@m-kopa/launchpad-cli 0.60.1 → 0.61.1

package/CHANGELOG.md

@@ -8,6 +8,26 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.61.1 - 2026-09-17
+
+### Fixed
+
+- Post-deploy checks stop at redirects instead of comparing an SSO sign-in page with the app.
+  Private apps report that content verification needs an authenticated browser, while direct content mismatches still fail.
+
+## 0.61.0 - 2026-09-17
+
+### Changed
+
+- New apps start private to their verified creator and platform administrators, and are unlisted by default.
+- Company-wide grants require explicit human confirmation before publication.
+  Sensitive apps also require administrator approval.
+- Deployment skills explain the audience and hand confirmation to the builder.
+  Existing audiences and unchanged content deployments retain their behaviour.
+- The platform minimum supported CLI version is 0.60.1 for deployments and other supported mutating commands.
+  Clients reporting stable versions below 0.60.1 receive an upgrade-required error directing users to `launchpad update`.
+  Existing apps and read-only commands remain available.
+
 ## 0.60.1 - 2026-09-17
 
 ### Changed

package/README.md

@@ -107,3 +107,13 @@ than a hand-maintained second copy.
 Pre-1.0 consumer-pinning policy (per ADR 0005): consumers must pin
 exact versions until v1.0.0. Caret ranges are forbidden. Each
 minor-version bump may carry breaking changes.
+
+## Default app access
+
+New apps are private to their verified creator and platform administrators, and are unlisted by default.
+Omit `--group` when running `launchpad init` to keep that audience.
+Selecting groups grants access to members of any selected group.
+A new company-wide grant requires the builder's explicit browser confirmation before publishing; sensitive apps also require platform-admin approval.
+Agents must never submit that confirmation for the human.
+Catalogue listing changes discovery, not access.
+See [App access](../../docs/app-access.md) for the manifest and deployment contract.

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.60.1";
+var CLI_VERSION = "0.61.1";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -2570,11 +2570,23 @@ import { join as join6 } from "node:path";
 import { parse as parseYaml2 } from "yaml";
 
 // ../launchpad-engine/dist/schema.js
+import { z as z2 } from "zod";
+
+// ../launchpad-engine/dist/audience.js
 import { z } from "zod";
+var PrivateOwnerSchema = z.object({ oid: z.uuid(), email: z.email() }).strict();
+function validateAudience(access, ctx) {
+  const groups = access.allowed_entra_groups ?? (access.allowed_entra_group ? [access.allowed_entra_group] : []);
+  const valid = access.audience === "private" ? access.private_owner !== undefined && access.allowed_entra_groups !== undefined && groups.length === 0 && !access.identity_types?.includes("dsr") : access.private_owner === undefined && groups.length > 0;
+  if (!valid)
+    ctx.addIssue({ code: "custom", path: ["audience"], message: "Private access requires a verified private_owner, no groups, and employee identity; group access requires at least one group and no private_owner." });
+}
+
+// ../launchpad-engine/dist/schema.js
 var APP_TYPES2 = ["static", "react", "react+api", "container"];
 var AUTH_MODES = ["access", "gateway"];
 var IDENTITY_TYPES = ["employee", "dsr"];
-var IdentityTypesSchema = z.array(z.enum(IDENTITY_TYPES)).min(1).refine((values) => new Set(values).size === values.length, {
+var IdentityTypesSchema = z2.array(z2.enum(IDENTITY_TYPES)).min(1).refine((values) => new Set(values).size === values.length, {
   message: "identity_types must not contain duplicates"
 }).refine((values) => values.includes("employee"), {
   message: "identity_types must include employee"
@@ -2586,111 +2598,115 @@ var PRIMARY_TARGET = "primary";
 var SLUG_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var ENV_NAME_REGEX = /^[A-Z][A-Z0-9_]*$/;
 var SESSION_DURATION_REGEX = /^[0-9]+(s|m|h)$/;
-var MetadataSchema = z.object({
-  name: z.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
-  team: z.string().min(1),
-  owner: z.string().email(),
-  description: z.string().max(280).optional()
+var MetadataSchema = z2.object({
+  name: z2.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
+  team: z2.string().min(1),
+  owner: z2.string().email(),
+  description: z2.string().max(280).optional()
 }).strict();
-var DeploymentSchema = z.object({
-  type: z.enum(APP_TYPES2),
-  runtime: z.enum(RUNTIMES).optional()
+var DeploymentSchema = z2.object({
+  type: z2.enum(APP_TYPES2),
+  runtime: z2.enum(RUNTIMES).optional()
 }).strict();
-var AccessSchema = z.object({
-  allowed_entra_group: z.string().min(1).optional(),
-  allowed_entra_groups: z.array(z.string().min(1)).min(1).refine((arr) => new Set(arr).size === arr.length, { message: "allowed_entra_groups must not contain duplicates" }).optional(),
-  session_duration: z.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional(),
+var AccessSchema = z2.object({
+  audience: z2.literal("private").optional(),
+  private_owner: PrivateOwnerSchema.optional(),
+  allowed_entra_group: z2.string().min(1).optional(),
+  allowed_entra_groups: z2.array(z2.string().min(1)).refine((arr) => new Set(arr).size === arr.length, { message: "allowed_entra_groups must not contain duplicates" }).optional(),
+  session_duration: z2.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional(),
   identity_types: IdentityTypesSchema.optional()
 }).strict().superRefine((access, ctx) => {
   const hasSingular = access.allowed_entra_group !== undefined;
   const hasPlural = access.allowed_entra_groups !== undefined;
-  if (!hasSingular && !hasPlural) {
+  if (!hasSingular && !hasPlural && access.audience !== "private") {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "either `allowed_entra_group` (singular, legacy) or `allowed_entra_groups` (plural, preferred) must be set",
       path: ["allowed_entra_groups"]
     });
   }
   if (hasSingular && hasPlural) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "`allowed_entra_group` (singular) and `allowed_entra_groups` (plural) are mutually exclusive; use the plural form",
       path: ["allowed_entra_groups"]
     });
   }
-});
+}).superRefine(validateAudience);
 function allowedEntraGroups(access) {
+  if (access.audience === "private")
+    return [];
   if (access.allowed_entra_groups !== undefined) {
     return access.allowed_entra_groups;
   }
   return [access.allowed_entra_group];
 }
-var ContainerSchema = z.object({
-  name: z.string().min(2).max(32).regex(SLUG_REGEX, "container name must be lowercase letters, digits, and hyphens"),
-  image: z.string().min(1),
-  port: z.number().int().min(1).max(65535),
-  ingress: z.boolean().optional(),
-  healthcheck: z.string().default("/health"),
-  env: z.array(z.string().regex(ENV_NAME_REGEX, "env entries must be UPPER_SNAKE_CASE")).optional(),
-  max_instances: z.number().int().min(1).max(100).optional()
+var ContainerSchema = z2.object({
+  name: z2.string().min(2).max(32).regex(SLUG_REGEX, "container name must be lowercase letters, digits, and hyphens"),
+  image: z2.string().min(1),
+  port: z2.number().int().min(1).max(65535),
+  ingress: z2.boolean().optional(),
+  healthcheck: z2.string().default("/health"),
+  env: z2.array(z2.string().regex(ENV_NAME_REGEX, "env entries must be UPPER_SNAKE_CASE")).optional(),
+  max_instances: z2.number().int().min(1).max(100).optional()
 }).strict();
-var TargetSchema = z.object({
-  kind: z.enum(TARGET_KINDS),
-  script: z.string().min(2).max(63).regex(SLUG_REGEX, "target script must be lowercase letters, digits, and hyphens").optional(),
-  schedule: z.array(z.string().min(1).max(120)).min(1).max(20).optional(),
-  d1_binding: z.string().min(1).max(64).regex(ENV_NAME_REGEX, "d1_binding must be an UPPER_SNAKE_CASE binding name").optional()
+var TargetSchema = z2.object({
+  kind: z2.enum(TARGET_KINDS),
+  script: z2.string().min(2).max(63).regex(SLUG_REGEX, "target script must be lowercase letters, digits, and hyphens").optional(),
+  schedule: z2.array(z2.string().min(1).max(120)).min(1).max(20).optional(),
+  d1_binding: z2.string().min(1).max(64).regex(ENV_NAME_REGEX, "d1_binding must be an UPPER_SNAKE_CASE binding name").optional()
 }).strict();
-var SecretBindingSchema = z.object({
-  name: z.string().min(1).max(64).regex(ENV_NAME_REGEX, "secret binding name must be UPPER_SNAKE_CASE"),
-  source: z.enum(SECRET_SOURCES),
-  description: z.string().max(200).optional(),
-  targets: z.union([z.literal("all"), z.array(z.string().min(1)).min(1)]).optional()
+var SecretBindingSchema = z2.object({
+  name: z2.string().min(1).max(64).regex(ENV_NAME_REGEX, "secret binding name must be UPPER_SNAKE_CASE"),
+  source: z2.enum(SECRET_SOURCES),
+  description: z2.string().max(200).optional(),
+  targets: z2.union([z2.literal("all"), z2.array(z2.string().min(1)).min(1)]).optional()
 }).strict();
-var SecretsSchema = z.object({
-  bindings: z.array(SecretBindingSchema).optional()
+var SecretsSchema = z2.object({
+  bindings: z2.array(SecretBindingSchema).optional()
 }).strict();
-var BuildSchema = z.object({
-  command: z.string().min(1).optional(),
-  destination_dir: z.string().min(1),
-  root_dir: z.string()
+var BuildSchema = z2.object({
+  command: z2.string().min(1).optional(),
+  destination_dir: z2.string().min(1),
+  root_dir: z2.string()
 }).strict();
 var STATIC_SERVE_DIR = "static";
 function staticNoBuild() {
   return { destination_dir: STATIC_SERVE_DIR, root_dir: "" };
 }
-var AppBoundarySchema = z.object({
-  root: z.string().min(1).optional(),
-  include: z.array(z.string().min(1)).min(1).optional(),
-  exclude: z.array(z.string().min(1)).optional()
+var AppBoundarySchema = z2.object({
+  root: z2.string().min(1).optional(),
+  include: z2.array(z2.string().min(1)).min(1).optional(),
+  exclude: z2.array(z2.string().min(1)).optional()
 }).strict();
-var ProductionEnvSchema = z.record(z.string().regex(ENV_NAME_REGEX, "production_env keys must be UPPER_SNAKE_CASE"), z.string());
-var VerifySchema = z.object({
-  protected_path: z.string().min(1).regex(/^\//, "verify.protected_path must be a root-relative path beginning with '/'")
+var ProductionEnvSchema = z2.record(z2.string().regex(ENV_NAME_REGEX, "production_env keys must be UPPER_SNAKE_CASE"), z2.string());
+var VerifySchema = z2.object({
+  protected_path: z2.string().min(1).regex(/^\//, "verify.protected_path must be a root-relative path beginning with '/'")
 }).strict();
-var ManifestSchema = z.object({
-  apiVersion: z.literal("launchpad.m-kopa.us/v1alpha1"),
-  kind: z.literal("App"),
+var ManifestSchema = z2.object({
+  apiVersion: z2.literal("launchpad.m-kopa.us/v1alpha1"),
+  kind: z2.literal("App"),
   metadata: MetadataSchema,
   deployment: DeploymentSchema,
   access: AccessSchema,
-  auth: z.enum(AUTH_MODES).optional(),
-  hostnames: z.array(z.string().min(1)).optional(),
-  containers: z.array(ContainerSchema).min(1).optional(),
+  auth: z2.enum(AUTH_MODES).optional(),
+  hostnames: z2.array(z2.string().min(1)).optional(),
+  containers: z2.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
-  targets: z.array(TargetSchema).optional(),
+  targets: z2.array(TargetSchema).optional(),
   build: BuildSchema.optional(),
   production_env: ProductionEnvSchema.optional(),
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
-  confine_origin: z.boolean().optional(),
-  origin: z.enum(["pages", "dispatch"]).optional(),
-  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional(),
-  sensitive: z.boolean().optional()
+  confine_origin: z2.boolean().optional(),
+  origin: z2.enum(["pages", "dispatch"]).optional(),
+  catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
+  sensitive: z2.boolean().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
   if (m.access.identity_types !== undefined && (m.auth ?? "access") !== "gateway") {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["access", "identity_types"],
       message: "access.identity_types is only valid with auth: gateway"
     });
@@ -2698,19 +2714,19 @@ var ManifestSchema = z.object({
   if (m.confine_origin !== undefined) {
     if (isContainer) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin is only valid for gateway pages apps (static/react/react+api); container apps have no pages.dev surface."
       });
     } else if (m.auth === "access") {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
       });
     } else if (m.deployment.type === "static" && m.confine_origin === false) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin: false is not allowed for static apps — they have no verifier, so an unconfined apex would be world-readable (ADR 0031)."
       });
@@ -2718,42 +2734,42 @@ var ManifestSchema = z.object({
   }
   if (isContainer && m.auth === "gateway") {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["auth"],
       message: "auth: gateway is only supported for pages-app shapes (static/react/react+api); container apps stay on Cloudflare Access (ADR 0016)."
     });
   }
   if (isContainer && m.containers === undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["containers"],
       message: "containers[] is required when deployment.type is 'container'"
     });
   }
   if (!isContainer && m.containers !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["containers"],
       message: `containers[] is only allowed when deployment.type is 'container' (current type: '${m.deployment.type}')`
     });
   }
   if (!isContainer && m.deployment.runtime !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["deployment", "runtime"],
       message: "deployment.runtime is only meaningful when deployment.type is 'container'"
     });
   }
   if (isContainer && m.build !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["build"],
       message: "build is only allowed for pages-app deployments (static/react/react+api). Container builds live in the Dockerfile."
     });
   }
   if (isContainer && m.production_env !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["production_env"],
       message: "production_env is only allowed for pages-app deployments. Container env vars use containers[].env (names only) + the bot's secrets pipeline for values."
     });
@@ -2762,7 +2778,7 @@ var ManifestSchema = z.object({
     const ingressContainers = m.containers.filter((c) => c.ingress === true);
     if (ingressContainers.length !== 1) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["containers"],
         message: `multi-container apps must mark exactly one container ingress: true (found ${ingressContainers.length})`
       });
@@ -2775,7 +2791,7 @@ var ManifestSchema = z.object({
       for (const envName of c.env ?? []) {
         if (!declaredBindings.has(envName)) {
           ctx.addIssue({
-            code: z.ZodIssueCode.custom,
+            code: z2.ZodIssueCode.custom,
             path: ["containers", i, "env"],
             message: `env reference '${envName}' has no matching entry in secrets.bindings[]`
           });
@@ -2791,7 +2807,7 @@ var ManifestSchema = z.object({
         continue;
       if (seen.has(name)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["containers", i, "name"],
           message: `duplicate container name '${name}' — names become DO class identifiers and must be unique`
         });
@@ -2808,7 +2824,7 @@ var ManifestSchema = z.object({
         continue;
       if (seen.has(name)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["secrets", "bindings", i, "name"],
           message: `duplicate secret binding name '${name}' — names become env-var keys and must be unique`
         });
@@ -2821,21 +2837,21 @@ var ManifestSchema = z.object({
     const t = targets[i];
     if (t.kind === "worker" && t.script === undefined) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: "a worker target must declare a script (the sibling Workers script name)"
       });
     }
     if (t.kind === "pages" && t.script !== undefined) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: "a pages target must not declare a script — the primary Pages project is the app slug"
       });
     }
     if (t.kind === "pages" && t.schedule !== undefined) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "schedule"],
         message: "schedule is only valid on a worker target (the cron deploy contract — ADR 0022)"
       });
@@ -2849,7 +2865,7 @@ var ManifestSchema = z.object({
       pagesTargets++;
       if (pagesTargets > 1) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["targets", i, "kind"],
           message: "at most one pages target may be declared (the primary Pages project is singular)"
         });
@@ -2860,7 +2876,7 @@ var ManifestSchema = z.object({
       continue;
     if (t.script === PRIMARY_TARGET || t.script === "pages") {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: `worker target script '${t.script}' is a reserved selector token — use a different script name`
       });
@@ -2868,7 +2884,7 @@ var ManifestSchema = z.object({
     }
     if (seenScripts.has(t.script)) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: `duplicate worker target script '${t.script}' — target scripts must be unique`
       });
@@ -2886,7 +2902,7 @@ var ManifestSchema = z.object({
     for (const ref of sel) {
       if (!validRefs.has(ref)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["secrets", "bindings", bi, "targets"],
           message: `secret binding '${b?.name}' references unknown target '${ref}' — declare it in targets[] or use "primary"`
         });
@@ -3302,42 +3318,44 @@ var STATUS_STATUS_KEYS = new Set([
   "status.generated_at"
 ]);
 // ../launchpad-engine/dist/schema-v2.js
-import { z as z2 } from "zod";
-var EnvVarSchema = z2.discriminatedUnion("type", [
-  z2.object({ type: z2.literal("secret_text"), secret_ref: z2.string().min(1) }).strict(),
-  z2.object({ type: z2.literal("plain_text"), value: z2.string() }).strict()
+import { z as z3 } from "zod";
+var EnvVarSchema = z3.discriminatedUnion("type", [
+  z3.object({ type: z3.literal("secret_text"), secret_ref: z3.string().min(1) }).strict(),
+  z3.object({ type: z3.literal("plain_text"), value: z3.string() }).strict()
 ]);
-var SpecSchema = z2.object({
-  appType: z2.enum(APP_TYPES2),
-  display: z2.object({
-    name: z2.string().min(1),
-    description: z2.string().max(280).optional(),
-    team: z2.string().min(1)
+var SpecSchema = z3.object({
+  appType: z3.enum(APP_TYPES2),
+  display: z3.object({
+    name: z3.string().min(1),
+    description: z3.string().max(280).optional(),
+    team: z3.string().min(1)
   }).strict(),
-  owner: z2.object({ email: z2.string().email() }).strict(),
-  access: z2.object({
-    allowed_entra_groups: z2.array(z2.string().min(1)).min(1).refine((a) => new Set(a).size === a.length, {
+  owner: z3.object({ email: z3.string().email() }).strict(),
+  access: z3.object({
+    audience: z3.literal("private").optional(),
+    private_owner: PrivateOwnerSchema.optional(),
+    allowed_entra_groups: z3.array(z3.string().min(1)).refine((a) => new Set(a).size === a.length, {
       message: "allowed_entra_groups must not contain duplicates"
     }),
-    require_email_domain: z2.string().min(1).optional(),
+    require_email_domain: z3.string().min(1).optional(),
     identity_types: IdentityTypesSchema.optional()
-  }).strict(),
-  auth: z2.enum(AUTH_MODES).optional(),
+  }).strict().superRefine(validateAudience),
+  auth: z3.enum(AUTH_MODES).optional(),
   build: BuildSchema.optional(),
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
-  confine_origin: z2.boolean().optional(),
-  origin: z2.enum(["pages", "dispatch"]).optional(),
-  sensitive: z2.boolean().optional(),
-  catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
-  env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
-  containers: z2.array(ContainerSchema).min(1).optional(),
+  confine_origin: z3.boolean().optional(),
+  origin: z3.enum(["pages", "dispatch"]).optional(),
+  sensitive: z3.boolean().optional(),
+  catalogue: z3.object({ listed: z3.boolean().default(true) }).strict().optional(),
+  env_vars: z3.record(z3.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
+  containers: z3.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
-  fronted_by_concierge: z2.boolean().optional()
+  fronted_by_concierge: z3.boolean().optional()
 }).strict().superRefine((s, ctx) => {
   if (s.access.identity_types !== undefined && (s.auth ?? "access") !== "gateway") {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["access", "identity_types"],
       message: "access.identity_types is only valid with auth: gateway"
     });
@@ -3345,7 +3363,7 @@ var SpecSchema = z2.object({
   for (const [k, v] of Object.entries(s.env_vars ?? {})) {
     if (/_(TOKEN|SECRET)$/.test(k) && v.type !== "secret_text") {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["env_vars", k],
         message: `env var '${k}' is secret-bearing (*_TOKEN/*_SECRET) and must be type secret_text, not '${v.type}'`
       });
@@ -3354,7 +3372,7 @@ var SpecSchema = z2.object({
   const isContainer = s.appType === "container";
   if (isContainer && s.containers === undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["containers"],
       message: "containers[] is required when appType is 'container'"
     });
@@ -3362,19 +3380,19 @@ var SpecSchema = z2.object({
   if (s.confine_origin !== undefined) {
     if (isContainer) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin is only valid for gateway pages apps; container apps have no pages.dev surface."
       });
     } else if (s.auth === "access") {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
       });
     } else if (s.appType === "static" && s.confine_origin === false) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin: false is not allowed for static apps — an unconfined apex with no verifier is world-readable (ADR 0031)."
       });
@@ -3383,21 +3401,21 @@ var SpecSchema = z2.object({
   if (s.origin === "dispatch") {
     if (isContainer) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["origin"],
         message: "origin: dispatch is not available for container apps — they run on the container runtime (ADR 0015/0016), not in a Workers dispatch namespace."
       });
     }
     if ((s.auth ?? "access") !== "gateway") {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["origin"],
         message: "origin: dispatch requires an explicit auth: gateway (auth defaults to 'access' when omitted). A dispatch-namespace Worker has no public hostname for Cloudflare Access to gate, so the gateway must be the sole gate."
       });
     }
     if (s.confine_origin !== undefined) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
       });
@@ -3405,7 +3423,7 @@ var SpecSchema = z2.object({
     for (const [name, envVar] of Object.entries(s.env_vars ?? {})) {
       if (envVar.type === "secret_text") {
         ctx.addIssue({
-          code: z2.ZodIssueCode.custom,
+          code: z3.ZodIssueCode.custom,
           path: ["env_vars", name],
           message: "secret_text env vars are not supported with origin: dispatch until PS-2740 (secrets on v2) provides their runtime consumer."
         });
@@ -3414,93 +3432,93 @@ var SpecSchema = z2.object({
   }
   if (!isContainer && s.containers !== undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["containers"],
       message: `containers[] is only allowed when appType is 'container' (current appType: '${s.appType}')`
     });
   }
   if (isContainer && s.build !== undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["build"],
       message: "build is not allowed when appType is 'container' (container build lives in the Dockerfile)"
     });
   }
   if (isContainer && s.auth === "gateway") {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["auth"],
       message: "auth: gateway is only supported for pages-app shapes (static/react/react+api); container apps stay on Cloudflare Access (ADR 0016)."
     });
   }
   if (!isContainer && s.fronted_by_concierge === true) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["fronted_by_concierge"],
       message: `fronted_by_concierge is only allowed when appType is 'container' (current appType: '${s.appType}')`
     });
   }
 });
-var nonEmpty = z2.string().min(1);
-var StatusSchema = z2.object({
-  schemaVersion: z2.literal(2),
+var nonEmpty = z3.string().min(1);
+var StatusSchema = z3.object({
+  schemaVersion: z3.literal(2),
   manifest_spec_sha: nonEmpty,
-  cloudflare: z2.object({
-    access: z2.object({
+  cloudflare: z3.object({
+    access: z3.object({
       app_id: nonEmpty,
       app_aud: nonEmpty,
       team_domain: nonEmpty,
       policy_id: nonEmpty
     }).strict(),
-    pages: z2.object({
+    pages: z3.object({
       project_name: nonEmpty,
       subdomain: nonEmpty,
       latest_deployment_id: nonEmpty
     }).strict().optional(),
-    worker: z2.object({
+    worker: z3.object({
       dev_url: nonEmpty,
       script_name: nonEmpty
     }).strict().optional()
   }).strict(),
-  dns: z2.object({ custom_hostname: nonEmpty, cname_target: nonEmpty }).strict().optional(),
-  terraform: z2.object({
+  dns: z3.object({ custom_hostname: nonEmpty, cname_target: nonEmpty }).strict().optional(),
+  terraform: z3.object({
     workspace_state_key: nonEmpty,
     last_applied_at: nonEmpty,
     last_applied_sha: nonEmpty
   }).strict(),
-  registry: z2.object({ record_present: z2.boolean(), lifecycle: nonEmpty }).strict(),
+  registry: z3.object({ record_present: z3.boolean(), lifecycle: nonEmpty }).strict(),
   generated_at: nonEmpty
 }).strict().superRefine((s, ctx) => {
   const hasPages = s.cloudflare.pages !== undefined;
   const hasWorker = s.cloudflare.worker !== undefined;
   if (hasPages === hasWorker) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["cloudflare"],
       message: "status.cloudflare must carry exactly one of `pages` (pages apps) or `worker` (container apps)"
     });
   }
   if (hasPages && s.dns === undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["dns"],
       message: "status.dns is required for a pages-shape status (cloudflare.pages present)"
     });
   }
   if (hasWorker && s.dns !== undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["dns"],
       message: "status.dns must be absent for a workers_dev_only container status (no custom hostname)"
     });
   }
 });
-var ManifestV2Schema = z2.object({
-  apiVersion: z2.literal("launchpad.m-kopa.us/v2"),
-  kind: z2.literal("App"),
-  metadata: z2.object({
-    slug: z2.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
-    schemaVersion: z2.literal(2)
+var ManifestV2Schema = z3.object({
+  apiVersion: z3.literal("launchpad.m-kopa.us/v2"),
+  kind: z3.literal("App"),
+  metadata: z3.object({
+    slug: z3.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
+    schemaVersion: z3.literal(2)
   }).strict(),
   spec: SpecSchema,
   status: StatusSchema.optional()
@@ -4230,6 +4248,11 @@ var BROAD_GROUPS = [
     uuid: "caf78902-35dd-4833-88ce-8f067eda6036",
     name: "S_ALL_Employees",
     note: "All employees — the broadest grant on the tenant; assigned to the Launchpad enterprise app. Granting this reaches the entire company."
+  },
+  {
+    uuid: "09c87073-2071-4f8e-9e97-aa67f7a153a7",
+    name: "S_ALL",
+    note: "Broad tenant group. Assignment is not a reliable limit on gateway eligibility."
   }
 ];
 function assertBroadGroupsWellFormed(list = BROAD_GROUPS) {
@@ -4248,7 +4271,7 @@ function assertBroadGroupsWellFormed(list = BROAD_GROUPS) {
 assertBroadGroupsWellFormed();
 var BROAD_UUIDS = new Set(BROAD_GROUPS.map((g) => canonicalUuid(g.uuid)).filter((u) => u !== null));
 // ../launchpad-engine/dist/fleet-manifest.js
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var TF_RESIDENCIES = ["per-app-workspace", "main-tf"];
 var APP_SHAPES = [
@@ -4276,22 +4299,22 @@ var FLEET_TIERS = [
   "out-of-scope"
 ];
 var DEVICE_POSTURE = ["gateway-eligible", "retained-access"];
-var GroupId = z3.string().regex(UUID_RE, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
-var FleetAppSchema = z3.object({
-  slug: z3.string().regex(SLUG_REGEX),
-  residency: z3.enum(TF_RESIDENCIES),
-  shape: z3.enum(APP_SHAPES),
-  declaredAuth: z3.enum(DECLARED_AUTH),
-  actualAuth: z3.enum(ACTUAL_AUTH),
-  groups: z3.array(GroupId).default([]),
-  tier: z3.enum(FLEET_TIERS),
-  devicePosture: z3.enum(DEVICE_POSTURE),
-  devicePostureReason: z3.string().trim().min(1, "devicePosture is only valid with a non-empty reason — the two-tier determination must be a surveyed output, not a default (AC-T0-3)."),
-  notes: z3.string().optional()
+var GroupId = z4.string().regex(UUID_RE, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
+var FleetAppSchema = z4.object({
+  slug: z4.string().regex(SLUG_REGEX),
+  residency: z4.enum(TF_RESIDENCIES),
+  shape: z4.enum(APP_SHAPES),
+  declaredAuth: z4.enum(DECLARED_AUTH),
+  actualAuth: z4.enum(ACTUAL_AUTH),
+  groups: z4.array(GroupId).default([]),
+  tier: z4.enum(FLEET_TIERS),
+  devicePosture: z4.enum(DEVICE_POSTURE),
+  devicePostureReason: z4.string().trim().min(1, "devicePosture is only valid with a non-empty reason — the two-tier determination must be a surveyed output, not a default (AC-T0-3)."),
+  notes: z4.string().optional()
 }).strict();
-var FleetManifestSchema = z3.object({
-  schemaVersion: z3.literal(1),
-  apps: z3.array(FleetAppSchema).min(1)
+var FleetManifestSchema = z4.object({
+  schemaVersion: z4.literal(1),
+  apps: z4.array(FleetAppSchema).min(1)
 }).strict().superRefine((m, ctx) => {
   const seen = new Set;
   for (const app of m.apps) {
@@ -4313,23 +4336,23 @@ var FleetManifestSchema = z3.object({
   }
 });
 // ../launchpad-engine/dist/fleet-secret-sets.js
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var SET_NAME_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var Slug = z4.string().regex(SLUG_REGEX, "member must be a lowercase-kebab app slug");
-var SecretName = z4.string().regex(ENV_NAME_REGEX, "secret name must be UPPER_SNAKE_CASE");
-var SecretSetExcludeSchema = z4.object({
+var Slug = z5.string().regex(SLUG_REGEX, "member must be a lowercase-kebab app slug");
+var SecretName = z5.string().regex(ENV_NAME_REGEX, "secret name must be UPPER_SNAKE_CASE");
+var SecretSetExcludeSchema = z5.object({
   member: Slug,
   secret: SecretName
 }).strict();
-var SecretSetSchema = z4.object({
-  name: z4.string().min(1).max(64).regex(SET_NAME_REGEX, "set name must be lowercase-kebab"),
-  secrets: z4.array(SecretName).min(1),
-  members: z4.array(Slug).min(1),
-  exclude: z4.array(SecretSetExcludeSchema).optional()
+var SecretSetSchema = z5.object({
+  name: z5.string().min(1).max(64).regex(SET_NAME_REGEX, "set name must be lowercase-kebab"),
+  secrets: z5.array(SecretName).min(1),
+  members: z5.array(Slug).min(1),
+  exclude: z5.array(SecretSetExcludeSchema).optional()
 }).strict();
-var FleetSecretSetsSchema = z4.object({
-  schemaVersion: z4.literal(1),
-  secretSets: z4.array(SecretSetSchema).min(1)
+var FleetSecretSetsSchema = z5.object({
+  schemaVersion: z5.literal(1),
+  secretSets: z5.array(SecretSetSchema).min(1)
 }).strict().superRefine((m, ctx) => {
   const seenSets = new Set;
   for (let i = 0;i < m.secretSets.length; i++) {
@@ -4863,7 +4886,7 @@ function toBytes(v) {
 async function verifyServed(args, deps = { fetch }) {
   let res;
   try {
-    res = await deps.fetch(args.servedUrl, { method: "GET" });
+    res = await deps.fetch(args.servedUrl, { method: "GET", redirect: "manual" });
   } catch (e) {
     return {
       kind: "unreachable",
@@ -4874,7 +4897,7 @@ async function verifyServed(args, deps = { fetch }) {
     return {
       kind: "unreachable",
       status: res.status,
-      reason: `served URL returned HTTP ${res.status}`
+      reason: [301, 302, 303, 307, 308].includes(res.status) ? `served URL redirected (HTTP ${res.status}); verify the app in an authenticated browser` : `served URL returned HTTP ${res.status}`
     };
   }
   if (args.appType !== "static") {
@@ -7625,9 +7648,6 @@ function parseDeployFlags(args) {
   if (appType === null) {
     return `--new requires --app-type (one of ${APP_TYPES.join(", ")})`;
   }
-  if (allowedGroups.length === 0) {
-    return "--new requires at least one --allowed-group";
-  }
   return {
     mode: {
       kind: "new",
@@ -9138,6 +9158,11 @@ async function runModelADeploy(args) {
         allowedHost: cfg.statusPageHost
       });
       const errorCode = body.error;
+      if (errorCode === "audience_confirmation_required") {
+        io.err(String(body.message));
+        io.err("Only the human builder may confirm. Retry this deployment after confirmation.");
+        return 1;
+      }
       if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
         io.err(upgradeRequiredMessage(body.minimum, body.yours));
         return EXIT_CLI_UPGRADE_REQUIRED;
@@ -10747,7 +10772,7 @@ var initCommand = {
   summary: "scaffold a new launchpad.yaml in the current directory",
   run: (args, io) => runInit(args, io, defaultPrompt2)
 };
-async function runInit(args, io, prompt) {
+async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(), { path: "/me/identity" })) {
   const parsed = parseArgs6(args);
   if (parsed.kind === "usage-error") {
     io.err(`launchpad init: ${parsed.message}`);
@@ -10801,7 +10826,20 @@ async function runInit(args, io, prompt) {
     io.err("launchpad init: dispatch does not support --hostname or --session-duration; use --origin pages for a Pages manifest");
     return 64;
   }
-  const manifest = buildManifest(fillResult.inputs, detected);
+  let privateOwner;
+  if (fillResult.inputs.groups.length === 0) {
+    try {
+      privateOwner = await identity();
+    } catch (error) {
+      io.err(`launchpad init: cannot verify your identity for a private app: ${error instanceof Error ? error.message : String(error)}`);
+      return 1;
+    }
+    io.out(`Audience: private. Only you (${privateOwner.email}) and platform administrators can open this app.`);
+  } else {
+    io.out(`Audience: selected Entra groups (${fillResult.inputs.groups.join(", ")}), plus platform administrators.`);
+    io.out("Company-wide grants require your explicit browser confirmation before publishing.");
+  }
+  const manifest = buildManifest({ ...fillResult.inputs, ...privateOwner === undefined ? {} : { privateOwner } }, detected);
   const validation = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? ManifestV2Schema.safeParse(manifest) : ManifestSchema.safeParse(manifest);
   if (!validation.success) {
     io.err("launchpad init: invalid manifest input");
@@ -11101,18 +11139,7 @@ async function fillRequired(inputs, options, io, prompt) {
       io.err(`  must be one of: ${APP_TYPES2.join(", ")}`);
     }
   }
-  let groupsR;
-  if (inputs.groups.length > 0) {
-    groupsR = inputs.groups;
-  } else {
-    const raw = await askIfMissing(undefined, "allowed_entra_groups (one or more, comma-separated)", (v) => v.length >= 1 ? undefined : "must not be empty");
-    if (typeof raw !== "string")
-      return raw;
-    groupsR = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-    if (groupsR.length === 0) {
-      return { kind: "usage-error", message: "at least one allowed Entra group is required" };
-    }
-  }
+  const groupsR = inputs.groups;
   let containerImage = inputs.containerImage;
   let containerPort = inputs.containerPort;
   if (typeR === "container") {
@@ -11178,7 +11205,7 @@ function buildManifest(inputs, detected) {
     metadata.description = inputs.description;
   }
   const deployment = { type: inputs.type };
-  const access = inputs.groups.length === 1 ? { allowed_entra_group: inputs.groups[0] } : { allowed_entra_groups: [...inputs.groups] };
+  const access = inputs.privateOwner !== undefined ? { audience: "private", private_owner: inputs.privateOwner, allowed_entra_groups: [] } : inputs.groups.length === 1 ? { allowed_entra_group: inputs.groups[0] } : { allowed_entra_groups: [...inputs.groups] };
   if (inputs.sessionDuration !== undefined && inputs.sessionDuration !== "") {
     access.session_duration = inputs.sessionDuration;
   }
@@ -11187,6 +11214,7 @@ function buildManifest(inputs, detected) {
     kind: "App",
     metadata,
     deployment,
+    catalogue: { listed: false },
     access
   };
   const resolvedAuth = inputs.auth ?? (inputs.type === "container" ? "access" : "gateway");
@@ -11234,7 +11262,11 @@ function buildManifest(inputs, detected) {
           ...inputs.description ? { description: inputs.description } : {}
         },
         owner: { email: inputs.owner },
-        access: { allowed_entra_groups: [...inputs.groups] },
+        access: {
+          ...inputs.privateOwner === undefined ? {} : { audience: "private", private_owner: inputs.privateOwner },
+          allowed_entra_groups: [...inputs.groups]
+        },
+        catalogue: { listed: false },
         app: manifest.app,
         ...manifest.build === undefined ? {} : { build: manifest.build }
       }

package/dist/commands/deploy-flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;gEAC4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;CACxB;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CAgZ9E"}
+{"version":3,"file":"deploy-flags.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-flags.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;uEACmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;gEAC4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACpF;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;CACxB;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,MAAM,CA6Y9E"}

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAitBxC,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAstBxC,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}

package/dist/commands/init.d.ts

@@ -1,5 +1,6 @@
 import type { CliIo, Command, ExitCode } from "../dispatcher.js";
 import { type AppType, type AuthMode } from "../manifest/schema.js";
+import type { PrivateOwner } from "@m-kopa/launchpad-engine";
 /** Required-and-optional fields the verb consumes. */
 export interface InitInputs {
     name: string | undefined;
@@ -43,5 +44,5 @@ export interface InitOptions {
 export type PromptFn = (question: string, fallback?: string) => Promise<string>;
 export declare const initCommand: Command;
 /** Validate inputs and write a new manifest without changing an existing app implicitly. */
-export declare function runInit(args: readonly string[], io: CliIo, prompt: PromptFn): Promise<ExitCode>;
+export declare function runInit(args: readonly string[], io: CliIo, prompt: PromptFn, identity?: () => Promise<PrivateOwner>): Promise<ExitCode>;
 //# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAM/B,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,GACf,OAAO,CAAC,QAAQ,CAAC,CAiLnB"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAK7D,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,EAChB,QAAQ,GAAE,MAAM,OAAO,CAAC,YAAY,CAAuE,GAC1G,OAAO,CAAC,QAAQ,CAAC,CA8LnB"}

package/dist/deploy/served-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"served-verify.d.ts","sourceRoot":"","sources":["../../src/deploy/served-verify.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAE3E,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAUD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAsB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAgDxB"}
+{"version":3,"file":"served-verify.d.ts","sourceRoot":"","sources":["../../src/deploy/served-verify.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAE3E,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAUD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAsB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAmDxB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.60.1";
+export declare const CLI_VERSION = "0.61.1";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.60.1",
+  "version": "0.61.1",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -51,6 +51,18 @@ This skill is therefore the **iteration** companion to
 `/launchpad-deploy`: once an app is live, how do you ship the next
 change — and how do you know it's actually serving.
 
+## Audience changes
+
+Keep the existing audience for ordinary content updates.
+Do not broaden groups to bypass a validation or deployment failure.
+If this update newly grants a company-wide audience, ask: **"Are you sure you want every employee to be able to open this app?"**
+Name the app and groups, explain that any selected group grants access, and give the human the server's confirmation URL.
+Never submit the browser decision on their behalf.
+Wait for their confirmation, then retry the unchanged deployment.
+Sensitive apps also require platform-admin approval.
+Do not review or recertify unchanged existing audiences as part of a routine update.
+Catalogue visibility controls discovery, not access; platform administrators retain entry independently of app groups.
+
 ## Pre-flight
 
 ```bash

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -39,6 +39,26 @@ required; no M-KOPA GitHub access required.** External users without
 M-KOPA GitHub access are first-class — a Launchpad sign-in
 (`launchpad login`, M-KOPA Microsoft account) is all they need.
 
+## App audience and human confirmation
+
+New apps are private and unlisted by default.
+Only the verified creator and platform administrators, including Kevin Robertson, can open a private app.
+Do not select a group unless the user deliberately wants to share the app with that audience.
+Never select `S_ALL_Employees`, `S_ALL`, or another broad group to fix a missing-group error or make a deployment succeed.
+
+Before requesting a new company-wide grant, ask the human exactly: **"Are you sure you want every employee to be able to open this app?"**
+Name the app and the selected groups, and explain that membership in any selected group grants access.
+A general instruction to deploy, a generic yes flag, and a previous approval for another app or revision do not answer this question.
+When the server returns `audience_confirmation_required`, give the user its confirmation URL and wait for them to complete the browser decision.
+Never open the decision endpoint with automation to approve it, submit its form, or manufacture an acknowledgement for the user.
+Retry the same deployment only after the human confirms completion.
+Sensitive apps also require a platform administrator's approval.
+A changed audience or revision needs a new decision; unchanged existing audiences do not require recertification.
+
+Catalogue listing controls discovery only.
+It neither grants access nor makes an app private.
+Platform-admin entry is independent of app groups, ownership and listing, and does not assign app-specific business roles.
+
 ## Constants (single source of truth)
 
 These values are referenced by `/launchpad-deploy-status`,
@@ -147,25 +167,11 @@ This is interactive by default. It will ask for:
 - **deployment type** — `static`, `react`, `react+api`, or
   `container`. The detector pre-selects the right one for Vite/React
   layouts; the user overrides if needed.
-- **allowed_entra_groups** — one or more, comma-separated; see §A.3.
-
-By default the app is **listed in the app catalogue**
-(get.launchpad/catalogue — the employee-facing app directory). Listing
-is discovery only and grants no one access. To keep an internal-only
-app out of it, add this under `spec` in a v2 manifest:
+- **audience**: private unless the user deliberately selects groups; see §A.3.
 
-```yaml
-spec:
-  catalogue:
-    listed: false
-```
-
-For a v1 Pages manifest, use top-level `catalogue` instead:
-
-```yaml
-catalogue:
-  listed: false
-```
+New apps are unlisted in the employee app catalogue.
+To make a v2 app discoverable, set `spec.catalogue.listed: true`; v1 uses top-level `catalogue.listed`.
+This changes discovery only and does not change who can open the app.
 
 Non-interactive form for scripting:
 
@@ -174,12 +180,11 @@ launchpad init --non-interactive \
   --name <slug> \
   --type <apptype> \
   --team <team> \
-  --owner <owner-email> \
-  --group <group>
+  --owner <owner-email>
 ```
 
 `--type` must be one of `static`, `react`, `react+api`, or
-`container`. `--group` (preferred long form `--allowed-group`,
+`container`. Omit `--group` for private access. `--group` (preferred long form `--allowed-group`,
 repeatable for multiple groups) accepts the Entra group's display
 name or UUID (the bot canonicalises to the UUID). Other flags:
 `--description <text>`, `--auth <mode>` (see §A.5),
@@ -215,7 +220,7 @@ the existing app uses any of these, plan the swap **before** picking
 a slug — do not deploy first and port later. What the bot *does*
 enforce at deploy time is the gate set in §A.5.
 
-### A.3 Allowed Entra group
+### A.3 Deliberately share with an Entra group
 
 The CLI resolves Entra groups via the bot's `/groups` endpoint
 (Entra-canonical, per M-940). The playbook never speaks to that

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.60.1
+version: 0.61.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->