@m-kopa/launchpad-cli 0.56.1 → 0.60.1

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.56.1";
+var CLI_VERSION = "0.60.1";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -2138,6 +2138,9 @@ function parse202(body, fallbackSlug) {
       slug: typeof body.slug === "string" ? body.slug : fallbackSlug,
       message: typeof body.message === "string" ? body.message : "bundle committed; deployment is pending"
     };
+    if (body.v2Delivery !== undefined && body.v2Delivery !== "pending" && body.v2Delivery !== "deferred") {
+      return null;
+    }
     return reconcile === undefined ? accepted : { ...accepted, reconcile };
   }
   if (body.status === "provisioning_started") {
@@ -2570,6 +2573,12 @@ import { parse as parseYaml2 } from "yaml";
 import { z } from "zod";
 var APP_TYPES2 = ["static", "react", "react+api", "container"];
 var AUTH_MODES = ["access", "gateway"];
+var IDENTITY_TYPES = ["employee", "dsr"];
+var IdentityTypesSchema = z.array(z.enum(IDENTITY_TYPES)).min(1).refine((values) => new Set(values).size === values.length, {
+  message: "identity_types must not contain duplicates"
+}).refine((values) => values.includes("employee"), {
+  message: "identity_types must include employee"
+});
 var RUNTIMES = ["cloudflare-containers", "aca"];
 var SECRET_SOURCES = ["env-file", "platform-managed"];
 var TARGET_KINDS = ["pages", "worker"];
@@ -2590,7 +2599,8 @@ var DeploymentSchema = z.object({
 var AccessSchema = z.object({
   allowed_entra_group: z.string().min(1).optional(),
   allowed_entra_groups: z.array(z.string().min(1)).min(1).refine((arr) => new Set(arr).size === arr.length, { message: "allowed_entra_groups must not contain duplicates" }).optional(),
-  session_duration: z.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional()
+  session_duration: z.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional(),
+  identity_types: IdentityTypesSchema.optional()
 }).strict().superRefine((access, ctx) => {
   const hasSingular = access.allowed_entra_group !== undefined;
   const hasPlural = access.allowed_entra_groups !== undefined;
@@ -2678,6 +2688,13 @@ var ManifestSchema = z.object({
   sensitive: z.boolean().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
+  if (m.access.identity_types !== undefined && (m.auth ?? "access") !== "gateway") {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["access", "identity_types"],
+      message: "access.identity_types is only valid with auth: gateway"
+    });
+  }
   if (m.confine_origin !== undefined) {
     if (isContainer) {
       ctx.addIssue({
@@ -3302,7 +3319,8 @@ var SpecSchema = z2.object({
     allowed_entra_groups: z2.array(z2.string().min(1)).min(1).refine((a) => new Set(a).size === a.length, {
       message: "allowed_entra_groups must not contain duplicates"
     }),
-    require_email_domain: z2.string().min(1).optional()
+    require_email_domain: z2.string().min(1).optional(),
+    identity_types: IdentityTypesSchema.optional()
   }).strict(),
   auth: z2.enum(AUTH_MODES).optional(),
   build: BuildSchema.optional(),
@@ -3317,6 +3335,13 @@ var SpecSchema = z2.object({
   secrets: SecretsSchema.optional(),
   fronted_by_concierge: z2.boolean().optional()
 }).strict().superRefine((s, ctx) => {
+  if (s.access.identity_types !== undefined && (s.auth ?? "access") !== "gateway") {
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      path: ["access", "identity_types"],
+      message: "access.identity_types is only valid with auth: gateway"
+    });
+  }
   for (const [k, v] of Object.entries(s.env_vars ?? {})) {
     if (/_(TOKEN|SECRET)$/.test(k) && v.type !== "secret_text") {
       ctx.addIssue({
@@ -3377,19 +3402,14 @@ var SpecSchema = z2.object({
         message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
       });
     }
-    if (s.env_vars !== undefined) {
-      ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
-        path: ["env_vars"],
-        message: "env_vars are not yet supported with origin: dispatch — a dispatch workspace has no Pages module to apply them, and accepting them here would silently drop them. Worker-level vars land with the v2 deploy path."
-      });
-    }
-    if (s.build !== undefined) {
-      ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
-        path: ["build"],
-        message: "build is not yet supported with origin: dispatch — a dispatch workspace has no Pages module to carry it, and the v2 deploy path that will consume it is not shipped yet. Accepting it here would silently drop it."
-      });
+    for (const [name, envVar] of Object.entries(s.env_vars ?? {})) {
+      if (envVar.type === "secret_text") {
+        ctx.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: ["env_vars", name],
+          message: "secret_text env vars are not supported with origin: dispatch until PS-2740 (secrets on v2) provides their runtime consumer."
+        });
+      }
     }
   }
   if (!isContainer && s.containers !== undefined) {
@@ -4381,6 +4401,21 @@ function membersForSecret(set, secret) {
 }
 // ../launchpad-engine/dist/redact-status.js
 var UNSAFE_KEY = new Set(["__proto__", "prototype", "constructor"]);
+// ../launchpad-engine/dist/deployment-auth.js
+function deploymentAuthIssue(appType, auth) {
+  if (appType === "container" || auth === "gateway")
+    return null;
+  return {
+    error: "pages_access_retired",
+    message: "Cloudflare Access login is retired for Pages apps. Set auth: gateway (spec.auth in v2). Containers are unchanged."
+  };
+}
+// ../launchpad-engine/dist/new-app-origin.js
+function newAppOrigin(appType, requested) {
+  if (appType === "container")
+    return;
+  return requested ?? (appType === "react+api" ? "pages" : "dispatch");
+}
 // src/bundle/boundary.ts
 var MAX_CONTENT_PROBE_BYTES = 1024 * 1024;
 function applyBoundaryToFiles(args) {
@@ -4528,7 +4563,7 @@ async function bundleAndDeploy(args) {
 }
 
 // src/deploy/verify-deploy.ts
-import { readFileSync as readFileSync9, existsSync as existsSync4 } from "node:fs";
+import { readFileSync as readFileSync10, existsSync as existsSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // src/deploy/redact-diagnostic.ts
@@ -4574,11 +4609,67 @@ async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
   return {
     slug: typeof raw.slug === "string" ? raw.slug : slug,
     supported: raw.supported,
+    ...raw.origin === "pages" || raw.origin === "dispatch" ? { origin: raw.origin } : {},
+    ...projectV2(raw.v2),
     liveDeployment: scrubLiveDeployment(raw.liveDeployment ?? null),
     lastSuccessfulDeployment: projectLastSuccessful(raw.lastSuccessfulDeployment),
     ...raw.reconciledToLive === true ? { reconciledToLive: true } : {}
   };
 }
+function projectV2(value) {
+  if (value === null || typeof value !== "object")
+    return {};
+  const raw = value;
+  if (!isV2State(raw.state) || !isV2Stage(raw.stage) || typeof raw.commitSha !== "string" || typeof raw.attempts !== "number" || !Number.isFinite(raw.attempts) || typeof raw.updatedAt !== "string") {
+    return {};
+  }
+  if (!isConsistentV2State(raw.state, raw.stage))
+    return {};
+  if (raw.failedAt !== undefined && !isV2FailedStage(raw.failedAt))
+    return {};
+  const v2 = {
+    state: raw.state,
+    stage: raw.stage,
+    commitSha: raw.commitSha,
+    attempts: raw.attempts,
+    updatedAt: raw.updatedAt,
+    ...raw.failedAt !== undefined ? { failedAt: raw.failedAt } : {},
+    ...typeof raw.reason === "string" ? { reason: redactDiagnostic(raw.reason) } : {},
+    ...typeof raw.detail === "string" ? { detail: redactDiagnostic(raw.detail) } : {},
+    ...projectRunUrl(raw.runUrl),
+    ...typeof raw.deliveredAt === "string" ? { deliveredAt: raw.deliveredAt } : {}
+  };
+  return { v2 };
+}
+function projectRunUrl(value) {
+  if (typeof value !== "string")
+    return {};
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname === "github.com" ? { runUrl: value } : {};
+  } catch {
+    return {};
+  }
+}
+function isV2State(value) {
+  return value === "pending" || value === "delivered" || value === "refused";
+}
+function isV2Stage(value) {
+  return ["committed", "building", "verified", "uploading", "live", "failed"].includes(String(value));
+}
+function isConsistentV2State(state, stage) {
+  switch (state) {
+    case "delivered":
+      return stage === "live";
+    case "refused":
+      return stage === "failed";
+    case "pending":
+      return stage !== "live" && stage !== "failed";
+  }
+}
+function isV2FailedStage(value) {
+  return ["build", "verify", "download", "expand", "manifest", "plan", "upload"].includes(String(value));
+}
 function projectLastSuccessful(value) {
   if (value === null || typeof value !== "object")
     return null;
@@ -4628,20 +4719,27 @@ function shaMatches(a, b) {
     return x === y;
   return x.slice(0, n) === y.slice(0, n);
 }
-async function readDeploymentBaseline(deps, slug) {
+async function readDeploymentContext(deps, slug) {
   let status;
   try {
     status = await deps.fetchStatus(slug);
   } catch {
-    return null;
+    return { baseline: null };
+  }
+  if (status === null)
+    return { baseline: null };
+  const origin = status.origin;
+  if (!status.supported || status.liveDeployment === null) {
+    return { baseline: null, ...origin !== undefined ? { origin } : {} };
   }
-  if (status === null || !status.supported || status.liveDeployment === null)
-    return null;
   const live = status.liveDeployment;
   return {
-    id: live.id,
-    commitHash: live.commit?.hash ?? null,
-    createdOn: live.createdOn
+    baseline: {
+      id: live.id,
+      commitHash: live.commit?.hash ?? null,
+      createdOn: live.createdOn
+    },
+    ...origin !== undefined ? { origin } : {}
   };
 }
 async function waitForCommitDeployment(args, deps) {
@@ -4649,6 +4747,7 @@ async function waitForCommitDeployment(args, deps) {
   const start = deps.now();
   const baselineId = args.baseline?.id ?? null;
   let matchedInProgress = false;
+  let lastV2Stage = null;
   for (;; ) {
     let status;
     try {
@@ -4662,6 +4761,38 @@ async function waitForCommitDeployment(args, deps) {
       return { kind: "unsupported" };
     const live = status.liveDeployment;
     const elapsed = deps.now() - start;
+    if (status.origin === "dispatch" && status.v2 !== undefined && shaMatches(status.v2.commitSha, args.shippedSha)) {
+      const delivery = status.v2;
+      if (delivery.stage !== lastV2Stage) {
+        args.onV2Stage?.(delivery);
+        lastV2Stage = delivery.stage;
+      }
+      if (delivery.state === "refused") {
+        return {
+          kind: "failure",
+          dispatch: true,
+          failedStage: delivery.failedAt ?? delivery.stage,
+          reason: delivery.reason,
+          detail: delivery.detail,
+          runUrl: delivery.runUrl
+        };
+      }
+      if (delivery.state === "delivered" || delivery.stage === "live") {
+        return {
+          kind: "success",
+          deploymentUrl: live?.url ?? null,
+          v2: {
+            commitSha: delivery.commitSha,
+            ...delivery.deliveredAt !== undefined ? { deliveredAt: delivery.deliveredAt } : {}
+          }
+        };
+      }
+      matchedInProgress = true;
+      if (elapsed >= args.settleTimeoutMs)
+        return { kind: "pending" };
+      await deps.sleep(pollIntervalMs);
+      continue;
+    }
     if (live !== null && shaMatches(live.commit?.hash, args.shippedSha)) {
       if (live.buildStatus === "success") {
         return { kind: "success", deploymentUrl: live.url };
@@ -4773,7 +4904,7 @@ async function verifyServed(args, deps = { fetch }) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
@@ -5582,6 +5713,88 @@ still provisioning after the watch window — re-run \`launchpad watch ${slug}\`
   }
 }
 
+// src/manifest/load.ts
+import { readFileSync as readFileSync8 } from "node:fs";
+import { parse as parseYaml4, YAMLParseError } from "yaml";
+function loadManifest(path8) {
+  let raw;
+  try {
+    raw = readFileSync8(path8, "utf8");
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      return { kind: "file-not-found", path: path8 };
+    }
+    return { kind: "read-error", path: path8, message: e.message ?? String(err) };
+  }
+  return parseManifest2(raw, path8);
+}
+function loadManifestAnyVersion(path8) {
+  let raw;
+  try {
+    raw = readFileSync8(path8, "utf8");
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT")
+      return { kind: "file-not-found", path: path8 };
+    return { kind: "read-error", path: path8, message: e.message ?? String(err) };
+  }
+  return parseManifestAnyVersion(raw, path8);
+}
+function parseManifestAnyVersion(yamlText, path8) {
+  let parsed;
+  try {
+    parsed = parseYaml4(yamlText);
+  } catch (err) {
+    const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
+    return { kind: "yaml-parse-error", path: path8, message };
+  }
+  const apiVersion = typeof parsed === "object" && parsed !== null ? parsed.apiVersion : undefined;
+  if (apiVersion === "launchpad.m-kopa.us/v2") {
+    const result = parseManifestV2(parsed);
+    return result.kind === "ok" ? { kind: "ok", manifest: result.manifest, schema: apiVersion } : { kind: "schema-error", path: path8, schema: apiVersion, issues: [...result.issues] };
+  }
+  if (apiVersion === "launchpad.m-kopa.us/v1alpha1") {
+    const result = parseManifest(parsed);
+    return result.kind === "ok" ? { kind: "ok", manifest: result.manifest, schema: apiVersion } : { kind: "schema-error", path: path8, schema: apiVersion, issues: [...result.issues] };
+  }
+  return {
+    kind: "schema-error",
+    path: path8,
+    schema: "launchpad.m-kopa.us/v1alpha1 or launchpad.m-kopa.us/v2",
+    issues: [
+      {
+        path: "apiVersion",
+        message: `unsupported apiVersion ${JSON.stringify(apiVersion)}; expected launchpad.m-kopa.us/v1alpha1 or launchpad.m-kopa.us/v2`
+      }
+    ]
+  };
+}
+function parseManifest2(yamlText, path8) {
+  let parsed;
+  try {
+    parsed = parseYaml4(yamlText);
+  } catch (err) {
+    const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
+    return { kind: "yaml-parse-error", path: path8, message };
+  }
+  const result = ManifestSchema.safeParse(parsed);
+  if (result.success) {
+    return { kind: "ok", manifest: result.data };
+  }
+  return {
+    kind: "schema-error",
+    path: path8,
+    issues: formatIssues(result.error)
+  };
+}
+function formatIssues(error) {
+  return error.issues.map((issue) => ({
+    path: issue.path.map(String).join(".") || "(root)",
+    message: issue.message
+  }));
+}
+
 // src/commands/status.ts
 var statusCommand = {
   name: "status",
@@ -5677,7 +5890,7 @@ async function runStatus(args, io) {
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync8(parsed.file, "utf8");
+    localYaml = readFileSync9(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
       io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe12(e)}`);
@@ -5686,24 +5899,24 @@ async function runStatus(args, io) {
   }
   let local = null;
   if (localYaml !== null) {
-    let localObj;
-    try {
-      const { parse: parseYaml4 } = await import("yaml");
-      localObj = parseYaml4(localYaml);
-    } catch (e) {
-      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe12(e)}`);
-      return 2;
-    }
-    const localParse = parseManifest(localObj);
+    const localParse = parseManifestAnyVersion(localYaml, parsed.file);
     if (localParse.kind !== "ok") {
-      io.err(`launchpad status: ${parsed.file} failed schema validation:`);
-      for (const issue of localParse.issues) {
-        io.err(`  - ${issue.path}: ${issue.message}`);
+      if (localParse.kind === "yaml-parse-error") {
+        io.err(`launchpad status: ${parsed.file} is not valid YAML: ${localParse.message}`);
+      } else if (localParse.kind === "schema-error") {
+        io.err(`launchpad status: ${parsed.file} failed schema validation against ${localParse.schema}:`);
+        for (const issue of localParse.issues) {
+          io.err(`  - ${issue.path}: ${issue.message}`);
+        }
+      } else {
+        io.err(`launchpad status: cannot read local manifest at ${parsed.file}`);
       }
       return 2;
     }
     local = localParse.manifest;
-    warnSecretShape(local.production_env, io);
+    if (local.apiVersion === "launchpad.m-kopa.us/v1alpha1") {
+      warnSecretShape(local.production_env, io);
+    }
   }
   let state;
   try {
@@ -5733,9 +5946,9 @@ async function runStatus(args, io) {
   }
   if (state.manifestYaml === null || state.manifestYaml === undefined) {
     const live = deployment?.liveDeployment ?? null;
-    const contentIsLive = live !== null && (live.buildStatus === "success" || deployment?.lastSuccessfulDeployment != null);
+    const contentIsLive = deployment?.v2?.state === "delivered" || deployment?.v2?.stage === "live" || live !== null && (live.buildStatus === "success" || deployment?.lastSuccessfulDeployment != null);
     const liveButEmpty = lifecycle !== null && lifecycle.state === "live";
-    const platformTracked = state.hasAppFile === true || live?.trigger === "bot";
+    const platformTracked = state.hasAppFile === true || live?.trigger === "bot" || deployment?.origin === "dispatch";
     const out = {
       state: contentIsLive ? platformTracked ? "live_drift_unknown" : "live_content_untracked" : platformTracked && !deploymentKnown ? "live_drift_unknown" : liveButEmpty ? "live_no_content" : "no_deployed_manifest",
       ...local === null ? { drift: null } : {},
@@ -5768,7 +5981,7 @@ async function runStatus(args, io) {
     };
     emit4(out, parsed.json, io);
     if (parsed.strict) {
-      if (deployment?.liveDeployment?.buildStatus === "failure") {
+      if (deployment?.liveDeployment?.buildStatus === "failure" || deployment?.v2?.state === "refused") {
         io.err(`launchpad status: --strict: live build FAILED ` + `(drift not evaluated — no local launchpad.yaml here).`);
         return 1;
       }
@@ -5776,26 +5989,40 @@ async function runStatus(args, io) {
     }
     return 0;
   }
-  let deployedObj;
-  try {
-    const { parse: parseYaml4 } = await import("yaml");
-    deployedObj = parseYaml4(state.manifestYaml);
-  } catch (e) {
-    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} is not valid YAML: ${describe12(e)}`);
-    return 2;
-  }
-  const deployedParse = parseManifest(deployedObj);
+  const deployedParse = parseManifestAnyVersion(state.manifestYaml, `deployed manifest at ${state.deployedManifestSha}`);
   if (deployedParse.kind !== "ok") {
-    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} failed schema validation:`);
-    for (const issue of deployedParse.issues) {
-      io.err(`  - ${issue.path}: ${issue.message}`);
+    if (deployedParse.kind === "yaml-parse-error") {
+      io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} is not valid YAML: ${deployedParse.message}`);
+    } else if (deployedParse.kind === "schema-error") {
+      io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} failed schema validation against ${deployedParse.schema}:`);
+      for (const issue of deployedParse.issues) {
+        io.err(`  - ${issue.path}: ${issue.message}`);
+      }
     }
     return 2;
   }
   const deployed = deployedParse.manifest;
+  if (local.apiVersion !== deployed.apiVersion) {
+    const reason = `local manifest uses ${local.apiVersion}, while the deployed manifest uses ${deployed.apiVersion}; ` + "the manifest shapes differ, so drift was not evaluated";
+    const out = {
+      state: "live_drift_unknown",
+      drift: null,
+      driftUnavailableReason: reason,
+      ...statusTruthFields({
+        slug: parsed.slug,
+        deployedSha: state.deployedManifestSha,
+        headSha: state.appRepoHeadSha,
+        openPrNumber: state.openPr?.number ?? null,
+        ...deploymentKnown ? { deployment } : {},
+        ...standingExceptions !== null ? { standingExceptions } : {}
+      })
+    };
+    emit4(out, parsed.json, io);
+    return 0;
+  }
   const localGroups = await resolveStatusGroups({
     cfg,
-    refs: allowedEntraGroups(local.access),
+    refs: allowedEntraGroups(manifestAccess(local)),
     source: "local manifest",
     manifestSha: null
   });
@@ -5804,14 +6031,17 @@ async function runStatus(args, io) {
   }
   const deployedGroups = await resolveStatusGroups({
     cfg,
-    refs: allowedEntraGroups(deployed.access),
+    refs: allowedEntraGroups(manifestAccess(deployed)),
     source: "deployed manifest",
     manifestSha: state.deployedManifestSha
   });
   if (deployedGroups.kind === "error") {
     return renderStatusGroupError(deployedGroups.envelope, parsed.json, io);
   }
-  const drift = computeDrift(local, deployed, {
+  const drift = local.apiVersion === "launchpad.m-kopa.us/v2" && deployed.apiVersion === "launchpad.m-kopa.us/v2" ? computeV2SpecDrift(local, deployed, {
+    local: localGroups.ids,
+    deployed: deployedGroups.ids
+  }) : computeDrift(local, deployed, {
     local: localGroups.ids,
     deployed: deployedGroups.ids
   });
@@ -5828,8 +6058,8 @@ async function runStatus(args, io) {
     }
     accessDrift = detectCanonicalAccessDrift(localGroups.ids, enforcedGroups.ids);
   }
-  const localAssignmentGroups = (local.auth ?? "access") === "access" ? localGroups : null;
-  const deployedAssignmentGroups = (deployed.auth ?? "access") === "access" ? deployedGroups : null;
+  const localAssignmentGroups = manifestAuth(local) === "access" ? localGroups : null;
+  const deployedAssignmentGroups = manifestAuth(deployed) === "access" ? deployedGroups : null;
   const assignmentCheck = localAssignmentGroups === null && deployedAssignmentGroups === null ? { kind: "ok", issues: [] } : await findAssignmentIssues(cfg, localAssignmentGroups, deployedAssignmentGroups, state.deployedManifestSha);
   if (assignmentCheck.kind === "error") {
     return renderStatusGroupError(assignmentCheck.envelope, parsed.json, io);
@@ -6030,6 +6260,58 @@ function computeDrift(local, deployed, canonicalGroups) {
   }
   return diffs;
 }
+function computeV2SpecDrift(local, deployed, canonicalGroups) {
+  const localSpec = {
+    ...local.spec,
+    access: {
+      ...local.spec.access,
+      allowed_entra_groups: [
+        ...canonicalGroups?.local ?? local.spec.access.allowed_entra_groups
+      ].sort()
+    }
+  };
+  const deployedSpec = {
+    ...deployed.spec,
+    access: {
+      ...deployed.spec.access,
+      allowed_entra_groups: [
+        ...canonicalGroups?.deployed ?? deployed.spec.access.allowed_entra_groups
+      ].sort()
+    }
+  };
+  const diffs = [];
+  compareV2Value("spec", localSpec, deployedSpec, diffs);
+  return diffs;
+}
+function compareV2Value(path8, local, deployed, diffs) {
+  if (Object.is(local, deployed))
+    return;
+  if (Array.isArray(local) || Array.isArray(deployed)) {
+    if (JSON.stringify(local) !== JSON.stringify(deployed)) {
+      diffs.push({ path: path8, local, deployed });
+    }
+    return;
+  }
+  if (typeof local === "object" && local !== null && typeof deployed === "object" && deployed !== null) {
+    const localRecord = local;
+    const deployedRecord = deployed;
+    const keys = new Set([
+      ...Object.keys(localRecord),
+      ...Object.keys(deployedRecord)
+    ]);
+    for (const key of [...keys].sort()) {
+      compareV2Value(`${path8}.${key}`, localRecord[key], deployedRecord[key], diffs);
+    }
+    return;
+  }
+  diffs.push({ path: path8, local, deployed });
+}
+function manifestAccess(manifest) {
+  return manifest.apiVersion === "launchpad.m-kopa.us/v2" ? manifest.spec.access : manifest.access;
+}
+function manifestAuth(manifest) {
+  return manifest.apiVersion === "launchpad.m-kopa.us/v2" ? manifest.spec.auth ?? "access" : manifest.auth ?? "access";
+}
 function lifecycleOutput(slug, lc) {
   const state = lc.state === "failed" ? "provisioning_failed" : lc.state === "live" ? "in_sync" : lc.state;
   return {
@@ -6097,7 +6379,7 @@ function emit4(out, asJson, io) {
       surfaceExceptions(out, io);
       return;
     case "live_content_untracked":
-      io.out(`${out.slug}: live — content deployed via ` + `${triggerLabel(out.deployment?.liveDeployment?.trigger)} (no platform-tracked manifest; this app deploys outside \`launchpad deploy\`).`);
+      io.out(`${out.slug}: live — content deployed via ` + `${triggerLabel(out.deployment?.liveDeployment?.trigger)} ` + `(no platform-tracked manifest; this app deploys outside \`launchpad deploy\`).`);
       surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
@@ -6159,6 +6441,10 @@ function surfaceGroupIssues(out, io) {
 function surfaceNoLocalManifestNote(out, io) {
   if (out.drift !== null)
     return;
+  if (out.driftUnavailableReason !== undefined) {
+    io.out(`  ${out.driftUnavailableReason}.`);
+    return;
+  }
   io.out("  no local launchpad.yaml here — drift not checked " + "(cd into the app directory or pass --file to compare)");
 }
 function triggerLabel(trigger) {
@@ -6184,7 +6470,13 @@ function surfaceFailedLifecycleDeployment(out, io) {
 }
 function surfaceDeployment(out, io) {
   const dep = out.deployment;
-  if (dep === undefined || dep === null || !dep.supported)
+  if (dep === undefined || dep === null)
+    return;
+  if (dep.origin === "dispatch") {
+    surfaceV2Deployment(dep, io);
+    return;
+  }
+  if (!dep.supported)
     return;
   if (dep.reconciledToLive === true) {
     io.out("  ✓ recovered: this app was in a failed state; its verified-live build reconciled the record failed→live (no `launchpad recover` needed).");
@@ -6224,6 +6516,29 @@ function surfaceDeployment(out, io) {
     }
   }
 }
+function surfaceV2Deployment(dep, io) {
+  for (const line of renderV2DeploymentLines(dep))
+    io.out(line);
+}
+function renderV2DeploymentLines(dep) {
+  const delivery = dep.v2;
+  if (delivery === undefined) {
+    return ["  v2 delivery: dispatch origin (delivery state unavailable)."];
+  }
+  const lines = [];
+  const deliveredAt = delivery.state === "delivered" && delivery.deliveredAt !== undefined ? `, delivered ${delivery.deliveredAt}` : "";
+  lines.push(`  v2 delivery: state ${delivery.state}, stage ${delivery.stage}, commit ${delivery.commitSha.slice(0, 7)}${deliveredAt}`);
+  if (delivery.state === "refused") {
+    const failedAt = delivery.failedAt ?? delivery.stage;
+    lines.push(`    failed at ${failedAt}${delivery.reason ? `: ${delivery.reason}` : ""}`);
+    if (delivery.runUrl)
+      lines.push(`    GitHub run: ${delivery.runUrl}`);
+  }
+  if (delivery.state !== "delivered" && dep.lastSuccessfulDeployment !== null) {
+    lines.push(`    serving: previous successful deployment from ${dep.lastSuccessfulDeployment.createdOn}`);
+  }
+  return lines;
+}
 function surfaceExceptions(out, io) {
   const exceptions = out.standingExceptions;
   if (exceptions === undefined || exceptions.length === 0)
@@ -6240,7 +6555,7 @@ function surfaceHeadVsDeployed(out, io) {
     if (out.hasOpenPr) {
       io.out(`  (deployed sha ${short(out.deployedSha)} is behind app-repo HEAD ${short(out.headSha)};` + ` an apply may be queued — see PR #${out.openPrNumber})`);
     } else {
-      io.out(`  (deployed sha ${short(out.deployedSha)} is behind app-repo HEAD ${short(out.headSha)}; main is ahead of deployed)`);
+      io.out(`  (deployed sha ${short(out.deployedSha)} is behind app-repo HEAD ${short(out.headSha)};` + ` main is ahead of deployed)`);
     }
   }
 }
@@ -6261,7 +6576,7 @@ function warnSecretShape(env, io) {
     const hasPrefix = prefixes.some((p) => v.startsWith(p));
     const longBase64Shape = v.length >= 32 && /^[A-Za-z0-9+/=_-]+$/.test(v);
     if (hasPrefix && longBase64Shape) {
-      io.err(`launchpad status: production_env.${k} looks like a secret. production_env is non-secret by contract; move secrets to the secrets bindings path. (This is informational; status will continue.)`);
+      io.err(`launchpad status: production_env.${k} looks like a secret. ` + `production_env is non-secret by contract; move secrets to the ` + `secrets bindings path. (This is informational; status will continue.)`);
     }
   }
 }
@@ -6320,7 +6635,7 @@ function parseArgs2(args, cwd = process.cwd(), warn) {
   if (slug === null) {
     const inferred = inferSlug({ cwd, file, warn });
     if (inferred === null) {
-      return `slug not provided + cannot infer from cwd. Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
+      return `slug not provided + cannot infer from cwd. ` + `Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
     slug = inferred;
   }
@@ -6379,7 +6694,7 @@ function readLocalEntrypoint(cwd) {
   for (const rel of ["index.html", join9("static", "index.html")]) {
     const p = join9(cwd, rel);
     if (existsSync4(p))
-      return new Uint8Array(readFileSync9(p));
+      return new Uint8Array(readFileSync10(p));
   }
   return null;
 }
@@ -6394,13 +6709,25 @@ function realVerifyDeployDeps(cfg) {
 }
 async function runDeployVerification(args, io, deps) {
   io.out("");
-  io.out("Verifying a build of your commit went live …");
+  if (args.dispatchOrigin === true) {
+    io.out("Waiting for your repo build and dispatch delivery …");
+  } else {
+    io.out("Verifying a build of your commit went live …");
+  }
+  const seenV2Stages = new Set;
+  const onV2Stage = (delivery) => {
+    if (seenV2Stages.has(delivery.stage))
+      return;
+    seenV2Stages.add(delivery.stage);
+    io.out(`  v2 stage: ${v2StageLabel(delivery.stage)}`);
+  };
   const settle = await deps.wait({
     slug: args.slug,
     shippedSha: args.shippedSha,
     baseline: args.baseline,
     registrationBoundMs: args.registrationBoundMs,
-    settleTimeoutMs: args.timeoutMs
+    settleTimeoutMs: args.timeoutMs,
+    onV2Stage
   }, deps.waitDeps);
   switch (settle.kind) {
     case "unsupported":
@@ -6429,10 +6756,25 @@ async function runDeployVerification(args, io, deps) {
       io.out(`   It may still be queued. Re-check the outcome: \`launchpad status ${args.slug}\``);
       return 0;
     case "pending":
+      if (args.dispatchOrigin === true || seenV2Stages.size > 0) {
+        io.out(`⏳ Dispatch delivery is still in progress after ${Math.round(args.timeoutMs / 1000)}s - couldn't verify yet.`);
+        io.out(`   Re-check the outcome: \`launchpad status ${args.slug}\``);
+        return 0;
+      }
       io.out(`⏳ Your commit's build is still in progress after ${Math.round(args.timeoutMs / 1000)}s — couldn't verify yet.`);
       io.out(`   Re-check the outcome: \`launchpad status ${args.slug}\``);
       return 0;
     case "failure":
+      if (settle.dispatch === true) {
+        io.err(`✗ Dispatch delivery REFUSED at ${settle.failedStage ?? "unknown"} - your commit is NOT live.`);
+        if (settle.reason)
+          io.err(`  reason: ${redactDiagnostic(settle.reason)}`);
+        if (settle.detail)
+          io.err(`  detail: ${redactDiagnostic(settle.detail)}`);
+        if (settle.runUrl)
+          io.err(`  GitHub run: ${settle.runUrl}`);
+        return 1;
+      }
       io.err("✗ The Cloudflare Pages build for your commit FAILED — your content is NOT live.");
       if (settle.failedStage)
         io.err(`  failed stage: ${redactDiagnostic(settle.failedStage)}`);
@@ -6444,9 +6786,30 @@ async function runDeployVerification(args, io, deps) {
       io.err(`  Full logs: \`launchpad status ${args.slug}\``);
       return 1;
     case "success":
+      if (settle.v2 !== undefined) {
+        const deliveredAt = settle.v2.deliveredAt ? ` at ${settle.v2.deliveredAt}` : "";
+        io.out(`✓ Live in dispatch namespace - delivered commit ${settle.v2.commitSha}${deliveredAt}.`);
+        return 0;
+      }
       return verifySuccess(args, settle.deploymentUrl, io, deps);
   }
 }
+function v2StageLabel(stage) {
+  switch (stage) {
+    case "committed":
+      return "source committed";
+    case "building":
+      return "CI building";
+    case "verified":
+      return "run verified";
+    case "uploading":
+      return "artifact uploading";
+    case "live":
+      return "live in dispatch namespace";
+    case "failed":
+      return "failed";
+  }
+}
 function realRedeployVerifyDeps(cfg) {
   return {
     wait: waitForDeployment,
@@ -6673,7 +7036,7 @@ function runGit2(sp, cwd, args) {
 }
 
 // src/deploy/manifest-diff.ts
-import { parse as parseYaml4 } from "yaml";
+import { parse as parseYaml5 } from "yaml";
 var MASK = "«redacted»";
 var SECRET_KEY_SEGMENT = /(secret|token|api[_-]?key|access[_-]?key|private[_-]?key|secret[_-]?key|password|passwd|pwd|authorization|auth[_-]?token|bearer|client[_-]?secret|session|credential|value)/i;
 function isSecretPath(path8) {
@@ -6764,7 +7127,7 @@ function diffManifests(localYaml, deployedYaml) {
   let local;
   let deployed;
   try {
-    local = normalize(parseYaml4(localYaml));
+    local = parseYaml5(localYaml);
   } catch (e) {
     return {
       inSync: false,
@@ -6773,7 +7136,7 @@ function diffManifests(localYaml, deployedYaml) {
     };
   }
   try {
-    deployed = normalize(parseYaml4(deployedYaml));
+    deployed = parseYaml5(deployedYaml);
   } catch (e) {
     return {
       inSync: false,
@@ -6781,6 +7144,22 @@ function diffManifests(localYaml, deployedYaml) {
       parseError: `deployed manifest did not parse: ${e.message}`
     };
   }
+  const localVersion = manifestApiVersion(local);
+  const deployedVersion = manifestApiVersion(deployed);
+  if (localVersion !== deployedVersion && (isV2(localVersion) || isV2(deployedVersion))) {
+    return {
+      inSync: false,
+      changes: [],
+      parseError: null,
+      shapeMismatch: `local uses ${localVersion ?? "an unknown schema"}; deployed uses ${deployedVersion ?? "an unknown schema"}`
+    };
+  }
+  if (isV2(localVersion) && isV2(deployedVersion)) {
+    local = { spec: manifestSpec(local) };
+    deployed = { spec: manifestSpec(deployed) };
+  }
+  local = normalize(local);
+  deployed = normalize(deployed);
   if (stableStringify(local) === stableStringify(deployed)) {
     return { inSync: true, changes: [], parseError: null };
   }
@@ -6827,6 +7206,18 @@ function diffManifests(localYaml, deployedYaml) {
   }
   return { inSync: false, changes, parseError: null };
 }
+function manifestApiVersion(value) {
+  if (typeof value !== "object" || value === null)
+    return null;
+  const apiVersion = value.apiVersion;
+  return typeof apiVersion === "string" ? apiVersion : null;
+}
+function isV2(apiVersion) {
+  return apiVersion === "launchpad.m-kopa.us/v2";
+}
+function manifestSpec(value) {
+  return typeof value === "object" && value !== null ? value.spec : undefined;
+}
 function renderManifestDiffLines(diff, max = 20) {
   const lines = [];
   for (const c of diff.changes.slice(0, max)) {
@@ -7255,47 +7646,6 @@ function parseDeployFlags(args) {
 import { existsSync as existsSync6, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join10 } from "node:path";
 
-// src/manifest/load.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-import { parse as parseYaml5, YAMLParseError } from "yaml";
-function loadManifest(path8) {
-  let raw;
-  try {
-    raw = readFileSync10(path8, "utf8");
-  } catch (err) {
-    const e = err;
-    if (e.code === "ENOENT") {
-      return { kind: "file-not-found", path: path8 };
-    }
-    return { kind: "read-error", path: path8, message: e.message ?? String(err) };
-  }
-  return parseManifest2(raw, path8);
-}
-function parseManifest2(yamlText, path8) {
-  let parsed;
-  try {
-    parsed = parseYaml5(yamlText);
-  } catch (err) {
-    const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
-    return { kind: "yaml-parse-error", path: path8, message };
-  }
-  const result = ManifestSchema.safeParse(parsed);
-  if (result.success) {
-    return { kind: "ok", manifest: result.data };
-  }
-  return {
-    kind: "schema-error",
-    path: path8,
-    issues: formatIssues(result.error)
-  };
-}
-function formatIssues(error) {
-  return error.issues.map((issue) => ({
-    path: issue.path.map(String).join(".") || "(root)",
-    message: issue.message
-  }));
-}
-
 // src/status-page-output.ts
 async function surfaceStatusPageUrl(url, io, options) {
   if (typeof url !== "string" || url.length === 0)
@@ -7370,13 +7720,13 @@ async function runDeployApply(opts, io, deps = {}) {
     return 0;
   }
   const manifestPath = resolvePath(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError(loaded, io);
   }
-  const slug = loaded.manifest.metadata.name;
+  const slug = manifestSlug(loaded);
   if (!SLUG_REGEX2.test(slug)) {
-    io.err(`launchpad deploy --apply: manifest's metadata.name '${slug}' is not a valid slug`);
+    io.err(`launchpad deploy --apply: manifest's ${loaded.schema === "launchpad.m-kopa.us/v2" ? "metadata.slug" : "metadata.name"} '${slug}' is not a valid slug`);
     return 1;
   }
   if (opts.atSha !== undefined && !MANIFEST_SHA_REGEX.test(opts.atSha)) {
@@ -7667,12 +8017,12 @@ function deletePinIfPresent(cfg, slug, io) {
 }
 async function loadSlugForResume(opts, io) {
   const manifestPath = resolvePath(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok") {
     renderManifestError(loaded, io);
     return null;
   }
-  return loaded.manifest.metadata.name;
+  return manifestSlug(loaded);
 }
 async function defaultPrompt(question) {
   const { createInterface } = await import("node:readline/promises");
@@ -7713,6 +8063,10 @@ function mapHttpError(e, slug, io) {
   io.err(`launchpad deploy --apply failed: ${describe14(e)}`);
   return 2;
 }
+function manifestSlug(loaded) {
+  const { metadata } = loaded.manifest;
+  return "slug" in metadata ? metadata.slug : metadata.name;
+}
 function renderManifestError(loaded, io) {
   switch (loaded.kind) {
     case "ok":
@@ -8608,6 +8962,10 @@ async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
     io.out(`  config diff: skipped (${diff.parseError}).`);
     return;
   }
+  if (diff.shapeMismatch !== undefined) {
+    io.out(`  config diff: manifest shapes differ (${diff.shapeMismatch}); drift was not evaluated.`);
+    return;
+  }
   if (diff.inSync) {
     io.out("  config: launchpad.yaml matches the deployed manifest (in sync).");
     return;
@@ -8631,6 +8989,7 @@ async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
   let appType = "static";
+  let declaredOrigin;
   try {
     const manifestObj = parseYaml6(readFileSync11(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
@@ -8640,13 +8999,22 @@ async function runModelADeploy(args) {
     }
     slug = metaSlug;
     const raw = manifestObj;
-    const isV2 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
-    const deploymentType = isV2 ? raw?.spec?.appType : raw?.deployment?.type;
+    const isV22 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
+    declaredOrigin = declaredOriginOf(isV22, raw?.spec?.origin);
+    const deploymentType = isV22 ? raw?.spec?.appType : raw?.deployment?.type;
     if (deploymentType === "static" || deploymentType === "react" || deploymentType === "react+api" || deploymentType === "container") {
       appType = deploymentType;
     }
+    if (appType !== undefined) {
+      const auth = isV22 ? raw?.spec?.auth : raw?.auth;
+      const issue = deploymentAuthIssue(appType, auth === "gateway" ? "gateway" : auth === "access" ? "access" : undefined);
+      if (issue !== null) {
+        io.err(`launchpad deploy: ${issue.message}`);
+        return 1;
+      }
+    }
     if (deploymentType === "container") {
-      const parsed = isV2 ? parseManifestV2(manifestObj) : parseManifest(manifestObj);
+      const parsed = isV22 ? parseManifestV2(manifestObj) : parseManifest(manifestObj);
       if (parsed.kind !== "ok") {
         io.err("launchpad deploy: manifest is structurally invalid:");
         for (const issue of parsed.issues) {
@@ -8698,7 +9066,8 @@ async function runModelADeploy(args) {
   try {
     await surfaceManifestDiff(cfg, slug, manifestPath, io);
   } catch {}
-  const deployBaseline = noVerify ? null : await readDeploymentBaseline(realCommitWaitDeps(cfg), slug);
+  const deployContext = await readDeploymentContext(realCommitWaitDeps(cfg), slug);
+  const deployBaseline = noVerify ? null : deployContext.baseline;
   let result;
   try {
     if (args.allowUnguarded) {
@@ -8828,7 +9197,11 @@ async function runModelADeploy(args) {
         if (accessExit !== 0)
           return accessExit;
         io.out("");
-        io.out("Committed; build pending - Cloudflare Pages is building this deploy now.");
+        const dispatchOrigin = handoffIsDispatch({
+          declared: declaredOrigin,
+          baseline: deployContext.origin
+        });
+        surfaceCommittedHandoff(dispatchOrigin, io, "ascii");
         if (noVerify)
           return 0;
         return runDeployVerification({
@@ -8838,7 +9211,8 @@ async function runModelADeploy(args) {
           shippedSha: outcome.manifest_sha,
           baseline: deployBaseline,
           registrationBoundMs,
-          timeoutMs: verifyTimeoutMs
+          timeoutMs: verifyTimeoutMs,
+          dispatchOrigin
         }, io, realVerifyDeployDeps(cfg));
       }
       io.err(`launchpad deploy: ${formatErrorEnvelope(body)}`);
@@ -8934,9 +9308,18 @@ async function runModelADeploy(args) {
       }
       surfaceDeployExtras(success, io, slug, args.allowStale);
       io.out("");
-      io.out("Committed; build pending — Cloudflare Pages is building this deploy now.");
+      const dispatchOrigin = handoffIsDispatch({
+        v2Delivery: success.v2Delivery,
+        declared: declaredOrigin,
+        baseline: deployContext.origin
+      });
+      surfaceCommittedHandoff(dispatchOrigin, io);
       if (noVerify) {
-        io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
+        if (dispatchOrigin) {
+          io.out(`Run \`launchpad status ${slug}\` to confirm the delivery stage and outcome.`);
+        } else {
+          io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
+        }
         return 0;
       }
       return runDeployVerification({
@@ -8946,11 +9329,33 @@ async function runModelADeploy(args) {
         shippedSha: success.commit_sha,
         baseline: deployBaseline,
         registrationBoundMs,
-        timeoutMs: verifyTimeoutMs
+        timeoutMs: verifyTimeoutMs,
+        dispatchOrigin
       }, io, realVerifyDeployDeps(cfg));
     }
   }
 }
+function surfaceCommittedHandoff(dispatchOrigin, io, pagesStyle = "unicode") {
+  io.out(committedHandoffMessage(dispatchOrigin, pagesStyle));
+}
+function declaredOriginOf(isV22, origin) {
+  if (!isV22)
+    return "pages";
+  return origin === "dispatch" ? "dispatch" : "pages";
+}
+function handoffIsDispatch(input) {
+  if (input.v2Delivery === "pending" || input.v2Delivery === "deferred")
+    return true;
+  if (input.declared !== undefined)
+    return input.declared === "dispatch";
+  return input.baseline === "dispatch";
+}
+function committedHandoffMessage(dispatchOrigin, pagesStyle = "unicode") {
+  if (dispatchOrigin) {
+    return "Committed; your repo's build workflow is building this commit, then the bot delivers it to the dispatch namespace.";
+  }
+  return pagesStyle === "ascii" ? "Committed; build pending - Cloudflare Pages is building this deploy now." : "Committed; build pending — Cloudflare Pages is building this deploy now.";
+}
 function pendingReconcileOutcome(body) {
   const manifestSha = body.manifestSha;
   const id = body.reconcileId;
@@ -10378,8 +10783,26 @@ async function runInit(args, io, prompt) {
     io.err(`launchpad init: ${fillResult.message}`);
     return 64;
   }
+  const authIssue = deploymentAuthIssue(fillResult.inputs.type, fillResult.inputs.auth ?? "gateway");
+  if (authIssue !== null) {
+    io.err(`launchpad init: ${authIssue.message}`);
+    return 64;
+  }
+  if (fillResult.inputs.type === "container" && inputs.origin !== undefined) {
+    io.err("launchpad init: --origin is not supported for containers");
+    return 64;
+  }
+  const dispatch = newAppOrigin(fillResult.inputs.type, inputs.origin) === "dispatch";
+  if (dispatch && fillResult.inputs.type === "react+api") {
+    io.err("launchpad init: API starter dispatch is not available yet; use --origin pages");
+    return 64;
+  }
+  if (dispatch && (inputs.hostnames.length > 0 || inputs.sessionDuration !== undefined)) {
+    io.err("launchpad init: dispatch does not support --hostname or --session-duration; use --origin pages for a Pages manifest");
+    return 64;
+  }
   const manifest = buildManifest(fillResult.inputs, detected);
-  const validation = ManifestSchema.safeParse(manifest);
+  const validation = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? ManifestV2Schema.safeParse(manifest) : ManifestSchema.safeParse(manifest);
   if (!validation.success) {
     io.err("launchpad init: invalid manifest input");
     for (const issue of validation.error.issues) {
@@ -10432,8 +10855,11 @@ async function runInit(args, io, prompt) {
   io.out("");
   io.out("Next steps:");
   io.out("  launchpad validate                # confirm the manifest");
-  io.out("  launchpad secrets template        # scaffold .env.example");
-  io.out("  launchpad deploy                  # ship it (Scope 6, pending)");
+  if (!dispatch)
+    io.out("  launchpad secrets template        # scaffold .env.example");
+  io.out("  launchpad deploy                  # build and deploy the app");
+  if (dispatch)
+    io.out("  Dispatch currently supports plain-text environment variables, but not secret bindings.");
   return 0;
 }
 function parseArgs6(args) {
@@ -10444,6 +10870,7 @@ function parseArgs6(args) {
     description: undefined,
     type: undefined,
     auth: undefined,
+    origin: undefined,
     groups: [],
     sessionDuration: undefined,
     hostnames: [],
@@ -10528,6 +10955,16 @@ function parseArgs6(args) {
       inputs.type = got;
       continue;
     }
+    if (a === "--origin") {
+      const got = needsValue();
+      if (typeof got !== "string")
+        return got;
+      if (got !== "pages" && got !== "dispatch") {
+        return { kind: "usage-error", message: "--origin must be pages or dispatch" };
+      }
+      inputs.origin = got;
+      continue;
+    }
     if (a === "--auth") {
       const got = needsValue();
       if (typeof got !== "string")
@@ -10722,6 +11159,7 @@ async function fillRequired(inputs, options, io, prompt) {
       description: inputs.description,
       type: typeR,
       auth: inputs.auth,
+      origin: inputs.origin,
       groups: groupsR,
       sessionDuration: inputs.sessionDuration,
       hostnames: inputs.hostnames,
@@ -10781,6 +11219,29 @@ function buildManifest(inputs, detected) {
     root: ".",
     include: [...defaultIncludeForAppType(inputs.type)]
   };
+  if (newAppOrigin(inputs.type, inputs.origin) === "dispatch") {
+    return {
+      apiVersion: "launchpad.m-kopa.us/v2",
+      kind: "App",
+      metadata: { slug: inputs.name, schemaVersion: 2 },
+      spec: {
+        appType: inputs.type,
+        origin: "dispatch",
+        auth: resolvedAuth,
+        display: {
+          name: inputs.name,
+          team: inputs.team,
+          ...inputs.description ? { description: inputs.description } : {}
+        },
+        owner: { email: inputs.owner },
+        access: { allowed_entra_groups: [...inputs.groups] },
+        app: manifest.app,
+        ...manifest.build === undefined ? {} : { build: manifest.build }
+      }
+    };
+  }
+  if (inputs.origin === "pages")
+    manifest.origin = "pages";
   return manifest;
 }
 function starterIndexHtml(slug) {
@@ -13220,11 +13681,15 @@ async function runSecretsPush(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
   const manifestPath = resolvePath4(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError4(loaded, io);
   }
-  const bindings = loaded.manifest.secrets?.bindings ?? [];
+  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets push", io);
+  if (v2Refusal !== null)
+    return v2Refusal;
+  const manifest = loaded.manifest;
+  const bindings = manifest.secrets?.bindings ?? [];
   const envFileBindings = bindings.filter((b) => b.source === "env-file");
   if (envFileBindings.length === 0) {
     io.out("No `env-file` secret bindings declared in the manifest.");
@@ -13306,7 +13771,7 @@ async function runSecretsPush(opts, io, deps = {}) {
     io.out("Re-run without --dry-run to push.");
     return 0;
   }
-  const slug = loaded.manifest.metadata.name;
+  const slug = manifest.metadata.name;
   let pushed = 0;
   let partial = 0;
   let anyPagesUpdated = false;
@@ -13431,6 +13896,20 @@ function mapPushError(e, slug, name, io) {
 function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function refuseV2Manifest(loaded, command, io) {
+  if (loaded.schema !== "launchpad.m-kopa.us/v2")
+    return null;
+  const origin = loaded.manifest.spec?.origin;
+  if (origin === "dispatch") {
+    io.err(`${command}: this is a dispatch-origin (v2) app.`);
+    const outcome = command.endsWith("push") ? "nothing was pushed" : "nothing was read";
+    io.err(`  Secrets are not delivered to the dispatch namespace yet (PS-2740); ${outcome}.`);
+    return 1;
+  }
+  io.err(`${command}: this is a launchpad.m-kopa.us/v2 manifest.`);
+  io.err("  This command reads v1alpha1 `secrets.bindings`; v2 declares secrets as `spec.env_vars` `secret_text` entries, which it does not push yet.");
+  return 1;
+}
 function renderManifestError4(result, io) {
   switch (result.kind) {
     case "ok":
@@ -13468,16 +13947,20 @@ async function runSecretsStatus(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
   const manifestPath = resolvePath5(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok")
     return renderManifestError5(loaded, io);
-  const slug = loaded.manifest.metadata.name;
+  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets status", io);
+  if (v2Refusal !== null)
+    return v2Refusal;
+  const manifest = loaded.manifest;
+  const slug = manifest.metadata.name;
   if (opts.slug != null && opts.slug !== slug) {
     io.err(`launchpad secrets status: slug "${opts.slug}" does not match this directory's ` + `manifest (metadata.name: "${slug}").`);
     io.err("  secrets status audits the manifest in the current directory — omit the slug, " + "or run from the app's directory.");
     return 2;
   }
-  const bindings = loaded.manifest.secrets?.bindings ?? [];
+  const bindings = manifest.secrets?.bindings ?? [];
   if (bindings.length === 0) {
     io.out("No secret bindings declared in the manifest.");
     return 0;
@@ -14845,7 +15328,7 @@ import { existsSync as existsSync16, readFileSync as readFileSync21, readdirSync
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
-  summary: "validate launchpad.yaml against the v1alpha1 schema",
+  summary: "validate launchpad.yaml against its v1alpha1 or v2 schema",
   run: runValidate
 };
 async function runValidate(args, io) {
@@ -14857,7 +15340,7 @@ async function runValidate(args, io) {
   }
   const { file, json, strictGroups } = parseResult;
   const path14 = resolve17(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifest(path14);
+  const result = loadManifestAnyVersion(path14);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
@@ -14867,16 +15350,17 @@ async function runValidate(args, io) {
     manifest: result.manifest,
     io,
     json,
-    structurallyValidName: result.manifest.metadata.name
+    structurallyValidName: manifestView(result.manifest).name
   });
   if (unsupported2 !== null)
     return unsupported2;
-  const boundary = checkBoundary(path14, result.manifest.app !== undefined);
+  const view = manifestView(result.manifest);
+  const boundary = checkBoundary(path14, view.appDeclared);
   const serveErrors = checkStaticServeDir(path14, result.manifest);
   if (serveErrors.length > 0) {
     boundary.errors = [...boundary.errors, ...serveErrors];
   }
-  const groupCheck = strictGroups ? await checkGroups(allowedEntraGroups(result.manifest.access)) : { kind: "skipped" };
+  const groupCheck = strictGroups ? await checkGroups(allowedEntraGroups(view.access)) : { kind: "skipped" };
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
 function checkBoundary(manifestPath, declared) {
@@ -14900,11 +15384,12 @@ function checkBoundary(manifestPath, declared) {
   return { declared, errors: [], warnings: r.warnings };
 }
 function checkStaticServeDir(manifestPath, manifest) {
-  if (manifest.deployment.type !== "static")
+  const view = manifestView(manifest);
+  if (view.deploymentType !== "static")
     return [];
-  if (manifest.build?.command !== undefined)
+  if (view.buildCommand !== undefined)
     return [];
-  const serveDir = manifest.build?.destination_dir ?? STATIC_SERVE_DIR;
+  const serveDir = view.destinationDir ?? STATIC_SERVE_DIR;
   const normalized = serveDir.replace(/\\/g, "/");
   const segments = normalized.split("/");
   if (normalized === "" || normalized === "." || normalized === "./" || normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized) || segments.some((s) => s === "..")) {
@@ -15004,9 +15489,10 @@ async function checkGroups(groups) {
   return ok ? { kind: "all-ok", perGroup } : { kind: "some-failed", perGroup };
 }
 function renderHumanOk(result, group, boundary, io) {
-  io.out(`✓ ${result.manifest.metadata.name} — manifest is valid`);
-  io.out(`  apiVersion: launchpad.m-kopa.us/v1alpha1`);
-  io.out(`  type:       ${result.manifest.deployment.type}`);
+  const view = manifestView(result.manifest);
+  io.out(`✓ ${view.name} — manifest is valid`);
+  io.out(`  apiVersion: ${result.schema}`);
+  io.out(`  type:       ${view.deploymentType}`);
   if (boundary.errors.length > 0) {
     for (const e of boundary.errors) {
       io.err(`✗ app boundary: ${e}`);
@@ -15075,6 +15561,7 @@ function renderHumanError(result, io) {
       return 1;
     case "schema-error":
       io.err(`✗ ${result.path}`);
+      io.err(`  validated against schema: ${result.schema}`);
       io.err(`  ${result.issues.length} schema issue${result.issues.length === 1 ? "" : "s"}:`);
       for (const issue of result.issues) {
         io.err(`    ${issue.path}: ${issue.message}`);
@@ -15083,11 +15570,12 @@ function renderHumanError(result, io) {
   }
 }
 function renderJsonOk(result, group, boundary, io) {
+  const view = manifestView(result.manifest);
   const base = {
     manifest_valid: true,
     runtime_supported: true,
-    name: result.manifest.metadata.name,
-    deploymentType: result.manifest.deployment.type,
+    name: view.name,
+    deploymentType: view.deploymentType,
     appBoundary: {
       declared: boundary.declared,
       errors: boundary.errors,
@@ -15167,11 +15655,32 @@ function renderJsonError(result, io) {
         ok: false,
         kind: "schema-error",
         path: result.path,
+        schema: result.schema,
         issues: result.issues
       }));
       return 1;
   }
 }
+function manifestView(manifest) {
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2") {
+    return {
+      name: manifest.metadata.slug,
+      deploymentType: manifest.spec.appType,
+      access: manifest.spec.access,
+      buildCommand: manifest.spec.build?.command,
+      destinationDir: manifest.spec.build?.destination_dir,
+      appDeclared: manifest.spec.app !== undefined
+    };
+  }
+  return {
+    name: manifest.metadata.name,
+    deploymentType: manifest.deployment.type,
+    access: manifest.access,
+    buildCommand: manifest.build?.command,
+    destinationDir: manifest.build?.destination_dir,
+    appDeclared: manifest.app !== undefined
+  };
+}
 function parseArgs13(args) {
   let file;
   let json = false;