
+    } else if (s.auth === "access") {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
+      });
+    } else if (s.appType === "static" && s.confine_origin === false) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin: false is not allowed for static apps — an unconfined apex with no verifier is world-readable (ADR 0031)."
+      });
+    }
+  }
   if (!isContainer && s.containers !== undefined) {
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
@@ -3343,9 +3394,45 @@ function emitSecretStep(lines, binding) {
 // ../launchpad-engine/dist/per-app-workspace.js
 var CF_ACCOUNT_ID = "c07cb17c9f742e8144c4828b3693ca65";
 var R2_S3_ENDPOINT = `https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com`;
+// ../launchpad-engine/dist/access-drift.js
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function canonicalUuid(s) {
+  const t = s.trim();
+  return UUID_RE.test(t) ? t.toLowerCase() : null;
+}
+function normalise(tokens, side, resolve6) {
+  const uuids = new Set;
+  const unresolved = [];
+  for (const raw of tokens) {
+    const direct = canonicalUuid(raw);
+    const uuid = direct ?? (() => {
+      const resolved = resolve6(raw);
+      return resolved === null ? null : canonicalUuid(resolved);
+    })();
+    if (uuid === null) {
+      unresolved.push({ side, token: raw });
+    } else {
+      uuids.add(uuid);
+    }
+  }
+  return { uuids, unresolved };
+}
+function detectAccessDrift(declaredTokens, enforcedTokens, resolve6) {
+  const declared = normalise(declaredTokens, "manifest", resolve6);
+  const enforced = normalise(enforcedTokens, "enforced", resolve6);
+  const manifestOnly = [...declared.uuids].filter((u) => !enforced.uuids.has(u)).sort();
+  const liveOnly = [...enforced.uuids].filter((u) => !declared.uuids.has(u)).sort();
+  const unresolved = [...declared.unresolved, ...enforced.unresolved];
+  return {
+    manifestOnly,
+    liveOnly,
+    unresolved,
+    inSync: manifestOnly.length === 0 && liveOnly.length === 0 && unresolved.length === 0
+  };
+}
 // ../launchpad-engine/dist/fleet-manifest.js
 import { z as z3 } from "zod";
-var UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var TF_RESIDENCIES = ["per-app-workspace", "main-tf"];
 var APP_SHAPES = [
   "pages",
@@ -3372,7 +3459,7 @@ var FLEET_TIERS = [
   "out-of-scope"
 ];
 var DEVICE_POSTURE = ["gateway-eligible", "retained-access"];
-var GroupId = z3.string().regex(UUID_RE, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
+var GroupId = z3.string().regex(UUID_RE2, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
 var FleetAppSchema = z3.object({
   slug: z3.string().regex(SLUG_REGEX),
   residency: z3.enum(TF_RESIDENCIES),
@@ -3644,8 +3731,8 @@ async function bundleAndDeploy(args) {
 }
 
 // src/deploy/verify-deploy.ts
-import { readFileSync as readFileSync7, existsSync as existsSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync8, existsSync as existsSync4 } from "node:fs";
+import { join as join9 } from "node:path";
 
 // src/deploy/deployment-status.ts
 async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
@@ -3860,7 +3947,7 @@ function redactDiagnostic(text, maxLen = MAX_DIAGNOSTIC_LEN) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
@@ -3872,6 +3959,7 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
     lastAppliedManifestSha: raw.lastAppliedManifestSha,
     appRepoHeadSha: raw.appRepoHeadSha ?? null,
     openPr: raw.openPr,
+    enforcedGroups: raw.enforcedGroups ?? null,
     ...raw.manifestYaml !== undefined ? { manifestYaml: raw.manifestYaml } : {}
   };
 }
@@ -3916,6 +4004,110 @@ function inferSlug(opts) {
   return fromManifest ?? fromDir;
 }
 
+// src/groups/client.ts
+import { mkdirSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
+import { dirname as dirname5, join as join8 } from "node:path";
+var CACHE_TTL_MS = 60 * 60 * 1000;
+var CACHE_FILENAME = "groups.json";
+async function fetchGroups(cfg, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const cachePath = join8(cfg.cacheDir, CACHE_FILENAME);
+  if (opts.forceRefresh !== true) {
+    const cached = readCache(cachePath);
+    if (cached !== null) {
+      const ageMs = now() - Date.parse(cached.fetchedAt);
+      if (Number.isFinite(ageMs) && ageMs >= 0 && ageMs < CACHE_TTL_MS) {
+        return {
+          kind: "ok",
+          source: "cache",
+          fetchedAt: cached.fetchedAt,
+          groups: cached.groups
+        };
+      }
+    }
+  }
+  let response;
+  try {
+    response = await apiJson(cfg, { path: "/groups" }, opts.fetcher);
+  } catch (e) {
+    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
+      throw e;
+    }
+    return { kind: "error", message: describe11(e) };
+  }
+  if (typeof response !== "object" || response === null || !Array.isArray(response.groups) || !response.groups.every(isEntraGroup)) {
+    return {
+      kind: "error",
+      message: "bot returned a malformed groups response"
+    };
+  }
+  const groups = response.groups;
+  const fetchedAt = new Date(now()).toISOString();
+  writeCache(cachePath, { fetchedAt, groups });
+  return { kind: "ok", source: "fresh", fetchedAt, groups };
+}
+function readCache(path8) {
+  let raw;
+  try {
+    raw = readFileSync6(path8, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return null;
+  const p = parsed;
+  if (typeof p.fetchedAt !== "string")
+    return null;
+  if (!Array.isArray(p.groups))
+    return null;
+  for (const g of p.groups)
+    if (!isEntraGroup(g))
+      return null;
+  return p;
+}
+function isEntraGroup(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const g = value;
+  return typeof g.id === "string" && typeof g.displayName === "string" && (typeof g.mailNickname === "string" || g.mailNickname === null);
+}
+function writeCache(path8, envelope) {
+  try {
+    mkdirSync(dirname5(path8), { recursive: true });
+    writeFileSync(path8, JSON.stringify(envelope), "utf8");
+  } catch {}
+}
+function describe11(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid2(value) {
+  return UUID_PATTERN.test(value);
+}
+function findGroup(groups, nameOrId) {
+  if (isUuid2(nameOrId)) {
+    const lower = nameOrId.toLowerCase();
+    const hit = groups.find((g) => g.id.toLowerCase() === lower);
+    return hit ? { kind: "found", group: hit } : { kind: "not-found" };
+  }
+  const matches = groups.filter((g) => g.displayName === nameOrId || g.mailNickname !== null && g.mailNickname === nameOrId);
+  if (matches.length === 0)
+    return { kind: "not-found" };
+  if (matches.length === 1)
+    return { kind: "found", group: matches[0] };
+  return { kind: "ambiguous", matches };
+}
+function searchGroups(groups, query) {
+  const q = query.toLowerCase();
+  return groups.filter((g) => g.displayName.toLowerCase().includes(q) || g.mailNickname !== null && g.mailNickname.toLowerCase().includes(q) || g.id.toLowerCase().includes(q));
+}
+
 // src/watch/capabilities.ts
 function isUtf8(env) {
   const v = `${env.LC_ALL ?? ""}|${env.LC_CTYPE ?? ""}|${env.LANG ?? ""}`.toLowerCase();
@@ -4548,7 +4740,7 @@ function mapBotError(e, slug, io) {
     io.err(`launchpad status: ${e.message}`);
     return 2;
   }
-  io.err(`launchpad status failed: ${describe11(e)}`);
+  io.err(`launchpad status failed: ${describe12(e)}`);
   return 2;
 }
 async function runStatus(args, io) {
@@ -4574,10 +4766,10 @@ async function runStatus(args, io) {
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync6(parsed.file, "utf8");
+    localYaml = readFileSync7(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
-      io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe11(e)}`);
+      io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe12(e)}`);
       return 2;
     }
   }
@@ -4588,7 +4780,7 @@ async function runStatus(args, io) {
       const { parse: parseYaml4 } = await import("yaml");
       localObj = parseYaml4(localYaml);
     } catch (e) {
-      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe11(e)}`);
+      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe12(e)}`);
       return 2;
     }
     const localParse = parseManifest(localObj);
@@ -4617,7 +4809,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: live deployment state unavailable (${describe11(e)}) — ` + `the report below is from the platform manifest view only.`);
+    io.err(`launchpad status: live deployment state unavailable (${describe12(e)}) — ` + `the report below is from the platform manifest view only.`);
   }
   let standingExceptions = null;
   try {
@@ -4626,7 +4818,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: standing-exception inventory unavailable (${describe11(e)}).`);
+    io.err(`launchpad status: standing-exception inventory unavailable (${describe12(e)}).`);
   }
   if (state.manifestYaml === null || state.manifestYaml === undefined) {
     const live = deployment?.liveDeployment ?? null;
@@ -4678,7 +4870,7 @@ async function runStatus(args, io) {
     const { parse: parseYaml4 } = await import("yaml");
     deployedObj = parseYaml4(state.manifestYaml);
   } catch (e) {
-    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe11(e)}`);
+    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe12(e)}`);
     return 2;
   }
   const deployedParse = parseManifest(deployedObj);
@@ -4691,6 +4883,16 @@ async function runStatus(args, io) {
   }
   const deployed = deployedParse.manifest;
   const drift = computeDrift(local, deployed);
+  let accessDrift;
+  if (state.enforcedGroups !== null) {
+    let resolver;
+    try {
+      resolver = await buildGroupResolver(cfg);
+    } catch (e) {
+      return mapBotError(e, parsed.slug, io);
+    }
+    accessDrift = detectAccessDrift(allowedEntraGroups(local.access), state.enforcedGroups, resolver);
+  }
   const result = {
     state: drift.length === 0 ? "in_sync" : "drift",
     slug: parsed.slug,
@@ -4701,14 +4903,30 @@ async function runStatus(args, io) {
     driftFields: drift.map((d) => d.path),
     driftDetails: drift,
     ...deploymentKnown ? { deployment } : {},
-    ...standingExceptions !== null ? { standingExceptions } : {}
+    ...standingExceptions !== null ? { standingExceptions } : {},
+    ...accessDrift !== undefined ? { accessDrift } : {}
   };
   emit3(result, parsed.json, io);
-  if (result.state === "drift" && parsed.strict) {
+  if (parsed.strict && (result.state === "drift" || accessDrift?.inSync === false)) {
     return 1;
   }
   return 0;
 }
+async function buildGroupResolver(cfg) {
+  try {
+    const res = await fetchGroups(cfg);
+    if (res.kind !== "ok")
+      return () => null;
+    return (nameOrId) => {
+      const hit = findGroup(res.groups, nameOrId);
+      return hit.kind === "found" ? hit.group.id : null;
+    };
+  } catch (e) {
+    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError)
+      throw e;
+    return () => null;
+  }
+}
 function computeDrift(local, deployed) {
   const diffs = [];
   const cmp = (path8, l, d) => {
@@ -4820,6 +5038,7 @@ function emit3(out, asJson, io) {
     case "in_sync":
       io.out(`${out.slug}: live, in sync` + (out.deployedSha ? ` (content @ ${out.deployedSha.slice(0, 7)})` : ""));
       surfaceHeadVsDeployed(out, io);
+      surfaceAccessDrift(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
@@ -4831,11 +5050,28 @@ function emit3(out, asJson, io) {
         io.out(`    deployed: ${formatValue(d.deployed)}`);
       }
       surfaceHeadVsDeployed(out, io);
+      surfaceAccessDrift(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
   }
 }
+function surfaceAccessDrift(out, io) {
+  const ad = out.accessDrift;
+  if (ad === undefined || ad.inSync)
+    return;
+  io.out("  ⚠ ACCESS DRIFT — your declared groups are not what the gateway enforces:");
+  if (ad.liveOnly.length > 0) {
+    io.out(`    enforced but NOT declared (over-grant — still reachable): ${ad.liveOnly.join(", ")}`);
+  }
+  if (ad.manifestOnly.length > 0) {
+    io.out(`    declared but NOT enforced (locked out despite the manifest): ${ad.manifestOnly.join(", ")}`);
+  }
+  for (const u of ad.unresolved) {
+    io.out(`    unresolved group (${u.side}): ${u.token}`);
+  }
+  io.out("    `launchpad deploy` will NOT fix this — access changes go via the gated TF route.");
+}
 function surfaceNoLocalManifestNote(out, io) {
   if (out.drift !== null)
     return;
@@ -5028,7 +5264,7 @@ function printUsage2(io) {
   ].join(`
 `));
 }
-function describe11(e) {
+function describe12(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function isEnoent(e) {
@@ -5039,10 +5275,10 @@ function isEnoent(e) {
 var VERIFY_MISMATCH_EXIT = 65;
 var NO_DEPLOYMENT_EXIT = 69;
 function readLocalEntrypoint(cwd) {
-  for (const rel of ["index.html", join8("static", "index.html")]) {
-    const p = join8(cwd, rel);
+  for (const rel of ["index.html", join9("static", "index.html")]) {
+    const p = join9(cwd, rel);
     if (existsSync4(p))
-      return new Uint8Array(readFileSync7(p));
+      return new Uint8Array(readFileSync8(p));
   }
   return null;
 }
@@ -5276,7 +5512,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 
 // src/commands/deploy.ts
 import { parse as parseYaml5 } from "yaml";
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -5717,15 +5953,15 @@ function parseDeployFlags(args) {
 
 // src/deploy/apply.ts
 import { existsSync as existsSync5, rmSync } from "node:fs";
-import { resolve as resolvePath, join as join9 } from "node:path";
+import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { parse as parseYaml4, YAMLParseError } from "yaml";
 function loadManifest(path8) {
   let raw;
   try {
-    raw = readFileSync8(path8, "utf8");
+    raw = readFileSync9(path8, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -5894,7 +6130,7 @@ async function pollUntilApplied(args) {
         path: `/apps/${args.slug}/manifest/state`
       }, args.fetcher);
     } catch (e) {
-      args.io.err(`! state fetch failed (will retry): ${describe12(e)}`);
+      args.io.err(`! state fetch failed (will retry): ${describe13(e)}`);
       await sleep(args.pollIntervalSec * 1000);
       continue;
     }
@@ -5947,14 +6183,14 @@ function sleep(ms) {
   return new Promise((res) => setTimeout(res, ms));
 }
 function deletePinIfPresent(cfg, slug, io) {
-  const pinPath = join9(cfg.stateDir, slug, "group.json");
+  const pinPath = join10(cfg.stateDir, slug, "group.json");
   if (!existsSync5(pinPath))
     return;
   try {
     rmSync(pinPath, { force: true });
     io.out(`  (cleaned up obsolete pin file ${pinPath})`);
   } catch (e) {
-    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe12(e)}`);
+    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe13(e)}`);
   }
 }
 async function loadSlugForResume(opts, io) {
@@ -5978,7 +6214,7 @@ async function defaultPrompt(question) {
     rl.close();
   }
 }
-function describe12(e) {
+function describe13(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError(e, slug, io) {
@@ -6002,7 +6238,7 @@ function mapHttpError(e, slug, io) {
     io.err(`launchpad deploy --apply: ${e.message}`);
     return 1;
   }
-  io.err(`launchpad deploy --apply failed: ${describe12(e)}`);
+  io.err(`launchpad deploy --apply failed: ${describe13(e)}`);
   return 2;
 }
 function renderManifestError(loaded, io) {
@@ -6044,7 +6280,7 @@ async function runDeployDryRun(opts, io, deps = {}) {
   try {
     manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
   } catch (e) {
-    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe13(e)}`;
+    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe14(e)}`;
     if (opts.json) {
       io.out(JSON.stringify({ ok: false, kind: "git-error", message: msg }));
     } else {
@@ -6093,7 +6329,7 @@ function defaultGitHeadSha(cwd) {
   });
   return out.trim();
 }
-function describe13(e) {
+function describe14(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError2(e, slug, json, io) {
@@ -6477,7 +6713,7 @@ async function runDeploy(args, io) {
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
     if (existsSync6(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync9(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync10(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -6551,7 +6787,7 @@ async function runDeploy(args, io) {
       io.err(`launchpad deploy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad deploy failed: ${describe14(e)}`);
+    io.err(`launchpad deploy failed: ${describe15(e)}`);
     return 1;
   }
 }
@@ -6623,7 +6859,7 @@ function formatBytes2(n) {
     return `${(n / 1024).toFixed(1)}KB`;
   return `${(n / (1024 * 1024)).toFixed(1)}MB`;
 }
-function describe14(e) {
+function describe15(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function surfaceDeployExtras(body, io, slug, allowStale = false) {
@@ -6656,6 +6892,17 @@ function surfaceDeployExtras(body, io, slug, allowStale = false) {
     }
     io.out(`  Full list: \`launchpad status ${slug}\`.`);
   }
+  const adw = body.access_drift_warning;
+  if (adw !== undefined) {
+    io.err("warning: ACCESS DRIFT — declared groups don't match what the gateway enforces:");
+    if (adw.liveOnly !== undefined && adw.liveOnly.length > 0) {
+      io.err(`         enforced but NOT declared (over-grant): ${adw.liveOnly.join(", ")}`);
+    }
+    if (adw.manifestOnly !== undefined && adw.manifestOnly.length > 0) {
+      io.err(`         declared but NOT enforced: ${adw.manifestOnly.join(", ")}`);
+    }
+    io.err(`         reconcile access via the gated TF route — \`launchpad deploy\` can't (it ships content only).`);
+  }
 }
 function isStaleBlock(body) {
   const code = body?.error;
@@ -6688,7 +6935,7 @@ async function runModelADeploy(args) {
   let slug;
   let appType = "static";
   try {
-    const manifestObj = parseYaml5(readFileSync9(manifestPath, "utf8"));
+    const manifestObj = parseYaml5(readFileSync10(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
@@ -6700,7 +6947,7 @@ async function runModelADeploy(args) {
       appType = dtype;
     }
   } catch (e) {
-    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe14(e)}`);
+    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe15(e)}`);
     return 1;
   }
   const noVerify = args.argv.includes("--no-verify");
@@ -6730,7 +6977,7 @@ async function runModelADeploy(args) {
   try {
     cfg = loadConfig();
   } catch (e) {
-    io.err(`launchpad deploy: ${describe14(e)}`);
+    io.err(`launchpad deploy: ${describe15(e)}`);
     return 1;
   }
   const deployBaseline = noVerify ? null : await readDeploymentBaseline(realCommitWaitDeps(cfg), slug);
@@ -6759,7 +7006,7 @@ async function runModelADeploy(args) {
       io.err("       run `launchpad login` to refresh your session.");
       return 1;
     }
-    io.err(`launchpad deploy: unexpected error: ${describe14(e)}`);
+    io.err(`launchpad deploy: unexpected error: ${describe15(e)}`);
     return 1;
   }
   switch (result.kind) {
@@ -6792,6 +7039,23 @@ async function runModelADeploy(args) {
         surfaceStaleBlock(body, io);
         return 1;
       }
+      if (result.status === 409 && errorCode === "access_drift") {
+        io.err(`launchpad deploy: refused — ACCESS DRIFT on "${slug}".`);
+        const liveOnly = Array.isArray(body.live_only) ? body.live_only : [];
+        const manifestOnly = Array.isArray(body.manifest_only) ? body.manifest_only : [];
+        if (liveOnly.length > 0) {
+          io.err(`       enforced but NOT declared (over-grant): ${liveOnly.map(String).join(", ")}`);
+        }
+        if (manifestOnly.length > 0) {
+          io.err(`       declared but NOT enforced: ${manifestOnly.map(String).join(", ")}`);
+        }
+        io.err("");
+        io.err("       Your manifest's access groups don't match what the gateway enforces.");
+        io.err("       `launchpad deploy` ships content only and cannot change access — reconcile");
+        io.err("       via the gated TF route (see the access-change runbook), then redeploy.");
+        io.err("       Nothing was committed by this attempt.");
+        return 1;
+      }
       io.err(`launchpad deploy: bot rejected the upload (HTTP ${result.status}, ${errorCode}).`);
       if (typeof body.message === "string") {
         io.err(`       ${body.message}`);
@@ -6887,7 +7151,7 @@ async function runModelADeploy(args) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml6 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -6968,7 +7232,7 @@ function readLocalAppType(cwd, file) {
   if (!existsSync7(manifestPath))
     return null;
   try {
-    const obj = parseYaml6(readFileSync10(manifestPath, "utf8"));
+    const obj = parseYaml6(readFileSync11(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -7150,7 +7414,7 @@ async function runEnvvars(args, io) {
       io.err(`launchpad envvars: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad envvars failed: ${describe15(e)}`);
+    io.err(`launchpad envvars failed: ${describe16(e)}`);
     return 1;
   }
 }
@@ -7247,13 +7511,13 @@ function renderList(envVars, io) {
     io.out(fmt(row));
   }
 }
-function describe15(e) {
+function describe16(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/generate.ts
-import { mkdirSync, readFileSync as readFileSync11, writeFileSync } from "node:fs";
-import { dirname as dirname5, resolve as resolve8, relative as relative3 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname6, resolve as resolve8, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
   summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
@@ -7271,7 +7535,7 @@ async function runGenerate(args, io) {
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
-  const appRoot = dirname5(manifestPath);
+  const appRoot = dirname6(manifestPath);
   const wranglerPath = resolve8(appRoot, "container", "wrangler.toml");
   const workflowPath = resolve8(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
@@ -7315,8 +7579,8 @@ function applyOne(artefact, path10, out, force) {
     };
   }
   try {
-    mkdirSync(dirname5(path10), { recursive: true });
-    writeFileSync(path10, out.content, "utf8");
+    mkdirSync2(dirname6(path10), { recursive: true });
+    writeFileSync2(path10, out.content, "utf8");
     return {
       artefact,
       action: {
@@ -7340,7 +7604,7 @@ function applyOne(artefact, path10, out, force) {
 }
 function readIfExists(path10) {
   try {
-    return { kind: "ok", content: readFileSync11(path10, "utf8") };
+    return { kind: "ok", content: readFileSync12(path10, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -7550,110 +7814,6 @@ function parseFlags(args) {
   return { kind: "ok", file, dryRun, force, json };
 }
 
-// src/groups/client.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, join as join11 } from "node:path";
-var CACHE_TTL_MS = 60 * 60 * 1000;
-var CACHE_FILENAME = "groups.json";
-async function fetchGroups(cfg, opts = {}) {
-  const now = opts.now ?? Date.now;
-  const cachePath = join11(cfg.cacheDir, CACHE_FILENAME);
-  if (opts.forceRefresh !== true) {
-    const cached = readCache(cachePath);
-    if (cached !== null) {
-      const ageMs = now() - Date.parse(cached.fetchedAt);
-      if (Number.isFinite(ageMs) && ageMs >= 0 && ageMs < CACHE_TTL_MS) {
-        return {
-          kind: "ok",
-          source: "cache",
-          fetchedAt: cached.fetchedAt,
-          groups: cached.groups
-        };
-      }
-    }
-  }
-  let response;
-  try {
-    response = await apiJson(cfg, { path: "/groups" }, opts.fetcher);
-  } catch (e) {
-    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
-      throw e;
-    }
-    return { kind: "error", message: describe16(e) };
-  }
-  if (typeof response !== "object" || response === null || !Array.isArray(response.groups) || !response.groups.every(isEntraGroup)) {
-    return {
-      kind: "error",
-      message: "bot returned a malformed groups response"
-    };
-  }
-  const groups = response.groups;
-  const fetchedAt = new Date(now()).toISOString();
-  writeCache(cachePath, { fetchedAt, groups });
-  return { kind: "ok", source: "fresh", fetchedAt, groups };
-}
-function readCache(path10) {
-  let raw;
-  try {
-    raw = readFileSync12(path10, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null)
-    return null;
-  const p = parsed;
-  if (typeof p.fetchedAt !== "string")
-    return null;
-  if (!Array.isArray(p.groups))
-    return null;
-  for (const g of p.groups)
-    if (!isEntraGroup(g))
-      return null;
-  return p;
-}
-function isEntraGroup(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const g = value;
-  return typeof g.id === "string" && typeof g.displayName === "string" && (typeof g.mailNickname === "string" || g.mailNickname === null);
-}
-function writeCache(path10, envelope) {
-  try {
-    mkdirSync2(dirname6(path10), { recursive: true });
-    writeFileSync2(path10, JSON.stringify(envelope), "utf8");
-  } catch {}
-}
-function describe16(e) {
-  return e instanceof Error ? e.message : String(e);
-}
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isUuid(value) {
-  return UUID_PATTERN.test(value);
-}
-function findGroup(groups, nameOrId) {
-  if (isUuid(nameOrId)) {
-    const lower = nameOrId.toLowerCase();
-    const hit = groups.find((g) => g.id.toLowerCase() === lower);
-    return hit ? { kind: "found", group: hit } : { kind: "not-found" };
-  }
-  const matches = groups.filter((g) => g.displayName === nameOrId || g.mailNickname !== null && g.mailNickname === nameOrId);
-  if (matches.length === 0)
-    return { kind: "not-found" };
-  if (matches.length === 1)
-    return { kind: "found", group: matches[0] };
-  return { kind: "ambiguous", matches };
-}
-function searchGroups(groups, query) {
-  const q = query.toLowerCase();
-  return groups.filter((g) => g.displayName.toLowerCase().includes(q) || g.mailNickname !== null && g.mailNickname.toLowerCase().includes(q) || g.id.toLowerCase().includes(q));
-}
-
 // src/auth/jwt.ts
 class JwtParseError extends Error {
   code = "jwt_parse_error";
@@ -8071,7 +8231,7 @@ async function runResolve(args, io) {
     return 1;
   }
   io.out(hit.group.id);
-  if (!isUuid(key)) {
+  if (!isUuid2(key)) {
     io.err(`# resolved "${key}" → ${hit.group.displayName}`);
   }
   return 0;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AA+KD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/commands/status.d.ts

@@ -1,6 +1,6 @@
 import { type CliConfig } from "../config.js";
 import { type DeploymentStatusView, type StandingExceptionView } from "../deploy/deployment-status.js";
-import { type Manifest } from "@m-kopa/launchpad-engine";
+import { type Manifest, type AccessDrift } from "@m-kopa/launchpad-engine";
 import type { Command } from "../dispatcher.js";
 export declare const statusCommand: Command;
 interface StatusArgs {
@@ -78,6 +78,13 @@ export interface StatusJsonOutput {
      *  policy violations in content already live on managed main.
      *  Absent when the bot pre-dates the endpoint. */
     readonly standingExceptions?: readonly StandingExceptionView[];
+    /** PS-1755 / PS-1763 (T4): access drift between the LOCAL declared groups
+     *  (`access.allowed_entra_groups`) and the ENFORCED gateway-KV allow-list
+     *  the bot read from the app's TF. Distinct from the content-drift
+     *  `access.allowed_entra_groups` row (which is local-vs-deployed *manifest*):
+     *  this is "what I declare" vs "what the gateway actually enforces".
+     *  Absent when not a gateway-KV app (`enforcedGroups` null / old bot). */
+    readonly accessDrift?: AccessDrift;
 }
 /** Fetch the app's provisioning lifecycle (sp-st5hw9). Returns null when the
  *  bot doesn't recognise the slug OR predates the endpoint — BOTH surface as a

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAG5F,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAID;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;;;;;2EAMuE;OACrE,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAChE;AAED;;;8EAG8E;AAC9E,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAgSD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAkSD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CA2ErB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,WAAW,EAEjB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAID;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;;;;;2EAMuE;OACrE,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC/D;;;;;8EAK0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED;;;8EAG8E;AAC9E,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAkVD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAgUD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CA2ErB"}

package/dist/deploy/manifest-state.d.ts

@@ -9,6 +9,13 @@ export interface ManifestStateResponse {
         readonly url: string;
         readonly branch: string;
     } | null;
+    /** PS-1763 (T4): the ENFORCED gateway allow-list — the per-app
+     *  `<slug>_policy` KV `groups` array, as raw tokens (UUIDs +
+     *  `entra_groups.<Name>` refs) parsed from the app's TF source. `null` for
+     *  an app with no `<slug>_policy` block (a CF Access app / the gateway —
+     *  a different enforcement mechanism, out of scope for gateway-KV drift).
+     *  Older bots (pre-PS-1763) omit it → normalised to `null`. */
+    readonly enforcedGroups: readonly string[] | null;
     readonly manifestYaml?: string | null;
 }
 /** Fetch `/apps/<slug>/manifest/state`. With `includeManifest: true`,

package/dist/deploy/manifest-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-state.d.ts","sourceRoot":"","sources":["../../src/deploy/manifest-state.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAcD;;gCAEgC;AAChC,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,EACxC,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAehC"}
+{"version":3,"file":"manifest-state.d.ts","sourceRoot":"","sources":["../../src/deploy/manifest-state.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;mEAK+D;IAC/D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAeD;;gCAEgC;AAChC,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,EACxC,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAgBhC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.40.0";
+export declare const CLI_VERSION = "0.41.1";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.40.0",
+  "version": "0.41.1",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
@@ -49,6 +49,8 @@
     "test:watch": "vitest",
     "lint": "eslint src tests",
     "typecheck": "tsc --noEmit",
+    "typecheck:catalogue": "tsc -p channel/catalogue/tsconfig.json --noEmit",
+    "build:catalogue": "esbuild channel/catalogue/src/main.ts --bundle --format=esm --minify --target=es2020 --legal-comments=none --outfile=channel/catalogue/dist/app.js",
     "check:version-sync": "bash scripts/check-version-sync.sh",
     "check:runtime-deps": "node scripts/check-runtime-deps.mjs",
     "check:installer-syntax": "bash scripts/check-installer-syntax.sh",

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -185,7 +185,10 @@ launchpad plan
 
 Both are offline by default (no bot). `launchpad validate
 --strict-groups` opts in to an online check that resolves
-`access.allowed_entra_group` (needs a session).
+`access.allowed_entra_group` (needs a session). Note it resolves only
+against the groups **assigned** to the Launchpad enterprise app, so it
+falsely fails a valid *unassigned* tenant group — pre-check those with
+`launchpad deploy --dry-run` instead.
 
 ## Verify the deploy
 
@@ -248,6 +251,11 @@ Once you've shipped first content, the daily-use verbs are:
   currently-deployed `launchpad.yaml`.
 - **`launchpad deploy`** — bundle the working tree; the bot commits
   it directly to the app repo's `main`.
+- **`launchpad redeploy <slug>`** — re-run a Pages build of the
+  current commit *without* changing content. Use it to **activate a
+  secret you just pushed** (Cloudflare binds env only on a new build,
+  so `secrets push` alone won't take effect on a Pages tier) or to
+  force a clean rebuild. See `/commands/redeploy`.
 - **`launchpad envvars`** — list / set / remove non-secret
   production env vars.
 - **`launchpad secrets template`** — emit `.env.example` from the

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -130,6 +130,16 @@ This is interactive by default. It will ask for:
   layouts; the user overrides if needed.
 - **allowed_entra_groups** — one or more, comma-separated; see §A.3.
 
+By default the app is **listed in the app catalogue**
+(get.launchpad/catalogue — the employee-facing app directory). Listing
+is discovery only and grants no one access. To keep an internal-only
+app out of it, add to `launchpad.yaml`:
+
+```yaml
+catalogue:
+  listed: false
+```
+
 Non-interactive form for scripting:
 
 ```bash
@@ -185,20 +195,45 @@ The CLI resolves Entra groups via the bot's `/groups` endpoint
 endpoint directly. Two helpers:
 
 ```bash
-launchpad groups list                # every group assigned to the Launchpad app in Entra
+launchpad groups list                # groups ASSIGNED to the Launchpad app in Entra
 launchpad groups search <query>      # fuzzy match by name / nickname / id
 launchpad groups show <name>         # UUID + displayName + mailNickname
 launchpad groups resolve <name>      # just the Entra Object-ID UUID (script-friendly)
 ```
 
-`groups list` is **not** the whole tenant and not caller-scoped: it
-lists the groups **assigned to the Launchpad enterprise application**
-in Entra — the only groups that can actually grant sign-in to a
-deployed app.
+**Important — `groups` only sees the *assigned* set.** All four
+helpers (and `launchpad validate --strict-groups`, §A.4) list only the
+groups **assigned to the Launchpad enterprise application** in Entra.
+That is a discovery convenience, **not** the set of usable groups.
+Since PS-1733 (live 2026-06-25) an app can be gated on **any group in
+the tenant** — the group does **not** have to be assigned to the
+Launchpad app first. So if the user wants a group that does not appear
+in `groups list` (e.g. `G_information_security`), that is **fine**:
+pass it anyway, by display name or UUID. Do **not** tell the user to
+ask IT to assign the group to the enterprise app — that requirement
+was retired.
 
 When the user picks a group, pass either the **displayName** or the
 **UUID** to `launchpad init --group <…>` — the CLI accepts both and
-the bot canonicalises to the UUID.
+the bot canonicalises to the UUID. Prefer the **UUID** for a group
+that is not in `groups list`, or whenever a display name could be
+ambiguous.
+
+A group reference is rejected at deploy only when it is **unknown** (no
+such group anywhere in the tenant), **ineligible** (a pure distribution
+list, or a hidden-membership group the platform cannot evaluate), or an
+**ambiguous** display name (use the UUID). An unassigned-but-valid
+group is accepted. Members who do not carry the group as a token claim
+are authorised at runtime via a Microsoft Graph membership check
+(employees only — guests are refused).
+
+**Pre-checking a group reference.** Because `groups` and
+`--strict-groups` are assigned-only, they **falsely reject** a valid
+unassigned group. To pre-check any tenant group without mutating
+anything, run `launchpad deploy --dry-run` — it resolves against the
+whole tenant exactly as the real submit does. Treat `--dry-run` (not
+`--strict-groups`) as the source of truth for "will this group
+resolve?".
 
 If `launchpad groups list` fails with:
 
@@ -212,9 +247,10 @@ If `launchpad groups list` fails with:
   `appRoleAssignedTo` assignment list (missing admin consent on the
   Graph application permission), or Graph is unreachable. Surface
   the error body.
-- empty list → no groups are assigned to the Launchpad enterprise
-  app in Entra. A group must be **assigned to the app** before it
-  can gate anything — membership alone is not enough.
+- empty list → no groups are **assigned** to the Launchpad app. This
+  does **not** block you — an unassigned tenant group can still be
+  used by name or UUID (above); the assigned set is just a discovery
+  shortlist.
 
 Use `launchpad groups whoami` to remind the user which groups
 **they** are currently a member of — handy when an app is gated and
@@ -234,7 +270,10 @@ Add `--strict-groups` to *additionally* resolve the manifest's
 allowed Entra group online against the bot's group list — it catches
 typo'd or renamed group names before deploy time. This mode needs a
 session and the network (exit 1 = group not found / ambiguous,
-2 = network error, 3 = no valid session).
+2 = network error, 3 = no valid session). **Caveat:** it checks only
+the **assigned** set, so it will falsely fail a valid *unassigned*
+tenant group — for those, pre-check with `launchpad deploy --dry-run`
+instead (see §A.3).
 
 ```bash
 launchpad plan

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.40.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -336,6 +336,15 @@ Group binding changed in your local manifest. This is the
 `allowed-groups-change: true` label from a non-author human reviewer
 (AC-S4) before it can auto-merge.
 
+Reconcile it with **`launchpad deploy --apply`** — a plain
+`launchpad deploy` ships content only and does **not** re-apply the
+gateway's access policy. On a gateway app where enforcement is on, the
+bot **refuses** a content deploy while the manifest's groups diverge
+from what the gateway actually enforces (so access changes can't be
+silently dropped); `--apply` is the gated route that reconciles the
+enforced KV allow-list to the manifest. `launchpad status --strict`
+exits non-zero on any drift, so it can gate CI.
+
 ## Related skills
 
 - **`/launchpad-deploy`** — provision a new app (`launchpad init`