@m-kopa/launchpad-cli 0.54.0 → 0.55.0

package/dist/cli.js

@@ -19,18 +19,20 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.54.0";
+var CLI_VERSION = "0.55.0";
 
 // src/config.ts
 import * as os from "node:os";
 import * as path from "node:path";
 var DEFAULT_BOT_URL = "https://launchpad-portal-bot.mkopa-launchpad.workers.dev";
 var DEFAULT_AUTH_GATEWAY_URL = "https://auth.launchpad.m-kopa.us";
+var DEFAULT_STATUS_PAGE_HOST = "status.launchpad.m-kopa.us";
 function loadConfig(env = process.env) {
   const rawBotUrl = env.LAUNCHPAD_BOT_URL ?? DEFAULT_BOT_URL;
   const botUrl = rawBotUrl.replace(/\/+$/, "");
   const rawGatewayUrl = env.LAUNCHPAD_AUTH_GATEWAY_URL ?? DEFAULT_AUTH_GATEWAY_URL;
   const authGatewayUrl = rawGatewayUrl.replace(/\/+$/, "");
+  const statusPageHost = (env.LAUNCHPAD_STATUS_PAGE_HOST ?? DEFAULT_STATUS_PAGE_HOST).trim().toLowerCase();
   const authLegacy = env.LAUNCHPAD_AUTH_LEGACY === "1";
   const sessionPath = env.LAUNCHPAD_SESSION_PATH ?? path.join(os.homedir(), ".launchpad", "session.json");
   const cacheDir = env.LAUNCHPAD_CACHE_DIR ?? path.join(os.homedir(), ".launchpad", "cache");
@@ -40,6 +42,7 @@ function loadConfig(env = process.env) {
   return {
     botUrl,
     authGatewayUrl,
+    statusPageHost,
     authLegacy,
     sessionPath,
     cacheDir,
@@ -1867,7 +1870,7 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
@@ -2657,6 +2660,7 @@ var ManifestSchema = z.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z.boolean().optional(),
+  origin: z.enum(["pages", "dispatch"]).optional(),
   catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional(),
   sensitive: z.boolean().optional()
 }).strict().superRefine((m, ctx) => {
@@ -3047,7 +3051,9 @@ var PLATFORM_SEEDED_GITHUB_PATHS = new Set([
   ".github/scripts/parse-tsc.mjs",
   ".github/scripts/parse-vitest.mjs",
   ".github/scripts/parse-gitleaks.mjs",
-  ".github/scripts/parse-bun-audit.mjs"
+  ".github/scripts/parse-bun-audit.mjs",
+  ".github/scripts/parse-html-validate.mjs",
+  ".github/scripts/parse-hadolint.mjs"
 ]);
 function checkDenyList(path7) {
   const segments = path7.split("/");
@@ -3290,6 +3296,7 @@ var SpecSchema = z2.object({
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
   confine_origin: z2.boolean().optional(),
+  origin: z2.enum(["pages", "dispatch"]).optional(),
   sensitive: z2.boolean().optional(),
   catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
   env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
@@ -3335,6 +3342,43 @@ var SpecSchema = z2.object({
       });
     }
   }
+  if (s.origin === "dispatch") {
+    if (isContainer) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["origin"],
+        message: "origin: dispatch is not available for container apps — they run on the container runtime (ADR 0015/0016), not in a Workers dispatch namespace."
+      });
+    }
+    if ((s.auth ?? "access") !== "gateway") {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["origin"],
+        message: "origin: dispatch requires an explicit auth: gateway (auth defaults to 'access' when omitted). A dispatch-namespace Worker has no public hostname for Cloudflare Access to gate, so the gateway must be the sole gate."
+      });
+    }
+    if (s.confine_origin !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["confine_origin"],
+        message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
+      });
+    }
+    if (s.env_vars !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["env_vars"],
+        message: "env_vars are not yet supported with origin: dispatch — a dispatch workspace has no Pages module to apply them, and accepting them here would silently drop them. Worker-level vars land with the v2 deploy path."
+      });
+    }
+    if (s.build !== undefined) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["build"],
+        message: "build is not yet supported with origin: dispatch — a dispatch workspace has no Pages module to carry it, and the v2 deploy path that will consume it is not shipped yet. Accepting it here would silently drop it."
+      });
+    }
+  }
   if (!isContainer && s.containers !== undefined) {
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
@@ -3428,6 +3472,19 @@ var ManifestV2Schema = z2.object({
   spec: SpecSchema,
   status: StatusSchema.optional()
 }).strict();
+function parseManifestV2(input) {
+  const result = ManifestV2Schema.safeParse(input);
+  if (result.success) {
+    return { kind: "ok", manifest: result.data };
+  }
+  return {
+    kind: "schema-error",
+    issues: result.error.issues.map((issue) => ({
+      path: issue.path.map(String).join(".") || "(root)",
+      message: issue.message
+    }))
+  };
+}
 // ../launchpad-engine/dist/secrets-audit.js
 function auditSecretPresence(bindings, surfaces) {
   const byId = new Map(surfaces.map((s) => [s.id, s]));
@@ -3547,298 +3604,569 @@ function deriveResources(m) {
   }
   return items;
 }
-// ../launchpad-engine/dist/wrangler.js
-var DEFAULT_COMPATIBILITY_DATE = "2026-05-01";
-var DEFAULT_COMPATIBILITY_FLAGS = ["nodejs_compat"];
-function generateWranglerToml(manifest) {
-  if (manifest.deployment.type !== "container") {
+// ../launchpad-engine/dist/container-runtime-capability.js
+var MAX_PATH_BYTES = 256;
+var MAX_ENV_NAMES = 64;
+var MAX_ENV_NAME_BYTES = 64;
+var CONTAINER_NAME = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+var ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
+var IMAGE_SEGMENT = /^[A-Za-z0-9._-]+$/;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
+var RESERVED_ENV_PREFIXES = ["LAUNCHPAD_", "CF_ACCESS_", "CLOUDFLARE_"];
+var RESERVED_ENV_NAMES = new Set([
+  "BINDINGS_PROXY_SECRET",
+  "BINDINGS_PROXY_URL"
+]);
+function validateDeploymentCapability(manifest) {
+  const view = deploymentView(manifest);
+  if (view.type !== "container") {
     return {
-      kind: "not-applicable",
-      reason: `deployment.type '${manifest.deployment.type}' does not use wrangler.toml`
+      kind: "supported",
+      manifestValid: true,
+      runtimeSupported: true,
+      runtime: "pages"
     };
   }
-  const containers = manifest.containers ?? [];
-  if (containers.length === 0) {
+  if (view.containers.length !== 1) {
+    return unsupported("unsupported_container_topology", "containers", `the container runtime supports exactly one container; found ${view.containers.length}`);
+  }
+  const container = view.containers[0];
+  if (byteLength(container.name) > 32 || container.name.length < 2 || !CONTAINER_NAME.test(container.name)) {
+    return unsupported("invalid_container_name", "containers.0.name", "container name must be a 2-32 character lowercase slug");
+  }
+  if (container.port < 1024 || container.port > 65535) {
+    return unsupported("unsupported_container_port", "containers.0.port", "container port must be between 1024 and 65535");
+  }
+  if (!validImagePath(container.image)) {
+    return unsupported("invalid_container_image", "containers.0.image", "container image must be a contained repository-relative Dockerfile path beginning ./");
+  }
+  if (!validHealthcheck(container.healthcheck)) {
+    return unsupported("invalid_container_healthcheck", "containers.0.healthcheck", "container healthcheck must be a simple absolute path without traversal, query, or fragment");
+  }
+  const environmentNames = container.env ?? [];
+  if (environmentNames.length > MAX_ENV_NAMES) {
+    return unsupported("too_many_container_environment_names", "containers.0.env", `container env may contain at most ${MAX_ENV_NAMES} names`);
+  }
+  const seen = new Set;
+  const bindingName = containerBindingName(container.name);
+  for (let index = 0;index < environmentNames.length; index += 1) {
+    const name = environmentNames[index];
+    const path7 = `containers.0.env.${index}`;
+    if (byteLength(name) > MAX_ENV_NAME_BYTES || !ENV_NAME.test(name)) {
+      return unsupported("invalid_container_environment_name", path7, "container environment names must be at most 64 bytes and use UPPER_SNAKE_CASE");
+    }
+    if (seen.has(name)) {
+      return unsupported("duplicate_container_environment_name", path7, `container environment name '${name}' is duplicated`);
+    }
+    seen.add(name);
+    if (RESERVED_ENV_NAMES.has(name) || RESERVED_ENV_PREFIXES.some((prefix) => name.startsWith(prefix)) || name === bindingName) {
+      return unsupported("reserved_container_environment_name", path7, `container environment name '${name}' is owned by the Launchpad runtime`);
+    }
+  }
+  return {
+    kind: "supported",
+    manifestValid: true,
+    runtimeSupported: true,
+    runtime: "container",
+    capability: {
+      appName: view.appName,
+      apiVersion: manifest.apiVersion,
+      container,
+      className: containerClassName(view.appName),
+      bindingName,
+      dockerfilePathFromContainerDirectory: `../${container.image.slice(2)}`,
+      environmentNames
+    }
+  };
+}
+function containerClassName(containerName) {
+  return `AppContainer${containerName.split("-").map(capitalise).join("")}`;
+}
+function containerBindingName(containerName) {
+  return `APP_CONTAINER_${containerName.split("-").map((part) => part.toUpperCase()).join("_")}`;
+}
+function deploymentView(manifest) {
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2") {
     return {
-      kind: "ok",
-      content: emit(manifest, []),
-      warnings: ["container manifest has no containers[] — emitting empty TOML"]
+      type: manifest.spec.appType,
+      appName: manifest.metadata.slug,
+      containers: manifest.spec.containers ?? []
     };
   }
-  return { kind: "ok", content: emit(manifest, containers), warnings: [] };
+  return {
+    type: manifest.deployment.type,
+    appName: manifest.metadata.name,
+    containers: manifest.containers ?? []
+  };
 }
-function emit(manifest, containers) {
-  const lines = [];
-  const header = `# Auto-generated by @krsecurity/launchpad-engine. Do not edit by hand.
-# Source: launchpad.yaml (apiVersion: ${manifest.apiVersion})
-# App:    ${manifest.metadata.name}
-#
-# Regenerate with \`launchpad generate\` (\`launchpad deploy\` also
-# re-emits before applying). Manual edits are overwritten on the
-# next regeneration. Manifest is the source of truth — change
-# ${manifest.metadata.name}/launchpad.yaml instead.`;
-  lines.push(header);
-  lines.push("");
-  lines.push(`name = "${escapeTomlString(manifest.metadata.name)}"`);
-  lines.push(`main = "worker/index.ts"`);
-  lines.push(`compatibility_date = "${DEFAULT_COMPATIBILITY_DATE}"`);
-  lines.push(`compatibility_flags = [${DEFAULT_COMPATIBILITY_FLAGS.map((f) => `"${escapeTomlString(f)}"`).join(", ")}]`);
-  lines.push("");
-  lines.push("# Workers Logs (PATTERNS.md: non-optional for container apps).");
-  lines.push("[observability]");
-  lines.push("enabled = true");
-  lines.push("head_sampling_rate = 1.0");
-  lines.push("");
-  lines.push("# Platform-managed runtime config. Populated by the deploy");
-  lines.push("# workflow via `wrangler deploy --var KEY:VALUE`. Secrets");
-  lines.push("# (declared in launchpad.yaml secrets.bindings[]) go through");
-  lines.push("# `wrangler secret put` and are NOT here.");
-  lines.push("[vars]");
-  lines.push(`CF_ACCESS_AUD = ""`);
-  lines.push(`CF_ACCESS_TEAM_DOMAIN = ""`);
-  lines.push("");
-  for (const c of containers) {
-    const className = containerClassName(c.name);
-    const maxInstances = c.max_instances ?? 1;
-    lines.push("[[containers]]");
-    lines.push(`class_name    = "${className}"`);
-    lines.push(`image         = "${escapeTomlString(c.image)}"`);
-    lines.push(`max_instances = ${maxInstances}`);
-    lines.push("");
+function validImagePath(path7) {
+  if (byteLength(path7) > MAX_PATH_BYTES || !path7.startsWith("./") || path7.includes("\\") || CONTROL_CHARACTER.test(path7)) {
+    return false;
   }
-  for (const c of containers) {
-    const className = containerClassName(c.name);
-    const bindingName = containerBindingName(c.name);
-    lines.push("[[durable_objects.bindings]]");
-    lines.push(`name       = "${bindingName}"`);
-    lines.push(`class_name = "${className}"`);
-    lines.push("");
+  const segments = path7.slice(2).split("/");
+  return segments.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && IMAGE_SEGMENT.test(segment));
+}
+function validHealthcheck(path7) {
+  if (byteLength(path7) === 0 || byteLength(path7) > MAX_PATH_BYTES || !path7.startsWith("/") || path7.includes("\\") || path7.includes("?") || path7.includes("#") || CONTROL_CHARACTER.test(path7)) {
+    return false;
   }
-  lines.push("# Fresh-deploy migration. Container-enabled DOs MUST be");
-  lines.push("# SQLite-backed (ADR 0015 #4/#5 — non-sqlite fails [code: 10074]).");
-  lines.push("# Re-shaping containers on a live app needs a v2 migration");
-  lines.push("# block; the engine's TF-state-aware migration generator lands");
-  lines.push("# with Scope 8 drift detection.");
-  lines.push("[[migrations]]");
-  lines.push(`tag                = "v1"`);
-  const classNames = containers.map((c) => `"${containerClassName(c.name)}"`);
-  lines.push(`new_sqlite_classes = [${classNames.join(", ")}]`);
-  lines.push("");
+  const segments = path7.slice(1).split("/");
+  return segments.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+function byteLength(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function capitalise(value) {
+  if (value.length === 0)
+    return value;
+  return value[0].toUpperCase() + value.slice(1);
+}
+function unsupported(reason, path7, message) {
+  return {
+    kind: "unsupported",
+    manifestValid: true,
+    runtimeSupported: false,
+    reason,
+    path: path7,
+    message
+  };
+}
+// ../launchpad-engine/dist/container-worker.js
+function generateContainerWorker(manifest) {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported") {
+    return {
+      kind: "unsupported",
+      reason: result.reason,
+      message: result.message
+    };
+  }
+  if (result.runtime !== "container") {
+    return {
+      kind: "not-applicable",
+      reason: "pages runtimes do not use the generated container Worker"
+    };
+  }
+  return { kind: "ok", content: emit(result.capability) };
+}
+function emit(capability) {
+  const app = JSON.stringify(capability.appName);
+  const className = capability.className;
+  const bindingName = capability.bindingName;
+  const environmentFields = capability.environmentNames.map((name) => `  ${name}: string;`);
+  const environmentValues = capability.environmentNames.map((name) => `    ${name}: this.env.${name} ?? "",`);
+  const lines = [
+    "/**",
+    " * Auto-generated by @m-kopa/launchpad-engine.",
+    " * Source: launchpad.yaml. Do not edit by hand.",
+    " */",
+    'import { Container } from "@cloudflare/containers";',
+    "import {",
+    "  AccessJwtVerificationError,",
+    "  createJwksCache,",
+    "  parseAccessJwtFromHeaders,",
+    "  verifyAccessJwt,",
+    "  type User,",
+    '} from "@m-kopa/platform-auth";',
+    "",
+    "type Env = {",
+    `  ${bindingName}: DurableObjectNamespace<${className}>;`,
+    "  BINDINGS_PROXY_SECRET: string;",
+    "  CF_ACCESS_AUD: string;",
+    "  CF_ACCESS_TEAM_DOMAIN: string;",
+    "  LAUNCHPAD_DEPLOYMENT_SHA: string;",
+    ...environmentFields,
+    "};",
+    "",
+    `export class ${className} extends Container<Env> {`,
+    `  defaultPort = ${capability.container.port};`,
+    '  sleepAfter = "5m";',
+    ...environmentValues.length === 0 ? [] : ["", "  envVars = {", ...environmentValues, "  };"],
+    "}",
+    "",
+    "let jwksCache: ReturnType<typeof createJwksCache> | null = null;",
+    "",
+    "function jwks(env: Env): ReturnType<typeof createJwksCache> {",
+    "  if (jwksCache === null) {",
+    "    jwksCache = createJwksCache(",
+    "      `https://${env.CF_ACCESS_TEAM_DOMAIN}/cdn-cgi/access/certs`,",
+    "    );",
+    "  }",
+    "  return jwksCache;",
+    "}",
+    "",
+    "function unauthenticated(code: string): Response {",
+    "  return Response.json(",
+    '    { error: "unauthenticated", code },',
+    '    { status: 401, headers: { "cache-control": "no-store" } },',
+    "  );",
+    "}",
+    "",
+    "async function secretsEqual(left: string, right: string): Promise<boolean> {",
+    "  const encoder = new TextEncoder();",
+    "  const [leftDigest, rightDigest] = await Promise.all([",
+    '    crypto.subtle.digest("SHA-256", encoder.encode(left)),',
+    '    crypto.subtle.digest("SHA-256", encoder.encode(right)),',
+    "  ]);",
+    "  const leftBytes = new Uint8Array(leftDigest);",
+    "  const rightBytes = new Uint8Array(rightDigest);",
+    "  let difference = 0;",
+    "  for (let index = 0; index < leftBytes.length; index += 1) {",
+    "    difference |= leftBytes[index]! ^ rightBytes[index]!;",
+    "  }",
+    "  return difference === 0;",
+    "}",
+    "",
+    "async function authenticate(request: Request, env: Env): Promise<User | Response> {",
+    "  if (!env.CF_ACCESS_TEAM_DOMAIN || !env.CF_ACCESS_AUD) {",
+    '    return unauthenticated("auth_unconfigured");',
+    "  }",
+    "  const token = parseAccessJwtFromHeaders(request.headers);",
+    "  if (token === null) {",
+    '    return unauthenticated("access_jwt_missing");',
+    "  }",
+    "  try {",
+    "    return await verifyAccessJwt(token, {",
+    "      teamDomain: `https://${env.CF_ACCESS_TEAM_DOMAIN}`,",
+    "      audience: env.CF_ACCESS_AUD,",
+    "      jwks: jwks(env),",
+    "      clockTolerance: 30,",
+    "    });",
+    "  } catch (error) {",
+    "    if (error instanceof AccessJwtVerificationError) {",
+    "      return unauthenticated(error.code);",
+    "    }",
+    '    console.error(JSON.stringify({ event: "container_runtime_error", kind: "access_jwt_verification_failed" }));',
+    '    return unauthenticated("access_jwt_verification_failed");',
+    "  }",
+    "}",
+    "",
+    "function forwardedRequest(",
+    "  request: Request,",
+    "  user: User,",
+    "  env: Env,",
+    "  requestId: string,",
+    "): Request {",
+    "  const url = new URL(request.url);",
+    "  const headers = new Headers(request.headers);",
+    "  for (const name of Array.from(headers.keys())) {",
+    "    const lower = name.toLowerCase();",
+    "    if (",
+    '      lower.startsWith("cf-access-") ||',
+    '      lower.startsWith("x-user-") ||',
+    '      lower.startsWith("x-bindings-proxy-") ||',
+    '      lower === "x-request-id"',
+    "    ) {",
+    "      headers.delete(name);",
+    "    }",
+    "  }",
+    '  headers.set("X-User-Sub", user.sub);',
+    '  headers.set("X-User-Email", user.preferredUsername);',
+    "  if (user.groups.length > 0) {",
+    '    headers.set("X-User-Groups", user.groups.join(","));',
+    "  }",
+    '  headers.set("X-Request-ID", requestId);',
+    '  headers.set("X-Bindings-Proxy-Secret", env.BINDINGS_PROXY_SECRET);',
+    '  headers.set("X-Bindings-Proxy-Url", `${url.origin}/__platform/bindings`);',
+    "  return new Request(url.toString(), {",
+    "    method: request.method,",
+    "    headers,",
+    '    body: request.method === "GET" || request.method === "HEAD" ? undefined : request.body,',
+    "    redirect: request.redirect,",
+    "  });",
+    "}",
+    "",
+    "function runtimeEvent(",
+    "  env: Env,",
+    "  requestId: string,",
+    "  status: number,",
+    "  kind: string,",
+    "): void {",
+    "  console.log(JSON.stringify({",
+    '    event: "container_runtime_dispatch",',
+    `    slug: ${app},`,
+    "    deployment_sha: env.LAUNCHPAD_DEPLOYMENT_SHA,",
+    "    request_id: requestId,",
+    `    class_name: ${JSON.stringify(className)},`,
+    `    binding_name: ${JSON.stringify(bindingName)},`,
+    "    status,",
+    "    kind,",
+    "  }));",
+    "}",
+    "",
+    "export default {",
+    "  async fetch(request: Request, env: Env): Promise<Response> {",
+    "    const url = new URL(request.url);",
+    "    const requestId = crypto.randomUUID();",
+    '    if (request.method === "GET" && url.pathname === "/health") {',
+    '      const response = Response.json({ ok: true, role: "worker" });',
+    '      runtimeEvent(env, requestId, response.status, "worker_health");',
+    "      return response;",
+    "    }",
+    '    if (url.pathname === "/__platform/bindings" || url.pathname.startsWith("/__platform/bindings/")) {',
+    '      const presented = request.headers.get("x-bindings-proxy-secret");',
+    "      if (!env.BINDINGS_PROXY_SECRET || !presented || !(await secretsEqual(presented, env.BINDINGS_PROXY_SECRET))) {",
+    '        const response = Response.json({ error: "forbidden" }, { status: 403 });',
+    '        runtimeEvent(env, requestId, response.status, "bindings_forbidden");',
+    "        return response;",
+    "      }",
+    '      const response = Response.json({ error: "unknown_binding_endpoint" }, { status: 404 });',
+    '      runtimeEvent(env, requestId, response.status, "bindings_unknown");',
+    "      return response;",
+    "    }",
+    "    const identity = await authenticate(request, env);",
+    "    if (identity instanceof Response) {",
+    '      runtimeEvent(env, requestId, identity.status, "authentication_failed");',
+    "      return identity;",
+    "    }",
+    `    const id = env.${bindingName}.idFromName("singleton");`,
+    `    const response = await env.${bindingName}.get(id).fetch(`,
+    "      forwardedRequest(request, identity, env, requestId),",
+    "    );",
+    '    runtimeEvent(env, requestId, response.status, "container_response");',
+    "    return response;",
+    "  },",
+    "};",
+    ""
+  ];
   return lines.join(`
 `);
 }
-function containerClassName(manifestName) {
-  return "AppContainer" + manifestName.split("-").map(capitalise).join("");
-}
-function containerBindingName(manifestName) {
-  return "APP_CONTAINER_" + manifestName.split("-").map((p) => p.toUpperCase()).join("_");
+// ../launchpad-engine/dist/wrangler.js
+var DEFAULT_COMPATIBILITY_DATE = "2026-05-01";
+var DEFAULT_COMPATIBILITY_FLAGS = ["nodejs_compat"];
+function generateWranglerToml(manifest) {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported") {
+    return {
+      kind: "unsupported",
+      reason: result.reason,
+      message: result.message
+    };
+  }
+  if (result.runtime !== "container") {
+    return {
+      kind: "not-applicable",
+      reason: "pages runtimes do not use container/wrangler.toml"
+    };
+  }
+  return { kind: "ok", content: emit2(result.capability), warnings: [] };
 }
-function capitalise(s) {
-  if (s.length === 0)
-    return s;
-  return s[0].toUpperCase() + s.slice(1);
+function emit2(capability) {
+  const maxInstances = capability.container.max_instances ?? 1;
+  return [
+    "# Auto-generated by @m-kopa/launchpad-engine. Do not edit by hand.",
+    `# Source: launchpad.yaml (apiVersion: ${capability.apiVersion})`,
+    `# App:    ${capability.appName}`,
+    "",
+    `name = "${escapeTomlString(capability.appName)}"`,
+    'main = "worker/index.ts"',
+    `compatibility_date = "${DEFAULT_COMPATIBILITY_DATE}"`,
+    `compatibility_flags = [${DEFAULT_COMPATIBILITY_FLAGS.map((flag) => `"${flag}"`).join(", ")}]`,
+    "",
+    "[observability]",
+    "enabled = true",
+    "head_sampling_rate = 1.0",
+    "",
+    "[vars]",
+    'CF_ACCESS_AUD = ""',
+    'CF_ACCESS_TEAM_DOMAIN = ""',
+    'LAUNCHPAD_DEPLOYMENT_SHA = ""',
+    "",
+    "[[containers]]",
+    `class_name = "${capability.className}"`,
+    `image = "${escapeTomlString(capability.dockerfilePathFromContainerDirectory)}"`,
+    `max_instances = ${maxInstances}`,
+    "",
+    "[[durable_objects.bindings]]",
+    `name = "${capability.bindingName}"`,
+    `class_name = "${capability.className}"`,
+    "",
+    "[[migrations]]",
+    'tag = "v1"',
+    `new_sqlite_classes = ["${capability.className}"]`,
+    ""
+  ].join(`
+`);
 }
-function escapeTomlString(s) {
-  return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+function escapeTomlString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
 }
 // ../launchpad-engine/dist/github-workflow.js
-var DEFAULT_WORKERS_SUBDOMAIN = "mkopa-launchpad.workers.dev";
-var DEFAULT_BUN_VERSION = "1.3.4";
+var DEFAULT_NODE_VERSION = "22";
 var ACTIONS_CHECKOUT_SHA = "de0fac2e4500dabe0009e67214ff5f5447ce83dd";
-var SETUP_BUN_SHA = "0c5077e51419868618aeaa5fe8019c62421857d6";
+var ACTIONS_SETUP_NODE_SHA = "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e";
 function generateGithubDeployWorkflow(manifest) {
-  if (manifest.deployment.type !== "container") {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported") {
     return {
-      kind: "not-applicable",
-      reason: `deployment.type '${manifest.deployment.type}' has no engine-generated deploy workflow yet`
+      kind: "unsupported",
+      reason: result.reason,
+      message: result.message
     };
   }
-  const bindings = manifest.secrets?.bindings ?? [];
-  const warnings = [];
-  if ((manifest.containers ?? []).length === 0) {
-    warnings.push("container manifest has no containers[] — workflow will deploy an empty Worker");
+  if (result.runtime !== "container") {
+    return {
+      kind: "not-applicable",
+      reason: "pages runtimes do not use the container deploy workflow"
+    };
   }
-  return {
-    kind: "ok",
-    content: emit2(manifest, bindings),
-    warnings
-  };
+  return { kind: "ok", content: emit3(result.capability), warnings: [] };
 }
-function emit2(manifest, bindings) {
-  const appName = manifest.metadata.name;
-  const lines = [];
-  lines.push(`# Auto-generated by @krsecurity/launchpad-engine. Do not edit by hand.`);
-  lines.push(`# Source: launchpad.yaml (apiVersion: ${manifest.apiVersion})`);
-  lines.push(`# App:    ${appName}`);
-  lines.push(`#`);
-  lines.push(`# Regenerate with \`launchpad generate\` (\`launchpad deploy\` also`);
-  lines.push(`# re-emits before applying). Manual edits are overwritten on the`);
-  lines.push(`# next regeneration. Manifest is the source of truth — change`);
-  lines.push(`# ${appName}/launchpad.yaml instead.`);
-  lines.push("");
-  lines.push(`name: deploy`);
-  lines.push("");
-  lines.push(`on:`);
-  lines.push(`  push:`);
-  lines.push(`    branches:`);
-  lines.push(`      - main`);
-  lines.push(`  workflow_dispatch:`);
-  lines.push("");
-  lines.push(`permissions:`);
-  lines.push(`  contents: read`);
-  lines.push(`  id-token: write`);
-  lines.push(`  packages: read`);
-  lines.push("");
-  lines.push(`concurrency:`);
-  lines.push(`  group: deploy-\${{ github.workflow }}-\${{ vars.LAUNCHPAD_APP_RUNTIME || 'production' }}`);
-  lines.push(`  cancel-in-progress: false`);
-  lines.push("");
-  lines.push(`defaults:`);
-  lines.push(`  run:`);
-  lines.push(`    # Container-shape apps keep wrangler.toml + Worker source +`);
-  lines.push(`    # per-container Dockerfiles under container/. Engine convention.`);
-  lines.push(`    working-directory: container`);
-  lines.push("");
-  lines.push(`jobs:`);
-  lines.push(`  deploy:`);
-  lines.push(`    name: deploy`);
-  lines.push(`    runs-on: ubuntu-latest`);
-  lines.push(`    environment: \${{ vars.LAUNCHPAD_APP_RUNTIME || 'production' }}`);
-  lines.push(`    steps:`);
-  lines.push(`      - uses: actions/checkout@${ACTIONS_CHECKOUT_SHA}  # v6.0.2`);
-  lines.push("");
-  lines.push(`      - uses: oven-sh/setup-bun@${SETUP_BUN_SHA}  # v2`);
-  lines.push(`        with:`);
-  lines.push(`          bun-version: "${DEFAULT_BUN_VERSION}"`);
-  lines.push("");
-  lines.push(`      - name: Install dependencies`);
-  lines.push(`        env:`);
-  lines.push(`          NODE_AUTH_TOKEN: \${{ secrets.NODE_AUTH_TOKEN }}`);
-  lines.push(`        run: bun install --ignore-scripts`);
-  lines.push("");
-  lines.push(`      - name: Deploy Worker + container images`);
-  lines.push(`        # --var KEY:VALUE overrides the placeholder [vars] block in`);
-  lines.push(`        # wrangler.toml. Missing either CF_ACCESS_* var trips the`);
-  lines.push(`        # Worker's auth_unconfigured fail-closed branch on every`);
-  lines.push(`        # request. Multi-container deploys build + push every`);
-  lines.push(`        # [[containers]] block; total time scales linearly.`);
-  lines.push(`        env:`);
-  lines.push(`          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}`);
-  lines.push(`          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}`);
-  lines.push(`        run: |`);
-  lines.push(`          bunx wrangler deploy \\`);
-  lines.push(`            --var "CF_ACCESS_AUD:\${{ vars.CF_ACCESS_AUD }}" \\`);
-  lines.push(`            --var "CF_ACCESS_TEAM_DOMAIN:\${{ vars.CF_ACCESS_TEAM_DOMAIN }}"`);
-  lines.push("");
-  for (const b of bindings) {
-    if (b.source !== "env-file")
-      continue;
-    emitSecretStep(lines, b);
-  }
-  const workerUrl = `https://${appName}.${DEFAULT_WORKERS_SUBDOMAIN}`;
-  lines.push(`      - name: Smoke probe — Worker liveness (via .well-known bypass)`);
-  lines.push(`        # In workers_dev_only mode CF Access intercepts every path`);
-  lines.push(`        # (including /health) with HTTP 302 to the IdP. The only`);
-  lines.push(`        # path that reaches the Worker without an Access JWT is`);
-  lines.push(`        # /.well-known/openid-configuration, gated by a separate`);
-  lines.push(`        # Bypass-policy Access app.`);
-  lines.push(`        #`);
-  lines.push(`        # Outcomes:`);
-  lines.push(`        #   302 → bypass policy missing or misconfigured.`);
-  lines.push(`        #   5xx → Worker is down (deploy bug).`);
-  lines.push(`        #   401 + auth_unconfigured → CF_ACCESS_* vars didn't wire in.`);
-  lines.push(`        #   401 + access_jwt_missing (any other 4xx) → HAPPY PATH.`);
-  lines.push(`        run: |`);
-  lines.push(`          set -euo pipefail`);
-  lines.push(`          URL="${workerUrl}/.well-known/openid-configuration"`);
-  lines.push(`          for i in 1 2 3 4 5; do`);
-  lines.push(`            body_file="$(mktemp)"`);
-  lines.push(`            code=$(curl -sS -o "$body_file" -w "%{http_code}" "$URL" || echo "000")`);
-  lines.push(`            body=$(cat "$body_file")`);
-  lines.push(`            rm -f "$body_file"`);
-  lines.push("");
-  lines.push(`            if [ "$code" = "302" ]; then`);
-  lines.push(`              echo "liveness-probe: bypass policy missing — Access redirected /.well-known/. Attempt $i."`);
-  lines.push(`              sleep 5`);
-  lines.push(`              continue`);
-  lines.push(`            fi`);
-  lines.push(`            if [ "\${code:0:1}" = "5" ] || [ "$code" = "000" ]; then`);
-  lines.push(`              echo "liveness-probe: Worker down (got $code). Attempt $i."`);
-  lines.push(`              sleep 5`);
-  lines.push(`              continue`);
-  lines.push(`            fi`);
-  lines.push(`            if printf '%s' "$body" | grep -q "auth_unconfigured"; then`);
-  lines.push(`              echo "liveness-probe FAIL: Worker is up but in fail-closed misconfig branch — CF_ACCESS_AUD / CF_ACCESS_TEAM_DOMAIN not wired in." >&2`);
-  lines.push(`              echo "body: $body" >&2`);
-  lines.push(`              exit 1`);
-  lines.push(`            fi`);
-  lines.push(`            echo "liveness-probe ok: Worker reachable (HTTP $code), env wired in (no auth_unconfigured)."`);
-  lines.push(`            exit 0`);
-  lines.push(`          done`);
-  lines.push(`          echo "liveness-probe failed after 5 attempts" >&2`);
-  lines.push(`          curl -sSI "$URL" >&2 || true`);
-  lines.push(`          exit 1`);
-  lines.push("");
-  lines.push(`      - name: Smoke probe — frontend route is auth-gated`);
-  lines.push(`        # 302 or 401 prove unauthenticated traffic is blocked.`);
-  lines.push(`        # HTTP 200 here would mean the SPA bundle is publicly`);
-  lines.push(`        # readable — the regression we're catching.`);
-  lines.push(`        run: |`);
-  lines.push(`          set -euo pipefail`);
-  lines.push(`          URL="${workerUrl}/"`);
-  lines.push(`          code=$(curl -sS -o /dev/null -w "%{http_code}" "$URL")`);
-  lines.push(`          case "$code" in`);
-  lines.push(`            302|401)`);
-  lines.push(`              echo "frontend auth-gate ok: HTTP $code on unauthenticated request to /."`);
-  lines.push(`              ;;`);
-  lines.push(`            *)`);
-  lines.push(`              echo "frontend auth-gate regression: expected 302 or 401 on /, got $code" >&2`);
-  lines.push(`              curl -sSI "$URL" >&2 || true`);
-  lines.push(`              exit 1`);
-  lines.push(`              ;;`);
-  lines.push(`          esac`);
-  lines.push("");
-  lines.push(`      - name: Smoke probe — backend route is auth-gated`);
-  lines.push(`        # Same logic as the frontend probe; confirms /api/* surface`);
-  lines.push(`        # is gated. A 200 here would be the worse regression:`);
-  lines.push(`        # backend data leaked unauthenticated.`);
-  lines.push(`        run: |`);
-  lines.push(`          set -euo pipefail`);
-  lines.push(`          URL="${workerUrl}/api/health"`);
-  lines.push(`          code=$(curl -sS -o /dev/null -w "%{http_code}" "$URL")`);
-  lines.push(`          case "$code" in`);
-  lines.push(`            302|401)`);
-  lines.push(`              echo "backend auth-gate ok: HTTP $code on unauthenticated request to /api/health."`);
-  lines.push(`              ;;`);
-  lines.push(`            *)`);
-  lines.push(`              echo "backend auth-gate regression: expected 302 or 401 on /api/health, got $code" >&2`);
-  lines.push(`              curl -sSI "$URL" >&2 || true`);
-  lines.push(`              exit 1`);
-  lines.push(`              ;;`);
-  lines.push(`          esac`);
-  lines.push("");
+function emit3(capability) {
+  const lines = [
+    "# Auto-generated by @m-kopa/launchpad-engine. Do not edit by hand.",
+    `# Source: launchpad.yaml (apiVersion: ${capability.apiVersion})`,
+    `# App:    ${capability.appName}`,
+    "",
+    "name: deploy",
+    "",
+    "on:",
+    "  push:",
+    "    branches:",
+    "      - main",
+    "  workflow_dispatch:",
+    "",
+    "permissions:",
+    "  contents: read",
+    "",
+    "concurrency:",
+    "  group: deploy-${{ github.workflow }}-${{ github.sha }}",
+    "  cancel-in-progress: false",
+    "",
+    "jobs:",
+    "  authorize:",
+    "    name: authorize exact run attempt",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    `      - uses: actions/checkout@${ACTIONS_CHECKOUT_SHA}  # v6.0.2`,
+    "        with:",
+    "          persist-credentials: false",
+    "",
+    "      - name: Verify protected runtime authorization",
+    "        env:",
+    "          GH_TOKEN: ${{ github.token }}",
+    "        run: |",
+    "          set -euo pipefail",
+    "          record=$(mktemp)",
+    `          trap 'rm -f "$record"' EXIT`,
+    '          api="${{ github.api_url }}/repos/${{ github.repository }}/contents/.launchpad/runtime-control/${GITHUB_SHA}.json?ref=launchpad-runtime-control"',
+    "          for attempt in $(seq 1 60); do",
+    "            if curl --fail --silent --show-error \\",
+    '              -H "Authorization: Bearer ${GH_TOKEN}" \\',
+    '              -H "Accept: application/vnd.github.raw+json" \\',
+    '              -H "X-GitHub-Api-Version: 2022-11-28" \\',
+    '              "$api" > "$record"; then',
+    "              break",
+    "            fi",
+    '            if [ "$attempt" -eq 60 ]; then',
+    '              echo "No exact-run authorization was published" >&2',
+    "              exit 1",
+    "            fi",
+    "            sleep 5",
+    "          done",
+    "          jq -e '",
+    '            (.schema == "launchpad-runtime-control/v1") and',
+    '            (.attempt_id | type == "string" and length > 0) and',
+    '            (.lease_digest | test("^[0-9a-f]{64}$")) and',
+    "            (.commit_sha == env.GITHUB_SHA) and",
+    "            (.run_id == env.GITHUB_RUN_ID) and",
+    "            (.run_attempt == env.GITHUB_RUN_ATTEMPT) and",
+    '            (.expires_at_epoch | type == "number" and . > now)',
+    `          ' "$record" >/dev/null`,
+    "          wrangler_sha=$(sha256sum container/wrangler.toml | cut -d' ' -f1)",
+    "          worker_sha=$(sha256sum container/worker/index.ts | cut -d' ' -f1)",
+    "          workflow_sha=$(sha256sum .github/workflows/deploy.yml | cut -d' ' -f1)",
+    "          jq -e \\",
+    '            --arg wrangler "$wrangler_sha" \\',
+    '            --arg worker "$worker_sha" \\',
+    '            --arg workflow "$workflow_sha" \\',
+    `            '.artifact_digests["container/wrangler.toml"] == $wrangler and`,
+    '             .artifact_digests["container/worker/index.ts"] == $worker and',
+    `             .artifact_digests[".github/workflows/deploy.yml"] == $workflow' \\`,
+    '            "$record" >/dev/null',
+    "",
+    "  deploy:",
+    "    name: deploy admitted runtime",
+    "    needs: authorize",
+    "    runs-on: ubuntu-latest",
+    "    environment: ${{ vars.LAUNCHPAD_APP_RUNTIME || 'production' }}",
+    "    steps:",
+    `      - uses: actions/checkout@${ACTIONS_CHECKOUT_SHA}  # v6.0.2`,
+    "        with:",
+    "          persist-credentials: false",
+    "",
+    `      - uses: actions/setup-node@${ACTIONS_SETUP_NODE_SHA}  # v6.4.0`,
+    "        with:",
+    `          node-version: "${DEFAULT_NODE_VERSION}"`,
+    "          cache: npm",
+    "          cache-dependency-path: |",
+    "            container/package-lock.json",
+    "            container/backend/package-lock.json",
+    "",
+    "      - name: Install frozen Worker dependencies",
+    "        working-directory: container",
+    "        run: npm ci --ignore-scripts",
+    "",
+    "      - name: Install frozen workload dependencies",
+    "        working-directory: container/backend",
+    "        run: npm ci --ignore-scripts",
+    "",
+    "      - name: Verify required deployment inputs",
+    "        env:",
+    "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
+    "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
+    "          CF_ACCESS_AUD: ${{ vars.CF_ACCESS_AUD }}",
+    "          CF_ACCESS_TEAM_DOMAIN: ${{ vars.CF_ACCESS_TEAM_DOMAIN }}",
+    "          BINDINGS_PROXY_SECRET: ${{ secrets.BINDINGS_PROXY_SECRET }}",
+    "          CF_ACCESS_AUD: ${{ vars.CF_ACCESS_AUD }}",
+    "          CF_ACCESS_TEAM_DOMAIN: ${{ vars.CF_ACCESS_TEAM_DOMAIN }}",
+    ...capability.environmentNames.map((name) => `          ${name}: \${{ secrets.${name} }}`),
+    "        run: |",
+    "          set -euo pipefail",
+    "          for name in CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID BINDINGS_PROXY_SECRET CF_ACCESS_AUD CF_ACCESS_TEAM_DOMAIN; do",
+    '            if [ -z "${!name:-}" ]; then',
+    '              echo "Required deployment input $name is empty" >&2',
+    "              exit 1",
+    "            fi",
+    "          done",
+    ...capability.environmentNames.flatMap((name) => [
+      `          if [ -z "\${${name}:-}" ]; then`,
+      `            echo "Required container secret ${name} is empty" >&2`,
+      "            exit 1",
+      "          fi"
+    ]),
+    "",
+    "      - name: Deploy Worker and container image",
+    "        working-directory: container",
+    "        env:",
+    "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
+    "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
+    "        run: |",
+    "          npx --no-install wrangler deploy \\",
+    '            --message "launchpad:${GITHUB_SHA}" \\',
+    '            --tag "launchpad-deployment-sha:${GITHUB_SHA}" \\',
+    '            --var "CF_ACCESS_AUD:${CF_ACCESS_AUD}" \\',
+    '            --var "CF_ACCESS_TEAM_DOMAIN:${CF_ACCESS_TEAM_DOMAIN}" \\',
+    '            --var "LAUNCHPAD_DEPLOYMENT_SHA:${GITHUB_SHA}"',
+    "",
+    ...secretSteps(capability)
+  ];
   return lines.join(`
 `);
 }
-function emitSecretStep(lines, binding) {
-  const name = binding.name;
-  const sourceNote = `env-file binding from launchpad.yaml — operator sets via \`launchpad secrets push\` or \`gh secret set\`.`;
-  lines.push(`      - name: Push ${name} to the Worker`);
-  lines.push(`        # ${sourceNote}`);
-  lines.push(`        # Gated on the GH Actions secret existing so the first deploy`);
-  lines.push(`        # on a fresh repo doesn't fail before secrets are provisioned.`);
-  lines.push(`        # Skipping logs a ::warning:: so the gap shows in the deploy log.`);
-  lines.push(`        env:`);
-  lines.push(`          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}`);
-  lines.push(`          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}`);
-  lines.push(`          ${name}: \${{ secrets.${name} }}`);
-  lines.push(`        run: |`);
-  lines.push(`          if [ -z "\${${name}:-}" ]; then`);
-  lines.push(`            echo "::warning::${name} GH Actions secret is unset — Worker will be missing this binding until the secret is provisioned + this workflow is rerun."`);
-  lines.push(`            exit 0`);
-  lines.push(`          fi`);
-  lines.push(`          printf '%s' "$${name}" | bunx wrangler secret put ${name}`);
-  lines.push("");
+function secretSteps(capability) {
+  return ["BINDINGS_PROXY_SECRET", ...capability.environmentNames].flatMap((name) => [
+    `      - name: Push ${name}`,
+    "        working-directory: container",
+    "        env:",
+    "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
+    "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
+    `          ${name}: \${{ secrets.${name} }}`,
+    "        run: |",
+    `          printf '%s' "$${name}" | npx --no-install wrangler secret put ${name}`,
+    ""
+  ]);
 }
 // ../launchpad-engine/dist/per-app-workspace.js
 var CF_ACCOUNT_ID = "c07cb17c9f742e8144c4828b3693ca65";
@@ -4190,6 +4518,21 @@ async function bundleAndDeploy(args) {
 import { readFileSync as readFileSync8, existsSync as existsSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 
+// src/deploy/redact-diagnostic.ts
+var MAX_DIAGNOSTIC_LEN = 600;
+var SECRET_KV = /(["']?)(\b[A-Za-z0-9_-]*(?:secrets?|token|api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|password|passwd|pwd|authorization|auth[_-]?token|bearer|client[_-]?secret|session)\b)\1(\s*[=:]\s*|\s+)(?:"[^"]*"|'[^']*'|\S+)/gi;
+var LONG_TOKEN = /[A-Za-z0-9_\-+/.]{28,}={0,2}/g;
+function redactDiagnostic(text, maxLen = MAX_DIAGNOSTIC_LEN) {
+  if (text === undefined || text === null)
+    return "";
+  let t = text.replace(SECRET_KV, (_match, quote, key, separator) => `${quote}${key}${quote}${separator}***`);
+  t = t.replace(LONG_TOKEN, "***");
+  t = t.trim();
+  if (t.length > maxLen)
+    t = `${t.slice(0, maxLen - 1)}…`;
+  return t;
+}
+
 // src/deploy/deployment-status.ts
 async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
   let raw;
@@ -4218,11 +4561,39 @@ async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
   return {
     slug: typeof raw.slug === "string" ? raw.slug : slug,
     supported: raw.supported,
-    liveDeployment: raw.liveDeployment ?? null,
-    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null,
+    liveDeployment: scrubLiveDeployment(raw.liveDeployment ?? null),
+    lastSuccessfulDeployment: projectLastSuccessful(raw.lastSuccessfulDeployment),
     ...raw.reconciledToLive === true ? { reconciledToLive: true } : {}
   };
 }
+function projectLastSuccessful(value) {
+  if (value === null || typeof value !== "object")
+    return null;
+  const raw = value;
+  if (typeof raw.id !== "string" || typeof raw.createdOn !== "string") {
+    return null;
+  }
+  return {
+    id: raw.id,
+    createdOn: raw.createdOn,
+    url: typeof raw.url === "string" ? raw.url : null
+  };
+}
+function scrubLiveDeployment(deployment) {
+  if (deployment === null)
+    return null;
+  return {
+    ...deployment,
+    ...deployment.commit === undefined ? {} : {
+      commit: {
+        ...deployment.commit,
+        message: redactDiagnostic(deployment.commit.message)
+      }
+    },
+    ...deployment.failedStage === undefined ? {} : { failedStage: redactDiagnostic(deployment.failedStage) },
+    ...deployment.logExcerpt === undefined ? {} : { logExcerpt: redactDiagnostic(deployment.logExcerpt) }
+  };
+}
 
 // src/deploy/commit-match-settle.ts
 var DEFAULT_REGISTRATION_BOUND_MS = 120000;
@@ -4388,21 +4759,6 @@ async function verifyServed(args, deps = { fetch }) {
   };
 }
 
-// src/deploy/redact-diagnostic.ts
-var MAX_DIAGNOSTIC_LEN = 600;
-var SECRET_KV = /\b(secret|secrets?|token|api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|password|passwd|pwd|authorization|auth[_-]?token|bearer|client[_-]?secret|session)\b(\s*[=:]\s*|\s+)(\S+)/gi;
-var LONG_TOKEN = /[A-Za-z0-9_\-+/.]{28,}={0,2}/g;
-function redactDiagnostic(text, maxLen = MAX_DIAGNOSTIC_LEN) {
-  if (text === undefined || text === null)
-    return "";
-  let t = text.replace(SECRET_KV, (_m, key, sep2) => `${key}${sep2}***`);
-  t = t.replace(LONG_TOKEN, "***");
-  t = t.trim();
-  if (t.length > maxLen)
-    t = `${t.slice(0, maxLen - 1)}…`;
-  return t;
-}
-
 // src/commands/status.ts
 import { readFileSync as readFileSync7 } from "node:fs";
 
@@ -5263,7 +5619,29 @@ async function runStatus(args, io) {
     return mapBotError(e, parsed.slug, io);
   }
   if (lifecycle !== null && lifecycle.state !== "live") {
-    emit3(lifecycleOutput(parsed.slug, lifecycle), parsed.json, io);
+    let output = lifecycleOutput(parsed.slug, lifecycle);
+    if (lifecycle.state === "failed") {
+      try {
+        const deployment2 = await fetchDeploymentStatus(cfg, parsed.slug);
+        output = {
+          ...output,
+          deployment: deployment2,
+          ...deployment2 === null ? {
+            deploymentUnavailableReason: "the deployment-status endpoint is unavailable or returned an unsupported response"
+          } : {}
+        };
+      } catch (e) {
+        if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
+          return mapBotError(e, parsed.slug, io);
+        }
+        output = {
+          ...output,
+          deployment: null,
+          deploymentUnavailableReason: redactDiagnostic(describe12(e))
+        };
+      }
+    }
+    emit4(output, parsed.json, io);
     return 0;
   }
   let localYaml = null;
@@ -5311,7 +5689,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: live deployment state unavailable (${describe12(e)}) — ` + `the report below is from the platform manifest view only.`);
+    io.err(`launchpad status: live deployment state unavailable (${redactDiagnostic(describe12(e))}) — ` + `the report below is from the platform manifest view only.`);
   }
   let standingExceptions = null;
   try {
@@ -5340,7 +5718,7 @@ async function runStatus(args, io) {
       ...deploymentKnown ? { deployment } : {},
       ...standingExceptions !== null ? { standingExceptions } : {}
     };
-    emit3(out, parsed.json, io);
+    emit4(out, parsed.json, io);
     return 0;
   }
   if (local === null) {
@@ -5357,7 +5735,7 @@ async function runStatus(args, io) {
       ...deploymentKnown ? { deployment } : {},
       ...standingExceptions !== null ? { standingExceptions } : {}
     };
-    emit3(out, parsed.json, io);
+    emit4(out, parsed.json, io);
     if (parsed.strict) {
       if (deployment?.liveDeployment?.buildStatus === "failure") {
         io.err(`launchpad status: --strict: live build FAILED ` + `(drift not evaluated — no local launchpad.yaml here).`);
@@ -5440,7 +5818,7 @@ async function runStatus(args, io) {
     ...accessDrift !== undefined ? { accessDrift } : {},
     ...groupIssues.length === 0 ? {} : { groupIssues }
   };
-  emit3(result, parsed.json, io);
+  emit4(result, parsed.json, io);
   if (parsed.strict && (result.state === "drift" || accessDrift?.inSync === false || groupIssues.length > 0)) {
     return 1;
   }
@@ -5636,7 +6014,7 @@ function lifecycleOutput(slug, lc) {
     driftDetails: []
   };
 }
-function emit3(out, asJson, io) {
+function emit4(out, asJson, io) {
   if (asJson) {
     io.out(JSON.stringify(out, null, 2));
     return;
@@ -5648,12 +6026,16 @@ function emit3(out, asJson, io) {
       return;
     case "provisioning_failed":
       io.out(`${out.slug}: provisioning FAILED at stage ${out.stage ?? "unknown"}` + (out.failedReason ? `: ${out.failedReason}` : ""));
-      if (isLikelyLiveFailureStage(out.stage)) {
+      if (out.deployment?.reconciledToLive === true) {
+        io.out(`  that lifecycle state is stale: this read verified the live build and reconciled the record failed→live.`);
+        io.out(`  no action needed — re-run \`launchpad status ${out.slug}\` to see the reconciled state.`);
+      } else if (isLikelyLiveFailureStage(out.stage)) {
         io.out(`  the app may already be live — run \`launchpad recover ${out.slug}\` to reconcile the record;`);
         io.out(`  if it is not serving, the same command starts the stage-dependent recovery.`);
       } else {
         io.out(`  run \`launchpad recover ${out.slug}\` to start the stage-dependent recovery.`);
       }
+      surfaceFailedLifecycleDeployment(out, io);
       return;
     case "destroying":
       io.out(`${out.slug}: destroying…`);
@@ -5750,6 +6132,20 @@ function triggerLabel(trigger) {
     return "launchpad deploy (bot)";
   return "an unknown mechanism";
 }
+function surfaceFailedLifecycleDeployment(out, io) {
+  if (out.deploymentUnavailableReason !== undefined) {
+    io.out(`  latest deployment evidence unavailable: ${out.deploymentUnavailableReason}`);
+    return;
+  }
+  if (out.deployment === undefined || out.deployment === null)
+    return;
+  if (!out.deployment.supported) {
+    io.out("  latest deployment evidence: not applicable because this app has no Pages deployment surface.");
+    return;
+  }
+  io.out("  latest deployment evidence (may not be the cause of this lifecycle failure):");
+  surfaceDeployment(out, io);
+}
 function surfaceDeployment(out, io) {
   const dep = out.deployment;
   if (dep === undefined || dep === null || !dep.supported)
@@ -5766,15 +6162,15 @@ function surfaceDeployment(out, io) {
   const via = triggerLabel(live.trigger);
   switch (live.buildStatus) {
     case "success":
-      io.out(`  last deployment: build success (${via}${commit}) at ${live.createdOn}`);
+      io.out(`  last deployment: build success (${via}${commit}) at ${live.createdOn} [deployment ${live.id}]`);
       return;
     case "in_progress":
-      io.out(`  last deployment: build IN PROGRESS (${via}${commit}, started ${live.createdOn})`);
+      io.out(`  last deployment: build IN PROGRESS (${via}${commit}, started ${live.createdOn}) [deployment ${live.id}]`);
       io.out("    re-run `launchpad status` shortly to confirm the build outcome.");
       return;
     case "failure": {
       const stage = live.failedStage !== undefined ? ` at stage "${live.failedStage}"` : "";
-      io.out(`  last deployment: build FAILED${stage} (${via}${commit}) at ${live.createdOn}`);
+      io.out(`  last deployment: build FAILED${stage} (${via}${commit}) at ${live.createdOn} [deployment ${live.id}]`);
       if (live.logExcerpt !== undefined && live.logExcerpt.length > 0) {
         io.out("    build log (excerpt):");
         for (const line of live.logExcerpt.split(`
@@ -6185,6 +6581,8 @@ import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 
 class GitFilesError extends Error {
   code = "git_files_error";
@@ -6202,6 +6600,7 @@ var PROTECTED_PATHS = new Set([
 ]);
 async function listDeployFiles(opts) {
   const sp = opts.spawner ?? spawn3;
+  const exists = opts.exists ?? existsSync5;
   const stdout = await runGit2(sp, opts.cwd, [
     "ls-files",
     "-c",
@@ -6209,11 +6608,11 @@ async function listDeployFiles(opts) {
     "--exclude-standard",
     "-z"
   ]);
-  const paths = stdout.split("\x00").filter((p) => p.length > 0 && !PROTECTED_PATHS.has(p));
+  const paths = stdout.split("\x00").filter((p) => p.length > 0 && exists(resolve7(opts.cwd, p)) && !PROTECTED_PATHS.has(p));
   return [...paths].sort();
 }
 function runGit2(sp, cwd, args) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const spawnOpts = { cwd, stdio: ["ignore", "pipe", "pipe"] };
     const child = sp("git", [...args], spawnOpts);
     let stdout = "";
@@ -6229,7 +6628,7 @@ function runGit2(sp, cwd, args) {
     });
     child.once("close", (code) => {
       if (code === 0) {
-        resolve7(stdout);
+        resolve8(stdout);
         return;
       }
       reject(new GitFilesError(`\`git ${args.join(" ")}\` exited ${code}: ${stderr.trim()}`));
@@ -6806,7 +7205,7 @@ function parseDeployFlags(args) {
 }
 
 // src/deploy/apply.ts
-import { existsSync as existsSync5, rmSync } from "node:fs";
+import { existsSync as existsSync6, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
@@ -7173,7 +7572,7 @@ function sleep(ms) {
 }
 function deletePinIfPresent(cfg, slug, io) {
   const pinPath = join10(cfg.stateDir, slug, "group.json");
-  if (!existsSync5(pinPath))
+  if (!existsSync6(pinPath))
     return;
   try {
     rmSync(pinPath, { force: true });
@@ -7311,12 +7710,12 @@ async function handleAccessDrift(params) {
 
 // src/deploy/dry-run.ts
 import { execFileSync } from "node:child_process";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var MANIFEST_SHA_REGEX2 = /^[0-9a-f]{40}$/;
 async function runDeployDryRun(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
-  const manifestPath = resolve7(process.cwd(), opts.file ?? "launchpad.yaml");
+  const manifestPath = resolve8(process.cwd(), opts.file ?? "launchpad.yaml");
   const loaded = loadManifest(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError2(loaded, opts.json, io);
@@ -7674,6 +8073,81 @@ function handleNetworkError(e, io, slug, verb) {
   return 1;
 }
 
+// src/manifest/container-filesystem.ts
+import { lstatSync as lstatSync3, realpathSync } from "node:fs";
+import { dirname as dirname6, join as join11, relative as relative3, resolve as resolve9, sep as sep2 } from "node:path";
+function validateContainerFilesystem(manifestPath, capability) {
+  const root = realpathSync(dirname6(manifestPath));
+  const segments = capability.container.image.slice(2).split("/");
+  let current = root;
+  for (const segment of segments) {
+    current = join11(current, segment);
+    let stat;
+    try {
+      stat = lstatSync3(current);
+    } catch (error) {
+      return failure("container_image_unreadable", relative3(root, current), `cannot inspect container image path: ${describe15(error)}`);
+    }
+    if (stat.isSymbolicLink()) {
+      return failure("container_image_symlink", relative3(root, current), "container image path must not contain symbolic links");
+    }
+  }
+  let finalPath;
+  try {
+    finalPath = realpathSync(current);
+  } catch (error) {
+    return failure("container_image_unreadable", relative3(root, current), `cannot resolve container image path: ${describe15(error)}`);
+  }
+  const rootPrefix = resolve9(root) + sep2;
+  if (!resolve9(finalPath).startsWith(rootPrefix)) {
+    return failure("container_image_outside_repository", capability.container.image, "container image resolves outside the app repository");
+  }
+  if (!lstatSync3(finalPath).isFile()) {
+    return failure("container_image_not_regular_file", capability.container.image, "container image must resolve to a regular Dockerfile");
+  }
+  return { kind: "ok", dockerfilePath: finalPath };
+}
+function failure(reason, path8, message) {
+  return { kind: "error", reason, path: path8, message };
+}
+function describe15(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/manifest/runtime-capability.ts
+function validateCliRuntimeCapability(manifestPath, manifest) {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported" || result.runtime === "pages") {
+    return result;
+  }
+  const filesystem = validateContainerFilesystem(manifestPath, result.capability);
+  return filesystem.kind === "error" ? filesystem : result;
+}
+function rejectUnsupportedCliRuntime(args) {
+  const result = validateCliRuntimeCapability(args.manifestPath, args.manifest);
+  if (result.kind !== "unsupported" && result.kind !== "error")
+    return null;
+  if (args.json) {
+    args.io.out(JSON.stringify({
+      ok: false,
+      manifest_valid: true,
+      runtime_supported: false,
+      reason: result.reason,
+      path: result.path,
+      message: result.message
+    }));
+    return 1;
+  }
+  if (args.structurallyValidName !== undefined) {
+    args.io.out(`✓ ${args.structurallyValidName} - manifest is structurally valid`);
+    args.io.err(`✗ runtime unsupported: ${result.reason}`);
+  } else {
+    args.io.err(`launchpad ${args.command}: runtime unsupported (${result.reason})`);
+  }
+  args.io.err(`  ${result.path}: ${result.message}`);
+  return 1;
+}
+
 // src/commands/deploy.ts
 var deployCommand = {
   name: "deploy",
@@ -7726,7 +8200,7 @@ async function runDeploy(args, io) {
   }
   const cwd = process.cwd();
   const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync6(manifestPath)) {
+  if (existsSync7(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : {
       allowStale: false,
       rebaseOntoHead: false,
@@ -7780,7 +8254,7 @@ async function runDeploy(args, io) {
     }
     let contentManifestYaml = null;
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync6(contentManifestPath)) {
+    if (existsSync7(contentManifestPath)) {
       try {
         contentManifestYaml = readFileSync10(contentManifestPath, "utf8");
       } catch {
@@ -7860,7 +8334,7 @@ async function runDeploy(args, io) {
       io.err(`launchpad deploy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad deploy failed: ${describe15(e)}`);
+    io.err(`launchpad deploy failed: ${describe16(e)}`);
     return 1;
   }
 }
@@ -7931,7 +8405,7 @@ function formatBytes2(n) {
     return `${(n / 1024).toFixed(1)}KB`;
   return `${(n / (1024 * 1024)).toFixed(1)}MB`;
 }
-function describe15(e) {
+function describe16(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function surfaceDeployExtras(body, io, slug, allowStale = false) {
@@ -8003,11 +8477,11 @@ function surfaceStaleBlock(body, io) {
 }
 var MANIFEST_DIFF_READ_TIMEOUT_MS = 5000;
 function withTimeout(p, ms) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve10, reject) => {
     const timer = setTimeout(() => reject(new Error(`manifest read timed out after ${ms}ms`)), ms);
     p.then((v) => {
       clearTimeout(timer);
-      resolve8(v);
+      resolve10(v);
     }, (e) => {
       clearTimeout(timer);
       reject(e instanceof Error ? e : new Error(String(e)));
@@ -8054,7 +8528,7 @@ async function advanceBaseShaMarker(cwd, sha, io) {
       return;
     await writeBaseShaMarker(cwd, sha);
   } catch (e) {
-    io.err(`warning: couldn't update the local base-sha marker (${describe15(e)}); ` + `a future deploy may re-warn about staleness. Harmless — your deploy landed.`);
+    io.err(`warning: couldn't update the local base-sha marker (${describe16(e)}); ` + `a future deploy may re-warn about staleness. Harmless — your deploy landed.`);
   }
 }
 async function runModelADeploy(args) {
@@ -8069,12 +8543,30 @@ async function runModelADeploy(args) {
       return 64;
     }
     slug = metaSlug;
-    const dtype = manifestObj?.deployment?.type;
-    if (dtype === "static" || dtype === "react" || dtype === "react+api" || dtype === "container") {
-      appType = dtype;
+    const raw = manifestObj;
+    const isV2 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
+    const deploymentType = isV2 ? raw?.spec?.appType : raw?.deployment?.type;
+    if (deploymentType === "static" || deploymentType === "react" || deploymentType === "react+api" || deploymentType === "container") {
+      appType = deploymentType;
+    }
+    if (deploymentType === "container") {
+      const parsed = isV2 ? parseManifestV2(manifestObj) : parseManifest(manifestObj);
+      if (parsed.kind !== "ok") {
+        io.err("launchpad deploy: manifest is structurally invalid:");
+        for (const issue of parsed.issues) {
+          io.err(`  ${issue.path}: ${issue.message}`);
+        }
+        return 1;
+      }
+      const capability = validateCliRuntimeCapability(manifestPath, parsed.manifest);
+      if (capability.kind === "unsupported" || capability.kind === "error") {
+        io.err(`launchpad deploy: runtime unsupported (${capability.reason})`);
+        io.err(`  ${capability.path}: ${capability.message}`);
+        return 1;
+      }
     }
   } catch (e) {
-    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe15(e)}`);
+    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe16(e)}`);
     return 1;
   }
   const noVerify = args.argv.includes("--no-verify");
@@ -8104,7 +8596,7 @@ async function runModelADeploy(args) {
   try {
     cfg = loadConfig();
   } catch (e) {
-    io.err(`launchpad deploy: ${describe15(e)}`);
+    io.err(`launchpad deploy: ${describe16(e)}`);
     return 1;
   }
   try {
@@ -8154,7 +8646,7 @@ async function runModelADeploy(args) {
       io.err("       run `launchpad login` to refresh your session.");
       return 1;
     }
-    io.err(`launchpad deploy: unexpected error: ${describe15(e)}`);
+    io.err(`launchpad deploy: unexpected error: ${describe16(e)}`);
     return 1;
   }
   switch (result.kind) {
@@ -8366,7 +8858,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -8444,7 +8936,7 @@ async function runRedeploy(opts, io, deps = {}) {
 }
 function readLocalAppType(cwd, file) {
   const manifestPath = resolvePath2(cwd, file ?? "launchpad.yaml");
-  if (!existsSync7(manifestPath))
+  if (!existsSync8(manifestPath))
     return null;
   try {
     const obj = parseYaml7(readFileSync11(manifestPath, "utf8"));
@@ -8629,7 +9121,7 @@ async function runEnvvars(args, io) {
       io.err(`launchpad envvars: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad envvars failed: ${describe16(e)}`);
+    io.err(`launchpad envvars failed: ${describe17(e)}`);
     return 1;
   }
 }
@@ -8726,16 +9218,16 @@ function renderList(envVars, io) {
     io.out(fmt(row));
   }
 }
-function describe16(e) {
+function describe17(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/generate.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, resolve as resolve8, relative as relative3 } from "node:path";
+import { dirname as dirname7, resolve as resolve10, relative as relative4 } from "node:path";
 var generateCommand = {
   name: "generate",
-  summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
+  summary: "emit derived runtime artefacts from launchpad.yaml",
   run: runGenerate
 };
 async function runGenerate(args, io) {
@@ -8745,33 +9237,50 @@ async function runGenerate(args, io) {
     io.err("Usage: launchpad generate [--file <path>] [--dry-run] [--force] [--json]");
     return 64;
   }
-  const manifestPath = resolve8(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
-  const appRoot = dirname6(manifestPath);
-  const wranglerPath = resolve8(appRoot, "container", "wrangler.toml");
-  const workflowPath = resolve8(appRoot, ".github", "workflows", "deploy.yml");
+  const unsupported2 = rejectUnsupportedCliRuntime({
+    command: "generate",
+    manifestPath,
+    manifest: result.manifest,
+    io,
+    json: flags.json
+  });
+  if (unsupported2 !== null)
+    return unsupported2;
+  const appRoot = dirname7(manifestPath);
+  const wranglerPath = resolve10(appRoot, "container", "wrangler.toml");
+  const workerPath = resolve10(appRoot, "container", "worker", "index.ts");
+  const workflowPath = resolve10(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
+  const workerRaw = generateContainerWorker(result.manifest);
+  const workerOut = workerRaw.kind === "ok" ? { kind: "ok", content: workerRaw.content, warnings: [] } : workerRaw;
   const workflowOut = generateGithubDeployWorkflow(result.manifest);
   if (flags.dryRun) {
     return renderDryRun([
       { artefact: "wrangler.toml", path: wranglerPath, result: wranglerOut },
+      { artefact: "worker/index.ts", path: workerPath, result: workerOut },
       { artefact: "deploy.yml", path: workflowPath, result: workflowOut }
     ], appRoot, flags.json, io);
   }
   const reports = [
     applyOne("wrangler.toml", wranglerPath, wranglerOut, flags.force),
+    applyOne("worker/index.ts", workerPath, workerOut, flags.force),
     applyOne("deploy.yml", workflowPath, workflowOut, flags.force)
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
 function applyOne(artefact, path10, out, force) {
-  if (out.kind === "not-applicable") {
+  if (out.kind === "not-applicable" || out.kind === "unsupported") {
     return {
       artefact,
-      action: { kind: "not-applicable", reason: out.reason },
+      action: {
+        kind: "not-applicable",
+        reason: out.kind === "unsupported" ? `${out.reason}: ${out.message}` : out.reason
+      },
       warnings: []
     };
   }
@@ -8794,7 +9303,7 @@ function applyOne(artefact, path10, out, force) {
     };
   }
   try {
-    mkdirSync2(dirname6(path10), { recursive: true });
+    mkdirSync2(dirname7(path10), { recursive: true });
     writeFileSync2(path10, out.content, "utf8");
     return {
       artefact,
@@ -8830,12 +9339,12 @@ function readIfExists(path10) {
 function renderDryRun(inputs, appRoot, json, io) {
   if (json) {
     const files = inputs.map((i) => {
-      const previewPath = i.preview === undefined ? relative3(appRoot, i.path) : i.path;
-      if (i.result.kind === "not-applicable") {
+      const previewPath = i.preview === undefined ? relative4(appRoot, i.path) : i.path;
+      if (i.result.kind === "not-applicable" || i.result.kind === "unsupported") {
         return {
           artefact: i.artefact,
           kind: "not-applicable",
-          reason: i.result.reason,
+          reason: i.result.kind === "unsupported" ? `${i.result.reason}: ${i.result.message}` : i.result.reason,
           ...i.preview ? { preview: true, destination: i.preview.destination } : {}
         };
       }
@@ -8852,12 +9361,13 @@ function renderDryRun(inputs, appRoot, json, io) {
     return 0;
   }
   for (const i of inputs) {
-    if (i.result.kind === "not-applicable") {
-      io.out(`# ${i.artefact}: skipped — ${i.result.reason}`);
+    if (i.result.kind === "not-applicable" || i.result.kind === "unsupported") {
+      const reason = i.result.kind === "unsupported" ? `${i.result.reason}: ${i.result.message}` : i.result.reason;
+      io.out(`# ${i.artefact}: skipped - ${reason}`);
       io.out("");
       continue;
     }
-    const headerPath = i.preview === undefined ? relative3(appRoot, i.path) : i.path;
+    const headerPath = i.preview === undefined ? relative4(appRoot, i.path) : i.path;
     const header = i.preview === undefined ? `--- ${headerPath} ---` : `--- [preview, destination = ${i.preview.destination}] ${headerPath} ---`;
     io.out(header);
     io.out(i.result.content);
@@ -8876,20 +9386,20 @@ function renderApplyHuman(reports, appRoot, io) {
     const a = r.action;
     switch (a.kind) {
       case "written":
-        io.out(`✓ ${r.artefact} — wrote ${a.bytes} bytes to ${relative3(appRoot, a.path)}`);
+        io.out(`✓ ${r.artefact} — wrote ${a.bytes} bytes to ${relative4(appRoot, a.path)}`);
         break;
       case "unchanged":
-        io.out(`= ${r.artefact} — unchanged (${relative3(appRoot, a.path)})`);
+        io.out(`= ${r.artefact} — unchanged (${relative4(appRoot, a.path)})`);
         break;
       case "would-overwrite":
-        io.err(`! ${r.artefact} — exists with different content (${relative3(appRoot, a.path)}); re-run with --force to overwrite`);
+        io.err(`! ${r.artefact} — exists with different content (${relative4(appRoot, a.path)}); re-run with --force to overwrite`);
         wouldOverwrite++;
         break;
       case "not-applicable":
         io.out(`- ${r.artefact} — skipped (${a.reason})`);
         break;
       case "write-error":
-        io.err(`✗ ${r.artefact} — ${a.message} (${relative3(appRoot, a.path)})`);
+        io.err(`✗ ${r.artefact} — ${a.message} (${relative4(appRoot, a.path)})`);
         writeError++;
         break;
     }
@@ -8908,17 +9418,17 @@ function renderApplyJson(reports, appRoot, io) {
     const base = { artefact: r.artefact, warnings: r.warnings };
     switch (a.kind) {
       case "written":
-        return { ...base, kind: a.kind, path: relative3(appRoot, a.path), bytes: a.bytes };
+        return { ...base, kind: a.kind, path: relative4(appRoot, a.path), bytes: a.bytes };
       case "unchanged":
       case "would-overwrite":
-        return { ...base, kind: a.kind, path: relative3(appRoot, a.path) };
+        return { ...base, kind: a.kind, path: relative4(appRoot, a.path) };
       case "not-applicable":
         return { ...base, kind: a.kind, reason: a.reason };
       case "write-error":
         return {
           ...base,
           kind: a.kind,
-          path: relative3(appRoot, a.path),
+          path: relative4(appRoot, a.path),
           message: a.message
         };
     }
@@ -9042,13 +9552,13 @@ function decodeJwtPayload(token) {
   try {
     json = Buffer.from(b64UrlToB64(payload), "base64").toString("utf8");
   } catch (e) {
-    throw new JwtParseError(`could not base64-decode JWT payload: ${describe17(e)}`);
+    throw new JwtParseError(`could not base64-decode JWT payload: ${describe18(e)}`);
   }
   let parsed;
   try {
     parsed = JSON.parse(json);
   } catch (e) {
-    throw new JwtParseError(`JWT payload is not JSON: ${describe17(e)}`);
+    throw new JwtParseError(`JWT payload is not JSON: ${describe18(e)}`);
   }
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new JwtParseError(`JWT payload is not an object`);
@@ -9059,7 +9569,7 @@ function b64UrlToB64(s) {
   const padded = s.padEnd(s.length + (4 - s.length % 4) % 4, "=");
   return padded.replace(/-/g, "+").replace(/_/g, "/");
 }
-function describe17(e) {
+function describe18(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -9086,7 +9596,7 @@ async function runGroupsWhoami(args, io) {
   try {
     payload = decodeJwtPayload(session.accessToken);
   } catch (e) {
-    const message = e instanceof JwtParseError ? e.message : describe18(e);
+    const message = e instanceof JwtParseError ? e.message : describe19(e);
     if (json) {
       io.out(JSON.stringify({ ok: false, kind: "jwt-parse-error", message }));
     } else {
@@ -9167,7 +9677,7 @@ function parseFlags2(args) {
   }
   return { kind: "ok", json };
 }
-function describe18(e) {
+function describe19(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -9270,7 +9780,7 @@ async function loadGroups(io, refresh, json) {
       }
       return { kind: "error", code: 3 };
     }
-    renderFetchError(io, describe19(e), json);
+    renderFetchError(io, describe20(e), json);
     return { kind: "error", code: 2 };
   }
 }
@@ -9307,7 +9817,7 @@ async function lookupTenantWide(key) {
       return { kind: "unauthenticated", message: e.message };
     if (e instanceof ForbiddenError)
       return { kind: "forbidden", message: e.message };
-    return { kind: "error", message: describe19(e) };
+    return { kind: "error", message: describe20(e) };
   }
 }
 function renderLookupFailure(io, json, hit) {
@@ -9453,9 +9963,9 @@ async function runShow(args, io) {
   }
   const key = parsed.flags.positional[0];
   const hit = await lookupTenantWide(key);
-  const failure = renderLookupFailure(io, parsed.flags.json, hit);
-  if (failure !== null)
-    return failure;
+  const failure2 = renderLookupFailure(io, parsed.flags.json, hit);
+  if (failure2 !== null)
+    return failure2;
   if (hit.kind !== "found" && hit.kind !== "ambiguous" && hit.kind !== "not-found") {
     return 2;
   }
@@ -9502,9 +10012,9 @@ async function runResolve(args, io) {
   }
   const key = parsed.flags.positional[0];
   const hit = await lookupTenantWide(key);
-  const failure = renderLookupFailure(io, parsed.flags.json, hit);
-  if (failure !== null)
-    return failure;
+  const failure2 = renderLookupFailure(io, parsed.flags.json, hit);
+  if (failure2 !== null)
+    return failure2;
   if (hit.kind !== "found" && hit.kind !== "ambiguous" && hit.kind !== "not-found") {
     return 2;
   }
@@ -9551,23 +10061,23 @@ function renderTable2(io, groups) {
   for (const r of rows)
     io.out(fmt(r));
 }
-function describe19(e) {
+function describe20(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname7, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname8, resolve as resolve11 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync8, readFileSync as readFileSync13, statSync } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync13, statSync } from "node:fs";
+import { join as join13 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync8(join12(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync8(join12(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync8(join12(cwd, n)));
+  const hasPackageJson = existsSync9(join13(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join13(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join13(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -9613,7 +10123,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync8(join12(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync9(join13(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -9635,8 +10145,8 @@ function detectPackageManager(cwd) {
 }
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
-    const p = join12(cwd, name);
-    if (existsSync8(p)) {
+    const p = join13(cwd, name);
+    if (existsSync9(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -9646,9 +10156,9 @@ function detectVitePresence(cwd) {
   };
 }
 function detectAppType(cwd) {
-  const fnDir = join12(cwd, "functions");
+  const fnDir = join13(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync8(fnDir)) {
+  if (existsSync9(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -9658,8 +10168,8 @@ function detectAppType(cwd) {
   return { kind: "ok", value: hasFunctionsDir ? "react+api" : "react" };
 }
 function detectBuildCommand(cwd, pm) {
-  const pkgJsonPath = join12(cwd, "package.json");
-  if (!existsSync8(pkgJsonPath)) {
+  const pkgJsonPath = join13(cwd, "package.json");
+  if (!existsSync9(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -9731,8 +10241,8 @@ async function runInit(args, io, prompt) {
     return 64;
   }
   const { inputs, options } = parsed;
-  const outPath = resolve9(process.cwd(), options.out);
-  if (existsSync9(outPath) && !options.force) {
+  const outPath = resolve11(process.cwd(), options.out);
+  if (existsSync10(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -9779,7 +10289,7 @@ async function runInit(args, io, prompt) {
   }
   io.out(`✓ wrote ${outPath}`);
   if (options.gitignore) {
-    const gitignorePath = resolve9(process.cwd(), ".gitignore");
+    const gitignorePath = resolve11(process.cwd(), ".gitignore");
     try {
       const changed = ensureGitignoreEntries(gitignorePath, [".env", ".env.local"]);
       if (changed.length > 0) {
@@ -9794,9 +10304,9 @@ async function runInit(args, io, prompt) {
     }
   }
   if (fillResult.inputs.type === "static") {
-    const serveDir = resolve9(dirname7(outPath), STATIC_SERVE_DIR);
-    const indexPath = resolve9(serveDir, "index.html");
-    if (!existsSync9(indexPath)) {
+    const serveDir = resolve11(dirname8(outPath), STATIC_SERVE_DIR);
+    const indexPath = resolve11(serveDir, "index.html");
+    if (!existsSync10(indexPath)) {
       try {
         mkdirSync3(serveDir, { recursive: true });
         writeFileSync3(indexPath, starterIndexHtml(fillResult.inputs.name), {
@@ -10188,7 +10698,7 @@ function renderYaml(manifest) {
 }
 function ensureGitignoreEntries(path10, entries) {
   let current = "";
-  if (existsSync9(path10)) {
+  if (existsSync10(path10)) {
     current = readFileSync14(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
@@ -10262,13 +10772,13 @@ async function runLogin(args, io, deps) {
       io.out(`Access token expires in ~${expiresIn}s; refreshes silently.`);
       return 0;
     } catch (e) {
-      io.err(`Gateway login failed: ${describe20(e)}`);
+      io.err(`Gateway login failed: ${describe21(e)}`);
       io.err("Falling back to the legacy Cloudflare Access flow (DEPRECATED — this fallback will be removed when the dual-auth window closes).");
       io.err("");
       return await runLegacyLogin(io, cfg.botUrl, cfg.sessionPath, deps);
     }
   } catch (e) {
-    io.err(`launchpad login failed: ${describe20(e)}`);
+    io.err(`launchpad login failed: ${describe21(e)}`);
     return 1;
   }
 }
@@ -10310,7 +10820,7 @@ function printLoginHelp(io) {
   io.out("  0   signed in / session stored");
   io.out("  1   login failed (network, browser, or gateway error)");
 }
-function describe20(e) {
+function describe21(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10347,14 +10857,14 @@ async function runLogout(args, io, deps) {
         });
         io.out("Server-side session revoked.");
       } catch (e) {
-        io.err(`warning: could not revoke the session server-side (${describe21(e)}) — clearing the local session anyway. Any in-flight access token expires within 15 minutes.`);
+        io.err(`warning: could not revoke the session server-side (${describe22(e)}) — clearing the local session anyway. Any in-flight access token expires within 15 minutes.`);
       }
     }
     const had = await clearSession(cfg.sessionPath);
     io.out(had ? `Logged out. Session cleared at ${cfg.sessionPath}` : "Already logged out.");
     return 0;
   } catch (e) {
-    io.err(`launchpad logout failed: ${describe21(e)}`);
+    io.err(`launchpad logout failed: ${describe22(e)}`);
     return 1;
   }
 }
@@ -10374,7 +10884,7 @@ function printLogoutHelp(io) {
   io.out("  0   logged out (or already logged out)");
   io.out("  1   could not clear the local session (file IO / config error)");
 }
-function describe21(e) {
+function describe22(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10444,7 +10954,7 @@ async function runLogs(args, io) {
       io.err(`launchpad logs: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad logs failed: ${describe22(e)}`);
+    io.err(`launchpad logs failed: ${describe23(e)}`);
     return 1;
   }
 }
@@ -10524,7 +11034,7 @@ function formatRelative2(iso) {
     return `${hr}h ago`;
   return `${Math.floor(hr / 24)}d ago`;
 }
-function describe22(e) {
+function describe23(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10573,7 +11083,7 @@ async function runMerge(args, io) {
       try {
         body = await res.json();
       } catch (e) {
-        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe23(e)}`);
+        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe24(e)}`);
         return 1;
       }
       io.out("");
@@ -10613,7 +11123,7 @@ async function runMerge(args, io) {
       io.err(`launchpad merge: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad merge failed: ${describe23(e)}`);
+    io.err(`launchpad merge failed: ${describe24(e)}`);
     return 1;
   }
 }
@@ -10712,12 +11222,12 @@ function renderBotError(status, env, io, prNumber = null) {
       io.err(`launchpad merge: bot returned ${status} ${code}${detail !== undefined ? `: ${detail}` : ""}`);
   }
 }
-function describe23(e) {
+function describe24(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/plan.ts
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -10730,8 +11240,19 @@ async function runPlan(args, io) {
     io.err("Usage: launchpad plan [--file <path>] [--json]");
     return 64;
   }
-  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve12(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
+  if (result.kind === "ok") {
+    const unsupported2 = rejectUnsupportedCliRuntime({
+      command: "plan",
+      manifestPath,
+      manifest: result.manifest,
+      io,
+      json: flags.json
+    });
+    if (unsupported2 !== null)
+      return unsupported2;
+  }
   return flags.json ? renderJson(result, io) : renderHuman(result, io);
 }
 function renderJson(result, io) {
@@ -10964,7 +11485,7 @@ async function runDestroy(args, io, prompt, isTty) {
       io.err(`launchpad destroy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad destroy failed: ${describe24(e)}`);
+    io.err(`launchpad destroy failed: ${describe25(e)}`);
     return 1;
   }
 }
@@ -11164,7 +11685,7 @@ function printUsage4(io) {
   ].join(`
 `));
 }
-function describe24(e) {
+function describe25(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -11296,22 +11817,22 @@ async function treesEqual(cwd, tracked, headDir, headPaths) {
   if (tracked.length !== headPaths.length)
     return false;
   const expected = new Set(headPaths);
-  for (const relative5 of tracked) {
-    if (!expected.has(relative5))
+  for (const relative6 of tracked) {
+    if (!expected.has(relative6))
       return false;
-    if (!equal(await readEntry(path12.resolve(cwd, relative5)), await readEntry(path12.resolve(headDir, relative5)))) {
+    if (!equal(await readEntry(path12.resolve(cwd, relative6)), await readEntry(path12.resolve(headDir, relative6)))) {
       return false;
     }
   }
   return true;
 }
-async function listFiles(root, relative5 = "") {
+async function listFiles(root, relative6 = "") {
   const files = [];
-  const entries = await fs6.readdir(path12.resolve(root, relative5), {
+  const entries = await fs6.readdir(path12.resolve(root, relative6), {
     withFileTypes: true
   });
   for (const entry of entries) {
-    const child = relative5.length === 0 ? entry.name : `${relative5}/${entry.name}`;
+    const child = relative6.length === 0 ? entry.name : `${relative6}/${entry.name}`;
     if (entry.isDirectory())
       files.push(...await listFiles(root, child));
     else if (entry.isFile())
@@ -11320,12 +11841,12 @@ async function listFiles(root, relative5 = "") {
   return files.sort();
 }
 function gitOutput(cwd, args) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve14, reject) => {
     execFile("git", [...args], { cwd, encoding: "utf8" }, (error, stdout) => {
       if (error !== null)
         reject(error);
       else
-        resolve12(stdout);
+        resolve14(stdout);
     });
   });
 }
@@ -11334,7 +11855,7 @@ function splitNull(value) {
 }
 async function reconcile(args) {
   const removals = await cleanAncestorRemovals(args);
-  const planned = await Promise.all(args.paths.map((relative5) => planPath(args, relative5, removals)));
+  const planned = await Promise.all(args.paths.map((relative6) => planPath(args, relative6, removals)));
   const conflicts = planned.flatMap((entry) => entry.conflict === undefined ? [] : [entry.conflict]);
   if (conflicts.length > 0) {
     const report = {
@@ -11378,55 +11899,55 @@ async function reconcile(args) {
 }
 async function cleanAncestorRemovals(args) {
   const removals = new Set;
-  for (const relative5 of args.compare.deleted) {
-    assertSafePath(relative5);
-    const checked = await checkParents(args.cwd, relative5, removals);
+  for (const relative6 of args.compare.deleted) {
+    assertSafePath(relative6);
+    const checked = await checkParents(args.cwd, relative6, removals);
     if (checked.kind === "blocked")
       continue;
-    const base = await readEntry(path12.resolve(args.baseDir, relative5));
+    const base = await readEntry(path12.resolve(args.baseDir, relative6));
     const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
     if (local.kind !== "missing" && cleanLocal(base, local))
-      removals.add(relative5);
+      removals.add(relative6);
   }
   return removals;
 }
-async function planPath(args, relative5, removals) {
-  assertSafePath(relative5);
-  const checked = await checkParents(args.cwd, relative5, removals);
-  const base = await readEntry(path12.resolve(args.baseDir, relative5));
-  const upstreamDeleted = args.compare.deleted.includes(relative5);
-  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path12.resolve(args.headDir, relative5));
-  const unsupported = (args.compare.unsupported ?? []).includes(relative5);
+async function planPath(args, relative6, removals) {
+  assertSafePath(relative6);
+  const checked = await checkParents(args.cwd, relative6, removals);
+  const base = await readEntry(path12.resolve(args.baseDir, relative6));
+  const upstreamDeleted = args.compare.deleted.includes(relative6);
+  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path12.resolve(args.headDir, relative6));
+  const unsupported2 = (args.compare.unsupported ?? []).includes(relative6);
   if (checked.kind === "blocked") {
-    return conflictPlan(relative5, checked.target, { kind: "missing" }, head, upstreamDeleted, checked.reason);
+    return conflictPlan(relative6, checked.target, { kind: "missing" }, head, upstreamDeleted, checked.reason);
   }
   const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
-  if (unsupported) {
-    return conflictPlan(relative5, checked.target, local, head, false, "upstream or baseline path uses an unsupported Git entry type");
+  if (unsupported2) {
+    return conflictPlan(relative6, checked.target, local, head, false, "upstream or baseline path uses an unsupported Git entry type");
   }
   if (alreadyResolved(local, head, upstreamDeleted)) {
-    return { relative: relative5, target: checked.target, local, head, upstreamDeleted, apply: false };
+    return { relative: relative6, target: checked.target, local, head, upstreamDeleted, apply: false };
   }
   if (unsupportedHead(head, upstreamDeleted)) {
-    return conflictPlan(relative5, checked.target, local, head, true, "unsupported upstream file type");
+    return conflictPlan(relative6, checked.target, local, head, true, "unsupported upstream file type");
   }
   if (cleanLocal(base, local)) {
-    return { relative: relative5, target: checked.target, local, head, upstreamDeleted, apply: true };
+    return { relative: relative6, target: checked.target, local, head, upstreamDeleted, apply: true };
   }
-  return conflictPlan(relative5, checked.target, local, head, upstreamDeleted, conflictReason(base, local, upstreamDeleted));
+  return conflictPlan(relative6, checked.target, local, head, upstreamDeleted, conflictReason(base, local, upstreamDeleted));
 }
-function conflictPlan(relative5, target, local, head, upstreamDeleted, reason) {
+function conflictPlan(relative6, target, local, head, upstreamDeleted, reason) {
   const suffix = upstreamDeleted ? ".upstream-deleted" : ".upstream";
-  const digest = createHash3("sha256").update(relative5).digest("hex");
+  const digest = createHash3("sha256").update(relative6).digest("hex");
   return {
-    relative: relative5,
+    relative: relative6,
     target,
     local,
     head,
     upstreamDeleted,
     apply: false,
     conflict: {
-      path: relative5,
+      path: relative6,
       reason,
       artifact: `${CONFLICT_DIR}/${digest}${suffix}`,
       upstreamDeleted
@@ -11527,13 +12048,13 @@ function equal(left, right) {
     return false;
   return left.bytes.every((byte, index) => byte === right.bytes[index]);
 }
-async function writeAtomic(cwd, relative5, bytes, mode, allowMetadata = false) {
-  const checked = await checkParents(cwd, relative5, new Set, allowMetadata);
+async function writeAtomic(cwd, relative6, bytes, mode, allowMetadata = false) {
+  const checked = await checkParents(cwd, relative6, new Set, allowMetadata);
   if (checked.kind === "blocked")
     throw new Error(checked.reason);
   const file = checked.target;
   await fs6.mkdir(path12.dirname(file), { recursive: true });
-  const rechecked = await checkParents(cwd, relative5, new Set, allowMetadata);
+  const rechecked = await checkParents(cwd, relative6, new Set, allowMetadata);
   if (rechecked.kind === "blocked")
     throw new Error(rechecked.reason);
   const temporary = `${file}.launchpad-tmp-${process.pid}-${crypto.randomUUID()}`;
@@ -11548,8 +12069,8 @@ async function writeAtomic(cwd, relative5, bytes, mode, allowMetadata = false) {
     throw error;
   }
 }
-async function writeJsonAtomic(cwd, relative5, value) {
-  await writeAtomic(cwd, relative5, new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+async function writeJsonAtomic(cwd, relative6, value) {
+  await writeAtomic(cwd, relative6, new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
 `), 384, true);
 }
 async function resetConflictArtifacts(cwd) {
@@ -11565,37 +12086,37 @@ async function cleanupConflictState(cwd) {
     throw new Error(report.reason);
   await fs6.rm(report.target, { force: true });
 }
-function assertSafePath(relative5) {
-  if (!isSafeSourcePath(relative5)) {
-    throw new Error(`unsafe source path returned by bot: ${relative5}`);
+function assertSafePath(relative6) {
+  if (!isSafeSourcePath(relative6)) {
+    throw new Error(`unsafe source path returned by bot: ${relative6}`);
   }
 }
-function isSafeSourcePath(relative5) {
-  return isSafeRelativePath(relative5) && !relative5.startsWith(`${MARKER_DIR}/`);
+function isSafeSourcePath(relative6) {
+  return isSafeRelativePath(relative6) && !relative6.startsWith(`${MARKER_DIR}/`);
 }
-function isSafeRelativePath(relative5) {
-  const normalized = path12.posix.normalize(relative5);
-  return relative5.length > 0 && !relative5.includes("\\") && !path12.isAbsolute(relative5) && normalized === relative5 && normalized !== ".." && !normalized.startsWith("../");
+function isSafeRelativePath(relative6) {
+  const normalized = path12.posix.normalize(relative6);
+  return relative6.length > 0 && !relative6.includes("\\") && !path12.isAbsolute(relative6) && normalized === relative6 && normalized !== ".." && !normalized.startsWith("../");
 }
-function resolveInsideClone(cwd, relative5) {
+function resolveInsideClone(cwd, relative6) {
   const root = path12.resolve(cwd);
-  const target = path12.resolve(root, relative5);
+  const target = path12.resolve(root, relative6);
   const fromRoot = path12.relative(root, target);
   if (fromRoot.length === 0 || path12.isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${path12.sep}`)) {
-    throw new Error(`unsafe source path returned by bot: ${relative5}`);
+    throw new Error(`unsafe source path returned by bot: ${relative6}`);
   }
   return target;
 }
-async function checkParents(cwd, relative5, projectedRemovals, allowMetadata = false) {
+async function checkParents(cwd, relative6, projectedRemovals, allowMetadata = false) {
   if (allowMetadata) {
-    if (!isSafeRelativePath(relative5)) {
-      throw new Error(`unsafe metadata path: ${relative5}`);
+    if (!isSafeRelativePath(relative6)) {
+      throw new Error(`unsafe metadata path: ${relative6}`);
     }
   } else {
-    assertSafePath(relative5);
+    assertSafePath(relative6);
   }
-  const target = resolveInsideClone(cwd, relative5);
-  const components = relative5.split("/");
+  const target = resolveInsideClone(cwd, relative6);
+  const components = relative6.split("/");
   let current = path12.resolve(cwd);
   for (let index = 0;index < components.length - 1; index += 1) {
     current = path12.join(current, components[index]);
@@ -11734,7 +12255,7 @@ async function runPull(args, io) {
       io.err(`launchpad pull: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad pull failed: ${describe25(e)}`);
+    io.err(`launchpad pull failed: ${describe26(e)}`);
     return 1;
   }
 }
@@ -11842,7 +12363,7 @@ function printUsage5(io) {
   ].join(`
 `));
 }
-function describe25(e) {
+function describe26(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -12177,7 +12698,7 @@ async function runReview(args, io) {
       io.err(`launchpad review: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad review failed: ${describe26(e)}`);
+    io.err(`launchpad review failed: ${describe27(e)}`);
     return 1;
   }
 }
@@ -12255,12 +12776,12 @@ function severityRank(s) {
       return 3;
   }
 }
-function describe26(e) {
+function describe27(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -12315,7 +12836,7 @@ async function runRollback(opts, io, deps = {}) {
       cwd: process.cwd()
     });
   } catch (e) {
-    io.err(`launchpad rollback: git rev-parse failed to start: ${describe27(e)}`);
+    io.err(`launchpad rollback: git rev-parse failed to start: ${describe28(e)}`);
     return 2;
   }
   if (revParse.exitCode !== 0) {
@@ -12330,7 +12851,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     show = await runner.run("git", ["show", `${verifiedSha}:${manifestRelpath}`], { cwd: process.cwd() });
   } catch (e) {
-    io.err(`launchpad rollback: git show failed to start: ${describe27(e)}`);
+    io.err(`launchpad rollback: git show failed to start: ${describe28(e)}`);
     return 2;
   }
   if (show.exitCode !== 0) {
@@ -12364,7 +12885,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     writeFileSync5(manifestPath, historicalYaml, "utf8");
   } catch (e) {
-    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe27(e)}`);
+    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe28(e)}`);
     return 2;
   }
   io.out(`Restored ${manifestPath} from ${verifiedSha.slice(0, 12)}.`);
@@ -12385,7 +12906,7 @@ async function runRollback(opts, io, deps = {}) {
   }, io, applyDeps);
 }
 function readCurrentManifest(path14) {
-  if (!existsSync10(path14))
+  if (!existsSync11(path14))
     return null;
   let raw;
   try {
@@ -12446,7 +12967,7 @@ async function defaultPrompt4(question) {
     rl.close();
   }
 }
-function describe27(e) {
+function describe28(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError3(result, io) {
@@ -12545,13 +13066,13 @@ function parseArgs12(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync11, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as input2, stdout as output2 } from "node:process";
 
 // src/secrets/env-parse.ts
-var ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
+var ENV_NAME2 = /^[A-Z][A-Z0-9_]*$/;
 var LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/;
 function parseEnv(text) {
   const entries = new Map;
@@ -12576,7 +13097,7 @@ function parseEnv(text) {
     if (value.startsWith('"') && value.endsWith('"') && value.length >= 2 || value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
       value = value.slice(1, -1);
     }
-    if (!ENV_NAME.test(key)) {
+    if (!ENV_NAME2.test(key)) {
       invalidNames.push(key);
       continue;
     }
@@ -12602,7 +13123,7 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath4(process.cwd(), opts.env ?? ".env");
-  if (!existsSync11(envPath)) {
+  if (!existsSync12(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
@@ -12611,7 +13132,7 @@ async function runSecretsPush(opts, io, deps = {}) {
   try {
     envText = readFileSync16(envPath, "utf8");
   } catch (e) {
-    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe28(e)}`);
+    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe29(e)}`);
     return 2;
   }
   const parsed = parseEnv(envText);
@@ -12795,10 +13316,10 @@ function mapPushError(e, slug, name, io) {
     io.err(`✗ secrets push ${name}: ${e.message}`);
     return 1;
   }
-  io.err(`✗ secrets push ${name} failed: ${describe28(e)}`);
+  io.err(`✗ secrets push ${name} failed: ${describe29(e)}`);
   return 2;
 }
-function describe28(e) {
+function describe29(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError4(result, io) {
@@ -12934,7 +13455,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
@@ -12944,7 +13465,7 @@ var CELL_LABEL2 = {
 };
 function loadSet(fleetFile, setName, io) {
   const path14 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync12(path14)) {
+  if (!existsSync13(path14)) {
     io.err(`✗ ${path14}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
@@ -13036,7 +13557,7 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath6(process.cwd(), opts.env ?? ".env");
-  if (!existsSync12(envPath)) {
+  if (!existsSync13(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
@@ -13187,8 +13708,8 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync13, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve14 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -13196,7 +13717,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve12(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve14(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -13210,8 +13731,8 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve12(process.cwd(), flags.out);
-  if (existsSync13(outPath) && !flags.force) {
+  const outPath = resolve14(process.cwd(), flags.out);
+  if (existsSync14(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
@@ -13507,16 +14028,16 @@ function printHelp3(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname9, join as join15, resolve as resolve13 } from "node:path";
-import { promises as fs7, existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname10, join as join16, resolve as resolve15 } from "node:path";
+import { promises as fs7, existsSync as existsSync15 } from "node:fs";
 
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { readFileSync as readFileSync18, readdirSync as readdirSync2 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
-  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join14(homedir2(), ".claude", "skills");
+  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
 }
 function readInstalledSkills() {
   try {
@@ -13526,7 +14047,7 @@ function readInstalledSkills() {
       return { present: false, version: null };
     return {
       present: true,
-      version: readSkillVersion(join14(dir, bundle.name, "SKILL.md"))
+      version: readSkillVersion(join15(dir, bundle.name, "SKILL.md"))
     };
   } catch {
     return { present: false, version: null };
@@ -13588,7 +14109,7 @@ async function runSkills(args, io) {
         return 64;
     }
   } catch (e) {
-    io.err(`launchpad skills ${action}: ${describe29(e)}`);
+    io.err(`launchpad skills ${action}: ${describe30(e)}`);
     return 1;
   }
 }
@@ -13611,13 +14132,13 @@ function resolveInstallEnv() {
   return { bundleDir, userSkillsDir };
 }
 function defaultBundleDir() {
-  const here = dirname9(fileURLToPath(import.meta.url));
+  const here = dirname10(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve13(here, "..", "skills"),
-    resolve13(here, "..", "..", "skills")
+    resolve15(here, "..", "skills"),
+    resolve15(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync14(join15(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync15(join16(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -13638,12 +14159,12 @@ async function doInstall(io) {
   }
   let installed = 0;
   for (const skill of BUNDLED_SKILLS) {
-    const src = join15(env.bundleDir, skill);
+    const src = join16(env.bundleDir, skill);
     if (!await isDir(src)) {
       io.err(`launchpad skills install: bundled skill "${skill}" missing from ${env.bundleDir} — package is incomplete.`);
       return 1;
     }
-    const dest = join15(env.userSkillsDir, skill);
+    const dest = join16(env.userSkillsDir, skill);
     await fs7.rm(dest, { recursive: true, force: true });
     await fs7.cp(src, dest, { recursive: true });
     installed++;
@@ -13668,7 +14189,7 @@ async function doUninstall(io) {
       continue;
     if (!isBundleManaged(entry.name))
       continue;
-    const target = join15(env.userSkillsDir, entry.name);
+    const target = join16(env.userSkillsDir, entry.name);
     await fs7.rm(target, { recursive: true, force: true });
     removed++;
     io.out(`✗ removed ${target}`);
@@ -13691,7 +14212,7 @@ async function doList(io) {
   }
   const width = managedDirs.reduce((n, s) => Math.max(n, s.length), 0);
   for (const name of managedDirs) {
-    const skillFile = join15(env.userSkillsDir, name, "SKILL.md");
+    const skillFile = join16(env.userSkillsDir, name, "SKILL.md");
     const version = await readVersion(skillFile);
     io.out(`  ${name.padEnd(width + 2)}${version ?? "(no version)"}`);
   }
@@ -13718,7 +14239,7 @@ async function isDir(path14) {
     return false;
   }
 }
-function describe29(e) {
+function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -13726,7 +14247,7 @@ function describe29(e) {
 import { execFile as execFile2, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname10, resolve as resolve14, relative as relative5, isAbsolute as isAbsolute3, join as join16 } from "node:path";
+import { dirname as dirname11, resolve as resolve16, relative as relative6, isAbsolute as isAbsolute3, join as join17 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
 import { readFileSync as readFileSync19, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
@@ -13771,9 +14292,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve14) => {
-    server.once("error", () => resolve14(false));
-    server.listen(0, "127.0.0.1", () => resolve14(true));
+  const bound = await new Promise((resolve16) => {
+    server.once("error", () => resolve16(false));
+    server.listen(0, "127.0.0.1", () => resolve16(true));
   });
   if (!bound)
     return null;
@@ -13849,7 +14370,7 @@ var PKG = "@m-kopa/launchpad-cli";
 var REGISTRY = "https://registry.npmjs.org";
 var CHANNEL_VERSION_URL = "https://get.launchpad.m-kopa.us/version.json";
 var CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
-var CHANNEL_MARKER = join16(homedir3(), ".launchpad", "channel");
+var CHANNEL_MARKER = join17(homedir3(), ".launchpad", "channel");
 var EXIT_UPDATE_AVAILABLE = 10;
 var UPGRADE_ARGS = {
   npm: ["install", "-g", `${PKG}@latest`],
@@ -13978,8 +14499,8 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join16(tmpdir(), "launchpad-update-"));
-  const file = join16(dir, "install.sh");
+  const dir = mkdtempSync(join17(tmpdir(), "launchpad-update-"));
+  const file = join17(dir, "install.sh");
   try {
     writeFileSync7(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
@@ -14066,7 +14587,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve14(dirname10(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve16(dirname11(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -14074,7 +14595,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve14(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve16(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -14088,7 +14609,7 @@ async function pmRoot(pm) {
   }
 }
 function pathContains(root, child) {
-  const rel = relative5(root, child);
+  const rel = relative6(root, child);
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function runUpgrade(pm) {
@@ -14211,8 +14732,8 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync15, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname11, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -14226,11 +14747,21 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path14 = resolve15(process.cwd(), file ?? "launchpad.yaml");
+  const path14 = resolve17(process.cwd(), file ?? "launchpad.yaml");
   const result = loadManifest(path14);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
+  const unsupported2 = rejectUnsupportedCliRuntime({
+    command: "validate",
+    manifestPath: path14,
+    manifest: result.manifest,
+    io,
+    json,
+    structurallyValidName: result.manifest.metadata.name
+  });
+  if (unsupported2 !== null)
+    return unsupported2;
   const boundary = checkBoundary(path14, result.manifest.app !== undefined);
   const serveErrors = checkStaticServeDir(path14, result.manifest);
   if (serveErrors.length > 0) {
@@ -14240,7 +14771,7 @@ async function runValidate(args, io) {
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
 function checkBoundary(manifestPath, declared) {
-  const dir = dirname11(manifestPath);
+  const dir = dirname12(manifestPath);
   let files;
   try {
     files = walkCwd(dir).files;
@@ -14272,9 +14803,9 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app destination_dir '${serveDir}' is unsafe — use a confined relative subdirectory (e.g. '${STATIC_SERVE_DIR}'). ` + `Serving '.' or an absolute/parent path would publish files outside your app's content.`
     ];
   }
-  const dir = dirname11(manifestPath);
-  const abs = resolve15(dir, serveDir);
-  if (!existsSync15(abs)) {
+  const dir = dirname12(manifestPath);
+  const abs = resolve17(dir, serveDir);
+  if (!existsSync16(abs)) {
     return [
       `static app serves '${serveDir}/' but that directory does not exist — nothing would be served. ` + `Create ${serveDir}/index.html (or run \`launchpad init\` to scaffold it).`
     ];
@@ -14283,7 +14814,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   try {
     isDir2 = statSync2(abs).isDirectory();
   } catch (e) {
-    return [`failed to inspect static served directory '${serveDir}/': ${describe30(e)}`];
+    return [`failed to inspect static served directory '${serveDir}/': ${describe31(e)}`];
   }
   if (!isDir2) {
     return [`static app serves '${serveDir}/' but that path is not a directory.`];
@@ -14292,14 +14823,14 @@ function checkStaticServeDir(manifestPath, manifest) {
   try {
     entries = readdirSync3(abs);
   } catch (e) {
-    return [`failed to read static served directory '${serveDir}/': ${describe30(e)}`];
+    return [`failed to read static served directory '${serveDir}/': ${describe31(e)}`];
   }
   if (entries.length === 0) {
     return [
       `static app's served directory '${serveDir}/' is empty — the deploy would serve an empty site.`
     ];
   }
-  if (!existsSync15(resolve15(abs, "index.html"))) {
+  if (!existsSync16(resolve17(abs, "index.html"))) {
     return [
       `static app's served directory '${serveDir}/' has no index.html — the deploy would serve a directory with no entrypoint.`
     ];
@@ -14347,7 +14878,7 @@ async function checkGroup(allowedGroup, cfg) {
     if (e instanceof ForbiddenError) {
       return { kind: "forbidden", message: e.message };
     }
-    return { kind: "network", message: describe30(e) };
+    return { kind: "network", message: describe31(e) };
   }
 }
 async function checkGroups(groups) {
@@ -14444,6 +14975,8 @@ function renderHumanError(result, io) {
 }
 function renderJsonOk(result, group, boundary, io) {
   const base = {
+    manifest_valid: true,
+    runtime_supported: true,
     name: result.manifest.metadata.name,
     deploymentType: result.manifest.deployment.type,
     appBoundary: {
@@ -14560,7 +15093,7 @@ function parseArgs13(args) {
   }
   return { kind: "ok", file, json, strictGroups };
 }
-function describe30(e) {
+function describe31(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -14613,7 +15146,7 @@ async function runWhoami(args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad whoami failed: ${describe31(e)}`);
+    io.err(`launchpad whoami failed: ${describe32(e)}`);
     return 1;
   }
 }
@@ -14643,11 +15176,11 @@ async function runShare(args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad whoami --share failed: ${describe31(e)}`);
+    io.err(`launchpad whoami --share failed: ${describe32(e)}`);
     return 1;
   }
 }
-function describe31(e) {
+function describe32(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -14813,7 +15346,7 @@ async function runEditor(action, args, io, deps) {
       io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
       return 1;
     }
-    io.err(`launchpad ${verb} failed: ${describe32(e)}`);
+    io.err(`launchpad ${verb} failed: ${describe33(e)}`);
     return 1;
   }
 }
@@ -14847,7 +15380,7 @@ async function sendMutation(action, slug, target, version, cfg, deps) {
     nonThrowingStatuses: [409]
   });
 }
-function describe32(e) {
+function describe33(e) {
   return e instanceof Error ? e.message : String(e);
 }
 var grantEditorCommand = makeEditorCommand("grant");
@@ -15053,7 +15586,7 @@ async function runOwner(action, args, io, deps) {
       io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
       return 1;
     }
-    io.err(`launchpad ${verb} failed: ${describe33(e)}`);
+    io.err(`launchpad ${verb} failed: ${describe34(e)}`);
     return 1;
   }
 }
@@ -15087,12 +15620,92 @@ async function sendMutation2(action, slug, target, version, cfg, deps) {
     nonThrowingStatuses: [409]
   });
 }
-function describe33(e) {
+function describe34(e) {
   return e instanceof Error ? e.message : String(e);
 }
 var addOwnerCommand = makeOwnerCommand("add");
 var removeOwnerCommand = makeOwnerCommand("remove");
 
+// src/commands/admin.ts
+var REAL_DEPS3 = { loadConfig, apiJson };
+var adminCommand = makeAdminCommand();
+function makeAdminCommand(deps = REAL_DEPS3) {
+  return {
+    name: "admin",
+    summary: "run authenticated platform-operator actions",
+    run: (args, io) => runAdmin(args, io, deps)
+  };
+}
+function statusPageUrl(value, allowedHost) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:")
+      return null;
+    if (url.hostname !== allowedHost)
+      return null;
+    if (!/^\/d\/[^/]+$/u.test(url.pathname))
+      return null;
+    if (url.username !== "" || url.password !== "")
+      return null;
+    if (url.search !== "" || url.hash !== "")
+      return null;
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+async function runAdmin(args, io, deps) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp6(io);
+    return 0;
+  }
+  const config = deps.loadConfig();
+  const parsed = parseStatusRevokeArgs(args, config.statusPageHost ?? DEFAULT_STATUS_PAGE_HOST);
+  if (parsed.kind === "unknown") {
+    io.err(`launchpad admin: unknown subcommand '${parsed.subcommand}'`);
+    printHelp6(io);
+    return 64;
+  }
+  if (parsed.kind === "invalid") {
+    io.err("launchpad admin: expected `status-revoke <status-url>`");
+    printHelp6(io);
+    return 64;
+  }
+  return revokeStatusPage(parsed.url, config, io, deps);
+}
+function parseStatusRevokeArgs(args, allowedHost) {
+  if (args[0] !== undefined && args[0] !== "status-revoke") {
+    return { kind: "unknown", subcommand: args[0] };
+  }
+  if (args.length !== 2)
+    return { kind: "invalid" };
+  const url = statusPageUrl(args[1], allowedHost);
+  return url === null ? { kind: "invalid" } : { kind: "ok", url };
+}
+async function revokeStatusPage(url, config, io, deps) {
+  try {
+    const response = await deps.apiJson(config, {
+      method: "POST",
+      path: "/status-page/revoke",
+      jsonBody: { url }
+    });
+    io.out(statusRevokeMessage(response));
+    return 0;
+  } catch (error) {
+    io.err(`launchpad admin status-revoke: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+function statusRevokeMessage(response) {
+  return response.revoked ? "Status page revoked." : "Status page was already absent.";
+}
+function printHelp6(io) {
+  io.out("launchpad admin - authenticated platform-operator actions.");
+  io.out("");
+  io.out("Usage:");
+  io.out("  launchpad admin status-revoke <status-url>");
+}
+
 // src/commands/list-owners.ts
 function realDeps4() {
   return { loadConfig, apiJson };
@@ -15168,9 +15781,9 @@ var listOwnersCommand = makeListOwnersCommand();
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync21,
   writeFileSync as writeFileSync8
@@ -15178,7 +15791,7 @@ import {
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
-var CACHE_FILE = join17(homedir4(), ".launchpad", "update-check.json");
+var CACHE_FILE = join18(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
     const raw = JSON.parse(readFileSync21(CACHE_FILE, "utf8"));
@@ -15194,22 +15807,22 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync4(join17(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
-var SKILLS_HINT_MARKER = join17(homedir4(), ".launchpad", "skills-hint-shown");
+var SKILLS_HINT_MARKER = join18(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
-    return existsSync16(SKILLS_HINT_MARKER);
+    return existsSync17(SKILLS_HINT_MARKER);
   } catch {
     return false;
   }
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync4(join17(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -15312,8 +15925,8 @@ var refreshUpdateCacheCommand = {
 // src/telemetry.ts
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
-import { join as join18 } from "node:path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join19 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -15321,8 +15934,8 @@ var POSTHOG_PROJECT_KEY = "phc_CYaCuETanWc36TMTiB7cdkdnmPPhFZCkDGmWGLaNkXnb";
 var CAPTURE_PATH = "/i/v0/e/";
 var SEND_TIMEOUT_MS = 3000;
 var APP = "launchpad-cli";
-var DEVICE_ID_FILE = join18(homedir5(), ".launchpad", "telemetry-id.json");
-var FIRST_RUN_MARKER = join18(homedir5(), ".launchpad", "telemetry-notice-shown");
+var DEVICE_ID_FILE = join19(homedir5(), ".launchpad", "telemetry-id.json");
+var FIRST_RUN_MARKER = join19(homedir5(), ".launchpad", "telemetry-notice-shown");
 function buildEvent(ctx, identity, nowMs) {
   const properties = {
     app: APP,
@@ -15396,7 +16009,7 @@ function getOrCreateDeviceId() {
   } catch {}
   const id = randomUUID();
   try {
-    mkdirSync5(join18(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
 `, {
       mode: 384
@@ -15467,14 +16080,14 @@ function telemetryNoticeLine() {
 }
 function firstRunNoticeShown() {
   try {
-    return existsSync17(FIRST_RUN_MARKER);
+    return existsSync18(FIRST_RUN_MARKER);
   } catch {
     return false;
   }
 }
 function markFirstRunNotice() {
   try {
-    mkdirSync5(join18(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(FIRST_RUN_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -15542,14 +16155,14 @@ import { platform } from "node:os";
 // src/report/breadcrumb.ts
 import { writeFileSync as writeFileSync10, readFileSync as readFileSync23, mkdirSync as mkdirSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join19, dirname as dirname12 } from "node:path";
+import { join as join20, dirname as dirname13 } from "node:path";
 function breadcrumbPath() {
-  return join19(homedir6(), ".launchpad", "last-run.json");
+  return join20(homedir6(), ".launchpad", "last-run.json");
 }
 function writeBreadcrumb(verb, exit) {
   try {
     const p = breadcrumbPath();
-    mkdirSync6(dirname12(p), { recursive: true });
+    mkdirSync6(dirname13(p), { recursive: true });
     writeFileSync10(p, JSON.stringify({ verb, exit, ts: Date.now() }), "utf8");
   } catch {}
 }
@@ -15749,6 +16362,7 @@ var COMMANDS = [
   addOwnerCommand,
   removeOwnerCommand,
   listOwnersCommand,
+  adminCommand,
   makeReportCommand("bug"),
   makeReportCommand("feature"),
   refreshUpdateCacheCommand,
@@ -15756,7 +16370,7 @@ var COMMANDS = [
 ];
 async function dispatch(argv, io, commands = COMMANDS, deps = {}) {
   if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
-    printHelp6(io, commands);
+    printHelp7(io, commands);
     return 0;
   }
   if (argv[0] === "--version" || argv[0] === "-v") {
@@ -15819,9 +16433,11 @@ function requiresCliFloorPreflight(verb, args) {
     return args[0] === "set" || args[0] === "rm";
   if (verb === "secrets")
     return args[0] === "push";
+  if (verb === "admin")
+    return args[0] === "status-revoke";
   return false;
 }
-function printHelp6(io, commands) {
+function printHelp7(io, commands) {
   io.out("launchpad — manage Launchpad-deployed apps from the command line.");
   io.out("");
   io.out("Usage:");