@m-kopa/launchpad-cli 0.41.0 → 0.42.0

package/CHANGELOG.md

@@ -6,6 +6,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.42.0 — 2026-06-30
+
+**`launchpad validate --strict-groups` and `launchpad groups resolve`/`show`
+now resolve Entra groups against the whole tenant (PS-1859).** They used to
+check only the enterprise-app-**assigned** set, so a valid *unassigned* group
+(e.g. `G_information_security`) was falsely reported as not-found — the durable
+fix for the discoverability gap the 0.41.1 docs worked around. The resolution
+runs bot-side via a new employee-gated `POST /groups/resolve` (rate-limited,
+audited; the CLI never holds Graph credentials), reusing the same resolver
+`launchpad deploy` uses.
+
+- **Behavioural change (CI note):** `validate --strict-groups` now exits `0`
+  for a valid unassigned group (it used to fail). Exit-code *values* are
+  unchanged; only the verdict flips. A reference still fails for an
+  **unknown**, **ineligible** (distribution list / hidden-membership), or
+  **ambiguous** group — ambiguous now prints the candidate UUIDs.
+- **Ambiguity fix (also affects deploy):** a tenant displayName matching more
+  than one group is now reported as ambiguous with candidate UUIDs instead of
+  silently resolving to the first match.
+- `launchpad groups list`/`search` remain the assigned-app shortlist, now
+  clearly labelled ("unlisted ≠ unusable — `launchpad groups resolve
+  <name|uuid>` checks any tenant group").
+- Skills: the interim 0.41.1 "use `deploy --dry-run` because the others lie"
+  caveats are removed (the others no longer lie). `launchpad-content-pr` and
+  `launchpad-deploy` now cross-link the self-serve **`launchpad deploy
+  --apply`** route for changing a live app's access group — never "raise a
+  request with the platform team."
+
+## 0.41.1 — 2026-06-30
+
+Docs & skills correctness fix: **any Entra group in the tenant can gate an
+app — it does not need to be assigned to the Launchpad enterprise
+application** (PS-1733, live 2026-06-25). The docs and bundled skills still
+described the retired "assigned-only" rule, which led to users being wrongly
+told to ask IT to assign a group (e.g. `G_information_security`) before they
+could use it. Corrected across the auth concept, manifest reference,
+`first-app`/`auth` guides, and the `validate` / `groups` / `deploy` command
+pages, and in the `launchpad-deploy` / `launchpad-content-pr` skills. Key
+clarification: `launchpad groups` and `launchpad validate --strict-groups`
+resolve only against the **assigned** set and will **falsely reject** a valid
+unassigned group — use **`launchpad deploy --dry-run`** to pre-check any
+tenant group (it resolves against the whole tenant, exactly as the real
+submit). A reference is rejected only when the group is unknown, ineligible (a
+distribution list / hidden-membership group), or an ambiguous display name.
+
 ## 0.41.0 — 2026-06-28
 
 Docs & skills: documented the **app catalogue** — a new

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.41.0";
+var CLI_VERSION = "0.42.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -4086,6 +4086,57 @@ function writeCache(path8, envelope) {
 function describe11(e) {
   return e instanceof Error ? e.message : String(e);
 }
+async function resolveGroupRefsTenant(cfg, refs, opts = {}) {
+  let res;
+  try {
+    res = await apiRaw(cfg, {
+      method: "POST",
+      path: "/groups/resolve",
+      jsonBody: { refs },
+      nonThrowingStatuses: [400, 429, 503]
+    }, opts.fetcher);
+  } catch (e) {
+    if (e instanceof UnauthenticatedError || e instanceof ForbiddenError)
+      throw e;
+    return { kind: "error", message: describe11(e) };
+  }
+  let data;
+  try {
+    data = await res.json();
+  } catch (e) {
+    return { kind: "error", message: `bot returned a non-JSON resolve response: ${describe11(e)}` };
+  }
+  if (res.status !== 200) {
+    const env = data;
+    const msg = typeof env?.message === "string" ? env.message : typeof env?.error === "string" ? env.error : `bot returned HTTP ${res.status}`;
+    return { kind: "error", message: msg };
+  }
+  const body = data;
+  switch (body.kind) {
+    case "ok":
+      if (!Array.isArray(body.groups))
+        break;
+      return { kind: "ok", groups: body.groups };
+    case "unresolved":
+      if (!Array.isArray(body.refs))
+        break;
+      return {
+        kind: "unresolved",
+        refs: body.refs,
+        message: typeof body.message === "string" ? body.message : ""
+      };
+    case "ambiguous":
+      if (typeof body.ref !== "string" || !Array.isArray(body.candidates))
+        break;
+      return {
+        kind: "ambiguous",
+        ref: body.ref,
+        candidates: body.candidates,
+        message: typeof body.message === "string" ? body.message : ""
+      };
+  }
+  return { kind: "error", message: "bot returned a malformed resolve response" };
+}
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isUuid2(value) {
   return UUID_PATTERN.test(value);
@@ -8059,6 +8110,91 @@ async function loadGroups(io, refresh, json) {
     return { kind: "error", code: 2 };
   }
 }
+async function lookupTenantAware(assigned, key) {
+  const hit = findGroup(assigned, key);
+  if (hit.kind === "found") {
+    return {
+      kind: "found",
+      group: {
+        id: hit.group.id,
+        displayName: hit.group.displayName,
+        mailNickname: hit.group.mailNickname
+      }
+    };
+  }
+  if (hit.kind === "ambiguous") {
+    return {
+      kind: "ambiguous",
+      matches: hit.matches.map((g) => ({ id: g.id, displayName: g.displayName }))
+    };
+  }
+  try {
+    const r = await resolveGroupRefsTenant(loadConfig(), [key]);
+    switch (r.kind) {
+      case "ok": {
+        const g = r.groups[0];
+        if (g === undefined)
+          return { kind: "not-found" };
+        return { kind: "found", group: { id: g.id, displayName: g.displayName, mailNickname: null } };
+      }
+      case "ambiguous":
+        return {
+          kind: "ambiguous",
+          matches: r.candidates.map((c) => ({ id: c.id, displayName: c.displayName }))
+        };
+      case "unresolved": {
+        const reason = r.refs[0]?.reason;
+        if (reason === "unverified") {
+          return { kind: "error", message: r.message };
+        }
+        if (reason === "ineligible") {
+          return { kind: "ineligible", message: r.message };
+        }
+        return { kind: "not-found" };
+      }
+      case "error":
+        return { kind: "error", message: r.message };
+    }
+  } catch (e) {
+    if (e instanceof UnauthenticatedError)
+      return { kind: "unauthenticated", message: e.message };
+    if (e instanceof ForbiddenError)
+      return { kind: "forbidden", message: e.message };
+    return { kind: "error", message: describe19(e) };
+  }
+}
+function renderLookupFailure(io, json, hit) {
+  if (hit.kind === "unauthenticated") {
+    if (json) {
+      io.out(JSON.stringify({ ok: false, kind: "unauthenticated", message: hit.message }));
+    } else {
+      io.err(hit.message);
+      io.err("Run `launchpad login` to start a session.");
+    }
+    return 3;
+  }
+  if (hit.kind === "forbidden") {
+    if (json) {
+      io.out(JSON.stringify({ ok: false, kind: "forbidden", message: hit.message }));
+    } else {
+      io.err(hit.message);
+    }
+    return 3;
+  }
+  if (hit.kind === "error") {
+    renderFetchError(io, hit.message, json);
+    return 2;
+  }
+  if (hit.kind === "ineligible") {
+    if (json) {
+      io.out(JSON.stringify({ ok: false, kind: "ineligible", message: hit.message }));
+    } else {
+      io.err(hit.message);
+    }
+    return 1;
+  }
+  return null;
+}
 function renderFetchError(io, message, json) {
   if (json) {
     io.out(JSON.stringify({ ok: false, kind: "fetch-error", message }));
@@ -8105,11 +8241,14 @@ async function runList(args, io) {
     return 0;
   }
   if (result.groups.length === 0) {
-    io.out("(no groups assigned to the Launchpad enterprise app yet — talk to platform-team)");
+    io.out("(no groups assigned to the Launchpad enterprise app yet)");
+    io.out("Unlisted ≠ unusable: any tenant group is still usable by name or UUID — " + "`launchpad groups resolve <name|uuid>` checks one.");
     return 0;
   }
   io.out(`${result.groups.length} group${result.groups.length === 1 ? "" : "s"} (source: ${result.source}, fetched: ${result.fetchedAt})`);
   renderTable2(io, result.groups);
+  io.out("");
+  io.out("This is the assigned-app shortlist — any tenant group is still usable by " + "name or UUID, even if it isn't listed here (`launchpad groups resolve <name|uuid>`).");
   return 0;
 }
 async function runSearch(args, io) {
@@ -8138,7 +8277,8 @@ async function runSearch(args, io) {
     return 0;
   }
   if (matches.length === 0) {
-    io.out(`no matches for "${query}"`);
+    io.out(`no matches for "${query}" in the assigned-app shortlist`);
+    io.out("That shortlist isn't the whole tenant — if you know the exact name or UUID, " + "`launchpad groups resolve <name|uuid>` checks any tenant group.");
     return 0;
   }
   io.out(`${matches.length} match${matches.length === 1 ? "" : "es"} for "${query}":`);
@@ -8160,7 +8300,13 @@ async function runShow(args, io) {
   const load = await loadGroups(io, parsed.flags.refresh, parsed.flags.json);
   if (load.kind === "error")
     return load.code;
-  const hit = findGroup(load.result.groups, key);
+  const hit = await lookupTenantAware(load.result.groups, key);
+  const failure = renderLookupFailure(io, parsed.flags.json, hit);
+  if (failure !== null)
+    return failure;
+  if (hit.kind !== "found" && hit.kind !== "ambiguous" && hit.kind !== "not-found") {
+    return 2;
+  }
   if (parsed.flags.json) {
     if (hit.kind === "not-found") {
       io.out(JSON.stringify({ ok: false, kind: "not-found", key }));
@@ -8175,7 +8321,7 @@ async function runShow(args, io) {
   }
   if (hit.kind === "not-found") {
     io.err(`no group matched "${key}"`);
-    io.err(`Run \`launchpad groups list\` to see every visible group.`);
+    io.err(`Not in the assigned shortlist? Any tenant group is still usable — check the exact name/UUID.`);
     return 1;
   }
   if (hit.kind === "ambiguous") {
@@ -8206,7 +8352,13 @@ async function runResolve(args, io) {
   const load = await loadGroups(io, parsed.flags.refresh, parsed.flags.json);
   if (load.kind === "error")
     return load.code;
-  const hit = findGroup(load.result.groups, key);
+  const hit = await lookupTenantAware(load.result.groups, key);
+  const failure = renderLookupFailure(io, parsed.flags.json, hit);
+  if (failure !== null)
+    return failure;
+  if (hit.kind !== "found" && hit.kind !== "ambiguous" && hit.kind !== "not-found") {
+    return 2;
+  }
   if (parsed.flags.json) {
     if (hit.kind === "not-found") {
       io.out(JSON.stringify({ ok: false, kind: "not-found", key }));
@@ -12395,27 +12547,33 @@ function checkStaticServeDir(manifestPath, manifest) {
 var DECLARE_APP_HINT = "no app: boundary declared — deploys bundle the whole working tree minus the platform deny-list. " + "Declare app: (root / include / exclude) in launchpad.yaml — see schema/README.md.";
 async function checkGroup(allowedGroup, cfg) {
   try {
-    const r = await fetchGroups(cfg);
-    if (r.kind === "error") {
-      return { kind: "network", message: r.message };
-    }
-    const hit = findGroup(r.groups, allowedGroup);
-    if (hit.kind === "found") {
-      return {
-        kind: "ok",
-        key: allowedGroup,
-        resolvedUuid: hit.group.id,
-        resolvedName: hit.group.displayName
-      };
-    }
-    if (hit.kind === "ambiguous") {
-      return {
-        kind: "ambiguous",
-        key: allowedGroup,
-        matches: hit.matches.map((g) => ({ id: g.id, displayName: g.displayName }))
-      };
+    const r = await resolveGroupRefsTenant(cfg, [allowedGroup]);
+    switch (r.kind) {
+      case "ok": {
+        const g = r.groups[0];
+        if (g === undefined)
+          return { kind: "not-found", key: allowedGroup };
+        return {
+          kind: "ok",
+          key: allowedGroup,
+          resolvedUuid: g.id,
+          resolvedName: g.displayName
+        };
+      }
+      case "ambiguous":
+        return {
+          kind: "ambiguous",
+          key: allowedGroup,
+          matches: r.candidates.map((c) => ({ id: c.id, displayName: c.displayName }))
+        };
+      case "unresolved":
+        if (r.refs[0]?.reason === "unverified") {
+          return { kind: "network", message: r.message };
+        }
+        return { kind: "not-found", key: allowedGroup };
+      case "error":
+        return { kind: "network", message: r.message };
     }
-    return { kind: "not-found", key: allowedGroup };
   } catch (e) {
     if (e instanceof UnauthenticatedError) {
       return { kind: "unauthenticated", message: e.message };

package/dist/commands/groups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/commands/groups.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAMjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC"}
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/commands/groups.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAMjE,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC"}

package/dist/groups/client.d.ts

@@ -35,6 +35,46 @@ export type FetchGroupsResult = {
  * message.
  */
 export declare function fetchGroups(cfg: CliConfig, opts?: FetchGroupsOptions): Promise<FetchGroupsResult>;
+/** A bot-resolved group descriptor. The tenant resolver canonicalises to
+ *  `{ id, displayName }` only — `mailNickname` is not carried back. */
+export interface ResolvedGroupLite {
+    readonly id: string;
+    readonly displayName: string;
+}
+/** One unresolved reference, mirroring the bot's `UnresolvedRef`. */
+export interface TenantUnresolvedRef {
+    readonly ref: string;
+    readonly reason: "unknown" | "ineligible" | "unverified";
+    readonly ineligibleKind?: "distribution" | "hidden-membership";
+    readonly group?: ResolvedGroupLite;
+}
+export type TenantResolveResult = {
+    kind: "ok";
+    groups: readonly ResolvedGroupLite[];
+} | {
+    kind: "unresolved";
+    refs: readonly TenantUnresolvedRef[];
+    message: string;
+} | {
+    kind: "ambiguous";
+    ref: string;
+    candidates: readonly ResolvedGroupLite[];
+    message: string;
+} | {
+    kind: "error";
+    message: string;
+};
+interface ResolveOptions {
+    readonly fetcher?: typeof fetch;
+}
+/**
+ * Resolve group references against the whole tenant via the bot's
+ * `POST /groups/resolve`. Resolution OUTCOMES (ok / unresolved / ambiguous)
+ * come back as a 200 with a discriminated body; a non-200 means the call
+ * could not run (rate-limit, Graph down, bad request) and is surfaced as
+ * `kind: "error"`. 401/403 rethrow as typed errors (auth/permission).
+ */
+export declare function resolveGroupRefsTenant(cfg: CliConfig, refs: readonly string[], opts?: ResolveOptions): Promise<TenantResolveResult>;
 /** True for a canonical Entra Object ID UUID. */
 export declare function isUuid(value: string): boolean;
 /**
@@ -59,4 +99,5 @@ export declare function findGroup(groups: readonly EntraGroup[], nameOrId: strin
  * `mailNickname`, and `id`. Used by `launchpad groups search`.
  */
 export declare function searchGroups(groups: readonly EntraGroup[], query: string): readonly EntraGroup[];
+export {};
 //# sourceMappingURL=client.d.ts.map

package/dist/groups/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/groups/client.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9C;gDACgD;AAChD,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAYD,oDAAoD;AACpD,eAAO,MAAM,YAAY,QAAkB,CAAC;AAK5C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,gCAAgC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GAC3F;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA0D5B;AA8DD,iDAAiD;AACjD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CAcxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,KAAK,EAAE,MAAM,GACZ,SAAS,UAAU,EAAE,CAQvB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/groups/client.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9C;gDACgD;AAChD,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAYD,oDAAoD;AACpD,eAAO,MAAM,YAAY,QAAkB,CAAC;AAK5C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,gCAAgC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GAC3F;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA0D5B;AAiED;uEACuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,qEAAqE;AACrE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,YAAY,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7E;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAiE9B;AASD,iDAAiD;AACjD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CAcxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,KAAK,EAAE,MAAM,GACZ,SAAS,UAAU,EAAE,CAQvB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.41.0";
+export declare const CLI_VERSION = "0.42.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.41.0",
+  "version": "0.42.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -185,7 +185,21 @@ launchpad plan
 
 Both are offline by default (no bot). `launchpad validate
 --strict-groups` opts in to an online check that resolves
-`access.allowed_entra_group` (needs a session).
+`access.allowed_entra_group(s)` (needs a session). As of PS-1859 it
+resolves against the **whole tenant**, so a valid *unassigned* tenant
+group passes (no need to use `deploy --dry-run` as a workaround).
+
+> **Changing the access group is NOT a content deploy.** Editing
+> `access.allowed_entra_groups` and running a plain `launchpad deploy`
+> ships content only — it does **not** reconcile the gateway's access
+> policy, so the change won't take effect (and is refused once the
+> access-drift gate is enforced). To change a live app's groups, the
+> user self-serves the **gated Terraform route**: `launchpad deploy
+> --apply` (preview with `--dry-run`, confirm with `launchpad status`).
+> Do **not** tell the user to raise a request with the platform team —
+> `--apply` IS the self-serve route. See `/launchpad-status` and the
+> [auth & groups](https://get.launchpad.m-kopa.us/docs/concepts/auth-groups#changing-access-on-an-existing-app)
+> doc.
 
 ## Verify the deploy
 

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -195,20 +195,50 @@ The CLI resolves Entra groups via the bot's `/groups` endpoint
 endpoint directly. Two helpers:
 
 ```bash
-launchpad groups list                # every group assigned to the Launchpad app in Entra
+launchpad groups list                # groups ASSIGNED to the Launchpad app in Entra
 launchpad groups search <query>      # fuzzy match by name / nickname / id
 launchpad groups show <name>         # UUID + displayName + mailNickname
 launchpad groups resolve <name>      # just the Entra Object-ID UUID (script-friendly)
 ```
 
-`groups list` is **not** the whole tenant and not caller-scoped: it
-lists the groups **assigned to the Launchpad enterprise application**
-in Entra — the only groups that can actually grant sign-in to a
-deployed app.
+**Important — `list`/`search` are the *assigned* shortlist; `resolve`
+resolves the whole tenant.** `launchpad groups list` / `search` show
+only the groups **assigned to the Launchpad enterprise application** —
+a discovery convenience, **not** the set of usable groups. Since
+PS-1733 an app can be gated on **any group in the tenant** — the group
+does **not** have to be assigned first. So if the user wants a group
+that does not appear in `groups list` (e.g. `G_information_security`),
+that is **fine**: pass it anyway, by display name or UUID. Do **not**
+tell the user to ask IT to assign the group — that requirement was
+retired. `launchpad groups resolve <name|uuid>` resolves any tenant
+group, assigned or not (PS-1859).
 
 When the user picks a group, pass either the **displayName** or the
 **UUID** to `launchpad init --group <…>` — the CLI accepts both and
-the bot canonicalises to the UUID.
+the bot canonicalises to the UUID. Prefer the **UUID** for a group
+that is not in `groups list`, or whenever a display name could be
+ambiguous.
+
+A group reference is rejected at deploy only when it is **unknown** (no
+such group anywhere in the tenant), **ineligible** (a pure distribution
+list, or a hidden-membership group the platform cannot evaluate), or an
+**ambiguous** display name (use the UUID). An unassigned-but-valid
+group is accepted. Members who do not carry the group as a token claim
+are authorised at runtime via a Microsoft Graph membership check
+(employees only — guests are refused).
+
+**Pre-checking a group reference.** `launchpad validate
+--strict-groups`, `launchpad groups resolve <name|uuid>`, and
+`launchpad deploy --dry-run` all resolve against the **whole tenant**
+(PS-1859), so any of them correctly accepts a valid unassigned group.
+Use whichever fits; `--dry-run` additionally previews the Terraform.
+
+This `--group` flow sets the group at **first deploy**. Changing the
+group on an **existing** app is a different path — a plain `launchpad
+deploy` ships content only and won't move the gateway policy. The
+self-serve fix is `launchpad deploy --apply` (the gated Terraform
+route); see `/launchpad-content-pr`. Never route the user to the
+platform team for a group change.
 
 If `launchpad groups list` fails with:
 
@@ -222,9 +252,10 @@ If `launchpad groups list` fails with:
   `appRoleAssignedTo` assignment list (missing admin consent on the
   Graph application permission), or Graph is unreachable. Surface
   the error body.
-- empty list → no groups are assigned to the Launchpad enterprise
-  app in Entra. A group must be **assigned to the app** before it
-  can gate anything — membership alone is not enough.
+- empty list → no groups are **assigned** to the Launchpad app. This
+  does **not** block you — an unassigned tenant group can still be
+  used by name or UUID (above); the assigned set is just a discovery
+  shortlist.
 
 Use `launchpad groups whoami` to remind the user which groups
 **they** are currently a member of — handy when an app is gated and
@@ -241,10 +272,13 @@ problems. Doesn't talk to the bot by default. Useful when the user
 wants a second look before paying for an upload round-trip.
 
 Add `--strict-groups` to *additionally* resolve the manifest's
-allowed Entra group online against the bot's group list — it catches
-typo'd or renamed group names before deploy time. This mode needs a
-session and the network (exit 1 = group not found / ambiguous,
-2 = network error, 3 = no valid session).
+allowed Entra group online — it catches typo'd / renamed / ineligible
+/ ambiguous group references before deploy time. As of PS-1859 it
+resolves against the **whole tenant** (like the real submit), so a
+valid *unassigned* group passes. This mode needs a session and the
+network (exit 1 = group not found / ineligible / ambiguous,
+2 = network error, 3 = no valid session **or the caller is not an
+employee** — the tenant resolve is employee-gated).
 
 ```bash
 launchpad plan

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.41.0
+version: 0.42.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->