@m-kopa/launchpad-cli 0.42.0 → 0.43.0

package/CHANGELOG.md

@@ -6,6 +6,29 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.43.0 — 2026-07-05
+
+**`launchpad deploy` now shows a pre-deploy config diff (PS-1920).** Before a
+content deploy sends your bundle, the CLI prints a git-style, key-level diff of
+how your local `launchpad.yaml` differs from the **currently deployed**
+manifest — added / removed / changed keys, with `old → new` for changed
+scalars — so a config change (intended or accidental) is visible up front. When
+your manifest already matches what's deployed, it says so in one line.
+
+- **Advisory only:** the diff never prompts, never blocks, and never changes the
+  deploy's exit code — a manifest edit is usually intentional. The commit
+  lost-update guard (stale-clone) and the declared-vs-enforced ACCESS DRIFT
+  warning are unchanged and stay separate; this covers the manifest-config axis
+  neither did.
+- **Secret-safe:** values under secret-shaped keys (env-var values, tokens) are
+  masked, never printed. Redaction is applied before the diff is computed.
+- **Fail-open:** if the deployed manifest can't be read (older bot, first deploy
+  with nothing deployed yet, transient error) the check prints a one-line
+  "skipping" note and the deploy proceeds unchanged.
+- **In-sync check is semantic:** key order, comments, whitespace, and the
+  singular-vs-plural access-group form don't register as changes; group lists
+  diff by set membership.
+
 ## 0.42.0 — 2026-06-30
 
 **`launchpad validate --strict-groups` and `launchpad groups resolve`/`show`

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.42.0";
+var CLI_VERSION = "0.43.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -5562,7 +5562,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 }
 
 // src/commands/deploy.ts
-import { parse as parseYaml5 } from "yaml";
+import { parse as parseYaml6 } from "yaml";
 import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/deploy/git-files.ts
@@ -5619,6 +5619,178 @@ function runGit2(sp, cwd, args) {
   });
 }
 
+// src/deploy/manifest-diff.ts
+import { parse as parseYaml4 } from "yaml";
+var MASK = "«redacted»";
+var SECRET_KEY_SEGMENT = /(secret|token|api[_-]?key|access[_-]?key|private[_-]?key|secret[_-]?key|password|passwd|pwd|authorization|auth[_-]?token|bearer|client[_-]?secret|session|credential|value)/i;
+function isSecretPath(path8) {
+  const last2 = path8.split(".").pop() ?? path8;
+  return SECRET_KEY_SEGMENT.test(last2);
+}
+function normalize(v) {
+  if (Array.isArray(v)) {
+    const items = v.map(normalize);
+    const allScalar = items.every((x) => x === null || typeof x !== "object");
+    return allScalar ? [...items].sort((a, b) => String(a).localeCompare(String(b))) : items;
+  }
+  if (v !== null && typeof v === "object") {
+    const obj = v;
+    const out = {};
+    for (const [k, val] of Object.entries(obj)) {
+      if (k === "allowed_entra_group" && typeof val === "string") {
+        out.allowed_entra_groups = normalize([val]);
+      } else {
+        out[k] = normalize(val);
+      }
+    }
+    return out;
+  }
+  return v;
+}
+function stableStringify(v) {
+  if (Array.isArray(v))
+    return `[${v.map(stableStringify).join(",")}]`;
+  if (v !== null && typeof v === "object") {
+    const obj = v;
+    return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(v ?? null);
+}
+function isScalarSet(v) {
+  return typeof v === "object" && v !== null && "__set" in v;
+}
+function flatten(v, prefix, out) {
+  if (Array.isArray(v)) {
+    if (v.length === 0) {
+      out.set(prefix, "[]");
+      return;
+    }
+    const allScalar = v.every((x) => x === null || typeof x !== "object");
+    if (allScalar) {
+      out.set(prefix, { __set: v.map((x) => String(x)) });
+      return;
+    }
+    v.forEach((item, i) => flatten(item, prefix === "" ? String(i) : `${prefix}.${i}`, out));
+    return;
+  }
+  if (v !== null && typeof v === "object") {
+    const entries = Object.entries(v);
+    if (entries.length === 0) {
+      out.set(prefix, "{}");
+      return;
+    }
+    for (const [k, val] of entries) {
+      flatten(val, prefix === "" ? k : `${prefix}.${k}`, out);
+    }
+    return;
+  }
+  out.set(prefix, v);
+}
+function renderValue(path8, value) {
+  if (isSecretPath(path8))
+    return MASK;
+  if (value === null)
+    return "null";
+  const raw = isScalarSet(value) ? renderScalar(value) : String(value);
+  const scrubbed = redactDiagnostic(raw, 120);
+  return scrubbed === "" ? MASK : scrubbed;
+}
+function renderScalar(value) {
+  return isScalarSet(value) ? `[${[...value.__set].sort().join(",")}]` : String(value);
+}
+function pushSideChange(changes, path8, kind, value) {
+  if (isScalarSet(value)) {
+    for (const m of value.__set) {
+      changes.push(kind === "added" ? { path: `${path8}[]`, kind, after: renderValue(path8, m) } : { path: `${path8}[]`, kind, before: renderValue(path8, m) });
+    }
+    return;
+  }
+  changes.push(kind === "added" ? { path: path8, kind, after: renderValue(path8, value) } : { path: path8, kind, before: renderValue(path8, value) });
+}
+function diffManifests(localYaml, deployedYaml) {
+  let local;
+  let deployed;
+  try {
+    local = normalize(parseYaml4(localYaml));
+  } catch (e) {
+    return {
+      inSync: false,
+      changes: [],
+      parseError: `local launchpad.yaml did not parse: ${e.message}`
+    };
+  }
+  try {
+    deployed = normalize(parseYaml4(deployedYaml));
+  } catch (e) {
+    return {
+      inSync: false,
+      changes: [],
+      parseError: `deployed manifest did not parse: ${e.message}`
+    };
+  }
+  if (stableStringify(local) === stableStringify(deployed)) {
+    return { inSync: true, changes: [], parseError: null };
+  }
+  const localFlat = new Map;
+  const deployedFlat = new Map;
+  flatten(local, "", localFlat);
+  flatten(deployed, "", deployedFlat);
+  const paths = [
+    ...new Set([...localFlat.keys(), ...deployedFlat.keys()])
+  ].sort();
+  const changes = [];
+  for (const p of paths) {
+    const hasLocal = localFlat.has(p);
+    const hasDeployed = deployedFlat.has(p);
+    const localVal = localFlat.get(p);
+    const deployedVal = deployedFlat.get(p);
+    if (isScalarSet(localVal) && isScalarSet(deployedVal)) {
+      const local2 = new Set(localVal.__set);
+      const deployed2 = new Set(deployedVal.__set);
+      for (const m of localVal.__set) {
+        if (!deployed2.has(m)) {
+          changes.push({ path: `${p}[]`, kind: "added", after: renderValue(p, m) });
+        }
+      }
+      for (const m of deployedVal.__set) {
+        if (!local2.has(m)) {
+          changes.push({ path: `${p}[]`, kind: "removed", before: renderValue(p, m) });
+        }
+      }
+      continue;
+    }
+    if (hasLocal && !hasDeployed) {
+      pushSideChange(changes, p, "added", localVal);
+    } else if (!hasLocal && hasDeployed) {
+      pushSideChange(changes, p, "removed", deployedVal);
+    } else if (renderScalar(localVal) !== renderScalar(deployedVal)) {
+      changes.push({
+        path: p,
+        kind: "changed",
+        before: renderValue(p, deployedVal),
+        after: renderValue(p, localVal)
+      });
+    }
+  }
+  return { inSync: false, changes, parseError: null };
+}
+function renderManifestDiffLines(diff, max = 20) {
+  const lines = [];
+  for (const c of diff.changes.slice(0, max)) {
+    if (c.kind === "added") {
+      lines.push(`    + ${c.path}: ${c.after}`);
+    } else if (c.kind === "removed") {
+      lines.push(`    - ${c.path}: ${c.before}`);
+    } else {
+      lines.push(`    ~ ${c.path}: ${c.before} → ${c.after}`);
+    }
+  }
+  if (diff.changes.length > max) {
+    lines.push(`    … and ${diff.changes.length - max} more`);
+  }
+  return lines;
+}
+
 // src/commands/deploy-flags.ts
 var SLUG_RE4 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var GROUP_KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -6008,7 +6180,7 @@ import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
 import { readFileSync as readFileSync9 } from "node:fs";
-import { parse as parseYaml4, YAMLParseError } from "yaml";
+import { parse as parseYaml5, YAMLParseError } from "yaml";
 function loadManifest(path8) {
   let raw;
   try {
@@ -6025,7 +6197,7 @@ function loadManifest(path8) {
 function parseManifest2(yamlText, path8) {
   let parsed;
   try {
-    parsed = parseYaml4(yamlText);
+    parsed = parseYaml5(yamlText);
   } catch (err) {
     const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
     return { kind: "yaml-parse-error", path: path8, message };
@@ -6557,12 +6729,25 @@ async function runResume(slug, io) {
         io.err(`launchpad deploy --resume: workflow at stage "${body.currentStage}" is not resumable. ${body.message}`);
         return exitCodeForStage(body.currentStage);
       }
+      if (body !== null && body.error === "not_refirable") {
+        io.err(`launchpad deploy --resume: ${body.message}`);
+        return 1;
+      }
+      const msg = body?.message;
+      if (typeof msg === "string" && msg.length > 0) {
+        io.err(`launchpad deploy --resume: ${msg}`);
+        return 1;
+      }
       io.err(`launchpad deploy --resume: bot returned 409 without parseable body`);
       return 1;
     }
     const parsed = await res.json();
-    if (parsed.refiring === true) {
-      io.out(`Workflow may resume from stage "${parsed.fromStage}" — next stage: "${parsed.nextStage}". Re-run \`launchpad deploy --resume ${slug}\` if the workflow doesn't pick up within a minute.`);
+    if (parsed.refiring === true && parsed.alreadyRunning === true) {
+      io.out(`A provisioning run for "${slug}" is already in flight — leaving it to finish. Watch \`launchpad status ${slug}\`.`);
+    } else if (parsed.refiring === true) {
+      const stageHint = parsed.fromStage !== undefined ? ` from stage "${parsed.fromStage}"` : "";
+      const viaHint = parsed.via !== undefined ? ` (${parsed.via})` : "";
+      io.out(`Re-driving provisioning for "${slug}"${stageHint}${viaHint}. Watch \`launchpad status ${slug}\`; every stage is idempotent, so it picks up where it left off.`);
     } else if (parsed.idempotent === true) {
       io.out(`Workflow already at \`done\` for "${slug}" — nothing to resume.`);
     } else {
@@ -6981,12 +7166,57 @@ function surfaceStaleBlock(body, io) {
     io.err(`         launchpad deploy --override-stale ${head.slice(0, 8)}`);
   }
 }
+var MANIFEST_DIFF_READ_TIMEOUT_MS = 5000;
+function withTimeout(p, ms) {
+  return new Promise((resolve8, reject) => {
+    const timer = setTimeout(() => reject(new Error(`manifest read timed out after ${ms}ms`)), ms);
+    p.then((v) => {
+      clearTimeout(timer);
+      resolve8(v);
+    }, (e) => {
+      clearTimeout(timer);
+      reject(e instanceof Error ? e : new Error(String(e)));
+    });
+  });
+}
+async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
+  let localYaml;
+  try {
+    localYaml = readFileSync10(manifestPath, "utf8");
+  } catch {
+    return;
+  }
+  let deployedYaml;
+  try {
+    const state = await withTimeout(fetchManifestState(cfg, slug, { includeManifest: true }), MANIFEST_DIFF_READ_TIMEOUT_MS);
+    deployedYaml = state.manifestYaml ?? null;
+  } catch {
+    io.out("  config diff: could not read the deployed manifest — skipping (does not affect this deploy).");
+    return;
+  }
+  if (deployedYaml === null || deployedYaml.trim() === "") {
+    io.out("  config diff: nothing deployed yet to compare against — skipping.");
+    return;
+  }
+  const diff = diffManifests(localYaml, deployedYaml);
+  if (diff.parseError !== null) {
+    io.out(`  config diff: skipped (${diff.parseError}).`);
+    return;
+  }
+  if (diff.inSync) {
+    io.out("  config: launchpad.yaml matches the deployed manifest (in sync).");
+    return;
+  }
+  io.out("  config diff — local launchpad.yaml vs the DEPLOYED manifest (this file, not gateway enforcement):");
+  for (const line of renderManifestDiffLines(diff))
+    io.out(line);
+}
 async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
   let appType = "static";
   try {
-    const manifestObj = parseYaml5(readFileSync10(manifestPath, "utf8"));
+    const manifestObj = parseYaml6(readFileSync10(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
@@ -7031,6 +7261,9 @@ async function runModelADeploy(args) {
     io.err(`launchpad deploy: ${describe15(e)}`);
     return 1;
   }
+  try {
+    await surfaceManifestDiff(cfg, slug, manifestPath, io);
+  } catch {}
   const deployBaseline = noVerify ? null : await readDeploymentBaseline(realCommitWaitDeps(cfg), slug);
   let result;
   try {
@@ -7204,7 +7437,7 @@ async function runModelADeploy(args) {
 // src/commands/redeploy.ts
 import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
-import { parse as parseYaml6 } from "yaml";
+import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var DEFAULT_VERIFY_TIMEOUT_MS = 180000;
 var redeployCommand = {
@@ -7283,7 +7516,7 @@ function readLocalAppType(cwd, file) {
   if (!existsSync7(manifestPath))
     return null;
   try {
-    const obj = parseYaml6(readFileSync11(manifestPath, "utf8"));
+    const obj = parseYaml7(readFileSync11(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -11230,7 +11463,7 @@ function renderManifestError5(result, io) {
 // src/secrets/set.ts
 import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
-import { parse as parseYaml7 } from "yaml";
+import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
   present: "PRESENT",
   missing: "MISSING",
@@ -11245,7 +11478,7 @@ function loadSet(fleetFile, setName, io) {
   }
   let obj;
   try {
-    obj = parseYaml7(readFileSync17(path13, "utf8"));
+    obj = parseYaml8(readFileSync17(path13, "utf8"));
   } catch (e) {
     io.err(`✗ ${path13}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);

package/dist/commands/deploy-modes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-modes.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-modes.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AA0B3C;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAwBnB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAwCnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE;IACJ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,EACD,EAAE,EAAE,KAAK;AACT;;;;;GAKG;AACH,aAAa,GAAE;IACb,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C,GACL,OAAO,CAAC,QAAQ,CAAC,CAmFnB"}
+{"version":3,"file":"deploy-modes.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-modes.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAwC3C;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAwBnB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiEnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE;IACJ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,EACD,EAAE,EAAE,KAAK;AACT;;;;;GAKG;AACH,aAAa,GAAE;IACb,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C,GACL,OAAO,CAAC,QAAQ,CAAC,CAmFnB"}

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAqEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/deploy/manifest-diff.d.ts

@@ -0,0 +1,30 @@
+export type ChangeKind = "added" | "removed" | "changed";
+export interface ManifestKeyChange {
+    /** Dotted key path, e.g. `access.allowed_entra_groups.0`. */
+    readonly path: string;
+    readonly kind: ChangeKind;
+    /** Redacted rendering of the DEPLOYED value (present for removed/changed). */
+    readonly before?: string;
+    /** Redacted rendering of the LOCAL value (present for added/changed). */
+    readonly after?: string;
+}
+export interface ManifestDiff {
+    /** True when the parsed + normalised documents are equal. */
+    readonly inSync: boolean;
+    readonly changes: readonly ManifestKeyChange[];
+    /** Set when a document could not be parsed as YAML — the caller fails open. */
+    readonly parseError: string | null;
+}
+/**
+ * Diff the local `launchpad.yaml` against the deployed manifest body. Both are
+ * raw YAML strings. On a parse failure of either side, returns `parseError` set
+ * and no changes — the caller treats that as "could not determine" and proceeds
+ * (fail open, AC4).
+ */
+export declare function diffManifests(localYaml: string, deployedYaml: string): ManifestDiff;
+/**
+ * Render the diff as terminal lines (added `+`, removed `-`, changed `~`),
+ * capped at `max` entries. Returns `[]` when there is nothing to show.
+ */
+export declare function renderManifestDiffLines(diff: ManifestDiff, max?: number): string[];
+//# sourceMappingURL=manifest-diff.d.ts.map

package/dist/deploy/manifest-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-diff.d.ts","sourceRoot":"","sources":["../../src/deploy/manifest-diff.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAiJD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,YAAY,CAyEd;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,YAAY,EAClB,GAAG,SAAK,GACP,MAAM,EAAE,CAeV"}

package/dist/deploy/status-polling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status-polling.d.ts","sourceRoot":"","sources":["../../src/deploy/status-polling.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAKD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CA8B5E"}
+{"version":3,"file":"status-polling.d.ts","sourceRoot":"","sources":["../../src/deploy/status-polling.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAKD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B5E"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.42.0";
+export declare const CLI_VERSION = "0.43.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.42.0
+version: 0.43.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->