@m-kopa/launchpad-cli 0.54.1 → 0.56.0

package/dist/cli.js

@@ -19,34 +19,49 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.54.1";
+var CLI_VERSION = "0.56.0";
 
 // src/config.ts
+import { readFileSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 var DEFAULT_BOT_URL = "https://launchpad-portal-bot.mkopa-launchpad.workers.dev";
 var DEFAULT_AUTH_GATEWAY_URL = "https://auth.launchpad.m-kopa.us";
+var DEFAULT_STATUS_PAGE_HOST = "status.launchpad.m-kopa.us";
 function loadConfig(env = process.env) {
   const rawBotUrl = env.LAUNCHPAD_BOT_URL ?? DEFAULT_BOT_URL;
   const botUrl = rawBotUrl.replace(/\/+$/, "");
   const rawGatewayUrl = env.LAUNCHPAD_AUTH_GATEWAY_URL ?? DEFAULT_AUTH_GATEWAY_URL;
   const authGatewayUrl = rawGatewayUrl.replace(/\/+$/, "");
+  const statusPageHost = (env.LAUNCHPAD_STATUS_PAGE_HOST ?? DEFAULT_STATUS_PAGE_HOST).trim().toLowerCase();
   const authLegacy = env.LAUNCHPAD_AUTH_LEGACY === "1";
   const sessionPath = env.LAUNCHPAD_SESSION_PATH ?? path.join(os.homedir(), ".launchpad", "session.json");
   const cacheDir = env.LAUNCHPAD_CACHE_DIR ?? path.join(os.homedir(), ".launchpad", "cache");
   const stateDir = env.LAUNCHPAD_STATE_DIR ?? path.join(os.homedir(), ".launchpad", "state");
   const rawPlatformRepo = env.LAUNCHPAD_PLATFORM_REPO;
   const platformRepoPath = rawPlatformRepo !== undefined && rawPlatformRepo.length > 0 ? path.resolve(rawPlatformRepo) : null;
+  const configPath = env.LAUNCHPAD_CONFIG_PATH ?? path.join(os.homedir(), ".launchpad", "config.json");
+  const statusPageAutoOpen = readStatusPageAutoOpen(configPath);
   return {
     botUrl,
     authGatewayUrl,
+    statusPageHost,
     authLegacy,
     sessionPath,
     cacheDir,
     stateDir,
-    platformRepoPath
+    platformRepoPath,
+    statusPageAutoOpen
   };
 }
+function readStatusPageAutoOpen(configPath) {
+  try {
+    const value = JSON.parse(readFileSync(configPath, "utf8"));
+    return !(typeof value === "object" && value !== null && value.statusPageAutoOpen === false);
+  } catch (error) {
+    return error.code === "ENOENT";
+  }
+}
 
 // src/http/error-envelope.ts
 var MAX_TEXT_CHARS = 16384;
@@ -1871,7 +1886,7 @@ import { existsSync as existsSync7 } from "node:fs";
 import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { join as join7 } from "node:path";
 
 // src/deploy/tar-pack.ts
@@ -2183,7 +2198,8 @@ function deployBundleError(envelope, body) {
     ...paths === undefined ? {} : { paths },
     ...typeof body.reason === "string" ? { reason: body.reason } : {},
     ...typeof body.minimum === "string" ? { minimum: body.minimum } : {},
-    ...typeof body.yours === "string" ? { yours: body.yours } : {}
+    ...typeof body.yours === "string" ? { yours: body.yours } : {},
+    ...typeof body.statusPageUrl === "string" ? { statusPageUrl: body.statusPageUrl } : {}
   };
 }
 function readStringArray(value) {
@@ -2207,7 +2223,7 @@ function isRecord2(value) {
 }
 
 // src/bundle/cwd-walker.ts
-import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync as readFileSync2, readdirSync } from "node:fs";
 import { join as join4, relative as relative2, sep } from "node:path";
 var DEFAULT_IGNORE = [
   ".git",
@@ -2313,7 +2329,7 @@ function loadIgnore(cwd) {
   }
   let content;
   try {
-    content = readFileSync(file, "utf8");
+    content = readFileSync2(file, "utf8");
   } catch {
     return { matches: () => false };
   }
@@ -2387,7 +2403,7 @@ function globToRegExp(glob) {
 }
 
 // src/bundle/cron-bundle.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 import { dirname as dirname4, join as join5, resolve as resolve5 } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { build as esbuild } from "esbuild";
@@ -2467,7 +2483,7 @@ function locateWorkerConfig(cwd, walkFiles, script) {
     const abs = resolve5(cwd, rel);
     let text;
     try {
-      text = readFileSync2(abs, "utf8");
+      text = readFileSync3(abs, "utf8");
     } catch {
       continue;
     }
@@ -2546,7 +2562,7 @@ async function buildWorkerArtifact(cwd, manifestYaml, walkFiles) {
 }
 
 // src/bundle/boundary.ts
-import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 import { parse as parseYaml2 } from "yaml";
 
@@ -3469,6 +3485,19 @@ var ManifestV2Schema = z2.object({
   spec: SpecSchema,
   status: StatusSchema.optional()
 }).strict();
+function parseManifestV2(input) {
+  const result = ManifestV2Schema.safeParse(input);
+  if (result.success) {
+    return { kind: "ok", manifest: result.data };
+  }
+  return {
+    kind: "schema-error",
+    issues: result.error.issues.map((issue) => ({
+      path: issue.path.map(String).join(".") || "(root)",
+      message: issue.message
+    }))
+  };
+}
 // ../launchpad-engine/dist/secrets-audit.js
 function auditSecretPresence(bindings, surfaces) {
   const byId = new Map(surfaces.map((s) => [s.id, s]));
@@ -3588,298 +3617,569 @@ function deriveResources(m) {
   }
   return items;
 }
-// ../launchpad-engine/dist/wrangler.js
-var DEFAULT_COMPATIBILITY_DATE = "2026-05-01";
-var DEFAULT_COMPATIBILITY_FLAGS = ["nodejs_compat"];
-function generateWranglerToml(manifest) {
-  if (manifest.deployment.type !== "container") {
+// ../launchpad-engine/dist/container-runtime-capability.js
+var MAX_PATH_BYTES = 256;
+var MAX_ENV_NAMES = 64;
+var MAX_ENV_NAME_BYTES = 64;
+var CONTAINER_NAME = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+var ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
+var IMAGE_SEGMENT = /^[A-Za-z0-9._-]+$/;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
+var RESERVED_ENV_PREFIXES = ["LAUNCHPAD_", "CF_ACCESS_", "CLOUDFLARE_"];
+var RESERVED_ENV_NAMES = new Set([
+  "BINDINGS_PROXY_SECRET",
+  "BINDINGS_PROXY_URL"
+]);
+function validateDeploymentCapability(manifest) {
+  const view = deploymentView(manifest);
+  if (view.type !== "container") {
     return {
-      kind: "not-applicable",
-      reason: `deployment.type '${manifest.deployment.type}' does not use wrangler.toml`
+      kind: "supported",
+      manifestValid: true,
+      runtimeSupported: true,
+      runtime: "pages"
     };
   }
-  const containers = manifest.containers ?? [];
-  if (containers.length === 0) {
+  if (view.containers.length !== 1) {
+    return unsupported("unsupported_container_topology", "containers", `the container runtime supports exactly one container; found ${view.containers.length}`);
+  }
+  const container = view.containers[0];
+  if (byteLength(container.name) > 32 || container.name.length < 2 || !CONTAINER_NAME.test(container.name)) {
+    return unsupported("invalid_container_name", "containers.0.name", "container name must be a 2-32 character lowercase slug");
+  }
+  if (container.port < 1024 || container.port > 65535) {
+    return unsupported("unsupported_container_port", "containers.0.port", "container port must be between 1024 and 65535");
+  }
+  if (!validImagePath(container.image)) {
+    return unsupported("invalid_container_image", "containers.0.image", "container image must be a contained repository-relative Dockerfile path beginning ./");
+  }
+  if (!validHealthcheck(container.healthcheck)) {
+    return unsupported("invalid_container_healthcheck", "containers.0.healthcheck", "container healthcheck must be a simple absolute path without traversal, query, or fragment");
+  }
+  const environmentNames = container.env ?? [];
+  if (environmentNames.length > MAX_ENV_NAMES) {
+    return unsupported("too_many_container_environment_names", "containers.0.env", `container env may contain at most ${MAX_ENV_NAMES} names`);
+  }
+  const seen = new Set;
+  const bindingName = containerBindingName(container.name);
+  for (let index = 0;index < environmentNames.length; index += 1) {
+    const name = environmentNames[index];
+    const path7 = `containers.0.env.${index}`;
+    if (byteLength(name) > MAX_ENV_NAME_BYTES || !ENV_NAME.test(name)) {
+      return unsupported("invalid_container_environment_name", path7, "container environment names must be at most 64 bytes and use UPPER_SNAKE_CASE");
+    }
+    if (seen.has(name)) {
+      return unsupported("duplicate_container_environment_name", path7, `container environment name '${name}' is duplicated`);
+    }
+    seen.add(name);
+    if (RESERVED_ENV_NAMES.has(name) || RESERVED_ENV_PREFIXES.some((prefix) => name.startsWith(prefix)) || name === bindingName) {
+      return unsupported("reserved_container_environment_name", path7, `container environment name '${name}' is owned by the Launchpad runtime`);
+    }
+  }
+  return {
+    kind: "supported",
+    manifestValid: true,
+    runtimeSupported: true,
+    runtime: "container",
+    capability: {
+      appName: view.appName,
+      apiVersion: manifest.apiVersion,
+      container,
+      className: containerClassName(view.appName),
+      bindingName,
+      dockerfilePathFromContainerDirectory: `../${container.image.slice(2)}`,
+      environmentNames
+    }
+  };
+}
+function containerClassName(containerName) {
+  return `AppContainer${containerName.split("-").map(capitalise).join("")}`;
+}
+function containerBindingName(containerName) {
+  return `APP_CONTAINER_${containerName.split("-").map((part) => part.toUpperCase()).join("_")}`;
+}
+function deploymentView(manifest) {
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2") {
     return {
-      kind: "ok",
-      content: emit(manifest, []),
-      warnings: ["container manifest has no containers[] — emitting empty TOML"]
+      type: manifest.spec.appType,
+      appName: manifest.metadata.slug,
+      containers: manifest.spec.containers ?? []
     };
   }
-  return { kind: "ok", content: emit(manifest, containers), warnings: [] };
+  return {
+    type: manifest.deployment.type,
+    appName: manifest.metadata.name,
+    containers: manifest.containers ?? []
+  };
 }
-function emit(manifest, containers) {
-  const lines = [];
-  const header = `# Auto-generated by @krsecurity/launchpad-engine. Do not edit by hand.
-# Source: launchpad.yaml (apiVersion: ${manifest.apiVersion})
-# App:    ${manifest.metadata.name}
-#
-# Regenerate with \`launchpad generate\` (\`launchpad deploy\` also
-# re-emits before applying). Manual edits are overwritten on the
-# next regeneration. Manifest is the source of truth — change
-# ${manifest.metadata.name}/launchpad.yaml instead.`;
-  lines.push(header);
-  lines.push("");
-  lines.push(`name = "${escapeTomlString(manifest.metadata.name)}"`);
-  lines.push(`main = "worker/index.ts"`);
-  lines.push(`compatibility_date = "${DEFAULT_COMPATIBILITY_DATE}"`);
-  lines.push(`compatibility_flags = [${DEFAULT_COMPATIBILITY_FLAGS.map((f) => `"${escapeTomlString(f)}"`).join(", ")}]`);
-  lines.push("");
-  lines.push("# Workers Logs (PATTERNS.md: non-optional for container apps).");
-  lines.push("[observability]");
-  lines.push("enabled = true");
-  lines.push("head_sampling_rate = 1.0");
-  lines.push("");
-  lines.push("# Platform-managed runtime config. Populated by the deploy");
-  lines.push("# workflow via `wrangler deploy --var KEY:VALUE`. Secrets");
-  lines.push("# (declared in launchpad.yaml secrets.bindings[]) go through");
-  lines.push("# `wrangler secret put` and are NOT here.");
-  lines.push("[vars]");
-  lines.push(`CF_ACCESS_AUD = ""`);
-  lines.push(`CF_ACCESS_TEAM_DOMAIN = ""`);
-  lines.push("");
-  for (const c of containers) {
-    const className = containerClassName(c.name);
-    const maxInstances = c.max_instances ?? 1;
-    lines.push("[[containers]]");
-    lines.push(`class_name    = "${className}"`);
-    lines.push(`image         = "${escapeTomlString(c.image)}"`);
-    lines.push(`max_instances = ${maxInstances}`);
-    lines.push("");
+function validImagePath(path7) {
+  if (byteLength(path7) > MAX_PATH_BYTES || !path7.startsWith("./") || path7.includes("\\") || CONTROL_CHARACTER.test(path7)) {
+    return false;
   }
-  for (const c of containers) {
-    const className = containerClassName(c.name);
-    const bindingName = containerBindingName(c.name);
-    lines.push("[[durable_objects.bindings]]");
-    lines.push(`name       = "${bindingName}"`);
-    lines.push(`class_name = "${className}"`);
-    lines.push("");
+  const segments = path7.slice(2).split("/");
+  return segments.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && IMAGE_SEGMENT.test(segment));
+}
+function validHealthcheck(path7) {
+  if (byteLength(path7) === 0 || byteLength(path7) > MAX_PATH_BYTES || !path7.startsWith("/") || path7.includes("\\") || path7.includes("?") || path7.includes("#") || CONTROL_CHARACTER.test(path7)) {
+    return false;
   }
-  lines.push("# Fresh-deploy migration. Container-enabled DOs MUST be");
-  lines.push("# SQLite-backed (ADR 0015 #4/#5 — non-sqlite fails [code: 10074]).");
-  lines.push("# Re-shaping containers on a live app needs a v2 migration");
-  lines.push("# block; the engine's TF-state-aware migration generator lands");
-  lines.push("# with Scope 8 drift detection.");
-  lines.push("[[migrations]]");
-  lines.push(`tag                = "v1"`);
-  const classNames = containers.map((c) => `"${containerClassName(c.name)}"`);
-  lines.push(`new_sqlite_classes = [${classNames.join(", ")}]`);
-  lines.push("");
+  const segments = path7.slice(1).split("/");
+  return segments.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+function byteLength(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function capitalise(value) {
+  if (value.length === 0)
+    return value;
+  return value[0].toUpperCase() + value.slice(1);
+}
+function unsupported(reason, path7, message) {
+  return {
+    kind: "unsupported",
+    manifestValid: true,
+    runtimeSupported: false,
+    reason,
+    path: path7,
+    message
+  };
+}
+// ../launchpad-engine/dist/container-worker.js
+function generateContainerWorker(manifest) {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported") {
+    return {
+      kind: "unsupported",
+      reason: result.reason,
+      message: result.message
+    };
+  }
+  if (result.runtime !== "container") {
+    return {
+      kind: "not-applicable",
+      reason: "pages runtimes do not use the generated container Worker"
+    };
+  }
+  return { kind: "ok", content: emit(result.capability) };
+}
+function emit(capability) {
+  const app = JSON.stringify(capability.appName);
+  const className = capability.className;
+  const bindingName = capability.bindingName;
+  const environmentFields = capability.environmentNames.map((name) => `  ${name}: string;`);
+  const environmentValues = capability.environmentNames.map((name) => `    ${name}: this.env.${name} ?? "",`);
+  const lines = [
+    "/**",
+    " * Auto-generated by @m-kopa/launchpad-engine.",
+    " * Source: launchpad.yaml. Do not edit by hand.",
+    " */",
+    'import { Container } from "@cloudflare/containers";',
+    "import {",
+    "  AccessJwtVerificationError,",
+    "  createJwksCache,",
+    "  parseAccessJwtFromHeaders,",
+    "  verifyAccessJwt,",
+    "  type User,",
+    '} from "@m-kopa/platform-auth";',
+    "",
+    "type Env = {",
+    `  ${bindingName}: DurableObjectNamespace<${className}>;`,
+    "  BINDINGS_PROXY_SECRET: string;",
+    "  CF_ACCESS_AUD: string;",
+    "  CF_ACCESS_TEAM_DOMAIN: string;",
+    "  LAUNCHPAD_DEPLOYMENT_SHA: string;",
+    ...environmentFields,
+    "};",
+    "",
+    `export class ${className} extends Container<Env> {`,
+    `  defaultPort = ${capability.container.port};`,
+    '  sleepAfter = "5m";',
+    ...environmentValues.length === 0 ? [] : ["", "  envVars = {", ...environmentValues, "  };"],
+    "}",
+    "",
+    "let jwksCache: ReturnType<typeof createJwksCache> | null = null;",
+    "",
+    "function jwks(env: Env): ReturnType<typeof createJwksCache> {",
+    "  if (jwksCache === null) {",
+    "    jwksCache = createJwksCache(",
+    "      `https://${env.CF_ACCESS_TEAM_DOMAIN}/cdn-cgi/access/certs`,",
+    "    );",
+    "  }",
+    "  return jwksCache;",
+    "}",
+    "",
+    "function unauthenticated(code: string): Response {",
+    "  return Response.json(",
+    '    { error: "unauthenticated", code },',
+    '    { status: 401, headers: { "cache-control": "no-store" } },',
+    "  );",
+    "}",
+    "",
+    "async function secretsEqual(left: string, right: string): Promise<boolean> {",
+    "  const encoder = new TextEncoder();",
+    "  const [leftDigest, rightDigest] = await Promise.all([",
+    '    crypto.subtle.digest("SHA-256", encoder.encode(left)),',
+    '    crypto.subtle.digest("SHA-256", encoder.encode(right)),',
+    "  ]);",
+    "  const leftBytes = new Uint8Array(leftDigest);",
+    "  const rightBytes = new Uint8Array(rightDigest);",
+    "  let difference = 0;",
+    "  for (let index = 0; index < leftBytes.length; index += 1) {",
+    "    difference |= leftBytes[index]! ^ rightBytes[index]!;",
+    "  }",
+    "  return difference === 0;",
+    "}",
+    "",
+    "async function authenticate(request: Request, env: Env): Promise<User | Response> {",
+    "  if (!env.CF_ACCESS_TEAM_DOMAIN || !env.CF_ACCESS_AUD) {",
+    '    return unauthenticated("auth_unconfigured");',
+    "  }",
+    "  const token = parseAccessJwtFromHeaders(request.headers);",
+    "  if (token === null) {",
+    '    return unauthenticated("access_jwt_missing");',
+    "  }",
+    "  try {",
+    "    return await verifyAccessJwt(token, {",
+    "      teamDomain: `https://${env.CF_ACCESS_TEAM_DOMAIN}`,",
+    "      audience: env.CF_ACCESS_AUD,",
+    "      jwks: jwks(env),",
+    "      clockTolerance: 30,",
+    "    });",
+    "  } catch (error) {",
+    "    if (error instanceof AccessJwtVerificationError) {",
+    "      return unauthenticated(error.code);",
+    "    }",
+    '    console.error(JSON.stringify({ event: "container_runtime_error", kind: "access_jwt_verification_failed" }));',
+    '    return unauthenticated("access_jwt_verification_failed");',
+    "  }",
+    "}",
+    "",
+    "function forwardedRequest(",
+    "  request: Request,",
+    "  user: User,",
+    "  env: Env,",
+    "  requestId: string,",
+    "): Request {",
+    "  const url = new URL(request.url);",
+    "  const headers = new Headers(request.headers);",
+    "  for (const name of Array.from(headers.keys())) {",
+    "    const lower = name.toLowerCase();",
+    "    if (",
+    '      lower.startsWith("cf-access-") ||',
+    '      lower.startsWith("x-user-") ||',
+    '      lower.startsWith("x-bindings-proxy-") ||',
+    '      lower === "x-request-id"',
+    "    ) {",
+    "      headers.delete(name);",
+    "    }",
+    "  }",
+    '  headers.set("X-User-Sub", user.sub);',
+    '  headers.set("X-User-Email", user.preferredUsername);',
+    "  if (user.groups.length > 0) {",
+    '    headers.set("X-User-Groups", user.groups.join(","));',
+    "  }",
+    '  headers.set("X-Request-ID", requestId);',
+    '  headers.set("X-Bindings-Proxy-Secret", env.BINDINGS_PROXY_SECRET);',
+    '  headers.set("X-Bindings-Proxy-Url", `${url.origin}/__platform/bindings`);',
+    "  return new Request(url.toString(), {",
+    "    method: request.method,",
+    "    headers,",
+    '    body: request.method === "GET" || request.method === "HEAD" ? undefined : request.body,',
+    "    redirect: request.redirect,",
+    "  });",
+    "}",
+    "",
+    "function runtimeEvent(",
+    "  env: Env,",
+    "  requestId: string,",
+    "  status: number,",
+    "  kind: string,",
+    "): void {",
+    "  console.log(JSON.stringify({",
+    '    event: "container_runtime_dispatch",',
+    `    slug: ${app},`,
+    "    deployment_sha: env.LAUNCHPAD_DEPLOYMENT_SHA,",
+    "    request_id: requestId,",
+    `    class_name: ${JSON.stringify(className)},`,
+    `    binding_name: ${JSON.stringify(bindingName)},`,
+    "    status,",
+    "    kind,",
+    "  }));",
+    "}",
+    "",
+    "export default {",
+    "  async fetch(request: Request, env: Env): Promise<Response> {",
+    "    const url = new URL(request.url);",
+    "    const requestId = crypto.randomUUID();",
+    '    if (request.method === "GET" && url.pathname === "/health") {',
+    '      const response = Response.json({ ok: true, role: "worker" });',
+    '      runtimeEvent(env, requestId, response.status, "worker_health");',
+    "      return response;",
+    "    }",
+    '    if (url.pathname === "/__platform/bindings" || url.pathname.startsWith("/__platform/bindings/")) {',
+    '      const presented = request.headers.get("x-bindings-proxy-secret");',
+    "      if (!env.BINDINGS_PROXY_SECRET || !presented || !(await secretsEqual(presented, env.BINDINGS_PROXY_SECRET))) {",
+    '        const response = Response.json({ error: "forbidden" }, { status: 403 });',
+    '        runtimeEvent(env, requestId, response.status, "bindings_forbidden");',
+    "        return response;",
+    "      }",
+    '      const response = Response.json({ error: "unknown_binding_endpoint" }, { status: 404 });',
+    '      runtimeEvent(env, requestId, response.status, "bindings_unknown");',
+    "      return response;",
+    "    }",
+    "    const identity = await authenticate(request, env);",
+    "    if (identity instanceof Response) {",
+    '      runtimeEvent(env, requestId, identity.status, "authentication_failed");',
+    "      return identity;",
+    "    }",
+    `    const id = env.${bindingName}.idFromName("singleton");`,
+    `    const response = await env.${bindingName}.get(id).fetch(`,
+    "      forwardedRequest(request, identity, env, requestId),",
+    "    );",
+    '    runtimeEvent(env, requestId, response.status, "container_response");',
+    "    return response;",
+    "  },",
+    "};",
+    ""
+  ];
   return lines.join(`
 `);
 }
-function containerClassName(manifestName) {
-  return "AppContainer" + manifestName.split("-").map(capitalise).join("");
-}
-function containerBindingName(manifestName) {
-  return "APP_CONTAINER_" + manifestName.split("-").map((p) => p.toUpperCase()).join("_");
+// ../launchpad-engine/dist/wrangler.js
+var DEFAULT_COMPATIBILITY_DATE = "2026-05-01";
+var DEFAULT_COMPATIBILITY_FLAGS = ["nodejs_compat"];
+function generateWranglerToml(manifest) {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported") {
+    return {
+      kind: "unsupported",
+      reason: result.reason,
+      message: result.message
+    };
+  }
+  if (result.runtime !== "container") {
+    return {
+      kind: "not-applicable",
+      reason: "pages runtimes do not use container/wrangler.toml"
+    };
+  }
+  return { kind: "ok", content: emit2(result.capability), warnings: [] };
 }
-function capitalise(s) {
-  if (s.length === 0)
-    return s;
-  return s[0].toUpperCase() + s.slice(1);
+function emit2(capability) {
+  const maxInstances = capability.container.max_instances ?? 1;
+  return [
+    "# Auto-generated by @m-kopa/launchpad-engine. Do not edit by hand.",
+    `# Source: launchpad.yaml (apiVersion: ${capability.apiVersion})`,
+    `# App:    ${capability.appName}`,
+    "",
+    `name = "${escapeTomlString(capability.appName)}"`,
+    'main = "worker/index.ts"',
+    `compatibility_date = "${DEFAULT_COMPATIBILITY_DATE}"`,
+    `compatibility_flags = [${DEFAULT_COMPATIBILITY_FLAGS.map((flag) => `"${flag}"`).join(", ")}]`,
+    "",
+    "[observability]",
+    "enabled = true",
+    "head_sampling_rate = 1.0",
+    "",
+    "[vars]",
+    'CF_ACCESS_AUD = ""',
+    'CF_ACCESS_TEAM_DOMAIN = ""',
+    'LAUNCHPAD_DEPLOYMENT_SHA = ""',
+    "",
+    "[[containers]]",
+    `class_name = "${capability.className}"`,
+    `image = "${escapeTomlString(capability.dockerfilePathFromContainerDirectory)}"`,
+    `max_instances = ${maxInstances}`,
+    "",
+    "[[durable_objects.bindings]]",
+    `name = "${capability.bindingName}"`,
+    `class_name = "${capability.className}"`,
+    "",
+    "[[migrations]]",
+    'tag = "v1"',
+    `new_sqlite_classes = ["${capability.className}"]`,
+    ""
+  ].join(`
+`);
 }
-function escapeTomlString(s) {
-  return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+function escapeTomlString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
 }
 // ../launchpad-engine/dist/github-workflow.js
-var DEFAULT_WORKERS_SUBDOMAIN = "mkopa-launchpad.workers.dev";
-var DEFAULT_BUN_VERSION = "1.3.4";
+var DEFAULT_NODE_VERSION = "22";
 var ACTIONS_CHECKOUT_SHA = "de0fac2e4500dabe0009e67214ff5f5447ce83dd";
-var SETUP_BUN_SHA = "0c5077e51419868618aeaa5fe8019c62421857d6";
+var ACTIONS_SETUP_NODE_SHA = "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e";
 function generateGithubDeployWorkflow(manifest) {
-  if (manifest.deployment.type !== "container") {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported") {
     return {
-      kind: "not-applicable",
-      reason: `deployment.type '${manifest.deployment.type}' has no engine-generated deploy workflow yet`
+      kind: "unsupported",
+      reason: result.reason,
+      message: result.message
     };
   }
-  const bindings = manifest.secrets?.bindings ?? [];
-  const warnings = [];
-  if ((manifest.containers ?? []).length === 0) {
-    warnings.push("container manifest has no containers[] — workflow will deploy an empty Worker");
+  if (result.runtime !== "container") {
+    return {
+      kind: "not-applicable",
+      reason: "pages runtimes do not use the container deploy workflow"
+    };
   }
-  return {
-    kind: "ok",
-    content: emit2(manifest, bindings),
-    warnings
-  };
+  return { kind: "ok", content: emit3(result.capability), warnings: [] };
 }
-function emit2(manifest, bindings) {
-  const appName = manifest.metadata.name;
-  const lines = [];
-  lines.push(`# Auto-generated by @krsecurity/launchpad-engine. Do not edit by hand.`);
-  lines.push(`# Source: launchpad.yaml (apiVersion: ${manifest.apiVersion})`);
-  lines.push(`# App:    ${appName}`);
-  lines.push(`#`);
-  lines.push(`# Regenerate with \`launchpad generate\` (\`launchpad deploy\` also`);
-  lines.push(`# re-emits before applying). Manual edits are overwritten on the`);
-  lines.push(`# next regeneration. Manifest is the source of truth — change`);
-  lines.push(`# ${appName}/launchpad.yaml instead.`);
-  lines.push("");
-  lines.push(`name: deploy`);
-  lines.push("");
-  lines.push(`on:`);
-  lines.push(`  push:`);
-  lines.push(`    branches:`);
-  lines.push(`      - main`);
-  lines.push(`  workflow_dispatch:`);
-  lines.push("");
-  lines.push(`permissions:`);
-  lines.push(`  contents: read`);
-  lines.push(`  id-token: write`);
-  lines.push(`  packages: read`);
-  lines.push("");
-  lines.push(`concurrency:`);
-  lines.push(`  group: deploy-\${{ github.workflow }}-\${{ vars.LAUNCHPAD_APP_RUNTIME || 'production' }}`);
-  lines.push(`  cancel-in-progress: false`);
-  lines.push("");
-  lines.push(`defaults:`);
-  lines.push(`  run:`);
-  lines.push(`    # Container-shape apps keep wrangler.toml + Worker source +`);
-  lines.push(`    # per-container Dockerfiles under container/. Engine convention.`);
-  lines.push(`    working-directory: container`);
-  lines.push("");
-  lines.push(`jobs:`);
-  lines.push(`  deploy:`);
-  lines.push(`    name: deploy`);
-  lines.push(`    runs-on: ubuntu-latest`);
-  lines.push(`    environment: \${{ vars.LAUNCHPAD_APP_RUNTIME || 'production' }}`);
-  lines.push(`    steps:`);
-  lines.push(`      - uses: actions/checkout@${ACTIONS_CHECKOUT_SHA}  # v6.0.2`);
-  lines.push("");
-  lines.push(`      - uses: oven-sh/setup-bun@${SETUP_BUN_SHA}  # v2`);
-  lines.push(`        with:`);
-  lines.push(`          bun-version: "${DEFAULT_BUN_VERSION}"`);
-  lines.push("");
-  lines.push(`      - name: Install dependencies`);
-  lines.push(`        env:`);
-  lines.push(`          NODE_AUTH_TOKEN: \${{ secrets.NODE_AUTH_TOKEN }}`);
-  lines.push(`        run: bun install --ignore-scripts`);
-  lines.push("");
-  lines.push(`      - name: Deploy Worker + container images`);
-  lines.push(`        # --var KEY:VALUE overrides the placeholder [vars] block in`);
-  lines.push(`        # wrangler.toml. Missing either CF_ACCESS_* var trips the`);
-  lines.push(`        # Worker's auth_unconfigured fail-closed branch on every`);
-  lines.push(`        # request. Multi-container deploys build + push every`);
-  lines.push(`        # [[containers]] block; total time scales linearly.`);
-  lines.push(`        env:`);
-  lines.push(`          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}`);
-  lines.push(`          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}`);
-  lines.push(`        run: |`);
-  lines.push(`          bunx wrangler deploy \\`);
-  lines.push(`            --var "CF_ACCESS_AUD:\${{ vars.CF_ACCESS_AUD }}" \\`);
-  lines.push(`            --var "CF_ACCESS_TEAM_DOMAIN:\${{ vars.CF_ACCESS_TEAM_DOMAIN }}"`);
-  lines.push("");
-  for (const b of bindings) {
-    if (b.source !== "env-file")
-      continue;
-    emitSecretStep(lines, b);
-  }
-  const workerUrl = `https://${appName}.${DEFAULT_WORKERS_SUBDOMAIN}`;
-  lines.push(`      - name: Smoke probe — Worker liveness (via .well-known bypass)`);
-  lines.push(`        # In workers_dev_only mode CF Access intercepts every path`);
-  lines.push(`        # (including /health) with HTTP 302 to the IdP. The only`);
-  lines.push(`        # path that reaches the Worker without an Access JWT is`);
-  lines.push(`        # /.well-known/openid-configuration, gated by a separate`);
-  lines.push(`        # Bypass-policy Access app.`);
-  lines.push(`        #`);
-  lines.push(`        # Outcomes:`);
-  lines.push(`        #   302 → bypass policy missing or misconfigured.`);
-  lines.push(`        #   5xx → Worker is down (deploy bug).`);
-  lines.push(`        #   401 + auth_unconfigured → CF_ACCESS_* vars didn't wire in.`);
-  lines.push(`        #   401 + access_jwt_missing (any other 4xx) → HAPPY PATH.`);
-  lines.push(`        run: |`);
-  lines.push(`          set -euo pipefail`);
-  lines.push(`          URL="${workerUrl}/.well-known/openid-configuration"`);
-  lines.push(`          for i in 1 2 3 4 5; do`);
-  lines.push(`            body_file="$(mktemp)"`);
-  lines.push(`            code=$(curl -sS -o "$body_file" -w "%{http_code}" "$URL" || echo "000")`);
-  lines.push(`            body=$(cat "$body_file")`);
-  lines.push(`            rm -f "$body_file"`);
-  lines.push("");
-  lines.push(`            if [ "$code" = "302" ]; then`);
-  lines.push(`              echo "liveness-probe: bypass policy missing — Access redirected /.well-known/. Attempt $i."`);
-  lines.push(`              sleep 5`);
-  lines.push(`              continue`);
-  lines.push(`            fi`);
-  lines.push(`            if [ "\${code:0:1}" = "5" ] || [ "$code" = "000" ]; then`);
-  lines.push(`              echo "liveness-probe: Worker down (got $code). Attempt $i."`);
-  lines.push(`              sleep 5`);
-  lines.push(`              continue`);
-  lines.push(`            fi`);
-  lines.push(`            if printf '%s' "$body" | grep -q "auth_unconfigured"; then`);
-  lines.push(`              echo "liveness-probe FAIL: Worker is up but in fail-closed misconfig branch — CF_ACCESS_AUD / CF_ACCESS_TEAM_DOMAIN not wired in." >&2`);
-  lines.push(`              echo "body: $body" >&2`);
-  lines.push(`              exit 1`);
-  lines.push(`            fi`);
-  lines.push(`            echo "liveness-probe ok: Worker reachable (HTTP $code), env wired in (no auth_unconfigured)."`);
-  lines.push(`            exit 0`);
-  lines.push(`          done`);
-  lines.push(`          echo "liveness-probe failed after 5 attempts" >&2`);
-  lines.push(`          curl -sSI "$URL" >&2 || true`);
-  lines.push(`          exit 1`);
-  lines.push("");
-  lines.push(`      - name: Smoke probe — frontend route is auth-gated`);
-  lines.push(`        # 302 or 401 prove unauthenticated traffic is blocked.`);
-  lines.push(`        # HTTP 200 here would mean the SPA bundle is publicly`);
-  lines.push(`        # readable — the regression we're catching.`);
-  lines.push(`        run: |`);
-  lines.push(`          set -euo pipefail`);
-  lines.push(`          URL="${workerUrl}/"`);
-  lines.push(`          code=$(curl -sS -o /dev/null -w "%{http_code}" "$URL")`);
-  lines.push(`          case "$code" in`);
-  lines.push(`            302|401)`);
-  lines.push(`              echo "frontend auth-gate ok: HTTP $code on unauthenticated request to /."`);
-  lines.push(`              ;;`);
-  lines.push(`            *)`);
-  lines.push(`              echo "frontend auth-gate regression: expected 302 or 401 on /, got $code" >&2`);
-  lines.push(`              curl -sSI "$URL" >&2 || true`);
-  lines.push(`              exit 1`);
-  lines.push(`              ;;`);
-  lines.push(`          esac`);
-  lines.push("");
-  lines.push(`      - name: Smoke probe — backend route is auth-gated`);
-  lines.push(`        # Same logic as the frontend probe; confirms /api/* surface`);
-  lines.push(`        # is gated. A 200 here would be the worse regression:`);
-  lines.push(`        # backend data leaked unauthenticated.`);
-  lines.push(`        run: |`);
-  lines.push(`          set -euo pipefail`);
-  lines.push(`          URL="${workerUrl}/api/health"`);
-  lines.push(`          code=$(curl -sS -o /dev/null -w "%{http_code}" "$URL")`);
-  lines.push(`          case "$code" in`);
-  lines.push(`            302|401)`);
-  lines.push(`              echo "backend auth-gate ok: HTTP $code on unauthenticated request to /api/health."`);
-  lines.push(`              ;;`);
-  lines.push(`            *)`);
-  lines.push(`              echo "backend auth-gate regression: expected 302 or 401 on /api/health, got $code" >&2`);
-  lines.push(`              curl -sSI "$URL" >&2 || true`);
-  lines.push(`              exit 1`);
-  lines.push(`              ;;`);
-  lines.push(`          esac`);
-  lines.push("");
+function emit3(capability) {
+  const lines = [
+    "# Auto-generated by @m-kopa/launchpad-engine. Do not edit by hand.",
+    `# Source: launchpad.yaml (apiVersion: ${capability.apiVersion})`,
+    `# App:    ${capability.appName}`,
+    "",
+    "name: deploy",
+    "",
+    "on:",
+    "  push:",
+    "    branches:",
+    "      - main",
+    "  workflow_dispatch:",
+    "",
+    "permissions:",
+    "  contents: read",
+    "",
+    "concurrency:",
+    "  group: deploy-${{ github.workflow }}-${{ github.sha }}",
+    "  cancel-in-progress: false",
+    "",
+    "jobs:",
+    "  authorize:",
+    "    name: authorize exact run attempt",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    `      - uses: actions/checkout@${ACTIONS_CHECKOUT_SHA}  # v6.0.2`,
+    "        with:",
+    "          persist-credentials: false",
+    "",
+    "      - name: Verify protected runtime authorization",
+    "        env:",
+    "          GH_TOKEN: ${{ github.token }}",
+    "        run: |",
+    "          set -euo pipefail",
+    "          record=$(mktemp)",
+    `          trap 'rm -f "$record"' EXIT`,
+    '          api="${{ github.api_url }}/repos/${{ github.repository }}/contents/.launchpad/runtime-control/${GITHUB_SHA}.json?ref=launchpad-runtime-control"',
+    "          for attempt in $(seq 1 60); do",
+    "            if curl --fail --silent --show-error \\",
+    '              -H "Authorization: Bearer ${GH_TOKEN}" \\',
+    '              -H "Accept: application/vnd.github.raw+json" \\',
+    '              -H "X-GitHub-Api-Version: 2022-11-28" \\',
+    '              "$api" > "$record"; then',
+    "              break",
+    "            fi",
+    '            if [ "$attempt" -eq 60 ]; then',
+    '              echo "No exact-run authorization was published" >&2',
+    "              exit 1",
+    "            fi",
+    "            sleep 5",
+    "          done",
+    "          jq -e '",
+    '            (.schema == "launchpad-runtime-control/v1") and',
+    '            (.attempt_id | type == "string" and length > 0) and',
+    '            (.lease_digest | test("^[0-9a-f]{64}$")) and',
+    "            (.commit_sha == env.GITHUB_SHA) and",
+    "            (.run_id == env.GITHUB_RUN_ID) and",
+    "            (.run_attempt == env.GITHUB_RUN_ATTEMPT) and",
+    '            (.expires_at_epoch | type == "number" and . > now)',
+    `          ' "$record" >/dev/null`,
+    "          wrangler_sha=$(sha256sum container/wrangler.toml | cut -d' ' -f1)",
+    "          worker_sha=$(sha256sum container/worker/index.ts | cut -d' ' -f1)",
+    "          workflow_sha=$(sha256sum .github/workflows/deploy.yml | cut -d' ' -f1)",
+    "          jq -e \\",
+    '            --arg wrangler "$wrangler_sha" \\',
+    '            --arg worker "$worker_sha" \\',
+    '            --arg workflow "$workflow_sha" \\',
+    `            '.artifact_digests["container/wrangler.toml"] == $wrangler and`,
+    '             .artifact_digests["container/worker/index.ts"] == $worker and',
+    `             .artifact_digests[".github/workflows/deploy.yml"] == $workflow' \\`,
+    '            "$record" >/dev/null',
+    "",
+    "  deploy:",
+    "    name: deploy admitted runtime",
+    "    needs: authorize",
+    "    runs-on: ubuntu-latest",
+    "    environment: ${{ vars.LAUNCHPAD_APP_RUNTIME || 'production' }}",
+    "    steps:",
+    `      - uses: actions/checkout@${ACTIONS_CHECKOUT_SHA}  # v6.0.2`,
+    "        with:",
+    "          persist-credentials: false",
+    "",
+    `      - uses: actions/setup-node@${ACTIONS_SETUP_NODE_SHA}  # v6.4.0`,
+    "        with:",
+    `          node-version: "${DEFAULT_NODE_VERSION}"`,
+    "          cache: npm",
+    "          cache-dependency-path: |",
+    "            container/package-lock.json",
+    "            container/backend/package-lock.json",
+    "",
+    "      - name: Install frozen Worker dependencies",
+    "        working-directory: container",
+    "        run: npm ci --ignore-scripts",
+    "",
+    "      - name: Install frozen workload dependencies",
+    "        working-directory: container/backend",
+    "        run: npm ci --ignore-scripts",
+    "",
+    "      - name: Verify required deployment inputs",
+    "        env:",
+    "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
+    "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
+    "          CF_ACCESS_AUD: ${{ vars.CF_ACCESS_AUD }}",
+    "          CF_ACCESS_TEAM_DOMAIN: ${{ vars.CF_ACCESS_TEAM_DOMAIN }}",
+    "          BINDINGS_PROXY_SECRET: ${{ secrets.BINDINGS_PROXY_SECRET }}",
+    "          CF_ACCESS_AUD: ${{ vars.CF_ACCESS_AUD }}",
+    "          CF_ACCESS_TEAM_DOMAIN: ${{ vars.CF_ACCESS_TEAM_DOMAIN }}",
+    ...capability.environmentNames.map((name) => `          ${name}: \${{ secrets.${name} }}`),
+    "        run: |",
+    "          set -euo pipefail",
+    "          for name in CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID BINDINGS_PROXY_SECRET CF_ACCESS_AUD CF_ACCESS_TEAM_DOMAIN; do",
+    '            if [ -z "${!name:-}" ]; then',
+    '              echo "Required deployment input $name is empty" >&2',
+    "              exit 1",
+    "            fi",
+    "          done",
+    ...capability.environmentNames.flatMap((name) => [
+      `          if [ -z "\${${name}:-}" ]; then`,
+      `            echo "Required container secret ${name} is empty" >&2`,
+      "            exit 1",
+      "          fi"
+    ]),
+    "",
+    "      - name: Deploy Worker and container image",
+    "        working-directory: container",
+    "        env:",
+    "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
+    "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
+    "        run: |",
+    "          npx --no-install wrangler deploy \\",
+    '            --message "launchpad:${GITHUB_SHA}" \\',
+    '            --tag "launchpad-deployment-sha:${GITHUB_SHA}" \\',
+    '            --var "CF_ACCESS_AUD:${CF_ACCESS_AUD}" \\',
+    '            --var "CF_ACCESS_TEAM_DOMAIN:${CF_ACCESS_TEAM_DOMAIN}" \\',
+    '            --var "LAUNCHPAD_DEPLOYMENT_SHA:${GITHUB_SHA}"',
+    "",
+    ...secretSteps(capability)
+  ];
   return lines.join(`
 `);
 }
-function emitSecretStep(lines, binding) {
-  const name = binding.name;
-  const sourceNote = `env-file binding from launchpad.yaml — operator sets via \`launchpad secrets push\` or \`gh secret set\`.`;
-  lines.push(`      - name: Push ${name} to the Worker`);
-  lines.push(`        # ${sourceNote}`);
-  lines.push(`        # Gated on the GH Actions secret existing so the first deploy`);
-  lines.push(`        # on a fresh repo doesn't fail before secrets are provisioned.`);
-  lines.push(`        # Skipping logs a ::warning:: so the gap shows in the deploy log.`);
-  lines.push(`        env:`);
-  lines.push(`          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}`);
-  lines.push(`          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}`);
-  lines.push(`          ${name}: \${{ secrets.${name} }}`);
-  lines.push(`        run: |`);
-  lines.push(`          if [ -z "\${${name}:-}" ]; then`);
-  lines.push(`            echo "::warning::${name} GH Actions secret is unset — Worker will be missing this binding until the secret is provisioned + this workflow is rerun."`);
-  lines.push(`            exit 0`);
-  lines.push(`          fi`);
-  lines.push(`          printf '%s' "$${name}" | bunx wrangler secret put ${name}`);
-  lines.push("");
+function secretSteps(capability) {
+  return ["BINDINGS_PROXY_SECRET", ...capability.environmentNames].flatMap((name) => [
+    `      - name: Push ${name}`,
+    "        working-directory: container",
+    "        env:",
+    "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
+    "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
+    `          ${name}: \${{ secrets.${name} }}`,
+    "        run: |",
+    `          printf '%s' "$${name}" | npx --no-install wrangler secret put ${name}`,
+    ""
+  ]);
 }
 // ../launchpad-engine/dist/per-app-workspace.js
 var CF_ACCOUNT_ID = "c07cb17c9f742e8144c4828b3693ca65";
@@ -4103,7 +4403,7 @@ function applyBoundaryToFiles(args) {
   const ignorePath = join6(cwd, ".launchpadignore");
   if (existsSync2(ignorePath)) {
     try {
-      launchpadIgnore = parseLaunchpadIgnore(readFileSync3(ignorePath, "utf8"));
+      launchpadIgnore = parseLaunchpadIgnore(readFileSync4(ignorePath, "utf8"));
     } catch {}
   }
   const result = applyAppBoundary(contract, files, {
@@ -4114,7 +4414,7 @@ function applyBoundaryToFiles(args) {
         const stat = lstatSync2(abs);
         if (!stat.isFile() || stat.size > MAX_CONTENT_PROBE_BYTES)
           return;
-        return readFileSync3(abs, "utf8");
+        return readFileSync4(abs, "utf8");
       } catch {
         return;
       }
@@ -4166,7 +4466,7 @@ async function bundleAndDeploy(args) {
   const manifestPath = join7(cwd, "launchpad.yaml");
   let manifestYaml;
   try {
-    manifestYaml = readFileSync4(manifestPath, "utf8");
+    manifestYaml = readFileSync5(manifestPath, "utf8");
   } catch (e) {
     return {
       kind: "no-manifest",
@@ -4228,9 +4528,24 @@ async function bundleAndDeploy(args) {
 }
 
 // src/deploy/verify-deploy.ts
-import { readFileSync as readFileSync8, existsSync as existsSync4 } from "node:fs";
+import { readFileSync as readFileSync9, existsSync as existsSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 
+// src/deploy/redact-diagnostic.ts
+var MAX_DIAGNOSTIC_LEN = 600;
+var SECRET_KV = /(["']?)(\b[A-Za-z0-9_-]*(?:secrets?|token|api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|password|passwd|pwd|authorization|auth[_-]?token|bearer|client[_-]?secret|session)\b)\1(\s*[=:]\s*|\s+)(?:"[^"]*"|'[^']*'|\S+)/gi;
+var LONG_TOKEN = /[A-Za-z0-9_\-+/.]{28,}={0,2}/g;
+function redactDiagnostic(text, maxLen = MAX_DIAGNOSTIC_LEN) {
+  if (text === undefined || text === null)
+    return "";
+  let t = text.replace(SECRET_KV, (_match, quote, key, separator) => `${quote}${key}${quote}${separator}***`);
+  t = t.replace(LONG_TOKEN, "***");
+  t = t.trim();
+  if (t.length > maxLen)
+    t = `${t.slice(0, maxLen - 1)}…`;
+  return t;
+}
+
 // src/deploy/deployment-status.ts
 async function fetchStandingExceptions(cfg, slug, fetcher = fetch) {
   let raw;
@@ -4259,11 +4574,39 @@ async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
   return {
     slug: typeof raw.slug === "string" ? raw.slug : slug,
     supported: raw.supported,
-    liveDeployment: raw.liveDeployment ?? null,
-    lastSuccessfulDeployment: raw.lastSuccessfulDeployment ?? null,
+    liveDeployment: scrubLiveDeployment(raw.liveDeployment ?? null),
+    lastSuccessfulDeployment: projectLastSuccessful(raw.lastSuccessfulDeployment),
     ...raw.reconciledToLive === true ? { reconciledToLive: true } : {}
   };
 }
+function projectLastSuccessful(value) {
+  if (value === null || typeof value !== "object")
+    return null;
+  const raw = value;
+  if (typeof raw.id !== "string" || typeof raw.createdOn !== "string") {
+    return null;
+  }
+  return {
+    id: raw.id,
+    createdOn: raw.createdOn,
+    url: typeof raw.url === "string" ? raw.url : null
+  };
+}
+function scrubLiveDeployment(deployment) {
+  if (deployment === null)
+    return null;
+  return {
+    ...deployment,
+    ...deployment.commit === undefined ? {} : {
+      commit: {
+        ...deployment.commit,
+        message: redactDiagnostic(deployment.commit.message)
+      }
+    },
+    ...deployment.failedStage === undefined ? {} : { failedStage: redactDiagnostic(deployment.failedStage) },
+    ...deployment.logExcerpt === undefined ? {} : { logExcerpt: redactDiagnostic(deployment.logExcerpt) }
+  };
+}
 
 // src/deploy/commit-match-settle.ts
 var DEFAULT_REGISTRATION_BOUND_MS = 120000;
@@ -4429,23 +4772,8 @@ async function verifyServed(args, deps = { fetch }) {
   };
 }
 
-// src/deploy/redact-diagnostic.ts
-var MAX_DIAGNOSTIC_LEN = 600;
-var SECRET_KV = /\b(secret|secrets?|token|api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|password|passwd|pwd|authorization|auth[_-]?token|bearer|client[_-]?secret|session)\b(\s*[=:]\s*|\s+)(\S+)/gi;
-var LONG_TOKEN = /[A-Za-z0-9_\-+/.]{28,}={0,2}/g;
-function redactDiagnostic(text, maxLen = MAX_DIAGNOSTIC_LEN) {
-  if (text === undefined || text === null)
-    return "";
-  let t = text.replace(SECRET_KV, (_m, key, sep2) => `${key}${sep2}***`);
-  t = t.replace(LONG_TOKEN, "***");
-  t = t.trim();
-  if (t.length > maxLen)
-    t = `${t.slice(0, maxLen - 1)}…`;
-  return t;
-}
-
 // src/commands/status.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
@@ -4455,6 +4783,7 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
     slug: raw.slug,
     hasAppFile: raw.hasAppFile,
     lastAppliedManifestSha: raw.lastAppliedManifestSha,
+    deployedManifestSha: raw.deployedManifestSha ?? raw.lastAppliedManifestSha,
     appRepoHeadSha: raw.appRepoHeadSha ?? null,
     openPr: raw.openPr,
     enforcedGroups: raw.enforcedGroups ?? null,
@@ -4464,7 +4793,7 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
 
 // src/commands/infer-slug.ts
 import * as path7 from "node:path";
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
 import { parse as parseYaml3 } from "yaml";
 var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 function inferSlugFromCwd(cwd) {
@@ -4487,7 +4816,7 @@ function inferSlugFromManifestFile(manifestPath) {
   if (!existsSync3(manifestPath))
     return null;
   try {
-    return resolveManifestSlug(parseYaml3(readFileSync5(manifestPath, "utf8")));
+    return resolveManifestSlug(parseYaml3(readFileSync6(manifestPath, "utf8")));
   } catch {
     return null;
   }
@@ -4503,7 +4832,7 @@ function inferSlug(opts) {
 }
 
 // src/groups/client.ts
-import { mkdirSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync as readFileSync7, writeFileSync } from "node:fs";
 import { dirname as dirname5, join as join8 } from "node:path";
 var CACHE_TTL_MS = 60 * 60 * 1000;
 var CACHE_FILENAME = "groups.json";
@@ -4547,7 +4876,7 @@ async function fetchGroups(cfg, opts = {}) {
 function readCache(path8) {
   let raw;
   try {
-    raw = readFileSync6(path8, "utf8");
+    raw = readFileSync7(path8, "utf8");
   } catch {
     return null;
   }
@@ -5183,9 +5512,10 @@ async function runWatch(slug, io, deps = {}) {
   const cfg = loadConfig();
   const now = deps.now ?? (() => Date.now());
   const stdout = deps.stdout ?? process.stdout;
+  const readLifecycle = deps.fetchLifecycle ?? (() => fetchLifecycleView(cfg, slug));
   let first;
   try {
-    first = await fetchLifecycleView(cfg, slug);
+    first = await readLifecycle();
   } catch (e) {
     return mapWatchError(e, slug, io);
   }
@@ -5193,6 +5523,9 @@ async function runWatch(slug, io, deps = {}) {
     io.err(`launchpad watch: no app "${slug}" to watch (unknown slug, or first deploy not started)`);
     return 1;
   }
+  if (first.statusPageUrl !== undefined) {
+    io.out(`Status page: ${first.statusPageUrl}`);
+  }
   if (first.state === "destroyed" || first.state === "destroying" || first.state === "destroy_failed") {
     io.out(`${slug}: ${first.state} — nothing to watch.`);
     return 0;
@@ -5219,7 +5552,7 @@ async function runWatch(slug, io, deps = {}) {
   };
   try {
     const res = await runWatchLoop(slug, {
-      fetchLifecycle: () => fetchLifecycleView(cfg, slug),
+      fetchLifecycle: readLifecycle,
       now,
       sleep: makeRealSleep(),
       signal: controller.signal,
@@ -5256,6 +5589,19 @@ var statusCommand = {
   run: runStatus
 };
 var SLUG_RE3 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+function statusTruthFields(args) {
+  return {
+    slug: args.slug,
+    deployedSha: args.deployedSha,
+    headSha: args.headSha,
+    hasOpenPr: args.openPrNumber !== null,
+    openPrNumber: args.openPrNumber,
+    driftFields: [],
+    driftDetails: [],
+    ...args.deployment !== undefined ? { deployment: args.deployment } : {},
+    ...args.standingExceptions !== undefined ? { standingExceptions: args.standingExceptions } : {}
+  };
+}
 async function fetchLifecycle(cfg, slug) {
   try {
     return await apiJson(cfg, { path: `/apps/${slug}/lifecycle` });
@@ -5304,12 +5650,34 @@ async function runStatus(args, io) {
     return mapBotError(e, parsed.slug, io);
   }
   if (lifecycle !== null && lifecycle.state !== "live") {
-    emit3(lifecycleOutput(parsed.slug, lifecycle), parsed.json, io);
+    let output = lifecycleOutput(parsed.slug, lifecycle);
+    if (lifecycle.state === "failed") {
+      try {
+        const deployment2 = await fetchDeploymentStatus(cfg, parsed.slug);
+        output = {
+          ...output,
+          deployment: deployment2,
+          ...deployment2 === null ? {
+            deploymentUnavailableReason: "the deployment-status endpoint is unavailable or returned an unsupported response"
+          } : {}
+        };
+      } catch (e) {
+        if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
+          return mapBotError(e, parsed.slug, io);
+        }
+        output = {
+          ...output,
+          deployment: null,
+          deploymentUnavailableReason: redactDiagnostic(describe12(e))
+        };
+      }
+    }
+    emit4(output, parsed.json, io);
     return 0;
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync7(parsed.file, "utf8");
+    localYaml = readFileSync8(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
       io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe12(e)}`);
@@ -5352,7 +5720,7 @@ async function runStatus(args, io) {
     if (e instanceof UnauthenticatedError || e instanceof ForbiddenError) {
       return mapBotError(e, parsed.slug, io);
     }
-    io.err(`launchpad status: live deployment state unavailable (${describe12(e)}) — ` + `the report below is from the platform manifest view only.`);
+    io.err(`launchpad status: live deployment state unavailable (${redactDiagnostic(describe12(e))}) — ` + `the report below is from the platform manifest view only.`);
   }
   let standingExceptions = null;
   try {
@@ -5370,35 +5738,35 @@ async function runStatus(args, io) {
     const platformTracked = state.hasAppFile === true || live?.trigger === "bot";
     const out = {
       state: contentIsLive ? platformTracked ? "live_drift_unknown" : "live_content_untracked" : platformTracked && !deploymentKnown ? "live_drift_unknown" : liveButEmpty ? "live_no_content" : "no_deployed_manifest",
-      slug: parsed.slug,
       ...local === null ? { drift: null } : {},
-      deployedSha: state.lastAppliedManifestSha,
-      headSha: state.appRepoHeadSha,
-      hasOpenPr: state.openPr !== null,
-      openPrNumber: state.openPr?.number ?? null,
-      driftFields: [],
-      driftDetails: [],
-      ...deploymentKnown ? { deployment } : {},
-      ...standingExceptions !== null ? { standingExceptions } : {}
+      ...statusTruthFields({
+        slug: parsed.slug,
+        deployedSha: state.deployedManifestSha,
+        headSha: state.appRepoHeadSha,
+        openPrNumber: state.openPr?.number ?? null,
+        ...deploymentKnown ? { deployment } : {},
+        ...standingExceptions !== null ? { standingExceptions } : {}
+      }),
+      ...lifecycle?.statusPageUrl !== undefined ? { statusPageUrl: lifecycle.statusPageUrl } : {}
     };
-    emit3(out, parsed.json, io);
+    emit4(out, parsed.json, io);
     return 0;
   }
   if (local === null) {
     const out = {
       state: "live_drift_unknown",
-      slug: parsed.slug,
       drift: null,
-      deployedSha: state.lastAppliedManifestSha,
-      headSha: state.appRepoHeadSha,
-      hasOpenPr: state.openPr !== null,
-      openPrNumber: state.openPr?.number ?? null,
-      driftFields: [],
-      driftDetails: [],
-      ...deploymentKnown ? { deployment } : {},
-      ...standingExceptions !== null ? { standingExceptions } : {}
+      ...statusTruthFields({
+        slug: parsed.slug,
+        deployedSha: state.deployedManifestSha,
+        headSha: state.appRepoHeadSha,
+        openPrNumber: state.openPr?.number ?? null,
+        ...deploymentKnown ? { deployment } : {},
+        ...standingExceptions !== null ? { standingExceptions } : {}
+      }),
+      ...lifecycle?.statusPageUrl !== undefined ? { statusPageUrl: lifecycle.statusPageUrl } : {}
     };
-    emit3(out, parsed.json, io);
+    emit4(out, parsed.json, io);
     if (parsed.strict) {
       if (deployment?.liveDeployment?.buildStatus === "failure") {
         io.err(`launchpad status: --strict: live build FAILED ` + `(drift not evaluated — no local launchpad.yaml here).`);
@@ -5413,12 +5781,12 @@ async function runStatus(args, io) {
     const { parse: parseYaml4 } = await import("yaml");
     deployedObj = parseYaml4(state.manifestYaml);
   } catch (e) {
-    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe12(e)}`);
+    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} is not valid YAML: ${describe12(e)}`);
     return 2;
   }
   const deployedParse = parseManifest(deployedObj);
   if (deployedParse.kind !== "ok") {
-    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} failed schema validation:`);
+    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} failed schema validation:`);
     for (const issue of deployedParse.issues) {
       io.err(`  - ${issue.path}: ${issue.message}`);
     }
@@ -5438,7 +5806,7 @@ async function runStatus(args, io) {
     cfg,
     refs: allowedEntraGroups(deployed.access),
     source: "deployed manifest",
-    manifestSha: state.lastAppliedManifestSha
+    manifestSha: state.deployedManifestSha
   });
   if (deployedGroups.kind === "error") {
     return renderStatusGroupError(deployedGroups.envelope, parsed.json, io);
@@ -5453,7 +5821,7 @@ async function runStatus(args, io) {
       cfg,
       refs: state.enforcedGroups,
       source: "enforced access",
-      manifestSha: state.lastAppliedManifestSha
+      manifestSha: state.deployedManifestSha
     });
     if (enforcedGroups.kind === "error") {
       return renderStatusGroupError(enforcedGroups.envelope, parsed.json, io);
@@ -5462,7 +5830,7 @@ async function runStatus(args, io) {
   }
   const localAssignmentGroups = (local.auth ?? "access") === "access" ? localGroups : null;
   const deployedAssignmentGroups = (deployed.auth ?? "access") === "access" ? deployedGroups : null;
-  const assignmentCheck = localAssignmentGroups === null && deployedAssignmentGroups === null ? { kind: "ok", issues: [] } : await findAssignmentIssues(cfg, localAssignmentGroups, deployedAssignmentGroups, state.lastAppliedManifestSha);
+  const assignmentCheck = localAssignmentGroups === null && deployedAssignmentGroups === null ? { kind: "ok", issues: [] } : await findAssignmentIssues(cfg, localAssignmentGroups, deployedAssignmentGroups, state.deployedManifestSha);
   if (assignmentCheck.kind === "error") {
     return renderStatusGroupError(assignmentCheck.envelope, parsed.json, io);
   }
@@ -5470,7 +5838,7 @@ async function runStatus(args, io) {
   const result = {
     state: drift.length === 0 ? "in_sync" : "drift",
     slug: parsed.slug,
-    deployedSha: state.lastAppliedManifestSha,
+    deployedSha: state.deployedManifestSha,
     headSha: state.appRepoHeadSha,
     hasOpenPr: state.openPr !== null,
     openPrNumber: state.openPr?.number ?? null,
@@ -5479,9 +5847,10 @@ async function runStatus(args, io) {
     ...deploymentKnown ? { deployment } : {},
     ...standingExceptions !== null ? { standingExceptions } : {},
     ...accessDrift !== undefined ? { accessDrift } : {},
-    ...groupIssues.length === 0 ? {} : { groupIssues }
+    ...groupIssues.length === 0 ? {} : { groupIssues },
+    ...lifecycle?.statusPageUrl !== undefined ? { statusPageUrl: lifecycle.statusPageUrl } : {}
   };
-  emit3(result, parsed.json, io);
+  emit4(result, parsed.json, io);
   if (parsed.strict && (result.state === "drift" || accessDrift?.inSync === false || groupIssues.length > 0)) {
     return 1;
   }
@@ -5674,14 +6043,18 @@ function lifecycleOutput(slug, lc) {
     hasOpenPr: false,
     openPrNumber: null,
     driftFields: [],
-    driftDetails: []
+    driftDetails: [],
+    ...lc.statusPageUrl !== undefined ? { statusPageUrl: lc.statusPageUrl } : {}
   };
 }
-function emit3(out, asJson, io) {
+function emit4(out, asJson, io) {
   if (asJson) {
     io.out(JSON.stringify(out, null, 2));
     return;
   }
+  if (out.statusPageUrl !== undefined) {
+    io.out(`Status page: ${out.statusPageUrl}`);
+  }
   switch (out.state) {
     case "provisioning":
       io.out(`${out.slug}: provisioning (stage: ${out.stage ?? "starting"})` + (out.submissionId ? ` — submission ${out.submissionId}` : ""));
@@ -5689,12 +6062,16 @@ function emit3(out, asJson, io) {
       return;
     case "provisioning_failed":
       io.out(`${out.slug}: provisioning FAILED at stage ${out.stage ?? "unknown"}` + (out.failedReason ? `: ${out.failedReason}` : ""));
-      if (isLikelyLiveFailureStage(out.stage)) {
+      if (out.deployment?.reconciledToLive === true) {
+        io.out(`  that lifecycle state is stale: this read verified the live build and reconciled the record failed→live.`);
+        io.out(`  no action needed — re-run \`launchpad status ${out.slug}\` to see the reconciled state.`);
+      } else if (isLikelyLiveFailureStage(out.stage)) {
         io.out(`  the app may already be live — run \`launchpad recover ${out.slug}\` to reconcile the record;`);
         io.out(`  if it is not serving, the same command starts the stage-dependent recovery.`);
       } else {
         io.out(`  run \`launchpad recover ${out.slug}\` to start the stage-dependent recovery.`);
       }
+      surfaceFailedLifecycleDeployment(out, io);
       return;
     case "destroying":
       io.out(`${out.slug}: destroying…`);
@@ -5791,6 +6168,20 @@ function triggerLabel(trigger) {
     return "launchpad deploy (bot)";
   return "an unknown mechanism";
 }
+function surfaceFailedLifecycleDeployment(out, io) {
+  if (out.deploymentUnavailableReason !== undefined) {
+    io.out(`  latest deployment evidence unavailable: ${out.deploymentUnavailableReason}`);
+    return;
+  }
+  if (out.deployment === undefined || out.deployment === null)
+    return;
+  if (!out.deployment.supported) {
+    io.out("  latest deployment evidence: not applicable because this app has no Pages deployment surface.");
+    return;
+  }
+  io.out("  latest deployment evidence (may not be the cause of this lifecycle failure):");
+  surfaceDeployment(out, io);
+}
 function surfaceDeployment(out, io) {
   const dep = out.deployment;
   if (dep === undefined || dep === null || !dep.supported)
@@ -5807,15 +6198,15 @@ function surfaceDeployment(out, io) {
   const via = triggerLabel(live.trigger);
   switch (live.buildStatus) {
     case "success":
-      io.out(`  last deployment: build success (${via}${commit}) at ${live.createdOn}`);
+      io.out(`  last deployment: build success (${via}${commit}) at ${live.createdOn} [deployment ${live.id}]`);
       return;
     case "in_progress":
-      io.out(`  last deployment: build IN PROGRESS (${via}${commit}, started ${live.createdOn})`);
+      io.out(`  last deployment: build IN PROGRESS (${via}${commit}, started ${live.createdOn}) [deployment ${live.id}]`);
       io.out("    re-run `launchpad status` shortly to confirm the build outcome.");
       return;
     case "failure": {
       const stage = live.failedStage !== undefined ? ` at stage "${live.failedStage}"` : "";
-      io.out(`  last deployment: build FAILED${stage} (${via}${commit}) at ${live.createdOn}`);
+      io.out(`  last deployment: build FAILED${stage} (${via}${commit}) at ${live.createdOn} [deployment ${live.id}]`);
       if (live.logExcerpt !== undefined && live.logExcerpt.length > 0) {
         io.out("    build log (excerpt):");
         for (const line of live.logExcerpt.split(`
@@ -5988,7 +6379,7 @@ function readLocalEntrypoint(cwd) {
   for (const rel of ["index.html", join9("static", "index.html")]) {
     const p = join9(cwd, rel);
     if (existsSync4(p))
-      return new Uint8Array(readFileSync8(p));
+      return new Uint8Array(readFileSync9(p));
   }
   return null;
 }
@@ -6222,7 +6613,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 
 // src/commands/deploy.ts
 import { parse as parseYaml6 } from "yaml";
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -6479,6 +6870,7 @@ function parseDeployFlags(args) {
   let rebaseOntoHead = false;
   let overrideStale = null;
   let allowUnguarded = false;
+  let noOpen = false;
   let i = 0;
   while (i < args.length) {
     const a = args[i] ?? "";
@@ -6683,6 +7075,11 @@ function parseDeployFlags(args) {
       i += 1;
       continue;
     }
+    if (a === "--no-open") {
+      noOpen = true;
+      i += 1;
+      continue;
+    }
     if (a.startsWith("--verify-timeout=")) {
       const v = a.slice("--verify-timeout=".length);
       const n = Number(v);
@@ -6703,6 +7100,9 @@ function parseDeployFlags(args) {
   if (rebaseOntoHead && overrideStale !== null) {
     return "--rebase-onto-head and --override-stale are mutually exclusive — re-stamp to head, or override in place, not both";
   }
+  if (noOpen && mode !== "content" && mode !== "apply") {
+    return "--no-open is only valid for a content deploy or --apply";
+  }
   if (mode === "dry-run") {
     if (slug !== null)
       return "--dry-run does not accept --slug (slug is read from launchpad.yaml)";
@@ -6759,7 +7159,8 @@ function parseDeployFlags(args) {
         timeoutMinutes
       },
       message: null,
-      timeoutSeconds: null
+      timeoutSeconds: null,
+      ...noOpen ? { noOpen: true } : {}
     };
   }
   if (resumePrNumber !== null) {
@@ -6800,7 +7201,8 @@ function parseDeployFlags(args) {
         allowUnguarded
       },
       message,
-      timeoutSeconds
+      timeoutSeconds,
+      ...noOpen ? { noOpen: true } : {}
     };
   }
   if (mode === "resume" || mode === "abandon") {
@@ -6854,12 +7256,12 @@ import { existsSync as existsSync6, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { parse as parseYaml5, YAMLParseError } from "yaml";
 function loadManifest(path8) {
   let raw;
   try {
-    raw = readFileSync9(path8, "utf8");
+    raw = readFileSync10(path8, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -6894,6 +7296,38 @@ function formatIssues(error) {
   }));
 }
 
+// src/status-page-output.ts
+async function surfaceStatusPageUrl(url, io, options) {
+  if (typeof url !== "string" || url.length === 0)
+    return;
+  io.out(`Status page: ${url}`);
+  const env = options.env ?? process.env;
+  const isTty = options.isTty ?? process.stdout.isTTY === true;
+  if (options.noOpen || !options.autoOpenEnabled || !isTty || env.CI !== undefined) {
+    return;
+  }
+  if (!isAllowedStatusPageUrl(url, options.allowedHost)) {
+    io.err("warning: refused to open an untrusted status page URL");
+    return;
+  }
+  try {
+    await (options.open ?? openBrowser)(url);
+  } catch (error) {
+    io.err(`warning: couldn't open the status page automatically: ${describe13(error)}`);
+  }
+}
+function isAllowedStatusPageUrl(url, allowedHost) {
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "https:" && (allowedHost === undefined || parsed.hostname === allowedHost);
+  } catch {
+    return false;
+  }
+}
+function describe13(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // src/deploy/apply.ts
 var DEFAULT_TIMEOUT_MINUTES = 90;
 var DEFAULT_POLL_INTERVAL_SECONDS = 10;
@@ -7028,6 +7462,11 @@ async function runDeployApply(opts, io, deps = {}) {
     io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/apply: ` + `requested ${manifestSha}, received ${String(apply.manifestSha)}`);
     return 2;
   }
+  await surfaceStatusPageUrl(apply.statusPageUrl, io, {
+    noOpen: opts.noOpen === true,
+    autoOpenEnabled: cfg.statusPageAutoOpen,
+    allowedHost: cfg.statusPageHost
+  });
   io.out("");
   io.out(`PR opened: ${apply.prUrl}`);
   io.out(`Branch:    ${apply.branch}`);
@@ -7102,7 +7541,7 @@ async function pollUntilApplied(args) {
           breakDots();
           return { kind: "failed", reason: e.message };
         }
-        args.io.err(`! apply-status fetch failed (will retry): ${describe13(e)}`);
+        args.io.err(`! apply-status fetch failed (will retry): ${describe14(e)}`);
         await sleep(args.pollIntervalSec * 1000);
         continue;
       }
@@ -7149,7 +7588,7 @@ async function pollUntilApplied(args) {
           path: `/apps/${args.slug}/manifest/state`
         }, args.fetcher);
       } catch (e) {
-        args.io.err(`! state fetch failed (will retry): ${describe13(e)}`);
+        args.io.err(`! state fetch failed (will retry): ${describe14(e)}`);
         await sleep(args.pollIntervalSec * 1000);
         continue;
       }
@@ -7223,7 +7662,7 @@ function deletePinIfPresent(cfg, slug, io) {
     rmSync(pinPath, { force: true });
     io.out(`  (cleaned up obsolete pin file ${pinPath})`);
   } catch (e) {
-    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe13(e)}`);
+    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe14(e)}`);
   }
 }
 async function loadSlugForResume(opts, io) {
@@ -7247,7 +7686,7 @@ async function defaultPrompt(question) {
     rl.close();
   }
 }
-function describe13(e) {
+function describe14(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError(e, slug, io) {
@@ -7271,7 +7710,7 @@ function mapHttpError(e, slug, io) {
     io.err(`launchpad deploy --apply: ${e.message}`);
     return 1;
   }
-  io.err(`launchpad deploy --apply failed: ${describe13(e)}`);
+  io.err(`launchpad deploy --apply failed: ${describe14(e)}`);
   return 2;
 }
 function renderManifestError(loaded, io) {
@@ -7314,7 +7753,7 @@ function renderAccessDriftSummary(slug, body) {
   return lines;
 }
 async function handleAccessDrift(params) {
-  const { slug, manifestPath, body, io, deps, outcome } = params;
+  const { slug, manifestPath, body, io, deps, noOpen, outcome } = params;
   if (outcome === undefined) {
     for (const line of renderAccessDriftSummary(slug, body))
       io.err(line);
@@ -7330,6 +7769,7 @@ async function handleAccessDrift(params) {
     platformRepo: null,
     rePin: false,
     yes: true,
+    noOpen,
     ...outcome === undefined ? {} : { atSha: outcome.manifest_sha },
     ...outcome?.pr === undefined ? {} : {
       preopenedPr: {
@@ -7370,7 +7810,7 @@ async function runDeployDryRun(opts, io, deps = {}) {
   try {
     manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
   } catch (e) {
-    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe14(e)}`;
+    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe15(e)}`;
     if (opts.json) {
       io.out(JSON.stringify({ ok: false, kind: "git-error", message: msg }));
     } else {
@@ -7419,7 +7859,7 @@ function defaultGitHeadSha(cwd) {
   });
   return out.trim();
 }
-function describe14(e) {
+function describe15(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError2(e, slug, json, io) {
@@ -7718,6 +8158,81 @@ function handleNetworkError(e, io, slug, verb) {
   return 1;
 }
 
+// src/manifest/container-filesystem.ts
+import { lstatSync as lstatSync3, realpathSync } from "node:fs";
+import { dirname as dirname6, join as join11, relative as relative3, resolve as resolve9, sep as sep2 } from "node:path";
+function validateContainerFilesystem(manifestPath, capability) {
+  const root = realpathSync(dirname6(manifestPath));
+  const segments = capability.container.image.slice(2).split("/");
+  let current = root;
+  for (const segment of segments) {
+    current = join11(current, segment);
+    let stat;
+    try {
+      stat = lstatSync3(current);
+    } catch (error) {
+      return failure("container_image_unreadable", relative3(root, current), `cannot inspect container image path: ${describe16(error)}`);
+    }
+    if (stat.isSymbolicLink()) {
+      return failure("container_image_symlink", relative3(root, current), "container image path must not contain symbolic links");
+    }
+  }
+  let finalPath;
+  try {
+    finalPath = realpathSync(current);
+  } catch (error) {
+    return failure("container_image_unreadable", relative3(root, current), `cannot resolve container image path: ${describe16(error)}`);
+  }
+  const rootPrefix = resolve9(root) + sep2;
+  if (!resolve9(finalPath).startsWith(rootPrefix)) {
+    return failure("container_image_outside_repository", capability.container.image, "container image resolves outside the app repository");
+  }
+  if (!lstatSync3(finalPath).isFile()) {
+    return failure("container_image_not_regular_file", capability.container.image, "container image must resolve to a regular Dockerfile");
+  }
+  return { kind: "ok", dockerfilePath: finalPath };
+}
+function failure(reason, path8, message) {
+  return { kind: "error", reason, path: path8, message };
+}
+function describe16(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/manifest/runtime-capability.ts
+function validateCliRuntimeCapability(manifestPath, manifest) {
+  const result = validateDeploymentCapability(manifest);
+  if (result.kind === "unsupported" || result.runtime === "pages") {
+    return result;
+  }
+  const filesystem = validateContainerFilesystem(manifestPath, result.capability);
+  return filesystem.kind === "error" ? filesystem : result;
+}
+function rejectUnsupportedCliRuntime(args) {
+  const result = validateCliRuntimeCapability(args.manifestPath, args.manifest);
+  if (result.kind !== "unsupported" && result.kind !== "error")
+    return null;
+  if (args.json) {
+    args.io.out(JSON.stringify({
+      ok: false,
+      manifest_valid: true,
+      runtime_supported: false,
+      reason: result.reason,
+      path: result.path,
+      message: result.message
+    }));
+    return 1;
+  }
+  if (args.structurallyValidName !== undefined) {
+    args.io.out(`✓ ${args.structurallyValidName} - manifest is structurally valid`);
+    args.io.err(`✗ runtime unsupported: ${result.reason}`);
+  } else {
+    args.io.err(`launchpad ${args.command}: runtime unsupported (${result.reason})`);
+  }
+  args.io.err(`  ${result.path}: ${result.message}`);
+  return 1;
+}
+
 // src/commands/deploy.ts
 var deployCommand = {
   name: "deploy",
@@ -7749,7 +8264,8 @@ async function runDeploy(args, io) {
       yes: flags.mode.yes,
       ...flags.mode.atSha !== null ? { atSha: flags.mode.atSha } : {},
       ...flags.mode.resumePrNumber !== null ? { resumePrNumber: flags.mode.resumePrNumber } : {},
-      ...flags.mode.timeoutMinutes !== null ? { timeoutMinutes: flags.mode.timeoutMinutes } : {}
+      ...flags.mode.timeoutMinutes !== null ? { timeoutMinutes: flags.mode.timeoutMinutes } : {},
+      noOpen: flags.noOpen === true
     }, io);
   }
   if (flags.mode.kind === "abandon") {
@@ -7785,7 +8301,8 @@ async function runDeploy(args, io) {
       allowStale: contentMode.allowStale,
       rebaseOntoHead: contentMode.rebaseOntoHead,
       overrideStale: contentMode.overrideStale,
-      allowUnguarded: contentMode.allowUnguarded
+      allowUnguarded: contentMode.allowUnguarded,
+      noOpen: flags.noOpen === true
     });
   }
   if (flags.mode.kind === "content" && flags.mode.allowUnguarded) {
@@ -7826,7 +8343,7 @@ async function runDeploy(args, io) {
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
     if (existsSync7(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync10(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync11(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -7859,6 +8376,11 @@ async function runDeploy(args, io) {
       headers,
       jsonBody: undefined
     }, makeBytesFetcher(packed.bytes, `/apps/${slug}/deploy-pr`));
+    await surfaceStatusPageUrl(response.statusPageUrl, io, {
+      noOpen: flags.noOpen === true,
+      autoOpenEnabled: cfg.statusPageAutoOpen,
+      allowedHost: cfg.statusPageHost
+    });
     io.out("");
     io.out(`PR opened: ${response.reviewUrl}`);
     io.out(`Branch:    ${response.branch}`);
@@ -7904,12 +8426,12 @@ async function runDeploy(args, io) {
       io.err(`launchpad deploy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad deploy failed: ${describe15(e)}`);
+    io.err(`launchpad deploy failed: ${describe17(e)}`);
     return 1;
   }
 }
 function deployUsage() {
-  return `usage: launchpad deploy [--message <text>] [--slug <slug>] [--allow-unguarded]
+  return `usage: launchpad deploy [--message <text>] [--slug <slug>] [--allow-unguarded] [--no-open]
 ` + `       (slug comes from launchpad.yaml at cwd when present — Model A —
 ` + "        else from the current directory's `launchpad-app-<slug>` suffix)\n" + `
 ` + `provisioning modes:
@@ -7947,6 +8469,10 @@ function parseArgs3(args) {
       i += 2;
       continue;
     }
+    if (a === "--no-open") {
+      i += 1;
+      continue;
+    }
     return null;
   }
   return { slug, message };
@@ -7975,7 +8501,7 @@ function formatBytes2(n) {
     return `${(n / 1024).toFixed(1)}KB`;
   return `${(n / (1024 * 1024)).toFixed(1)}MB`;
 }
-function describe15(e) {
+function describe17(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function surfaceDeployExtras(body, io, slug, allowStale = false) {
@@ -8047,11 +8573,11 @@ function surfaceStaleBlock(body, io) {
 }
 var MANIFEST_DIFF_READ_TIMEOUT_MS = 5000;
 function withTimeout(p, ms) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const timer = setTimeout(() => reject(new Error(`manifest read timed out after ${ms}ms`)), ms);
     p.then((v) => {
       clearTimeout(timer);
-      resolve9(v);
+      resolve10(v);
     }, (e) => {
       clearTimeout(timer);
       reject(e instanceof Error ? e : new Error(String(e)));
@@ -8061,7 +8587,7 @@ function withTimeout(p, ms) {
 async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
   let localYaml;
   try {
-    localYaml = readFileSync10(manifestPath, "utf8");
+    localYaml = readFileSync11(manifestPath, "utf8");
   } catch {
     return;
   }
@@ -8098,7 +8624,7 @@ async function advanceBaseShaMarker(cwd, sha, io) {
       return;
     await writeBaseShaMarker(cwd, sha);
   } catch (e) {
-    io.err(`warning: couldn't update the local base-sha marker (${describe15(e)}); ` + `a future deploy may re-warn about staleness. Harmless — your deploy landed.`);
+    io.err(`warning: couldn't update the local base-sha marker (${describe17(e)}); ` + `a future deploy may re-warn about staleness. Harmless — your deploy landed.`);
   }
 }
 async function runModelADeploy(args) {
@@ -8106,19 +8632,37 @@ async function runModelADeploy(args) {
   let slug;
   let appType = "static";
   try {
-    const manifestObj = parseYaml6(readFileSync10(manifestPath, "utf8"));
+    const manifestObj = parseYaml6(readFileSync11(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
       return 64;
     }
     slug = metaSlug;
-    const dtype = manifestObj?.deployment?.type;
-    if (dtype === "static" || dtype === "react" || dtype === "react+api" || dtype === "container") {
-      appType = dtype;
+    const raw = manifestObj;
+    const isV2 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
+    const deploymentType = isV2 ? raw?.spec?.appType : raw?.deployment?.type;
+    if (deploymentType === "static" || deploymentType === "react" || deploymentType === "react+api" || deploymentType === "container") {
+      appType = deploymentType;
+    }
+    if (deploymentType === "container") {
+      const parsed = isV2 ? parseManifestV2(manifestObj) : parseManifest(manifestObj);
+      if (parsed.kind !== "ok") {
+        io.err("launchpad deploy: manifest is structurally invalid:");
+        for (const issue of parsed.issues) {
+          io.err(`  ${issue.path}: ${issue.message}`);
+        }
+        return 1;
+      }
+      const capability = validateCliRuntimeCapability(manifestPath, parsed.manifest);
+      if (capability.kind === "unsupported" || capability.kind === "error") {
+        io.err(`launchpad deploy: runtime unsupported (${capability.reason})`);
+        io.err(`  ${capability.path}: ${capability.message}`);
+        return 1;
+      }
     }
   } catch (e) {
-    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe15(e)}`);
+    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe17(e)}`);
     return 1;
   }
   const noVerify = args.argv.includes("--no-verify");
@@ -8148,7 +8692,7 @@ async function runModelADeploy(args) {
   try {
     cfg = loadConfig();
   } catch (e) {
-    io.err(`launchpad deploy: ${describe15(e)}`);
+    io.err(`launchpad deploy: ${describe17(e)}`);
     return 1;
   }
   try {
@@ -8198,7 +8742,7 @@ async function runModelADeploy(args) {
       io.err("       run `launchpad login` to refresh your session.");
       return 1;
     }
-    io.err(`launchpad deploy: unexpected error: ${describe15(e)}`);
+    io.err(`launchpad deploy: unexpected error: ${describe17(e)}`);
     return 1;
   }
   switch (result.kind) {
@@ -8219,6 +8763,11 @@ async function runModelADeploy(args) {
       return 1;
     case "upload-error": {
       const body = result.body;
+      await surfaceStatusPageUrl(body.statusPageUrl, io, {
+        noOpen: args.noOpen,
+        autoOpenEnabled: cfg.statusPageAutoOpen,
+        allowedHost: cfg.statusPageHost
+      });
       const errorCode = body.error;
       if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
         io.err(upgradeRequiredMessage(body.minimum, body.yours));
@@ -8255,6 +8804,7 @@ async function runModelADeploy(args) {
           manifestPath,
           body,
           io,
+          noOpen: args.noOpen,
           deps: { runApply: runDeployApply }
         });
       }
@@ -8272,6 +8822,7 @@ async function runModelADeploy(args) {
           body,
           outcome,
           io,
+          noOpen: args.noOpen,
           deps: { runApply: runDeployApply }
         });
         if (accessExit !== 0)
@@ -8315,6 +8866,11 @@ async function runModelADeploy(args) {
         io.err(`warning: ${w}`);
       }
       const success = result.result;
+      await surfaceStatusPageUrl(success.statusPageUrl, io, {
+        noOpen: args.noOpen,
+        autoOpenEnabled: cfg.statusPageAutoOpen,
+        allowedHost: cfg.statusPageHost
+      });
       if ("outcome" in success) {
         io.out("Nothing to deploy — your app is already live at this content.");
         if (typeof success.head_sha === "string") {
@@ -8359,6 +8915,7 @@ async function runModelADeploy(args) {
           body: {},
           outcome: success.reconcile,
           io,
+          noOpen: args.noOpen,
           deps: { runApply: runDeployApply }
         });
         if (accessExit !== 0)
@@ -8410,7 +8967,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync12 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -8491,7 +9048,7 @@ function readLocalAppType(cwd, file) {
   if (!existsSync8(manifestPath))
     return null;
   try {
-    const obj = parseYaml7(readFileSync11(manifestPath, "utf8"));
+    const obj = parseYaml7(readFileSync12(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -8673,7 +9230,7 @@ async function runEnvvars(args, io) {
       io.err(`launchpad envvars: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad envvars failed: ${describe16(e)}`);
+    io.err(`launchpad envvars failed: ${describe18(e)}`);
     return 1;
   }
 }
@@ -8770,16 +9327,16 @@ function renderList(envVars, io) {
     io.out(fmt(row));
   }
 }
-function describe16(e) {
+function describe18(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/generate.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, resolve as resolve9, relative as relative3 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname7, resolve as resolve10, relative as relative4 } from "node:path";
 var generateCommand = {
   name: "generate",
-  summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
+  summary: "emit derived runtime artefacts from launchpad.yaml",
   run: runGenerate
 };
 async function runGenerate(args, io) {
@@ -8789,33 +9346,50 @@ async function runGenerate(args, io) {
     io.err("Usage: launchpad generate [--file <path>] [--dry-run] [--force] [--json]");
     return 64;
   }
-  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
-  const appRoot = dirname6(manifestPath);
-  const wranglerPath = resolve9(appRoot, "container", "wrangler.toml");
-  const workflowPath = resolve9(appRoot, ".github", "workflows", "deploy.yml");
+  const unsupported2 = rejectUnsupportedCliRuntime({
+    command: "generate",
+    manifestPath,
+    manifest: result.manifest,
+    io,
+    json: flags.json
+  });
+  if (unsupported2 !== null)
+    return unsupported2;
+  const appRoot = dirname7(manifestPath);
+  const wranglerPath = resolve10(appRoot, "container", "wrangler.toml");
+  const workerPath = resolve10(appRoot, "container", "worker", "index.ts");
+  const workflowPath = resolve10(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
+  const workerRaw = generateContainerWorker(result.manifest);
+  const workerOut = workerRaw.kind === "ok" ? { kind: "ok", content: workerRaw.content, warnings: [] } : workerRaw;
   const workflowOut = generateGithubDeployWorkflow(result.manifest);
   if (flags.dryRun) {
     return renderDryRun([
       { artefact: "wrangler.toml", path: wranglerPath, result: wranglerOut },
+      { artefact: "worker/index.ts", path: workerPath, result: workerOut },
       { artefact: "deploy.yml", path: workflowPath, result: workflowOut }
     ], appRoot, flags.json, io);
   }
   const reports = [
     applyOne("wrangler.toml", wranglerPath, wranglerOut, flags.force),
+    applyOne("worker/index.ts", workerPath, workerOut, flags.force),
     applyOne("deploy.yml", workflowPath, workflowOut, flags.force)
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
 function applyOne(artefact, path10, out, force) {
-  if (out.kind === "not-applicable") {
+  if (out.kind === "not-applicable" || out.kind === "unsupported") {
     return {
       artefact,
-      action: { kind: "not-applicable", reason: out.reason },
+      action: {
+        kind: "not-applicable",
+        reason: out.kind === "unsupported" ? `${out.reason}: ${out.message}` : out.reason
+      },
       warnings: []
     };
   }
@@ -8838,7 +9412,7 @@ function applyOne(artefact, path10, out, force) {
     };
   }
   try {
-    mkdirSync2(dirname6(path10), { recursive: true });
+    mkdirSync2(dirname7(path10), { recursive: true });
     writeFileSync2(path10, out.content, "utf8");
     return {
       artefact,
@@ -8863,7 +9437,7 @@ function applyOne(artefact, path10, out, force) {
 }
 function readIfExists(path10) {
   try {
-    return { kind: "ok", content: readFileSync12(path10, "utf8") };
+    return { kind: "ok", content: readFileSync13(path10, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -8874,12 +9448,12 @@ function readIfExists(path10) {
 function renderDryRun(inputs, appRoot, json, io) {
   if (json) {
     const files = inputs.map((i) => {
-      const previewPath = i.preview === undefined ? relative3(appRoot, i.path) : i.path;
-      if (i.result.kind === "not-applicable") {
+      const previewPath = i.preview === undefined ? relative4(appRoot, i.path) : i.path;
+      if (i.result.kind === "not-applicable" || i.result.kind === "unsupported") {
         return {
           artefact: i.artefact,
           kind: "not-applicable",
-          reason: i.result.reason,
+          reason: i.result.kind === "unsupported" ? `${i.result.reason}: ${i.result.message}` : i.result.reason,
           ...i.preview ? { preview: true, destination: i.preview.destination } : {}
         };
       }
@@ -8896,12 +9470,13 @@ function renderDryRun(inputs, appRoot, json, io) {
     return 0;
   }
   for (const i of inputs) {
-    if (i.result.kind === "not-applicable") {
-      io.out(`# ${i.artefact}: skipped — ${i.result.reason}`);
+    if (i.result.kind === "not-applicable" || i.result.kind === "unsupported") {
+      const reason = i.result.kind === "unsupported" ? `${i.result.reason}: ${i.result.message}` : i.result.reason;
+      io.out(`# ${i.artefact}: skipped - ${reason}`);
       io.out("");
       continue;
     }
-    const headerPath = i.preview === undefined ? relative3(appRoot, i.path) : i.path;
+    const headerPath = i.preview === undefined ? relative4(appRoot, i.path) : i.path;
     const header = i.preview === undefined ? `--- ${headerPath} ---` : `--- [preview, destination = ${i.preview.destination}] ${headerPath} ---`;
     io.out(header);
     io.out(i.result.content);
@@ -8920,20 +9495,20 @@ function renderApplyHuman(reports, appRoot, io) {
     const a = r.action;
     switch (a.kind) {
       case "written":
-        io.out(`✓ ${r.artefact} — wrote ${a.bytes} bytes to ${relative3(appRoot, a.path)}`);
+        io.out(`✓ ${r.artefact} — wrote ${a.bytes} bytes to ${relative4(appRoot, a.path)}`);
         break;
       case "unchanged":
-        io.out(`= ${r.artefact} — unchanged (${relative3(appRoot, a.path)})`);
+        io.out(`= ${r.artefact} — unchanged (${relative4(appRoot, a.path)})`);
         break;
       case "would-overwrite":
-        io.err(`! ${r.artefact} — exists with different content (${relative3(appRoot, a.path)}); re-run with --force to overwrite`);
+        io.err(`! ${r.artefact} — exists with different content (${relative4(appRoot, a.path)}); re-run with --force to overwrite`);
         wouldOverwrite++;
         break;
       case "not-applicable":
         io.out(`- ${r.artefact} — skipped (${a.reason})`);
         break;
       case "write-error":
-        io.err(`✗ ${r.artefact} — ${a.message} (${relative3(appRoot, a.path)})`);
+        io.err(`✗ ${r.artefact} — ${a.message} (${relative4(appRoot, a.path)})`);
         writeError++;
         break;
     }
@@ -8952,17 +9527,17 @@ function renderApplyJson(reports, appRoot, io) {
     const base = { artefact: r.artefact, warnings: r.warnings };
     switch (a.kind) {
       case "written":
-        return { ...base, kind: a.kind, path: relative3(appRoot, a.path), bytes: a.bytes };
+        return { ...base, kind: a.kind, path: relative4(appRoot, a.path), bytes: a.bytes };
       case "unchanged":
       case "would-overwrite":
-        return { ...base, kind: a.kind, path: relative3(appRoot, a.path) };
+        return { ...base, kind: a.kind, path: relative4(appRoot, a.path) };
       case "not-applicable":
         return { ...base, kind: a.kind, reason: a.reason };
       case "write-error":
         return {
           ...base,
           kind: a.kind,
-          path: relative3(appRoot, a.path),
+          path: relative4(appRoot, a.path),
           message: a.message
         };
     }
@@ -9086,13 +9661,13 @@ function decodeJwtPayload(token) {
   try {
     json = Buffer.from(b64UrlToB64(payload), "base64").toString("utf8");
   } catch (e) {
-    throw new JwtParseError(`could not base64-decode JWT payload: ${describe17(e)}`);
+    throw new JwtParseError(`could not base64-decode JWT payload: ${describe19(e)}`);
   }
   let parsed;
   try {
     parsed = JSON.parse(json);
   } catch (e) {
-    throw new JwtParseError(`JWT payload is not JSON: ${describe17(e)}`);
+    throw new JwtParseError(`JWT payload is not JSON: ${describe19(e)}`);
   }
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new JwtParseError(`JWT payload is not an object`);
@@ -9103,7 +9678,7 @@ function b64UrlToB64(s) {
   const padded = s.padEnd(s.length + (4 - s.length % 4) % 4, "=");
   return padded.replace(/-/g, "+").replace(/_/g, "/");
 }
-function describe17(e) {
+function describe19(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -9130,7 +9705,7 @@ async function runGroupsWhoami(args, io) {
   try {
     payload = decodeJwtPayload(session.accessToken);
   } catch (e) {
-    const message = e instanceof JwtParseError ? e.message : describe18(e);
+    const message = e instanceof JwtParseError ? e.message : describe20(e);
     if (json) {
       io.out(JSON.stringify({ ok: false, kind: "jwt-parse-error", message }));
     } else {
@@ -9211,7 +9786,7 @@ function parseFlags2(args) {
   }
   return { kind: "ok", json };
 }
-function describe18(e) {
+function describe20(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -9314,7 +9889,7 @@ async function loadGroups(io, refresh, json) {
       }
       return { kind: "error", code: 3 };
     }
-    renderFetchError(io, describe19(e), json);
+    renderFetchError(io, describe21(e), json);
     return { kind: "error", code: 2 };
   }
 }
@@ -9351,7 +9926,7 @@ async function lookupTenantWide(key) {
       return { kind: "unauthenticated", message: e.message };
     if (e instanceof ForbiddenError)
       return { kind: "forbidden", message: e.message };
-    return { kind: "error", message: describe19(e) };
+    return { kind: "error", message: describe21(e) };
   }
 }
 function renderLookupFailure(io, json, hit) {
@@ -9497,9 +10072,9 @@ async function runShow(args, io) {
   }
   const key = parsed.flags.positional[0];
   const hit = await lookupTenantWide(key);
-  const failure = renderLookupFailure(io, parsed.flags.json, hit);
-  if (failure !== null)
-    return failure;
+  const failure2 = renderLookupFailure(io, parsed.flags.json, hit);
+  if (failure2 !== null)
+    return failure2;
   if (hit.kind !== "found" && hit.kind !== "ambiguous" && hit.kind !== "not-found") {
     return 2;
   }
@@ -9546,9 +10121,9 @@ async function runResolve(args, io) {
   }
   const key = parsed.flags.positional[0];
   const hit = await lookupTenantWide(key);
-  const failure = renderLookupFailure(io, parsed.flags.json, hit);
-  if (failure !== null)
-    return failure;
+  const failure2 = renderLookupFailure(io, parsed.flags.json, hit);
+  if (failure2 !== null)
+    return failure2;
   if (hit.kind !== "found" && hit.kind !== "ambiguous" && hit.kind !== "not-found") {
     return 2;
   }
@@ -9595,23 +10170,23 @@ function renderTable2(io, groups) {
   for (const r of rows)
     io.out(fmt(r));
 }
-function describe19(e) {
+function describe21(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname7, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname8, resolve as resolve11 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync9, readFileSync as readFileSync13, statSync } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync14, statSync } from "node:fs";
+import { join as join13 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync9(join12(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join12(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join12(cwd, n)));
+  const hasPackageJson = existsSync9(join13(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join13(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join13(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -9657,7 +10232,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync9(join12(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync9(join13(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -9679,7 +10254,7 @@ function detectPackageManager(cwd) {
 }
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
-    const p = join12(cwd, name);
+    const p = join13(cwd, name);
     if (existsSync9(p)) {
       return { kind: "ok", value: { path: p } };
     }
@@ -9690,7 +10265,7 @@ function detectVitePresence(cwd) {
   };
 }
 function detectAppType(cwd) {
-  const fnDir = join12(cwd, "functions");
+  const fnDir = join13(cwd, "functions");
   let hasFunctionsDir = false;
   if (existsSync9(fnDir)) {
     try {
@@ -9702,7 +10277,7 @@ function detectAppType(cwd) {
   return { kind: "ok", value: hasFunctionsDir ? "react+api" : "react" };
 }
 function detectBuildCommand(cwd, pm) {
-  const pkgJsonPath = join12(cwd, "package.json");
+  const pkgJsonPath = join13(cwd, "package.json");
   if (!existsSync9(pkgJsonPath)) {
     return {
       kind: "ambiguous",
@@ -9711,7 +10286,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync13(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync14(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -9746,7 +10321,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync13(vite.path, "utf8");
+    text = readFileSync14(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -9775,7 +10350,7 @@ async function runInit(args, io, prompt) {
     return 64;
   }
   const { inputs, options } = parsed;
-  const outPath = resolve10(process.cwd(), options.out);
+  const outPath = resolve11(process.cwd(), options.out);
   if (existsSync10(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
@@ -9823,7 +10398,7 @@ async function runInit(args, io, prompt) {
   }
   io.out(`✓ wrote ${outPath}`);
   if (options.gitignore) {
-    const gitignorePath = resolve10(process.cwd(), ".gitignore");
+    const gitignorePath = resolve11(process.cwd(), ".gitignore");
     try {
       const changed = ensureGitignoreEntries(gitignorePath, [".env", ".env.local"]);
       if (changed.length > 0) {
@@ -9838,8 +10413,8 @@ async function runInit(args, io, prompt) {
     }
   }
   if (fillResult.inputs.type === "static") {
-    const serveDir = resolve10(dirname7(outPath), STATIC_SERVE_DIR);
-    const indexPath = resolve10(serveDir, "index.html");
+    const serveDir = resolve11(dirname8(outPath), STATIC_SERVE_DIR);
+    const indexPath = resolve11(serveDir, "index.html");
     if (!existsSync10(indexPath)) {
       try {
         mkdirSync3(serveDir, { recursive: true });
@@ -10233,7 +10808,7 @@ function renderYaml(manifest) {
 function ensureGitignoreEntries(path10, entries) {
   let current = "";
   if (existsSync10(path10)) {
-    current = readFileSync14(path10, "utf8");
+    current = readFileSync15(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -10306,13 +10881,13 @@ async function runLogin(args, io, deps) {
       io.out(`Access token expires in ~${expiresIn}s; refreshes silently.`);
       return 0;
     } catch (e) {
-      io.err(`Gateway login failed: ${describe20(e)}`);
+      io.err(`Gateway login failed: ${describe22(e)}`);
       io.err("Falling back to the legacy Cloudflare Access flow (DEPRECATED — this fallback will be removed when the dual-auth window closes).");
       io.err("");
       return await runLegacyLogin(io, cfg.botUrl, cfg.sessionPath, deps);
     }
   } catch (e) {
-    io.err(`launchpad login failed: ${describe20(e)}`);
+    io.err(`launchpad login failed: ${describe22(e)}`);
     return 1;
   }
 }
@@ -10354,7 +10929,7 @@ function printLoginHelp(io) {
   io.out("  0   signed in / session stored");
   io.out("  1   login failed (network, browser, or gateway error)");
 }
-function describe20(e) {
+function describe22(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10391,14 +10966,14 @@ async function runLogout(args, io, deps) {
         });
         io.out("Server-side session revoked.");
       } catch (e) {
-        io.err(`warning: could not revoke the session server-side (${describe21(e)}) — clearing the local session anyway. Any in-flight access token expires within 15 minutes.`);
+        io.err(`warning: could not revoke the session server-side (${describe23(e)}) — clearing the local session anyway. Any in-flight access token expires within 15 minutes.`);
       }
     }
     const had = await clearSession(cfg.sessionPath);
     io.out(had ? `Logged out. Session cleared at ${cfg.sessionPath}` : "Already logged out.");
     return 0;
   } catch (e) {
-    io.err(`launchpad logout failed: ${describe21(e)}`);
+    io.err(`launchpad logout failed: ${describe23(e)}`);
     return 1;
   }
 }
@@ -10418,7 +10993,7 @@ function printLogoutHelp(io) {
   io.out("  0   logged out (or already logged out)");
   io.out("  1   could not clear the local session (file IO / config error)");
 }
-function describe21(e) {
+function describe23(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10488,7 +11063,7 @@ async function runLogs(args, io) {
       io.err(`launchpad logs: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad logs failed: ${describe22(e)}`);
+    io.err(`launchpad logs failed: ${describe24(e)}`);
     return 1;
   }
 }
@@ -10568,7 +11143,7 @@ function formatRelative2(iso) {
     return `${hr}h ago`;
   return `${Math.floor(hr / 24)}d ago`;
 }
-function describe22(e) {
+function describe24(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10617,7 +11192,7 @@ async function runMerge(args, io) {
       try {
         body = await res.json();
       } catch (e) {
-        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe23(e)}`);
+        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe25(e)}`);
         return 1;
       }
       io.out("");
@@ -10657,7 +11232,7 @@ async function runMerge(args, io) {
       io.err(`launchpad merge: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad merge failed: ${describe23(e)}`);
+    io.err(`launchpad merge failed: ${describe25(e)}`);
     return 1;
   }
 }
@@ -10756,12 +11331,12 @@ function renderBotError(status, env, io, prNumber = null) {
       io.err(`launchpad merge: bot returned ${status} ${code}${detail !== undefined ? `: ${detail}` : ""}`);
   }
 }
-function describe23(e) {
+function describe25(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/plan.ts
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -10774,8 +11349,19 @@ async function runPlan(args, io) {
     io.err("Usage: launchpad plan [--file <path>] [--json]");
     return 64;
   }
-  const manifestPath = resolve11(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve12(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
+  if (result.kind === "ok") {
+    const unsupported2 = rejectUnsupportedCliRuntime({
+      command: "plan",
+      manifestPath,
+      manifest: result.manifest,
+      io,
+      json: flags.json
+    });
+    if (unsupported2 !== null)
+      return unsupported2;
+  }
   return flags.json ? renderJson(result, io) : renderHuman(result, io);
 }
 function renderJson(result, io) {
@@ -11008,7 +11594,7 @@ async function runDestroy(args, io, prompt, isTty) {
       io.err(`launchpad destroy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad destroy failed: ${describe24(e)}`);
+    io.err(`launchpad destroy failed: ${describe26(e)}`);
     return 1;
   }
 }
@@ -11208,7 +11794,7 @@ function printUsage4(io) {
   ].join(`
 `));
 }
-function describe24(e) {
+function describe26(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -11340,22 +11926,22 @@ async function treesEqual(cwd, tracked, headDir, headPaths) {
   if (tracked.length !== headPaths.length)
     return false;
   const expected = new Set(headPaths);
-  for (const relative5 of tracked) {
-    if (!expected.has(relative5))
+  for (const relative6 of tracked) {
+    if (!expected.has(relative6))
       return false;
-    if (!equal(await readEntry(path12.resolve(cwd, relative5)), await readEntry(path12.resolve(headDir, relative5)))) {
+    if (!equal(await readEntry(path12.resolve(cwd, relative6)), await readEntry(path12.resolve(headDir, relative6)))) {
       return false;
     }
   }
   return true;
 }
-async function listFiles(root, relative5 = "") {
+async function listFiles(root, relative6 = "") {
   const files = [];
-  const entries = await fs6.readdir(path12.resolve(root, relative5), {
+  const entries = await fs6.readdir(path12.resolve(root, relative6), {
     withFileTypes: true
   });
   for (const entry of entries) {
-    const child = relative5.length === 0 ? entry.name : `${relative5}/${entry.name}`;
+    const child = relative6.length === 0 ? entry.name : `${relative6}/${entry.name}`;
     if (entry.isDirectory())
       files.push(...await listFiles(root, child));
     else if (entry.isFile())
@@ -11364,12 +11950,12 @@ async function listFiles(root, relative5 = "") {
   return files.sort();
 }
 function gitOutput(cwd, args) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     execFile("git", [...args], { cwd, encoding: "utf8" }, (error, stdout) => {
       if (error !== null)
         reject(error);
       else
-        resolve13(stdout);
+        resolve14(stdout);
     });
   });
 }
@@ -11378,7 +11964,7 @@ function splitNull(value) {
 }
 async function reconcile(args) {
   const removals = await cleanAncestorRemovals(args);
-  const planned = await Promise.all(args.paths.map((relative5) => planPath(args, relative5, removals)));
+  const planned = await Promise.all(args.paths.map((relative6) => planPath(args, relative6, removals)));
   const conflicts = planned.flatMap((entry) => entry.conflict === undefined ? [] : [entry.conflict]);
   if (conflicts.length > 0) {
     const report = {
@@ -11422,55 +12008,55 @@ async function reconcile(args) {
 }
 async function cleanAncestorRemovals(args) {
   const removals = new Set;
-  for (const relative5 of args.compare.deleted) {
-    assertSafePath(relative5);
-    const checked = await checkParents(args.cwd, relative5, removals);
+  for (const relative6 of args.compare.deleted) {
+    assertSafePath(relative6);
+    const checked = await checkParents(args.cwd, relative6, removals);
     if (checked.kind === "blocked")
       continue;
-    const base = await readEntry(path12.resolve(args.baseDir, relative5));
+    const base = await readEntry(path12.resolve(args.baseDir, relative6));
     const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
     if (local.kind !== "missing" && cleanLocal(base, local))
-      removals.add(relative5);
+      removals.add(relative6);
   }
   return removals;
 }
-async function planPath(args, relative5, removals) {
-  assertSafePath(relative5);
-  const checked = await checkParents(args.cwd, relative5, removals);
-  const base = await readEntry(path12.resolve(args.baseDir, relative5));
-  const upstreamDeleted = args.compare.deleted.includes(relative5);
-  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path12.resolve(args.headDir, relative5));
-  const unsupported = (args.compare.unsupported ?? []).includes(relative5);
+async function planPath(args, relative6, removals) {
+  assertSafePath(relative6);
+  const checked = await checkParents(args.cwd, relative6, removals);
+  const base = await readEntry(path12.resolve(args.baseDir, relative6));
+  const upstreamDeleted = args.compare.deleted.includes(relative6);
+  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path12.resolve(args.headDir, relative6));
+  const unsupported2 = (args.compare.unsupported ?? []).includes(relative6);
   if (checked.kind === "blocked") {
-    return conflictPlan(relative5, checked.target, { kind: "missing" }, head, upstreamDeleted, checked.reason);
+    return conflictPlan(relative6, checked.target, { kind: "missing" }, head, upstreamDeleted, checked.reason);
   }
   const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
-  if (unsupported) {
-    return conflictPlan(relative5, checked.target, local, head, false, "upstream or baseline path uses an unsupported Git entry type");
+  if (unsupported2) {
+    return conflictPlan(relative6, checked.target, local, head, false, "upstream or baseline path uses an unsupported Git entry type");
   }
   if (alreadyResolved(local, head, upstreamDeleted)) {
-    return { relative: relative5, target: checked.target, local, head, upstreamDeleted, apply: false };
+    return { relative: relative6, target: checked.target, local, head, upstreamDeleted, apply: false };
   }
   if (unsupportedHead(head, upstreamDeleted)) {
-    return conflictPlan(relative5, checked.target, local, head, true, "unsupported upstream file type");
+    return conflictPlan(relative6, checked.target, local, head, true, "unsupported upstream file type");
   }
   if (cleanLocal(base, local)) {
-    return { relative: relative5, target: checked.target, local, head, upstreamDeleted, apply: true };
+    return { relative: relative6, target: checked.target, local, head, upstreamDeleted, apply: true };
   }
-  return conflictPlan(relative5, checked.target, local, head, upstreamDeleted, conflictReason(base, local, upstreamDeleted));
+  return conflictPlan(relative6, checked.target, local, head, upstreamDeleted, conflictReason(base, local, upstreamDeleted));
 }
-function conflictPlan(relative5, target, local, head, upstreamDeleted, reason) {
+function conflictPlan(relative6, target, local, head, upstreamDeleted, reason) {
   const suffix = upstreamDeleted ? ".upstream-deleted" : ".upstream";
-  const digest = createHash3("sha256").update(relative5).digest("hex");
+  const digest = createHash3("sha256").update(relative6).digest("hex");
   return {
-    relative: relative5,
+    relative: relative6,
     target,
     local,
     head,
     upstreamDeleted,
     apply: false,
     conflict: {
-      path: relative5,
+      path: relative6,
       reason,
       artifact: `${CONFLICT_DIR}/${digest}${suffix}`,
       upstreamDeleted
@@ -11571,13 +12157,13 @@ function equal(left, right) {
     return false;
   return left.bytes.every((byte, index) => byte === right.bytes[index]);
 }
-async function writeAtomic(cwd, relative5, bytes, mode, allowMetadata = false) {
-  const checked = await checkParents(cwd, relative5, new Set, allowMetadata);
+async function writeAtomic(cwd, relative6, bytes, mode, allowMetadata = false) {
+  const checked = await checkParents(cwd, relative6, new Set, allowMetadata);
   if (checked.kind === "blocked")
     throw new Error(checked.reason);
   const file = checked.target;
   await fs6.mkdir(path12.dirname(file), { recursive: true });
-  const rechecked = await checkParents(cwd, relative5, new Set, allowMetadata);
+  const rechecked = await checkParents(cwd, relative6, new Set, allowMetadata);
   if (rechecked.kind === "blocked")
     throw new Error(rechecked.reason);
   const temporary = `${file}.launchpad-tmp-${process.pid}-${crypto.randomUUID()}`;
@@ -11592,8 +12178,8 @@ async function writeAtomic(cwd, relative5, bytes, mode, allowMetadata = false) {
     throw error;
   }
 }
-async function writeJsonAtomic(cwd, relative5, value) {
-  await writeAtomic(cwd, relative5, new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+async function writeJsonAtomic(cwd, relative6, value) {
+  await writeAtomic(cwd, relative6, new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
 `), 384, true);
 }
 async function resetConflictArtifacts(cwd) {
@@ -11609,37 +12195,37 @@ async function cleanupConflictState(cwd) {
     throw new Error(report.reason);
   await fs6.rm(report.target, { force: true });
 }
-function assertSafePath(relative5) {
-  if (!isSafeSourcePath(relative5)) {
-    throw new Error(`unsafe source path returned by bot: ${relative5}`);
+function assertSafePath(relative6) {
+  if (!isSafeSourcePath(relative6)) {
+    throw new Error(`unsafe source path returned by bot: ${relative6}`);
   }
 }
-function isSafeSourcePath(relative5) {
-  return isSafeRelativePath(relative5) && !relative5.startsWith(`${MARKER_DIR}/`);
+function isSafeSourcePath(relative6) {
+  return isSafeRelativePath(relative6) && !relative6.startsWith(`${MARKER_DIR}/`);
 }
-function isSafeRelativePath(relative5) {
-  const normalized = path12.posix.normalize(relative5);
-  return relative5.length > 0 && !relative5.includes("\\") && !path12.isAbsolute(relative5) && normalized === relative5 && normalized !== ".." && !normalized.startsWith("../");
+function isSafeRelativePath(relative6) {
+  const normalized = path12.posix.normalize(relative6);
+  return relative6.length > 0 && !relative6.includes("\\") && !path12.isAbsolute(relative6) && normalized === relative6 && normalized !== ".." && !normalized.startsWith("../");
 }
-function resolveInsideClone(cwd, relative5) {
+function resolveInsideClone(cwd, relative6) {
   const root = path12.resolve(cwd);
-  const target = path12.resolve(root, relative5);
+  const target = path12.resolve(root, relative6);
   const fromRoot = path12.relative(root, target);
   if (fromRoot.length === 0 || path12.isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${path12.sep}`)) {
-    throw new Error(`unsafe source path returned by bot: ${relative5}`);
+    throw new Error(`unsafe source path returned by bot: ${relative6}`);
   }
   return target;
 }
-async function checkParents(cwd, relative5, projectedRemovals, allowMetadata = false) {
+async function checkParents(cwd, relative6, projectedRemovals, allowMetadata = false) {
   if (allowMetadata) {
-    if (!isSafeRelativePath(relative5)) {
-      throw new Error(`unsafe metadata path: ${relative5}`);
+    if (!isSafeRelativePath(relative6)) {
+      throw new Error(`unsafe metadata path: ${relative6}`);
     }
   } else {
-    assertSafePath(relative5);
+    assertSafePath(relative6);
   }
-  const target = resolveInsideClone(cwd, relative5);
-  const components = relative5.split("/");
+  const target = resolveInsideClone(cwd, relative6);
+  const components = relative6.split("/");
   let current = path12.resolve(cwd);
   for (let index = 0;index < components.length - 1; index += 1) {
     current = path12.join(current, components[index]);
@@ -11778,7 +12364,7 @@ async function runPull(args, io) {
       io.err(`launchpad pull: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad pull failed: ${describe25(e)}`);
+    io.err(`launchpad pull failed: ${describe27(e)}`);
     return 1;
   }
 }
@@ -11886,7 +12472,7 @@ function printUsage5(io) {
   ].join(`
 `));
 }
-function describe25(e) {
+function describe27(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -12221,7 +12807,7 @@ async function runReview(args, io) {
       io.err(`launchpad review: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad review failed: ${describe26(e)}`);
+    io.err(`launchpad review failed: ${describe28(e)}`);
     return 1;
   }
 }
@@ -12299,12 +12885,12 @@ function severityRank(s) {
       return 3;
   }
 }
-function describe26(e) {
+function describe28(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -12359,7 +12945,7 @@ async function runRollback(opts, io, deps = {}) {
       cwd: process.cwd()
     });
   } catch (e) {
-    io.err(`launchpad rollback: git rev-parse failed to start: ${describe27(e)}`);
+    io.err(`launchpad rollback: git rev-parse failed to start: ${describe29(e)}`);
     return 2;
   }
   if (revParse.exitCode !== 0) {
@@ -12374,7 +12960,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     show = await runner.run("git", ["show", `${verifiedSha}:${manifestRelpath}`], { cwd: process.cwd() });
   } catch (e) {
-    io.err(`launchpad rollback: git show failed to start: ${describe27(e)}`);
+    io.err(`launchpad rollback: git show failed to start: ${describe29(e)}`);
     return 2;
   }
   if (show.exitCode !== 0) {
@@ -12408,7 +12994,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     writeFileSync5(manifestPath, historicalYaml, "utf8");
   } catch (e) {
-    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe27(e)}`);
+    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe29(e)}`);
     return 2;
   }
   io.out(`Restored ${manifestPath} from ${verifiedSha.slice(0, 12)}.`);
@@ -12433,7 +13019,7 @@ function readCurrentManifest(path14) {
     return null;
   let raw;
   try {
-    raw = readFileSync15(path14, "utf8");
+    raw = readFileSync16(path14, "utf8");
   } catch {
     return null;
   }
@@ -12490,7 +13076,7 @@ async function defaultPrompt4(question) {
     rl.close();
   }
 }
-function describe27(e) {
+function describe29(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError3(result, io) {
@@ -12589,13 +13175,13 @@ function parseArgs12(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as input2, stdout as output2 } from "node:process";
 
 // src/secrets/env-parse.ts
-var ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
+var ENV_NAME2 = /^[A-Z][A-Z0-9_]*$/;
 var LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/;
 function parseEnv(text) {
   const entries = new Map;
@@ -12620,7 +13206,7 @@ function parseEnv(text) {
     if (value.startsWith('"') && value.endsWith('"') && value.length >= 2 || value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
       value = value.slice(1, -1);
     }
-    if (!ENV_NAME.test(key)) {
+    if (!ENV_NAME2.test(key)) {
       invalidNames.push(key);
       continue;
     }
@@ -12653,9 +13239,9 @@ async function runSecretsPush(opts, io, deps = {}) {
   }
   let envText;
   try {
-    envText = readFileSync16(envPath, "utf8");
+    envText = readFileSync17(envPath, "utf8");
   } catch (e) {
-    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe28(e)}`);
+    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe30(e)}`);
     return 2;
   }
   const parsed = parseEnv(envText);
@@ -12839,10 +13425,10 @@ function mapPushError(e, slug, name, io) {
     io.err(`✗ secrets push ${name}: ${e.message}`);
     return 1;
   }
-  io.err(`✗ secrets push ${name} failed: ${describe28(e)}`);
+  io.err(`✗ secrets push ${name} failed: ${describe30(e)}`);
   return 2;
 }
-function describe28(e) {
+function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError4(result, io) {
@@ -12978,7 +13564,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync18 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
@@ -12995,7 +13581,7 @@ function loadSet(fleetFile, setName, io) {
   }
   let obj;
   try {
-    obj = parseYaml8(readFileSync17(path14, "utf8"));
+    obj = parseYaml8(readFileSync18(path14, "utf8"));
   } catch (e) {
     io.err(`✗ ${path14}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
@@ -13087,7 +13673,7 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   }
   let envText;
   try {
-    envText = readFileSync17(envPath, "utf8");
+    envText = readFileSync18(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -13232,7 +13818,7 @@ function setPushExit(e) {
 
 // src/commands/secrets-template.ts
 import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -13240,7 +13826,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve13(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve14(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -13254,7 +13840,7 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve13(process.cwd(), flags.out);
+  const outPath = resolve14(process.cwd(), flags.out);
   if (existsSync14(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
@@ -13551,16 +14137,16 @@ function printHelp3(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname9, join as join15, resolve as resolve14 } from "node:path";
+import { dirname as dirname10, join as join16, resolve as resolve15 } from "node:path";
 import { promises as fs7, existsSync as existsSync15 } from "node:fs";
 
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join14 } from "node:path";
-import { readFileSync as readFileSync18, readdirSync as readdirSync2 } from "node:fs";
+import { join as join15 } from "node:path";
+import { readFileSync as readFileSync19, readdirSync as readdirSync2 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
-  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join14(homedir2(), ".claude", "skills");
+  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
 }
 function readInstalledSkills() {
   try {
@@ -13570,7 +14156,7 @@ function readInstalledSkills() {
       return { present: false, version: null };
     return {
       present: true,
-      version: readSkillVersion(join14(dir, bundle.name, "SKILL.md"))
+      version: readSkillVersion(join15(dir, bundle.name, "SKILL.md"))
     };
   } catch {
     return { present: false, version: null };
@@ -13578,7 +14164,7 @@ function readInstalledSkills() {
 }
 function readSkillVersion(path14) {
   try {
-    const text = readFileSync18(path14, "utf8");
+    const text = readFileSync19(path14, "utf8");
     const fenceEnd = text.indexOf(`
 ---`, 4);
     const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
@@ -13632,7 +14218,7 @@ async function runSkills(args, io) {
         return 64;
     }
   } catch (e) {
-    io.err(`launchpad skills ${action}: ${describe29(e)}`);
+    io.err(`launchpad skills ${action}: ${describe31(e)}`);
     return 1;
   }
 }
@@ -13655,13 +14241,13 @@ function resolveInstallEnv() {
   return { bundleDir, userSkillsDir };
 }
 function defaultBundleDir() {
-  const here = dirname9(fileURLToPath(import.meta.url));
+  const here = dirname10(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve14(here, "..", "skills"),
-    resolve14(here, "..", "..", "skills")
+    resolve15(here, "..", "skills"),
+    resolve15(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync15(join15(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync15(join16(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -13682,12 +14268,12 @@ async function doInstall(io) {
   }
   let installed = 0;
   for (const skill of BUNDLED_SKILLS) {
-    const src = join15(env.bundleDir, skill);
+    const src = join16(env.bundleDir, skill);
     if (!await isDir(src)) {
       io.err(`launchpad skills install: bundled skill "${skill}" missing from ${env.bundleDir} — package is incomplete.`);
       return 1;
     }
-    const dest = join15(env.userSkillsDir, skill);
+    const dest = join16(env.userSkillsDir, skill);
     await fs7.rm(dest, { recursive: true, force: true });
     await fs7.cp(src, dest, { recursive: true });
     installed++;
@@ -13712,7 +14298,7 @@ async function doUninstall(io) {
       continue;
     if (!isBundleManaged(entry.name))
       continue;
-    const target = join15(env.userSkillsDir, entry.name);
+    const target = join16(env.userSkillsDir, entry.name);
     await fs7.rm(target, { recursive: true, force: true });
     removed++;
     io.out(`✗ removed ${target}`);
@@ -13735,7 +14321,7 @@ async function doList(io) {
   }
   const width = managedDirs.reduce((n, s) => Math.max(n, s.length), 0);
   for (const name of managedDirs) {
-    const skillFile = join15(env.userSkillsDir, name, "SKILL.md");
+    const skillFile = join16(env.userSkillsDir, name, "SKILL.md");
     const version = await readVersion(skillFile);
     io.out(`  ${name.padEnd(width + 2)}${version ?? "(no version)"}`);
   }
@@ -13762,7 +14348,7 @@ async function isDir(path14) {
     return false;
   }
 }
-function describe29(e) {
+function describe31(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -13770,9 +14356,9 @@ function describe29(e) {
 import { execFile as execFile2, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname10, resolve as resolve15, relative as relative5, isAbsolute as isAbsolute3, join as join16 } from "node:path";
+import { dirname as dirname11, resolve as resolve16, relative as relative6, isAbsolute as isAbsolute3, join as join17 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync19, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync20, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
@@ -13815,9 +14401,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve15) => {
-    server.once("error", () => resolve15(false));
-    server.listen(0, "127.0.0.1", () => resolve15(true));
+  const bound = await new Promise((resolve16) => {
+    server.once("error", () => resolve16(false));
+    server.listen(0, "127.0.0.1", () => resolve16(true));
   });
   if (!bound)
     return null;
@@ -13893,7 +14479,7 @@ var PKG = "@m-kopa/launchpad-cli";
 var REGISTRY = "https://registry.npmjs.org";
 var CHANNEL_VERSION_URL = "https://get.launchpad.m-kopa.us/version.json";
 var CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
-var CHANNEL_MARKER = join16(homedir3(), ".launchpad", "channel");
+var CHANNEL_MARKER = join17(homedir3(), ".launchpad", "channel");
 var EXIT_UPDATE_AVAILABLE = 10;
 var UPGRADE_ARGS = {
   npm: ["install", "-g", `${PKG}@latest`],
@@ -14022,8 +14608,8 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join16(tmpdir(), "launchpad-update-"));
-  const file = join16(dir, "install.sh");
+  const dir = mkdtempSync(join17(tmpdir(), "launchpad-update-"));
+  const file = join17(dir, "install.sh");
   try {
     writeFileSync7(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
@@ -14047,7 +14633,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync19(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync20(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -14110,7 +14696,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve15(dirname10(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve16(dirname11(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -14118,7 +14704,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve15(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve16(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -14132,7 +14718,7 @@ async function pmRoot(pm) {
   }
 }
 function pathContains(root, child) {
-  const rel = relative5(root, child);
+  const rel = relative6(root, child);
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function runUpgrade(pm) {
@@ -14255,8 +14841,8 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync16, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname11, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync21, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -14270,11 +14856,21 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path14 = resolve16(process.cwd(), file ?? "launchpad.yaml");
+  const path14 = resolve17(process.cwd(), file ?? "launchpad.yaml");
   const result = loadManifest(path14);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
+  const unsupported2 = rejectUnsupportedCliRuntime({
+    command: "validate",
+    manifestPath: path14,
+    manifest: result.manifest,
+    io,
+    json,
+    structurallyValidName: result.manifest.metadata.name
+  });
+  if (unsupported2 !== null)
+    return unsupported2;
   const boundary = checkBoundary(path14, result.manifest.app !== undefined);
   const serveErrors = checkStaticServeDir(path14, result.manifest);
   if (serveErrors.length > 0) {
@@ -14284,7 +14880,7 @@ async function runValidate(args, io) {
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
 function checkBoundary(manifestPath, declared) {
-  const dir = dirname11(manifestPath);
+  const dir = dirname12(manifestPath);
   let files;
   try {
     files = walkCwd(dir).files;
@@ -14293,7 +14889,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync20(manifestPath, "utf8");
+    manifestYaml = readFileSync21(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -14316,8 +14912,8 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app destination_dir '${serveDir}' is unsafe — use a confined relative subdirectory (e.g. '${STATIC_SERVE_DIR}'). ` + `Serving '.' or an absolute/parent path would publish files outside your app's content.`
     ];
   }
-  const dir = dirname11(manifestPath);
-  const abs = resolve16(dir, serveDir);
+  const dir = dirname12(manifestPath);
+  const abs = resolve17(dir, serveDir);
   if (!existsSync16(abs)) {
     return [
       `static app serves '${serveDir}/' but that directory does not exist — nothing would be served. ` + `Create ${serveDir}/index.html (or run \`launchpad init\` to scaffold it).`
@@ -14327,7 +14923,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   try {
     isDir2 = statSync2(abs).isDirectory();
   } catch (e) {
-    return [`failed to inspect static served directory '${serveDir}/': ${describe30(e)}`];
+    return [`failed to inspect static served directory '${serveDir}/': ${describe32(e)}`];
   }
   if (!isDir2) {
     return [`static app serves '${serveDir}/' but that path is not a directory.`];
@@ -14336,14 +14932,14 @@ function checkStaticServeDir(manifestPath, manifest) {
   try {
     entries = readdirSync3(abs);
   } catch (e) {
-    return [`failed to read static served directory '${serveDir}/': ${describe30(e)}`];
+    return [`failed to read static served directory '${serveDir}/': ${describe32(e)}`];
   }
   if (entries.length === 0) {
     return [
       `static app's served directory '${serveDir}/' is empty — the deploy would serve an empty site.`
     ];
   }
-  if (!existsSync16(resolve16(abs, "index.html"))) {
+  if (!existsSync16(resolve17(abs, "index.html"))) {
     return [
       `static app's served directory '${serveDir}/' has no index.html — the deploy would serve a directory with no entrypoint.`
     ];
@@ -14391,7 +14987,7 @@ async function checkGroup(allowedGroup, cfg) {
     if (e instanceof ForbiddenError) {
       return { kind: "forbidden", message: e.message };
     }
-    return { kind: "network", message: describe30(e) };
+    return { kind: "network", message: describe32(e) };
   }
 }
 async function checkGroups(groups) {
@@ -14488,6 +15084,8 @@ function renderHumanError(result, io) {
 }
 function renderJsonOk(result, group, boundary, io) {
   const base = {
+    manifest_valid: true,
+    runtime_supported: true,
     name: result.manifest.metadata.name,
     deploymentType: result.manifest.deployment.type,
     appBoundary: {
@@ -14604,7 +15202,7 @@ function parseArgs13(args) {
   }
   return { kind: "ok", file, json, strictGroups };
 }
-function describe30(e) {
+function describe32(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -14657,7 +15255,7 @@ async function runWhoami(args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad whoami failed: ${describe31(e)}`);
+    io.err(`launchpad whoami failed: ${describe33(e)}`);
     return 1;
   }
 }
@@ -14687,11 +15285,11 @@ async function runShare(args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad whoami --share failed: ${describe31(e)}`);
+    io.err(`launchpad whoami --share failed: ${describe33(e)}`);
     return 1;
   }
 }
-function describe31(e) {
+function describe33(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -14857,7 +15455,7 @@ async function runEditor(action, args, io, deps) {
       io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
       return 1;
     }
-    io.err(`launchpad ${verb} failed: ${describe32(e)}`);
+    io.err(`launchpad ${verb} failed: ${describe34(e)}`);
     return 1;
   }
 }
@@ -14891,7 +15489,7 @@ async function sendMutation(action, slug, target, version, cfg, deps) {
     nonThrowingStatuses: [409]
   });
 }
-function describe32(e) {
+function describe34(e) {
   return e instanceof Error ? e.message : String(e);
 }
 var grantEditorCommand = makeEditorCommand("grant");
@@ -15097,7 +15695,7 @@ async function runOwner(action, args, io, deps) {
       io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
       return 1;
     }
-    io.err(`launchpad ${verb} failed: ${describe33(e)}`);
+    io.err(`launchpad ${verb} failed: ${describe35(e)}`);
     return 1;
   }
 }
@@ -15131,12 +15729,92 @@ async function sendMutation2(action, slug, target, version, cfg, deps) {
     nonThrowingStatuses: [409]
   });
 }
-function describe33(e) {
+function describe35(e) {
   return e instanceof Error ? e.message : String(e);
 }
 var addOwnerCommand = makeOwnerCommand("add");
 var removeOwnerCommand = makeOwnerCommand("remove");
 
+// src/commands/admin.ts
+var REAL_DEPS3 = { loadConfig, apiJson };
+var adminCommand = makeAdminCommand();
+function makeAdminCommand(deps = REAL_DEPS3) {
+  return {
+    name: "admin",
+    summary: "run authenticated platform-operator actions",
+    run: (args, io) => runAdmin(args, io, deps)
+  };
+}
+function statusPageUrl(value, allowedHost) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:")
+      return null;
+    if (url.hostname !== allowedHost)
+      return null;
+    if (!/^\/d\/[^/]+$/u.test(url.pathname))
+      return null;
+    if (url.username !== "" || url.password !== "")
+      return null;
+    if (url.search !== "" || url.hash !== "")
+      return null;
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+async function runAdmin(args, io, deps) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp6(io);
+    return 0;
+  }
+  const config = deps.loadConfig();
+  const parsed = parseStatusRevokeArgs(args, config.statusPageHost ?? DEFAULT_STATUS_PAGE_HOST);
+  if (parsed.kind === "unknown") {
+    io.err(`launchpad admin: unknown subcommand '${parsed.subcommand}'`);
+    printHelp6(io);
+    return 64;
+  }
+  if (parsed.kind === "invalid") {
+    io.err("launchpad admin: expected `status-revoke <status-url>`");
+    printHelp6(io);
+    return 64;
+  }
+  return revokeStatusPage(parsed.url, config, io, deps);
+}
+function parseStatusRevokeArgs(args, allowedHost) {
+  if (args[0] !== undefined && args[0] !== "status-revoke") {
+    return { kind: "unknown", subcommand: args[0] };
+  }
+  if (args.length !== 2)
+    return { kind: "invalid" };
+  const url = statusPageUrl(args[1], allowedHost);
+  return url === null ? { kind: "invalid" } : { kind: "ok", url };
+}
+async function revokeStatusPage(url, config, io, deps) {
+  try {
+    const response = await deps.apiJson(config, {
+      method: "POST",
+      path: "/status-page/revoke",
+      jsonBody: { url }
+    });
+    io.out(statusRevokeMessage(response));
+    return 0;
+  } catch (error) {
+    io.err(`launchpad admin status-revoke: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+function statusRevokeMessage(response) {
+  return response.revoked ? "Status page revoked." : "Status page was already absent.";
+}
+function printHelp6(io) {
+  io.out("launchpad admin - authenticated platform-operator actions.");
+  io.out("");
+  io.out("Usage:");
+  io.out("  launchpad admin status-revoke <status-url>");
+}
+
 // src/commands/list-owners.ts
 function realDeps4() {
   return { loadConfig, apiJson };
@@ -15212,20 +15890,20 @@ var listOwnersCommand = makeListOwnersCommand();
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import {
   existsSync as existsSync17,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   writeFileSync as writeFileSync8
 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
-var CACHE_FILE = join17(homedir4(), ".launchpad", "update-check.json");
+var CACHE_FILE = join18(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync21(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync22(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -15238,12 +15916,12 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync4(join17(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
-var SKILLS_HINT_MARKER = join17(homedir4(), ".launchpad", "skills-hint-shown");
+var SKILLS_HINT_MARKER = join18(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
     return existsSync17(SKILLS_HINT_MARKER);
@@ -15253,7 +15931,7 @@ function absentHintShown() {
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync4(join17(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -15356,8 +16034,8 @@ var refreshUpdateCacheCommand = {
 // src/telemetry.ts
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
-import { join as join18 } from "node:path";
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join19 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync23, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -15365,8 +16043,8 @@ var POSTHOG_PROJECT_KEY = "phc_CYaCuETanWc36TMTiB7cdkdnmPPhFZCkDGmWGLaNkXnb";
 var CAPTURE_PATH = "/i/v0/e/";
 var SEND_TIMEOUT_MS = 3000;
 var APP = "launchpad-cli";
-var DEVICE_ID_FILE = join18(homedir5(), ".launchpad", "telemetry-id.json");
-var FIRST_RUN_MARKER = join18(homedir5(), ".launchpad", "telemetry-notice-shown");
+var DEVICE_ID_FILE = join19(homedir5(), ".launchpad", "telemetry-id.json");
+var FIRST_RUN_MARKER = join19(homedir5(), ".launchpad", "telemetry-notice-shown");
 function buildEvent(ctx, identity, nowMs) {
   const properties = {
     app: APP,
@@ -15433,14 +16111,14 @@ async function resolveIdentityReal() {
 }
 function getOrCreateDeviceId() {
   try {
-    const raw = JSON.parse(readFileSync22(DEVICE_ID_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync23(DEVICE_ID_FILE, "utf8"));
     const id2 = raw?.deviceId;
     if (typeof id2 === "string" && id2)
       return id2;
   } catch {}
   const id = randomUUID();
   try {
-    mkdirSync5(join18(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
 `, {
       mode: 384
@@ -15518,7 +16196,7 @@ function firstRunNoticeShown() {
 }
 function markFirstRunNotice() {
   try {
-    mkdirSync5(join18(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(FIRST_RUN_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -15584,22 +16262,22 @@ import { createInterface as createInterface7 } from "node:readline/promises";
 import { platform } from "node:os";
 
 // src/report/breadcrumb.ts
-import { writeFileSync as writeFileSync10, readFileSync as readFileSync23, mkdirSync as mkdirSync6 } from "node:fs";
+import { writeFileSync as writeFileSync10, readFileSync as readFileSync24, mkdirSync as mkdirSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join19, dirname as dirname12 } from "node:path";
+import { join as join20, dirname as dirname13 } from "node:path";
 function breadcrumbPath() {
-  return join19(homedir6(), ".launchpad", "last-run.json");
+  return join20(homedir6(), ".launchpad", "last-run.json");
 }
 function writeBreadcrumb(verb, exit) {
   try {
     const p = breadcrumbPath();
-    mkdirSync6(dirname12(p), { recursive: true });
+    mkdirSync6(dirname13(p), { recursive: true });
     writeFileSync10(p, JSON.stringify({ verb, exit, ts: Date.now() }), "utf8");
   } catch {}
 }
 function readBreadcrumb() {
   try {
-    const raw = JSON.parse(readFileSync23(breadcrumbPath(), "utf8"));
+    const raw = JSON.parse(readFileSync24(breadcrumbPath(), "utf8"));
     if (typeof raw !== "object" || raw === null)
       return null;
     const r = raw;
@@ -15793,6 +16471,7 @@ var COMMANDS = [
   addOwnerCommand,
   removeOwnerCommand,
   listOwnersCommand,
+  adminCommand,
   makeReportCommand("bug"),
   makeReportCommand("feature"),
   refreshUpdateCacheCommand,
@@ -15800,7 +16479,7 @@ var COMMANDS = [
 ];
 async function dispatch(argv, io, commands = COMMANDS, deps = {}) {
   if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
-    printHelp6(io, commands);
+    printHelp7(io, commands);
     return 0;
   }
   if (argv[0] === "--version" || argv[0] === "-v") {
@@ -15863,9 +16542,11 @@ function requiresCliFloorPreflight(verb, args) {
     return args[0] === "set" || args[0] === "rm";
   if (verb === "secrets")
     return args[0] === "push";
+  if (verb === "admin")
+    return args[0] === "status-revoke";
   return false;
 }
-function printHelp6(io, commands) {
+function printHelp7(io, commands) {
   io.out("launchpad — manage Launchpad-deployed apps from the command line.");
   io.out("");
   io.out("Usage:");