@m-kopa/launchpad-cli 0.27.3 → 0.27.5

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.27.3";
+var CLI_VERSION = "0.27.5";
 
 // src/config.ts
 import * as os from "node:os";
@@ -1525,7 +1525,7 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
@@ -3616,9 +3616,212 @@ async function bundleAndDeploy(args) {
   };
 }
 
+// src/deploy/verify-deploy.ts
+import { readFileSync as readFileSync5, existsSync as existsSync3 } from "node:fs";
+import { join as join8 } from "node:path";
+
+// src/deploy/deployment-status.ts
+async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
+  let raw;
+  try {
+    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/exceptions` }, fetcher);
+  } catch (e) {
+    if (e instanceof NotFoundError)
+      return null;
+    throw e;
+  }
+  if (!Array.isArray(raw.exceptions))
+    return null;
+  return raw.exceptions.filter((e) => typeof e === "object" && e !== null && typeof e.path === "string" && typeof e.rule === "string" && typeof e.detectedAt === "string" && typeof e.deployRef === "string");
+}
+async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
+  let raw;
+  try {
+    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/deployment-status` }, fetcher);
+  } catch (e) {
+    if (e instanceof NotFoundError)
+      return null;
+    throw e;
+  }
+  if (typeof raw.supported !== "boolean")
+    return null;
+  return {
+    slug: typeof raw.slug === "string" ? raw.slug : slug,
+    supported: raw.supported,
+    liveDeployment: raw.liveDeployment ?? null,
+    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null
+  };
+}
+
+// src/deploy/wait-for-deployment.ts
+var DEFAULT_POLL_INTERVAL_MS = 5000;
+function realWaitDeps(cfg) {
+  return {
+    fetchStatus: (slug) => fetchDeploymentStatus(cfg, slug),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    now: () => Date.now()
+  };
+}
+async function waitForDeployment(args, deps) {
+  const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const start = deps.now();
+  for (;; ) {
+    let status;
+    try {
+      status = await deps.fetchStatus(args.slug);
+    } catch {
+      return { kind: "unknown" };
+    }
+    if (status === null)
+      return { kind: "unknown" };
+    if (!status.supported)
+      return { kind: "unsupported" };
+    const live = status.liveDeployment;
+    if (live) {
+      if (live.buildStatus === "success") {
+        return { kind: "success", deploymentUrl: live.url };
+      }
+      if (live.buildStatus === "failure") {
+        return { kind: "failure", logExcerpt: live.logExcerpt, failedStage: live.failedStage };
+      }
+    }
+    if (deps.now() - start >= args.timeoutMs)
+      return { kind: "pending" };
+    await deps.sleep(pollIntervalMs);
+  }
+}
+
+// src/deploy/served-verify.ts
+import { createHash as createHash2 } from "node:crypto";
+function sha256(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function toBytes(v) {
+  return typeof v === "string" ? new TextEncoder().encode(v) : v;
+}
+async function verifyServed(args, deps = { fetch }) {
+  let res;
+  try {
+    res = await deps.fetch(args.servedUrl, { method: "GET" });
+  } catch (e) {
+    return {
+      kind: "unreachable",
+      reason: `could not reach ${args.servedUrl}: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (!res.ok) {
+    return {
+      kind: "unreachable",
+      status: res.status,
+      reason: `served URL returned HTTP ${res.status}`
+    };
+  }
+  if (args.appType !== "static") {
+    return { kind: "match" };
+  }
+  let servedBytes;
+  try {
+    servedBytes = new Uint8Array(await res.arrayBuffer());
+  } catch (e) {
+    return {
+      kind: "unreachable",
+      reason: `could not read served body: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  const shippedBytes = toBytes(args.shippedEntrypoint);
+  const servedHash = sha256(servedBytes);
+  const shippedHash = sha256(shippedBytes);
+  if (servedHash === shippedHash)
+    return { kind: "match" };
+  return {
+    kind: "mismatch",
+    servedHash,
+    shippedHash,
+    servedLen: servedBytes.byteLength,
+    shippedLen: shippedBytes.byteLength
+  };
+}
+
+// src/deploy/verify-deploy.ts
+var VERIFY_MISMATCH_EXIT = 65;
+function readLocalEntrypoint(cwd) {
+  for (const rel of ["index.html", join8("static", "index.html")]) {
+    const p = join8(cwd, rel);
+    if (existsSync3(p))
+      return new Uint8Array(readFileSync5(p));
+  }
+  return null;
+}
+function realVerifyDeployDeps(cfg) {
+  return {
+    wait: waitForDeployment,
+    verify: verifyServed,
+    readLocalEntrypoint,
+    waitDeps: realWaitDeps(cfg),
+    verifyDeps: { fetch }
+  };
+}
+async function runDeployVerification(args, io, deps) {
+  io.out("");
+  io.out("Verifying the live deployment serves what you shipped …");
+  const settle = await deps.wait({ slug: args.slug, timeoutMs: args.timeoutMs }, deps.waitDeps);
+  switch (settle.kind) {
+    case "unsupported":
+      io.out("  (skipped — this app has no Pages deployment surface)");
+      return 0;
+    case "unknown":
+      io.out(`  (couldn't read deployment status — verify manually with \`launchpad status ${args.slug}\`)`);
+      return 0;
+    case "pending":
+      io.out(`⏳ Build still in progress after ${Math.round(args.timeoutMs / 1000)}s — couldn't verify yet.`);
+      io.out(`   Re-check the outcome: \`launchpad status ${args.slug}\``);
+      return 0;
+    case "failure":
+      io.err("✗ The Cloudflare Pages build FAILED — your content is NOT live.");
+      if (settle.failedStage)
+        io.err(`  failed stage: ${settle.failedStage}`);
+      if (settle.logExcerpt)
+        io.err(`  ${settle.logExcerpt}`);
+      io.err(`  Full logs: \`launchpad status ${args.slug}\``);
+      return 1;
+    case "success":
+      return verifySuccess(args, settle.deploymentUrl, io, deps);
+  }
+}
+async function verifySuccess(args, deploymentUrl, io, deps) {
+  if (deploymentUrl === null || deploymentUrl.length === 0) {
+    io.out("  (build succeeded but no served URL was reported — verify manually)");
+    return 0;
+  }
+  const entrypoint = deps.readLocalEntrypoint(args.cwd);
+  if (entrypoint === null) {
+    io.out("  (no local index.html found to compare against — skipped)");
+    return 0;
+  }
+  const verdict = await deps.verify({ servedUrl: deploymentUrl, shippedEntrypoint: entrypoint, appType: args.appType }, deps.verifyDeps);
+  switch (verdict.kind) {
+    case "match":
+      io.out("✓ Verified — the live deployment serves exactly what you shipped.");
+      return 0;
+    case "unreachable":
+      io.out(`  (couldn't reach the served URL to verify: ${verdict.reason}) — check manually`);
+      return 0;
+    case "mismatch":
+      io.err("");
+      io.err("✗ LIVE SERVES DIFFERENT CONTENT THAN YOU SHIPPED.");
+      io.err("  Your deploy committed, but the served page does not match your local index.html.");
+      io.err("  The app's build likely reads the entrypoint from a different path than your files");
+      io.err("  landed — e.g. it serves `static/index.html` while your content is at the repo root");
+      io.err("  (or vice-versa). This is the silent-revert class; your content did NOT go live.");
+      io.err(`  served ${verdict.servedLen}B (sha ${verdict.servedHash.slice(0, 12)}) ≠ shipped ${verdict.shippedLen}B (sha ${verdict.shippedHash.slice(0, 12)})`);
+      io.err(`  Check the app's Pages build config; see \`launchpad status ${args.slug}\`.`);
+      return VERIFY_MISMATCH_EXIT;
+  }
+}
+
 // src/commands/deploy.ts
 import { parse as parseYaml5 } from "yaml";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -3894,6 +4097,19 @@ function parseDeployFlags(args) {
       i += 2;
       continue;
     }
+    if (a === "--no-verify") {
+      i += 1;
+      continue;
+    }
+    if (a.startsWith("--verify-timeout=")) {
+      const v = a.slice("--verify-timeout=".length);
+      const n = Number(v);
+      if (!Number.isFinite(n) || n <= 0 || Math.floor(n) !== n) {
+        return `invalid --verify-timeout "${v}" — expected positive integer seconds`;
+      }
+      i += 1;
+      continue;
+    }
     return `unknown argument "${a}"`;
   }
   if (modeFlagsSeen > 1) {
@@ -4045,16 +4261,16 @@ function parseDeployFlags(args) {
 }
 
 // src/deploy/apply.ts
-import { existsSync as existsSync3, rmSync } from "node:fs";
-import { resolve as resolvePath, join as join8 } from "node:path";
+import { existsSync as existsSync4, rmSync } from "node:fs";
+import { resolve as resolvePath, join as join9 } from "node:path";
 
 // src/manifest/load.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { parse as parseYaml3, YAMLParseError } from "yaml";
 function loadManifest(path7) {
   let raw;
   try {
-    raw = readFileSync5(path7, "utf8");
+    raw = readFileSync6(path7, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -4276,8 +4492,8 @@ function sleep(ms) {
   return new Promise((res) => setTimeout(res, ms));
 }
 function deletePinIfPresent(cfg, slug, io) {
-  const pinPath = join8(cfg.stateDir, slug, "group.json");
-  if (!existsSync3(pinPath))
+  const pinPath = join9(cfg.stateDir, slug, "group.json");
+  if (!existsSync4(pinPath))
     return;
   try {
     rmSync(pinPath, { force: true });
@@ -4710,7 +4926,7 @@ function handleNetworkError(e, io, slug, verb) {
 
 // src/commands/infer-slug.ts
 import * as path7 from "node:path";
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "node:fs";
 import { parse as parseYaml4 } from "yaml";
 var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 function inferSlugFromCwd(cwd) {
@@ -4730,10 +4946,10 @@ function resolveManifestSlug(parsed) {
   return null;
 }
 function inferSlugFromManifestFile(manifestPath) {
-  if (!existsSync4(manifestPath))
+  if (!existsSync5(manifestPath))
     return null;
   try {
-    return resolveManifestSlug(parseYaml4(readFileSync6(manifestPath, "utf8")));
+    return resolveManifestSlug(parseYaml4(readFileSync7(manifestPath, "utf8")));
   } catch {
     return null;
   }
@@ -4800,7 +5016,7 @@ async function runDeploy(args, io) {
   }
   const cwd = process.cwd();
   const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync5(manifestPath)) {
+  if (existsSync6(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : { allowStale: false, rebaseOntoHead: false, overrideStale: null };
     return runModelADeploy({
       cwd,
@@ -4844,9 +5060,9 @@ async function runDeploy(args, io) {
     }
     let contentManifestYaml = null;
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync5(contentManifestPath)) {
+    if (existsSync6(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync7(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync8(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -5055,17 +5271,31 @@ function surfaceStaleBlock(body, io) {
 async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
+  let appType = "static";
   try {
-    const metaSlug = resolveManifestSlug(parseYaml5(readFileSync7(manifestPath, "utf8")));
+    const manifestObj = parseYaml5(readFileSync8(manifestPath, "utf8"));
+    const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
       return 64;
     }
     slug = metaSlug;
+    const dtype = manifestObj?.deployment?.type;
+    if (dtype === "static" || dtype === "react" || dtype === "react+api" || dtype === "container") {
+      appType = dtype;
+    }
   } catch (e) {
     io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe13(e)}`);
     return 1;
   }
+  const noVerify = args.argv.includes("--no-verify");
+  let verifyTimeoutMs = 180000;
+  const vtFlag = args.argv.find((a) => a.startsWith("--verify-timeout="));
+  if (vtFlag !== undefined) {
+    const secs = Number.parseInt(vtFlag.slice("--verify-timeout=".length), 10);
+    if (Number.isFinite(secs) && secs > 0)
+      verifyTimeoutMs = secs * 1000;
+  }
   if (!SLUG_RE4.test(slug)) {
     io.err(`launchpad deploy: invalid slug "${slug}" in manifest — expected ${SLUG_RE4.source}`);
     return 64;
@@ -5174,11 +5404,11 @@ async function runModelADeploy(args) {
       }
       if (success.status === "provisioning_started") {
         const submissionId = typeof success.submissionId === "string" ? success.submissionId : "(missing)";
-        const appType = typeof success.appType === "string" ? success.appType : "(missing)";
+        const appType2 = typeof success.appType === "string" ? success.appType : "(missing)";
         const message = typeof success.message === "string" ? success.message : "Bot accepted the upload and started provisioning.";
         io.out(`✓ First-time deploy — provisioning workflow started for ${slug}`);
         io.out(`  submission: ${submissionId}`);
-        io.out(`  appType:    ${appType}`);
+        io.out(`  appType:    ${appType2}`);
         io.out("");
         io.out(message);
         io.out("");
@@ -5209,8 +5439,11 @@ async function runModelADeploy(args) {
       surfaceDeployExtras(success, io, slug, args.allowStale);
       io.out("");
       io.out("Committed; build pending — Cloudflare Pages is building this deploy now.");
-      io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
-      return 0;
+      if (noVerify) {
+        io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
+        return 0;
+      }
+      return runDeployVerification({ slug, cwd, appType, timeoutMs: verifyTimeoutMs }, io, realVerifyDeployDeps(cfg));
     }
   }
 }
@@ -5406,7 +5639,7 @@ function describe14(e) {
 }
 
 // src/commands/generate.ts
-import { mkdirSync, readFileSync as readFileSync8, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync as readFileSync9, writeFileSync } from "node:fs";
 import { dirname as dirname5, resolve as resolve8, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
@@ -5494,7 +5727,7 @@ function applyOne(artefact, path10, out, force) {
 }
 function readIfExists(path10) {
   try {
-    return { kind: "ok", content: readFileSync8(path10, "utf8") };
+    return { kind: "ok", content: readFileSync9(path10, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -5705,13 +5938,13 @@ function parseFlags(args) {
 }
 
 // src/groups/client.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname6, join as join11 } from "node:path";
 var CACHE_TTL_MS = 60 * 60 * 1000;
 var CACHE_FILENAME = "groups.json";
 async function fetchGroups(cfg, opts = {}) {
   const now = opts.now ?? Date.now;
-  const cachePath = join10(cfg.cacheDir, CACHE_FILENAME);
+  const cachePath = join11(cfg.cacheDir, CACHE_FILENAME);
   if (opts.forceRefresh !== true) {
     const cached = readCache(cachePath);
     if (cached !== null) {
@@ -5749,7 +5982,7 @@ async function fetchGroups(cfg, opts = {}) {
 function readCache(path10) {
   let raw;
   try {
-    raw = readFileSync9(path10, "utf8");
+    raw = readFileSync10(path10, "utf8");
   } catch {
     return null;
   }
@@ -6250,17 +6483,17 @@ function describe18(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync6, readFileSync as readFileSync10, statSync } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync11, statSync } from "node:fs";
+import { join as join12 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync6(join11(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync6(join11(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync6(join11(cwd, n)));
+  const hasPackageJson = existsSync7(join12(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync7(join12(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync7(join12(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -6306,7 +6539,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync6(join11(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync7(join12(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -6328,8 +6561,8 @@ function detectPackageManager(cwd) {
 }
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
-    const p = join11(cwd, name);
-    if (existsSync6(p)) {
+    const p = join12(cwd, name);
+    if (existsSync7(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -6339,9 +6572,9 @@ function detectVitePresence(cwd) {
   };
 }
 function detectAppType(cwd) {
-  const fnDir = join11(cwd, "functions");
+  const fnDir = join12(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync6(fnDir)) {
+  if (existsSync7(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -6351,8 +6584,8 @@ function detectAppType(cwd) {
   return { kind: "ok", value: hasFunctionsDir ? "react+api" : "react" };
 }
 function detectBuildCommand(cwd, pm) {
-  const pkgJsonPath = join11(cwd, "package.json");
-  if (!existsSync6(pkgJsonPath)) {
+  const pkgJsonPath = join12(cwd, "package.json");
+  if (!existsSync7(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -6360,7 +6593,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync10(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -6395,7 +6628,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync10(vite.path, "utf8");
+    text = readFileSync11(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -6425,7 +6658,7 @@ async function runInit(args, io, prompt) {
   }
   const { inputs, options } = parsed;
   const outPath = resolve9(process.cwd(), options.out);
-  if (existsSync7(outPath) && !options.force) {
+  if (existsSync8(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -6843,8 +7076,8 @@ function renderYaml(manifest) {
 }
 function ensureGitignoreEntries(path10, entries) {
   let current = "";
-  if (existsSync7(path10)) {
-    current = readFileSync11(path10, "utf8");
+  if (existsSync8(path10)) {
+    current = readFileSync12(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -7833,39 +8066,6 @@ async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
   return apiJson(cfg, { path: path12 }, fetcher);
 }
 
-// src/deploy/deployment-status.ts
-async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
-  let raw;
-  try {
-    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/exceptions` }, fetcher);
-  } catch (e) {
-    if (e instanceof NotFoundError)
-      return null;
-    throw e;
-  }
-  if (!Array.isArray(raw.exceptions))
-    return null;
-  return raw.exceptions.filter((e) => typeof e === "object" && e !== null && typeof e.path === "string" && typeof e.rule === "string" && typeof e.detectedAt === "string" && typeof e.deployRef === "string");
-}
-async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
-  let raw;
-  try {
-    raw = await apiJson(cfg, { path: `/apps/${encodeURIComponent(slug)}/deployment-status` }, fetcher);
-  } catch (e) {
-    if (e instanceof NotFoundError)
-      return null;
-    throw e;
-  }
-  if (typeof raw.supported !== "boolean")
-    return null;
-  return {
-    slug: typeof raw.slug === "string" ? raw.slug : slug,
-    supported: raw.supported,
-    liveDeployment: raw.liveDeployment ?? null,
-    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null
-  };
-}
-
 // src/commands/pull.ts
 var pullCommand = {
   name: "pull",
@@ -8205,7 +8405,7 @@ function printUsage5(io) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 var statusCommand = {
   name: "status",
   summary: "show drift between local launchpad.yaml and deployed state",
@@ -8262,7 +8462,7 @@ async function runStatus(args, io) {
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync12(parsed.file, "utf8");
+    localYaml = readFileSync13(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
       io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe25(e)}`);
@@ -8865,7 +9065,7 @@ function describe26(e) {
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -8990,11 +9190,11 @@ async function runRollback(opts, io, deps = {}) {
   }, io, applyDeps);
 }
 function readCurrentManifest(path13) {
-  if (!existsSync8(path13))
+  if (!existsSync9(path13))
     return null;
   let raw;
   try {
-    raw = readFileSync13(path13, "utf8");
+    raw = readFileSync14(path13, "utf8");
   } catch {
     return null;
   }
@@ -9150,7 +9350,7 @@ function parseArgs11(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 
 // src/secrets/env-parse.ts
@@ -9205,14 +9405,14 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath3(process.cwd(), opts.env ?? ".env");
-  if (!existsSync9(envPath)) {
+  if (!existsSync10(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync14(envPath, "utf8");
+    envText = readFileSync15(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push: failed to read ${envPath}: ${describe28(e)}`);
     return 2;
@@ -9484,7 +9684,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolvePath5 } from "node:path";
 import { parse as parseYaml6 } from "yaml";
 var CELL_LABEL2 = {
@@ -9494,14 +9694,14 @@ var CELL_LABEL2 = {
 };
 function loadSet(fleetFile, setName, io) {
   const path13 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync10(path13)) {
+  if (!existsSync11(path13)) {
     io.err(`✗ ${path13}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml6(readFileSync15(path13, "utf8"));
+    obj = parseYaml6(readFileSync16(path13, "utf8"));
   } catch (e) {
     io.err(`✗ ${path13}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
@@ -9586,14 +9786,14 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath5(process.cwd(), opts.env ?? ".env");
-  if (!existsSync10(envPath)) {
+  if (!existsSync11(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync15(envPath, "utf8");
+    envText = readFileSync16(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -9737,7 +9937,7 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync11, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync12, writeFileSync as writeFileSync6 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
@@ -9761,7 +9961,7 @@ async function runSecretsTemplate(args, io) {
     return 0;
   }
   const outPath = resolve11(process.cwd(), flags.out);
-  if (existsSync11(outPath) && !flags.force) {
+  if (existsSync12(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
@@ -10049,8 +10249,8 @@ function printHelp2(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname7, join as join12, resolve as resolve12 } from "node:path";
-import { promises as fs6, existsSync as existsSync12 } from "node:fs";
+import { dirname as dirname7, join as join13, resolve as resolve12 } from "node:path";
+import { promises as fs6, existsSync as existsSync13 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 var BUNDLE_PREFIX = "launchpad-";
 var BUNDLED_SKILLS = [
@@ -10111,7 +10311,7 @@ function printHelp3(io) {
 }
 function resolveInstallEnv() {
   const bundleDir = process.env.LAUNCHPAD_SKILLS_BUNDLE_DIR ?? defaultBundleDir();
-  const userSkillsDir = process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join12(homedir2(), ".claude", "skills");
+  const userSkillsDir = process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join13(homedir2(), ".claude", "skills");
   return { bundleDir, userSkillsDir };
 }
 function defaultBundleDir() {
@@ -10121,7 +10321,7 @@ function defaultBundleDir() {
     resolve12(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync12(join12(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync13(join13(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -10142,12 +10342,12 @@ async function doInstall(io) {
   }
   let installed = 0;
   for (const skill of BUNDLED_SKILLS) {
-    const src = join12(env.bundleDir, skill);
+    const src = join13(env.bundleDir, skill);
     if (!await isDir(src)) {
       io.err(`launchpad skills install: bundled skill "${skill}" missing from ${env.bundleDir} — package is incomplete.`);
       return 1;
     }
-    const dest = join12(env.userSkillsDir, skill);
+    const dest = join13(env.userSkillsDir, skill);
     await fs6.rm(dest, { recursive: true, force: true });
     await fs6.cp(src, dest, { recursive: true });
     installed++;
@@ -10172,7 +10372,7 @@ async function doUninstall(io) {
       continue;
     if (!isBundleManaged(entry.name))
       continue;
-    const target = join12(env.userSkillsDir, entry.name);
+    const target = join13(env.userSkillsDir, entry.name);
     await fs6.rm(target, { recursive: true, force: true });
     removed++;
     io.out(`✗ removed ${target}`);
@@ -10195,7 +10395,7 @@ async function doList(io) {
   }
   const width = managedDirs.reduce((n, s) => Math.max(n, s.length), 0);
   for (const name of managedDirs) {
-    const skillFile = join12(env.userSkillsDir, name, "SKILL.md");
+    const skillFile = join13(env.userSkillsDir, name, "SKILL.md");
     const version = await readVersion(skillFile);
     io.out(`  ${name.padEnd(width + 2)}${version ?? "(no version)"}`);
   }
@@ -10230,13 +10430,13 @@ function describe29(e) {
 import { execFile, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname8, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join13 } from "node:path";
+import { dirname as dirname8, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join14 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync16, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync17, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
-import { createHash as createHash2, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes5 } from "node:crypto";
 var CHANNEL_BASE = "https://get.launchpad.m-kopa.us";
 var CLI_AUTH_URL = `${CHANNEL_BASE}/__cli_auth`;
 var CLI_TOKEN_URL = `${CHANNEL_BASE}/__cli_token`;
@@ -10247,7 +10447,7 @@ function base64url(b) {
 }
 function pkcePair() {
   const verifier = base64url(randomBytes5(32));
-  const challenge = base64url(createHash2("sha256").update(verifier).digest());
+  const challenge = base64url(createHash3("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
 async function startLoopback(state, timeoutMs) {
@@ -10353,7 +10553,7 @@ var PKG = "@m-kopa/launchpad-cli";
 var REGISTRY = "https://registry.npmjs.org";
 var CHANNEL_VERSION_URL = "https://get.launchpad.m-kopa.us/version.json";
 var CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
-var CHANNEL_MARKER = join13(homedir3(), ".launchpad", "channel");
+var CHANNEL_MARKER = join14(homedir3(), ".launchpad", "channel");
 var EXIT_UPDATE_AVAILABLE = 10;
 var UPGRADE_ARGS = {
   npm: ["install", "-g", `${PKG}@latest`],
@@ -10463,8 +10663,8 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join13(tmpdir(), "launchpad-update-"));
-  const file = join13(dir, "install.sh");
+  const dir = mkdtempSync(join14(tmpdir(), "launchpad-update-"));
+  const file = join14(dir, "install.sh");
   try {
     writeFileSync7(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
@@ -10488,7 +10688,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync16(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync17(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -10695,7 +10895,7 @@ function printHelp4(io) {
 }
 
 // src/commands/validate.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import { dirname as dirname9, resolve as resolve14 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -10729,7 +10929,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync17(manifestPath, "utf8");
+    manifestYaml = readFileSync18(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -10993,7 +11193,11 @@ var whoamiCommand = {
   summary: "show current session identity + role per app",
   run: runWhoami
 };
-async function runWhoami(_args, io) {
+async function runWhoami(args, io) {
+  const wantShare = args.includes("--share") || args.includes("--id");
+  if (wantShare) {
+    return runShare(args, io);
+  }
   try {
     const cfg = loadConfig();
     const session = await readSession(cfg.sessionPath);
@@ -11036,28 +11240,215 @@ async function runWhoami(_args, io) {
     return 1;
   }
 }
+async function runShare(args, io) {
+  const json = args.includes("--json");
+  try {
+    const cfg = loadConfig();
+    const session = await readSession(cfg.sessionPath);
+    if (session === null) {
+      io.err("No session — run `launchpad login`.");
+      return 1;
+    }
+    let payload = null;
+    try {
+      payload = decodeJwtPayload(session.accessToken);
+    } catch {}
+    const rawSub = typeof payload?.sub === "string" ? payload.sub : null;
+    const sub = rawSub === null ? null : rawSub.trim();
+    if (sub === null || sub.length === 0) {
+      io.err("Couldn't read your id from the session — run `launchpad login` again.");
+      return 1;
+    }
+    io.out(json ? JSON.stringify({ sub }) : sub);
+    return 0;
+  } catch (e) {
+    if (e instanceof UnauthenticatedError) {
+      io.err(e.message);
+      return 1;
+    }
+    io.err(`launchpad whoami --share failed: ${describe31(e)}`);
+    return 1;
+  }
+}
 function describe31(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
+// src/commands/editors.ts
+import { createInterface as createInterface4 } from "node:readline/promises";
+var CONFLICT_EXIT = 75;
+function realDeps() {
+  return {
+    loadConfig,
+    apiJson,
+    isTty: () => process.stdout.isTTY === true,
+    prompt: async (question) => {
+      const rl = createInterface4({ input: process.stdin, output: process.stdout });
+      try {
+        return (await rl.question(question)).trim();
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+function parseArgs13(args) {
+  let slug;
+  let target;
+  let yes = false;
+  let json = false;
+  for (const a of args) {
+    if (a === "--yes" || a === "-y")
+      yes = true;
+    else if (a === "--json")
+      json = true;
+    else if (slug === undefined)
+      slug = a;
+    else if (target === undefined)
+      target = a;
+  }
+  if (slug === undefined || target === undefined)
+    return null;
+  return { slug, target, yes, json };
+}
+function isVersionMismatch(b) {
+  return typeof b === "object" && b !== null && b.error === "version_mismatch" && typeof b.currentVersion === "number";
+}
+function makeEditorCommand(action, deps = realDeps()) {
+  const name = action === "grant" ? "grant-editor" : "revoke-editor";
+  return {
+    name,
+    summary: action === "grant" ? "grant a developer editor access to an app (by id; email in Phase 2)" : "revoke a developer's editor access to an app",
+    run: (args, io) => runEditor(action, args, io, deps)
+  };
+}
+async function runEditor(action, args, io, deps) {
+  const verb = action === "grant" ? "grant-editor" : "revoke-editor";
+  const parsed = parseArgs13(args);
+  if (parsed === null) {
+    io.err(`usage: launchpad ${verb} <slug> <id> [--yes] [--json]`);
+    io.err("  <id> is the recipient's value from `launchpad whoami --share`.");
+    return 64;
+  }
+  const { slug, target, yes, json } = parsed;
+  if (!yes && !deps.isTty()) {
+    io.err(`launchpad ${verb}: refusing to mutate "${slug}" without confirmation — pass --yes in non-interactive mode.`);
+    return 64;
+  }
+  try {
+    const cfg = deps.loadConfig();
+    const current = await deps.apiJson(cfg, {
+      path: `/apps/${slug}`
+    });
+    const alreadyEditor = current.record.editors.includes(target);
+    if (!yes) {
+      const noop = action === "grant" && alreadyEditor || action === "revoke" && !alreadyEditor;
+      io.out(action === "grant" ? `About to grant editor access on "${slug}" to:
+  ${target}` : `About to revoke editor access on "${slug}" from:
+  ${target}`);
+      if (noop) {
+        io.out(action === "grant" ? "  (already an editor — this will be a no-op)" : "  (not currently an editor — this will be a no-op)");
+      }
+      const answer = (await deps.prompt("Proceed? [y/N] ")).toLowerCase();
+      if (answer !== "y" && answer !== "yes") {
+        io.out("Aborted — no change made.");
+        return 0;
+      }
+    }
+    const result = await mutateWithRetry(action, slug, target, current.record.version, cfg, deps);
+    if (result.kind === "conflict") {
+      io.err(`launchpad ${verb}: the app record for "${slug}" changed during the ${action} — re-run \`launchpad ${verb} ${slug} ${target}\`.`);
+      return CONFLICT_EXIT;
+    }
+    const changed = result.record.version !== result.attemptedVersion;
+    if (json) {
+      io.out(JSON.stringify({
+        ok: true,
+        slug,
+        action,
+        editor: target,
+        changed,
+        editors: result.record.editors
+      }));
+      return 0;
+    }
+    if (!changed) {
+      io.out(action === "grant" ? `${target} was already an editor on "${slug}" — no change.` : `${target} was not an editor on "${slug}" — no change.`);
+    } else {
+      io.out(action === "grant" ? `✓ ${target} is now an editor on "${slug}".` : `✓ ${target} is no longer an editor on "${slug}".`);
+    }
+    return 0;
+  } catch (e) {
+    if (e instanceof UnauthenticatedError) {
+      io.err(e.message);
+      return 1;
+    }
+    if (e instanceof ForbiddenError) {
+      io.err(`launchpad ${verb}: not authorised — you must be the owner of "${slug}" to manage its editors.`);
+      return 1;
+    }
+    if (e instanceof NotFoundError) {
+      io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
+      return 1;
+    }
+    io.err(`launchpad ${verb} failed: ${describe32(e)}`);
+    return 1;
+  }
+}
+async function mutateWithRetry(action, slug, target, startVersion, cfg, deps) {
+  let version = startVersion;
+  for (let attempt = 0;attempt < 2; attempt++) {
+    const body = await sendMutation(action, slug, target, version, cfg, deps);
+    if (isVersionMismatch(body)) {
+      version = body.currentVersion;
+      continue;
+    }
+    return { kind: "ok", record: body.record, attemptedVersion: version };
+  }
+  return { kind: "conflict" };
+}
+async function sendMutation(action, slug, target, version, cfg, deps) {
+  const headers = { "if-match": String(version) };
+  if (action === "grant") {
+    return deps.apiJson(cfg, {
+      method: "POST",
+      path: `/apps/${slug}/editors`,
+      jsonBody: { editor: target },
+      headers,
+      nonThrowingStatuses: [409]
+    });
+  }
+  return deps.apiJson(cfg, {
+    method: "DELETE",
+    path: `/apps/${slug}/editors/${encodeURIComponent(target)}`,
+    headers,
+    nonThrowingStatuses: [409]
+  });
+}
+function describe32(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+var grantEditorCommand = makeEditorCommand("grant");
+var revokeEditorCommand = makeEditorCommand("revoke");
+
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync2,
   writeFileSync as writeFileSync8
 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
-var CACHE_FILE = join14(homedir4(), ".launchpad", "update-check.json");
+var CACHE_FILE = join15(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync18(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync19(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -11070,15 +11461,15 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync3(join14(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync3(join15(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
 var SKILL_PREFIX = "launchpad-";
-var SKILLS_HINT_MARKER = join14(homedir4(), ".launchpad", "skills-hint-shown");
+var SKILLS_HINT_MARKER = join15(homedir4(), ".launchpad", "skills-hint-shown");
 function skillsTargetDir() {
-  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join14(homedir4(), ".claude", "skills");
+  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir4(), ".claude", "skills");
 }
 function readInstalledSkills() {
   try {
@@ -11086,14 +11477,14 @@ function readInstalledSkills() {
     const bundle = readdirSync2(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
     if (!bundle)
       return { present: false, version: null };
-    return { present: true, version: readSkillVersion(join14(dir, bundle.name, "SKILL.md")) };
+    return { present: true, version: readSkillVersion(join15(dir, bundle.name, "SKILL.md")) };
   } catch {
     return { present: false, version: null };
   }
 }
 function readSkillVersion(path13) {
   try {
-    const text = readFileSync18(path13, "utf8");
+    const text = readFileSync19(path13, "utf8");
     const fenceEnd = text.indexOf(`
 ---`, 4);
     const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
@@ -11105,14 +11496,14 @@ function readSkillVersion(path13) {
 }
 function absentHintShown() {
   try {
-    return existsSync13(SKILLS_HINT_MARKER);
+    return existsSync14(SKILLS_HINT_MARKER);
   } catch {
     return false;
   }
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync3(join14(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync3(join15(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -11238,6 +11629,8 @@ var COMMANDS = [
   rollbackCommand,
   groupsCommand,
   secretsCommand,
+  grantEditorCommand,
+  revokeEditorCommand,
   refreshUpdateCacheCommand
 ];
 async function dispatch(argv, io, commands = COMMANDS) {