Follow sluiceway v0.47.0: sluiceway preview on the Command line page

.gitmodules

@@ -1,4 +1,4 @@
 [submodule "vendor/sluiceway"]
 	path = vendor/sluiceway
 	url = https://github.com/sluiceway/sluiceway.git
-	branch = v0.46.0
+	branch = v0.47.0

src/content/docs/hosted-app/install.mdx

@@ -64,6 +64,7 @@ These are the permissions the app asks for, and what each one is used for.
 | Deployments | Read and write | Reading the deployment records. Opening a record for a tick that goes through the app. |
 | Actions | Read and write | Reading workflow runs. Starting your Sluiceway workflow for a tick or a rescan that goes through the app. |
 | Contents | Read and write | Reading the repo for the onboarding pull request, and `sluiceway.yaml` at a commit. Writing one branch with one commit for a pull request the app opens. |
+| Checks | Read | Reading a stack's preview page when `sluiceway preview` asks for it, to hand it on. Until an org accepts it, `preview` fails there and says so. |
 | Pull requests | Read and write | Opening the onboarding pull request and the pull requests of edit mode. Reading when a merged pull request was merged, for Insights. |
 | Members (organization) | Read | Checking that a person is an admin of the org before they change the plan. |
 

src/content/docs/hosted-app/what-the-app-keeps.mdx

@@ -38,6 +38,9 @@ for that shape.
 
 - **No resource name, property path, diff or value.** Not in its database, not in its pages, not
   in the pull requests it opens. A row in the app shows counts, and the changes are on GitHub.
+  When <a href={page("hosted-app/command-line")}>`sluiceway preview`</a> asks for a stack's
+  changes, the app reads its preview page from GitHub at that moment, hands it on, and keeps
+  none of it.
 - **No text of a row, an issue title or a status description**, and of a merged pull request
   nothing but its commit and time: no number, title, description, branch or author.
 - **None of your repo's files.** For the onboarding pull request and to explain a failed first

src/lib/command-line.ts

@@ -197,6 +197,93 @@ export const EXAMPLES: ExampleGroup[] = [
       },
     ],
   },
+  {
+    heading: "`sluiceway preview`",
+    intro:
+      "Every change of the stack's preview, read from its preview page on GitHub through the app: the policies, the changes with each path whole and the values `dashboard.showValues` shows, and the drift. A destroy is in capitals. With `--json`, the app's answer as it came.",
+    examples: [
+      {
+        command: "sluiceway preview infra apps/api:prod",
+        words: [
+          "apps/api:prod in acme/infra: 1 update, 1 replace",
+          "Preview page: https://github.com/acme/infra/runs/48213301, of 0a1b2c3, written at 2026-09-26T08:00:00.000Z",
+          "",
+          "Policies",
+          "  warning  tags · the queue has no team tag",
+          "",
+          "Changes",
+          "  REPLACE  aws:rds/instance:Instance  main · forced by engineVersion · also changes tags.team",
+          "  update  aws:lambda/function:Function  api · memorySize 128 → 256, timeout nothing → 30",
+          "  create + import  aws:sqs/queue:Queue  jobs",
+          "",
+          "Outside the code",
+          "  changed  aws:ec2/securityGroup:SecurityGroup  web · ingress[0].cidrBlocks[0]",
+        ].join("\n"),
+        exit: 0,
+      },
+      {
+        command: "sluiceway preview infra apps/api:prod --json",
+        schema: "Preview",
+        json: {
+          stack: "apps/api:prod",
+          repo: "acme/infra",
+          page: {
+            name: "sluiceway / apps/api:prod",
+            url: "https://github.com/acme/infra/runs/48213301",
+            sha: "0a1b2c3d4e5f60718293a4b5c6d7e8f901234567",
+            at: "2026-09-26T08:00:00.000Z",
+          },
+          title: "apps/api:prod: 1 update, 1 replace",
+          policies: [
+            { result: "warning", namespace: "tags", message: "the queue has no team tag" },
+          ],
+          changes: [
+            {
+              action: "replace",
+              tracking: null,
+              type: "aws:rds/instance:Instance",
+              name: "main",
+              properties: ["engineVersion", "tags.team"],
+              forcedBy: ["engineVersion"],
+              values: [],
+            },
+            {
+              action: "update",
+              tracking: null,
+              type: "aws:lambda/function:Function",
+              name: "api",
+              properties: ["memorySize", "timeout"],
+              forcedBy: [],
+              values: [
+                { path: "memorySize", old: "128", new: "256" },
+                { path: "timeout", old: null, new: "30" },
+              ],
+            },
+            {
+              action: "create",
+              tracking: "import",
+              type: "aws:sqs/queue:Queue",
+              name: "jobs",
+              properties: [],
+              forcedBy: [],
+              values: [],
+            },
+          ],
+          drift: [
+            {
+              action: "changed",
+              type: "aws:ec2/securityGroup:SecurityGroup",
+              name: "web",
+              properties: ["ingress[0].cidrBlocks[0]"],
+            },
+          ],
+          unlisted: 0,
+          unread: 0,
+        },
+        exit: 0,
+      },
+    ],
+  },
   {
     heading: "`sluiceway tick`",
     intro:

src/lib/pages.ts

@@ -658,7 +658,7 @@ export function pages(repoUrl: string, base: string): Page[] {
       title: titleOf("docs/command-line.md"),
       sidebarLabel: "Command line",
       description:
-        "Install the sluiceway command, sign in with a token from the app, then check status, tick, rescan and change settings, with --json and exit codes for agents.",
+        "Install the sluiceway command, sign in with an app token, then read status and previews, tick, rescan and change settings, with --json and exit codes.",
       source: "docs/command-line.md",
       headerPicture: {
         picture: "deploying-2",