@m-kopa/launchpad-cli 0.44.0 → 0.46.0

package/CHANGELOG.md

@@ -6,6 +6,54 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.46.0 — 2026-07-07
+
+**Honest apply status (sp-k9kw8d).** `launchpad deploy --apply` no longer
+declares success off the merged file - the verdict is now your app's own
+`terraform apply` run:
+
+- **Four visible states while polling.** `waiting-approval` (the bot PR is
+  open - access-bearing changes need the `allowed-groups-change: true` label
+  from someone other than the PR author), `pending` (merged, apply running),
+  `applied`, and `failed`. A failed apply exits non-zero and prints the
+  failing run's URL - previously the CLI could print `✓ Applied` while the
+  apply was failing (the 2026-07-07 people-analytics-v2 incident).
+- **Per-app verdict, not workflow-level.** For per-app-workspace apps the CLI
+  reads the app's own `terraform apply (<slug>)` check run, so a sibling
+  app's failure in the same matrix never taints your result.
+- **Old-bot fallback.** Against a bot that predates the new endpoint the CLI
+  falls back to the previous coarse poll, with a notice.
+- **Access drift now has a self-serve fix.** The `ACCESS DRIFT` refusal from
+  `launchpad deploy` (and the drift warning in `launchpad status`) now point
+  at `launchpad deploy --apply` as the reconcile path, replacing the manual
+  runbook detour. The apply route dispatches on the app's provisioning world
+  server-side, so per-app-workspace apps get their workspace regenerated -
+  never the legacy flat pair that poisoned shared-root applies.
+
+## 0.45.0 — 2026-07-05
+
+**Self-serve recovery of a build-failed app (PS-1934).** An app stuck in a
+`failed` lifecycle because of a build bug now recovers through the normal
+`launchpad deploy` flow — no break-glass, no separate `launchpad recover`:
+
+- **Auto-reconcile `failed → live`.** Once your fixing deploy's Cloudflare
+  Pages build is **verified serving**, the platform flips the record back to
+  `live` on the next `launchpad status` / `launchpad watch` read (which
+  `deploy` runs for you). `status` surfaces a `✓ recovered:` line so the
+  repair is visible, not silent. Scoped to **build** failures only — a
+  security-verdict `failed` (origin reachable without auth) is never
+  auto-cleared by a green build.
+- **Honest failed-app deploy UX.** An empty-delta deploy to a `failed` app now
+  says so plainly (`slug_failed`) and points at the fix path, instead of an
+  opaque 409.
+- **`recover` stays** as the explicit reconcile-only path; the docs now
+  cross-reference the broken-CI case (PS-1932), where `launchpad deploy` (bot
+  bypass) is the supported recovery.
+
+Platform-side (ships with the bot): the `redeploy` path now re-ensures the
+D1 binding like `deploy` does, so a redeploy-based recovery can't leave the
+database unbound (the stock-dispatch-tracker 500 root cause).
+
 ## 0.44.0 — 2026-07-05
 
 **Identity guide crystal-clarity — fixes the "gateway signs me in but the app

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.44.0";
+var CLI_VERSION = "0.46.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -3763,7 +3763,8 @@ async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
     slug: typeof raw.slug === "string" ? raw.slug : slug,
     supported: raw.supported,
     liveDeployment: raw.liveDeployment ?? null,
-    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null
+    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null,
+    ...raw.reconciledToLive === true ? { reconciledToLive: true } : {}
   };
 }
 
@@ -5121,7 +5122,8 @@ function surfaceAccessDrift(out, io) {
   for (const u of ad.unresolved) {
     io.out(`    unresolved group (${u.side}): ${u.token}`);
   }
-  io.out("    `launchpad deploy` will NOT fix this — access changes go via the gated TF route.");
+  io.out("    `launchpad deploy` will NOT fix this — run `launchpad deploy --apply` to");
+  io.out("    reconcile access through the gated TF route (sp-k9kw8d).");
 }
 function surfaceNoLocalManifestNote(out, io) {
   if (out.drift !== null)
@@ -5139,6 +5141,9 @@ function surfaceDeployment(out, io) {
   const dep = out.deployment;
   if (dep === undefined || dep === null || !dep.supported)
     return;
+  if (dep.reconciledToLive === true) {
+    io.out("  ✓ recovered: this app was in a failed state; its verified-live build reconciled the record failed→live (no `launchpad recover` needed).");
+  }
   const live = dep.liveDeployment;
   if (live === null) {
     io.out("  last deployment: none — Cloudflare Pages has no production deployment yet.");
@@ -6254,7 +6259,7 @@ async function runDeployApply(opts, io, deps = {}) {
       timeoutMs
     });
     if (outcome2.kind !== "applied")
-      return outcomeToExit(outcome2);
+      return outcomeToExit(outcome2, undefined, io);
     deletePinIfPresent(cfg, slug2, io);
     io.out(`✓ Applied ${slug2}.`);
     return 0;
@@ -6335,7 +6340,7 @@ async function runDeployApply(opts, io, deps = {}) {
     timeoutMs
   });
   if (outcome.kind !== "applied")
-    return outcomeToExit(outcome, apply.prUrl);
+    return outcomeToExit(outcome, apply.prUrl, io);
   deletePinIfPresent(cfg, slug, io);
   io.out("");
   io.out(`✓ Applied ${slug}. (See ${apply.prUrl} for the merged PR.)`);
@@ -6343,36 +6348,83 @@ async function runDeployApply(opts, io, deps = {}) {
 }
 async function pollUntilApplied(args) {
   const start = Date.now();
-  let lastPrSeen = true;
   let dotsThisLine = 0;
-  while (Date.now() - start < args.timeoutMs) {
-    let state;
-    try {
-      state = await apiJson(args.cfg, {
-        method: "GET",
-        path: `/apps/${args.slug}/manifest/state`
-      }, args.fetcher);
-    } catch (e) {
-      args.io.err(`! state fetch failed (will retry): ${describe13(e)}`);
-      await sleep(args.pollIntervalSec * 1000);
-      continue;
-    }
-    const prGone = state.openPr === null || state.openPr.number !== args.prNumber;
-    const shaMatches2 = args.manifestSha === null ? state.hasAppFile && state.lastAppliedManifestSha !== null : state.lastAppliedManifestSha === args.manifestSha;
-    if (prGone && shaMatches2) {
-      if (dotsThisLine > 0)
-        args.io.out("");
-      return { kind: "applied" };
+  let mode = args.manifestSha === null ? "legacy" : "status";
+  let lastRendered = null;
+  let lastPrSeen = true;
+  const breakDots = () => {
+    if (dotsThisLine > 0) {
+      args.io.out("");
+      dotsThisLine = 0;
     }
-    if (prGone && !shaMatches2 && lastPrSeen) {
-      if (dotsThisLine > 0)
-        args.io.out("");
-      return {
-        kind: "failed",
-        reason: "the bot PR closed without applying this manifest sha (was it rejected or superseded?)"
-      };
+  };
+  while (Date.now() - start < args.timeoutMs) {
+    if (mode === "status") {
+      let status;
+      try {
+        status = await apiJson(args.cfg, {
+          method: "GET",
+          path: `/apps/${args.slug}/manifest/apply-status?manifestSha=${args.manifestSha}`
+        }, args.fetcher);
+      } catch (e) {
+        if (e instanceof NotFoundError) {
+          breakDots();
+          args.io.err("! bot has no apply-status endpoint yet — falling back to the coarse merge-poll (upgrade pending bot deploy)");
+          mode = "legacy";
+          continue;
+        }
+        args.io.err(`! apply-status fetch failed (will retry): ${describe13(e)}`);
+        await sleep(args.pollIntervalSec * 1000);
+        continue;
+      }
+      if (status.state === "applied") {
+        breakDots();
+        return { kind: "applied" };
+      }
+      if (status.state === "failed") {
+        breakDots();
+        return {
+          kind: "failed",
+          reason: status.detail ?? "the apply run failed",
+          runUrl: status.runUrl ?? null
+        };
+      }
+      if (status.state !== lastRendered) {
+        breakDots();
+        if (status.state === "waiting-approval") {
+          args.io.out(`⏳ waiting for approval/CI — access-bearing changes need the 'allowed-groups-change: true' label from someone other than the PR author (${status.prUrl})`);
+        } else {
+          args.io.out(`⚙ PR merged — waiting for the app's terraform apply${status.checkName !== undefined ? ` ('${status.checkName}')` : ""} …`);
+        }
+        lastRendered = status.state;
+      }
+    } else {
+      let state;
+      try {
+        state = await apiJson(args.cfg, {
+          method: "GET",
+          path: `/apps/${args.slug}/manifest/state`
+        }, args.fetcher);
+      } catch (e) {
+        args.io.err(`! state fetch failed (will retry): ${describe13(e)}`);
+        await sleep(args.pollIntervalSec * 1000);
+        continue;
+      }
+      const prGone = state.openPr === null || state.openPr.number !== args.prNumber;
+      const shaMatches2 = args.manifestSha === null ? state.hasAppFile && state.lastAppliedManifestSha !== null : state.lastAppliedManifestSha === args.manifestSha;
+      if (prGone && shaMatches2) {
+        breakDots();
+        return { kind: "applied" };
+      }
+      if (prGone && !shaMatches2 && lastPrSeen) {
+        breakDots();
+        return {
+          kind: "failed",
+          reason: "the bot PR closed without applying this manifest sha (was it rejected or superseded?)"
+        };
+      }
+      lastPrSeen = state.openPr !== null;
     }
-    lastPrSeen = state.openPr !== null;
     process.stdout.write(".");
     dotsThisLine++;
     if (dotsThisLine >= 60) {
@@ -6385,15 +6437,29 @@ async function pollUntilApplied(args) {
     args.io.out("");
   return { kind: "timed-out" };
 }
-function outcomeToExit(outcome, prUrl) {
+function outcomeToExit(outcome, prUrl, io) {
+  const err = (line) => {
+    if (io !== undefined) {
+      io.err(line);
+    } else {
+      console.error(line);
+    }
+  };
   switch (outcome.kind) {
     case "applied":
       return 0;
     case "failed":
+      err(`✗ Apply FAILED: ${outcome.reason}`);
+      if (outcome.runUrl !== undefined && outcome.runUrl !== null) {
+        err(`  Failing run: ${outcome.runUrl}`);
+      }
+      if (prUrl !== undefined) {
+        err(`  PR: ${prUrl}`);
+      }
       return 1;
     case "timed-out":
       if (prUrl !== undefined) {
-        console.error(`! timed out waiting for apply — check ${prUrl} for live status.`);
+        err(`! timed out waiting for apply — check ${prUrl} for live status.`);
       }
       return 4;
     case "transport":
@@ -7137,7 +7203,7 @@ function surfaceDeployExtras(body, io, slug, allowStale = false) {
     if (adw.manifestOnly !== undefined && adw.manifestOnly.length > 0) {
       io.err(`         declared but NOT enforced: ${adw.manifestOnly.join(", ")}`);
     }
-    io.err(`         reconcile access via the gated TF route — \`launchpad deploy\` can't (it ships content only).`);
+    io.err(`         reconcile with \`launchpad deploy --apply\` (the gated TF route) — \`launchpad deploy\` can't (it ships content only).`);
   }
 }
 function isStaleBlock(body) {
@@ -7319,6 +7385,14 @@ async function runModelADeploy(args) {
         }
         return 1;
       }
+      if (result.status === 409 && errorCode === "slug_failed") {
+        io.err(`launchpad deploy: app "${slug}" is in a FAILED state, and this deploy adds no new content (nothing to re-drive the build).`);
+        if (typeof body.message === "string") {
+          io.err(`       ${body.message}`);
+        }
+        io.err(`       Deploy a content change to re-drive the build (it reconciles failed→live automatically once verified serving — watch \`launchpad status ${slug}\`), or \`launchpad deploy --resume ${slug}\`.`);
+        return 1;
+      }
       if (result.status === 409 && isStaleBlock(body)) {
         surfaceStaleBlock(body, io);
         return 1;
@@ -7335,8 +7409,10 @@ async function runModelADeploy(args) {
         }
         io.err("");
         io.err("       Your manifest's access groups don't match what the gateway enforces.");
-        io.err("       `launchpad deploy` ships content only and cannot change access — reconcile");
-        io.err("       via the gated TF route (see the access-change runbook), then redeploy.");
+        io.err("       `launchpad deploy` ships content only and cannot change access.");
+        io.err("       Run `launchpad deploy --apply` to reconcile — it opens the gated TF PR");
+        io.err("       (access-widening changes need the allowed-groups-change label from a");
+        io.err("       second person), waits for the apply verdict, then redeploy your content.");
         io.err("       Nothing was committed by this attempt.");
         return 1;
       }

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,WAAW,EAEjB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAID;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;;;;;2EAMuE;OACrE,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC/D;;;;;8EAK0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED;;;8EAG8E;AAC9E,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAkVD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AAgUD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CA2ErB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AASxC,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,WAAW,EAEjB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAID;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EACV,cAAc,GACd,qBAAqB,GACrB,iBAAiB;IACnB;;wDAEoD;OAClD,wBAAwB,GACxB,SAAS,GACT,OAAO;IACT;;;;;;2EAMuE;OACrE,oBAAoB,GACpB,sBAAsB,GACtB,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH;;;wCAGoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;sDAEkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC/D;;;;;8EAK0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED;;;8EAG8E;AAC9E,wBAAsB,cAAc,CAClC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAkVD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,QAAQ,GACjB,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA2DpE;AA0UD;0BAC0B;AAC1B,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,UAAU,GAAG,MAAM,CA2ErB"}

package/dist/deploy/deployment-status.d.ts

@@ -26,6 +26,11 @@ export interface DeploymentStatusView {
         readonly createdOn: string;
         readonly url: string | null;
     } | null;
+    /** PS-1934 AC1 — true when THIS read auto-reconciled a build-failed app
+     *  back to `live` (its latest build is verified serving). Lets `status` /
+     *  `watch` / the post-deploy verify surface "record reconciled failed→live"
+     *  rather than the repair happening silently. */
+    readonly reconciledToLive?: boolean;
 }
 /** One standing-exception inventory entry (sp-devlp1 T3 / D2) — a
  *  policy/boundary/build-command violation observed in content already

package/dist/deploy/deployment-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-status.d.ts","sourceRoot":"","sources":["../../src/deploy/deployment-status.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,GAAG,SAAS,CAAC;AAC/D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,QAAQ,CAAC,wBAAwB,EAAE;QACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,IAAI,CAAC;CACV;AAED;;;wEAGwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAsBlD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuBtC"}
+{"version":3,"file":"deployment-status.d.ts","sourceRoot":"","sources":["../../src/deploy/deployment-status.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,GAAG,SAAS,CAAC;AAC/D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,QAAQ,CAAC,wBAAwB,EAAE;QACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,IAAI,CAAC;IACT;;;qDAGiD;IACjD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;wEAGwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAsBlD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAwBtC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.44.0";
+export declare const CLI_VERSION = "0.46.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.44.0",
-  "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
+  "version": "0.46.0",
+  "description": "Launchpad CLI \u2014 clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
     "launchpad": "./dist/cli.js"

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.44.0
+version: 0.46.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->