@m-kopa/launchpad-cli 0.47.2 → 0.49.0

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.47.2";
+var CLI_VERSION = "0.49.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -48,6 +48,159 @@ function loadConfig(env = process.env) {
   };
 }
 
+// src/http/error-envelope.ts
+var MAX_TEXT_CHARS = 16384;
+var MAX_PATH_CHARS = 1024;
+var MAX_ARRAY_ITEMS = 100;
+function decodeErrorEnvelope(input, context) {
+  const body = isRecord(input) ? input : {};
+  const omissions = [];
+  const endpoint = boundedOptionalString(body.endpoint, "endpoint", omissions) ?? context.endpoint;
+  const legacyError = boundedOptionalString(body.error, "error", omissions);
+  const code = boundedOptionalString(body.code, "code", omissions) ?? legacyError ?? "api_error";
+  const message = boundedOptionalString(body.message, "message", omissions) ?? `bot returned HTTP ${context.status}`;
+  const source = boundedOptionalString(body.source, "source", omissions);
+  const sourceSha = nullableBoundedString(body.source_sha ?? body.sourceSha, "source_sha", omissions);
+  const manifestSha = boundedOptionalString(body.manifest_sha ?? body.manifestSha ?? body.commit_sha ?? body.commitSha, "manifest_sha", omissions);
+  return {
+    status: context.status,
+    endpoint,
+    code,
+    message,
+    ...legacyError === undefined ? {} : { legacyError },
+    ...source === undefined ? {} : { source },
+    ...sourceSha === undefined ? {} : { sourceSha },
+    ...manifestSha === undefined ? {} : { manifestSha },
+    offendingRefs: boundedStringArray(body.offending_refs ?? body.offendingRefs, "offending_refs", omissions),
+    retryable: typeof body.retryable === "boolean" ? body.retryable : null,
+    issues: boundedIssues(body.issues, omissions),
+    candidates: boundedCandidates(body.candidates, omissions),
+    omissions
+  };
+}
+function decodeErrorText(text, context) {
+  try {
+    return decodeErrorEnvelope(JSON.parse(text), context);
+  } catch {
+    return {
+      status: context.status,
+      endpoint: context.endpoint,
+      code: "bad_response",
+      message: `bot returned a non-JSON response (${text.length} characters); ` + "the unstructured body was omitted",
+      offendingRefs: [],
+      retryable: null,
+      issues: [],
+      candidates: [],
+      omissions: ["response body omitted because it was not structured JSON"]
+    };
+  }
+}
+function formatErrorEnvelope(envelope) {
+  const lines = [
+    `bot returned HTTP ${envelope.status} for ${envelope.endpoint} ` + `[${envelope.code}]: ${envelope.message}`
+  ];
+  if (envelope.source !== undefined || envelope.sourceSha !== undefined) {
+    lines.push(`source: ${envelope.source ?? "unspecified"}` + (envelope.sourceSha === undefined ? "" : ` @ ${envelope.sourceSha ?? "none"}`));
+  }
+  if (envelope.manifestSha !== undefined) {
+    lines.push(`manifest SHA: ${envelope.manifestSha}`);
+  }
+  if (envelope.offendingRefs.length > 0) {
+    lines.push(`offending refs: ${envelope.offendingRefs.join(", ")}`);
+  }
+  for (const issue of envelope.issues) {
+    lines.push(`issue: ${issue.path}: ${issue.message}` + (issue.code === undefined ? "" : ` [${issue.code}]`));
+  }
+  for (const omission of envelope.omissions)
+    lines.push(`omission: ${omission}`);
+  if (envelope.retryable !== null) {
+    lines.push(`retryable: ${String(envelope.retryable)}`);
+  }
+  return lines.join(`
+`);
+}
+function errorEnvelopeJson(envelope) {
+  return {
+    error: {
+      status: envelope.status,
+      endpoint: envelope.endpoint,
+      code: envelope.code,
+      message: envelope.message,
+      ...envelope.legacyError === undefined ? {} : { legacy_error: envelope.legacyError },
+      ...envelope.source === undefined ? {} : { source: envelope.source },
+      ...envelope.sourceSha === undefined ? {} : { source_sha: envelope.sourceSha },
+      ...envelope.manifestSha === undefined ? {} : { manifest_sha: envelope.manifestSha },
+      offending_refs: envelope.offendingRefs,
+      retryable: envelope.retryable,
+      issues: envelope.issues,
+      candidates: envelope.candidates,
+      omissions: envelope.omissions
+    }
+  };
+}
+function boundedOptionalString(value, field, omissions) {
+  if (typeof value !== "string")
+    return;
+  return boundString(value, field, MAX_TEXT_CHARS, omissions);
+}
+function nullableBoundedString(value, field, omissions) {
+  if (value === null)
+    return null;
+  return boundedOptionalString(value, field, omissions);
+}
+function boundString(value, field, maxChars, omissions) {
+  if (value.length <= maxChars)
+    return value;
+  const omitted = value.length - maxChars;
+  omissions.push(`${field}: ${omitted} trailing characters omitted`);
+  return `${value.slice(0, maxChars)} [${omitted} trailing characters omitted]`;
+}
+function boundedStringArray(value, field, omissions) {
+  if (!Array.isArray(value))
+    return [];
+  const kept = value.slice(0, MAX_ARRAY_ITEMS).map((entry, index) => boundString(String(entry), `${field}[${index}]`, MAX_TEXT_CHARS, omissions));
+  if (value.length > MAX_ARRAY_ITEMS) {
+    omissions.push(`${field}: ${value.length - MAX_ARRAY_ITEMS} entries omitted`);
+  }
+  return kept;
+}
+function boundedIssues(value, omissions) {
+  if (!Array.isArray(value))
+    return [];
+  const issues = value.slice(0, MAX_ARRAY_ITEMS).flatMap((entry, index) => {
+    if (!isRecord(entry))
+      return [];
+    return [{
+      path: boundString(typeof entry.path === "string" ? entry.path : "(unspecified)", `issues[${index}].path`, MAX_PATH_CHARS, omissions),
+      message: boundString(typeof entry.message === "string" ? entry.message : String(entry.message ?? ""), `issues[${index}].message`, MAX_TEXT_CHARS, omissions),
+      ...typeof entry.code === "string" ? { code: boundString(entry.code, `issues[${index}].code`, MAX_PATH_CHARS, omissions) } : {}
+    }];
+  });
+  if (value.length > MAX_ARRAY_ITEMS) {
+    omissions.push(`issues: ${value.length - MAX_ARRAY_ITEMS} entries omitted`);
+  }
+  return issues;
+}
+function boundedCandidates(value, omissions) {
+  if (!Array.isArray(value))
+    return [];
+  const candidates = value.slice(0, MAX_ARRAY_ITEMS).flatMap((entry, index) => {
+    if (!isRecord(entry) || typeof entry.id !== "string")
+      return [];
+    return [{
+      id: boundString(entry.id, `candidates[${index}].id`, MAX_PATH_CHARS, omissions),
+      displayName: boundString(typeof entry.displayName === "string" ? entry.displayName : "", `candidates[${index}].displayName`, MAX_TEXT_CHARS, omissions)
+    }];
+  });
+  if (value.length > MAX_ARRAY_ITEMS) {
+    omissions.push(`candidates: ${value.length - MAX_ARRAY_ITEMS} entries omitted`);
+  }
+  return candidates;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/http/errors.ts
 class UnauthenticatedError extends Error {
   code = "unauthenticated";
@@ -62,12 +215,37 @@ class NotFoundError extends Error {
 }
 
 class ApiError extends Error {
-  code = "api_error";
+  faultCode = "api_error";
+  code;
   status;
-  constructor(message, status) {
-    super(message);
+  endpoint;
+  source;
+  sourceSha;
+  manifestSha;
+  offendingRefs;
+  retryable;
+  issues;
+  candidates;
+  omissions;
+  envelope;
+  constructor(envelope) {
+    super(formatErrorEnvelope(envelope));
     this.name = "ApiError";
-    this.status = status;
+    this.code = envelope.code;
+    this.status = envelope.status;
+    this.endpoint = envelope.endpoint;
+    if (envelope.source !== undefined)
+      this.source = envelope.source;
+    if (envelope.sourceSha !== undefined)
+      this.sourceSha = envelope.sourceSha;
+    if (envelope.manifestSha !== undefined)
+      this.manifestSha = envelope.manifestSha;
+    this.offendingRefs = envelope.offendingRefs;
+    this.retryable = envelope.retryable;
+    this.issues = envelope.issues;
+    this.candidates = envelope.candidates;
+    this.omissions = envelope.omissions;
+    this.envelope = envelope;
   }
 }
 
@@ -80,7 +258,7 @@ var last = null;
 function recordFault(err) {
   if (err === null || typeof err !== "object")
     return;
-  const code = err.code;
+  const code = err.faultCode ?? err.code;
   if (typeof code !== "string")
     return;
   const status = err.status;
@@ -854,6 +1032,7 @@ function buildAuthorizationUrl(params) {
 }
 
 // src/http/api-client.ts
+var MAX_ERROR_BODY_BYTES = 256 * 1024;
 async function apiJson(cfg, opts, fetcher = fetch) {
   const res = await apiRaw(cfg, opts, fetcher);
   let parsed;
@@ -905,34 +1084,75 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
     throw recordedFault(new TransportError(`network error calling ${url}: ${describe7(e)}`));
   }
   if (res.status === 401) {
-    const detail = await peek(res);
+    const detail = await errorDetail(res, opts.path);
     throw recordedFault(new UnauthenticatedError(`bot returned 401 for ${opts.path}: ${detail} — run \`launchpad login\``));
   }
   if (res.status === 403) {
-    const detail = await peek(res);
+    const detail = await errorDetail(res, opts.path);
     throw recordedFault(new ForbiddenError(`bot returned 403 for ${opts.path}: ${detail}`));
   }
   if (res.status === 404) {
-    const detail = await peek(res);
+    const detail = await errorDetail(res, opts.path);
     throw recordedFault(new NotFoundError(`bot returned 404 for ${opts.path}: ${detail}`));
   }
   if (!res.ok) {
     if (opts.nonThrowingStatuses?.includes(res.status) === true) {
       return res;
     }
-    const detail = await peek(res);
-    throw recordedFault(new ApiError(`bot returned HTTP ${res.status} for ${opts.path}: ${detail}`, res.status));
+    throw recordedFault(new ApiError(await readErrorEnvelope(res, opts.path)));
   }
   clearFault();
   return res;
 }
-async function peek(res) {
+async function readErrorText(res) {
+  const reader = res.body?.getReader();
+  if (reader === undefined)
+    return { kind: "text", text: "" };
+  const chunks = [];
+  let byteLength = 0;
   try {
-    const text = await res.text();
-    return text.slice(0, 200);
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      byteLength += value.byteLength;
+      if (byteLength > MAX_ERROR_BODY_BYTES) {
+        try {
+          await reader.cancel();
+        } catch {}
+        return { kind: "omitted" };
+      }
+      chunks.push(value);
+    }
   } catch {
-    return "";
+    return { kind: "text", text: "" };
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
   }
+  return { kind: "text", text: new TextDecoder().decode(bytes) };
+}
+async function readErrorEnvelope(res, endpoint) {
+  const body = await readErrorText(res);
+  if (body.kind === "text") {
+    return decodeErrorText(body.text, { status: res.status, endpoint });
+  }
+  const omission = `response body omitted because it exceeded ${MAX_ERROR_BODY_BYTES} bytes`;
+  return {
+    ...decodeErrorEnvelope({
+      code: "response_body_too_large",
+      message: `bot returned a response body larger than ${MAX_ERROR_BODY_BYTES} bytes; ` + "the body was omitted"
+    }, { status: res.status, endpoint }),
+    omissions: [omission]
+  };
+}
+async function errorDetail(res, endpoint) {
+  return formatErrorEnvelope(await readErrorEnvelope(res, endpoint));
 }
 function describe7(e) {
   return e instanceof Error ? e.message : String(e);
@@ -1404,8 +1624,6 @@ var createCommand = {
 };
 var APP_TYPES = ["static", "react", "react+api", "container"];
 var SLUG_RE2 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var GROUP_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var GROUP_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function runCreate(args, io) {
   const parsed = parseArgs(args);
   if (typeof parsed === "string") {
@@ -1513,8 +1731,8 @@ function parseArgs(args) {
     return "missing required flag --allowed-group (pass at least one)";
   }
   for (const g of allowedGroups) {
-    if (!GROUP_KEY_RE.test(g) && !GROUP_UUID_RE.test(g)) {
-      return `invalid --allowed-group "${g}" — expected a group key (HCL identifier, e.g. G_Product_Security) or an Entra Object-ID UUID`;
+    if (g.trim().length === 0) {
+      return "invalid --allowed-group: display name or Entra Object-ID UUID must be non-empty";
     }
   }
   return {
@@ -1531,15 +1749,14 @@ function printUsage(io) {
     "         --slug <slug>",
     "         --display-name <name>",
     `         --app-type <${APP_TYPES.join("|")}>`,
-    "         --allowed-group <G_KEY> [--allowed-group <G_KEY> ...]",
+    "         --allowed-group <name-or-uuid> [--allowed-group <name-or-uuid> ...]",
     "         [--description <text>]",
     "",
     "       slugs are kebab-case (3–58 chars); they become the",
     "       <slug>.launchpad.m-kopa.us hostname.",
     "",
-    "       --allowed-group values are `local.entra_groups` map KEYS",
-    "       from terraform/envs/prod/locals.tf (e.g. G_Product_Security),",
-    "       NOT raw Entra UUIDs."
+    "       --allowed-group accepts an exact Entra display name or Object-ID UUID.",
+    "       The server resolves identity and enforces the app's auth-mode rules."
   ].join(`
 `));
 }
@@ -1707,12 +1924,13 @@ function isErrno3(e) {
 }
 
 // src/bundle/upload.ts
+var ACCESS_RECONCILE_EXACT_SHA_V1 = "access-reconcile-exact-sha-v1";
 async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact, baseSha, overrideStale) {
   const formData = new FormData;
   formData.append("manifest", manifestYaml);
   const buf = new ArrayBuffer(bundleTarGz.byteLength);
   new Uint8Array(buf).set(bundleTarGz);
-  formData.append("bundle", new Blob([buf], { type: "application/gzip" }), "bundle.tar.gz");
+  formData.append("bundle", new Blob([new Uint8Array(buf)], { type: "application/gzip" }), "bundle.tar.gz");
   if (workerArtifact !== undefined) {
     const descriptor = {
       script: workerArtifact.script,
@@ -1729,7 +1947,8 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
   const { accessToken } = await getValidAccessToken(cfg.sessionPath);
   const headers = {
     authorization: `Bearer ${accessToken}`,
-    accept: "application/json"
+    accept: "application/json",
+    "x-launchpad-capabilities": ACCESS_RECONCILE_EXACT_SHA_V1
   };
   if (baseSha)
     headers["x-launchpad-base-sha"] = baseSha;
@@ -1739,13 +1958,15 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
   try {
     res = await fetch(url, { method: "POST", headers, body: formData });
   } catch (e) {
+    const envelope = decodeErrorEnvelope({
+      error: "transport_failed",
+      message: `network error contacting bot: ${e.message}`,
+      retryable: true
+    }, { status: 0, endpoint: url });
     return {
       kind: "error",
       status: 0,
-      response: {
-        error: "transport_failed",
-        message: `network error contacting bot: ${e.message}`
-      }
+      response: deployBundleError(envelope, {})
     };
   }
   const text = await res.text();
@@ -1756,14 +1977,21 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
     return {
       kind: "error",
       status: res.status,
-      response: {
-        error: "bad_response",
-        message: `bot returned non-JSON body (HTTP ${res.status}): ${text.slice(0, 200)}`
-      }
+      response: deployBundleError(decodeErrorText(text, { status: res.status, endpoint: url }), {})
     };
   }
   if (res.status === 202) {
-    return { kind: "ok", response: body };
+    const parsed = parse202(body, slug);
+    if (parsed !== null)
+      return { kind: "ok", response: parsed };
+    return {
+      kind: "error",
+      status: res.status,
+      response: deployBundleError(decodeErrorEnvelope({
+        error: "bad_response",
+        message: "bot returned a malformed HTTP 202 deploy response"
+      }, { status: res.status, endpoint: url }), {})
+    };
   }
   if (res.status === 200 && typeof body === "object" && body !== null && body.outcome === "nothing-to-deploy") {
     return { kind: "ok", response: body };
@@ -1771,8 +1999,104 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
   return {
     kind: "error",
     status: res.status,
-    response: body
+    response: deployBundleError(decodeErrorEnvelope(body, { status: res.status, endpoint: url }), isRecord2(body) ? body : {})
+  };
+}
+function parse202(body, fallbackSlug) {
+  if (!isRecord2(body))
+    return null;
+  if (body.status === "accepted") {
+    if (typeof body.commit_sha !== "string" || typeof body.repo !== "string") {
+      return null;
+    }
+    const reconcileRaw = body.reconcile ?? body.access_reconcile;
+    const reconcile = reconcileRaw === undefined ? undefined : parseReconcile(reconcileRaw);
+    if (reconcile === null)
+      return null;
+    const accepted = {
+      ...body,
+      slug: typeof body.slug === "string" ? body.slug : fallbackSlug,
+      message: typeof body.message === "string" ? body.message : "bundle committed; deployment is pending"
+    };
+    return reconcile === undefined ? accepted : { ...accepted, reconcile };
+  }
+  if (body.status === "provisioning_started") {
+    if (typeof body.slug !== "string" || typeof body.submissionId !== "string" || typeof body.appType !== "string") {
+      return null;
+    }
+    return {
+      ...body,
+      message: typeof body.message === "string" ? body.message : "provisioning started"
+    };
+  }
+  return null;
+}
+function parseReconcile(value) {
+  if (!isRecord2(value))
+    return null;
+  if (typeof value.id !== "string" || !isReconcileState(value.state) || typeof value.manifest_sha !== "string") {
+    return null;
+  }
+  const pr = value.pr === undefined ? undefined : parsePr(value.pr);
+  if (pr === null)
+    return null;
+  const outcome = {
+    id: value.id,
+    state: value.state,
+    manifest_sha: value.manifest_sha
   };
+  return pr === undefined ? outcome : { ...outcome, pr };
+}
+function parsePr(value) {
+  if (!isRecord2(value))
+    return null;
+  const headSha = value.head_sha ?? value.headSha;
+  if (typeof value.number !== "number" || !Number.isInteger(value.number) || typeof value.url !== "string" || typeof headSha !== "string") {
+    return null;
+  }
+  return { number: value.number, url: value.url, head_sha: headSha };
+}
+function deployBundleError(envelope, body) {
+  const pr = parsePr(body.pr);
+  const violations = readViolations(body.violations);
+  const findings = readFindings(body.findings);
+  const liveOnly = readStringArray(body.live_only);
+  const manifestOnly = readStringArray(body.manifest_only);
+  const paths = readStringArray(body.paths);
+  const reconcileId = body.reconcileId ?? body.reconcile_id;
+  return {
+    ...envelope,
+    error: envelope.legacyError ?? envelope.code,
+    ...violations === undefined ? {} : { violations },
+    ...findings === undefined ? {} : { findings },
+    ...typeof reconcileId === "string" ? { reconcileId } : {},
+    ...isReconcileState(body.state) ? { state: body.state } : {},
+    ...pr === null ? {} : { pr },
+    ...liveOnly === undefined ? {} : { live_only: liveOnly },
+    ...manifestOnly === undefined ? {} : { manifest_only: manifestOnly },
+    ...typeof body.head_sha === "string" ? { head_sha: body.head_sha } : {},
+    ...paths === undefined ? {} : { paths },
+    ...typeof body.reason === "string" ? { reason: body.reason } : {}
+  };
+}
+function readStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : undefined;
+}
+function readViolations(value) {
+  if (!Array.isArray(value))
+    return;
+  return value.flatMap((entry) => isRecord2(entry) && typeof entry.path === "string" && typeof entry.rule === "string" && typeof entry.message === "string" ? [{ path: entry.path, rule: entry.rule, message: entry.message }] : []);
+}
+function readFindings(value) {
+  if (!Array.isArray(value))
+    return;
+  return value.flatMap((entry) => isRecord2(entry) && typeof entry.path === "string" && typeof entry.rule === "string" ? [{ path: entry.path, rule: entry.rule }] : []);
+}
+function isReconcileState(value) {
+  return value === "prepared" || value === "committed" || value === "pr_open" || value === "applied" || value === "aborted";
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/bundle/cwd-walker.ts
@@ -2225,7 +2549,8 @@ var ManifestSchema = z.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z.boolean().optional(),
-  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional()
+  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional(),
+  sensitive: z.boolean().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
   if (m.confine_origin !== undefined) {
@@ -2440,6 +2765,14 @@ function parseManifest(input) {
     }))
   };
 }
+// ../launchpad-engine/dist/canonical-group-id.js
+var CANONICAL_GROUP_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function parseCanonicalGroupId(value) {
+  if (!CANONICAL_GROUP_ID_PATTERN.test(value)) {
+    return { kind: "invalid", value };
+  }
+  return { kind: "ok", id: value.toLowerCase() };
+}
 // ../launchpad-engine/dist/app-boundary.js
 var INCLUDE_EVERYTHING = ["**"];
 var COMMON_INCLUDE = [
@@ -2842,6 +3175,7 @@ var SpecSchema = z2.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z2.boolean().optional(),
+  sensitive: z2.boolean().optional(),
   catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
   env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
   containers: z2.array(ContainerSchema).min(1).optional(),
@@ -3395,44 +3729,51 @@ function emitSecretStep(lines, binding) {
 var CF_ACCOUNT_ID = "c07cb17c9f742e8144c4828b3693ca65";
 var R2_S3_ENDPOINT = `https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com`;
 // ../launchpad-engine/dist/access-drift.js
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function canonicalUuid(s) {
-  const t = s.trim();
-  return UUID_RE.test(t) ? t.toLowerCase() : null;
-}
-function normalise(tokens, side, resolve6) {
-  const uuids = new Set;
-  const unresolved = [];
-  for (const raw of tokens) {
-    const direct = canonicalUuid(raw);
-    const uuid = direct ?? (() => {
-      const resolved = resolve6(raw);
-      return resolved === null ? null : canonicalUuid(resolved);
-    })();
-    if (uuid === null) {
-      unresolved.push({ side, token: raw });
-    } else {
-      uuids.add(uuid);
-    }
-  }
-  return { uuids, unresolved };
+function isUuid(s) {
+  return parseCanonicalGroupId(s.trim()).kind === "ok";
 }
-function detectAccessDrift(declaredTokens, enforcedTokens, resolve6) {
-  const declared = normalise(declaredTokens, "manifest", resolve6);
-  const enforced = normalise(enforcedTokens, "enforced", resolve6);
-  const manifestOnly = [...declared.uuids].filter((u) => !enforced.uuids.has(u)).sort();
-  const liveOnly = [...enforced.uuids].filter((u) => !declared.uuids.has(u)).sort();
-  const unresolved = [...declared.unresolved, ...enforced.unresolved];
+function canonicalUuid(s) {
+  const parsed = parseCanonicalGroupId(s.trim());
+  return parsed.kind === "ok" ? parsed.id : null;
+}
+function detectCanonicalAccessDrift(declaredIds, enforcedIds) {
+  const declared = new Set(declaredIds);
+  const enforced = new Set(enforcedIds);
+  const manifestOnly = [...declared].filter((id) => !enforced.has(id)).sort();
+  const liveOnly = [...enforced].filter((id) => !declared.has(id)).sort();
   return {
     manifestOnly,
     liveOnly,
-    unresolved,
-    inSync: manifestOnly.length === 0 && liveOnly.length === 0 && unresolved.length === 0
+    unresolved: [],
+    inSync: manifestOnly.length === 0 && liveOnly.length === 0
   };
 }
+// ../launchpad-engine/dist/broad-groups.js
+var BROAD_GROUPS = [
+  {
+    uuid: "caf78902-35dd-4833-88ce-8f067eda6036",
+    name: "S_ALL_Employees",
+    note: "All employees — the broadest grant on the tenant; assigned to the Launchpad enterprise app. Granting this reaches the entire company."
+  }
+];
+function assertBroadGroupsWellFormed(list = BROAD_GROUPS) {
+  const seen = new Set;
+  for (const g of list) {
+    const key = canonicalUuid(g.uuid);
+    if (key === null || !isUuid(g.uuid)) {
+      throw new Error(`broad-groups: entry '${g.name}' has a malformed UUID: '${g.uuid}'`);
+    }
+    if (seen.has(key)) {
+      throw new Error(`broad-groups: duplicate UUID for '${g.name}': '${g.uuid}'`);
+    }
+    seen.add(key);
+  }
+}
+assertBroadGroupsWellFormed();
+var BROAD_UUIDS = new Set(BROAD_GROUPS.map((g) => canonicalUuid(g.uuid)).filter((u) => u !== null));
 // ../launchpad-engine/dist/fleet-manifest.js
 import { z as z3 } from "zod";
-var UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var TF_RESIDENCIES = ["per-app-workspace", "main-tf"];
 var APP_SHAPES = [
   "pages",
@@ -3459,7 +3800,7 @@ var FLEET_TIERS = [
   "out-of-scope"
 ];
 var DEVICE_POSTURE = ["gateway-eligible", "retained-access"];
-var GroupId = z3.string().regex(UUID_RE2, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
+var GroupId = z3.string().regex(UUID_RE, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
 var FleetAppSchema = z3.object({
   slug: z3.string().regex(SLUG_REGEX),
   residency: z3.enum(TF_RESIDENCIES),
@@ -4094,23 +4435,30 @@ async function resolveGroupRefsTenant(cfg, refs, opts = {}) {
       method: "POST",
       path: "/groups/resolve",
       jsonBody: { refs },
-      nonThrowingStatuses: [400, 429, 503]
+      nonThrowingStatuses: [400, 409, 422, 429, 503]
     }, opts.fetcher);
   } catch (e) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError)
       throw e;
     return { kind: "error", message: describe11(e) };
   }
+  const text = await res.text();
   let data;
   try {
-    data = await res.json();
-  } catch (e) {
-    return { kind: "error", message: `bot returned a non-JSON resolve response: ${describe11(e)}` };
+    data = JSON.parse(text);
+  } catch {
+    const envelope = decodeErrorText(text, {
+      status: res.status,
+      endpoint: "/groups/resolve"
+    });
+    return { kind: "error", message: envelope.message, envelope };
   }
   if (res.status !== 200) {
-    const env = data;
-    const msg = typeof env?.message === "string" ? env.message : typeof env?.error === "string" ? env.error : `bot returned HTTP ${res.status}`;
-    return { kind: "error", message: msg };
+    const envelope = decodeErrorEnvelope(data, {
+      status: res.status,
+      endpoint: "/groups/resolve"
+    });
+    return { kind: "error", message: envelope.message, envelope };
   }
   const body = data;
   switch (body.kind) {
@@ -4142,19 +4490,6 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12
 function isUuid2(value) {
   return UUID_PATTERN.test(value);
 }
-function findGroup(groups, nameOrId) {
-  if (isUuid2(nameOrId)) {
-    const lower = nameOrId.toLowerCase();
-    const hit = groups.find((g) => g.id.toLowerCase() === lower);
-    return hit ? { kind: "found", group: hit } : { kind: "not-found" };
-  }
-  const matches = groups.filter((g) => g.displayName === nameOrId || g.mailNickname !== null && g.mailNickname === nameOrId);
-  if (matches.length === 0)
-    return { kind: "not-found" };
-  if (matches.length === 1)
-    return { kind: "found", group: matches[0] };
-  return { kind: "ambiguous", matches };
-}
 function searchGroups(groups, query) {
   const q = query.toLowerCase();
   return groups.filter((g) => g.displayName.toLowerCase().includes(q) || g.mailNickname !== null && g.mailNickname.toLowerCase().includes(q) || g.id.toLowerCase().includes(q));
@@ -4934,17 +5269,48 @@ async function runStatus(args, io) {
     return 2;
   }
   const deployed = deployedParse.manifest;
-  const drift = computeDrift(local, deployed);
+  const localGroups = await resolveStatusGroups({
+    cfg,
+    refs: allowedEntraGroups(local.access),
+    source: "local manifest",
+    manifestSha: null
+  });
+  if (localGroups.kind === "error") {
+    return renderStatusGroupError(localGroups.envelope, parsed.json, io);
+  }
+  const deployedGroups = await resolveStatusGroups({
+    cfg,
+    refs: allowedEntraGroups(deployed.access),
+    source: "deployed manifest",
+    manifestSha: state.lastAppliedManifestSha
+  });
+  if (deployedGroups.kind === "error") {
+    return renderStatusGroupError(deployedGroups.envelope, parsed.json, io);
+  }
+  const drift = computeDrift(local, deployed, {
+    local: localGroups.ids,
+    deployed: deployedGroups.ids
+  });
   let accessDrift;
   if (state.enforcedGroups !== null) {
-    let resolver;
-    try {
-      resolver = await buildGroupResolver(cfg);
-    } catch (e) {
-      return mapBotError(e, parsed.slug, io);
+    const enforcedGroups = await resolveStatusGroups({
+      cfg,
+      refs: state.enforcedGroups,
+      source: "enforced access",
+      manifestSha: state.lastAppliedManifestSha
+    });
+    if (enforcedGroups.kind === "error") {
+      return renderStatusGroupError(enforcedGroups.envelope, parsed.json, io);
     }
-    accessDrift = detectAccessDrift(allowedEntraGroups(local.access), state.enforcedGroups, resolver);
+    accessDrift = detectCanonicalAccessDrift(localGroups.ids, enforcedGroups.ids);
+  }
+  const localAssignmentGroups = (local.auth ?? "access") === "access" ? localGroups : null;
+  const deployedAssignmentGroups = (deployed.auth ?? "access") === "access" ? deployedGroups : null;
+  const assignmentCheck = localAssignmentGroups === null && deployedAssignmentGroups === null ? { kind: "ok", issues: [] } : await findAssignmentIssues(cfg, localAssignmentGroups, deployedAssignmentGroups, state.lastAppliedManifestSha);
+  if (assignmentCheck.kind === "error") {
+    return renderStatusGroupError(assignmentCheck.envelope, parsed.json, io);
   }
+  const groupIssues = assignmentCheck.issues;
   const result = {
     state: drift.length === 0 ? "in_sync" : "drift",
     slug: parsed.slug,
@@ -4956,30 +5322,154 @@ async function runStatus(args, io) {
     driftDetails: drift,
     ...deploymentKnown ? { deployment } : {},
     ...standingExceptions !== null ? { standingExceptions } : {},
-    ...accessDrift !== undefined ? { accessDrift } : {}
+    ...accessDrift !== undefined ? { accessDrift } : {},
+    ...groupIssues.length === 0 ? {} : { groupIssues }
   };
   emit3(result, parsed.json, io);
-  if (parsed.strict && (result.state === "drift" || accessDrift?.inSync === false)) {
+  if (parsed.strict && (result.state === "drift" || accessDrift?.inSync === false || groupIssues.length > 0)) {
     return 1;
   }
   return 0;
 }
-async function buildGroupResolver(cfg) {
+async function resolveStatusGroups(args) {
+  const direct = args.refs.map((ref) => parseCanonicalGroupId(ref));
+  if (direct.every((result2) => result2.kind === "ok")) {
+    const ids = direct.map((result2) => result2.id);
+    return {
+      kind: "ok",
+      refs: args.refs,
+      ids,
+      groups: ids.map((id) => ({ id, displayName: id }))
+    };
+  }
+  let result;
   try {
-    const res = await fetchGroups(cfg);
-    if (res.kind !== "ok")
-      return () => null;
-    return (nameOrId) => {
-      const hit = findGroup(res.groups, nameOrId);
-      return hit.kind === "found" ? hit.group.id : null;
+    result = await resolveGroupRefsTenant(args.cfg, args.refs);
+  } catch (error) {
+    const code = error instanceof UnauthenticatedError ? "unauthenticated" : error instanceof ForbiddenError ? "forbidden" : "group_resolution_failed";
+    const status = error instanceof UnauthenticatedError ? 401 : error instanceof ForbiddenError ? 403 : 503;
+    return {
+      kind: "error",
+      envelope: sourceEnvelope(args, code, describe12(error), args.refs, [], status)
+    };
+  }
+  if (result.kind === "ok") {
+    if (result.groups.length === args.refs.length) {
+      const parsed = result.groups.map((group) => parseCanonicalGroupId(group.id));
+      if (parsed.every((entry) => entry.kind === "ok")) {
+        const groups = result.groups.map((group, index) => ({
+          id: parsed[index].id,
+          displayName: group.displayName
+        }));
+        return {
+          kind: "ok",
+          refs: args.refs,
+          ids: groups.map((group) => group.id),
+          groups
+        };
+      }
+    }
+    return {
+      kind: "error",
+      envelope: sourceEnvelope(args, "bad_response", "tenant group resolver returned a malformed canonical projection", args.refs)
+    };
+  }
+  if (result.kind === "ambiguous") {
+    return {
+      kind: "error",
+      envelope: sourceEnvelope(args, "group_ambiguous", result.message || `group '${result.ref}' is ambiguous`, [result.ref], result.candidates)
+    };
+  }
+  if (result.kind === "unresolved") {
+    return {
+      kind: "error",
+      envelope: sourceEnvelope(args, result.refs.some((ref) => ref.reason === "unverified") ? "group_unverified" : "group_unresolved", result.message || "one or more group references could not be resolved", result.refs.map((ref) => ref.ref))
     };
-  } catch (e) {
-    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError)
-      throw e;
-    return () => null;
   }
+  return {
+    kind: "error",
+    envelope: result.envelope === undefined ? sourceEnvelope(args, "group_resolution_failed", result.message, args.refs) : {
+      ...result.envelope,
+      source: args.source,
+      sourceSha: args.manifestSha,
+      ...args.manifestSha === null ? {} : { manifestSha: args.manifestSha }
+    }
+  };
+}
+function sourceEnvelope(args, code, message, offendingRefs, candidates = [], status = 422) {
+  return decodeErrorEnvelope({
+    error: "group_resolution_failed",
+    code,
+    message,
+    source: args.source,
+    source_sha: args.manifestSha,
+    manifest_sha: args.manifestSha,
+    offending_refs: offendingRefs,
+    retryable: code === "group_unverified" || code === "group_resolution_failed",
+    candidates
+  }, { status, endpoint: "/groups/resolve" });
+}
+function renderStatusGroupError(envelope, json, io) {
+  if (json) {
+    io.out(JSON.stringify(errorEnvelopeJson(envelope), null, 2));
+  } else {
+    io.err(`launchpad status: ${formatErrorEnvelope(envelope)}`);
+  }
+  return 2;
 }
-function computeDrift(local, deployed) {
+async function findAssignmentIssues(cfg, local, deployed, deployedSha) {
+  const refs = [
+    ...local?.refs ?? [],
+    ...deployed?.refs ?? []
+  ];
+  let assigned;
+  try {
+    assigned = await fetchGroups(cfg, { forceRefresh: true });
+  } catch (error) {
+    const code = error instanceof UnauthenticatedError ? "unauthenticated" : error instanceof ForbiddenError ? "forbidden" : "group_assignment_lookup_failed";
+    const status = error instanceof UnauthenticatedError ? 401 : error instanceof ForbiddenError ? 403 : 503;
+    return {
+      kind: "error",
+      envelope: sourceEnvelope({
+        source: "enterprise-app group assignments",
+        manifestSha: deployedSha
+      }, code, describe12(error), refs, [], status)
+    };
+  }
+  if (assigned.kind !== "ok") {
+    return {
+      kind: "error",
+      envelope: sourceEnvelope({
+        source: "enterprise-app group assignments",
+        manifestSha: deployedSha
+      }, "group_assignment_lookup_failed", assigned.message, refs, [], 503)
+    };
+  }
+  const assignedIds = new Set(assigned.groups.map((group) => group.id.toLowerCase()));
+  const issue = (source, projection, manifestSha) => {
+    const missing = projection.groups.flatMap((group, index) => assignedIds.has(group.id) ? [] : [{ ref: projection.refs[index] ?? group.id, group }]);
+    if (missing.length === 0)
+      return [];
+    return [{
+      code: "group_not_assigned",
+      source,
+      manifestSha,
+      offendingRefs: missing.map((entry) => entry.ref),
+      candidates: missing.map((entry) => ({
+        id: entry.group.id,
+        displayName: entry.group.displayName
+      }))
+    }];
+  };
+  return {
+    kind: "ok",
+    issues: [
+      ...local === null ? [] : issue("local", local, null),
+      ...deployed === null ? [] : issue("deployed", deployed, deployedSha)
+    ]
+  };
+}
+function computeDrift(local, deployed, canonicalGroups) {
   const diffs = [];
   const cmp = (path8, l, d) => {
     const li = l ?? null;
@@ -4999,7 +5489,7 @@ function computeDrift(local, deployed) {
   cmp("metadata.owner", local.metadata.owner, deployed.metadata.owner);
   cmp("metadata.description", local.metadata.description, deployed.metadata.description);
   cmp("deployment.type", local.deployment.type, deployed.deployment.type);
-  cmp("access.allowed_entra_groups", allowedEntraGroups(local.access).join(", "), allowedEntraGroups(deployed.access).join(", "));
+  cmp("access.allowed_entra_groups", (canonicalGroups?.local ?? allowedEntraGroups(local.access)).join(", "), (canonicalGroups?.deployed ?? allowedEntraGroups(deployed.access)).join(", "));
   cmp("hostnames[0]", local.hostnames?.[0], deployed.hostnames?.[0]);
   cmp("build.command", local.build?.command, deployed.build?.command);
   cmp("build.destination_dir", local.build?.destination_dir, deployed.build?.destination_dir);
@@ -5091,6 +5581,7 @@ function emit3(out, asJson, io) {
       io.out(`${out.slug}: live, in sync` + (out.deployedSha ? ` (content @ ${out.deployedSha.slice(0, 7)})` : ""));
       surfaceHeadVsDeployed(out, io);
       surfaceAccessDrift(out, io);
+      surfaceGroupIssues(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
@@ -5103,6 +5594,7 @@ function emit3(out, asJson, io) {
       }
       surfaceHeadVsDeployed(out, io);
       surfaceAccessDrift(out, io);
+      surfaceGroupIssues(out, io);
       surfaceDeployment(out, io);
       surfaceExceptions(out, io);
       return;
@@ -5122,8 +5614,14 @@ function surfaceAccessDrift(out, io) {
   for (const u of ad.unresolved) {
     io.out(`    unresolved group (${u.side}): ${u.token}`);
   }
-  io.out("    `launchpad deploy` will NOT fix this — run `launchpad deploy --apply` to");
-  io.out("    reconcile access through the gated TF route.");
+  io.out("    `launchpad deploy` reconciles this from the exact content commit through the gated TF route.");
+}
+function surfaceGroupIssues(out, io) {
+  for (const issue of out.groupIssues ?? []) {
+    const source = issue.source === "deployed" && issue.manifestSha !== null ? `deployed manifest @ ${issue.manifestSha}` : "local manifest";
+    io.out(`  group_not_assigned (${source}): ${issue.offendingRefs.join(", ")}`);
+    io.out("    auth: access requires enterprise-app assignment so Entra emits the groups claim.");
+  }
 }
 function surfaceNoLocalManifestNote(out, io) {
   if (out.drift !== null)
@@ -5798,8 +6296,8 @@ function renderManifestDiffLines(diff, max = 20) {
 
 // src/commands/deploy-flags.ts
 var SLUG_RE4 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var GROUP_KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var GROUP_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var GROUP_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var GROUP_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function parseDeployFlags(args) {
   let mode = "content";
   let slug = null;
@@ -5933,7 +6431,7 @@ function parseDeployFlags(args) {
       const v = args[i + 1];
       if (v === undefined)
         return `missing value for ${a}`;
-      if (!GROUP_KEY_RE2.test(v) && !GROUP_UUID_RE2.test(v)) {
+      if (!GROUP_KEY_RE.test(v) && !GROUP_UUID_RE.test(v)) {
         return `invalid --allowed-group "${v}" — expected a group key (HCL identifier, e.g. G_Product_Security) or an Entra Object-ID UUID`;
       }
       allowedGroups.push(v);
@@ -6291,6 +6789,14 @@ async function runDeployApply(opts, io, deps = {}) {
     return mapHttpError(e, slug, io);
   }
   const manifestSha = plan.manifestSha;
+  if (!MANIFEST_SHA_REGEX.test(manifestSha)) {
+    io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/plan: ` + `invalid manifest SHA '${String(manifestSha)}'`);
+    return 2;
+  }
+  if (opts.atSha !== undefined && manifestSha !== opts.atSha) {
+    io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/plan: ` + `requested exact manifest SHA ${opts.atSha}, received ${manifestSha}`);
+    return 2;
+  }
   io.out(`Manifest pinned @ ${manifestSha.slice(0, 7)} (managed repo provenance).`);
   for (const w of plan.warnings)
     io.err(`! ${w}`);
@@ -6311,6 +6817,9 @@ async function runDeployApply(opts, io, deps = {}) {
       return 0;
     }
   }
+  if (opts.preopenedPr !== undefined) {
+    io.out(`Server already opened exact-SHA apply PR #${opts.preopenedPr.number}; ` + "confirming it idempotently before polling.");
+  }
   let apply;
   try {
     apply = await apiJson(cfg, {
@@ -6321,6 +6830,14 @@ async function runDeployApply(opts, io, deps = {}) {
   } catch (e) {
     return mapHttpError(e, slug, io);
   }
+  if (apply.manifestSha !== manifestSha) {
+    io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/apply: ` + `requested ${manifestSha}, received ${String(apply.manifestSha)}`);
+    return 2;
+  }
+  if (opts.preopenedPr !== undefined && apply.prNumber !== opts.preopenedPr.number) {
+    io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/apply: ` + `server-preopened PR #${opts.preopenedPr.number}, received #${apply.prNumber}`);
+    return 2;
+  }
   io.out("");
   io.out(`PR opened: ${apply.prUrl}`);
   io.out(`Branch:    ${apply.branch}`);
@@ -6340,8 +6857,13 @@ async function runDeployApply(opts, io, deps = {}) {
     pollIntervalSec,
     timeoutMs
   });
-  if (outcome.kind !== "applied")
-    return outcomeToExit(outcome, apply.prUrl, io);
+  if (outcome.kind !== "applied") {
+    const exit = outcomeToExit(outcome, apply.prUrl, io);
+    if (outcome.kind === "timed-out" && opts.serverRecoveryActive === true) {
+      io.err("  The CLI stopped waiting, but server recovery remains active for this exact commit.");
+    }
+    return exit;
+  }
   deletePinIfPresent(cfg, slug, io);
   io.out("");
   io.out(`✓ Applied ${slug}. (See ${apply.prUrl} for the merged PR.)`);
@@ -6379,10 +6901,21 @@ async function pollUntilApplied(args) {
           mode = "legacy";
           continue;
         }
+        if (e instanceof ApiError && e.retryable === false) {
+          breakDots();
+          return { kind: "failed", reason: e.message };
+        }
         args.io.err(`! apply-status fetch failed (will retry): ${describe13(e)}`);
         await sleep(args.pollIntervalSec * 1000);
         continue;
       }
+      if (status.manifestSha !== args.manifestSha) {
+        breakDots();
+        return {
+          kind: "transport",
+          reason: `protocol failure from /apps/${args.slug}/manifest/apply-status: ` + `requested ${args.manifestSha}, received ${status.manifestSha}`
+        };
+      }
       if (status.state === "applied") {
         breakDots();
         return { kind: "applied" };
@@ -6398,7 +6931,7 @@ async function pollUntilApplied(args) {
       if (status.state !== lastRendered) {
         breakDots();
         if (status.state === "waiting-approval") {
-          args.io.out(`⏳ waiting for approval/CI — access-bearing changes need the 'allowed-groups-change: true' label from someone other than the PR author (${status.prUrl})`);
+          args.io.out(`⏳ waiting for CI — the apply PR auto-merges when required checks pass (${status.prUrl})`);
         } else {
           args.io.out(`⚙ PR merged — waiting for the app's terraform apply${status.checkName !== undefined ? ` ('${status.checkName}')` : ""} …`);
         }
@@ -6469,6 +7002,7 @@ function outcomeToExit(outcome, prUrl, io) {
       }
       return 4;
     case "transport":
+      err(`! apply status failed: ${outcome.reason}`);
       return 2;
   }
 }
@@ -6561,76 +7095,58 @@ function renderManifestError(loaded, io) {
 // src/deploy/access-drift-offer.ts
 var asStrings = (v) => Array.isArray(v) ? v.map((x) => String(x)) : [];
 function renderAccessDriftSummary(slug, body) {
-  const lines = [`launchpad deploy: refused — ACCESS DRIFT on "${slug}".`];
+  const lines = [`launchpad deploy: access change detected on "${slug}".`];
   const liveOnly = asStrings(body.live_only);
   const manifestOnly = asStrings(body.manifest_only);
   if (liveOnly.length > 0) {
-    lines.push(`       enforced but NOT declared (over-grant): ${liveOnly.join(", ")}`);
+    lines.push(`       enforced but NOT declared (will be removed): ${liveOnly.join(", ")}`);
   }
   if (manifestOnly.length > 0) {
-    lines.push(`       declared but NOT enforced: ${manifestOnly.join(", ")}`);
+    lines.push(`       declared but NOT enforced (will be granted): ${manifestOnly.join(", ")}`);
   }
   lines.push("");
-  lines.push("       Your manifest's access groups don't match what the gateway enforces.");
-  lines.push("       `launchpad deploy` ships content only and cannot change access.");
+  lines.push("       Your manifest's access groups differ from what the gateway enforces —");
+  lines.push("       reconciling automatically via the gated Terraform apply (no second command needed).");
   return lines;
 }
-function renderManualApplyGuidance() {
-  return [
-    "       Run `launchpad deploy --apply` to reconcile — it opens the gated TF PR",
-    "       (an access-widening change needs the allowed-groups-change label from a",
-    "       second person) and waits for the apply verdict. Then redeploy your content.",
-    "       Nothing was committed by this attempt."
-  ];
-}
-function isYes(answer) {
-  const a = answer.trim().toLowerCase();
-  return a === "y" || a === "yes";
-}
 async function handleAccessDrift(params) {
-  const { slug, manifestPath, body, io, deps } = params;
-  for (const line of renderAccessDriftSummary(slug, body))
-    io.err(line);
-  if (!deps.interactive) {
-    for (const line of renderManualApplyGuidance())
+  const { slug, manifestPath, body, io, deps, outcome } = params;
+  if (outcome === undefined) {
+    for (const line of renderAccessDriftSummary(slug, body))
       io.err(line);
-    return 1;
-  }
-  io.err("");
-  const answer = await deps.prompt("Reconcile access now via the gated apply PR? You'll review the exact plan next. [y/N] ");
-  if (!isYes(answer)) {
-    io.err("");
-    io.err("Skipped — no access change was made.");
-    for (const line of renderManualApplyGuidance())
-      io.err(line);
-    return 1;
+  } else {
+    io.out("");
+    io.out(`Content committed at ${outcome.manifest_sha}; access now reconciles from that exact commit.`);
   }
   io.out("");
-  io.out("Reconciling access via `launchpad deploy --apply` …");
+  io.out(outcome?.pr === undefined ? "Reconciling access automatically via the gated apply PR …" : `Waiting for server-preopened access PR #${outcome.pr.number} to apply …`);
   let applied = false;
-  const exit = await deps.runApply({ file: manifestPath, platformRepo: null, rePin: false, yes: false }, io, { onApplied: () => {
+  const exit = await deps.runApply({
+    file: manifestPath,
+    platformRepo: null,
+    rePin: false,
+    yes: true,
+    ...outcome === undefined ? {} : { atSha: outcome.manifest_sha },
+    ...outcome?.pr === undefined ? {} : {
+      preopenedPr: {
+        number: outcome.pr.number,
+        url: outcome.pr.url,
+        headSha: outcome.pr.head_sha
+      }
+    },
+    ...outcome === undefined ? {} : { serverRecoveryActive: true }
+  }, io, { onApplied: () => {
     applied = true;
   } });
   if (applied) {
     io.out("");
-    io.out("✓ Access reconciled. Re-run `launchpad deploy` to ship your content change.");
+    io.out(outcome === undefined ? "✓ Access reconciled." : `✓ Access applied from committed manifest ${outcome.manifest_sha}.`);
     return exit;
   }
-  return exit === 0 ? 1 : exit;
-}
-
-// src/io/prompt.ts
-function isInteractive() {
-  return Boolean(process.stdin.isTTY);
-}
-async function defaultPrompt2(question) {
-  const { createInterface } = await import("node:readline/promises");
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    return await rl.question(question);
-  } finally {
-    rl.close();
+  if (outcome !== undefined && exit === 4) {
+    io.err("Access is not yet applied. The CLI timed out, but server recovery remains active for the committed exact SHA.");
   }
+  return exit === 0 ? 1 : exit;
 }
 
 // src/deploy/dry-run.ts
@@ -7188,9 +7704,8 @@ function deployUsage() {
 ` + `manifest-driven dry-run (read-only preview):
 ` + `       launchpad deploy --dry-run [--file <manifest>] [--json]
 ` + `
-` + `manifest-driven apply (runs server-side via portal-bot):
-` + `       launchpad deploy --apply [--file <manifest>] [--at <sha>] [--re-pin]
-` + "                        [--yes] [--resume-pr <n>] [--timeout-minutes <n>]";
+` + "access changes reconcile automatically (ADR 0034): plain `launchpad deploy`\n" + `detects a group change vs the deployed manifest and applies it via the gated
+` + "TF route — no separate verb. (`--apply` remains a hidden alias for one release.)";
 }
 function parseArgs3(args) {
   let message = null;
@@ -7284,26 +7799,24 @@ function surfaceDeployExtras(body, io, slug, allowStale = false) {
     if (adw.manifestOnly !== undefined && adw.manifestOnly.length > 0) {
       io.err(`         declared but NOT enforced: ${adw.manifestOnly.join(", ")}`);
     }
-    io.err(`         reconcile with \`launchpad deploy --apply\` (the gated TF route) — \`launchpad deploy\` can't (it ships content only).`);
+    io.err(`         re-run \`launchpad deploy\` to reconcile — it applies an access change automatically via the gated TF route (ADR 0034); no separate verb needed.`);
   }
 }
 function isStaleBlock(body) {
-  const code = body?.error;
-  return code === "stale_overlap" || code === "stale_unverifiable";
+  return body.error === "stale_overlap" || body.error === "stale_unverifiable";
 }
 function surfaceStaleBlock(body, io) {
-  const code = String(body.error);
-  const head = typeof body.head_sha === "string" ? body.head_sha : null;
-  if (code === "stale_overlap" && Array.isArray(body.paths)) {
+  const head = body.head_sha ?? null;
+  if (body.error === "stale_overlap" && body.paths !== undefined) {
     io.err(`launchpad deploy: BLOCKED — this deploy would roll back ${body.paths.length} file(s) a teammate changed on main since you cloned:`);
-    for (const p of body.paths.slice(0, 20)) {
-      io.err(`         - ${String(p)}`);
+    for (const path9 of body.paths.slice(0, 20)) {
+      io.err(`         - ${path9}`);
     }
     if (body.paths.length > 20) {
       io.err(`         … and ${body.paths.length - 20} more`);
     }
   } else {
-    io.err(`launchpad deploy: BLOCKED — main moved since you cloned and the overlap cannot be proven` + (typeof body.reason === "string" ? ` (${body.reason})` : "") + `; treating as unsafe.`);
+    io.err(`launchpad deploy: BLOCKED — main moved since you cloned and the overlap cannot be proven` + (body.reason === undefined ? "" : ` (${body.reason})`) + `; treating as unsafe.`);
   }
   io.err("");
   io.err("       To recover (after reconciling the listed file(s) with main):");
@@ -7469,7 +7982,7 @@ async function runModelADeploy(args) {
       return 1;
     case "upload-error": {
       const body = result.body;
-      const errorCode = typeof body.error === "string" ? body.error : "unknown_error";
+      const errorCode = body.error;
       if (result.status === 409 && errorCode === "slug_in_flight") {
         io.err(`launchpad deploy: slug "${slug}" is already provisioning.`);
         if (typeof body.message === "string") {
@@ -7495,17 +8008,42 @@ async function runModelADeploy(args) {
           manifestPath,
           body,
           io,
-          deps: {
-            interactive: isInteractive(),
-            prompt: defaultPrompt2,
-            runApply: runDeployApply
-          }
+          deps: { runApply: runDeployApply }
         });
       }
-      io.err(`launchpad deploy: bot rejected the upload (HTTP ${result.status}, ${errorCode}).`);
-      if (typeof body.message === "string") {
-        io.err(`       ${body.message}`);
-      }
+      if (errorCode === "reconcile_pending") {
+        const outcome = pendingReconcileOutcome(body);
+        if (outcome === null) {
+          io.err(`launchpad deploy: ${formatErrorEnvelope(body)}`);
+          io.err("       The CLI cannot identify the commit yet. Server recovery remains active; this command exits non-zero.");
+          return 1;
+        }
+        await advanceBaseShaMarker(cwd, outcome.manifest_sha, io);
+        const accessExit = await handleAccessDrift({
+          slug,
+          manifestPath,
+          body,
+          outcome,
+          io,
+          deps: { runApply: runDeployApply }
+        });
+        if (accessExit !== 0)
+          return accessExit;
+        io.out("");
+        io.out("Committed; build pending - Cloudflare Pages is building this deploy now.");
+        if (noVerify)
+          return 0;
+        return runDeployVerification({
+          slug,
+          cwd,
+          appType,
+          shippedSha: outcome.manifest_sha,
+          baseline: deployBaseline,
+          registrationBoundMs,
+          timeoutMs: verifyTimeoutMs
+        }, io, realVerifyDeployDeps(cfg));
+      }
+      io.err(`launchpad deploy: ${formatErrorEnvelope(body)}`);
       if (Array.isArray(body.violations)) {
         io.err("       AC8 violations:");
         for (const v of body.violations) {
@@ -7567,6 +8105,18 @@ async function runModelADeploy(args) {
         return 1;
       }
       await advanceBaseShaMarker(cwd, success.commit_sha, io);
+      if (success.reconcile !== undefined) {
+        const accessExit = await handleAccessDrift({
+          slug,
+          manifestPath,
+          body: {},
+          outcome: success.reconcile,
+          io,
+          deps: { runApply: runDeployApply }
+        });
+        if (accessExit !== 0)
+          return accessExit;
+      }
       io.out(`✓ Bundle accepted — committed as ${success.commit_sha.slice(0, 8)} on ${success.repo}`);
       io.out(`  ${result.fileCount} files (${formatBytes2(result.compressedBytes)} gzipped)`);
       if (result.workerScript !== null) {
@@ -7597,6 +8147,20 @@ async function runModelADeploy(args) {
     }
   }
 }
+function pendingReconcileOutcome(body) {
+  const manifestSha = body.manifestSha;
+  const id = body.reconcileId;
+  const state = body.state;
+  if (typeof manifestSha !== "string" || !/^[0-9a-f]{40}$/.test(manifestSha) || typeof id !== "string" || !(state === "prepared" || state === "committed" || state === "pr_open" || state === "applied" || state === "aborted")) {
+    return null;
+  }
+  return {
+    id,
+    state,
+    manifest_sha: manifestSha,
+    ...body.pr === undefined ? {} : { pr: body.pr }
+  };
+}
 
 // src/commands/redeploy.ts
 import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
@@ -8507,24 +9071,7 @@ async function loadGroups(io, refresh, json) {
     return { kind: "error", code: 2 };
   }
 }
-async function lookupTenantAware(assigned, key) {
-  const hit = findGroup(assigned, key);
-  if (hit.kind === "found") {
-    return {
-      kind: "found",
-      group: {
-        id: hit.group.id,
-        displayName: hit.group.displayName,
-        mailNickname: hit.group.mailNickname
-      }
-    };
-  }
-  if (hit.kind === "ambiguous") {
-    return {
-      kind: "ambiguous",
-      matches: hit.matches.map((g) => ({ id: g.id, displayName: g.displayName }))
-    };
-  }
+async function lookupTenantWide(key) {
   try {
     const r = await resolveGroupRefsTenant(loadConfig(), [key]);
     switch (r.kind) {
@@ -8550,7 +9097,7 @@ async function lookupTenantAware(assigned, key) {
         return { kind: "not-found" };
       }
       case "error":
-        return { kind: "error", message: r.message };
+        return { kind: "error", message: r.message, ...r.envelope === undefined ? {} : { envelope: r.envelope } };
     }
   } catch (e) {
     if (e instanceof UnauthenticatedError)
@@ -8579,7 +9126,15 @@ function renderLookupFailure(io, json, hit) {
     return 3;
   }
   if (hit.kind === "error") {
-    renderFetchError(io, hit.message, json);
+    if (hit.envelope !== undefined) {
+      if (json) {
+        io.out(JSON.stringify(errorEnvelopeJson(hit.envelope)));
+      } else {
+        io.err(`launchpad groups: ${formatErrorEnvelope(hit.envelope)}`);
+      }
+    } else {
+      renderFetchError(io, hit.message, json);
+    }
     return 2;
   }
   if (hit.kind === "ineligible") {
@@ -8694,10 +9249,7 @@ async function runShow(args, io) {
     return 64;
   }
   const key = parsed.flags.positional[0];
-  const load = await loadGroups(io, parsed.flags.refresh, parsed.flags.json);
-  if (load.kind === "error")
-    return load.code;
-  const hit = await lookupTenantAware(load.result.groups, key);
+  const hit = await lookupTenantWide(key);
   const failure = renderLookupFailure(io, parsed.flags.json, hit);
   if (failure !== null)
     return failure;
@@ -8746,10 +9298,7 @@ async function runResolve(args, io) {
     return 64;
   }
   const key = parsed.flags.positional[0];
-  const load = await loadGroups(io, parsed.flags.refresh, parsed.flags.json);
-  if (load.kind === "error")
-    return load.code;
-  const hit = await lookupTenantAware(load.result.groups, key);
+  const hit = await lookupTenantWide(key);
   const failure = renderLookupFailure(io, parsed.flags.json, hit);
   if (failure !== null)
     return failure;
@@ -8969,7 +9518,7 @@ var SLUG_REGEX3 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var initCommand = {
   name: "init",
   summary: "scaffold a new launchpad.yaml in the current directory",
-  run: (args, io) => runInit(args, io, defaultPrompt3)
+  run: (args, io) => runInit(args, io, defaultPrompt2)
 };
 async function runInit(args, io, prompt) {
   const parsed = parseArgs6(args);
@@ -9459,7 +10008,7 @@ function ensureGitignoreEntries(path10, entries) {
   }
   return added;
 }
-async function defaultPrompt3(question, fallback) {
+async function defaultPrompt2(question, fallback) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     const suffix = fallback !== undefined ? ` [${fallback}]` : "";
@@ -10140,7 +10689,7 @@ import { stdin as input, stdout as output } from "node:process";
 var destroyCommand = {
   name: "destroy",
   summary: "tear down a Launchpad app (owner-only, destructive)",
-  run: (args, io) => runDestroy(args, io, defaultPrompt4, defaultIsTty)
+  run: (args, io) => runDestroy(args, io, defaultPrompt3, defaultIsTty)
 };
 var SLUG_RE10 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var SLUG_MIN_LENGTH = 3;
@@ -10372,7 +10921,7 @@ function renderBotError2(status, env, slug, io) {
       io.err(`launchpad destroy: bot returned HTTP ${status} (error=${errorCode}): ${message}`);
   }
 }
-async function defaultPrompt4(question) {
+async function defaultPrompt3(question) {
   const rl = createInterface2({ input, output });
   try {
     return await rl.question(question);
@@ -11041,7 +11590,7 @@ async function runRollback(opts, io, deps = {}) {
   io.out(`Rollback target: ${verifiedSha.slice(0, 12)} (${manifestRelpath})`);
   renderDiff(current, parsed.manifest, io);
   if (!opts.yes) {
-    const prompt = deps.prompt ?? defaultPrompt5;
+    const prompt = deps.prompt ?? defaultPrompt4;
     if (!process.stdin.isTTY && deps.prompt === undefined) {
       io.err("launchpad rollback: refusing to rollback non-interactively without --yes.");
       return 64;
@@ -11129,7 +11678,7 @@ function formatHostnames(hs) {
     return hs[0];
   return `[${hs.join(", ")}]`;
 }
-async function defaultPrompt5(question) {
+async function defaultPrompt4(question) {
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     return await rl.question(question);
@@ -11436,7 +11985,7 @@ async function offerRedeploy(slug, opts, io, deps) {
   const isTty = (deps.isTty ?? (() => process.stdin.isTTY === true))();
   let doRedeploy = wantsAuto;
   if (!wantsAuto && isTty) {
-    const prompt = deps.prompt ?? defaultPrompt6;
+    const prompt = deps.prompt ?? defaultPrompt5;
     let answer;
     try {
       answer = (await prompt(`Redeploy ${slug} now to activate? [y/N] `)).trim().toLowerCase();
@@ -11457,7 +12006,7 @@ async function offerRedeploy(slug, opts, io, deps) {
   };
   return run({ slug, file: opts.file ?? null, verify: true, verifyTimeoutMs: 180000 }, io, rdeps);
 }
-async function defaultPrompt6(question) {
+async function defaultPrompt5(question) {
   const rl = createInterface4({ input: input2, output: output2 });
   try {
     return await rl.question(question);
@@ -13025,7 +13574,11 @@ async function checkGroup(allowedGroup, cfg) {
         }
         return { kind: "not-found", key: allowedGroup };
       case "error":
-        return { kind: "network", message: r.message };
+        return {
+          kind: "network",
+          message: r.message,
+          ...r.envelope === undefined ? {} : { envelope: r.envelope }
+        };
     }
   } catch (e) {
     if (e instanceof UnauthenticatedError) {
@@ -13100,7 +13653,7 @@ function renderHumanOk(result, group, boundary, io) {
       io.err(`  The session is valid but lacks permission for /groups; talk to the platform team.`);
       return 3;
     case "network":
-      io.err(`✗ --strict-groups failed to reach the bot: ${group.message}`);
+      io.err(group.envelope === undefined ? `✗ --strict-groups failed to reach the bot: ${group.message}` : `✗ --strict-groups: ${formatErrorEnvelope(group.envelope)}`);
       return 2;
   }
 }
@@ -13176,11 +13729,11 @@ function renderJsonOk(result, group, boundary, io) {
       }));
       return 3;
     case "network":
-      io.out(JSON.stringify({
+      io.out(JSON.stringify(group.envelope === undefined ? {
         ok: false,
         ...base,
         group: { kind: "network", message: group.message }
-      }));
+      } : { ok: false, ...base, ...errorEnvelopeJson(group.envelope) }));
       return 2;
   }
 }