@m-kopa/launchpad-cli 0.27.5 → 0.28.0

package/CHANGELOG.md

@@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.28.0 — 2026-06-17
+
+PostHog usage telemetry (sp-phcli2).
+
+- The CLI now records one anonymous/signed-in `command_run` event per command
+  (command name, exit code, duration, CLI version, OS, Node version, `ci`,
+  `environment`) so the platform team can see usage and failures. Identified by
+  your M-KOPA email when signed in, by a local anonymous device-id otherwise.
+- **Never sends your data:** a fixed allowlist means command arguments, paths,
+  env, secrets, repo/app names, and group ids can **not** be transmitted — only
+  the fields above. Email is the only PII, and only on signed-in events.
+- **Never slows or breaks a command:** the event is delivered by a detached,
+  `unref`'d background process after the command finishes (the same pattern as
+  the update check), bounded by a timeout and fully fail-silent.
+- This is internal staff tooling: telemetry is **on by default and cannot be
+  disabled** (`DO_NOT_TRACK` is not honored) — see the new
+  [usage analytics](https://get.launchpad.m-kopa.us/docs/concepts/telemetry)
+  disclosure page and ADR 0027 / the ADR 0014 amendment. A one-time notice is
+  printed on first interactive run.
+
 ## 0.27.5 — 2026-06-16
 
 Post-deploy verification — `launchpad deploy` confirms the live deployment

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.27.5";
+var CLI_VERSION = "0.28.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -11603,6 +11603,234 @@ var refreshUpdateCacheCommand = {
   }
 };
 
+// src/telemetry.ts
+import { spawn as spawn7 } from "node:child_process";
+import { homedir as homedir5 } from "node:os";
+import { join as join16 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "node:fs";
+import { randomUUID } from "node:crypto";
+var INTERNAL_EMIT_VERB = "__emit-telemetry";
+var POSTHOG_HOST = "https://us.i.posthog.com";
+var POSTHOG_PROJECT_KEY = "phc_D4FKJnWb7wWGCWs8NoTpQ2xFGFd4jQt698pQ68BrdcXt";
+var CAPTURE_PATH = "/i/v0/e/";
+var SEND_TIMEOUT_MS = 3000;
+var APP = "launchpad-cli";
+var DEVICE_ID_FILE = join16(homedir5(), ".launchpad", "telemetry-id.json");
+var FIRST_RUN_MARKER = join16(homedir5(), ".launchpad", "telemetry-notice-shown");
+function buildEvent(ctx, identity, nowMs) {
+  const properties = {
+    app: APP,
+    command: ctx.command,
+    exit_code: ctx.exitCode,
+    duration_ms: ctx.durationMs,
+    cli_version: CLI_VERSION,
+    os: process.platform,
+    node_version: process.version,
+    ci: ctx.ci,
+    environment: ctx.environment
+  };
+  if (!identity.identified)
+    properties.$process_person_profile = false;
+  return {
+    api_key: POSTHOG_PROJECT_KEY,
+    event: "command_run",
+    distinct_id: identity.distinctId,
+    properties,
+    timestamp: new Date(nowMs).toISOString()
+  };
+}
+function emittingCommand(argv) {
+  const verb = argv[0];
+  if (verb === undefined)
+    return null;
+  if (verb === "--help" || verb === "-h")
+    return null;
+  if (verb === "--version" || verb === "-v")
+    return null;
+  if (verb === INTERNAL_EMIT_VERB || verb === INTERNAL_REFRESH_VERB)
+    return null;
+  return verb;
+}
+function environmentOf(argv, stderrIsTTY) {
+  if (argv.includes("--json"))
+    return "json";
+  return stderrIsTTY ? "tty" : "non-tty";
+}
+async function resolveIdentity(deps) {
+  try {
+    const session = await deps.readSession();
+    if (session && typeof session.accessToken === "string") {
+      let payload = null;
+      try {
+        payload = decodeJwtPayload(session.accessToken);
+      } catch {
+        payload = null;
+      }
+      const id = typeof payload?.email === "string" && payload.email ? payload.email : typeof payload?.sub === "string" && payload.sub ? payload.sub : null;
+      if (id)
+        return { distinctId: id, identified: true };
+    }
+  } catch {}
+  return { distinctId: deps.deviceId(), identified: false };
+}
+async function resolveIdentityReal() {
+  return resolveIdentity({
+    readSession: async () => {
+      const cfg = loadConfig();
+      return readSession(cfg.sessionPath);
+    },
+    deviceId: getOrCreateDeviceId
+  });
+}
+function getOrCreateDeviceId() {
+  try {
+    const raw = JSON.parse(readFileSync20(DEVICE_ID_FILE, "utf8"));
+    const id2 = raw?.deviceId;
+    if (typeof id2 === "string" && id2)
+      return id2;
+  } catch {}
+  const id = randomUUID();
+  try {
+    mkdirSync4(join16(homedir5(), ".launchpad"), { recursive: true });
+    writeFileSync9(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
+`, {
+      mode: 384
+    });
+  } catch {}
+  return id;
+}
+async function postCapture(event, fetcher = fetch) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), SEND_TIMEOUT_MS);
+  try {
+    await fetcher(`${POSTHOG_HOST}${CAPTURE_PATH}`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "user-agent": `launchpad-cli/${CLI_VERSION}`
+      },
+      body: JSON.stringify(event),
+      signal: controller.signal
+    });
+  } catch {} finally {
+    clearTimeout(timer);
+  }
+}
+function recordAfterCommand(argv, exitCode, durationMs, deps) {
+  const command = emittingCommand(argv);
+  if (command === null)
+    return;
+  deps.emit({
+    command,
+    exitCode,
+    durationMs,
+    ci: deps.ci,
+    environment: environmentOf(argv, deps.stderrIsTTY)
+  });
+}
+function recordAfterCommandReal(argv, exitCode, durationMs, cliPath = process.argv[1]) {
+  try {
+    recordAfterCommand(argv, exitCode, durationMs, {
+      emit: (ctx) => spawnDetachedEmit(cliPath, ctx),
+      ci: Boolean(process.env.CI),
+      stderrIsTTY: Boolean(process.stderr.isTTY)
+    });
+  } catch {}
+}
+function spawnDetachedEmit(cliPath, ctx) {
+  if (!cliPath)
+    return;
+  try {
+    const child = spawn7(process.execPath, [
+      cliPath,
+      INTERNAL_EMIT_VERB,
+      "--command",
+      ctx.command,
+      "--exit",
+      String(ctx.exitCode),
+      "--duration",
+      String(ctx.durationMs),
+      "--environment",
+      ctx.environment,
+      ...ctx.ci ? ["--ci"] : []
+    ], { detached: true, stdio: "ignore" });
+    child.unref();
+  } catch {}
+}
+function telemetryNoticeLine() {
+  return "ℹ launchpad records anonymous + signed-in usage analytics (command, CLI version, OS, outcome — never your arguments, paths, or file contents) to improve the platform. Internal staff tooling. More: https://get.launchpad.m-kopa.us/docs/.";
+}
+function firstRunNoticeShown() {
+  try {
+    return existsSync15(FIRST_RUN_MARKER);
+  } catch {
+    return false;
+  }
+}
+function markFirstRunNotice() {
+  try {
+    mkdirSync4(join16(homedir5(), ".launchpad"), { recursive: true });
+    writeFileSync9(FIRST_RUN_MARKER, `${Date.now()}
+`, { mode: 384 });
+  } catch {}
+}
+function maybeFirstRunNotice(io, argv, deps) {
+  if (!deps.stderrIsTTY)
+    return;
+  if (argv.includes("--json"))
+    return;
+  if (emittingCommand(argv) === null)
+    return;
+  if (deps.shown())
+    return;
+  io.err(telemetryNoticeLine());
+  deps.mark();
+}
+function maybeFirstRunNoticeReal(io, argv) {
+  try {
+    maybeFirstRunNotice(io, argv, {
+      stderrIsTTY: Boolean(process.stderr.isTTY),
+      shown: firstRunNoticeShown,
+      mark: markFirstRunNotice
+    });
+  } catch {}
+}
+function parseEmitArgs(args) {
+  const get = (flag) => {
+    const i = args.indexOf(flag);
+    return i >= 0 ? args[i + 1] : undefined;
+  };
+  const command = get("--command");
+  const exit = get("--exit");
+  const duration = get("--duration");
+  const environment = get("--environment");
+  if (!command || exit === undefined || duration === undefined)
+    return null;
+  const env = environment === "json" || environment === "non-tty" ? environment : "tty";
+  return {
+    command,
+    exitCode: Number.parseInt(exit, 10) || 0,
+    durationMs: Number.parseInt(duration, 10) || 0,
+    ci: args.includes("--ci"),
+    environment: env
+  };
+}
+var emitTelemetryCommand = {
+  name: INTERNAL_EMIT_VERB,
+  summary: "(internal) send a usage-telemetry event",
+  hidden: true,
+  run: async (args) => {
+    try {
+      const ctx = parseEmitArgs(args);
+      if (ctx) {
+        const identity = await resolveIdentityReal();
+        await postCapture(buildEvent(ctx, identity, Date.now()));
+      }
+    } catch {}
+    return 0;
+  }
+};
+
 // src/dispatcher.ts
 var COMMANDS = [
   loginCommand,
@@ -11631,7 +11859,8 @@ var COMMANDS = [
   secretsCommand,
   grantEditorCommand,
   revokeEditorCommand,
-  refreshUpdateCacheCommand
+  refreshUpdateCacheCommand,
+  emitTelemetryCommand
 ];
 async function dispatch(argv, io, commands = COMMANDS) {
   if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
@@ -11692,12 +11921,19 @@ var io = {
   }
 };
 var args = process.argv.slice(2);
+var startedAt = Date.now();
 dispatch(args, io).then((code) => {
+  const elapsedMs = Date.now() - startedAt;
   process.exitCode = code;
   notifyAfterCommand(io, args);
+  maybeFirstRunNoticeReal(io, args);
+  recordAfterCommandReal(args, code, elapsedMs);
 }).catch((err) => {
+  const elapsedMs = Date.now() - startedAt;
   const msg = err instanceof Error ? err.message : String(err);
   process.stderr.write(`launchpad: unexpected error: ${msg}
 `);
   process.exitCode = 70;
+  maybeFirstRunNoticeReal(io, args);
+  recordAfterCommandReal(args, 70, elapsedMs);
 });

package/dist/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAkDA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAgCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CAmBnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAmDA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAiCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CAmBnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}

package/dist/telemetry.d.ts

@@ -0,0 +1,84 @@
+import type { CliIo, Command } from "./dispatcher.js";
+/** Internal verb the detached emitter process runs. Hidden from help. */
+export declare const INTERNAL_EMIT_VERB = "__emit-telemetry";
+export declare const POSTHOG_HOST = "https://us.i.posthog.com";
+export declare const POSTHOG_PROJECT_KEY = "phc_D4FKJnWb7wWGCWs8NoTpQ2xFGFd4jQt698pQ68BrdcXt";
+export type Environment = "tty" | "non-tty" | "json";
+/** NON-PII context captured in the foreground and passed to the child. */
+export interface CommandContext {
+    readonly command: string;
+    readonly exitCode: number;
+    readonly durationMs: number;
+    readonly ci: boolean;
+    readonly environment: Environment;
+}
+export interface Identity {
+    readonly distinctId: string;
+    readonly identified: boolean;
+}
+/** PostHog capture wire payload (`/i/v0/e/`). */
+export interface PosthogEvent {
+    readonly api_key: string;
+    readonly event: "command_run";
+    readonly distinct_id: string;
+    readonly properties: Record<string, unknown>;
+    readonly timestamp: string;
+}
+/**
+ * Build the `command_run` event from a FIXED ALLOWLIST of properties.
+ * This is the PII floor (ADR 0027 D6): nothing outside this set can be
+ * sent, so command arguments / paths / env / secrets can never leak.
+ * Anonymous events set `$process_person_profile:false` (cheaper tier).
+ */
+export declare function buildEvent(ctx: CommandContext, identity: Identity, nowMs: number): PosthogEvent;
+/**
+ * The verb to emit for, or `null` when this invocation must NOT emit:
+ * the two internal verbs (the emitter itself — no recursion — and the
+ * update-cache refresh), `--help`/`-h`, `--version`/`-v`, and the bare
+ * no-arg invocation. Every other registered verb emits.
+ */
+export declare function emittingCommand(argv: readonly string[]): string | null;
+export declare function environmentOf(argv: readonly string[], stderrIsTTY: boolean): Environment;
+export interface IdentityDeps {
+    readonly readSession: () => Promise<{
+        accessToken: string;
+    } | null>;
+    readonly deviceId: () => string;
+}
+/**
+ * Entra email (else `sub`) from the session JWT when a session exists,
+ * otherwise a stable anonymous device-id. Resolved INSIDE the detached
+ * child so the email never travels on the foreground command line.
+ */
+export declare function resolveIdentity(deps: IdentityDeps): Promise<Identity>;
+export declare function resolveIdentityReal(): Promise<Identity>;
+/** Read or lazily create the stable anonymous device-id (0600). */
+export declare function getOrCreateDeviceId(): string;
+/** POST the event to PostHog. Bounded by a timeout, totally fail-silent. */
+export declare function postCapture(event: PosthogEvent, fetcher?: typeof fetch): Promise<void>;
+export interface RecordDeps {
+    readonly emit: (ctx: CommandContext) => void;
+    readonly ci: boolean;
+    readonly stderrIsTTY: boolean;
+}
+/** Core: classify the verb and, if it emits, hand a NON-PII context to `emit`. */
+export declare function recordAfterCommand(argv: readonly string[], exitCode: number, durationMs: number, deps: RecordDeps): void;
+/** Real wiring for the bin wrapper. Fully guarded. */
+export declare function recordAfterCommandReal(argv: readonly string[], exitCode: number, durationMs: number, cliPath?: string | undefined): void;
+export declare function telemetryNoticeLine(): string;
+export declare function firstRunNoticeShown(): boolean;
+export declare function markFirstRunNotice(): void;
+export interface NoticeDeps {
+    readonly stderrIsTTY: boolean;
+    readonly shown: () => boolean;
+    readonly mark: () => void;
+}
+/** Show the one-time disclosure on stderr. Never on `--json`, non-TTY, or
+ *  the non-emitting verbs (help/version/internal/no-arg). */
+export declare function maybeFirstRunNotice(io: CliIo, argv: readonly string[], deps: NoticeDeps): void;
+export declare function maybeFirstRunNoticeReal(io: CliIo, argv: readonly string[]): void;
+/** Parse the NON-PII flags the foreground passed; null if malformed. */
+export declare function parseEmitArgs(args: readonly string[]): CommandContext | null;
+/** Hidden command: resolve identity + POST. Runs in the detached process. */
+export declare const emitTelemetryCommand: Command;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAMtD,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAKrD,eAAO,MAAM,YAAY,6BAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,qDACoB,CAAC;AAUrD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;AAErD,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,MAAM,GACZ,YAAY,CAoBd;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAOtE;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,OAAO,GACnB,WAAW,CAGb;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsB3E;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,QAAQ,CAAC,CAQ7D;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,IAAI,MAAM,CAkB5C;AAID,4EAA4E;AAC5E,wBAAsB,WAAW,CAC/B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkBf;AAID,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,GACf,IAAI,CAUN;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,MAAM,GAAG,SAA2B,GAC5C,IAAI,CAUN;AAqCD,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAOzC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;6DAC6D;AAC7D,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,EAAE,UAAU,GACf,IAAI,CAON;AAED,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,IAAI,CAUN;AAID,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAmB5E;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,EAAE,OAgBlC,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.27.5";
+export declare const CLI_VERSION = "0.28.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.27.5",
+  "version": "0.28.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.27.5
+version: 0.28.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.27.5
+version: 0.28.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket). Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.27.5
+version: 0.28.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.27.5
+version: 0.28.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.27.5
+version: 0.28.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.27.5
+version: 0.28.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->