@m-kopa/launchpad-cli 0.47.1 → 0.48.0

package/CHANGELOG.md

@@ -6,6 +6,50 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.48.0 — 2026-07-08
+
+**One-command access reconcile — `launchpad deploy` now applies access changes
+automatically (PS-2117 / ADR 0034).** Plain `launchpad deploy` reconciles both
+content and access in one command: when it detects that your manifest's
+`allowed_entra_groups` differ from what the gateway enforces, it no longer
+stops at a message or asks — it routes straight into the gated apply flow
+(opens the bot's `[launchpad] apply <slug>` PR, which auto-merges on its
+non-bypassable automated checks). No `--apply` verb, no y/N prompt, no human
+approval. This supersedes the 0.47 interactive inline offer (PS-2071); `--apply`
+remains a **hidden alias for one release** and will be removed.
+
+The platform no longer **blocks** an access change — it is self-serve and
+owner-accountable (ADR 0034). A *dangerous* shape (a widening on a `sensitive`
+app, or a broad-group grant like `S_ALL_Employees`) fires an **after-the-fact,
+non-blocking** Product Security alert instead. The former two-person
+`allowed-groups-change` label gate is **retired**; the byte-equal validator +
+per-app `tf plan` are the non-bypassable trust root.
+
+New: `launchpad.yaml` supports a self-declared `sensitive: true` flag (drives
+the alert). To revert a bad access change fast, `launchpad rollback <prior-sha>`
+re-applies the previous manifest through the same gated flow. The honest-exit
+behaviour from 0.47.1 is preserved (a non-applied reconcile never reports
+success).
+
+## 0.47.2 — 2026-07-08
+
+**Fix: `launchpad deploy` no longer leaves you falsely "stale" after your own
+deploys (PS-2119).** The clone staleness guard compares `.launchpad/base-sha`
+against managed `main` head, but the marker only ever advanced on
+`--rebase-onto-head` — a normal deploy left it frozen at clone time. So each
+deploy you made moved `main` forward while your marker stayed put, and the next
+deploy re-warned "a teammate may have shipped changes you don't have" (and could
+BLOCK), when the only "teammate" was your own prior commits. `launchpad deploy`
+now re-pins the marker after a successful deploy — to the new commit (committed)
+or to managed main head (nothing-to-deploy). It only re-stamps a marker that
+already exists (a git-less `launchpad init` tree gains nothing), and a stamp
+failure never fails the deploy. If you were stuck on this, a single
+`launchpad update` + `launchpad deploy` clears it — no re-clone.
+
+(Companion bot-side fix PS-2120, shipped separately: co-owners were wrongly 403'd
+by `launchpad status` / hidden from `launchpad apps` on their own apps — several
+read endpoints resolved the role without `coOwners`. Now co-owner-aware.)
+
 ## 0.47.1 — 2026-07-08
 
 **Fix: no false-success exit code when the inline access-drift apply is aborted

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.47.1";
+var CLI_VERSION = "0.48.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -2225,7 +2225,8 @@ var ManifestSchema = z.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z.boolean().optional(),
-  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional()
+  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional(),
+  sensitive: z.boolean().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
   if (m.confine_origin !== undefined) {
@@ -2842,6 +2843,7 @@ var SpecSchema = z2.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z2.boolean().optional(),
+  sensitive: z2.boolean().optional(),
   catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
   env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
   containers: z2.array(ContainerSchema).min(1).optional(),
@@ -3396,6 +3398,9 @@ var CF_ACCOUNT_ID = "c07cb17c9f742e8144c4828b3693ca65";
 var R2_S3_ENDPOINT = `https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com`;
 // ../launchpad-engine/dist/access-drift.js
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(s) {
+  return UUID_RE.test(s.trim());
+}
 function canonicalUuid(s) {
   const t = s.trim();
   return UUID_RE.test(t) ? t.toLowerCase() : null;
@@ -3430,6 +3435,29 @@ function detectAccessDrift(declaredTokens, enforcedTokens, resolve6) {
     inSync: manifestOnly.length === 0 && liveOnly.length === 0 && unresolved.length === 0
   };
 }
+// ../launchpad-engine/dist/broad-groups.js
+var BROAD_GROUPS = [
+  {
+    uuid: "caf78902-35dd-4833-88ce-8f067eda6036",
+    name: "S_ALL_Employees",
+    note: "All employees — the broadest grant on the tenant; assigned to the Launchpad enterprise app. Granting this reaches the entire company."
+  }
+];
+function assertBroadGroupsWellFormed(list = BROAD_GROUPS) {
+  const seen = new Set;
+  for (const g of list) {
+    const key = canonicalUuid(g.uuid);
+    if (key === null || !isUuid(g.uuid)) {
+      throw new Error(`broad-groups: entry '${g.name}' has a malformed UUID: '${g.uuid}'`);
+    }
+    if (seen.has(key)) {
+      throw new Error(`broad-groups: duplicate UUID for '${g.name}': '${g.uuid}'`);
+    }
+    seen.add(key);
+  }
+}
+assertBroadGroupsWellFormed();
+var BROAD_UUIDS = new Set(BROAD_GROUPS.map((g) => canonicalUuid(g.uuid)).filter((u) => u !== null));
 // ../launchpad-engine/dist/fleet-manifest.js
 import { z as z3 } from "zod";
 var UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -6561,54 +6589,28 @@ function renderManifestError(loaded, io) {
 // src/deploy/access-drift-offer.ts
 var asStrings = (v) => Array.isArray(v) ? v.map((x) => String(x)) : [];
 function renderAccessDriftSummary(slug, body) {
-  const lines = [`launchpad deploy: refused — ACCESS DRIFT on "${slug}".`];
+  const lines = [`launchpad deploy: access change detected on "${slug}".`];
   const liveOnly = asStrings(body.live_only);
   const manifestOnly = asStrings(body.manifest_only);
   if (liveOnly.length > 0) {
-    lines.push(`       enforced but NOT declared (over-grant): ${liveOnly.join(", ")}`);
+    lines.push(`       enforced but NOT declared (will be removed): ${liveOnly.join(", ")}`);
   }
   if (manifestOnly.length > 0) {
-    lines.push(`       declared but NOT enforced: ${manifestOnly.join(", ")}`);
+    lines.push(`       declared but NOT enforced (will be granted): ${manifestOnly.join(", ")}`);
   }
   lines.push("");
-  lines.push("       Your manifest's access groups don't match what the gateway enforces.");
-  lines.push("       `launchpad deploy` ships content only and cannot change access.");
+  lines.push("       Your manifest's access groups differ from what the gateway enforces —");
+  lines.push("       reconciling automatically via the gated Terraform apply (no second command needed).");
   return lines;
 }
-function renderManualApplyGuidance() {
-  return [
-    "       Run `launchpad deploy --apply` to reconcile — it opens the gated TF PR",
-    "       (an access-widening change needs the allowed-groups-change label from a",
-    "       second person) and waits for the apply verdict. Then redeploy your content.",
-    "       Nothing was committed by this attempt."
-  ];
-}
-function isYes(answer) {
-  const a = answer.trim().toLowerCase();
-  return a === "y" || a === "yes";
-}
 async function handleAccessDrift(params) {
   const { slug, manifestPath, body, io, deps } = params;
   for (const line of renderAccessDriftSummary(slug, body))
     io.err(line);
-  if (!deps.interactive) {
-    for (const line of renderManualApplyGuidance())
-      io.err(line);
-    return 1;
-  }
-  io.err("");
-  const answer = await deps.prompt("Reconcile access now via the gated apply PR? You'll review the exact plan next. [y/N] ");
-  if (!isYes(answer)) {
-    io.err("");
-    io.err("Skipped — no access change was made.");
-    for (const line of renderManualApplyGuidance())
-      io.err(line);
-    return 1;
-  }
   io.out("");
-  io.out("Reconciling access via `launchpad deploy --apply` …");
+  io.out("Reconciling access automatically via the gated apply PR (no second command needed) …");
   let applied = false;
-  const exit = await deps.runApply({ file: manifestPath, platformRepo: null, rePin: false, yes: false }, io, { onApplied: () => {
+  const exit = await deps.runApply({ file: manifestPath, platformRepo: null, rePin: false, yes: true }, io, { onApplied: () => {
     applied = true;
   } });
   if (applied) {
@@ -6619,20 +6621,6 @@ async function handleAccessDrift(params) {
   return exit === 0 ? 1 : exit;
 }
 
-// src/io/prompt.ts
-function isInteractive() {
-  return Boolean(process.stdin.isTTY);
-}
-async function defaultPrompt2(question) {
-  const { createInterface } = await import("node:readline/promises");
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    return await rl.question(question);
-  } finally {
-    rl.close();
-  }
-}
-
 // src/deploy/dry-run.ts
 import { execFileSync } from "node:child_process";
 import { resolve as resolve7 } from "node:path";
@@ -7188,9 +7176,8 @@ function deployUsage() {
 ` + `manifest-driven dry-run (read-only preview):
 ` + `       launchpad deploy --dry-run [--file <manifest>] [--json]
 ` + `
-` + `manifest-driven apply (runs server-side via portal-bot):
-` + `       launchpad deploy --apply [--file <manifest>] [--at <sha>] [--re-pin]
-` + "                        [--yes] [--resume-pr <n>] [--timeout-minutes <n>]";
+` + "access changes reconcile automatically (ADR 0034): plain `launchpad deploy`\n" + `detects a group change vs the deployed manifest and applies it via the gated
+` + "TF route — no separate verb. (`--apply` remains a hidden alias for one release.)";
 }
 function parseArgs3(args) {
   let message = null;
@@ -7284,7 +7271,7 @@ function surfaceDeployExtras(body, io, slug, allowStale = false) {
     if (adw.manifestOnly !== undefined && adw.manifestOnly.length > 0) {
       io.err(`         declared but NOT enforced: ${adw.manifestOnly.join(", ")}`);
     }
-    io.err(`         reconcile with \`launchpad deploy --apply\` (the gated TF route) — \`launchpad deploy\` can't (it ships content only).`);
+    io.err(`         re-run \`launchpad deploy\` to reconcile — it applies an access change automatically via the gated TF route (ADR 0034); no separate verb needed.`);
   }
 }
 function isStaleBlock(body) {
@@ -7358,6 +7345,17 @@ async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
   for (const line of renderManifestDiffLines(diff))
     io.out(line);
 }
+async function advanceBaseShaMarker(cwd, sha, io) {
+  try {
+    if (typeof sha !== "string" || !isValidBaseSha(sha))
+      return;
+    if (await readBaseShaMarker(cwd) === null)
+      return;
+    await writeBaseShaMarker(cwd, sha);
+  } catch (e) {
+    io.err(`warning: couldn't update the local base-sha marker (${describe15(e)}); ` + `a future deploy may re-warn about staleness. Harmless — your deploy landed.`);
+  }
+}
 async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
@@ -7484,11 +7482,7 @@ async function runModelADeploy(args) {
           manifestPath,
           body,
           io,
-          deps: {
-            interactive: isInteractive(),
-            prompt: defaultPrompt2,
-            runApply: runDeployApply
-          }
+          deps: { runApply: runDeployApply }
         });
       }
       io.err(`launchpad deploy: bot rejected the upload (HTTP ${result.status}, ${errorCode}).`);
@@ -7525,6 +7519,7 @@ async function runModelADeploy(args) {
           io.out(`  (managed main @ ${success.head_sha.slice(0, 8)} matches the bundle)`);
         }
         surfaceDeployExtras(success, io, slug, args.allowStale);
+        await advanceBaseShaMarker(cwd, success.head_sha, io);
         return 0;
       }
       if (success.status === "provisioning_started") {
@@ -7554,6 +7549,7 @@ async function runModelADeploy(args) {
         io.err(`       got: ${JSON.stringify(success)}`);
         return 1;
       }
+      await advanceBaseShaMarker(cwd, success.commit_sha, io);
       io.out(`✓ Bundle accepted — committed as ${success.commit_sha.slice(0, 8)} on ${success.repo}`);
       io.out(`  ${result.fileCount} files (${formatBytes2(result.compressedBytes)} gzipped)`);
       if (result.workerScript !== null) {
@@ -8956,7 +8952,7 @@ var SLUG_REGEX3 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var initCommand = {
   name: "init",
   summary: "scaffold a new launchpad.yaml in the current directory",
-  run: (args, io) => runInit(args, io, defaultPrompt3)
+  run: (args, io) => runInit(args, io, defaultPrompt2)
 };
 async function runInit(args, io, prompt) {
   const parsed = parseArgs6(args);
@@ -9446,7 +9442,7 @@ function ensureGitignoreEntries(path10, entries) {
   }
   return added;
 }
-async function defaultPrompt3(question, fallback) {
+async function defaultPrompt2(question, fallback) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     const suffix = fallback !== undefined ? ` [${fallback}]` : "";
@@ -10127,7 +10123,7 @@ import { stdin as input, stdout as output } from "node:process";
 var destroyCommand = {
   name: "destroy",
   summary: "tear down a Launchpad app (owner-only, destructive)",
-  run: (args, io) => runDestroy(args, io, defaultPrompt4, defaultIsTty)
+  run: (args, io) => runDestroy(args, io, defaultPrompt3, defaultIsTty)
 };
 var SLUG_RE10 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var SLUG_MIN_LENGTH = 3;
@@ -10359,7 +10355,7 @@ function renderBotError2(status, env, slug, io) {
       io.err(`launchpad destroy: bot returned HTTP ${status} (error=${errorCode}): ${message}`);
   }
 }
-async function defaultPrompt4(question) {
+async function defaultPrompt3(question) {
   const rl = createInterface2({ input, output });
   try {
     return await rl.question(question);
@@ -11028,7 +11024,7 @@ async function runRollback(opts, io, deps = {}) {
   io.out(`Rollback target: ${verifiedSha.slice(0, 12)} (${manifestRelpath})`);
   renderDiff(current, parsed.manifest, io);
   if (!opts.yes) {
-    const prompt = deps.prompt ?? defaultPrompt5;
+    const prompt = deps.prompt ?? defaultPrompt4;
     if (!process.stdin.isTTY && deps.prompt === undefined) {
       io.err("launchpad rollback: refusing to rollback non-interactively without --yes.");
       return 64;
@@ -11116,7 +11112,7 @@ function formatHostnames(hs) {
     return hs[0];
   return `[${hs.join(", ")}]`;
 }
-async function defaultPrompt5(question) {
+async function defaultPrompt4(question) {
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     return await rl.question(question);
@@ -11423,7 +11419,7 @@ async function offerRedeploy(slug, opts, io, deps) {
   const isTty = (deps.isTty ?? (() => process.stdin.isTTY === true))();
   let doRedeploy = wantsAuto;
   if (!wantsAuto && isTty) {
-    const prompt = deps.prompt ?? defaultPrompt6;
+    const prompt = deps.prompt ?? defaultPrompt5;
     let answer;
     try {
       answer = (await prompt(`Redeploy ${slug} now to activate? [y/N] `)).trim().toLowerCase();
@@ -11444,7 +11440,7 @@ async function offerRedeploy(slug, opts, io, deps) {
   };
   return run({ slug, file: opts.file ?? null, verify: true, verifyTimeoutMs: 180000 }, io, rdeps);
 }
-async function defaultPrompt6(question) {
+async function defaultPrompt5(question) {
   const rl = createInterface4({ input: input2, output: output2 });
   try {
     return await rl.question(question);

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAqEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAsEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/deploy/access-drift-offer.d.ts

@@ -6,35 +6,31 @@ export interface AccessDriftBody {
     readonly manifest_only?: unknown;
 }
 export interface AccessDriftDeps {
-    /** True when we may prompt (stdin is a TTY). */
-    readonly interactive: boolean;
-    /** Ask a yes/no question; resolves the raw typed line. */
-    readonly prompt: (question: string) => Promise<string>;
     /**
      * Run the gated apply flow. Defaults to `runDeployApply` at the call site.
      * The third arg carries an `onApplied` hook the flow fires only when a
      * terraform apply actually completes — so we never claim success when the
-     * operator reviews the plan and aborts (both paths exit 0).
+     * apply reaches a non-applied terminal state (both paths can exit 0).
      */
     readonly runApply: (opts: ApplyOptions, io: CliIo, deps?: {
         readonly onApplied?: () => void;
     }) => Promise<ExitCode>;
 }
 /**
- * The drift summary — printed in every case (interactive or not). Names both
- * directions of the divergence so the operator can see exactly what would
- * change before deciding.
+ * The drift summary — printed before the automatic reconcile. Names both
+ * directions of the divergence so the operator can see exactly what is about
+ * to change.
  */
 export declare function renderAccessDriftSummary(slug: string, body: AccessDriftBody): string[];
 /**
- * The manual fallback guidance — printed when the session is non-interactive,
- * or when the operator declines the inline offer.
- */
-export declare function renderManualApplyGuidance(): string[];
-/**
- * Surface an access-drift refusal and, when interactive, offer to reconcile
- * inline via the gated apply flow. Returns the exit code the deploy command
- * should return.
+ * Surface an access-drift refusal and reconcile it automatically via the gated
+ * apply flow. Returns the exit code the deploy command should return.
+ *
+ * Honest exit (carried forward from the 0.47.1 fix): the apply flow exits 0
+ * both when a terraform apply actually completes AND when it reaches a
+ * non-applied terminal state without changing anything, so we only report
+ * "reconciled" — and only return the apply's 0 — when `onApplied` fired. A bare
+ * 0 with nothing applied would be false success a script/CI would observe.
  */
 export declare function handleAccessDrift(params: {
     readonly slug: string;

package/dist/deploy/access-drift-offer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-drift-offer.d.ts","sourceRoot":"","sources":["../../src/deploy/access-drift-offer.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,KACvC,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAKD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,GACpB,MAAM,EAAE,CAoBV;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,EAAE,CAOpD;AAQD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoDpB"}
+{"version":3,"file":"access-drift-offer.d.ts","sourceRoot":"","sources":["../../src/deploy/access-drift-offer.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,KACvC,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAKD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,GACpB,MAAM,EAAE,CAoBV;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+BpB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.47.1";
+export declare const CLI_VERSION = "0.48.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.47.1",
+  "version": "0.48.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -189,19 +189,20 @@ Both are offline by default (no bot). `launchpad validate
 resolves against the **whole tenant**, so a valid *unassigned* tenant
 group passes (no need to use `deploy --dry-run` as a workaround).
 
-> **Changing the access group is NOT a content deploy.** Editing
-> `access.allowed_entra_groups` and running a plain `launchpad deploy`
-> ships content only — it does **not** reconcile the gateway's access
-> policy, so the change won't take effect (and is refused once the
-> access-drift gate is enforced). When that refusal happens in an
-> **interactive terminal**, the CLI now **offers to reconcile inline** —
-> answering `y` routes straight into the gated apply flow (which shows
-> the plan and confirms again before opening the PR). To change a live
-> app's groups the user self-serves the **gated Terraform route**:
-> `launchpad deploy --apply` (preview with `--dry-run`, confirm with
-> `launchpad status`) — or just accept the inline offer. Do **not** tell
-> the user to raise a request with the platform team — `--apply` IS the
-> self-serve route. See `/launchpad-status` and the
+> **Changing the access group needs no special command (PS-2117 / ADR
+> 0034).** Edit `access.allowed_entra_groups` and run a plain
+> `launchpad deploy`: it detects the group change and **reconciles
+> access automatically** via the gated apply PR, which auto-merges on
+> its automated checks (byte-equal validator + `tf plan`) with no
+> `--apply` verb, no prompt, and no human approval. The content bundle
+> is refused only for that one deploy (access reconciles first); re-run
+> `launchpad deploy` afterwards to ship content. The platform does not
+> block the change — a dangerous shape (a widening on a `sensitive` app,
+> or a broad-group grant) fires an after-the-fact Product Security
+> alert. Preview with `--dry-run`; undo a bad change with
+> `launchpad rollback <prior-sha>`. Do **not** tell the user to raise a
+> request with the platform team — it is fully self-serve. See
+> `/launchpad-status` and the
 > [auth & groups](https://get.launchpad.m-kopa.us/docs/concepts/auth-groups#changing-access-on-an-existing-app)
 > doc.
 

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -234,16 +234,18 @@ are authorised at runtime via a Microsoft Graph membership check
 Use whichever fits; `--dry-run` additionally previews the Terraform.
 
 This `--group` flow sets the group at **first deploy**. Changing the
-group on an **existing** app is a different path — a plain `launchpad
-deploy` ships content only and won't move the gateway policy. When a
-plain deploy detects access drift in an **interactive terminal** it now
-**offers to reconcile inline** (answer `y` to route straight into the
-gated apply flow, which shows the plan and confirms again before it
-opens the PR); in a non-interactive session it prints the manual
-`launchpad deploy --apply` route and exits non-zero. Either way the fix
-is the gated Terraform apply — see `/launchpad-content-pr`. Never route
-the user to the platform team for a group change, and never tell them
-access drift is unfixable: the self-serve reconcile is one keystroke.
+group on an **existing** app needs no different command: a plain
+`launchpad deploy` **reconciles access automatically** (PS-2117 / ADR
+0034). When it detects that the manifest's groups differ from what the
+gateway enforces, it routes straight into the gated apply flow — opens
+the bot's `[launchpad] apply <slug>` PR, which **auto-merges on its
+automated checks** (byte-equal validator + `tf plan`) with no `--apply`
+verb, no prompt, and no human approval. Once access is in sync, re-run
+`launchpad deploy` to ship your content. The platform does not block an
+access change; a dangerous shape (a widening on a `sensitive` app, or a
+broad-group grant) fires an after-the-fact Product Security alert. Never
+route the user to the platform team for a group change, and never tell
+them access drift is unfixable — it just reconciles.
 
 If `launchpad groups list` fails with:
 
@@ -377,8 +379,8 @@ Flags — there is nothing useful to pass on the Model A path:
 - `--message` is sent as a request header on the legacy path only,
   and the bot currently **ignores** it — don't offer it as a
   change-log mechanism.
-- `--file <path>` is valid only with the `--dry-run` / `--apply`
-  manifest modes, not with a bundle deploy.
+- `--file <path>` is valid only with the `--dry-run` manifest preview
+  (and the hidden `--apply` alias), not with a bundle deploy.
 
 ### A.6 Terminal handling
 

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.47.1
+version: 0.48.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -331,19 +331,18 @@ which the bot handles.)
 ### "drift: access.allowed_entra_groups"
 
 Group binding changed in your local manifest. This is the
-**load-bearing** drift — it controls who can access the app. After
-`launchpad deploy`, the resulting PR will require the
-`allowed-groups-change: true` label from a non-author human reviewer
-(AC-S4) before it can auto-merge.
-
-Reconcile it with **`launchpad deploy --apply`** — a plain
-`launchpad deploy` ships content only and does **not** re-apply the
-gateway's access policy. On a gateway app where enforcement is on, the
-bot **refuses** a content deploy while the manifest's groups diverge
-from what the gateway actually enforces (so access changes can't be
-silently dropped); `--apply` is the gated route that reconciles the
-enforced KV allow-list to the manifest. `launchpad status --strict`
-exits non-zero on any drift, so it can gate CI.
+**load-bearing** drift — it controls who can access the app.
+
+Reconcile it by just running **`launchpad deploy`** (PS-2117 / ADR
+0034): a plain deploy detects the group divergence and reconciles it
+automatically via the gated apply PR, which auto-merges on its
+automated checks (byte-equal validator + `tf plan`) with no `--apply`
+verb, no prompt, and no human approval. The platform does not block the
+change; a dangerous shape (a widening on a `sensitive` app, or a
+broad-group grant) fires an after-the-fact Product Security alert. To
+undo a bad change fast, `launchpad rollback <prior-sha>`.
+`launchpad status --strict` exits non-zero on any drift, so it can gate
+CI.
 
 ## Related skills