@m-kopa/launchpad-cli 0.52.0 → 0.53.0

package/dist/clone/base-sha-marker.d.ts

@@ -10,9 +10,8 @@ export declare function isValidBaseSha(value: string): boolean;
  * is excluded from the deploy bundle via `.git/info/exclude`. Call this
  * AFTER the initial commit so the marker is never committed.
  *
- * Throws on I/O failure — the caller decides whether a stamp failure is
- * fatal (it is not: an unstamped clone is simply un-guarded, the same
- * as a clone taken from a pre-provenance bot).
+ * Throws on I/O failure. Clone treats persistence as mandatory, while
+ * deploy callers surface marker-advance failures without hiding them.
  */
 export declare function writeBaseShaMarker(cwd: string, sha: string): Promise<void>;
 /**
@@ -22,4 +21,14 @@ export declare function writeBaseShaMarker(cwd: string, sha: string): Promise<vo
  * "no baseline to compare against".
  */
 export declare function readBaseShaMarker(cwd: string): Promise<string | null>;
+export type BaseShaMarkerState = {
+    readonly kind: "valid";
+    readonly sha: string;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "malformed";
+};
+/** Distinguish missing provenance from malformed, explicitly untrusted state. */
+export declare function readBaseShaMarkerState(cwd: string): Promise<BaseShaMarkerState>;
 //# sourceMappingURL=base-sha-marker.d.ts.map

package/dist/clone/base-sha-marker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-sha-marker.d.ts","sourceRoot":"","sources":["../../src/clone/base-sha-marker.ts"],"names":[],"mappings":"AA6BA,kEAAkE;AAClE,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAEtD,qEAAqE;AACrE,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,2DAA2D;AAC3D,eAAO,MAAM,cAAc,wBAA2B,CAAC;AAQvD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS3E"}
+{"version":3,"file":"base-sha-marker.d.ts","sourceRoot":"","sources":["../../src/clone/base-sha-marker.ts"],"names":[],"mappings":"AA6BA,kEAAkE;AAClE,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAEtD,qEAAqE;AACrE,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,2DAA2D;AAC3D,eAAO,MAAM,cAAc,wBAA2B,CAAC;AAQvD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS3E;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnC,iFAAiF;AACjF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CAU7B"}

package/dist/clone/tar-extract.d.ts

@@ -47,6 +47,8 @@ export interface ExtractOptions {
      * peel that prefix.
      */
     readonly stripComponents?: number;
+    /** Permit extraction into a controlled non-empty staging directory. */
+    readonly allowNonEmpty?: boolean;
 }
 /**
  * Stream-extract a gzipped tarball into `destDir`. Creates the

package/dist/clone/tar-extract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tar-extract.d.ts","sourceRoot":"","sources":["../../src/clone/tar-extract.ts"],"names":[],"mappings":"AA2BA;;iCAEiC;AACjC,eAAO,MAAM,cAAc,QAAkB,CAAC;AAC9C,6DAA6D;AAC7D,eAAO,MAAM,eAAe,OAAO,CAAC;AAGpC,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B;;;;+DAI2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;CAChD;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;CAC3C;AAED;;;wBAGwB;AACxB,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;CAClD;AAED;;;;;GAKG;AACH,wBAAuB,kBAAkB,CACvC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAC/B,cAAc,CAAC,QAAQ,CAAC,CAiH1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAChC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,YAAY,CAAC,CA4CvB"}
+{"version":3,"file":"tar-extract.d.ts","sourceRoot":"","sources":["../../src/clone/tar-extract.ts"],"names":[],"mappings":"AA2BA;;iCAEiC;AACjC,eAAO,MAAM,cAAc,QAAkB,CAAC;AAC9C,6DAA6D;AAC7D,eAAO,MAAM,eAAe,OAAO,CAAC;AAGpC,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B;;;;+DAI2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;CAChD;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;CAC3C;AAED;;;wBAGwB;AACxB,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;CAClD;AAED;;;;;GAKG;AACH,wBAAuB,kBAAkB,CACvC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAC/B,cAAc,CAAC,QAAQ,CAAC,CAiH1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAChC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,YAAY,CAAC,CA4CvB"}

package/dist/commands/deploy-flags.d.ts

@@ -10,6 +10,8 @@ export type DeployMode = {
     /** sp-vmj0j0 AC7 — in-place typed override: must echo the head SHA
      *  (≥7-char prefix) from the block. Null = not supplied. */
     readonly overrideStale: string | null;
+    /** Explicit compatibility path for a non-clone tree with no baseline. */
+    readonly allowUnguarded: boolean;
 } | {
     readonly kind: "new";
     readonly slug: string;

package/dist/commands/deploy-flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;gEAC4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CAqX9E"}
+{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;gEAC4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CAqY9E"}

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAsEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAc/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAgMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAsEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAc/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAgRD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/commands/pull.d.ts

@@ -5,6 +5,8 @@ interface PullArgs {
     readonly out: string | null;
     /** `--status`: pull the role-redacted status block instead of the spec manifest. */
     readonly status: boolean;
+    readonly manifest: boolean;
+    readonly bootstrap: boolean;
 }
 /** Pure arg parser. Returns parsed shape or human-readable error string. */
 export declare function parseArgs(args: readonly string[], cwd?: string, warn?: (line: string) => void): PullArgs | string;

package/dist/commands/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,UAAU,QAAQ;IAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAyID,4EAA4E;AAC5E,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,QAAQ,GAAG,MAAM,CA8DnB"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAGjE,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,UAAU,QAAQ;IAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAmJD,4EAA4E;AAC5E,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAsB,EAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B,QAAQ,GAAG,MAAM,CA6EnB"}

package/dist/pull/source-sync.d.ts

@@ -0,0 +1,11 @@
+import type { CliConfig } from "../config.js";
+import type { CliIo, ExitCode } from "../dispatcher.js";
+/** Reconcile one clone from recorded base to current managed main. */
+export declare function runSourceSync(args: {
+    readonly cfg: CliConfig;
+    readonly cwd: string;
+    readonly slug: string;
+    readonly io: CliIo;
+    readonly bootstrap?: boolean;
+}): Promise<ExitCode>;
+//# sourceMappingURL=source-sync.d.ts.map

package/dist/pull/source-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-sync.d.ts","sourceRoot":"","sources":["../../src/pull/source-sync.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AA2DxD,sEAAsE;AACtE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoDpB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.52.0";
+export declare const CLI_VERSION = "0.53.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.52.0
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -224,7 +224,7 @@ for after a deploy:
   confirm the outcome.
 - **`drift: <fields>`** — your local manifest diverges from what's
   deployed. Either re-run `launchpad deploy` to ship the local, or
-  `launchpad pull <slug> --out launchpad.yaml` to bring the local
+  `launchpad pull --manifest <slug> --out launchpad.yaml` to bring the local
   into line with deployed.
 - **provisioning / failed / destroy states** — route to
   `/launchpad-deploy-status` or `/launchpad-destroy`.
@@ -259,7 +259,7 @@ Once you've shipped first content, the daily-use verbs are:
 - **`launchpad status`** (`/launchpad-status`) — is my local
   `launchpad.yaml` in sync with what's deployed, and did the last
   build succeed?
-- **`launchpad pull <slug>`** (`/launchpad-status`) — read the
+- **`launchpad pull --manifest <slug>`** (`/launchpad-status`) - read the
   currently-deployed `launchpad.yaml`.
 - **`launchpad deploy`** — bundle the working tree; the bot commits
   it directly to the app repo's `main`.

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.52.0
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -63,6 +63,13 @@ static · react · react+api · container
 
 ## Pre-flight
 
+When deploying from a clone that may be stale, run `launchpad pull` first.
+It applies clean upstream changes, preserves local work, and writes upstream
+artifacts under `.launchpad/pull-conflicts/` for conflicts.
+Resolve those paths and rerun pull before deploying.
+Use `--allow-unguarded` only for an intentional non-clone directory with no
+source marker; it disables staleness protection for that deploy and is audited.
+
 ```bash
 launchpad whoami
 ```

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.52.0
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -59,7 +59,7 @@ inference source resolves.
 | Watch a first deploy provision to live in real time | `launchpad watch <slug>` — see § Watch below |
 | Is my local manifest in sync with what's deployed? | `launchpad status <slug>` |
 | What lifecycle bucket is the app in? | `launchpad apps` |
-| What was actually deployed? | `launchpad pull <slug>` |
+| What was actually deployed? | `launchpad pull --manifest <slug>` |
 | Is the app stuck in the legacy M-892 zero-touch flow? | See § Legacy below |
 | What broke the most recent deploy? | `launchpad status <slug> --json` + the bot's PR check trail |
 | It says `failed` but the app is live in a browser | `launchpad recover <slug>` — see § Recover below |
@@ -199,7 +199,7 @@ Next steps:
   Edit ./launchpad.yaml to resolve the differences, then run
   `launchpad deploy` to roll it out.
 
-  Or run `launchpad pull demo-9 --out deployed.yaml` to bring your
+  Or run `launchpad pull --manifest demo-9 --out deployed.yaml` to bring your
   local manifest into line with what's deployed.
 ```
 

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.52.0
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -373,7 +373,7 @@ On an idempotent re-run against a `destroyed` slug:
 ## Related skills
 
 - **`/launchpad-status`** — read the deployed manifest, compare to
-  local. Pair this with `launchpad pull <slug> --out backup.yaml`
+  local. Pair this with `launchpad pull --manifest <slug> --out backup.yaml`
   before destroy if you want to keep the manifest for reference.
 - **`/launchpad-deploy`** — provision a new app via `launchpad init`
   + `launchpad deploy` (e.g. after a destroy that frees the slug).

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.52.0
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.52.0
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -43,6 +43,11 @@ trigger `launchpad login` and suggest installs). The other skills
 `/launchpad-identity`) assume the machine is already onboarded and fail
 loudly if a prereq is missing — pointing back here.
 
+After `launchpad clone <slug>`, refresh that same directory with bare
+`launchpad pull`.
+Do not recommend rename-and-reclone recovery for ordinary staleness.
+The old deployed-manifest read is now `launchpad pull --manifest <slug>`.
+
 ## Zero non-Launchpad dependencies
 
 Under Model A (M-1216), the CLI is fully self-contained: it signs in

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.52.0
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
-description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.52.0
+description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
+version: 0.53.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -30,8 +30,8 @@ esac
 
 # /launchpad-status
 
-Read-only verbs. Zero local platform-repo / terraform / GitHub
-credentials needed. Both go through the bot's `/manifest/state`
+Launchpad-native source and status verbs. Zero local platform-repo /
+terraform / GitHub credentials needed. Manifest reads go through the bot's `/manifest/state`
 endpoint; the bot reads launchpad-platform's TF state to find the
 last-applied manifest sha, then fetches launchpad.yaml from the app
 repo at that sha. `launchpad status` additionally reads the bot's
@@ -42,7 +42,10 @@ is a thin client.
 
 ## When to use which verb
 
-- **`launchpad pull <slug>`** — read the deployed `launchpad.yaml`.
+- **Bare `launchpad pull` inside a clone** - reconcile source from managed
+  `main` without overwriting local work. Conflicts keep the original and write
+  an upstream artifact under `.launchpad/pull-conflicts/`.
+- **`launchpad pull --manifest <slug>`** - read the deployed `launchpad.yaml`.
   Use when you want to see what's actually running, or when you need
   a starting point for editing a manifest.
 - **`launchpad status [<slug>] [--strict] [--json]`** — compare local
@@ -53,7 +56,7 @@ is a thin client.
 If the operator is asking "did my deploy work" → `launchpad status`
 inside the app repo's clone is the answer.
 
-If they're asking "what was actually deployed" → `launchpad pull` is
+If they're asking "what was actually deployed" → `launchpad pull --manifest` is
 the answer.
 
 ## Pre-flight
@@ -75,7 +78,7 @@ Both verbs are owner/editor-scoped — non-members get HTTP 403 with
 Both verbs accept the slug four ways, with this precedence:
 
 1. **`--slug <slug>`** — explicit, wins over everything.
-2. **Positional argument** — `launchpad pull horizon-clone`.
+2. **Positional argument** - `launchpad pull --manifest horizon-clone`.
 3. **Local manifest inference** — the slug declared by
    `./launchpad.yaml` (or `--file` on `launchpad status`); v1
    `metadata.name` / v2 `metadata.slug`. Works from any directory
@@ -90,22 +93,26 @@ If `launchpad status` has a slug but NO local manifest exists, it does
 not error: it renders the live-truth-only view (lifecycle + deployment;
 drift not checked) and exits 0.
 
-## `launchpad pull`
+## `launchpad pull` source sync and manifest read
 
 ```bash
 # Write deployed launchpad.yaml to stdout
-launchpad pull horizon
+launchpad pull --manifest horizon
 
 # Write to a file
-launchpad pull horizon --out /tmp/deployed.yaml
+launchpad pull --manifest horizon --out /tmp/deployed.yaml
 
-# Inside an app-repo clone — slug inferred from cwd
+# Inside an app-repo clone, refresh source safely
 launchpad clone horizon
 cd launchpad-app-horizon
 launchpad pull
 
+# Legacy markerless clone: only succeeds when the clean synthetic baseline
+# exactly matches current managed main
+launchpad pull --bootstrap
+
 # Read the role-redacted status block instead of the spec manifest
-launchpad pull horizon --status
+launchpad pull --manifest horizon --status
 ```
 
 Exit codes:
@@ -371,4 +378,4 @@ CI.
 
 ## Version
 
-This skill ships in launchpad-cli v0.13.0+ (M-1188 release).
+This skill ships in launchpad-cli v0.53.0+.