@m-kopa/launchpad-cli 0.57.0 → 0.61.0

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.57.0";
+var CLI_VERSION = "0.61.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -2138,6 +2138,9 @@ function parse202(body, fallbackSlug) {
       slug: typeof body.slug === "string" ? body.slug : fallbackSlug,
       message: typeof body.message === "string" ? body.message : "bundle committed; deployment is pending"
     };
+    if (body.v2Delivery !== undefined && body.v2Delivery !== "pending" && body.v2Delivery !== "deferred") {
+      return null;
+    }
     return reconcile === undefined ? accepted : { ...accepted, reconcile };
   }
   if (body.status === "provisioning_started") {
@@ -2567,11 +2570,23 @@ import { join as join6 } from "node:path";
 import { parse as parseYaml2 } from "yaml";
 
 // ../launchpad-engine/dist/schema.js
+import { z as z2 } from "zod";
+
+// ../launchpad-engine/dist/audience.js
 import { z } from "zod";
+var PrivateOwnerSchema = z.object({ oid: z.uuid(), email: z.email() }).strict();
+function validateAudience(access, ctx) {
+  const groups = access.allowed_entra_groups ?? (access.allowed_entra_group ? [access.allowed_entra_group] : []);
+  const valid = access.audience === "private" ? access.private_owner !== undefined && access.allowed_entra_groups !== undefined && groups.length === 0 && !access.identity_types?.includes("dsr") : access.private_owner === undefined && groups.length > 0;
+  if (!valid)
+    ctx.addIssue({ code: "custom", path: ["audience"], message: "Private access requires a verified private_owner, no groups, and employee identity; group access requires at least one group and no private_owner." });
+}
+
+// ../launchpad-engine/dist/schema.js
 var APP_TYPES2 = ["static", "react", "react+api", "container"];
 var AUTH_MODES = ["access", "gateway"];
 var IDENTITY_TYPES = ["employee", "dsr"];
-var IdentityTypesSchema = z.array(z.enum(IDENTITY_TYPES)).min(1).refine((values) => new Set(values).size === values.length, {
+var IdentityTypesSchema = z2.array(z2.enum(IDENTITY_TYPES)).min(1).refine((values) => new Set(values).size === values.length, {
   message: "identity_types must not contain duplicates"
 }).refine((values) => values.includes("employee"), {
   message: "identity_types must include employee"
@@ -2583,111 +2598,115 @@ var PRIMARY_TARGET = "primary";
 var SLUG_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var ENV_NAME_REGEX = /^[A-Z][A-Z0-9_]*$/;
 var SESSION_DURATION_REGEX = /^[0-9]+(s|m|h)$/;
-var MetadataSchema = z.object({
-  name: z.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
-  team: z.string().min(1),
-  owner: z.string().email(),
-  description: z.string().max(280).optional()
+var MetadataSchema = z2.object({
+  name: z2.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
+  team: z2.string().min(1),
+  owner: z2.string().email(),
+  description: z2.string().max(280).optional()
 }).strict();
-var DeploymentSchema = z.object({
-  type: z.enum(APP_TYPES2),
-  runtime: z.enum(RUNTIMES).optional()
+var DeploymentSchema = z2.object({
+  type: z2.enum(APP_TYPES2),
+  runtime: z2.enum(RUNTIMES).optional()
 }).strict();
-var AccessSchema = z.object({
-  allowed_entra_group: z.string().min(1).optional(),
-  allowed_entra_groups: z.array(z.string().min(1)).min(1).refine((arr) => new Set(arr).size === arr.length, { message: "allowed_entra_groups must not contain duplicates" }).optional(),
-  session_duration: z.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional(),
+var AccessSchema = z2.object({
+  audience: z2.literal("private").optional(),
+  private_owner: PrivateOwnerSchema.optional(),
+  allowed_entra_group: z2.string().min(1).optional(),
+  allowed_entra_groups: z2.array(z2.string().min(1)).refine((arr) => new Set(arr).size === arr.length, { message: "allowed_entra_groups must not contain duplicates" }).optional(),
+  session_duration: z2.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional(),
   identity_types: IdentityTypesSchema.optional()
 }).strict().superRefine((access, ctx) => {
   const hasSingular = access.allowed_entra_group !== undefined;
   const hasPlural = access.allowed_entra_groups !== undefined;
-  if (!hasSingular && !hasPlural) {
+  if (!hasSingular && !hasPlural && access.audience !== "private") {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "either `allowed_entra_group` (singular, legacy) or `allowed_entra_groups` (plural, preferred) must be set",
       path: ["allowed_entra_groups"]
     });
   }
   if (hasSingular && hasPlural) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "`allowed_entra_group` (singular) and `allowed_entra_groups` (plural) are mutually exclusive; use the plural form",
       path: ["allowed_entra_groups"]
     });
   }
-});
+}).superRefine(validateAudience);
 function allowedEntraGroups(access) {
+  if (access.audience === "private")
+    return [];
   if (access.allowed_entra_groups !== undefined) {
     return access.allowed_entra_groups;
   }
   return [access.allowed_entra_group];
 }
-var ContainerSchema = z.object({
-  name: z.string().min(2).max(32).regex(SLUG_REGEX, "container name must be lowercase letters, digits, and hyphens"),
-  image: z.string().min(1),
-  port: z.number().int().min(1).max(65535),
-  ingress: z.boolean().optional(),
-  healthcheck: z.string().default("/health"),
-  env: z.array(z.string().regex(ENV_NAME_REGEX, "env entries must be UPPER_SNAKE_CASE")).optional(),
-  max_instances: z.number().int().min(1).max(100).optional()
+var ContainerSchema = z2.object({
+  name: z2.string().min(2).max(32).regex(SLUG_REGEX, "container name must be lowercase letters, digits, and hyphens"),
+  image: z2.string().min(1),
+  port: z2.number().int().min(1).max(65535),
+  ingress: z2.boolean().optional(),
+  healthcheck: z2.string().default("/health"),
+  env: z2.array(z2.string().regex(ENV_NAME_REGEX, "env entries must be UPPER_SNAKE_CASE")).optional(),
+  max_instances: z2.number().int().min(1).max(100).optional()
 }).strict();
-var TargetSchema = z.object({
-  kind: z.enum(TARGET_KINDS),
-  script: z.string().min(2).max(63).regex(SLUG_REGEX, "target script must be lowercase letters, digits, and hyphens").optional(),
-  schedule: z.array(z.string().min(1).max(120)).min(1).max(20).optional(),
-  d1_binding: z.string().min(1).max(64).regex(ENV_NAME_REGEX, "d1_binding must be an UPPER_SNAKE_CASE binding name").optional()
+var TargetSchema = z2.object({
+  kind: z2.enum(TARGET_KINDS),
+  script: z2.string().min(2).max(63).regex(SLUG_REGEX, "target script must be lowercase letters, digits, and hyphens").optional(),
+  schedule: z2.array(z2.string().min(1).max(120)).min(1).max(20).optional(),
+  d1_binding: z2.string().min(1).max(64).regex(ENV_NAME_REGEX, "d1_binding must be an UPPER_SNAKE_CASE binding name").optional()
 }).strict();
-var SecretBindingSchema = z.object({
-  name: z.string().min(1).max(64).regex(ENV_NAME_REGEX, "secret binding name must be UPPER_SNAKE_CASE"),
-  source: z.enum(SECRET_SOURCES),
-  description: z.string().max(200).optional(),
-  targets: z.union([z.literal("all"), z.array(z.string().min(1)).min(1)]).optional()
+var SecretBindingSchema = z2.object({
+  name: z2.string().min(1).max(64).regex(ENV_NAME_REGEX, "secret binding name must be UPPER_SNAKE_CASE"),
+  source: z2.enum(SECRET_SOURCES),
+  description: z2.string().max(200).optional(),
+  targets: z2.union([z2.literal("all"), z2.array(z2.string().min(1)).min(1)]).optional()
 }).strict();
-var SecretsSchema = z.object({
-  bindings: z.array(SecretBindingSchema).optional()
+var SecretsSchema = z2.object({
+  bindings: z2.array(SecretBindingSchema).optional()
 }).strict();
-var BuildSchema = z.object({
-  command: z.string().min(1).optional(),
-  destination_dir: z.string().min(1),
-  root_dir: z.string()
+var BuildSchema = z2.object({
+  command: z2.string().min(1).optional(),
+  destination_dir: z2.string().min(1),
+  root_dir: z2.string()
 }).strict();
 var STATIC_SERVE_DIR = "static";
 function staticNoBuild() {
   return { destination_dir: STATIC_SERVE_DIR, root_dir: "" };
 }
-var AppBoundarySchema = z.object({
-  root: z.string().min(1).optional(),
-  include: z.array(z.string().min(1)).min(1).optional(),
-  exclude: z.array(z.string().min(1)).optional()
+var AppBoundarySchema = z2.object({
+  root: z2.string().min(1).optional(),
+  include: z2.array(z2.string().min(1)).min(1).optional(),
+  exclude: z2.array(z2.string().min(1)).optional()
 }).strict();
-var ProductionEnvSchema = z.record(z.string().regex(ENV_NAME_REGEX, "production_env keys must be UPPER_SNAKE_CASE"), z.string());
-var VerifySchema = z.object({
-  protected_path: z.string().min(1).regex(/^\//, "verify.protected_path must be a root-relative path beginning with '/'")
+var ProductionEnvSchema = z2.record(z2.string().regex(ENV_NAME_REGEX, "production_env keys must be UPPER_SNAKE_CASE"), z2.string());
+var VerifySchema = z2.object({
+  protected_path: z2.string().min(1).regex(/^\//, "verify.protected_path must be a root-relative path beginning with '/'")
 }).strict();
-var ManifestSchema = z.object({
-  apiVersion: z.literal("launchpad.m-kopa.us/v1alpha1"),
-  kind: z.literal("App"),
+var ManifestSchema = z2.object({
+  apiVersion: z2.literal("launchpad.m-kopa.us/v1alpha1"),
+  kind: z2.literal("App"),
   metadata: MetadataSchema,
   deployment: DeploymentSchema,
   access: AccessSchema,
-  auth: z.enum(AUTH_MODES).optional(),
-  hostnames: z.array(z.string().min(1)).optional(),
-  containers: z.array(ContainerSchema).min(1).optional(),
+  auth: z2.enum(AUTH_MODES).optional(),
+  hostnames: z2.array(z2.string().min(1)).optional(),
+  containers: z2.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
-  targets: z.array(TargetSchema).optional(),
+  targets: z2.array(TargetSchema).optional(),
   build: BuildSchema.optional(),
   production_env: ProductionEnvSchema.optional(),
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
-  confine_origin: z.boolean().optional(),
-  origin: z.enum(["pages", "dispatch"]).optional(),
-  catalogue: z.object({ listed: z.boolean().default(true) }).strict().optional(),
-  sensitive: z.boolean().optional()
+  confine_origin: z2.boolean().optional(),
+  origin: z2.enum(["pages", "dispatch"]).optional(),
+  catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
+  sensitive: z2.boolean().optional()
 }).strict().superRefine((m, ctx) => {
   const isContainer = m.deployment.type === "container";
   if (m.access.identity_types !== undefined && (m.auth ?? "access") !== "gateway") {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["access", "identity_types"],
       message: "access.identity_types is only valid with auth: gateway"
     });
@@ -2695,19 +2714,19 @@ var ManifestSchema = z.object({
   if (m.confine_origin !== undefined) {
     if (isContainer) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin is only valid for gateway pages apps (static/react/react+api); container apps have no pages.dev surface."
       });
     } else if (m.auth === "access") {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
       });
     } else if (m.deployment.type === "static" && m.confine_origin === false) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin: false is not allowed for static apps — they have no verifier, so an unconfined apex would be world-readable (ADR 0031)."
       });
@@ -2715,42 +2734,42 @@ var ManifestSchema = z.object({
   }
   if (isContainer && m.auth === "gateway") {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["auth"],
       message: "auth: gateway is only supported for pages-app shapes (static/react/react+api); container apps stay on Cloudflare Access (ADR 0016)."
     });
   }
   if (isContainer && m.containers === undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["containers"],
       message: "containers[] is required when deployment.type is 'container'"
     });
   }
   if (!isContainer && m.containers !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["containers"],
       message: `containers[] is only allowed when deployment.type is 'container' (current type: '${m.deployment.type}')`
     });
   }
   if (!isContainer && m.deployment.runtime !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["deployment", "runtime"],
       message: "deployment.runtime is only meaningful when deployment.type is 'container'"
     });
   }
   if (isContainer && m.build !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["build"],
       message: "build is only allowed for pages-app deployments (static/react/react+api). Container builds live in the Dockerfile."
     });
   }
   if (isContainer && m.production_env !== undefined) {
     ctx.addIssue({
-      code: z.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       path: ["production_env"],
       message: "production_env is only allowed for pages-app deployments. Container env vars use containers[].env (names only) + the bot's secrets pipeline for values."
     });
@@ -2759,7 +2778,7 @@ var ManifestSchema = z.object({
     const ingressContainers = m.containers.filter((c) => c.ingress === true);
     if (ingressContainers.length !== 1) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["containers"],
         message: `multi-container apps must mark exactly one container ingress: true (found ${ingressContainers.length})`
       });
@@ -2772,7 +2791,7 @@ var ManifestSchema = z.object({
       for (const envName of c.env ?? []) {
         if (!declaredBindings.has(envName)) {
           ctx.addIssue({
-            code: z.ZodIssueCode.custom,
+            code: z2.ZodIssueCode.custom,
             path: ["containers", i, "env"],
             message: `env reference '${envName}' has no matching entry in secrets.bindings[]`
           });
@@ -2788,7 +2807,7 @@ var ManifestSchema = z.object({
         continue;
       if (seen.has(name)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["containers", i, "name"],
           message: `duplicate container name '${name}' — names become DO class identifiers and must be unique`
         });
@@ -2805,7 +2824,7 @@ var ManifestSchema = z.object({
         continue;
       if (seen.has(name)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["secrets", "bindings", i, "name"],
           message: `duplicate secret binding name '${name}' — names become env-var keys and must be unique`
         });
@@ -2818,21 +2837,21 @@ var ManifestSchema = z.object({
     const t = targets[i];
     if (t.kind === "worker" && t.script === undefined) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: "a worker target must declare a script (the sibling Workers script name)"
       });
     }
     if (t.kind === "pages" && t.script !== undefined) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: "a pages target must not declare a script — the primary Pages project is the app slug"
       });
     }
     if (t.kind === "pages" && t.schedule !== undefined) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "schedule"],
         message: "schedule is only valid on a worker target (the cron deploy contract — ADR 0022)"
       });
@@ -2846,7 +2865,7 @@ var ManifestSchema = z.object({
       pagesTargets++;
       if (pagesTargets > 1) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["targets", i, "kind"],
           message: "at most one pages target may be declared (the primary Pages project is singular)"
         });
@@ -2857,7 +2876,7 @@ var ManifestSchema = z.object({
       continue;
     if (t.script === PRIMARY_TARGET || t.script === "pages") {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: `worker target script '${t.script}' is a reserved selector token — use a different script name`
       });
@@ -2865,7 +2884,7 @@ var ManifestSchema = z.object({
     }
     if (seenScripts.has(t.script)) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         path: ["targets", i, "script"],
         message: `duplicate worker target script '${t.script}' — target scripts must be unique`
       });
@@ -2883,7 +2902,7 @@ var ManifestSchema = z.object({
     for (const ref of sel) {
       if (!validRefs.has(ref)) {
         ctx.addIssue({
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           path: ["secrets", "bindings", bi, "targets"],
           message: `secret binding '${b?.name}' references unknown target '${ref}' — declare it in targets[] or use "primary"`
         });
@@ -3299,42 +3318,44 @@ var STATUS_STATUS_KEYS = new Set([
   "status.generated_at"
 ]);
 // ../launchpad-engine/dist/schema-v2.js
-import { z as z2 } from "zod";
-var EnvVarSchema = z2.discriminatedUnion("type", [
-  z2.object({ type: z2.literal("secret_text"), secret_ref: z2.string().min(1) }).strict(),
-  z2.object({ type: z2.literal("plain_text"), value: z2.string() }).strict()
+import { z as z3 } from "zod";
+var EnvVarSchema = z3.discriminatedUnion("type", [
+  z3.object({ type: z3.literal("secret_text"), secret_ref: z3.string().min(1) }).strict(),
+  z3.object({ type: z3.literal("plain_text"), value: z3.string() }).strict()
 ]);
-var SpecSchema = z2.object({
-  appType: z2.enum(APP_TYPES2),
-  display: z2.object({
-    name: z2.string().min(1),
-    description: z2.string().max(280).optional(),
-    team: z2.string().min(1)
+var SpecSchema = z3.object({
+  appType: z3.enum(APP_TYPES2),
+  display: z3.object({
+    name: z3.string().min(1),
+    description: z3.string().max(280).optional(),
+    team: z3.string().min(1)
   }).strict(),
-  owner: z2.object({ email: z2.string().email() }).strict(),
-  access: z2.object({
-    allowed_entra_groups: z2.array(z2.string().min(1)).min(1).refine((a) => new Set(a).size === a.length, {
+  owner: z3.object({ email: z3.string().email() }).strict(),
+  access: z3.object({
+    audience: z3.literal("private").optional(),
+    private_owner: PrivateOwnerSchema.optional(),
+    allowed_entra_groups: z3.array(z3.string().min(1)).refine((a) => new Set(a).size === a.length, {
       message: "allowed_entra_groups must not contain duplicates"
     }),
-    require_email_domain: z2.string().min(1).optional(),
+    require_email_domain: z3.string().min(1).optional(),
     identity_types: IdentityTypesSchema.optional()
-  }).strict(),
-  auth: z2.enum(AUTH_MODES).optional(),
+  }).strict().superRefine(validateAudience),
+  auth: z3.enum(AUTH_MODES).optional(),
   build: BuildSchema.optional(),
   app: AppBoundarySchema.optional(),
   verify: VerifySchema.optional(),
-  confine_origin: z2.boolean().optional(),
-  origin: z2.enum(["pages", "dispatch"]).optional(),
-  sensitive: z2.boolean().optional(),
-  catalogue: z2.object({ listed: z2.boolean().default(true) }).strict().optional(),
-  env_vars: z2.record(z2.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
-  containers: z2.array(ContainerSchema).min(1).optional(),
+  confine_origin: z3.boolean().optional(),
+  origin: z3.enum(["pages", "dispatch"]).optional(),
+  sensitive: z3.boolean().optional(),
+  catalogue: z3.object({ listed: z3.boolean().default(true) }).strict().optional(),
+  env_vars: z3.record(z3.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
+  containers: z3.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
-  fronted_by_concierge: z2.boolean().optional()
+  fronted_by_concierge: z3.boolean().optional()
 }).strict().superRefine((s, ctx) => {
   if (s.access.identity_types !== undefined && (s.auth ?? "access") !== "gateway") {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["access", "identity_types"],
       message: "access.identity_types is only valid with auth: gateway"
     });
@@ -3342,7 +3363,7 @@ var SpecSchema = z2.object({
   for (const [k, v] of Object.entries(s.env_vars ?? {})) {
     if (/_(TOKEN|SECRET)$/.test(k) && v.type !== "secret_text") {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["env_vars", k],
         message: `env var '${k}' is secret-bearing (*_TOKEN/*_SECRET) and must be type secret_text, not '${v.type}'`
       });
@@ -3351,7 +3372,7 @@ var SpecSchema = z2.object({
   const isContainer = s.appType === "container";
   if (isContainer && s.containers === undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["containers"],
       message: "containers[] is required when appType is 'container'"
     });
@@ -3359,19 +3380,19 @@ var SpecSchema = z2.object({
   if (s.confine_origin !== undefined) {
     if (isContainer) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin is only valid for gateway pages apps; container apps have no pages.dev surface."
       });
     } else if (s.auth === "access") {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin applies to gateway-fronted apps (auth: gateway); it has no meaning under Cloudflare Access."
       });
     } else if (s.appType === "static" && s.confine_origin === false) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin: false is not allowed for static apps — an unconfined apex with no verifier is world-readable (ADR 0031)."
       });
@@ -3380,129 +3401,124 @@ var SpecSchema = z2.object({
   if (s.origin === "dispatch") {
     if (isContainer) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["origin"],
         message: "origin: dispatch is not available for container apps — they run on the container runtime (ADR 0015/0016), not in a Workers dispatch namespace."
       });
     }
     if ((s.auth ?? "access") !== "gateway") {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["origin"],
         message: "origin: dispatch requires an explicit auth: gateway (auth defaults to 'access' when omitted). A dispatch-namespace Worker has no public hostname for Cloudflare Access to gate, so the gateway must be the sole gate."
       });
     }
     if (s.confine_origin !== undefined) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z3.ZodIssueCode.custom,
         path: ["confine_origin"],
         message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
       });
     }
-    if (s.env_vars !== undefined) {
-      ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
-        path: ["env_vars"],
-        message: "env_vars are not yet supported with origin: dispatch — a dispatch workspace has no Pages module to apply them, and accepting them here would silently drop them. Worker-level vars land with the v2 deploy path."
-      });
-    }
-    if (s.build !== undefined) {
-      ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
-        path: ["build"],
-        message: "build is not yet supported with origin: dispatch — a dispatch workspace has no Pages module to carry it, and the v2 deploy path that will consume it is not shipped yet. Accepting it here would silently drop it."
-      });
+    for (const [name, envVar] of Object.entries(s.env_vars ?? {})) {
+      if (envVar.type === "secret_text") {
+        ctx.addIssue({
+          code: z3.ZodIssueCode.custom,
+          path: ["env_vars", name],
+          message: "secret_text env vars are not supported with origin: dispatch until PS-2740 (secrets on v2) provides their runtime consumer."
+        });
+      }
     }
   }
   if (!isContainer && s.containers !== undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["containers"],
       message: `containers[] is only allowed when appType is 'container' (current appType: '${s.appType}')`
     });
   }
   if (isContainer && s.build !== undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["build"],
       message: "build is not allowed when appType is 'container' (container build lives in the Dockerfile)"
     });
   }
   if (isContainer && s.auth === "gateway") {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["auth"],
       message: "auth: gateway is only supported for pages-app shapes (static/react/react+api); container apps stay on Cloudflare Access (ADR 0016)."
     });
   }
   if (!isContainer && s.fronted_by_concierge === true) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["fronted_by_concierge"],
       message: `fronted_by_concierge is only allowed when appType is 'container' (current appType: '${s.appType}')`
     });
   }
 });
-var nonEmpty = z2.string().min(1);
-var StatusSchema = z2.object({
-  schemaVersion: z2.literal(2),
+var nonEmpty = z3.string().min(1);
+var StatusSchema = z3.object({
+  schemaVersion: z3.literal(2),
   manifest_spec_sha: nonEmpty,
-  cloudflare: z2.object({
-    access: z2.object({
+  cloudflare: z3.object({
+    access: z3.object({
       app_id: nonEmpty,
       app_aud: nonEmpty,
       team_domain: nonEmpty,
       policy_id: nonEmpty
     }).strict(),
-    pages: z2.object({
+    pages: z3.object({
       project_name: nonEmpty,
       subdomain: nonEmpty,
       latest_deployment_id: nonEmpty
     }).strict().optional(),
-    worker: z2.object({
+    worker: z3.object({
       dev_url: nonEmpty,
       script_name: nonEmpty
     }).strict().optional()
   }).strict(),
-  dns: z2.object({ custom_hostname: nonEmpty, cname_target: nonEmpty }).strict().optional(),
-  terraform: z2.object({
+  dns: z3.object({ custom_hostname: nonEmpty, cname_target: nonEmpty }).strict().optional(),
+  terraform: z3.object({
     workspace_state_key: nonEmpty,
     last_applied_at: nonEmpty,
     last_applied_sha: nonEmpty
   }).strict(),
-  registry: z2.object({ record_present: z2.boolean(), lifecycle: nonEmpty }).strict(),
+  registry: z3.object({ record_present: z3.boolean(), lifecycle: nonEmpty }).strict(),
   generated_at: nonEmpty
 }).strict().superRefine((s, ctx) => {
   const hasPages = s.cloudflare.pages !== undefined;
   const hasWorker = s.cloudflare.worker !== undefined;
   if (hasPages === hasWorker) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["cloudflare"],
       message: "status.cloudflare must carry exactly one of `pages` (pages apps) or `worker` (container apps)"
     });
   }
   if (hasPages && s.dns === undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["dns"],
       message: "status.dns is required for a pages-shape status (cloudflare.pages present)"
     });
   }
   if (hasWorker && s.dns !== undefined) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["dns"],
       message: "status.dns must be absent for a workers_dev_only container status (no custom hostname)"
     });
   }
 });
-var ManifestV2Schema = z2.object({
-  apiVersion: z2.literal("launchpad.m-kopa.us/v2"),
-  kind: z2.literal("App"),
-  metadata: z2.object({
-    slug: z2.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
-    schemaVersion: z2.literal(2)
+var ManifestV2Schema = z3.object({
+  apiVersion: z3.literal("launchpad.m-kopa.us/v2"),
+  kind: z3.literal("App"),
+  metadata: z3.object({
+    slug: z3.string().min(2).max(63).regex(SLUG_REGEX, "must be lowercase letters, digits, and hyphens; start/end alphanumeric"),
+    schemaVersion: z3.literal(2)
   }).strict(),
   spec: SpecSchema,
   status: StatusSchema.optional()
@@ -4232,6 +4248,11 @@ var BROAD_GROUPS = [
     uuid: "caf78902-35dd-4833-88ce-8f067eda6036",
     name: "S_ALL_Employees",
     note: "All employees — the broadest grant on the tenant; assigned to the Launchpad enterprise app. Granting this reaches the entire company."
+  },
+  {
+    uuid: "09c87073-2071-4f8e-9e97-aa67f7a153a7",
+    name: "S_ALL",
+    note: "Broad tenant group. Assignment is not a reliable limit on gateway eligibility."
   }
 ];
 function assertBroadGroupsWellFormed(list = BROAD_GROUPS) {
@@ -4250,7 +4271,7 @@ function assertBroadGroupsWellFormed(list = BROAD_GROUPS) {
 assertBroadGroupsWellFormed();
 var BROAD_UUIDS = new Set(BROAD_GROUPS.map((g) => canonicalUuid(g.uuid)).filter((u) => u !== null));
 // ../launchpad-engine/dist/fleet-manifest.js
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var TF_RESIDENCIES = ["per-app-workspace", "main-tf"];
 var APP_SHAPES = [
@@ -4278,22 +4299,22 @@ var FLEET_TIERS = [
   "out-of-scope"
 ];
 var DEVICE_POSTURE = ["gateway-eligible", "retained-access"];
-var GroupId = z3.string().regex(UUID_RE, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
-var FleetAppSchema = z3.object({
-  slug: z3.string().regex(SLUG_REGEX),
-  residency: z3.enum(TF_RESIDENCIES),
-  shape: z3.enum(APP_SHAPES),
-  declaredAuth: z3.enum(DECLARED_AUTH),
-  actualAuth: z3.enum(ACTUAL_AUTH),
-  groups: z3.array(GroupId).default([]),
-  tier: z3.enum(FLEET_TIERS),
-  devicePosture: z3.enum(DEVICE_POSTURE),
-  devicePostureReason: z3.string().trim().min(1, "devicePosture is only valid with a non-empty reason — the two-tier determination must be a surveyed output, not a default (AC-T0-3)."),
-  notes: z3.string().optional()
+var GroupId = z4.string().regex(UUID_RE, "Entra group ids are emitted as canonical UUIDs in the JWT groups claim — display names will not match policies.");
+var FleetAppSchema = z4.object({
+  slug: z4.string().regex(SLUG_REGEX),
+  residency: z4.enum(TF_RESIDENCIES),
+  shape: z4.enum(APP_SHAPES),
+  declaredAuth: z4.enum(DECLARED_AUTH),
+  actualAuth: z4.enum(ACTUAL_AUTH),
+  groups: z4.array(GroupId).default([]),
+  tier: z4.enum(FLEET_TIERS),
+  devicePosture: z4.enum(DEVICE_POSTURE),
+  devicePostureReason: z4.string().trim().min(1, "devicePosture is only valid with a non-empty reason — the two-tier determination must be a surveyed output, not a default (AC-T0-3)."),
+  notes: z4.string().optional()
 }).strict();
-var FleetManifestSchema = z3.object({
-  schemaVersion: z3.literal(1),
-  apps: z3.array(FleetAppSchema).min(1)
+var FleetManifestSchema = z4.object({
+  schemaVersion: z4.literal(1),
+  apps: z4.array(FleetAppSchema).min(1)
 }).strict().superRefine((m, ctx) => {
   const seen = new Set;
   for (const app of m.apps) {
@@ -4315,23 +4336,23 @@ var FleetManifestSchema = z3.object({
   }
 });
 // ../launchpad-engine/dist/fleet-secret-sets.js
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var SET_NAME_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
-var Slug = z4.string().regex(SLUG_REGEX, "member must be a lowercase-kebab app slug");
-var SecretName = z4.string().regex(ENV_NAME_REGEX, "secret name must be UPPER_SNAKE_CASE");
-var SecretSetExcludeSchema = z4.object({
+var Slug = z5.string().regex(SLUG_REGEX, "member must be a lowercase-kebab app slug");
+var SecretName = z5.string().regex(ENV_NAME_REGEX, "secret name must be UPPER_SNAKE_CASE");
+var SecretSetExcludeSchema = z5.object({
   member: Slug,
   secret: SecretName
 }).strict();
-var SecretSetSchema = z4.object({
-  name: z4.string().min(1).max(64).regex(SET_NAME_REGEX, "set name must be lowercase-kebab"),
-  secrets: z4.array(SecretName).min(1),
-  members: z4.array(Slug).min(1),
-  exclude: z4.array(SecretSetExcludeSchema).optional()
+var SecretSetSchema = z5.object({
+  name: z5.string().min(1).max(64).regex(SET_NAME_REGEX, "set name must be lowercase-kebab"),
+  secrets: z5.array(SecretName).min(1),
+  members: z5.array(Slug).min(1),
+  exclude: z5.array(SecretSetExcludeSchema).optional()
 }).strict();
-var FleetSecretSetsSchema = z4.object({
-  schemaVersion: z4.literal(1),
-  secretSets: z4.array(SecretSetSchema).min(1)
+var FleetSecretSetsSchema = z5.object({
+  schemaVersion: z5.literal(1),
+  secretSets: z5.array(SecretSetSchema).min(1)
 }).strict().superRefine((m, ctx) => {
   const seenSets = new Set;
   for (let i = 0;i < m.secretSets.length; i++) {
@@ -4403,6 +4424,21 @@ function membersForSecret(set, secret) {
 }
 // ../launchpad-engine/dist/redact-status.js
 var UNSAFE_KEY = new Set(["__proto__", "prototype", "constructor"]);
+// ../launchpad-engine/dist/deployment-auth.js
+function deploymentAuthIssue(appType, auth) {
+  if (appType === "container" || auth === "gateway")
+    return null;
+  return {
+    error: "pages_access_retired",
+    message: "Cloudflare Access login is retired for Pages apps. Set auth: gateway (spec.auth in v2). Containers are unchanged."
+  };
+}
+// ../launchpad-engine/dist/new-app-origin.js
+function newAppOrigin(appType, requested) {
+  if (appType === "container")
+    return;
+  return requested ?? (appType === "react+api" ? "pages" : "dispatch");
+}
 // src/bundle/boundary.ts
 var MAX_CONTENT_PROBE_BYTES = 1024 * 1024;
 function applyBoundaryToFiles(args) {
@@ -4550,7 +4586,7 @@ async function bundleAndDeploy(args) {
 }
 
 // src/deploy/verify-deploy.ts
-import { readFileSync as readFileSync9, existsSync as existsSync4 } from "node:fs";
+import { readFileSync as readFileSync10, existsSync as existsSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // src/deploy/redact-diagnostic.ts
@@ -4596,11 +4632,67 @@ async function fetchDeploymentStatus(cfg, slug, fetcher = fetch) {
   return {
     slug: typeof raw.slug === "string" ? raw.slug : slug,
     supported: raw.supported,
+    ...raw.origin === "pages" || raw.origin === "dispatch" ? { origin: raw.origin } : {},
+    ...projectV2(raw.v2),
     liveDeployment: scrubLiveDeployment(raw.liveDeployment ?? null),
     lastSuccessfulDeployment: projectLastSuccessful(raw.lastSuccessfulDeployment),
     ...raw.reconciledToLive === true ? { reconciledToLive: true } : {}
   };
 }
+function projectV2(value) {
+  if (value === null || typeof value !== "object")
+    return {};
+  const raw = value;
+  if (!isV2State(raw.state) || !isV2Stage(raw.stage) || typeof raw.commitSha !== "string" || typeof raw.attempts !== "number" || !Number.isFinite(raw.attempts) || typeof raw.updatedAt !== "string") {
+    return {};
+  }
+  if (!isConsistentV2State(raw.state, raw.stage))
+    return {};
+  if (raw.failedAt !== undefined && !isV2FailedStage(raw.failedAt))
+    return {};
+  const v2 = {
+    state: raw.state,
+    stage: raw.stage,
+    commitSha: raw.commitSha,
+    attempts: raw.attempts,
+    updatedAt: raw.updatedAt,
+    ...raw.failedAt !== undefined ? { failedAt: raw.failedAt } : {},
+    ...typeof raw.reason === "string" ? { reason: redactDiagnostic(raw.reason) } : {},
+    ...typeof raw.detail === "string" ? { detail: redactDiagnostic(raw.detail) } : {},
+    ...projectRunUrl(raw.runUrl),
+    ...typeof raw.deliveredAt === "string" ? { deliveredAt: raw.deliveredAt } : {}
+  };
+  return { v2 };
+}
+function projectRunUrl(value) {
+  if (typeof value !== "string")
+    return {};
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname === "github.com" ? { runUrl: value } : {};
+  } catch {
+    return {};
+  }
+}
+function isV2State(value) {
+  return value === "pending" || value === "delivered" || value === "refused";
+}
+function isV2Stage(value) {
+  return ["committed", "building", "verified", "uploading", "live", "failed"].includes(String(value));
+}
+function isConsistentV2State(state, stage) {
+  switch (state) {
+    case "delivered":
+      return stage === "live";
+    case "refused":
+      return stage === "failed";
+    case "pending":
+      return stage !== "live" && stage !== "failed";
+  }
+}
+function isV2FailedStage(value) {
+  return ["build", "verify", "download", "expand", "manifest", "plan", "upload"].includes(String(value));
+}
 function projectLastSuccessful(value) {
   if (value === null || typeof value !== "object")
     return null;
@@ -4650,20 +4742,27 @@ function shaMatches(a, b) {
     return x === y;
   return x.slice(0, n) === y.slice(0, n);
 }
-async function readDeploymentBaseline(deps, slug) {
+async function readDeploymentContext(deps, slug) {
   let status;
   try {
     status = await deps.fetchStatus(slug);
   } catch {
-    return null;
+    return { baseline: null };
+  }
+  if (status === null)
+    return { baseline: null };
+  const origin = status.origin;
+  if (!status.supported || status.liveDeployment === null) {
+    return { baseline: null, ...origin !== undefined ? { origin } : {} };
   }
-  if (status === null || !status.supported || status.liveDeployment === null)
-    return null;
   const live = status.liveDeployment;
   return {
-    id: live.id,
-    commitHash: live.commit?.hash ?? null,
-    createdOn: live.createdOn
+    baseline: {
+      id: live.id,
+      commitHash: live.commit?.hash ?? null,
+      createdOn: live.createdOn
+    },
+    ...origin !== undefined ? { origin } : {}
   };
 }
 async function waitForCommitDeployment(args, deps) {
@@ -4671,6 +4770,7 @@ async function waitForCommitDeployment(args, deps) {
   const start = deps.now();
   const baselineId = args.baseline?.id ?? null;
   let matchedInProgress = false;
+  let lastV2Stage = null;
   for (;; ) {
     let status;
     try {
@@ -4684,6 +4784,38 @@ async function waitForCommitDeployment(args, deps) {
       return { kind: "unsupported" };
     const live = status.liveDeployment;
     const elapsed = deps.now() - start;
+    if (status.origin === "dispatch" && status.v2 !== undefined && shaMatches(status.v2.commitSha, args.shippedSha)) {
+      const delivery = status.v2;
+      if (delivery.stage !== lastV2Stage) {
+        args.onV2Stage?.(delivery);
+        lastV2Stage = delivery.stage;
+      }
+      if (delivery.state === "refused") {
+        return {
+          kind: "failure",
+          dispatch: true,
+          failedStage: delivery.failedAt ?? delivery.stage,
+          reason: delivery.reason,
+          detail: delivery.detail,
+          runUrl: delivery.runUrl
+        };
+      }
+      if (delivery.state === "delivered" || delivery.stage === "live") {
+        return {
+          kind: "success",
+          deploymentUrl: live?.url ?? null,
+          v2: {
+            commitSha: delivery.commitSha,
+            ...delivery.deliveredAt !== undefined ? { deliveredAt: delivery.deliveredAt } : {}
+          }
+        };
+      }
+      matchedInProgress = true;
+      if (elapsed >= args.settleTimeoutMs)
+        return { kind: "pending" };
+      await deps.sleep(pollIntervalMs);
+      continue;
+    }
     if (live !== null && shaMatches(live.commit?.hash, args.shippedSha)) {
       if (live.buildStatus === "success") {
         return { kind: "success", deploymentUrl: live.url };
@@ -4795,7 +4927,7 @@ async function verifyServed(args, deps = { fetch }) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
@@ -5604,6 +5736,88 @@ still provisioning after the watch window — re-run \`launchpad watch ${slug}\`
   }
 }
 
+// src/manifest/load.ts
+import { readFileSync as readFileSync8 } from "node:fs";
+import { parse as parseYaml4, YAMLParseError } from "yaml";
+function loadManifest(path8) {
+  let raw;
+  try {
+    raw = readFileSync8(path8, "utf8");
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      return { kind: "file-not-found", path: path8 };
+    }
+    return { kind: "read-error", path: path8, message: e.message ?? String(err) };
+  }
+  return parseManifest2(raw, path8);
+}
+function loadManifestAnyVersion(path8) {
+  let raw;
+  try {
+    raw = readFileSync8(path8, "utf8");
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT")
+      return { kind: "file-not-found", path: path8 };
+    return { kind: "read-error", path: path8, message: e.message ?? String(err) };
+  }
+  return parseManifestAnyVersion(raw, path8);
+}
+function parseManifestAnyVersion(yamlText, path8) {
+  let parsed;
+  try {
+    parsed = parseYaml4(yamlText);
+  } catch (err) {
+    const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
+    return { kind: "yaml-parse-error", path: path8, message };
+  }
+  const apiVersion = typeof parsed === "object" && parsed !== null ? parsed.apiVersion : undefined;
+  if (apiVersion === "launchpad.m-kopa.us/v2") {
+    const result = parseManifestV2(parsed);
+    return result.kind === "ok" ? { kind: "ok", manifest: result.manifest, schema: apiVersion } : { kind: "schema-error", path: path8, schema: apiVersion, issues: [...result.issues] };
+  }
+  if (apiVersion === "launchpad.m-kopa.us/v1alpha1") {
+    const result = parseManifest(parsed);
+    return result.kind === "ok" ? { kind: "ok", manifest: result.manifest, schema: apiVersion } : { kind: "schema-error", path: path8, schema: apiVersion, issues: [...result.issues] };
+  }
+  return {
+    kind: "schema-error",
+    path: path8,
+    schema: "launchpad.m-kopa.us/v1alpha1 or launchpad.m-kopa.us/v2",
+    issues: [
+      {
+        path: "apiVersion",
+        message: `unsupported apiVersion ${JSON.stringify(apiVersion)}; expected launchpad.m-kopa.us/v1alpha1 or launchpad.m-kopa.us/v2`
+      }
+    ]
+  };
+}
+function parseManifest2(yamlText, path8) {
+  let parsed;
+  try {
+    parsed = parseYaml4(yamlText);
+  } catch (err) {
+    const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
+    return { kind: "yaml-parse-error", path: path8, message };
+  }
+  const result = ManifestSchema.safeParse(parsed);
+  if (result.success) {
+    return { kind: "ok", manifest: result.data };
+  }
+  return {
+    kind: "schema-error",
+    path: path8,
+    issues: formatIssues(result.error)
+  };
+}
+function formatIssues(error) {
+  return error.issues.map((issue) => ({
+    path: issue.path.map(String).join(".") || "(root)",
+    message: issue.message
+  }));
+}
+
 // src/commands/status.ts
 var statusCommand = {
   name: "status",
@@ -5699,7 +5913,7 @@ async function runStatus(args, io) {
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync8(parsed.file, "utf8");
+    localYaml = readFileSync9(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
       io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe12(e)}`);
@@ -5708,24 +5922,24 @@ async function runStatus(args, io) {
   }
   let local = null;
   if (localYaml !== null) {
-    let localObj;
-    try {
-      const { parse: parseYaml4 } = await import("yaml");
-      localObj = parseYaml4(localYaml);
-    } catch (e) {
-      io.err(`launchpad status: ${parsed.file} is not valid YAML: ${describe12(e)}`);
-      return 2;
-    }
-    const localParse = parseManifest(localObj);
+    const localParse = parseManifestAnyVersion(localYaml, parsed.file);
     if (localParse.kind !== "ok") {
-      io.err(`launchpad status: ${parsed.file} failed schema validation:`);
-      for (const issue of localParse.issues) {
-        io.err(`  - ${issue.path}: ${issue.message}`);
+      if (localParse.kind === "yaml-parse-error") {
+        io.err(`launchpad status: ${parsed.file} is not valid YAML: ${localParse.message}`);
+      } else if (localParse.kind === "schema-error") {
+        io.err(`launchpad status: ${parsed.file} failed schema validation against ${localParse.schema}:`);
+        for (const issue of localParse.issues) {
+          io.err(`  - ${issue.path}: ${issue.message}`);
+        }
+      } else {
+        io.err(`launchpad status: cannot read local manifest at ${parsed.file}`);
       }
       return 2;
     }
     local = localParse.manifest;
-    warnSecretShape(local.production_env, io);
+    if (local.apiVersion === "launchpad.m-kopa.us/v1alpha1") {
+      warnSecretShape(local.production_env, io);
+    }
   }
   let state;
   try {
@@ -5755,9 +5969,9 @@ async function runStatus(args, io) {
   }
   if (state.manifestYaml === null || state.manifestYaml === undefined) {
     const live = deployment?.liveDeployment ?? null;
-    const contentIsLive = live !== null && (live.buildStatus === "success" || deployment?.lastSuccessfulDeployment != null);
+    const contentIsLive = deployment?.v2?.state === "delivered" || deployment?.v2?.stage === "live" || live !== null && (live.buildStatus === "success" || deployment?.lastSuccessfulDeployment != null);
     const liveButEmpty = lifecycle !== null && lifecycle.state === "live";
-    const platformTracked = state.hasAppFile === true || live?.trigger === "bot";
+    const platformTracked = state.hasAppFile === true || live?.trigger === "bot" || deployment?.origin === "dispatch";
     const out = {
       state: contentIsLive ? platformTracked ? "live_drift_unknown" : "live_content_untracked" : platformTracked && !deploymentKnown ? "live_drift_unknown" : liveButEmpty ? "live_no_content" : "no_deployed_manifest",
       ...local === null ? { drift: null } : {},
@@ -5790,7 +6004,7 @@ async function runStatus(args, io) {
     };
     emit4(out, parsed.json, io);
     if (parsed.strict) {
-      if (deployment?.liveDeployment?.buildStatus === "failure") {
+      if (deployment?.liveDeployment?.buildStatus === "failure" || deployment?.v2?.state === "refused") {
         io.err(`launchpad status: --strict: live build FAILED ` + `(drift not evaluated — no local launchpad.yaml here).`);
         return 1;
       }
@@ -5798,26 +6012,40 @@ async function runStatus(args, io) {
     }
     return 0;
   }
-  let deployedObj;
-  try {
-    const { parse: parseYaml4 } = await import("yaml");
-    deployedObj = parseYaml4(state.manifestYaml);
-  } catch (e) {
-    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} is not valid YAML: ${describe12(e)}`);
-    return 2;
-  }
-  const deployedParse = parseManifest(deployedObj);
+  const deployedParse = parseManifestAnyVersion(state.manifestYaml, `deployed manifest at ${state.deployedManifestSha}`);
   if (deployedParse.kind !== "ok") {
-    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} failed schema validation:`);
-    for (const issue of deployedParse.issues) {
-      io.err(`  - ${issue.path}: ${issue.message}`);
+    if (deployedParse.kind === "yaml-parse-error") {
+      io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} is not valid YAML: ${deployedParse.message}`);
+    } else if (deployedParse.kind === "schema-error") {
+      io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} failed schema validation against ${deployedParse.schema}:`);
+      for (const issue of deployedParse.issues) {
+        io.err(`  - ${issue.path}: ${issue.message}`);
+      }
     }
     return 2;
   }
   const deployed = deployedParse.manifest;
+  if (local.apiVersion !== deployed.apiVersion) {
+    const reason = `local manifest uses ${local.apiVersion}, while the deployed manifest uses ${deployed.apiVersion}; ` + "the manifest shapes differ, so drift was not evaluated";
+    const out = {
+      state: "live_drift_unknown",
+      drift: null,
+      driftUnavailableReason: reason,
+      ...statusTruthFields({
+        slug: parsed.slug,
+        deployedSha: state.deployedManifestSha,
+        headSha: state.appRepoHeadSha,
+        openPrNumber: state.openPr?.number ?? null,
+        ...deploymentKnown ? { deployment } : {},
+        ...standingExceptions !== null ? { standingExceptions } : {}
+      })
+    };
+    emit4(out, parsed.json, io);
+    return 0;
+  }
   const localGroups = await resolveStatusGroups({
     cfg,
-    refs: allowedEntraGroups(local.access),
+    refs: allowedEntraGroups(manifestAccess(local)),
     source: "local manifest",
     manifestSha: null
   });
@@ -5826,14 +6054,17 @@ async function runStatus(args, io) {
   }
   const deployedGroups = await resolveStatusGroups({
     cfg,
-    refs: allowedEntraGroups(deployed.access),
+    refs: allowedEntraGroups(manifestAccess(deployed)),
     source: "deployed manifest",
     manifestSha: state.deployedManifestSha
   });
   if (deployedGroups.kind === "error") {
     return renderStatusGroupError(deployedGroups.envelope, parsed.json, io);
   }
-  const drift = computeDrift(local, deployed, {
+  const drift = local.apiVersion === "launchpad.m-kopa.us/v2" && deployed.apiVersion === "launchpad.m-kopa.us/v2" ? computeV2SpecDrift(local, deployed, {
+    local: localGroups.ids,
+    deployed: deployedGroups.ids
+  }) : computeDrift(local, deployed, {
     local: localGroups.ids,
     deployed: deployedGroups.ids
   });
@@ -5850,8 +6081,8 @@ async function runStatus(args, io) {
     }
     accessDrift = detectCanonicalAccessDrift(localGroups.ids, enforcedGroups.ids);
   }
-  const localAssignmentGroups = (local.auth ?? "access") === "access" ? localGroups : null;
-  const deployedAssignmentGroups = (deployed.auth ?? "access") === "access" ? deployedGroups : null;
+  const localAssignmentGroups = manifestAuth(local) === "access" ? localGroups : null;
+  const deployedAssignmentGroups = manifestAuth(deployed) === "access" ? deployedGroups : null;
   const assignmentCheck = localAssignmentGroups === null && deployedAssignmentGroups === null ? { kind: "ok", issues: [] } : await findAssignmentIssues(cfg, localAssignmentGroups, deployedAssignmentGroups, state.deployedManifestSha);
   if (assignmentCheck.kind === "error") {
     return renderStatusGroupError(assignmentCheck.envelope, parsed.json, io);
@@ -6052,6 +6283,58 @@ function computeDrift(local, deployed, canonicalGroups) {
   }
   return diffs;
 }
+function computeV2SpecDrift(local, deployed, canonicalGroups) {
+  const localSpec = {
+    ...local.spec,
+    access: {
+      ...local.spec.access,
+      allowed_entra_groups: [
+        ...canonicalGroups?.local ?? local.spec.access.allowed_entra_groups
+      ].sort()
+    }
+  };
+  const deployedSpec = {
+    ...deployed.spec,
+    access: {
+      ...deployed.spec.access,
+      allowed_entra_groups: [
+        ...canonicalGroups?.deployed ?? deployed.spec.access.allowed_entra_groups
+      ].sort()
+    }
+  };
+  const diffs = [];
+  compareV2Value("spec", localSpec, deployedSpec, diffs);
+  return diffs;
+}
+function compareV2Value(path8, local, deployed, diffs) {
+  if (Object.is(local, deployed))
+    return;
+  if (Array.isArray(local) || Array.isArray(deployed)) {
+    if (JSON.stringify(local) !== JSON.stringify(deployed)) {
+      diffs.push({ path: path8, local, deployed });
+    }
+    return;
+  }
+  if (typeof local === "object" && local !== null && typeof deployed === "object" && deployed !== null) {
+    const localRecord = local;
+    const deployedRecord = deployed;
+    const keys = new Set([
+      ...Object.keys(localRecord),
+      ...Object.keys(deployedRecord)
+    ]);
+    for (const key of [...keys].sort()) {
+      compareV2Value(`${path8}.${key}`, localRecord[key], deployedRecord[key], diffs);
+    }
+    return;
+  }
+  diffs.push({ path: path8, local, deployed });
+}
+function manifestAccess(manifest) {
+  return manifest.apiVersion === "launchpad.m-kopa.us/v2" ? manifest.spec.access : manifest.access;
+}
+function manifestAuth(manifest) {
+  return manifest.apiVersion === "launchpad.m-kopa.us/v2" ? manifest.spec.auth ?? "access" : manifest.auth ?? "access";
+}
 function lifecycleOutput(slug, lc) {
   const state = lc.state === "failed" ? "provisioning_failed" : lc.state === "live" ? "in_sync" : lc.state;
   return {
@@ -6119,7 +6402,7 @@ function emit4(out, asJson, io) {
       surfaceExceptions(out, io);
       return;
     case "live_content_untracked":
-      io.out(`${out.slug}: live — content deployed via ` + `${triggerLabel(out.deployment?.liveDeployment?.trigger)} (no platform-tracked manifest; this app deploys outside \`launchpad deploy\`).`);
+      io.out(`${out.slug}: live — content deployed via ` + `${triggerLabel(out.deployment?.liveDeployment?.trigger)} ` + `(no platform-tracked manifest; this app deploys outside \`launchpad deploy\`).`);
       surfaceNoLocalManifestNote(out, io);
       surfaceHeadVsDeployed(out, io);
       surfaceDeployment(out, io);
@@ -6181,6 +6464,10 @@ function surfaceGroupIssues(out, io) {
 function surfaceNoLocalManifestNote(out, io) {
   if (out.drift !== null)
     return;
+  if (out.driftUnavailableReason !== undefined) {
+    io.out(`  ${out.driftUnavailableReason}.`);
+    return;
+  }
   io.out("  no local launchpad.yaml here — drift not checked " + "(cd into the app directory or pass --file to compare)");
 }
 function triggerLabel(trigger) {
@@ -6206,7 +6493,13 @@ function surfaceFailedLifecycleDeployment(out, io) {
 }
 function surfaceDeployment(out, io) {
   const dep = out.deployment;
-  if (dep === undefined || dep === null || !dep.supported)
+  if (dep === undefined || dep === null)
+    return;
+  if (dep.origin === "dispatch") {
+    surfaceV2Deployment(dep, io);
+    return;
+  }
+  if (!dep.supported)
     return;
   if (dep.reconciledToLive === true) {
     io.out("  ✓ recovered: this app was in a failed state; its verified-live build reconciled the record failed→live (no `launchpad recover` needed).");
@@ -6246,6 +6539,29 @@ function surfaceDeployment(out, io) {
     }
   }
 }
+function surfaceV2Deployment(dep, io) {
+  for (const line of renderV2DeploymentLines(dep))
+    io.out(line);
+}
+function renderV2DeploymentLines(dep) {
+  const delivery = dep.v2;
+  if (delivery === undefined) {
+    return ["  v2 delivery: dispatch origin (delivery state unavailable)."];
+  }
+  const lines = [];
+  const deliveredAt = delivery.state === "delivered" && delivery.deliveredAt !== undefined ? `, delivered ${delivery.deliveredAt}` : "";
+  lines.push(`  v2 delivery: state ${delivery.state}, stage ${delivery.stage}, commit ${delivery.commitSha.slice(0, 7)}${deliveredAt}`);
+  if (delivery.state === "refused") {
+    const failedAt = delivery.failedAt ?? delivery.stage;
+    lines.push(`    failed at ${failedAt}${delivery.reason ? `: ${delivery.reason}` : ""}`);
+    if (delivery.runUrl)
+      lines.push(`    GitHub run: ${delivery.runUrl}`);
+  }
+  if (delivery.state !== "delivered" && dep.lastSuccessfulDeployment !== null) {
+    lines.push(`    serving: previous successful deployment from ${dep.lastSuccessfulDeployment.createdOn}`);
+  }
+  return lines;
+}
 function surfaceExceptions(out, io) {
   const exceptions = out.standingExceptions;
   if (exceptions === undefined || exceptions.length === 0)
@@ -6262,7 +6578,7 @@ function surfaceHeadVsDeployed(out, io) {
     if (out.hasOpenPr) {
       io.out(`  (deployed sha ${short(out.deployedSha)} is behind app-repo HEAD ${short(out.headSha)};` + ` an apply may be queued — see PR #${out.openPrNumber})`);
     } else {
-      io.out(`  (deployed sha ${short(out.deployedSha)} is behind app-repo HEAD ${short(out.headSha)}; main is ahead of deployed)`);
+      io.out(`  (deployed sha ${short(out.deployedSha)} is behind app-repo HEAD ${short(out.headSha)};` + ` main is ahead of deployed)`);
     }
   }
 }
@@ -6283,7 +6599,7 @@ function warnSecretShape(env, io) {
     const hasPrefix = prefixes.some((p) => v.startsWith(p));
     const longBase64Shape = v.length >= 32 && /^[A-Za-z0-9+/=_-]+$/.test(v);
     if (hasPrefix && longBase64Shape) {
-      io.err(`launchpad status: production_env.${k} looks like a secret. production_env is non-secret by contract; move secrets to the secrets bindings path. (This is informational; status will continue.)`);
+      io.err(`launchpad status: production_env.${k} looks like a secret. ` + `production_env is non-secret by contract; move secrets to the ` + `secrets bindings path. (This is informational; status will continue.)`);
     }
   }
 }
@@ -6342,7 +6658,7 @@ function parseArgs2(args, cwd = process.cwd(), warn) {
   if (slug === null) {
     const inferred = inferSlug({ cwd, file, warn });
     if (inferred === null) {
-      return `slug not provided + cannot infer from cwd. Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
+      return `slug not provided + cannot infer from cwd. ` + `Pass <slug> or --slug <slug>, or cd into a directory named launchpad-app-<slug>.`;
     }
     slug = inferred;
   }
@@ -6401,7 +6717,7 @@ function readLocalEntrypoint(cwd) {
   for (const rel of ["index.html", join9("static", "index.html")]) {
     const p = join9(cwd, rel);
     if (existsSync4(p))
-      return new Uint8Array(readFileSync9(p));
+      return new Uint8Array(readFileSync10(p));
   }
   return null;
 }
@@ -6416,13 +6732,25 @@ function realVerifyDeployDeps(cfg) {
 }
 async function runDeployVerification(args, io, deps) {
   io.out("");
-  io.out("Verifying a build of your commit went live …");
+  if (args.dispatchOrigin === true) {
+    io.out("Waiting for your repo build and dispatch delivery …");
+  } else {
+    io.out("Verifying a build of your commit went live …");
+  }
+  const seenV2Stages = new Set;
+  const onV2Stage = (delivery) => {
+    if (seenV2Stages.has(delivery.stage))
+      return;
+    seenV2Stages.add(delivery.stage);
+    io.out(`  v2 stage: ${v2StageLabel(delivery.stage)}`);
+  };
   const settle = await deps.wait({
     slug: args.slug,
     shippedSha: args.shippedSha,
     baseline: args.baseline,
     registrationBoundMs: args.registrationBoundMs,
-    settleTimeoutMs: args.timeoutMs
+    settleTimeoutMs: args.timeoutMs,
+    onV2Stage
   }, deps.waitDeps);
   switch (settle.kind) {
     case "unsupported":
@@ -6451,10 +6779,25 @@ async function runDeployVerification(args, io, deps) {
       io.out(`   It may still be queued. Re-check the outcome: \`launchpad status ${args.slug}\``);
       return 0;
     case "pending":
+      if (args.dispatchOrigin === true || seenV2Stages.size > 0) {
+        io.out(`⏳ Dispatch delivery is still in progress after ${Math.round(args.timeoutMs / 1000)}s - couldn't verify yet.`);
+        io.out(`   Re-check the outcome: \`launchpad status ${args.slug}\``);
+        return 0;
+      }
       io.out(`⏳ Your commit's build is still in progress after ${Math.round(args.timeoutMs / 1000)}s — couldn't verify yet.`);
       io.out(`   Re-check the outcome: \`launchpad status ${args.slug}\``);
       return 0;
     case "failure":
+      if (settle.dispatch === true) {
+        io.err(`✗ Dispatch delivery REFUSED at ${settle.failedStage ?? "unknown"} - your commit is NOT live.`);
+        if (settle.reason)
+          io.err(`  reason: ${redactDiagnostic(settle.reason)}`);
+        if (settle.detail)
+          io.err(`  detail: ${redactDiagnostic(settle.detail)}`);
+        if (settle.runUrl)
+          io.err(`  GitHub run: ${settle.runUrl}`);
+        return 1;
+      }
       io.err("✗ The Cloudflare Pages build for your commit FAILED — your content is NOT live.");
       if (settle.failedStage)
         io.err(`  failed stage: ${redactDiagnostic(settle.failedStage)}`);
@@ -6466,9 +6809,30 @@ async function runDeployVerification(args, io, deps) {
       io.err(`  Full logs: \`launchpad status ${args.slug}\``);
       return 1;
     case "success":
+      if (settle.v2 !== undefined) {
+        const deliveredAt = settle.v2.deliveredAt ? ` at ${settle.v2.deliveredAt}` : "";
+        io.out(`✓ Live in dispatch namespace - delivered commit ${settle.v2.commitSha}${deliveredAt}.`);
+        return 0;
+      }
       return verifySuccess(args, settle.deploymentUrl, io, deps);
   }
 }
+function v2StageLabel(stage) {
+  switch (stage) {
+    case "committed":
+      return "source committed";
+    case "building":
+      return "CI building";
+    case "verified":
+      return "run verified";
+    case "uploading":
+      return "artifact uploading";
+    case "live":
+      return "live in dispatch namespace";
+    case "failed":
+      return "failed";
+  }
+}
 function realRedeployVerifyDeps(cfg) {
   return {
     wait: waitForDeployment,
@@ -6695,7 +7059,7 @@ function runGit2(sp, cwd, args) {
 }
 
 // src/deploy/manifest-diff.ts
-import { parse as parseYaml4 } from "yaml";
+import { parse as parseYaml5 } from "yaml";
 var MASK = "«redacted»";
 var SECRET_KEY_SEGMENT = /(secret|token|api[_-]?key|access[_-]?key|private[_-]?key|secret[_-]?key|password|passwd|pwd|authorization|auth[_-]?token|bearer|client[_-]?secret|session|credential|value)/i;
 function isSecretPath(path8) {
@@ -6786,7 +7150,7 @@ function diffManifests(localYaml, deployedYaml) {
   let local;
   let deployed;
   try {
-    local = normalize(parseYaml4(localYaml));
+    local = parseYaml5(localYaml);
   } catch (e) {
     return {
       inSync: false,
@@ -6795,7 +7159,7 @@ function diffManifests(localYaml, deployedYaml) {
     };
   }
   try {
-    deployed = normalize(parseYaml4(deployedYaml));
+    deployed = parseYaml5(deployedYaml);
   } catch (e) {
     return {
       inSync: false,
@@ -6803,6 +7167,22 @@ function diffManifests(localYaml, deployedYaml) {
       parseError: `deployed manifest did not parse: ${e.message}`
     };
   }
+  const localVersion = manifestApiVersion(local);
+  const deployedVersion = manifestApiVersion(deployed);
+  if (localVersion !== deployedVersion && (isV2(localVersion) || isV2(deployedVersion))) {
+    return {
+      inSync: false,
+      changes: [],
+      parseError: null,
+      shapeMismatch: `local uses ${localVersion ?? "an unknown schema"}; deployed uses ${deployedVersion ?? "an unknown schema"}`
+    };
+  }
+  if (isV2(localVersion) && isV2(deployedVersion)) {
+    local = { spec: manifestSpec(local) };
+    deployed = { spec: manifestSpec(deployed) };
+  }
+  local = normalize(local);
+  deployed = normalize(deployed);
   if (stableStringify(local) === stableStringify(deployed)) {
     return { inSync: true, changes: [], parseError: null };
   }
@@ -6849,6 +7229,18 @@ function diffManifests(localYaml, deployedYaml) {
   }
   return { inSync: false, changes, parseError: null };
 }
+function manifestApiVersion(value) {
+  if (typeof value !== "object" || value === null)
+    return null;
+  const apiVersion = value.apiVersion;
+  return typeof apiVersion === "string" ? apiVersion : null;
+}
+function isV2(apiVersion) {
+  return apiVersion === "launchpad.m-kopa.us/v2";
+}
+function manifestSpec(value) {
+  return typeof value === "object" && value !== null ? value.spec : undefined;
+}
 function renderManifestDiffLines(diff, max = 20) {
   const lines = [];
   for (const c of diff.changes.slice(0, max)) {
@@ -7256,9 +7648,6 @@ function parseDeployFlags(args) {
   if (appType === null) {
     return `--new requires --app-type (one of ${APP_TYPES.join(", ")})`;
   }
-  if (allowedGroups.length === 0) {
-    return "--new requires at least one --allowed-group";
-  }
   return {
     mode: {
       kind: "new",
@@ -7277,47 +7666,6 @@ function parseDeployFlags(args) {
 import { existsSync as existsSync6, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join10 } from "node:path";
 
-// src/manifest/load.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-import { parse as parseYaml5, YAMLParseError } from "yaml";
-function loadManifest(path8) {
-  let raw;
-  try {
-    raw = readFileSync10(path8, "utf8");
-  } catch (err) {
-    const e = err;
-    if (e.code === "ENOENT") {
-      return { kind: "file-not-found", path: path8 };
-    }
-    return { kind: "read-error", path: path8, message: e.message ?? String(err) };
-  }
-  return parseManifest2(raw, path8);
-}
-function parseManifest2(yamlText, path8) {
-  let parsed;
-  try {
-    parsed = parseYaml5(yamlText);
-  } catch (err) {
-    const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
-    return { kind: "yaml-parse-error", path: path8, message };
-  }
-  const result = ManifestSchema.safeParse(parsed);
-  if (result.success) {
-    return { kind: "ok", manifest: result.data };
-  }
-  return {
-    kind: "schema-error",
-    path: path8,
-    issues: formatIssues(result.error)
-  };
-}
-function formatIssues(error) {
-  return error.issues.map((issue) => ({
-    path: issue.path.map(String).join(".") || "(root)",
-    message: issue.message
-  }));
-}
-
 // src/status-page-output.ts
 async function surfaceStatusPageUrl(url, io, options) {
   if (typeof url !== "string" || url.length === 0)
@@ -7392,13 +7740,13 @@ async function runDeployApply(opts, io, deps = {}) {
     return 0;
   }
   const manifestPath = resolvePath(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError(loaded, io);
   }
-  const slug = loaded.manifest.metadata.name;
+  const slug = manifestSlug(loaded);
   if (!SLUG_REGEX2.test(slug)) {
-    io.err(`launchpad deploy --apply: manifest's metadata.name '${slug}' is not a valid slug`);
+    io.err(`launchpad deploy --apply: manifest's ${loaded.schema === "launchpad.m-kopa.us/v2" ? "metadata.slug" : "metadata.name"} '${slug}' is not a valid slug`);
     return 1;
   }
   if (opts.atSha !== undefined && !MANIFEST_SHA_REGEX.test(opts.atSha)) {
@@ -7689,12 +8037,12 @@ function deletePinIfPresent(cfg, slug, io) {
 }
 async function loadSlugForResume(opts, io) {
   const manifestPath = resolvePath(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok") {
     renderManifestError(loaded, io);
     return null;
   }
-  return loaded.manifest.metadata.name;
+  return manifestSlug(loaded);
 }
 async function defaultPrompt(question) {
   const { createInterface } = await import("node:readline/promises");
@@ -7735,6 +8083,10 @@ function mapHttpError(e, slug, io) {
   io.err(`launchpad deploy --apply failed: ${describe14(e)}`);
   return 2;
 }
+function manifestSlug(loaded) {
+  const { metadata } = loaded.manifest;
+  return "slug" in metadata ? metadata.slug : metadata.name;
+}
 function renderManifestError(loaded, io) {
   switch (loaded.kind) {
     case "ok":
@@ -8630,6 +8982,10 @@ async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
     io.out(`  config diff: skipped (${diff.parseError}).`);
     return;
   }
+  if (diff.shapeMismatch !== undefined) {
+    io.out(`  config diff: manifest shapes differ (${diff.shapeMismatch}); drift was not evaluated.`);
+    return;
+  }
   if (diff.inSync) {
     io.out("  config: launchpad.yaml matches the deployed manifest (in sync).");
     return;
@@ -8653,6 +9009,7 @@ async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
   let appType = "static";
+  let declaredOrigin;
   try {
     const manifestObj = parseYaml6(readFileSync11(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
@@ -8662,13 +9019,22 @@ async function runModelADeploy(args) {
     }
     slug = metaSlug;
     const raw = manifestObj;
-    const isV2 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
-    const deploymentType = isV2 ? raw?.spec?.appType : raw?.deployment?.type;
+    const isV22 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
+    declaredOrigin = declaredOriginOf(isV22, raw?.spec?.origin);
+    const deploymentType = isV22 ? raw?.spec?.appType : raw?.deployment?.type;
     if (deploymentType === "static" || deploymentType === "react" || deploymentType === "react+api" || deploymentType === "container") {
       appType = deploymentType;
     }
+    if (appType !== undefined) {
+      const auth = isV22 ? raw?.spec?.auth : raw?.auth;
+      const issue = deploymentAuthIssue(appType, auth === "gateway" ? "gateway" : auth === "access" ? "access" : undefined);
+      if (issue !== null) {
+        io.err(`launchpad deploy: ${issue.message}`);
+        return 1;
+      }
+    }
     if (deploymentType === "container") {
-      const parsed = isV2 ? parseManifestV2(manifestObj) : parseManifest(manifestObj);
+      const parsed = isV22 ? parseManifestV2(manifestObj) : parseManifest(manifestObj);
       if (parsed.kind !== "ok") {
         io.err("launchpad deploy: manifest is structurally invalid:");
         for (const issue of parsed.issues) {
@@ -8720,7 +9086,8 @@ async function runModelADeploy(args) {
   try {
     await surfaceManifestDiff(cfg, slug, manifestPath, io);
   } catch {}
-  const deployBaseline = noVerify ? null : await readDeploymentBaseline(realCommitWaitDeps(cfg), slug);
+  const deployContext = await readDeploymentContext(realCommitWaitDeps(cfg), slug);
+  const deployBaseline = noVerify ? null : deployContext.baseline;
   let result;
   try {
     if (args.allowUnguarded) {
@@ -8791,6 +9158,11 @@ async function runModelADeploy(args) {
         allowedHost: cfg.statusPageHost
       });
       const errorCode = body.error;
+      if (errorCode === "audience_confirmation_required") {
+        io.err(String(body.message));
+        io.err("Only the human builder may confirm. Retry this deployment after confirmation.");
+        return 1;
+      }
       if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
         io.err(upgradeRequiredMessage(body.minimum, body.yours));
         return EXIT_CLI_UPGRADE_REQUIRED;
@@ -8850,7 +9222,11 @@ async function runModelADeploy(args) {
         if (accessExit !== 0)
           return accessExit;
         io.out("");
-        io.out("Committed; build pending - Cloudflare Pages is building this deploy now.");
+        const dispatchOrigin = handoffIsDispatch({
+          declared: declaredOrigin,
+          baseline: deployContext.origin
+        });
+        surfaceCommittedHandoff(dispatchOrigin, io, "ascii");
         if (noVerify)
           return 0;
         return runDeployVerification({
@@ -8860,7 +9236,8 @@ async function runModelADeploy(args) {
           shippedSha: outcome.manifest_sha,
           baseline: deployBaseline,
           registrationBoundMs,
-          timeoutMs: verifyTimeoutMs
+          timeoutMs: verifyTimeoutMs,
+          dispatchOrigin
         }, io, realVerifyDeployDeps(cfg));
       }
       io.err(`launchpad deploy: ${formatErrorEnvelope(body)}`);
@@ -8956,9 +9333,18 @@ async function runModelADeploy(args) {
       }
       surfaceDeployExtras(success, io, slug, args.allowStale);
       io.out("");
-      io.out("Committed; build pending — Cloudflare Pages is building this deploy now.");
+      const dispatchOrigin = handoffIsDispatch({
+        v2Delivery: success.v2Delivery,
+        declared: declaredOrigin,
+        baseline: deployContext.origin
+      });
+      surfaceCommittedHandoff(dispatchOrigin, io);
       if (noVerify) {
-        io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
+        if (dispatchOrigin) {
+          io.out(`Run \`launchpad status ${slug}\` to confirm the delivery stage and outcome.`);
+        } else {
+          io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
+        }
         return 0;
       }
       return runDeployVerification({
@@ -8968,11 +9354,33 @@ async function runModelADeploy(args) {
         shippedSha: success.commit_sha,
         baseline: deployBaseline,
         registrationBoundMs,
-        timeoutMs: verifyTimeoutMs
+        timeoutMs: verifyTimeoutMs,
+        dispatchOrigin
       }, io, realVerifyDeployDeps(cfg));
     }
   }
 }
+function surfaceCommittedHandoff(dispatchOrigin, io, pagesStyle = "unicode") {
+  io.out(committedHandoffMessage(dispatchOrigin, pagesStyle));
+}
+function declaredOriginOf(isV22, origin) {
+  if (!isV22)
+    return "pages";
+  return origin === "dispatch" ? "dispatch" : "pages";
+}
+function handoffIsDispatch(input) {
+  if (input.v2Delivery === "pending" || input.v2Delivery === "deferred")
+    return true;
+  if (input.declared !== undefined)
+    return input.declared === "dispatch";
+  return input.baseline === "dispatch";
+}
+function committedHandoffMessage(dispatchOrigin, pagesStyle = "unicode") {
+  if (dispatchOrigin) {
+    return "Committed; your repo's build workflow is building this commit, then the bot delivers it to the dispatch namespace.";
+  }
+  return pagesStyle === "ascii" ? "Committed; build pending - Cloudflare Pages is building this deploy now." : "Committed; build pending — Cloudflare Pages is building this deploy now.";
+}
 function pendingReconcileOutcome(body) {
   const manifestSha = body.manifestSha;
   const id = body.reconcileId;
@@ -10364,7 +10772,7 @@ var initCommand = {
   summary: "scaffold a new launchpad.yaml in the current directory",
   run: (args, io) => runInit(args, io, defaultPrompt2)
 };
-async function runInit(args, io, prompt) {
+async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(), { path: "/me/identity" })) {
   const parsed = parseArgs6(args);
   if (parsed.kind === "usage-error") {
     io.err(`launchpad init: ${parsed.message}`);
@@ -10400,8 +10808,39 @@ async function runInit(args, io, prompt) {
     io.err(`launchpad init: ${fillResult.message}`);
     return 64;
   }
-  const manifest = buildManifest(fillResult.inputs, detected);
-  const validation = ManifestSchema.safeParse(manifest);
+  const authIssue = deploymentAuthIssue(fillResult.inputs.type, fillResult.inputs.auth ?? "gateway");
+  if (authIssue !== null) {
+    io.err(`launchpad init: ${authIssue.message}`);
+    return 64;
+  }
+  if (fillResult.inputs.type === "container" && inputs.origin !== undefined) {
+    io.err("launchpad init: --origin is not supported for containers");
+    return 64;
+  }
+  const dispatch = newAppOrigin(fillResult.inputs.type, inputs.origin) === "dispatch";
+  if (dispatch && fillResult.inputs.type === "react+api") {
+    io.err("launchpad init: API starter dispatch is not available yet; use --origin pages");
+    return 64;
+  }
+  if (dispatch && (inputs.hostnames.length > 0 || inputs.sessionDuration !== undefined)) {
+    io.err("launchpad init: dispatch does not support --hostname or --session-duration; use --origin pages for a Pages manifest");
+    return 64;
+  }
+  let privateOwner;
+  if (fillResult.inputs.groups.length === 0) {
+    try {
+      privateOwner = await identity();
+    } catch (error) {
+      io.err(`launchpad init: cannot verify your identity for a private app: ${error instanceof Error ? error.message : String(error)}`);
+      return 1;
+    }
+    io.out(`Audience: private. Only you (${privateOwner.email}) and platform administrators can open this app.`);
+  } else {
+    io.out(`Audience: selected Entra groups (${fillResult.inputs.groups.join(", ")}), plus platform administrators.`);
+    io.out("Company-wide grants require your explicit browser confirmation before publishing.");
+  }
+  const manifest = buildManifest({ ...fillResult.inputs, ...privateOwner === undefined ? {} : { privateOwner } }, detected);
+  const validation = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? ManifestV2Schema.safeParse(manifest) : ManifestSchema.safeParse(manifest);
   if (!validation.success) {
     io.err("launchpad init: invalid manifest input");
     for (const issue of validation.error.issues) {
@@ -10454,8 +10893,11 @@ async function runInit(args, io, prompt) {
   io.out("");
   io.out("Next steps:");
   io.out("  launchpad validate                # confirm the manifest");
-  io.out("  launchpad secrets template        # scaffold .env.example");
-  io.out("  launchpad deploy                  # ship it (Scope 6, pending)");
+  if (!dispatch)
+    io.out("  launchpad secrets template        # scaffold .env.example");
+  io.out("  launchpad deploy                  # build and deploy the app");
+  if (dispatch)
+    io.out("  Dispatch currently supports plain-text environment variables, but not secret bindings.");
   return 0;
 }
 function parseArgs6(args) {
@@ -10466,6 +10908,7 @@ function parseArgs6(args) {
     description: undefined,
     type: undefined,
     auth: undefined,
+    origin: undefined,
     groups: [],
     sessionDuration: undefined,
     hostnames: [],
@@ -10550,6 +10993,16 @@ function parseArgs6(args) {
       inputs.type = got;
       continue;
     }
+    if (a === "--origin") {
+      const got = needsValue();
+      if (typeof got !== "string")
+        return got;
+      if (got !== "pages" && got !== "dispatch") {
+        return { kind: "usage-error", message: "--origin must be pages or dispatch" };
+      }
+      inputs.origin = got;
+      continue;
+    }
     if (a === "--auth") {
       const got = needsValue();
       if (typeof got !== "string")
@@ -10686,18 +11139,7 @@ async function fillRequired(inputs, options, io, prompt) {
       io.err(`  must be one of: ${APP_TYPES2.join(", ")}`);
     }
   }
-  let groupsR;
-  if (inputs.groups.length > 0) {
-    groupsR = inputs.groups;
-  } else {
-    const raw = await askIfMissing(undefined, "allowed_entra_groups (one or more, comma-separated)", (v) => v.length >= 1 ? undefined : "must not be empty");
-    if (typeof raw !== "string")
-      return raw;
-    groupsR = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-    if (groupsR.length === 0) {
-      return { kind: "usage-error", message: "at least one allowed Entra group is required" };
-    }
-  }
+  const groupsR = inputs.groups;
   let containerImage = inputs.containerImage;
   let containerPort = inputs.containerPort;
   if (typeR === "container") {
@@ -10744,6 +11186,7 @@ async function fillRequired(inputs, options, io, prompt) {
       description: inputs.description,
       type: typeR,
       auth: inputs.auth,
+      origin: inputs.origin,
       groups: groupsR,
       sessionDuration: inputs.sessionDuration,
       hostnames: inputs.hostnames,
@@ -10762,7 +11205,7 @@ function buildManifest(inputs, detected) {
     metadata.description = inputs.description;
   }
   const deployment = { type: inputs.type };
-  const access = inputs.groups.length === 1 ? { allowed_entra_group: inputs.groups[0] } : { allowed_entra_groups: [...inputs.groups] };
+  const access = inputs.privateOwner !== undefined ? { audience: "private", private_owner: inputs.privateOwner, allowed_entra_groups: [] } : inputs.groups.length === 1 ? { allowed_entra_group: inputs.groups[0] } : { allowed_entra_groups: [...inputs.groups] };
   if (inputs.sessionDuration !== undefined && inputs.sessionDuration !== "") {
     access.session_duration = inputs.sessionDuration;
   }
@@ -10771,6 +11214,7 @@ function buildManifest(inputs, detected) {
     kind: "App",
     metadata,
     deployment,
+    catalogue: { listed: false },
     access
   };
   const resolvedAuth = inputs.auth ?? (inputs.type === "container" ? "access" : "gateway");
@@ -10803,6 +11247,33 @@ function buildManifest(inputs, detected) {
     root: ".",
     include: [...defaultIncludeForAppType(inputs.type)]
   };
+  if (newAppOrigin(inputs.type, inputs.origin) === "dispatch") {
+    return {
+      apiVersion: "launchpad.m-kopa.us/v2",
+      kind: "App",
+      metadata: { slug: inputs.name, schemaVersion: 2 },
+      spec: {
+        appType: inputs.type,
+        origin: "dispatch",
+        auth: resolvedAuth,
+        display: {
+          name: inputs.name,
+          team: inputs.team,
+          ...inputs.description ? { description: inputs.description } : {}
+        },
+        owner: { email: inputs.owner },
+        access: {
+          ...inputs.privateOwner === undefined ? {} : { audience: "private", private_owner: inputs.privateOwner },
+          allowed_entra_groups: [...inputs.groups]
+        },
+        catalogue: { listed: false },
+        app: manifest.app,
+        ...manifest.build === undefined ? {} : { build: manifest.build }
+      }
+    };
+  }
+  if (inputs.origin === "pages")
+    manifest.origin = "pages";
   return manifest;
 }
 function starterIndexHtml(slug) {
@@ -13242,11 +13713,15 @@ async function runSecretsPush(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
   const manifestPath = resolvePath4(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError4(loaded, io);
   }
-  const bindings = loaded.manifest.secrets?.bindings ?? [];
+  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets push", io);
+  if (v2Refusal !== null)
+    return v2Refusal;
+  const manifest = loaded.manifest;
+  const bindings = manifest.secrets?.bindings ?? [];
   const envFileBindings = bindings.filter((b) => b.source === "env-file");
   if (envFileBindings.length === 0) {
     io.out("No `env-file` secret bindings declared in the manifest.");
@@ -13328,7 +13803,7 @@ async function runSecretsPush(opts, io, deps = {}) {
     io.out("Re-run without --dry-run to push.");
     return 0;
   }
-  const slug = loaded.manifest.metadata.name;
+  const slug = manifest.metadata.name;
   let pushed = 0;
   let partial = 0;
   let anyPagesUpdated = false;
@@ -13453,6 +13928,20 @@ function mapPushError(e, slug, name, io) {
 function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function refuseV2Manifest(loaded, command, io) {
+  if (loaded.schema !== "launchpad.m-kopa.us/v2")
+    return null;
+  const origin = loaded.manifest.spec?.origin;
+  if (origin === "dispatch") {
+    io.err(`${command}: this is a dispatch-origin (v2) app.`);
+    const outcome = command.endsWith("push") ? "nothing was pushed" : "nothing was read";
+    io.err(`  Secrets are not delivered to the dispatch namespace yet (PS-2740); ${outcome}.`);
+    return 1;
+  }
+  io.err(`${command}: this is a launchpad.m-kopa.us/v2 manifest.`);
+  io.err("  This command reads v1alpha1 `secrets.bindings`; v2 declares secrets as `spec.env_vars` `secret_text` entries, which it does not push yet.");
+  return 1;
+}
 function renderManifestError4(result, io) {
   switch (result.kind) {
     case "ok":
@@ -13490,16 +13979,20 @@ async function runSecretsStatus(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
   const manifestPath = resolvePath5(process.cwd(), opts.file ?? "launchpad.yaml");
-  const loaded = loadManifest(manifestPath);
+  const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok")
     return renderManifestError5(loaded, io);
-  const slug = loaded.manifest.metadata.name;
+  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets status", io);
+  if (v2Refusal !== null)
+    return v2Refusal;
+  const manifest = loaded.manifest;
+  const slug = manifest.metadata.name;
   if (opts.slug != null && opts.slug !== slug) {
     io.err(`launchpad secrets status: slug "${opts.slug}" does not match this directory's ` + `manifest (metadata.name: "${slug}").`);
     io.err("  secrets status audits the manifest in the current directory — omit the slug, " + "or run from the app's directory.");
     return 2;
   }
-  const bindings = loaded.manifest.secrets?.bindings ?? [];
+  const bindings = manifest.secrets?.bindings ?? [];
   if (bindings.length === 0) {
     io.out("No secret bindings declared in the manifest.");
     return 0;
@@ -14867,7 +15360,7 @@ import { existsSync as existsSync16, readFileSync as readFileSync21, readdirSync
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
-  summary: "validate launchpad.yaml against the v1alpha1 schema",
+  summary: "validate launchpad.yaml against its v1alpha1 or v2 schema",
   run: runValidate
 };
 async function runValidate(args, io) {
@@ -14879,7 +15372,7 @@ async function runValidate(args, io) {
   }
   const { file, json, strictGroups } = parseResult;
   const path14 = resolve17(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifest(path14);
+  const result = loadManifestAnyVersion(path14);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
@@ -14889,16 +15382,17 @@ async function runValidate(args, io) {
     manifest: result.manifest,
     io,
     json,
-    structurallyValidName: result.manifest.metadata.name
+    structurallyValidName: manifestView(result.manifest).name
   });
   if (unsupported2 !== null)
     return unsupported2;
-  const boundary = checkBoundary(path14, result.manifest.app !== undefined);
+  const view = manifestView(result.manifest);
+  const boundary = checkBoundary(path14, view.appDeclared);
   const serveErrors = checkStaticServeDir(path14, result.manifest);
   if (serveErrors.length > 0) {
     boundary.errors = [...boundary.errors, ...serveErrors];
   }
-  const groupCheck = strictGroups ? await checkGroups(allowedEntraGroups(result.manifest.access)) : { kind: "skipped" };
+  const groupCheck = strictGroups ? await checkGroups(allowedEntraGroups(view.access)) : { kind: "skipped" };
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
 function checkBoundary(manifestPath, declared) {
@@ -14922,11 +15416,12 @@ function checkBoundary(manifestPath, declared) {
   return { declared, errors: [], warnings: r.warnings };
 }
 function checkStaticServeDir(manifestPath, manifest) {
-  if (manifest.deployment.type !== "static")
+  const view = manifestView(manifest);
+  if (view.deploymentType !== "static")
     return [];
-  if (manifest.build?.command !== undefined)
+  if (view.buildCommand !== undefined)
     return [];
-  const serveDir = manifest.build?.destination_dir ?? STATIC_SERVE_DIR;
+  const serveDir = view.destinationDir ?? STATIC_SERVE_DIR;
   const normalized = serveDir.replace(/\\/g, "/");
   const segments = normalized.split("/");
   if (normalized === "" || normalized === "." || normalized === "./" || normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized) || segments.some((s) => s === "..")) {
@@ -15026,9 +15521,10 @@ async function checkGroups(groups) {
   return ok ? { kind: "all-ok", perGroup } : { kind: "some-failed", perGroup };
 }
 function renderHumanOk(result, group, boundary, io) {
-  io.out(`✓ ${result.manifest.metadata.name} — manifest is valid`);
-  io.out(`  apiVersion: launchpad.m-kopa.us/v1alpha1`);
-  io.out(`  type:       ${result.manifest.deployment.type}`);
+  const view = manifestView(result.manifest);
+  io.out(`✓ ${view.name} — manifest is valid`);
+  io.out(`  apiVersion: ${result.schema}`);
+  io.out(`  type:       ${view.deploymentType}`);
   if (boundary.errors.length > 0) {
     for (const e of boundary.errors) {
       io.err(`✗ app boundary: ${e}`);
@@ -15097,6 +15593,7 @@ function renderHumanError(result, io) {
       return 1;
     case "schema-error":
       io.err(`✗ ${result.path}`);
+      io.err(`  validated against schema: ${result.schema}`);
       io.err(`  ${result.issues.length} schema issue${result.issues.length === 1 ? "" : "s"}:`);
       for (const issue of result.issues) {
         io.err(`    ${issue.path}: ${issue.message}`);
@@ -15105,11 +15602,12 @@ function renderHumanError(result, io) {
   }
 }
 function renderJsonOk(result, group, boundary, io) {
+  const view = manifestView(result.manifest);
   const base = {
     manifest_valid: true,
     runtime_supported: true,
-    name: result.manifest.metadata.name,
-    deploymentType: result.manifest.deployment.type,
+    name: view.name,
+    deploymentType: view.deploymentType,
     appBoundary: {
       declared: boundary.declared,
       errors: boundary.errors,
@@ -15189,11 +15687,32 @@ function renderJsonError(result, io) {
         ok: false,
         kind: "schema-error",
         path: result.path,
+        schema: result.schema,
         issues: result.issues
       }));
       return 1;
   }
 }
+function manifestView(manifest) {
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2") {
+    return {
+      name: manifest.metadata.slug,
+      deploymentType: manifest.spec.appType,
+      access: manifest.spec.access,
+      buildCommand: manifest.spec.build?.command,
+      destinationDir: manifest.spec.build?.destination_dir,
+      appDeclared: manifest.spec.app !== undefined
+    };
+  }
+  return {
+    name: manifest.metadata.name,
+    deploymentType: manifest.deployment.type,
+    access: manifest.access,
+    buildCommand: manifest.build?.command,
+    destinationDir: manifest.build?.destination_dir,
+    appDeclared: manifest.app !== undefined
+  };
+}
 function parseArgs13(args) {
   let file;
   let json = false;