@m-kopa/launchpad-cli 0.41.0 → 0.41.1

package/CHANGELOG.md

@@ -6,6 +6,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.41.1 — 2026-06-30
+
+Docs & skills correctness fix: **any Entra group in the tenant can gate an
+app — it does not need to be assigned to the Launchpad enterprise
+application** (PS-1733, live 2026-06-25). The docs and bundled skills still
+described the retired "assigned-only" rule, which led to users being wrongly
+told to ask IT to assign a group (e.g. `G_information_security`) before they
+could use it. Corrected across the auth concept, manifest reference,
+`first-app`/`auth` guides, and the `validate` / `groups` / `deploy` command
+pages, and in the `launchpad-deploy` / `launchpad-content-pr` skills. Key
+clarification: `launchpad groups` and `launchpad validate --strict-groups`
+resolve only against the **assigned** set and will **falsely reject** a valid
+unassigned group — use **`launchpad deploy --dry-run`** to pre-check any
+tenant group (it resolves against the whole tenant, exactly as the real
+submit). A reference is rejected only when the group is unknown, ineligible (a
+distribution list / hidden-membership group), or an ambiguous display name.
+
 ## 0.41.0 — 2026-06-28
 
 Docs & skills: documented the **app catalogue** — a new

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.41.0";
+var CLI_VERSION = "0.41.1";
 
 // src/config.ts
 import * as os from "node:os";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.41.0";
+export declare const CLI_VERSION = "0.41.1";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.41.0",
+  "version": "0.41.1",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -185,7 +185,10 @@ launchpad plan
 
 Both are offline by default (no bot). `launchpad validate
 --strict-groups` opts in to an online check that resolves
-`access.allowed_entra_group` (needs a session).
+`access.allowed_entra_group` (needs a session). Note it resolves only
+against the groups **assigned** to the Launchpad enterprise app, so it
+falsely fails a valid *unassigned* tenant group — pre-check those with
+`launchpad deploy --dry-run` instead.
 
 ## Verify the deploy
 

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -195,20 +195,45 @@ The CLI resolves Entra groups via the bot's `/groups` endpoint
 endpoint directly. Two helpers:
 
 ```bash
-launchpad groups list                # every group assigned to the Launchpad app in Entra
+launchpad groups list                # groups ASSIGNED to the Launchpad app in Entra
 launchpad groups search <query>      # fuzzy match by name / nickname / id
 launchpad groups show <name>         # UUID + displayName + mailNickname
 launchpad groups resolve <name>      # just the Entra Object-ID UUID (script-friendly)
 ```
 
-`groups list` is **not** the whole tenant and not caller-scoped: it
-lists the groups **assigned to the Launchpad enterprise application**
-in Entra — the only groups that can actually grant sign-in to a
-deployed app.
+**Important — `groups` only sees the *assigned* set.** All four
+helpers (and `launchpad validate --strict-groups`, §A.4) list only the
+groups **assigned to the Launchpad enterprise application** in Entra.
+That is a discovery convenience, **not** the set of usable groups.
+Since PS-1733 (live 2026-06-25) an app can be gated on **any group in
+the tenant** — the group does **not** have to be assigned to the
+Launchpad app first. So if the user wants a group that does not appear
+in `groups list` (e.g. `G_information_security`), that is **fine**:
+pass it anyway, by display name or UUID. Do **not** tell the user to
+ask IT to assign the group to the enterprise app — that requirement
+was retired.
 
 When the user picks a group, pass either the **displayName** or the
 **UUID** to `launchpad init --group <…>` — the CLI accepts both and
-the bot canonicalises to the UUID.
+the bot canonicalises to the UUID. Prefer the **UUID** for a group
+that is not in `groups list`, or whenever a display name could be
+ambiguous.
+
+A group reference is rejected at deploy only when it is **unknown** (no
+such group anywhere in the tenant), **ineligible** (a pure distribution
+list, or a hidden-membership group the platform cannot evaluate), or an
+**ambiguous** display name (use the UUID). An unassigned-but-valid
+group is accepted. Members who do not carry the group as a token claim
+are authorised at runtime via a Microsoft Graph membership check
+(employees only — guests are refused).
+
+**Pre-checking a group reference.** Because `groups` and
+`--strict-groups` are assigned-only, they **falsely reject** a valid
+unassigned group. To pre-check any tenant group without mutating
+anything, run `launchpad deploy --dry-run` — it resolves against the
+whole tenant exactly as the real submit does. Treat `--dry-run` (not
+`--strict-groups`) as the source of truth for "will this group
+resolve?".
 
 If `launchpad groups list` fails with:
 
@@ -222,9 +247,10 @@ If `launchpad groups list` fails with:
   `appRoleAssignedTo` assignment list (missing admin consent on the
   Graph application permission), or Graph is unreachable. Surface
   the error body.
-- empty list → no groups are assigned to the Launchpad enterprise
-  app in Entra. A group must be **assigned to the app** before it
-  can gate anything — membership alone is not enough.
+- empty list → no groups are **assigned** to the Launchpad app. This
+  does **not** block you — an unassigned tenant group can still be
+  used by name or UUID (above); the assigned set is just a discovery
+  shortlist.
 
 Use `launchpad groups whoami` to remind the user which groups
 **they** are currently a member of — handy when an app is gated and
@@ -244,7 +270,10 @@ Add `--strict-groups` to *additionally* resolve the manifest's
 allowed Entra group online against the bot's group list — it catches
 typo'd or renamed group names before deploy time. This mode needs a
 session and the network (exit 1 = group not found / ambiguous,
-2 = network error, 3 = no valid session).
+2 = network error, 3 = no valid session). **Caveat:** it checks only
+the **assigned** set, so it will falsely fail a valid *unassigned*
+tenant group — for those, pre-check with `launchpad deploy --dry-run`
+instead (see §A.3).
 
 ```bash
 launchpad plan

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.41.0
+version: 0.41.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->