@m-kopa/launchpad-cli 0.51.0 → 0.52.0

package/CHANGELOG.md

@@ -8,6 +8,16 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.52.0 - 2026-07-18
+
+**Server-authoritative manifest apply completion.**
+
+- A deploy now attaches directly to the exact server-opened apply PR and head SHA.
+  It never creates a second apply attempt for the same durable reconcile intent, and an identity mismatch remains a hard protocol error that names both sides.
+- `launchpad merge` accepts `--repo app|platform`, fails closed when the same PR number exists in both repositories, and explains that attested platform apply PRs are auto-managed.
+- Manifest status treats the registry's successfully applied manifest SHA as primary deployed provenance, so per-app-workspace apps report a real deployed SHA without relying on legacy flat Terraform metadata.
+- Bot-side apply completion now uses an append-only attempt ledger, exact PR and check evidence, one atomic provenance transition, webhook-first completion, sweep fallback, and fresh per-attempt branches cut from platform `main`.
+
 ## 0.51.0 - 2026-07-17
 
 **Self-serve recovery rendering + honest guidance.**

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.51.0";
+var CLI_VERSION = "0.52.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -6777,6 +6777,31 @@ async function runDeployApply(opts, io, deps = {}) {
     io.err(`launchpad deploy --apply: --at expects a 40-char lowercase hex git SHA, got '${opts.atSha}'`);
     return 64;
   }
+  if (opts.preopenedPr !== undefined) {
+    if (opts.atSha === undefined) {
+      io.err("launchpad deploy --apply: server-preopened apply attachment requires its exact manifest SHA");
+      return 2;
+    }
+    io.out(`Attaching to server-preopened apply PR #${opts.preopenedPr.number} ` + `at head ${opts.preopenedPr.headSha}.`);
+    const outcome2 = await pollUntilApplied({
+      slug,
+      manifestSha: opts.atSha,
+      prNumber: opts.preopenedPr.number,
+      expectedHeadSha: opts.preopenedPr.headSha,
+      cfg,
+      io,
+      fetcher,
+      pollIntervalSec,
+      timeoutMs
+    });
+    if (outcome2.kind !== "applied") {
+      return outcomeToExit(outcome2, opts.preopenedPr.url, io);
+    }
+    deletePinIfPresent(cfg, slug, io);
+    io.out(`✓ Applied ${slug} from PR #${opts.preopenedPr.number}.`);
+    deps.onApplied?.();
+    return 0;
+  }
   io.out(opts.atSha !== undefined ? `Planning apply for ${slug} @ ${opts.atSha.slice(0, 7)} (managed repo) …` : `Planning apply for ${slug} (bot resolves managed main HEAD) …`);
   let plan;
   try {
@@ -6817,9 +6842,6 @@ async function runDeployApply(opts, io, deps = {}) {
       return 0;
     }
   }
-  if (opts.preopenedPr !== undefined) {
-    io.out(`Server already opened exact-SHA apply PR #${opts.preopenedPr.number}; ` + "confirming it idempotently before polling.");
-  }
   let apply;
   try {
     apply = await apiJson(cfg, {
@@ -6834,10 +6856,6 @@ async function runDeployApply(opts, io, deps = {}) {
     io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/apply: ` + `requested ${manifestSha}, received ${String(apply.manifestSha)}`);
     return 2;
   }
-  if (opts.preopenedPr !== undefined && apply.prNumber !== opts.preopenedPr.number) {
-    io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/apply: ` + `server-preopened PR #${opts.preopenedPr.number}, received #${apply.prNumber}`);
-    return 2;
-  }
   io.out("");
   io.out(`PR opened: ${apply.prUrl}`);
   io.out(`Branch:    ${apply.branch}`);
@@ -6896,6 +6914,13 @@ async function pollUntilApplied(args) {
             await sleep(args.pollIntervalSec * 1000);
             continue;
           }
+          if (args.expectedHeadSha !== undefined) {
+            breakDots();
+            return {
+              kind: "transport",
+              reason: "the bot cannot verify the exact server-preopened apply attempt"
+            };
+          }
           breakDots();
           args.io.err("! bot has no apply-status endpoint yet — falling back to the coarse merge-poll (upgrade pending bot deploy)");
           mode = "legacy";
@@ -6916,6 +6941,13 @@ async function pollUntilApplied(args) {
           reason: `protocol failure from /apps/${args.slug}/manifest/apply-status: ` + `requested ${args.manifestSha}, received ${status.manifestSha}`
         };
       }
+      if (args.expectedHeadSha !== undefined && (status.prNumber !== args.prNumber || status.headSha !== args.expectedHeadSha)) {
+        breakDots();
+        return {
+          kind: "transport",
+          reason: `server-preopened PR #${args.prNumber} head ${args.expectedHeadSha}, ` + `received PR #${status.prNumber} head ${String(status.headSha)}`
+        };
+      }
       if (status.state === "applied") {
         breakDots();
         return { kind: "applied" };
@@ -10337,7 +10369,7 @@ var HANDLED_STATUSES = [409, 422, 502, 503];
 async function runMerge(args, io) {
   const parsed = parseArgs8(args);
   if (parsed === null) {
-    io.err(`usage: launchpad merge <prNumber> [--slug <slug>]
+    io.err(`usage: launchpad merge <prNumber> [--slug <slug>] [--repo app|platform]
 ` + "       (prNumber is required; slug defaults to the cwd's `launchpad-app-<slug>` suffix)");
     return 64;
   }
@@ -10362,7 +10394,7 @@ async function runMerge(args, io) {
     io.out(`Merging PR #${parsed.prNumber} on ${slug} …`);
     const res = await apiRaw(cfg, {
       method: "POST",
-      path: `/apps/${slug}/merge/${parsed.prNumber}`,
+      path: `/apps/${slug}/merge/${parsed.prNumber}` + (parsed.repository === null ? "" : `?repository=${parsed.repository}`),
       nonThrowingStatuses: [...HANDLED_STATUSES]
     });
     if (res.ok) {
@@ -10416,6 +10448,7 @@ async function runMerge(args, io) {
 }
 function parseArgs8(args) {
   let slug = null;
+  let repository = null;
   let prNumber = null;
   let i = 0;
   while (i < args.length) {
@@ -10428,6 +10461,14 @@ function parseArgs8(args) {
       i += 2;
       continue;
     }
+    if (a === "--repo") {
+      const value = args[i + 1];
+      if (value !== "app" && value !== "platform")
+        return null;
+      repository = value;
+      i += 2;
+      continue;
+    }
     if (/^\d+$/.test(a)) {
       if (prNumber !== null)
         return null;
@@ -10442,7 +10483,7 @@ function parseArgs8(args) {
   }
   if (prNumber === null)
     return null;
-  return { slug, prNumber };
+  return { slug, prNumber, repository };
 }
 function renderBotError(status, env, io, prNumber = null) {
   const code = env?.error ?? "unknown";
@@ -10479,6 +10520,12 @@ function renderBotError(status, env, io, prNumber = null) {
     case "pipeline_unavailable":
       io.err("launchpad merge: no review state recorded for this PR — push a commit to trigger the workflow, or wait for the first event.");
       return;
+    case "platform_apply_auto_managed":
+      io.err("launchpad merge: this platform apply PR is auto-managed; inspect `launchpad status` or apply status.");
+      return;
+    case "merge_pr_ambiguous":
+      io.err("launchpad merge: that PR number exists in both repositories; pass `--repo app` or `--repo platform`.");
+      return;
     case "credential_unavailable":
       io.err("launchpad merge: bot credential is temporarily unavailable — retry in a moment.");
       return;

package/dist/commands/merge.d.ts

@@ -6,6 +6,7 @@ export declare const mergeCommand: Command;
 interface MergeArgs {
     readonly slug: string | null;
     readonly prNumber: number;
+    readonly repository: "app" | "platform" | null;
 }
 /**
  * Parse the merge verb's args. Returns null on malformed argv. The

package/dist/commands/merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/commands/merge.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAa,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAI9D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5B,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,YAAY,EAAE,OAI1B,CAAC;AAEF,UAAU,SAAS;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA8GD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CA8BnE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAC5B,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC7B,IAAI,CA4EN"}
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/commands/merge.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAa,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAI9D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5B,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,YAAY,EAAE,OAI1B,CAAC;AAEF,UAAU,SAAS;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;CAChD;AAkHD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAsCnE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAC5B,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC7B,IAAI,CAsFN"}

package/dist/deploy/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/deploy/apply.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;oEAGgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAwCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAmOnB"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/deploy/apply.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;oEAGgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAwCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAoPnB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.51.0";
+export declare const CLI_VERSION = "0.52.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.51.0
+version: 0.52.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->