@m-kopa/launchpad-cli 0.56.1 → 0.57.0

package/CHANGELOG.md

@@ -8,6 +8,14 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.57.0 - 2026-08-20
+
+**Apps can declare a default-off DSR sign-in policy.**
+
+- Gateway manifests may set `access.identity_types: [employee, dsr]`; omitting the field remains employee-only, and `employee` cannot be removed.
+- The generated gateway routing policy carries the opt-in for the gateway rollout.
+- This policy does not enable DSR login by itself; apps must wait for the DSR canary and gateway release before adding `dsr`.
+
 ## 0.56.1 - 2026-08-17
 
 **Destroy now removes bot-owned resources without sacrificing D1 recovery.**

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.56.1";
+var CLI_VERSION = "0.57.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -2570,6 +2570,12 @@ import { parse as parseYaml2 } from "yaml";
 import { z } from "zod";
 var APP_TYPES2 = ["static", "react", "react+api", "container"];
 var AUTH_MODES = ["access", "gateway"];
+var IDENTITY_TYPES = ["employee", "dsr"];
+var IdentityTypesSchema = z.array(z.enum(IDENTITY_TYPES)).min(1).refine((values) => new Set(values).size === values.length, {
+  message: "identity_types must not contain duplicates"
+}).refine((values) => values.includes("employee"), {
+  message: "identity_types must include employee"
+});
 var RUNTIMES = ["cloudflare-containers", "aca"];
 var SECRET_SOURCES = ["env-file", "platform-managed"];
 var TARGET_KINDS = ["pages", "worker"];
@@ -2590,7 +2596,8 @@ var DeploymentSchema = z.object({
 var AccessSchema = z.object({
   allowed_entra_group: z.string().min(1).optional(),
   allowed_entra_groups: z.array(z.string().min(1)).min(1).refine((arr) => new Set(arr).size === arr.length, { message: "allowed_entra_groups must not contain duplicates" }).optional(),
-  session_duration: z.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional()
+  session_duration: z.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional(),
+  identity_types: IdentityTypesSchema.optional()
 }).strict().superRefine((access, ctx) => {
   const hasSingular = access.allowed_entra_group !== undefined;
   const hasPlural = access.allowed_entra_groups !== undefined;
@@ -2678,6 +2685,13 @@ var ManifestSchema = z.object({
   sensitive: z.boolean().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
+  if (m.access.identity_types !== undefined && (m.auth ?? "access") !== "gateway") {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["access", "identity_types"],
+      message: "access.identity_types is only valid with auth: gateway"
+    });
+  }
   if (m.confine_origin !== undefined) {
     if (isContainer) {
       ctx.addIssue({
@@ -3302,7 +3316,8 @@ var SpecSchema = z2.object({
     allowed_entra_groups: z2.array(z2.string().min(1)).min(1).refine((a) => new Set(a).size === a.length, {
       message: "allowed_entra_groups must not contain duplicates"
     }),
-    require_email_domain: z2.string().min(1).optional()
+    require_email_domain: z2.string().min(1).optional(),
+    identity_types: IdentityTypesSchema.optional()
   }).strict(),
   auth: z2.enum(AUTH_MODES).optional(),
   build: BuildSchema.optional(),
@@ -3317,6 +3332,13 @@ var SpecSchema = z2.object({
   secrets: SecretsSchema.optional(),
   fronted_by_concierge: z2.boolean().optional()
 }).strict().superRefine((s, ctx) => {
+  if (s.access.identity_types !== undefined && (s.auth ?? "access") !== "gateway") {
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      path: ["access", "identity_types"],
+      message: "access.identity_types is only valid with auth: gateway"
+    });
+  }
   for (const [k, v] of Object.entries(s.env_vars ?? {})) {
     if (/_(TOKEN|SECRET)$/.test(k) && v.type !== "secret_text") {
       ctx.addIssue({

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.56.1";
+export declare const CLI_VERSION = "0.57.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.56.1",
+  "version": "0.57.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.56.1
+version: 0.57.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->