@m-kopa/launchpad-cli 0.36.0 → 0.37.0

package/CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.37.0 — 2026-06-18
+
+Feature (sp-grnted Phase 2, ADR 0028): **grant editors by email**, plus a
+`list-editors` verb.
+
+- `grant-editor` / `revoke-editor` now accept a **work email** as well as an id
+  (`launchpad grant-editor <slug> alice@m-kopa.com`). The email is resolved to
+  the recipient's Entra id via the bot's new `/users/resolve` endpoint — a
+  bounded, exact-match lookup within the platform's **existing** directory
+  consent (no new Graph permission). Members only: ambiguous emails are refused
+  (pass an id instead) and guest/external accounts are rejected.
+- New `launchpad list-editors <slug>` — shows who has editor (BUILD) access.
+- Both verbs now surface that **editor = BUILD rights (clone + deploy)** and that
+  browser VIEW access to the running app is a separate Entra-group grant from IT.
+
+> Requires the portal-bot deploy that ships `/users/resolve`; until then the
+> email path returns a clear resolver error. The id path is unaffected.
+
 ## 0.36.0 — 2026-06-18
 
 Feature (sp-rpt9kd, ADR 0029): **`launchpad bug` / `launchpad feature`** — file a

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.36.0";
+var CLI_VERSION = "0.37.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -12422,8 +12422,9 @@ async function runEditor(action, args, io, deps) {
   const verb = action === "grant" ? "grant-editor" : "revoke-editor";
   const parsed = parseArgs14(args);
   if (parsed === null) {
-    io.err(`usage: launchpad ${verb} <slug> <id> [--yes] [--json]`);
-    io.err("  <id> is the recipient's value from `launchpad whoami --share`.");
+    io.err(`usage: launchpad ${verb} <slug> <id|email> [--yes] [--json]`);
+    io.err("  <id> is the recipient's value from `launchpad whoami --share`,");
+    io.err("  or pass their @-email and it is resolved to their id.");
     return 64;
   }
   const { slug, target, yes, json } = parsed;
@@ -12433,15 +12434,21 @@ async function runEditor(action, args, io, deps) {
   }
   try {
     const cfg = deps.loadConfig();
+    const resolved = await resolveTarget(verb, target, cfg, deps, io);
+    if (resolved.kind === "error")
+      return resolved.exit;
+    const editorId = resolved.id;
+    const label = resolved.label;
     const current = await deps.apiJson(cfg, {
       path: `/apps/${slug}`
     });
-    const alreadyEditor = current.record.editors.includes(target);
+    const alreadyEditor = current.record.editors.includes(editorId);
     if (!yes) {
       const noop = action === "grant" && alreadyEditor || action === "revoke" && !alreadyEditor;
+      const subject = resolved.resolvedFromEmail ? `${label}  (id ${editorId})` : label;
       io.out(action === "grant" ? `About to grant editor access on "${slug}" to:
-  ${target}` : `About to revoke editor access on "${slug}" from:
-  ${target}`);
+  ${subject}` : `About to revoke editor access on "${slug}" from:
+  ${subject}`);
       if (noop) {
         io.out(action === "grant" ? "  (already an editor — this will be a no-op)" : "  (not currently an editor — this will be a no-op)");
       }
@@ -12451,7 +12458,7 @@ async function runEditor(action, args, io, deps) {
         return 0;
       }
     }
-    const result = await mutateWithRetry(action, slug, target, current.record.version, cfg, deps);
+    const result = await mutateWithRetry(action, slug, editorId, current.record.version, cfg, deps);
     if (result.kind === "conflict") {
       io.err(`launchpad ${verb}: the app record for "${slug}" changed during the ${action} — re-run \`launchpad ${verb} ${slug} ${target}\`.`);
       return CONFLICT_EXIT;
@@ -12462,16 +12469,21 @@ async function runEditor(action, args, io, deps) {
         ok: true,
         slug,
         action,
-        editor: target,
+        editor: editorId,
+        input: target,
         changed,
         editors: result.record.editors
       }));
       return 0;
     }
     if (!changed) {
-      io.out(action === "grant" ? `${target} was already an editor on "${slug}" — no change.` : `${target} was not an editor on "${slug}" — no change.`);
+      io.out(action === "grant" ? `${label} was already an editor on "${slug}" — no change.` : `${label} was not an editor on "${slug}" — no change.`);
     } else {
-      io.out(action === "grant" ? `✓ ${target} is now an editor on "${slug}".` : `✓ ${target} is no longer an editor on "${slug}".`);
+      io.out(action === "grant" ? `✓ ${label} is now an editor on "${slug}".` : `✓ ${label} is no longer an editor on "${slug}".`);
+    }
+    if (action === "grant") {
+      io.out("  Note: editor access = BUILD rights (clone + deploy). Opening the");
+      io.out("  running app in a browser is a separate Entra-group grant from IT.");
     }
     return 0;
   } catch (e) {
@@ -12524,9 +12536,109 @@ async function sendMutation(action, slug, target, version, cfg, deps) {
 function describe32(e) {
   return e instanceof Error ? e.message : String(e);
 }
+async function resolveTarget(verb, target, cfg, deps, io) {
+  if (!target.includes("@")) {
+    return { kind: "id", id: target, label: target, resolvedFromEmail: false };
+  }
+  const body = await deps.apiJson(cfg, {
+    path: `/users/resolve?email=${encodeURIComponent(target)}`,
+    nonThrowingStatuses: [400, 403, 404, 409, 502, 503]
+  });
+  if (typeof body.oid === "string" && body.oid.length > 0) {
+    return { kind: "id", id: body.oid, label: target, resolvedFromEmail: true };
+  }
+  io.err(resolveErrorMessage(verb, target, body));
+  return { kind: "error", exit: 1 };
+}
+function resolveErrorMessage(verb, email, body) {
+  const fallback = `pass their id from \`launchpad whoami --share\` instead.`;
+  switch (body.error) {
+    case "user_not_found":
+      return `launchpad ${verb}: no Entra user matches "${email}" — check the address, or ${fallback}`;
+    case "ambiguous_email":
+      return `launchpad ${verb}: "${email}" matches more than one user — ${fallback}`;
+    case "guest_unsupported":
+      return `launchpad ${verb}: "${email}" is a guest/external user — grant-by-email is members-only; ${fallback}`;
+    case "bad_request":
+      return `launchpad ${verb}: "${email}" is not a valid email address.`;
+    default:
+      return `launchpad ${verb}: could not resolve "${email}"${body.message ? `: ${body.message}` : ""} — ${fallback}`;
+  }
+}
 var grantEditorCommand = makeEditorCommand("grant");
 var revokeEditorCommand = makeEditorCommand("revoke");
 
+// src/commands/list-editors.ts
+function realDeps2() {
+  return { loadConfig, apiJson };
+}
+function parseArgs15(args) {
+  let slug;
+  let json = false;
+  for (const a of args) {
+    if (a === "--json")
+      json = true;
+    else if (slug === undefined)
+      slug = a;
+  }
+  if (slug === undefined)
+    return null;
+  return { slug, json };
+}
+async function runListEditors(args, io, deps) {
+  const parsed = parseArgs15(args);
+  if (parsed === null) {
+    io.err("usage: launchpad list-editors <slug> [--json]");
+    return 64;
+  }
+  const { slug, json } = parsed;
+  try {
+    const cfg = deps.loadConfig();
+    const current = await deps.apiJson(cfg, {
+      path: `/apps/${slug}`
+    });
+    const editors = current.record.editors;
+    if (json) {
+      io.out(JSON.stringify({ slug, editors }));
+      return 0;
+    }
+    if (editors.length === 0) {
+      io.out(`No editors on "${slug}" — only the owner has BUILD access.`);
+    } else {
+      io.out(`Editors on "${slug}" (${editors.length}):`);
+      for (const e of editors)
+        io.out(`  ${e}`);
+    }
+    io.out("");
+    io.out("Editor access = BUILD rights (clone + deploy). Browser VIEW access to");
+    io.out("the running app is a separate Entra-group grant from IT.");
+    return 0;
+  } catch (e) {
+    if (e instanceof UnauthenticatedError) {
+      io.err(e.message);
+      return 1;
+    }
+    if (e instanceof ForbiddenError) {
+      io.err(`launchpad list-editors: not authorised to view editors on "${slug}".`);
+      return 1;
+    }
+    if (e instanceof NotFoundError) {
+      io.err(`launchpad list-editors: no app "${slug}" — check the slug with \`launchpad apps\`.`);
+      return 1;
+    }
+    io.err(`launchpad list-editors failed: ${e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+}
+function makeListEditorsCommand(deps = realDeps2()) {
+  return {
+    name: "list-editors",
+    summary: "list the developers with editor (BUILD) access to an app",
+    run: (args, io) => runListEditors(args, io, deps)
+  };
+}
+var listEditorsCommand = makeListEditorsCommand();
+
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
@@ -12959,7 +13071,7 @@ function readBreadcrumb() {
 }
 
 // src/commands/report.ts
-function realDeps2() {
+function realDeps3() {
   return {
     loadConfig,
     apiJson,
@@ -12978,7 +13090,7 @@ function realDeps2() {
     readBreadcrumb
   };
 }
-function parseArgs15(args) {
+function parseArgs16(args) {
   let title;
   let message;
   let positional;
@@ -13008,7 +13120,7 @@ function parseArgs15(args) {
 var NOUN = { bug: "bug report", feature: "feature request" };
 async function runReport(kind, args, io, deps) {
   const verb = kind;
-  const parsed = parseArgs15(args);
+  const parsed = parseArgs16(args);
   let message = parsed.message ?? parsed.positional ?? "";
   let title = parsed.title ?? "";
   if (message === "" && deps.isTty()) {
@@ -13090,7 +13202,7 @@ function buildContext(deps) {
     ctx.appSlug = slug;
   return ctx;
 }
-function makeReportCommand(kind, deps = realDeps2()) {
+function makeReportCommand(kind, deps = realDeps3()) {
   return {
     name: kind,
     summary: kind === "bug" ? "file a bug report (lands in the team's Linear inbox)" : "file a feature request (lands in the team's Linear inbox)",
@@ -13128,6 +13240,7 @@ var COMMANDS = [
   secretsCommand,
   grantEditorCommand,
   revokeEditorCommand,
+  listEditorsCommand,
   makeReportCommand("bug"),
   makeReportCommand("feature"),
   refreshUpdateCacheCommand,

package/dist/commands/editors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"editors.d.ts","sourceRoot":"","sources":["../../src/commands/editors.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,iFAAiF;AACjF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AA8DD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,UAAuB,GAAG,OAAO,CAU9F;AAgLD,eAAO,MAAM,kBAAkB,EAAE,OAAoC,CAAC;AACtE,eAAO,MAAM,mBAAmB,EAAE,OAAqC,CAAC"}
+{"version":3,"file":"editors.d.ts","sourceRoot":"","sources":["../../src/commands/editors.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,iFAAiF;AACjF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AA8DD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,UAAuB,GAAG,OAAO,CAU9F;AAuQD,eAAO,MAAM,kBAAkB,EAAE,OAAoC,CAAC;AACtE,eAAO,MAAM,mBAAmB,EAAE,OAAqC,CAAC"}

package/dist/commands/list-editors.d.ts

@@ -0,0 +1,10 @@
+import type { CliConfig } from "../config.js";
+import type { ApiRequestOptions } from "../http/api-client.js";
+import type { Command } from "../dispatcher.js";
+export interface ListEditorsDeps {
+    readonly loadConfig: () => CliConfig;
+    readonly apiJson: <T>(cfg: CliConfig, opts: ApiRequestOptions) => Promise<T>;
+}
+export declare function makeListEditorsCommand(deps?: ListEditorsDeps): Command;
+export declare const listEditorsCommand: Command;
+//# sourceMappingURL=list-editors.d.ts.map

package/dist/commands/list-editors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-editors.d.ts","sourceRoot":"","sources":["../../src/commands/list-editors.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAyFD,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,eAA4B,GACjC,OAAO,CAMT;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAkC,CAAC"}

package/dist/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAuDA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAqCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAwDA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAsCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.36.0";
+export declare const CLI_VERSION = "0.37.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Launchpad CLI \u2014 clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.36.0
+version: 0.37.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->