@m-kopa/launchpad-cli 0.54.0 → 0.54.1

package/CHANGELOG.md

@@ -8,6 +8,14 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.54.1 - 2026-07-29
+
+**Deleted application files now stay deleted after deployment.**
+
+- The legacy clone deploy path excludes tracked files that no longer exist in the working tree, allowing the server to derive their deletion from the complete upload.
+- The platform applies updates and proved app-owned deletions in one Git tree while preserving governance, workflow, ownership, Wrangler, Launchpad metadata, and out-of-boundary files.
+- The server uses exact managed-tree enumeration before absence can authorize deletion and returns a retryable failure when that proof is unavailable.
+
 ## 0.54.0 - 2026-07-19
 
 **Server-visible CLI compatibility, with dormant minimum-version enforcement.**

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.54.0";
+var CLI_VERSION = "0.54.1";
 
 // src/config.ts
 import * as os from "node:os";
@@ -1867,7 +1867,7 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
@@ -2657,6 +2657,7 @@ var ManifestSchema = z.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z.boolean().optional(),
+  origin: z.enum(["pages", "dispatch"]).optional(),
   catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional(),
   sensitive: z.boolean().optional()
 }).strict().superRefine((m, ctx) => {
@@ -3047,7 +3048,9 @@ var PLATFORM_SEEDED_GITHUB_PATHS = new Set([
   ".github/scripts/parse-tsc.mjs",
   ".github/scripts/parse-vitest.mjs",
   ".github/scripts/parse-gitleaks.mjs",
-  ".github/scripts/parse-bun-audit.mjs"
+  ".github/scripts/parse-bun-audit.mjs",
+  ".github/scripts/parse-html-validate.mjs",
+  ".github/scripts/parse-hadolint.mjs"
 ]);
 function checkDenyList(path7) {
   const segments = path7.split("/");
@@ -3290,6 +3293,7 @@ var SpecSchema = z2.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z2.boolean().optional(),
+  origin: z2.enum(["pages", "dispatch"]).optional(),
   sensitive: z2.boolean().optional(),
   catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
   env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
@@ -3335,6 +3339,43 @@ var SpecSchema = z2.object({
       });
     }
   }
+  if (s.origin === "dispatch") {
+    if (isContainer) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["origin"],
+        message: "origin: dispatch is not available for container apps — they run on the container runtime (ADR 0015/0016), not in a Workers dispatch namespace."
+      });
+    }
+    if ((s.auth ?? "access") !== "gateway") {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["origin"],
+        message: "origin: dispatch requires an explicit auth: gateway (auth defaults to 'access' when omitted). A dispatch-namespace Worker has no public hostname for Cloudflare Access to gate, so the gateway must be the sole gate."
+      });
+    }
+    if (s.confine_origin !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
+      });
+    }
+    if (s.env_vars !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["env_vars"],
+        message: "env_vars are not yet supported with origin: dispatch — a dispatch workspace has no Pages module to apply them, and accepting them here would silently drop them. Worker-level vars land with the v2 deploy path."
+      });
+    }
+    if (s.build !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["build"],
+        message: "build is not yet supported with origin: dispatch — a dispatch workspace has no Pages module to carry it, and the v2 deploy path that will consume it is not shipped yet. Accepting it here would silently drop it."
+      });
+    }
+  }
   if (!isContainer && s.containers !== undefined) {
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
@@ -6185,6 +6226,8 @@ import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 
 class GitFilesError extends Error {
   code = "git_files_error";
@@ -6202,6 +6245,7 @@ var PROTECTED_PATHS = new Set([
 ]);
 async function listDeployFiles(opts) {
   const sp = opts.spawner ?? spawn3;
+  const exists = opts.exists ?? existsSync5;
   const stdout = await runGit2(sp, opts.cwd, [
     "ls-files",
     "-c",
@@ -6209,11 +6253,11 @@ async function listDeployFiles(opts) {
     "--exclude-standard",
     "-z"
   ]);
-  const paths = stdout.split("\x00").filter((p) => p.length > 0 && !PROTECTED_PATHS.has(p));
+  const paths = stdout.split("\x00").filter((p) => p.length > 0 && exists(resolve7(opts.cwd, p)) && !PROTECTED_PATHS.has(p));
   return [...paths].sort();
 }
 function runGit2(sp, cwd, args) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const spawnOpts = { cwd, stdio: ["ignore", "pipe", "pipe"] };
     const child = sp("git", [...args], spawnOpts);
     let stdout = "";
@@ -6229,7 +6273,7 @@ function runGit2(sp, cwd, args) {
     });
     child.once("close", (code) => {
       if (code === 0) {
-        resolve7(stdout);
+        resolve8(stdout);
         return;
       }
       reject(new GitFilesError(`\`git ${args.join(" ")}\` exited ${code}: ${stderr.trim()}`));
@@ -6806,7 +6850,7 @@ function parseDeployFlags(args) {
 }
 
 // src/deploy/apply.ts
-import { existsSync as existsSync5, rmSync } from "node:fs";
+import { existsSync as existsSync6, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
@@ -7173,7 +7217,7 @@ function sleep(ms) {
 }
 function deletePinIfPresent(cfg, slug, io) {
   const pinPath = join10(cfg.stateDir, slug, "group.json");
-  if (!existsSync5(pinPath))
+  if (!existsSync6(pinPath))
     return;
   try {
     rmSync(pinPath, { force: true });
@@ -7311,12 +7355,12 @@ async function handleAccessDrift(params) {
 
 // src/deploy/dry-run.ts
 import { execFileSync } from "node:child_process";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var MANIFEST_SHA_REGEX2 = /^[0-9a-f]{40}$/;
 async function runDeployDryRun(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
-  const manifestPath = resolve7(process.cwd(), opts.file ?? "launchpad.yaml");
+  const manifestPath = resolve8(process.cwd(), opts.file ?? "launchpad.yaml");
   const loaded = loadManifest(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError2(loaded, opts.json, io);
@@ -7726,7 +7770,7 @@ async function runDeploy(args, io) {
   }
   const cwd = process.cwd();
   const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync6(manifestPath)) {
+  if (existsSync7(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : {
       allowStale: false,
       rebaseOntoHead: false,
@@ -7780,7 +7824,7 @@ async function runDeploy(args, io) {
     }
     let contentManifestYaml = null;
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync6(contentManifestPath)) {
+    if (existsSync7(contentManifestPath)) {
       try {
         contentManifestYaml = readFileSync10(contentManifestPath, "utf8");
       } catch {
@@ -8003,11 +8047,11 @@ function surfaceStaleBlock(body, io) {
 }
 var MANIFEST_DIFF_READ_TIMEOUT_MS = 5000;
 function withTimeout(p, ms) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const timer = setTimeout(() => reject(new Error(`manifest read timed out after ${ms}ms`)), ms);
     p.then((v) => {
       clearTimeout(timer);
-      resolve8(v);
+      resolve9(v);
     }, (e) => {
       clearTimeout(timer);
       reject(e instanceof Error ? e : new Error(String(e)));
@@ -8366,7 +8410,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -8444,7 +8488,7 @@ async function runRedeploy(opts, io, deps = {}) {
 }
 function readLocalAppType(cwd, file) {
   const manifestPath = resolvePath2(cwd, file ?? "launchpad.yaml");
-  if (!existsSync7(manifestPath))
+  if (!existsSync8(manifestPath))
     return null;
   try {
     const obj = parseYaml7(readFileSync11(manifestPath, "utf8"));
@@ -8732,7 +8776,7 @@ function describe16(e) {
 
 // src/commands/generate.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, resolve as resolve8, relative as relative3 } from "node:path";
+import { dirname as dirname6, resolve as resolve9, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
   summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
@@ -8745,14 +8789,14 @@ async function runGenerate(args, io) {
     io.err("Usage: launchpad generate [--file <path>] [--dry-run] [--force] [--json]");
     return 64;
   }
-  const manifestPath = resolve8(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
   const appRoot = dirname6(manifestPath);
-  const wranglerPath = resolve8(appRoot, "container", "wrangler.toml");
-  const workflowPath = resolve8(appRoot, ".github", "workflows", "deploy.yml");
+  const wranglerPath = resolve9(appRoot, "container", "wrangler.toml");
+  const workflowPath = resolve9(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
   const workflowOut = generateGithubDeployWorkflow(result.manifest);
   if (flags.dryRun) {
@@ -9557,17 +9601,17 @@ function describe19(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname7, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname7, resolve as resolve10 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13, statSync } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13, statSync } from "node:fs";
 import { join as join12 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync8(join12(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync8(join12(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync8(join12(cwd, n)));
+  const hasPackageJson = existsSync9(join12(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join12(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join12(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -9613,7 +9657,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync8(join12(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync9(join12(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -9636,7 +9680,7 @@ function detectPackageManager(cwd) {
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
     const p = join12(cwd, name);
-    if (existsSync8(p)) {
+    if (existsSync9(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -9648,7 +9692,7 @@ function detectVitePresence(cwd) {
 function detectAppType(cwd) {
   const fnDir = join12(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync8(fnDir)) {
+  if (existsSync9(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -9659,7 +9703,7 @@ function detectAppType(cwd) {
 }
 function detectBuildCommand(cwd, pm) {
   const pkgJsonPath = join12(cwd, "package.json");
-  if (!existsSync8(pkgJsonPath)) {
+  if (!existsSync9(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -9731,8 +9775,8 @@ async function runInit(args, io, prompt) {
     return 64;
   }
   const { inputs, options } = parsed;
-  const outPath = resolve9(process.cwd(), options.out);
-  if (existsSync9(outPath) && !options.force) {
+  const outPath = resolve10(process.cwd(), options.out);
+  if (existsSync10(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -9779,7 +9823,7 @@ async function runInit(args, io, prompt) {
   }
   io.out(`✓ wrote ${outPath}`);
   if (options.gitignore) {
-    const gitignorePath = resolve9(process.cwd(), ".gitignore");
+    const gitignorePath = resolve10(process.cwd(), ".gitignore");
     try {
       const changed = ensureGitignoreEntries(gitignorePath, [".env", ".env.local"]);
       if (changed.length > 0) {
@@ -9794,9 +9838,9 @@ async function runInit(args, io, prompt) {
     }
   }
   if (fillResult.inputs.type === "static") {
-    const serveDir = resolve9(dirname7(outPath), STATIC_SERVE_DIR);
-    const indexPath = resolve9(serveDir, "index.html");
-    if (!existsSync9(indexPath)) {
+    const serveDir = resolve10(dirname7(outPath), STATIC_SERVE_DIR);
+    const indexPath = resolve10(serveDir, "index.html");
+    if (!existsSync10(indexPath)) {
       try {
         mkdirSync3(serveDir, { recursive: true });
         writeFileSync3(indexPath, starterIndexHtml(fillResult.inputs.name), {
@@ -10188,7 +10232,7 @@ function renderYaml(manifest) {
 }
 function ensureGitignoreEntries(path10, entries) {
   let current = "";
-  if (existsSync9(path10)) {
+  if (existsSync10(path10)) {
     current = readFileSync14(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
@@ -10717,7 +10761,7 @@ function describe23(e) {
 }
 
 // src/commands/plan.ts
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -10730,7 +10774,7 @@ async function runPlan(args, io) {
     io.err("Usage: launchpad plan [--file <path>] [--json]");
     return 64;
   }
-  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve11(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   return flags.json ? renderJson(result, io) : renderHuman(result, io);
 }
@@ -11320,12 +11364,12 @@ async function listFiles(root, relative5 = "") {
   return files.sort();
 }
 function gitOutput(cwd, args) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     execFile("git", [...args], { cwd, encoding: "utf8" }, (error, stdout) => {
       if (error !== null)
         reject(error);
       else
-        resolve12(stdout);
+        resolve13(stdout);
     });
   });
 }
@@ -12260,7 +12304,7 @@ function describe26(e) {
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -12385,7 +12429,7 @@ async function runRollback(opts, io, deps = {}) {
   }, io, applyDeps);
 }
 function readCurrentManifest(path14) {
-  if (!existsSync10(path14))
+  if (!existsSync11(path14))
     return null;
   let raw;
   try {
@@ -12545,7 +12589,7 @@ function parseArgs12(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync11, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as input2, stdout as output2 } from "node:process";
@@ -12602,7 +12646,7 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath4(process.cwd(), opts.env ?? ".env");
-  if (!existsSync11(envPath)) {
+  if (!existsSync12(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
@@ -12934,7 +12978,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
@@ -12944,7 +12988,7 @@ var CELL_LABEL2 = {
 };
 function loadSet(fleetFile, setName, io) {
   const path14 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync12(path14)) {
+  if (!existsSync13(path14)) {
     io.err(`✗ ${path14}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
@@ -13036,7 +13080,7 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath6(process.cwd(), opts.env ?? ".env");
-  if (!existsSync12(envPath)) {
+  if (!existsSync13(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
@@ -13187,8 +13231,8 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync13, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve13 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -13196,7 +13240,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve12(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve13(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -13210,8 +13254,8 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve12(process.cwd(), flags.out);
-  if (existsSync13(outPath) && !flags.force) {
+  const outPath = resolve13(process.cwd(), flags.out);
+  if (existsSync14(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
@@ -13507,8 +13551,8 @@ function printHelp3(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname9, join as join15, resolve as resolve13 } from "node:path";
-import { promises as fs7, existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname9, join as join15, resolve as resolve14 } from "node:path";
+import { promises as fs7, existsSync as existsSync15 } from "node:fs";
 
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
@@ -13613,11 +13657,11 @@ function resolveInstallEnv() {
 function defaultBundleDir() {
   const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve13(here, "..", "skills"),
-    resolve13(here, "..", "..", "skills")
+    resolve14(here, "..", "skills"),
+    resolve14(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync14(join15(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync15(join15(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -13726,7 +13770,7 @@ function describe29(e) {
 import { execFile as execFile2, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname10, resolve as resolve14, relative as relative5, isAbsolute as isAbsolute3, join as join16 } from "node:path";
+import { dirname as dirname10, resolve as resolve15, relative as relative5, isAbsolute as isAbsolute3, join as join16 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
 import { readFileSync as readFileSync19, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
@@ -13771,9 +13815,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve14) => {
-    server.once("error", () => resolve14(false));
-    server.listen(0, "127.0.0.1", () => resolve14(true));
+  const bound = await new Promise((resolve15) => {
+    server.once("error", () => resolve15(false));
+    server.listen(0, "127.0.0.1", () => resolve15(true));
   });
   if (!bound)
     return null;
@@ -14066,7 +14110,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve14(dirname10(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve15(dirname10(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -14074,7 +14118,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve14(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve15(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -14211,8 +14255,8 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync15, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname11, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { dirname as dirname11, resolve as resolve16 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -14226,7 +14270,7 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path14 = resolve15(process.cwd(), file ?? "launchpad.yaml");
+  const path14 = resolve16(process.cwd(), file ?? "launchpad.yaml");
   const result = loadManifest(path14);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
@@ -14273,8 +14317,8 @@ function checkStaticServeDir(manifestPath, manifest) {
     ];
   }
   const dir = dirname11(manifestPath);
-  const abs = resolve15(dir, serveDir);
-  if (!existsSync15(abs)) {
+  const abs = resolve16(dir, serveDir);
+  if (!existsSync16(abs)) {
     return [
       `static app serves '${serveDir}/' but that directory does not exist — nothing would be served. ` + `Create ${serveDir}/index.html (or run \`launchpad init\` to scaffold it).`
     ];
@@ -14299,7 +14343,7 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app's served directory '${serveDir}/' is empty — the deploy would serve an empty site.`
     ];
   }
-  if (!existsSync15(resolve15(abs, "index.html"))) {
+  if (!existsSync16(resolve16(abs, "index.html"))) {
     return [
       `static app's served directory '${serveDir}/' has no index.html — the deploy would serve a directory with no entrypoint.`
     ];
@@ -15170,7 +15214,7 @@ import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
 import { join as join17 } from "node:path";
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync21,
   writeFileSync as writeFileSync8
@@ -15202,7 +15246,7 @@ function writeCache2(state) {
 var SKILLS_HINT_MARKER = join17(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
-    return existsSync16(SKILLS_HINT_MARKER);
+    return existsSync17(SKILLS_HINT_MARKER);
   } catch {
     return false;
   }
@@ -15313,7 +15357,7 @@ var refreshUpdateCacheCommand = {
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join18 } from "node:path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -15467,7 +15511,7 @@ function telemetryNoticeLine() {
 }
 function firstRunNoticeShown() {
   try {
-    return existsSync17(FIRST_RUN_MARKER);
+    return existsSync18(FIRST_RUN_MARKER);
   } catch {
     return false;
   }

package/dist/deploy/git-files.d.ts

@@ -3,23 +3,19 @@ export declare class GitFilesError extends Error {
     readonly code: "git_files_error";
 }
 /**
- * Paths the bot owns and rejects unconditionally on `deploy-pr`
- * (see `PROTECTED_PATHS` in `portal-bot/src/deploy-pr.ts`). Mirrored
- * here so the CLI excludes them up front rather than shipping a
- * tarball the bot will reject.
+ * Legacy convenience filter for known bot-owned files.
  *
- * The bot uses `base_tree` mode on the commit, so files we omit
- * from the tarball keep their base-branch contents — there's no
- * destructive consequence to filtering these out.
- *
- * Keep in lock-step with the bot's list. A future endpoint that
- * exposes this list would let the CLI fetch it dynamically; for
- * v1 the set is small and rarely changes.
+ * This list is not a security boundary and does not grant deletion
+ * authority. The server owns the canonical, family-based path policy
+ * and preserves platform files even when an older or newer client
+ * sends a different set.
  */
 export declare const PROTECTED_PATHS: ReadonlySet<string>;
 export interface ListFilesOptions {
     readonly cwd: string;
     readonly spawner?: typeof spawn;
+    /** Test seam for the worktree existence check. Receives an absolute path. */
+    readonly exists?: (path: string) => boolean;
 }
 /**
  * Return the deploy-eligible file paths under `cwd`, relative to

package/dist/deploy/git-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-files.d.ts","sourceRoot":"","sources":["../../src/deploy/git-files.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAU9C,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAqBxF"}
+{"version":3,"file":"git-files.d.ts","sourceRoot":"","sources":["../../src/deploy/git-files.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAI9D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAU9C,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA4BxF"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.54.0";
+export declare const CLI_VERSION = "0.54.1";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.54.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->