@m-kopa/launchpad-cli 0.36.0 → 0.38.0

package/CHANGELOG.md

@@ -6,6 +6,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.38.0 — 2026-06-19
+
+Feature (sp-cown4k, ADR 0030): **multi-owner co-ownership** — share full
+ownership of an app.
+
+- `add-owner <slug> <id|email>` / `remove-owner <slug> <id|email>` — any current
+  owner can add or remove **co-owners**. A co-owner has full, equal owner rights:
+  manage editors, manage co-owners, transfer, redeploy, and **destroy**. Add by
+  work email (resolved to an id, members-only) or by id. Mirrors `grant-editor`:
+  confirm-preview, hidden `If-Match` retry, fail-soft.
+- `list-owners <slug>` — show the creator (the un-removable anchor) and the
+  co-owners.
+- The original creator stays as the app's anchor and can't be evicted by a
+  co-owner (only displaced via transfer), so an app can never be orphaned.
+
+> Requires the portal-bot deploy that ships `POST/DELETE /apps/<slug>/co-owners`;
+> until then the verbs return a clear endpoint error.
+
+## 0.37.0 — 2026-06-18
+
+Feature (sp-grnted Phase 2, ADR 0028): **grant editors by email**, plus a
+`list-editors` verb.
+
+- `grant-editor` / `revoke-editor` now accept a **work email** as well as an id
+  (`launchpad grant-editor <slug> alice@m-kopa.com`). The email is resolved to
+  the recipient's Entra id via the bot's new `/users/resolve` endpoint — a
+  bounded, exact-match lookup within the platform's **existing** directory
+  consent (no new Graph permission). Members only: ambiguous emails are refused
+  (pass an id instead) and guest/external accounts are rejected.
+- New `launchpad list-editors <slug>` — shows who has editor (BUILD) access.
+- Both verbs now surface that **editor = BUILD rights (clone + deploy)** and that
+  browser VIEW access to the running app is a separate Entra-group grant from IT.
+
+> Requires the portal-bot deploy that ships `/users/resolve`; until then the
+> email path returns a clear resolver error. The id path is unaffected.
+
 ## 0.36.0 — 2026-06-18
 
 Feature (sp-rpt9kd, ADR 0029): **`launchpad bug` / `launchpad feature`** — file a

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.36.0";
+var CLI_VERSION = "0.38.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -12372,6 +12372,39 @@ function describe31(e) {
 
 // src/commands/editors.ts
 import { createInterface as createInterface5 } from "node:readline/promises";
+
+// src/commands/resolve-target.ts
+async function resolveTarget(verb, target, cfg, deps, io) {
+  if (!target.includes("@")) {
+    return { kind: "id", id: target, label: target, resolvedFromEmail: false };
+  }
+  const body = await deps.apiJson(cfg, {
+    path: `/users/resolve?email=${encodeURIComponent(target)}`,
+    nonThrowingStatuses: [400, 403, 404, 409, 502, 503]
+  });
+  if (typeof body.oid === "string" && body.oid.length > 0) {
+    return { kind: "id", id: body.oid, label: target, resolvedFromEmail: true };
+  }
+  io.err(resolveErrorMessage(verb, target, body));
+  return { kind: "error", exit: 1 };
+}
+function resolveErrorMessage(verb, email, body) {
+  const fallback = `pass their id from \`launchpad whoami --share\` instead.`;
+  switch (body.error) {
+    case "user_not_found":
+      return `launchpad ${verb}: no Entra user matches "${email}" — check the address, or ${fallback}`;
+    case "ambiguous_email":
+      return `launchpad ${verb}: "${email}" matches more than one user — ${fallback}`;
+    case "guest_unsupported":
+      return `launchpad ${verb}: "${email}" is a guest/external user — grant-by-email is members-only; ${fallback}`;
+    case "bad_request":
+      return `launchpad ${verb}: "${email}" is not a valid email address.`;
+    default:
+      return `launchpad ${verb}: could not resolve "${email}"${body.message ? `: ${body.message}` : ""} — ${fallback}`;
+  }
+}
+
+// src/commands/editors.ts
 var CONFLICT_EXIT = 75;
 function realDeps() {
   return {
@@ -12422,8 +12455,9 @@ async function runEditor(action, args, io, deps) {
   const verb = action === "grant" ? "grant-editor" : "revoke-editor";
   const parsed = parseArgs14(args);
   if (parsed === null) {
-    io.err(`usage: launchpad ${verb} <slug> <id> [--yes] [--json]`);
-    io.err("  <id> is the recipient's value from `launchpad whoami --share`.");
+    io.err(`usage: launchpad ${verb} <slug> <id|email> [--yes] [--json]`);
+    io.err("  <id> is the recipient's value from `launchpad whoami --share`,");
+    io.err("  or pass their @-email and it is resolved to their id.");
     return 64;
   }
   const { slug, target, yes, json } = parsed;
@@ -12433,15 +12467,21 @@ async function runEditor(action, args, io, deps) {
   }
   try {
     const cfg = deps.loadConfig();
+    const resolved = await resolveTarget(verb, target, cfg, deps, io);
+    if (resolved.kind === "error")
+      return resolved.exit;
+    const editorId = resolved.id;
+    const label = resolved.label;
     const current = await deps.apiJson(cfg, {
       path: `/apps/${slug}`
     });
-    const alreadyEditor = current.record.editors.includes(target);
+    const alreadyEditor = current.record.editors.includes(editorId);
     if (!yes) {
       const noop = action === "grant" && alreadyEditor || action === "revoke" && !alreadyEditor;
+      const subject = resolved.resolvedFromEmail ? `${label}  (id ${editorId})` : label;
       io.out(action === "grant" ? `About to grant editor access on "${slug}" to:
-  ${target}` : `About to revoke editor access on "${slug}" from:
-  ${target}`);
+  ${subject}` : `About to revoke editor access on "${slug}" from:
+  ${subject}`);
       if (noop) {
         io.out(action === "grant" ? "  (already an editor — this will be a no-op)" : "  (not currently an editor — this will be a no-op)");
       }
@@ -12451,7 +12491,7 @@ async function runEditor(action, args, io, deps) {
         return 0;
       }
     }
-    const result = await mutateWithRetry(action, slug, target, current.record.version, cfg, deps);
+    const result = await mutateWithRetry(action, slug, editorId, current.record.version, cfg, deps);
     if (result.kind === "conflict") {
       io.err(`launchpad ${verb}: the app record for "${slug}" changed during the ${action} — re-run \`launchpad ${verb} ${slug} ${target}\`.`);
       return CONFLICT_EXIT;
@@ -12462,16 +12502,21 @@ async function runEditor(action, args, io, deps) {
         ok: true,
         slug,
         action,
-        editor: target,
+        editor: editorId,
+        input: target,
         changed,
         editors: result.record.editors
       }));
       return 0;
     }
     if (!changed) {
-      io.out(action === "grant" ? `${target} was already an editor on "${slug}" — no change.` : `${target} was not an editor on "${slug}" — no change.`);
+      io.out(action === "grant" ? `${label} was already an editor on "${slug}" — no change.` : `${label} was not an editor on "${slug}" — no change.`);
     } else {
-      io.out(action === "grant" ? `✓ ${target} is now an editor on "${slug}".` : `✓ ${target} is no longer an editor on "${slug}".`);
+      io.out(action === "grant" ? `✓ ${label} is now an editor on "${slug}".` : `✓ ${label} is no longer an editor on "${slug}".`);
+    }
+    if (action === "grant") {
+      io.out("  Note: editor access = BUILD rights (clone + deploy). Opening the");
+      io.out("  running app in a browser is a separate Entra-group grant from IT.");
     }
     return 0;
   } catch (e) {
@@ -12527,6 +12572,318 @@ function describe32(e) {
 var grantEditorCommand = makeEditorCommand("grant");
 var revokeEditorCommand = makeEditorCommand("revoke");
 
+// src/commands/list-editors.ts
+function realDeps2() {
+  return { loadConfig, apiJson };
+}
+function parseArgs15(args) {
+  let slug;
+  let json = false;
+  for (const a of args) {
+    if (a === "--json")
+      json = true;
+    else if (slug === undefined)
+      slug = a;
+  }
+  if (slug === undefined)
+    return null;
+  return { slug, json };
+}
+async function runListEditors(args, io, deps) {
+  const parsed = parseArgs15(args);
+  if (parsed === null) {
+    io.err("usage: launchpad list-editors <slug> [--json]");
+    return 64;
+  }
+  const { slug, json } = parsed;
+  try {
+    const cfg = deps.loadConfig();
+    const current = await deps.apiJson(cfg, {
+      path: `/apps/${slug}`
+    });
+    const editors = current.record.editors;
+    if (json) {
+      io.out(JSON.stringify({ slug, editors }));
+      return 0;
+    }
+    if (editors.length === 0) {
+      io.out(`No editors on "${slug}" — only the owner has BUILD access.`);
+    } else {
+      io.out(`Editors on "${slug}" (${editors.length}):`);
+      for (const e of editors)
+        io.out(`  ${e}`);
+    }
+    io.out("");
+    io.out("Editor access = BUILD rights (clone + deploy). Browser VIEW access to");
+    io.out("the running app is a separate Entra-group grant from IT.");
+    return 0;
+  } catch (e) {
+    if (e instanceof UnauthenticatedError) {
+      io.err(e.message);
+      return 1;
+    }
+    if (e instanceof ForbiddenError) {
+      io.err(`launchpad list-editors: not authorised to view editors on "${slug}".`);
+      return 1;
+    }
+    if (e instanceof NotFoundError) {
+      io.err(`launchpad list-editors: no app "${slug}" — check the slug with \`launchpad apps\`.`);
+      return 1;
+    }
+    io.err(`launchpad list-editors failed: ${e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+}
+function makeListEditorsCommand(deps = realDeps2()) {
+  return {
+    name: "list-editors",
+    summary: "list the developers with editor (BUILD) access to an app",
+    run: (args, io) => runListEditors(args, io, deps)
+  };
+}
+var listEditorsCommand = makeListEditorsCommand();
+
+// src/commands/owners.ts
+import { createInterface as createInterface6 } from "node:readline/promises";
+var CONFLICT_EXIT2 = 75;
+function realDeps3() {
+  return {
+    loadConfig,
+    apiJson,
+    isTty: () => process.stdout.isTTY === true,
+    prompt: async (question) => {
+      const rl = createInterface6({ input: process.stdin, output: process.stdout });
+      try {
+        return (await rl.question(question)).trim();
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+function parseArgs16(args) {
+  let slug;
+  let target;
+  let yes = false;
+  let json = false;
+  for (const a of args) {
+    if (a === "--yes" || a === "-y")
+      yes = true;
+    else if (a === "--json")
+      json = true;
+    else if (slug === undefined)
+      slug = a;
+    else if (target === undefined)
+      target = a;
+  }
+  if (slug === undefined || target === undefined)
+    return null;
+  return { slug, target, yes, json };
+}
+function isVersionMismatch2(b) {
+  return typeof b === "object" && b !== null && b.error === "version_mismatch" && typeof b.currentVersion === "number";
+}
+function makeOwnerCommand(action, deps = realDeps3()) {
+  const name = action === "add" ? "add-owner" : "remove-owner";
+  return {
+    name,
+    summary: action === "add" ? "add a co-owner with full owner rights to an app (by id or email)" : "remove a co-owner from an app",
+    run: (args, io) => runOwner(action, args, io, deps)
+  };
+}
+async function runOwner(action, args, io, deps) {
+  const verb = action === "add" ? "add-owner" : "remove-owner";
+  const parsed = parseArgs16(args);
+  if (parsed === null) {
+    io.err(`usage: launchpad ${verb} <slug> <id|email> [--yes] [--json]`);
+    io.err("  <id> is the recipient's value from `launchpad whoami --share`,");
+    io.err("  or pass their @-email and it is resolved to their id.");
+    return 64;
+  }
+  const { slug, target, yes, json } = parsed;
+  if (!yes && !deps.isTty()) {
+    io.err(`launchpad ${verb}: refusing to mutate "${slug}" without confirmation — pass --yes in non-interactive mode.`);
+    return 64;
+  }
+  try {
+    const cfg = deps.loadConfig();
+    const resolved = await resolveTarget(verb, target, cfg, deps, io);
+    if (resolved.kind === "error")
+      return resolved.exit;
+    const ownerId = resolved.id;
+    const label = resolved.label;
+    const current = await deps.apiJson(cfg, {
+      path: `/apps/${slug}`
+    });
+    const alreadyOwner = current.record.owner === ownerId || current.record.coOwners.includes(ownerId);
+    if (!yes) {
+      const noop = action === "add" && alreadyOwner || action === "remove" && !current.record.coOwners.includes(ownerId);
+      const subject = resolved.resolvedFromEmail ? `${label}  (id ${ownerId})` : label;
+      io.out(action === "add" ? `About to add a co-owner on "${slug}":
+  ${subject}` : `About to remove a co-owner on "${slug}":
+  ${subject}`);
+      if (action === "add") {
+        io.out("  A co-owner gets FULL owner rights (manage editors, owners,");
+        io.out("  transfer, redeploy, AND destroy).");
+      }
+      if (noop) {
+        io.out(action === "add" ? current.record.owner === ownerId ? "  (already the owner — this will be a no-op)" : "  (already a co-owner — this will be a no-op)" : "  (not currently a co-owner — this will be a no-op)");
+      }
+      const answer = (await deps.prompt("Proceed? [y/N] ")).toLowerCase();
+      if (answer !== "y" && answer !== "yes") {
+        io.out("Aborted — no change made.");
+        return 0;
+      }
+    }
+    const result = await mutateWithRetry2(action, slug, ownerId, current.record.version, cfg, deps);
+    if (result.kind === "conflict") {
+      io.err(`launchpad ${verb}: the app record for "${slug}" changed during the ${action} — re-run \`launchpad ${verb} ${slug} ${target}\`.`);
+      return CONFLICT_EXIT2;
+    }
+    const changed = result.record.version !== result.attemptedVersion;
+    if (json) {
+      io.out(JSON.stringify({
+        ok: true,
+        slug,
+        action,
+        coOwner: ownerId,
+        input: target,
+        changed,
+        coOwners: result.record.coOwners
+      }));
+      return 0;
+    }
+    if (!changed) {
+      io.out(action === "add" ? `${label} was already an owner of "${slug}" — no change.` : `${label} was not a co-owner of "${slug}" — no change.`);
+    } else {
+      io.out(action === "add" ? `✓ ${label} is now a co-owner of "${slug}" (full owner rights).` : `✓ ${label} is no longer a co-owner of "${slug}".`);
+    }
+    return 0;
+  } catch (e) {
+    if (e instanceof UnauthenticatedError) {
+      io.err(e.message);
+      return 1;
+    }
+    if (e instanceof ForbiddenError) {
+      io.err(`launchpad ${verb}: not authorised — you must be an owner of "${slug}" to manage its owners.`);
+      return 1;
+    }
+    if (e instanceof NotFoundError) {
+      io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
+      return 1;
+    }
+    io.err(`launchpad ${verb} failed: ${describe33(e)}`);
+    return 1;
+  }
+}
+async function mutateWithRetry2(action, slug, target, startVersion, cfg, deps) {
+  let version = startVersion;
+  for (let attempt = 0;attempt < 2; attempt++) {
+    const body = await sendMutation2(action, slug, target, version, cfg, deps);
+    if (isVersionMismatch2(body)) {
+      version = body.currentVersion;
+      continue;
+    }
+    return { kind: "ok", record: body.record, attemptedVersion: version };
+  }
+  return { kind: "conflict" };
+}
+async function sendMutation2(action, slug, target, version, cfg, deps) {
+  const headers = { "if-match": String(version) };
+  if (action === "add") {
+    return deps.apiJson(cfg, {
+      method: "POST",
+      path: `/apps/${slug}/co-owners`,
+      jsonBody: { coOwner: target },
+      headers,
+      nonThrowingStatuses: [409]
+    });
+  }
+  return deps.apiJson(cfg, {
+    method: "DELETE",
+    path: `/apps/${slug}/co-owners/${encodeURIComponent(target)}`,
+    headers,
+    nonThrowingStatuses: [409]
+  });
+}
+function describe33(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+var addOwnerCommand = makeOwnerCommand("add");
+var removeOwnerCommand = makeOwnerCommand("remove");
+
+// src/commands/list-owners.ts
+function realDeps4() {
+  return { loadConfig, apiJson };
+}
+function parseArgs17(args) {
+  let slug;
+  let json = false;
+  for (const a of args) {
+    if (a === "--json")
+      json = true;
+    else if (slug === undefined)
+      slug = a;
+  }
+  if (slug === undefined)
+    return null;
+  return { slug, json };
+}
+async function runListOwners(args, io, deps) {
+  const parsed = parseArgs17(args);
+  if (parsed === null) {
+    io.err("usage: launchpad list-owners <slug> [--json]");
+    return 64;
+  }
+  const { slug, json } = parsed;
+  try {
+    const cfg = deps.loadConfig();
+    const current = await deps.apiJson(cfg, {
+      path: `/apps/${slug}`
+    });
+    const { owner, coOwners } = current.record;
+    if (json) {
+      io.out(JSON.stringify({ slug, owner, coOwners }));
+      return 0;
+    }
+    io.out(`Owners of "${slug}":`);
+    io.out(`  ${owner}  (creator)`);
+    if (coOwners.length === 0) {
+      io.out("  (no co-owners — only the creator has owner rights)");
+    } else {
+      for (const c of coOwners)
+        io.out(`  ${c}  (co-owner)`);
+    }
+    io.out("");
+    io.out("Every owner has full rights (manage editors + owners, transfer, redeploy,");
+    io.out("destroy). The creator is the un-removable anchor (displace via transfer).");
+    return 0;
+  } catch (e) {
+    if (e instanceof UnauthenticatedError) {
+      io.err(e.message);
+      return 1;
+    }
+    if (e instanceof ForbiddenError) {
+      io.err(`launchpad list-owners: not authorised to view owners on "${slug}".`);
+      return 1;
+    }
+    if (e instanceof NotFoundError) {
+      io.err(`launchpad list-owners: no app "${slug}" — check the slug with \`launchpad apps\`.`);
+      return 1;
+    }
+    io.err(`launchpad list-owners failed: ${e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+}
+function makeListOwnersCommand(deps = realDeps4()) {
+  return {
+    name: "list-owners",
+    summary: "list the owners (creator + co-owners) of an app",
+    run: (args, io) => runListOwners(args, io, deps)
+  };
+}
+var listOwnersCommand = makeListOwnersCommand();
+
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
@@ -12926,7 +13283,7 @@ var emitTelemetryCommand = {
 };
 
 // src/commands/report.ts
-import { createInterface as createInterface6 } from "node:readline/promises";
+import { createInterface as createInterface7 } from "node:readline/promises";
 import { platform } from "node:os";
 
 // src/report/breadcrumb.ts
@@ -12959,13 +13316,13 @@ function readBreadcrumb() {
 }
 
 // src/commands/report.ts
-function realDeps2() {
+function realDeps5() {
   return {
     loadConfig,
     apiJson,
     isTty: () => process.stdout.isTTY === true && process.stdin.isTTY === true,
     prompt: async (question) => {
-      const rl = createInterface6({ input: process.stdin, output: process.stdout });
+      const rl = createInterface7({ input: process.stdin, output: process.stdout });
       try {
         return (await rl.question(question)).trim();
       } finally {
@@ -12978,7 +13335,7 @@ function realDeps2() {
     readBreadcrumb
   };
 }
-function parseArgs15(args) {
+function parseArgs18(args) {
   let title;
   let message;
   let positional;
@@ -13008,7 +13365,7 @@ function parseArgs15(args) {
 var NOUN = { bug: "bug report", feature: "feature request" };
 async function runReport(kind, args, io, deps) {
   const verb = kind;
-  const parsed = parseArgs15(args);
+  const parsed = parseArgs18(args);
   let message = parsed.message ?? parsed.positional ?? "";
   let title = parsed.title ?? "";
   if (message === "" && deps.isTty()) {
@@ -13090,7 +13447,7 @@ function buildContext(deps) {
     ctx.appSlug = slug;
   return ctx;
 }
-function makeReportCommand(kind, deps = realDeps2()) {
+function makeReportCommand(kind, deps = realDeps5()) {
   return {
     name: kind,
     summary: kind === "bug" ? "file a bug report (lands in the team's Linear inbox)" : "file a feature request (lands in the team's Linear inbox)",
@@ -13128,6 +13485,10 @@ var COMMANDS = [
   secretsCommand,
   grantEditorCommand,
   revokeEditorCommand,
+  listEditorsCommand,
+  addOwnerCommand,
+  removeOwnerCommand,
+  listOwnersCommand,
   makeReportCommand("bug"),
   makeReportCommand("feature"),
   refreshUpdateCacheCommand,

package/dist/commands/editors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"editors.d.ts","sourceRoot":"","sources":["../../src/commands/editors.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,iFAAiF;AACjF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AA8DD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,UAAuB,GAAG,OAAO,CAU9F;AAgLD,eAAO,MAAM,kBAAkB,EAAE,OAAoC,CAAC;AACtE,eAAO,MAAM,mBAAmB,EAAE,OAAqC,CAAC"}
+{"version":3,"file":"editors.d.ts","sourceRoot":"","sources":["../../src/commands/editors.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,iFAAiF;AACjF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AA8DD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,UAAuB,GAAG,OAAO,CAU9F;AAwMD,eAAO,MAAM,kBAAkB,EAAE,OAAoC,CAAC;AACtE,eAAO,MAAM,mBAAmB,EAAE,OAAqC,CAAC"}

package/dist/commands/list-editors.d.ts

@@ -0,0 +1,10 @@
+import type { CliConfig } from "../config.js";
+import type { ApiRequestOptions } from "../http/api-client.js";
+import type { Command } from "../dispatcher.js";
+export interface ListEditorsDeps {
+    readonly loadConfig: () => CliConfig;
+    readonly apiJson: <T>(cfg: CliConfig, opts: ApiRequestOptions) => Promise<T>;
+}
+export declare function makeListEditorsCommand(deps?: ListEditorsDeps): Command;
+export declare const listEditorsCommand: Command;
+//# sourceMappingURL=list-editors.d.ts.map

package/dist/commands/list-editors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-editors.d.ts","sourceRoot":"","sources":["../../src/commands/list-editors.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAyFD,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,eAA4B,GACjC,OAAO,CAMT;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAkC,CAAC"}

package/dist/commands/list-owners.d.ts

@@ -0,0 +1,10 @@
+import type { CliConfig } from "../config.js";
+import type { ApiRequestOptions } from "../http/api-client.js";
+import type { Command } from "../dispatcher.js";
+export interface ListOwnersDeps {
+    readonly loadConfig: () => CliConfig;
+    readonly apiJson: <T>(cfg: CliConfig, opts: ApiRequestOptions) => Promise<T>;
+}
+export declare function makeListOwnersCommand(deps?: ListOwnersDeps): Command;
+export declare const listOwnersCommand: Command;
+//# sourceMappingURL=list-owners.d.ts.map

package/dist/commands/list-owners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-owners.d.ts","sourceRoot":"","sources":["../../src/commands/list-owners.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AA4FD,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,cAA2B,GAChC,OAAO,CAMT;AAED,eAAO,MAAM,iBAAiB,EAAE,OAAiC,CAAC"}

package/dist/commands/owners.d.ts

@@ -0,0 +1,16 @@
+import type { CliConfig } from "../config.js";
+import type { ApiRequestOptions } from "../http/api-client.js";
+import type { Command } from "../dispatcher.js";
+/** EX_TEMPFAIL — a concurrent edit won the race; the action is safe to retry. */
+export declare const CONFLICT_EXIT = 75;
+export type OwnerAction = "add" | "remove";
+export interface OwnerDeps {
+    readonly loadConfig: () => CliConfig;
+    readonly apiJson: <T>(cfg: CliConfig, opts: ApiRequestOptions) => Promise<T>;
+    readonly isTty: () => boolean;
+    readonly prompt: (question: string) => Promise<string>;
+}
+export declare function makeOwnerCommand(action: OwnerAction, deps?: OwnerDeps): Command;
+export declare const addOwnerCommand: Command;
+export declare const removeOwnerCommand: Command;
+//# sourceMappingURL=owners.d.ts.map

package/dist/commands/owners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owners.d.ts","sourceRoot":"","sources":["../../src/commands/owners.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAEjE,iFAAiF;AACjF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AA+DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,SAAsB,GAAG,OAAO,CAU3F;AAoMD,eAAO,MAAM,eAAe,EAAE,OAAiC,CAAC;AAChE,eAAO,MAAM,kBAAkB,EAAE,OAAoC,CAAC"}

package/dist/commands/resolve-target.d.ts

@@ -0,0 +1,26 @@
+import type { CliConfig } from "../config.js";
+import type { ApiRequestOptions } from "../http/api-client.js";
+import type { CliIo, ExitCode } from "../dispatcher.js";
+/** Minimal dependency surface the resolver needs (a subset of the
+ *  per-command Deps objects, which all carry `apiJson`). */
+export interface ResolveDeps {
+    readonly apiJson: <T>(cfg: CliConfig, opts: ApiRequestOptions) => Promise<T>;
+}
+export type ResolveOutcome = {
+    kind: "id";
+    id: string;
+    label: string;
+    resolvedFromEmail: boolean;
+} | {
+    kind: "error";
+    exit: ExitCode;
+};
+export interface ResolveResponse {
+    readonly oid?: string;
+    readonly userPrincipalName?: string;
+    readonly error?: string;
+    readonly message?: string;
+}
+export declare function resolveTarget(verb: string, target: string, cfg: CliConfig, deps: ResolveDeps, io: Pick<CliIo, "err">): Promise<ResolveOutcome>;
+export declare function resolveErrorMessage(verb: string, email: string, body: ResolveResponse): string;
+//# sourceMappingURL=resolve-target.d.ts.map

package/dist/commands/resolve-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-target.d.ts","sourceRoot":"","sources":["../../src/commands/resolve-target.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD;4DAC4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GACrB,OAAO,CAAC,cAAc,CAAC,CAiBzB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,eAAe,GACpB,MAAM,CAcR"}

package/dist/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAuDA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAqCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AA0DA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAyCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.36.0";
+export declare const CLI_VERSION = "0.38.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.36.0",
-  "description": "Launchpad CLI \u2014 clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
+  "version": "0.38.0",
+  "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
     "launchpad": "./dist/cli.js"

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.36.0
+version: 0.38.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->