@m-kopa/launchpad-cli 0.53.0 → 0.54.1

package/CHANGELOG.md

@@ -8,6 +8,25 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.54.1 - 2026-07-29
+
+**Deleted application files now stay deleted after deployment.**
+
+- The legacy clone deploy path excludes tracked files that no longer exist in the working tree, allowing the server to derive their deletion from the complete upload.
+- The platform applies updates and proved app-owned deletions in one Git tree while preserving governance, workflow, ownership, Wrangler, Launchpad metadata, and out-of-boundary files.
+- The server uses exact managed-tree enumeration before absence can authorize deletion and returns a retryable failure when that proof is unavailable.
+
+## 0.54.0 - 2026-07-19
+
+**Server-visible CLI compatibility, with dormant minimum-version enforcement.**
+
+- Every request to the Launchpad bot now sends the real CLI release in `x-launchpad-cli-version` and the `User-Agent`, replacing the placeholder `launchpad-cli/0.x` value.
+  This lets the platform measure authenticated CLI adoption from server observations and reconcile it with PostHog telemetry.
+- Mutating commands make one authenticated compatibility preflight before local build or upload work.
+  A future server-configured minimum can return HTTP `426 Upgrade Required`; the CLI then prints its version, the minimum version, and `run launchpad update`, and exits with the dedicated code `42`.
+- Upload and deployment requests also handle `426` directly so a floor change between preflight and mutation cannot proceed silently.
+- No minimum version is configured by this release, so the compatibility machinery is dormant and no client is blocked.
+
 ## 0.53.0 - 2026-07-18
 
 **Breaking: `launchpad pull` now synchronizes source.**

package/dist/auth/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/auth/discovery.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,cAAc,CAAC,CA0EzB"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/auth/discovery.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,cAAc,CAAC,CA0EzB"}

package/dist/auth/gateway-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-flow.d.ts","sourceRoot":"","sources":["../../src/auth/gateway-flow.ts"],"names":[],"mappings":"AA0CA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAC7D,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;6DAE6D;AAC7D,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;CAChD;AAED;;sCAEsC;AACtC,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAKjD;AAED;;;gCAGgC;AAChC,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM;CAOlC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;wBAEoB;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,kCAAkC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EACtE,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAS3B;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EACtE,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,IAAI,CAAC,CAsBf"}
+{"version":3,"file":"gateway-flow.d.ts","sourceRoot":"","sources":["../../src/auth/gateway-flow.ts"],"names":[],"mappings":"AA4CA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAC7D,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;6DAE6D;AAC7D,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;CAChD;AAED;;sCAEsC;AACtC,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAKjD;AAED;;;gCAGgC;AAChC,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM;CAOlC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;wBAEoB;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,kCAAkC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EACtE,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAS3B;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EACtE,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,IAAI,CAAC,CAwBf"}

package/dist/auth/registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/auth/registration.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;CAC/C;AAED,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA6C7B"}
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/auth/registration.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;CAC/C;AAED,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA6C7B"}

package/dist/auth/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;qEACiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAG,aAAa,CAAU;IACvC;;qDAEiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAKjD;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IACN,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;6DAGyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,EACD,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,aAAa,CAAC,CAUxB;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE;IACN,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;+CAE2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,EACD,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,aAAa,CAAC,CAQxB"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;qEACiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAG,aAAa,CAAU;IACvC;;qDAEiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAKjD;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IACN,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;6DAGyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,EACD,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,aAAa,CAAC,CAUxB;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE;IACN,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;+CAE2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,EACD,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,aAAa,CAAC,CAQxB"}

package/dist/bundle/upload.d.ts

@@ -110,6 +110,8 @@ export interface DeployBundleError extends StructuredErrorEnvelope {
     readonly head_sha?: string;
     readonly paths?: readonly string[];
     readonly reason?: string;
+    readonly minimum?: string;
+    readonly yours?: string;
 }
 export type DeployBundleResult = {
     kind: "ok";

package/dist/bundle/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/bundle/upload.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,eAAO,MAAM,6BAA6B,kCACT,CAAC;AAClC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,WAAW,GACX,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;CAC/B;AAgBD;;;oCAGoC;AACpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;qEAGqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;4CACwC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,+BAA+B,GAC/B,2BAA2B,CAAC;AAEhC,iEAAiE;AACjE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc;AAC/B;gEACgE;AAChE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;AACvB;0EAC0E;AAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;AAC7B,+EAA+E;AAC/E,cAAc,GAAE,OAAe,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA+H7B"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/bundle/upload.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,eAAO,MAAM,6BAA6B,kCACT,CAAC;AAClC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,WAAW,GACX,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;CAC/B;AAgBD;;;oCAGoC;AACpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;qEAGqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;4CACwC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,+BAA+B,GAC/B,2BAA2B,CAAC;AAEhC,iEAAiE;AACjE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc;AAC/B;gEACgE;AAChE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;AACvB;0EAC0E;AAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;AAC7B,+EAA+E;AAC/E,cAAc,GAAE,OAAe,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA+H7B"}

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.53.0";
+var CLI_VERSION = "0.54.1";
 
 // src/config.ts
 import * as os from "node:os";
@@ -213,6 +213,22 @@ class ForbiddenError extends Error {
 class NotFoundError extends Error {
   code = "not_found";
 }
+var EXIT_CLI_UPGRADE_REQUIRED = 42;
+
+class UpgradeRequiredError extends Error {
+  code = "cli_upgrade_required";
+  minimum;
+  yours;
+  constructor(minimum, yours) {
+    super(upgradeRequiredMessage(minimum, yours));
+    this.name = "UpgradeRequiredError";
+    this.minimum = minimum;
+    this.yours = yours;
+  }
+}
+function upgradeRequiredMessage(minimum, yours) {
+  return `you're on ${yours}; minimum supported is ${minimum} - run launchpad update`;
+}
 
 class ApiError extends Error {
   faultCode = "api_error";
@@ -363,6 +379,21 @@ function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
+// src/http/version-headers.ts
+var CLI_VERSION_HEADER = "x-launchpad-cli-version";
+function cliVersionHeaders(headers = {}) {
+  const result = { ...headers };
+  for (const key of Object.keys(result)) {
+    const lower = key.toLowerCase();
+    if (lower === CLI_VERSION_HEADER || lower === "user-agent") {
+      delete result[key];
+    }
+  }
+  result[CLI_VERSION_HEADER] = CLI_VERSION;
+  result["user-agent"] = `launchpad-cli/${CLI_VERSION}`;
+  return result;
+}
+
 // src/auth/discovery.ts
 class DiscoveryError extends Error {
   code = "discovery_error";
@@ -401,7 +432,10 @@ async function discoverOauthEndpoints(botUrl, fetcher = fetch) {
 async function fetchJson(fetcher, url) {
   let res;
   try {
-    res = await fetcher(url, { method: "GET" });
+    res = await fetcher(url, {
+      method: "GET",
+      headers: cliVersionHeaders()
+    });
   } catch (e) {
     throw new DiscoveryError(`discovery: network error fetching ${url}: ${describe(e)}`);
   }
@@ -471,10 +505,10 @@ async function registerClient(registrationEndpoint, redirectUri, fetcher = fetch
   try {
     res = await fetcher(registrationEndpoint, {
       method: "POST",
-      headers: {
+      headers: cliVersionHeaders({
         "content-type": "application/json",
         accept: "application/json"
-      },
+      }),
       body: JSON.stringify(body)
     });
   } catch (e) {
@@ -535,10 +569,10 @@ async function postTokenForm(tokenEndpoint, form, fetcher) {
   try {
     res = await fetcher(tokenEndpoint, {
       method: "POST",
-      headers: {
+      headers: cliVersionHeaders({
         "content-type": "application/x-www-form-urlencoded",
         accept: "application/json"
-      },
+      }),
       body: form.toString()
     });
   } catch (e) {
@@ -805,7 +839,9 @@ async function revokeGatewaySession(params, fetcher = fetch) {
   try {
     res = await fetcher(url, {
       method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
+      headers: cliVersionHeaders({
+        "content-type": "application/x-www-form-urlencoded"
+      }),
       body: new URLSearchParams({ refresh_token: params.refreshToken }).toString()
     });
   } catch (e) {
@@ -823,7 +859,10 @@ async function probeGateway(gatewayUrl, fetcher) {
   const url = `${gatewayUrl}${CLI_SESSION_AUTH_PATH}`;
   let res;
   try {
-    res = await fetcher(url, { method: "GET" });
+    res = await fetcher(url, {
+      method: "GET",
+      headers: cliVersionHeaders()
+    });
   } catch (e) {
     throw new GatewayUnavailableError(`auth gateway unreachable at ${gatewayUrl}: ${describe5(e)}`);
   }
@@ -840,10 +879,10 @@ async function postSessionTokenForm(gatewayUrl, form, fetcher) {
   try {
     res = await fetcher(url, {
       method: "POST",
-      headers: {
+      headers: cliVersionHeaders({
         "content-type": "application/x-www-form-urlencoded",
         accept: "application/json"
-      },
+      }),
       body: form.toString()
     });
   } catch (e) {
@@ -1054,12 +1093,11 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
     }
     throw e;
   }
-  const headers = {
+  const headers = cliVersionHeaders({
     accept: "application/json",
     ...opts.headers,
-    authorization: `Bearer ${token}`,
-    "user-agent": "launchpad-cli/0.x"
-  };
+    authorization: `Bearer ${token}`
+  });
   for (const k of Object.keys(headers)) {
     if (k !== "authorization" && k.toLowerCase() === "authorization") {
       delete headers[k];
@@ -1083,6 +1121,9 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
   } catch (e) {
     throw recordedFault(new TransportError(`network error calling ${url}: ${describe7(e)}`));
   }
+  if (res.status === 426) {
+    throw recordedFault(await decodeUpgradeRequired(res, opts.path));
+  }
   if (res.status === 401) {
     const detail = await errorDetail(res, opts.path);
     throw recordedFault(new UnauthenticatedError(`bot returned 401 for ${opts.path}: ${detail} — run \`launchpad login\``));
@@ -1104,6 +1145,18 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
   clearFault();
   return res;
 }
+async function decodeUpgradeRequired(response, endpoint) {
+  const body = await readErrorText(response);
+  if (body.kind === "text") {
+    try {
+      const parsed = JSON.parse(body.text);
+      if (typeof parsed.minimum === "string" && typeof parsed.yours === "string") {
+        return new UpgradeRequiredError(parsed.minimum, parsed.yours);
+      }
+    } catch {}
+  }
+  return new ApiError(decodeErrorEnvelope({ code: "cli_upgrade_required", message: "CLI upgrade required" }, { status: 426, endpoint }));
+}
 async function readErrorText(res) {
   const reader = res.body?.getReader();
   if (reader === undefined)
@@ -1814,7 +1867,7 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
@@ -1995,11 +2048,11 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
   }
   const url = `${cfg.botUrl}/apps/${slug}/deploy/bundle`;
   const { accessToken } = await getValidAccessToken(cfg.sessionPath);
-  const headers = {
+  const headers = cliVersionHeaders({
     authorization: `Bearer ${accessToken}`,
     accept: "application/json",
     "x-launchpad-capabilities": `${ACCESS_RECONCILE_EXACT_SHA_V1},${SOURCE_PROVENANCE_V1}`
-  };
+  });
   if (baseSha)
     headers["x-launchpad-base-sha"] = baseSha;
   if (overrideStale)
@@ -2128,7 +2181,9 @@ function deployBundleError(envelope, body) {
     ...manifestOnly === undefined ? {} : { manifest_only: manifestOnly },
     ...typeof body.head_sha === "string" ? { head_sha: body.head_sha } : {},
     ...paths === undefined ? {} : { paths },
-    ...typeof body.reason === "string" ? { reason: body.reason } : {}
+    ...typeof body.reason === "string" ? { reason: body.reason } : {},
+    ...typeof body.minimum === "string" ? { minimum: body.minimum } : {},
+    ...typeof body.yours === "string" ? { yours: body.yours } : {}
   };
 }
 function readStringArray(value) {
@@ -2602,6 +2657,7 @@ var ManifestSchema = z.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z.boolean().optional(),
+  origin: z.enum(["pages", "dispatch"]).optional(),
   catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional(),
   sensitive: z.boolean().optional()
 }).strict().superRefine((m, ctx) => {
@@ -2992,7 +3048,9 @@ var PLATFORM_SEEDED_GITHUB_PATHS = new Set([
   ".github/scripts/parse-tsc.mjs",
   ".github/scripts/parse-vitest.mjs",
   ".github/scripts/parse-gitleaks.mjs",
-  ".github/scripts/parse-bun-audit.mjs"
+  ".github/scripts/parse-bun-audit.mjs",
+  ".github/scripts/parse-html-validate.mjs",
+  ".github/scripts/parse-hadolint.mjs"
 ]);
 function checkDenyList(path7) {
   const segments = path7.split("/");
@@ -3235,6 +3293,7 @@ var SpecSchema = z2.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z2.boolean().optional(),
+  origin: z2.enum(["pages", "dispatch"]).optional(),
   sensitive: z2.boolean().optional(),
   catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
   env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
@@ -3280,6 +3339,43 @@ var SpecSchema = z2.object({
       });
     }
   }
+  if (s.origin === "dispatch") {
+    if (isContainer) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["origin"],
+        message: "origin: dispatch is not available for container apps — they run on the container runtime (ADR 0015/0016), not in a Workers dispatch namespace."
+      });
+    }
+    if ((s.auth ?? "access") !== "gateway") {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["origin"],
+        message: "origin: dispatch requires an explicit auth: gateway (auth defaults to 'access' when omitted). A dispatch-namespace Worker has no public hostname for Cloudflare Access to gate, so the gateway must be the sole gate."
+      });
+    }
+    if (s.confine_origin !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
+      });
+    }
+    if (s.env_vars !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["env_vars"],
+        message: "env_vars are not yet supported with origin: dispatch — a dispatch workspace has no Pages module to apply them, and accepting them here would silently drop them. Worker-level vars land with the v2 deploy path."
+      });
+    }
+    if (s.build !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["build"],
+        message: "build is not yet supported with origin: dispatch — a dispatch workspace has no Pages module to carry it, and the v2 deploy path that will consume it is not shipped yet. Accepting it here would silently drop it."
+      });
+    }
+  }
   if (!isContainer && s.containers !== undefined) {
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
@@ -6130,6 +6226,8 @@ import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 
 class GitFilesError extends Error {
   code = "git_files_error";
@@ -6147,6 +6245,7 @@ var PROTECTED_PATHS = new Set([
 ]);
 async function listDeployFiles(opts) {
   const sp = opts.spawner ?? spawn3;
+  const exists = opts.exists ?? existsSync5;
   const stdout = await runGit2(sp, opts.cwd, [
     "ls-files",
     "-c",
@@ -6154,11 +6253,11 @@ async function listDeployFiles(opts) {
     "--exclude-standard",
     "-z"
   ]);
-  const paths = stdout.split("\x00").filter((p) => p.length > 0 && !PROTECTED_PATHS.has(p));
+  const paths = stdout.split("\x00").filter((p) => p.length > 0 && exists(resolve7(opts.cwd, p)) && !PROTECTED_PATHS.has(p));
   return [...paths].sort();
 }
 function runGit2(sp, cwd, args) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const spawnOpts = { cwd, stdio: ["ignore", "pipe", "pipe"] };
     const child = sp("git", [...args], spawnOpts);
     let stdout = "";
@@ -6174,7 +6273,7 @@ function runGit2(sp, cwd, args) {
     });
     child.once("close", (code) => {
       if (code === 0) {
-        resolve7(stdout);
+        resolve8(stdout);
         return;
       }
       reject(new GitFilesError(`\`git ${args.join(" ")}\` exited ${code}: ${stderr.trim()}`));
@@ -6751,7 +6850,7 @@ function parseDeployFlags(args) {
 }
 
 // src/deploy/apply.ts
-import { existsSync as existsSync5, rmSync } from "node:fs";
+import { existsSync as existsSync6, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
@@ -7118,7 +7217,7 @@ function sleep(ms) {
 }
 function deletePinIfPresent(cfg, slug, io) {
   const pinPath = join10(cfg.stateDir, slug, "group.json");
-  if (!existsSync5(pinPath))
+  if (!existsSync6(pinPath))
     return;
   try {
     rmSync(pinPath, { force: true });
@@ -7256,12 +7355,12 @@ async function handleAccessDrift(params) {
 
 // src/deploy/dry-run.ts
 import { execFileSync } from "node:child_process";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var MANIFEST_SHA_REGEX2 = /^[0-9a-f]{40}$/;
 async function runDeployDryRun(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
-  const manifestPath = resolve7(process.cwd(), opts.file ?? "launchpad.yaml");
+  const manifestPath = resolve8(process.cwd(), opts.file ?? "launchpad.yaml");
   const loaded = loadManifest(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError2(loaded, opts.json, io);
@@ -7671,7 +7770,7 @@ async function runDeploy(args, io) {
   }
   const cwd = process.cwd();
   const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync6(manifestPath)) {
+  if (existsSync7(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : {
       allowStale: false,
       rebaseOntoHead: false,
@@ -7725,7 +7824,7 @@ async function runDeploy(args, io) {
     }
     let contentManifestYaml = null;
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync6(contentManifestPath)) {
+    if (existsSync7(contentManifestPath)) {
       try {
         contentManifestYaml = readFileSync10(contentManifestPath, "utf8");
       } catch {
@@ -7773,6 +7872,10 @@ async function runDeploy(args, io) {
     }
     return 0;
   } catch (e) {
+    if (e instanceof UpgradeRequiredError) {
+      io.err(e.message);
+      return EXIT_CLI_UPGRADE_REQUIRED;
+    }
     if (e instanceof UnauthenticatedError) {
       io.err(e.message);
       return 1;
@@ -7944,11 +8047,11 @@ function surfaceStaleBlock(body, io) {
 }
 var MANIFEST_DIFF_READ_TIMEOUT_MS = 5000;
 function withTimeout(p, ms) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const timer = setTimeout(() => reject(new Error(`manifest read timed out after ${ms}ms`)), ms);
     p.then((v) => {
       clearTimeout(timer);
-      resolve8(v);
+      resolve9(v);
     }, (e) => {
       clearTimeout(timer);
       reject(e instanceof Error ? e : new Error(String(e)));
@@ -8086,6 +8189,10 @@ async function runModelADeploy(args) {
       }
     }
   } catch (e) {
+    if (e instanceof UpgradeRequiredError) {
+      io.err(e.message);
+      return EXIT_CLI_UPGRADE_REQUIRED;
+    }
     if (e instanceof UnauthenticatedError) {
       io.err(`launchpad deploy: ${e.message}`);
       io.err("       run `launchpad login` to refresh your session.");
@@ -8113,6 +8220,10 @@ async function runModelADeploy(args) {
     case "upload-error": {
       const body = result.body;
       const errorCode = body.error;
+      if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
+        io.err(upgradeRequiredMessage(body.minimum, body.yours));
+        return EXIT_CLI_UPGRADE_REQUIRED;
+      }
       if (result.status === 409 && errorCode === "slug_in_flight") {
         io.err(`launchpad deploy: slug "${slug}" is already provisioning.`);
         if (typeof body.message === "string") {
@@ -8299,7 +8410,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -8377,7 +8488,7 @@ async function runRedeploy(opts, io, deps = {}) {
 }
 function readLocalAppType(cwd, file) {
   const manifestPath = resolvePath2(cwd, file ?? "launchpad.yaml");
-  if (!existsSync7(manifestPath))
+  if (!existsSync8(manifestPath))
     return null;
   try {
     const obj = parseYaml7(readFileSync11(manifestPath, "utf8"));
@@ -8665,7 +8776,7 @@ function describe16(e) {
 
 // src/commands/generate.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, resolve as resolve8, relative as relative3 } from "node:path";
+import { dirname as dirname6, resolve as resolve9, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
   summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
@@ -8678,14 +8789,14 @@ async function runGenerate(args, io) {
     io.err("Usage: launchpad generate [--file <path>] [--dry-run] [--force] [--json]");
     return 64;
   }
-  const manifestPath = resolve8(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
   const appRoot = dirname6(manifestPath);
-  const wranglerPath = resolve8(appRoot, "container", "wrangler.toml");
-  const workflowPath = resolve8(appRoot, ".github", "workflows", "deploy.yml");
+  const wranglerPath = resolve9(appRoot, "container", "wrangler.toml");
+  const workflowPath = resolve9(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
   const workflowOut = generateGithubDeployWorkflow(result.manifest);
   if (flags.dryRun) {
@@ -9490,17 +9601,17 @@ function describe19(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname7, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname7, resolve as resolve10 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13, statSync } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13, statSync } from "node:fs";
 import { join as join12 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync8(join12(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync8(join12(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync8(join12(cwd, n)));
+  const hasPackageJson = existsSync9(join12(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join12(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join12(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -9546,7 +9657,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync8(join12(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync9(join12(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -9569,7 +9680,7 @@ function detectPackageManager(cwd) {
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
     const p = join12(cwd, name);
-    if (existsSync8(p)) {
+    if (existsSync9(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -9581,7 +9692,7 @@ function detectVitePresence(cwd) {
 function detectAppType(cwd) {
   const fnDir = join12(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync8(fnDir)) {
+  if (existsSync9(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -9592,7 +9703,7 @@ function detectAppType(cwd) {
 }
 function detectBuildCommand(cwd, pm) {
   const pkgJsonPath = join12(cwd, "package.json");
-  if (!existsSync8(pkgJsonPath)) {
+  if (!existsSync9(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -9664,8 +9775,8 @@ async function runInit(args, io, prompt) {
     return 64;
   }
   const { inputs, options } = parsed;
-  const outPath = resolve9(process.cwd(), options.out);
-  if (existsSync9(outPath) && !options.force) {
+  const outPath = resolve10(process.cwd(), options.out);
+  if (existsSync10(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -9712,7 +9823,7 @@ async function runInit(args, io, prompt) {
   }
   io.out(`✓ wrote ${outPath}`);
   if (options.gitignore) {
-    const gitignorePath = resolve9(process.cwd(), ".gitignore");
+    const gitignorePath = resolve10(process.cwd(), ".gitignore");
     try {
       const changed = ensureGitignoreEntries(gitignorePath, [".env", ".env.local"]);
       if (changed.length > 0) {
@@ -9727,9 +9838,9 @@ async function runInit(args, io, prompt) {
     }
   }
   if (fillResult.inputs.type === "static") {
-    const serveDir = resolve9(dirname7(outPath), STATIC_SERVE_DIR);
-    const indexPath = resolve9(serveDir, "index.html");
-    if (!existsSync9(indexPath)) {
+    const serveDir = resolve10(dirname7(outPath), STATIC_SERVE_DIR);
+    const indexPath = resolve10(serveDir, "index.html");
+    if (!existsSync10(indexPath)) {
       try {
         mkdirSync3(serveDir, { recursive: true });
         writeFileSync3(indexPath, starterIndexHtml(fillResult.inputs.name), {
@@ -10121,7 +10232,7 @@ function renderYaml(manifest) {
 }
 function ensureGitignoreEntries(path10, entries) {
   let current = "";
-  if (existsSync9(path10)) {
+  if (existsSync10(path10)) {
     current = readFileSync14(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
@@ -10650,7 +10761,7 @@ function describe23(e) {
 }
 
 // src/commands/plan.ts
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -10663,7 +10774,7 @@ async function runPlan(args, io) {
     io.err("Usage: launchpad plan [--file <path>] [--json]");
     return 64;
   }
-  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve11(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   return flags.json ? renderJson(result, io) : renderHuman(result, io);
 }
@@ -11253,12 +11364,12 @@ async function listFiles(root, relative5 = "") {
   return files.sort();
 }
 function gitOutput(cwd, args) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     execFile("git", [...args], { cwd, encoding: "utf8" }, (error, stdout) => {
       if (error !== null)
         reject(error);
       else
-        resolve12(stdout);
+        resolve13(stdout);
     });
   });
 }
@@ -12193,7 +12304,7 @@ function describe26(e) {
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -12318,7 +12429,7 @@ async function runRollback(opts, io, deps = {}) {
   }, io, applyDeps);
 }
 function readCurrentManifest(path14) {
-  if (!existsSync10(path14))
+  if (!existsSync11(path14))
     return null;
   let raw;
   try {
@@ -12478,7 +12589,7 @@ function parseArgs12(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync11, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as input2, stdout as output2 } from "node:process";
@@ -12535,7 +12646,7 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath4(process.cwd(), opts.env ?? ".env");
-  if (!existsSync11(envPath)) {
+  if (!existsSync12(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
@@ -12867,7 +12978,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
@@ -12877,7 +12988,7 @@ var CELL_LABEL2 = {
 };
 function loadSet(fleetFile, setName, io) {
   const path14 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync12(path14)) {
+  if (!existsSync13(path14)) {
     io.err(`✗ ${path14}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
@@ -12969,7 +13080,7 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath6(process.cwd(), opts.env ?? ".env");
-  if (!existsSync12(envPath)) {
+  if (!existsSync13(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
@@ -13120,8 +13231,8 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync13, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve13 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -13129,7 +13240,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve12(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve13(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -13143,8 +13254,8 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve12(process.cwd(), flags.out);
-  if (existsSync13(outPath) && !flags.force) {
+  const outPath = resolve13(process.cwd(), flags.out);
+  if (existsSync14(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
@@ -13440,8 +13551,8 @@ function printHelp3(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname9, join as join15, resolve as resolve13 } from "node:path";
-import { promises as fs7, existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname9, join as join15, resolve as resolve14 } from "node:path";
+import { promises as fs7, existsSync as existsSync15 } from "node:fs";
 
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
@@ -13546,11 +13657,11 @@ function resolveInstallEnv() {
 function defaultBundleDir() {
   const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve13(here, "..", "skills"),
-    resolve13(here, "..", "..", "skills")
+    resolve14(here, "..", "skills"),
+    resolve14(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync14(join15(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync15(join15(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -13659,7 +13770,7 @@ function describe29(e) {
 import { execFile as execFile2, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname10, resolve as resolve14, relative as relative5, isAbsolute as isAbsolute3, join as join16 } from "node:path";
+import { dirname as dirname10, resolve as resolve15, relative as relative5, isAbsolute as isAbsolute3, join as join16 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
 import { readFileSync as readFileSync19, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
@@ -13704,9 +13815,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve14) => {
-    server.once("error", () => resolve14(false));
-    server.listen(0, "127.0.0.1", () => resolve14(true));
+  const bound = await new Promise((resolve15) => {
+    server.once("error", () => resolve15(false));
+    server.listen(0, "127.0.0.1", () => resolve15(true));
   });
   if (!bound)
     return null;
@@ -13999,7 +14110,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve14(dirname10(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve15(dirname10(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -14007,7 +14118,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve14(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve15(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -14144,8 +14255,8 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync15, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname11, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { dirname as dirname11, resolve as resolve16 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -14159,7 +14270,7 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path14 = resolve15(process.cwd(), file ?? "launchpad.yaml");
+  const path14 = resolve16(process.cwd(), file ?? "launchpad.yaml");
   const result = loadManifest(path14);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
@@ -14206,8 +14317,8 @@ function checkStaticServeDir(manifestPath, manifest) {
     ];
   }
   const dir = dirname11(manifestPath);
-  const abs = resolve15(dir, serveDir);
-  if (!existsSync15(abs)) {
+  const abs = resolve16(dir, serveDir);
+  if (!existsSync16(abs)) {
     return [
       `static app serves '${serveDir}/' but that directory does not exist — nothing would be served. ` + `Create ${serveDir}/index.html (or run \`launchpad init\` to scaffold it).`
     ];
@@ -14232,7 +14343,7 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app's served directory '${serveDir}/' is empty — the deploy would serve an empty site.`
     ];
   }
-  if (!existsSync15(resolve15(abs, "index.html"))) {
+  if (!existsSync16(resolve16(abs, "index.html"))) {
     return [
       `static app's served directory '${serveDir}/' has no index.html — the deploy would serve a directory with no entrypoint.`
     ];
@@ -15103,7 +15214,7 @@ import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
 import { join as join17 } from "node:path";
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync21,
   writeFileSync as writeFileSync8
@@ -15135,7 +15246,7 @@ function writeCache2(state) {
 var SKILLS_HINT_MARKER = join17(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
-    return existsSync16(SKILLS_HINT_MARKER);
+    return existsSync17(SKILLS_HINT_MARKER);
   } catch {
     return false;
   }
@@ -15246,7 +15357,7 @@ var refreshUpdateCacheCommand = {
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join18 } from "node:path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -15400,7 +15511,7 @@ function telemetryNoticeLine() {
 }
 function firstRunNoticeShown() {
   try {
-    return existsSync17(FIRST_RUN_MARKER);
+    return existsSync18(FIRST_RUN_MARKER);
   } catch {
     return false;
   }
@@ -15642,6 +15753,12 @@ function makeReportCommand(kind, deps = realDeps5()) {
   };
 }
 
+// src/http/preflight.ts
+async function preflightMinimumCliVersion(config, fetcher = fetch) {
+  const detachedFetcher = fetcher;
+  await apiRaw(config, { method: "POST", path: "/cli/preflight" }, detachedFetcher);
+}
+
 // src/dispatcher.ts
 var COMMANDS = [
   loginCommand,
@@ -15681,7 +15798,7 @@ var COMMANDS = [
   refreshUpdateCacheCommand,
   emitTelemetryCommand
 ];
-async function dispatch(argv, io, commands = COMMANDS) {
+async function dispatch(argv, io, commands = COMMANDS, deps = {}) {
   if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
     printHelp6(io, commands);
     return 0;
@@ -15699,12 +15816,55 @@ async function dispatch(argv, io, commands = COMMANDS) {
     io.err("Run `launchpad --help` for the list of available commands.");
     return 64;
   }
+  const preflightExit = await runCliFloorPreflight(verb, rest, io, deps);
+  if (preflightExit !== null)
+    return preflightExit;
   const code = await cmd.run(rest, io);
   if (!cmd.hidden && verb !== "bug" && verb !== "feature") {
     writeBreadcrumb(verb, code);
   }
   return code;
 }
+async function runCliFloorPreflight(verb, args, io, deps) {
+  if (!requiresCliFloorPreflight(verb, args))
+    return null;
+  try {
+    const preflight = deps.preflight ?? preflightMinimumCliVersion;
+    await preflight(loadConfig());
+    return null;
+  } catch (error) {
+    if (error instanceof UpgradeRequiredError) {
+      io.err(error.message);
+      return EXIT_CLI_UPGRADE_REQUIRED;
+    }
+    io.err(`launchpad ${verb}: version preflight failed: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+function requiresCliFloorPreflight(verb, args) {
+  if (args.includes("--help") || args.includes("-h"))
+    return false;
+  if ([
+    "create",
+    "deploy",
+    "redeploy",
+    "merge",
+    "destroy",
+    "recover",
+    "rollback",
+    "grant-editor",
+    "revoke-editor",
+    "add-owner",
+    "remove-owner"
+  ].includes(verb)) {
+    return true;
+  }
+  if (verb === "envvars")
+    return args[0] === "set" || args[0] === "rm";
+  if (verb === "secrets")
+    return args[0] === "push";
+  return false;
+}
 function printHelp6(io, commands) {
   io.out("launchpad — manage Launchpad-deployed apps from the command line.");
   io.out("");

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAsEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAc/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAgRD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAyEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAc/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAoRD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/deploy/git-files.d.ts

@@ -3,23 +3,19 @@ export declare class GitFilesError extends Error {
     readonly code: "git_files_error";
 }
 /**
- * Paths the bot owns and rejects unconditionally on `deploy-pr`
- * (see `PROTECTED_PATHS` in `portal-bot/src/deploy-pr.ts`). Mirrored
- * here so the CLI excludes them up front rather than shipping a
- * tarball the bot will reject.
+ * Legacy convenience filter for known bot-owned files.
  *
- * The bot uses `base_tree` mode on the commit, so files we omit
- * from the tarball keep their base-branch contents — there's no
- * destructive consequence to filtering these out.
- *
- * Keep in lock-step with the bot's list. A future endpoint that
- * exposes this list would let the CLI fetch it dynamically; for
- * v1 the set is small and rarely changes.
+ * This list is not a security boundary and does not grant deletion
+ * authority. The server owns the canonical, family-based path policy
+ * and preserves platform files even when an older or newer client
+ * sends a different set.
  */
 export declare const PROTECTED_PATHS: ReadonlySet<string>;
 export interface ListFilesOptions {
     readonly cwd: string;
     readonly spawner?: typeof spawn;
+    /** Test seam for the worktree existence check. Receives an absolute path. */
+    readonly exists?: (path: string) => boolean;
 }
 /**
  * Return the deploy-eligible file paths under `cwd`, relative to

package/dist/deploy/git-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-files.d.ts","sourceRoot":"","sources":["../../src/deploy/git-files.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAU9C,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAqBxF"}
+{"version":3,"file":"git-files.d.ts","sourceRoot":"","sources":["../../src/deploy/git-files.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAI9D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAU9C,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA4BxF"}

package/dist/dispatcher.d.ts

@@ -1,3 +1,4 @@
+import { type CliConfig } from "./config.js";
 export interface CliIo {
     /** Where regular CLI output goes (matches stdout). */
     readonly out: (line: string) => void;
@@ -15,6 +16,9 @@ export interface Command {
      */
     readonly hidden?: boolean;
 }
+export interface DispatchDeps {
+    readonly preflight?: (config: CliConfig) => Promise<void>;
+}
 /**
  * Verb table. Each slice imports + appends its `Command` here.
  * Keeping the registry as a const array (rather than a Map)
@@ -25,6 +29,6 @@ export declare const COMMANDS: readonly Command[];
  * Top-level dispatcher. Returns an exit code; never calls
  * `process.exit` itself (the bin wrapper does).
  */
-export declare function dispatch(argv: readonly string[], io: CliIo, commands?: readonly Command[]): Promise<ExitCode>;
+export declare function dispatch(argv: readonly string[], io: CliIo, commands?: readonly Command[], deps?: DispatchDeps): Promise<ExitCode>;
 export declare function printHelp(io: CliIo, commands: readonly Command[]): void;
 //# sourceMappingURL=dispatcher.d.ts.map

package/dist/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AA0DA,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAyCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,GACtC,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAOzD,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EAyCtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,EACvC,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CA4BnB;AAsDD,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}

package/dist/http/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/http/api-client.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAe9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA0FnB"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/http/api-client.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgB9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA6FnB"}

package/dist/http/errors.d.ts

@@ -15,6 +15,17 @@ export declare class ForbiddenError extends Error {
 export declare class NotFoundError extends Error {
     readonly code: "not_found";
 }
+/** Stable process exit used only for a server-enforced CLI upgrade. */
+export declare const EXIT_CLI_UPGRADE_REQUIRED = 42;
+/** HTTP 426 with the server's current minimum and the presented CLI version. */
+export declare class UpgradeRequiredError extends Error {
+    readonly code: "cli_upgrade_required";
+    readonly minimum: string;
+    readonly yours: string;
+    constructor(minimum: string, yours: string);
+}
+/** Render the one-line recovery message shared by preflight and upload. */
+export declare function upgradeRequiredMessage(minimum: string, yours: string): string;
 import { type StructuredErrorEnvelope } from "./error-envelope.js";
 /** Any other non-2xx. Carries the complete bounded structured envelope. */
 export declare class ApiError extends Error {

package/dist/http/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/http/errors.ts"],"names":[],"mappings":"AAIA;;2DAE2D;AAC3D,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;uCAEuC;AACvC,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;CACtC;AAED;yEACyE;AACzE,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;CACtC;AAED,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,SAAS,EAAG,WAAW,CAAU;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;gBAE/B,QAAQ,EAAE,uBAAuB;CAgB9C;AAED;2BAC2B;AAC3B,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/http/errors.ts"],"names":[],"mappings":"AAIA;;2DAE2D;AAC3D,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;uCAEuC;AACvC,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;CACtC;AAED;yEACyE;AACzE,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;CACtC;AAED,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,gFAAgF;AAChF,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAM3C;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,SAAS,EAAG,WAAW,CAAU;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;gBAE/B,QAAQ,EAAE,uBAAuB;CAgB9C;AAED;2BAC2B;AAC3B,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C"}

package/dist/http/preflight.d.ts

@@ -0,0 +1,7 @@
+import type { CliConfig } from "../config.js";
+/**
+ * Run the no-side-effect bot endpoint governed by the same floor as mutations.
+ * The injected fetcher is passed as a bare callable through `apiRaw`.
+ */
+export declare function preflightMinimumCliVersion(config: CliConfig, fetcher?: typeof fetch): Promise<void>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/http/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/http/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9C;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/http/version-headers.d.ts

@@ -0,0 +1,10 @@
+/** Stable header used by Launchpad services to observe the real CLI version. */
+export declare const CLI_VERSION_HEADER = "x-launchpad-cli-version";
+/**
+ * Add the real CLI version to a Launchpad-controlled HTTP request.
+ *
+ * Caller-provided casing variants are removed so neither the version header
+ * nor the user-agent can be spoofed accidentally by a command-specific map.
+ */
+export declare function cliVersionHeaders(headers?: Readonly<Record<string, string>>): Record<string, string>;
+//# sourceMappingURL=version-headers.d.ts.map

package/dist/http/version-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-headers.d.ts","sourceRoot":"","sources":["../../src/http/version-headers.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,GAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.53.0";
+export declare const CLI_VERSION = "0.54.1";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.53.0",
+  "version": "0.54.1",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
@@ -26,6 +26,9 @@
     "directory": "packages/launchpad-cli"
   },
   "homepage": "https://github.com/M-KOPA/launchpad-platform/tree/main/packages/launchpad-cli#readme",
+  "bugs": {
+    "url": "https://github.com/M-KOPA/launchpad-platform/issues"
+  },
   "license": "UNLICENSED",
   "dependencies": {
     "esbuild": "0.28.1",

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.53.0
+version: 0.54.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -378,4 +378,4 @@ CI.
 
 ## Version
 
-This skill ships in launchpad-cli v0.53.0+.
+This skill ships in launchpad-cli v0.54.0+.