@m-kopa/launchpad-cli 0.61.1 → 0.62.0

package/CHANGELOG.md

@@ -8,6 +8,20 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.62.0 - 2026-09-17
+
+### Added
+
+- `launchpad migrate --origin dispatch` converts compatible, unprovisioned static and React apps to Workers without hand-editing v1 manifests.
+  It preserves access and application settings, keeps the original YAML, and refuses unsupported runtimes or an existing app record.
+  Failed writes clean up only the current attempt's files so migration can be retried.
+
+### Fixed
+
+- Pages quota errors explain why the existing manifest still selects Pages and give the supported migration command.
+  Pages Functions apps get build-specific guidance instead of an unsafe origin-only edit.
+- Deploy prints when the manifest selects Pages, so a CLI update is not mistaken for a runtime migration.
+
 ## 0.61.1 - 2026-09-17
 
 ### Fixed

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.61.1";
+var CLI_VERSION = "0.62.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -226,7 +226,12 @@ class ForbiddenError extends Error {
 }
 
 class NotFoundError extends Error {
+  serverCode;
   code = "not_found";
+  constructor(message, serverCode) {
+    super(message);
+    this.serverCode = serverCode;
+  }
 }
 var EXIT_CLI_UPGRADE_REQUIRED = 42;
 
@@ -1148,8 +1153,9 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
     throw recordedFault(new ForbiddenError(`bot returned 403 for ${opts.path}: ${detail}`));
   }
   if (res.status === 404) {
-    const detail = await errorDetail(res, opts.path);
-    throw recordedFault(new NotFoundError(`bot returned 404 for ${opts.path}: ${detail}`));
+    const envelope = await readErrorEnvelope(res, opts.path);
+    const detail = formatErrorEnvelope(envelope);
+    throw recordedFault(new NotFoundError(`bot returned 404 for ${opts.path}: ${detail}`, envelope.code));
   }
   if (!res.ok) {
     if (opts.nonThrowingStatuses?.includes(res.status) === true) {
@@ -9076,6 +9082,12 @@ async function runModelADeploy(args) {
     return 64;
   }
   io.out(`Bundling ${cwd} for ${slug} (Model A) …`);
+  if (declaredOrigin !== "dispatch" && appType !== "container") {
+    io.out("Deployment target: Cloudflare Pages, selected by launchpad.yaml.");
+    if (appType === "static" || appType === "react") {
+      io.out("For an app that has never provisioned, `launchpad migrate --origin dispatch` checks whether it can use Workers without a Pages project.");
+    }
+  }
   let cfg;
   try {
     cfg = loadConfig();
@@ -11828,6 +11840,178 @@ function describe25(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
+// src/commands/migrate.ts
+import { closeSync, existsSync as existsSync11, lstatSync as lstatSync4, mkdirSync as mkdirSync4, mkdtempSync, openSync, readFileSync as readFileSync16, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import path12 from "node:path";
+import { stringify } from "yaml";
+
+// src/manifest/migrate-dispatch.ts
+function dispatchManifest(manifest) {
+  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
+  const source = v2 ? manifest.spec : manifest;
+  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
+  if (appType !== "static" && appType !== "react") {
+    throw new Error("Only static and React apps can use this converter. Pages Functions (react+api) need a compiled Worker build before switching to dispatch; containers use their own runtime.");
+  }
+  if (source.secrets !== undefined || source.containers !== undefined) {
+    throw new Error("Secret and container bindings cannot be converted automatically.");
+  }
+  if (!v2)
+    assertConvertibleV1(manifest);
+  const spec = v2 ? { ...manifest.spec } : {
+    appType,
+    display: {
+      name: manifest.metadata.name,
+      team: manifest.metadata.team,
+      ...manifest.metadata.description === undefined ? {} : { description: manifest.metadata.description }
+    },
+    owner: { email: manifest.metadata.owner },
+    access: {
+      audience: manifest.access.audience,
+      private_owner: manifest.access.private_owner,
+      allowed_entra_groups: [...allowedEntraGroups(manifest.access)],
+      identity_types: manifest.access.identity_types
+    },
+    build: manifest.build,
+    app: manifest.app,
+    verify: manifest.verify,
+    sensitive: manifest.sensitive,
+    catalogue: manifest.catalogue,
+    ...manifest.production_env === undefined ? {} : {
+      env_vars: Object.fromEntries(Object.entries(manifest.production_env).map(([name, value]) => [name, { type: "plain_text", value }]))
+    }
+  };
+  const candidate = {
+    apiVersion: "launchpad.m-kopa.us/v2",
+    kind: "App",
+    metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
+    spec: { ...spec, origin: "dispatch", auth: "gateway", confine_origin: undefined }
+  };
+  const parsed = parseManifestV2(candidate);
+  if (parsed.kind !== "ok") {
+    throw new Error(`Cannot convert manifest: ${parsed.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
+  }
+  return parsed.manifest;
+}
+function assertConvertibleV1(manifest) {
+  const unsupported2 = [
+    manifest.hostnames !== undefined && "hostnames",
+    manifest.targets !== undefined && "targets",
+    manifest.access.session_duration !== undefined && "access.session_duration",
+    manifest.deployment.runtime !== undefined && "deployment.runtime"
+  ].filter(Boolean);
+  if (unsupported2.length > 0) {
+    throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
+  }
+}
+
+// src/commands/migrate.ts
+var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
+var migrateCommand = {
+  name: "migrate",
+  summary: "convert an unprovisioned static or React app to Workers dispatch",
+  run: runMigrate
+};
+async function runMigrate(args, io) {
+  if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
+    io.out(USAGE);
+    return 0;
+  }
+  const flags = args.filter((arg) => arg !== "--dry-run");
+  if (flags.length !== 2 || flags[0] !== "--origin" || flags[1] !== "dispatch" || args.length > 3) {
+    io.err(USAGE);
+    return 64;
+  }
+  const cwd = process.cwd();
+  const file = path12.join(cwd, "launchpad.yaml");
+  try {
+    if (!lstatSync4(file).isFile())
+      throw new Error("launchpad.yaml must be a regular file, not a symlink.");
+    const original = readFileSync16(file, "utf8");
+    const loaded = parseManifestAnyVersion(original, file);
+    if (loaded.kind !== "ok")
+      throw new Error("launchpad.yaml is invalid. Run `launchpad validate` and correct it first.");
+    const manifest = loaded.manifest;
+    if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch") {
+      io.out("launchpad.yaml already selects Workers dispatch. Run `launchpad deploy`.");
+      return 0;
+    }
+    const converted = dispatchManifest(manifest);
+    assertNoCustomRuntime(cwd, converted);
+    const slug = converted.metadata.slug;
+    await assertUnregistered(slug);
+    if (args.includes("--dry-run")) {
+      io.out(`${slug}: eligible for v2 Workers dispatch with gateway authentication. No files changed.`);
+      return 0;
+    }
+    saveMigration(file, original, converted);
+    io.out(`${slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
+    io.out("Audience, owner and application settings are preserved. Original: .launchpad/manifest-before-dispatch.yaml");
+    io.out("Run `launchpad deploy`. No Pages project is needed.");
+    return 0;
+  } catch (error) {
+    io.err(`launchpad migrate: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+async function assertUnregistered(slug) {
+  try {
+    await apiRaw(loadConfig(), { path: `/apps/${encodeURIComponent(slug)}/manifest/state` });
+  } catch (error) {
+    if (error instanceof NotFoundError && error.serverCode === "not_found")
+      return;
+    throw error;
+  }
+  throw new Error("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
+}
+function assertNoCustomRuntime(cwd, manifest) {
+  const appRoot = path12.resolve(cwd, manifest.spec.app?.root ?? ".");
+  const buildRoot = path12.resolve(appRoot, manifest.spec.build?.root_dir ?? ".");
+  const roots = new Set([
+    cwd,
+    appRoot,
+    buildRoot,
+    path12.resolve(cwd, manifest.spec.build?.root_dir ?? "."),
+    path12.resolve(buildRoot, manifest.spec.build?.destination_dir ?? "dist")
+  ]);
+  for (const root of roots) {
+    for (const name of ["functions", "_worker.js", "wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
+      if (existsSync11(path12.join(root, name))) {
+        throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker bindings must not be dropped. Ask the platform team to review this app.`);
+      }
+    }
+  }
+}
+function saveMigration(file, original, converted) {
+  if (readFileSync16(file, "utf8") !== original)
+    throw new Error("launchpad.yaml changed during the check. Retry migration.");
+  const backupDir = path12.join(path12.dirname(file), ".launchpad");
+  mkdirSync4(backupDir, { recursive: true });
+  const backup = path12.join(backupDir, "manifest-before-dispatch.yaml");
+  const attemptDir = mkdtempSync(path12.join(backupDir, "migration-"));
+  let backupCreated = false;
+  try {
+    const fd = openSync(backup, "wx", 384);
+    backupCreated = true;
+    try {
+      writeFileSync4(fd, original);
+    } finally {
+      closeSync(fd);
+    }
+    const temporary = path12.join(attemptDir, "launchpad.yaml");
+    writeFileSync4(temporary, stringify(converted), { flag: "wx", mode: 384 });
+    if (readFileSync16(file, "utf8") !== original)
+      throw new Error("launchpad.yaml changed during migration. Retry migration.");
+    renameSync(temporary, file);
+  } catch (error) {
+    if (backupCreated)
+      rmSync2(backup);
+    throw error;
+  } finally {
+    rmSync2(attemptDir, { recursive: true, force: true });
+  }
+}
+
 // src/commands/plan.ts
 import { resolve as resolve12 } from "node:path";
 var planCommand = {
@@ -12292,18 +12476,18 @@ function describe26(e) {
 }
 
 // src/commands/pull.ts
-import { writeFileSync as writeFileSync4 } from "node:fs";
+import { writeFileSync as writeFileSync5 } from "node:fs";
 import { stringify as stringifyYaml } from "yaml";
 
 // src/deploy/manifest-status.ts
 async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
-  const path12 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
-  return apiJson(cfg, { path: path12 }, fetcher);
+  const path13 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
+  return apiJson(cfg, { path: path13 }, fetcher);
 }
 
 // src/pull/source-sync.ts
 import * as fs6 from "node:fs/promises";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import { constants as fsConstants } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
 import { execFile } from "node:child_process";
@@ -12342,9 +12526,9 @@ async function runSourceSync(args) {
     args.io.out(`Already current at ${compare.headSha.slice(0, 12)}.`);
     return 0;
   }
-  const stageRoot = path12.resolve(args.cwd, MARKER_DIR, `pull-stage-${process.pid}-${crypto.randomUUID()}`);
-  const baseDir = path12.join(stageRoot, "base");
-  const headDir = path12.join(stageRoot, "head");
+  const stageRoot = path13.resolve(args.cwd, MARKER_DIR, `pull-stage-${process.pid}-${crypto.randomUUID()}`);
+  const baseDir = path13.join(stageRoot, "base");
+  const headDir = path13.join(stageRoot, "head");
   await fs6.mkdir(baseDir, { recursive: true });
   await fs6.mkdir(headDir, { recursive: true });
   try {
@@ -12396,7 +12580,7 @@ async function bootstrapProvenance(args) {
     args.io.err("  Preserve this directory and obtain a separate current clone for comparison.");
     return 1;
   }
-  const stageRoot = path12.resolve(args.cwd, MARKER_DIR, `pull-bootstrap-${process.pid}-${crypto.randomUUID()}`);
+  const stageRoot = path13.resolve(args.cwd, MARKER_DIR, `pull-bootstrap-${process.pid}-${crypto.randomUUID()}`);
   await fs6.mkdir(stageRoot, { recursive: true });
   try {
     const headSha = await fetchSnapshotRef(args.cfg, args.slug, "main", stageRoot);
@@ -12422,7 +12606,7 @@ async function treesEqual(cwd, tracked, headDir, headPaths) {
   for (const relative6 of tracked) {
     if (!expected.has(relative6))
       return false;
-    if (!equal(await readEntry(path12.resolve(cwd, relative6)), await readEntry(path12.resolve(headDir, relative6)))) {
+    if (!equal(await readEntry(path13.resolve(cwd, relative6)), await readEntry(path13.resolve(headDir, relative6)))) {
       return false;
     }
   }
@@ -12430,7 +12614,7 @@ async function treesEqual(cwd, tracked, headDir, headPaths) {
 }
 async function listFiles(root, relative6 = "") {
   const files = [];
-  const entries = await fs6.readdir(path12.resolve(root, relative6), {
+  const entries = await fs6.readdir(path13.resolve(root, relative6), {
     withFileTypes: true
   });
   for (const entry of entries) {
@@ -12506,7 +12690,7 @@ async function cleanAncestorRemovals(args) {
     const checked = await checkParents(args.cwd, relative6, removals);
     if (checked.kind === "blocked")
       continue;
-    const base = await readEntry(path12.resolve(args.baseDir, relative6));
+    const base = await readEntry(path13.resolve(args.baseDir, relative6));
     const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
     if (local.kind !== "missing" && cleanLocal(base, local))
       removals.add(relative6);
@@ -12516,9 +12700,9 @@ async function cleanAncestorRemovals(args) {
 async function planPath(args, relative6, removals) {
   assertSafePath(relative6);
   const checked = await checkParents(args.cwd, relative6, removals);
-  const base = await readEntry(path12.resolve(args.baseDir, relative6));
+  const base = await readEntry(path13.resolve(args.baseDir, relative6));
   const upstreamDeleted = args.compare.deleted.includes(relative6);
-  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path12.resolve(args.headDir, relative6));
+  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path13.resolve(args.headDir, relative6));
   const unsupported2 = (args.compare.unsupported ?? []).includes(relative6);
   if (checked.kind === "blocked") {
     return conflictPlan(relative6, checked.target, { kind: "missing" }, head, upstreamDeleted, checked.reason);
@@ -12655,7 +12839,7 @@ async function writeAtomic(cwd, relative6, bytes, mode, allowMetadata = false) {
   if (checked.kind === "blocked")
     throw new Error(checked.reason);
   const file = checked.target;
-  await fs6.mkdir(path12.dirname(file), { recursive: true });
+  await fs6.mkdir(path13.dirname(file), { recursive: true });
   const rechecked = await checkParents(cwd, relative6, new Set, allowMetadata);
   if (rechecked.kind === "blocked")
     throw new Error(rechecked.reason);
@@ -12697,14 +12881,14 @@ function isSafeSourcePath(relative6) {
   return isSafeRelativePath(relative6) && !relative6.startsWith(`${MARKER_DIR}/`);
 }
 function isSafeRelativePath(relative6) {
-  const normalized = path12.posix.normalize(relative6);
-  return relative6.length > 0 && !relative6.includes("\\") && !path12.isAbsolute(relative6) && normalized === relative6 && normalized !== ".." && !normalized.startsWith("../");
+  const normalized = path13.posix.normalize(relative6);
+  return relative6.length > 0 && !relative6.includes("\\") && !path13.isAbsolute(relative6) && normalized === relative6 && normalized !== ".." && !normalized.startsWith("../");
 }
 function resolveInsideClone(cwd, relative6) {
-  const root = path12.resolve(cwd);
-  const target = path12.resolve(root, relative6);
-  const fromRoot = path12.relative(root, target);
-  if (fromRoot.length === 0 || path12.isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${path12.sep}`)) {
+  const root = path13.resolve(cwd);
+  const target = path13.resolve(root, relative6);
+  const fromRoot = path13.relative(root, target);
+  if (fromRoot.length === 0 || path13.isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${path13.sep}`)) {
     throw new Error(`unsafe source path returned by bot: ${relative6}`);
   }
   return target;
@@ -12719,9 +12903,9 @@ async function checkParents(cwd, relative6, projectedRemovals, allowMetadata = f
   }
   const target = resolveInsideClone(cwd, relative6);
   const components = relative6.split("/");
-  let current = path12.resolve(cwd);
+  let current = path13.resolve(cwd);
   for (let index = 0;index < components.length - 1; index += 1) {
-    current = path12.join(current, components[index]);
+    current = path13.join(current, components[index]);
     const ancestor = components.slice(0, index + 1).join("/");
     const stat = await lstatIfPresent(current);
     if (stat === null)
@@ -12747,12 +12931,12 @@ async function checkParents(cwd, relative6, projectedRemovals, allowMetadata = f
   return { kind: "safe", target, projectedMissing: false };
 }
 async function assertSafeCloneRoot(cwd) {
-  const root = await fs6.lstat(path12.resolve(cwd));
+  const root = await fs6.lstat(path13.resolve(cwd));
   if (!root.isDirectory() || root.isSymbolicLink()) {
     throw new Error("launchpad pull requires a real clone directory");
   }
   try {
-    const metadata = await fs6.lstat(path12.resolve(cwd, MARKER_DIR));
+    const metadata = await fs6.lstat(path13.resolve(cwd, MARKER_DIR));
     if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
       throw new Error("launchpad pull refuses a non-directory or symlinked .launchpad path");
     }
@@ -12808,7 +12992,7 @@ async function runPull(args, io) {
       }
       const yaml = stringifyYaml(res.status);
       if (parsed.out !== null) {
-        writeFileSync4(parsed.out, yaml);
+        writeFileSync5(parsed.out, yaml);
         io.err(`launchpad pull: wrote status (${res.role} view) to ${parsed.out}`);
       } else {
         io.out(yaml.replace(/\n$/, ""));
@@ -12829,7 +13013,7 @@ async function runPull(args, io) {
       return 1;
     }
     if (parsed.out !== null) {
-      writeFileSync4(parsed.out, state.manifestYaml);
+      writeFileSync5(parsed.out, state.manifestYaml);
       io.err(`launchpad pull: wrote ${state.manifestYaml.length} bytes to ${parsed.out}`);
     } else {
       io.out(state.manifestYaml.replace(/\n$/, ""));
@@ -13230,7 +13414,7 @@ var watchCommand = {
 };
 
 // src/commands/review.ts
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 var reviewCommand = {
   name: "review",
   summary: "show the review state for a PR (slug-scoped)",
@@ -13250,7 +13434,7 @@ async function runReview(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad review: could not infer slug from cwd (${path13.basename(process.cwd())});
+      io.err(`launchpad review: could not infer slug from cwd (${path14.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -13383,7 +13567,7 @@ function describe28(e) {
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -13485,7 +13669,7 @@ async function runRollback(opts, io, deps = {}) {
     }
   }
   try {
-    writeFileSync5(manifestPath, historicalYaml, "utf8");
+    writeFileSync6(manifestPath, historicalYaml, "utf8");
   } catch (e) {
     io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe29(e)}`);
     return 2;
@@ -13507,16 +13691,16 @@ async function runRollback(opts, io, deps = {}) {
     yes: true
   }, io, applyDeps);
 }
-function readCurrentManifest(path14) {
-  if (!existsSync11(path14))
+function readCurrentManifest(path15) {
+  if (!existsSync12(path15))
     return null;
   let raw;
   try {
-    raw = readFileSync16(path14, "utf8");
+    raw = readFileSync17(path15, "utf8");
   } catch {
     return null;
   }
-  const parsed = parseManifest2(raw, path14);
+  const parsed = parseManifest2(raw, path15);
   if (parsed.kind !== "ok")
     return null;
   return summarise(parsed.manifest);
@@ -13668,7 +13852,7 @@ function parseArgs12(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync18 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as input2, stdout as output2 } from "node:process";
@@ -13729,14 +13913,14 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath4(process.cwd(), opts.env ?? ".env");
-  if (!existsSync12(envPath)) {
+  if (!existsSync13(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync17(envPath, "utf8");
+    envText = readFileSync18(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push: failed to read ${envPath}: ${describe30(e)}`);
     return 2;
@@ -14079,7 +14263,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync13, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync19 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
@@ -14088,23 +14272,23 @@ var CELL_LABEL2 = {
   not_deployed: "NOT_DEPLOYED"
 };
 function loadSet(fleetFile, setName, io) {
-  const path14 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync13(path14)) {
-    io.err(`✗ ${path14}`);
+  const path15 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
+  if (!existsSync14(path15)) {
+    io.err(`✗ ${path15}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml8(readFileSync18(path14, "utf8"));
+    obj = parseYaml8(readFileSync19(path15, "utf8"));
   } catch (e) {
-    io.err(`✗ ${path14}`);
+    io.err(`✗ ${path15}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
   const parsed = parseFleetSecretSets(obj);
   if (!parsed.ok) {
-    io.err(`✗ ${path14}`);
+    io.err(`✗ ${path15}`);
     io.err(`  ${parsed.issues.length} schema issue(s):`);
     for (const i of parsed.issues)
       io.err(`    ${i.path}: ${i.message}`);
@@ -14113,7 +14297,7 @@ function loadSet(fleetFile, setName, io) {
   const set = parsed.manifest.secretSets.find((s) => s.name === setName);
   if (set === undefined) {
     const names = parsed.manifest.secretSets.map((s) => s.name).join(", ");
-    io.err(`✗ secret-set "${setName}" not found in ${path14}`);
+    io.err(`✗ secret-set "${setName}" not found in ${path15}`);
     io.err(`  declared sets: ${names}`);
     return 1;
   }
@@ -14181,14 +14365,14 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath6(process.cwd(), opts.env ?? ".env");
-  if (!existsSync13(envPath)) {
+  if (!existsSync14(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync18(envPath, "utf8");
+    envText = readFileSync19(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -14332,7 +14516,7 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync15, writeFileSync as writeFileSync7 } from "node:fs";
 import { resolve as resolve14 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
@@ -14356,13 +14540,13 @@ async function runSecretsTemplate(args, io) {
     return 0;
   }
   const outPath = resolve14(process.cwd(), flags.out);
-  if (existsSync14(outPath) && !flags.force) {
+  if (existsSync15(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
   }
   try {
-    writeFileSync6(outPath, body, { encoding: "utf8" });
+    writeFileSync7(outPath, body, { encoding: "utf8" });
   } catch (err) {
     const e = err;
     io.err(`launchpad secrets template: failed to write ${outPath}`);
@@ -14653,12 +14837,12 @@ function printHelp3(io) {
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
 import { dirname as dirname10, join as join16, resolve as resolve15 } from "node:path";
-import { promises as fs7, existsSync as existsSync15 } from "node:fs";
+import { promises as fs7, existsSync as existsSync16 } from "node:fs";
 
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join15 } from "node:path";
-import { readFileSync as readFileSync19, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync20, readdirSync as readdirSync2 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
   return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
@@ -14677,9 +14861,9 @@ function readInstalledSkills() {
     return { present: false, version: null };
   }
 }
-function readSkillVersion(path14) {
+function readSkillVersion(path15) {
   try {
-    const text = readFileSync19(path14, "utf8");
+    const text = readFileSync20(path15, "utf8");
     const fenceEnd = text.indexOf(`
 ---`, 4);
     const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
@@ -14762,7 +14946,7 @@ function defaultBundleDir() {
     resolve15(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync15(join16(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync16(join16(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -14842,10 +15026,10 @@ async function doList(io) {
   }
   return 0;
 }
-async function readVersion(path14) {
+async function readVersion(path15) {
   let text;
   try {
-    text = await fs7.readFile(path14, "utf8");
+    text = await fs7.readFile(path15, "utf8");
   } catch {
     return null;
   }
@@ -14855,9 +15039,9 @@ async function readVersion(path14) {
   const m = /^version:\s*(.+?)\s*$/m.exec(front);
   return m === null ? null : m[1] ?? null;
 }
-async function isDir(path14) {
+async function isDir(path15) {
   try {
-    const stat = await fs7.stat(path14);
+    const stat = await fs7.stat(path15);
     return stat.isDirectory();
   } catch {
     return false;
@@ -14873,7 +15057,7 @@ import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { dirname as dirname11, resolve as resolve16, relative as relative6, isAbsolute as isAbsolute3, join as join17 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync20, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync21, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync8, rmSync as rmSync3 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
@@ -15123,17 +15307,17 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join17(tmpdir(), "launchpad-update-"));
+  const dir = mkdtempSync2(join17(tmpdir(), "launchpad-update-"));
   const file = join17(dir, "install.sh");
   try {
-    writeFileSync7(file, script, { mode: 448 });
+    writeFileSync8(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
       const child = spawn5("bash", [file], { stdio: "inherit" });
       child.on("error", () => resolvePromise(127));
       child.on("close", (c) => resolvePromise(c ?? 1));
     });
   } finally {
-    rmSync2(dir, { recursive: true, force: true });
+    rmSync3(dir, { recursive: true, force: true });
   }
 }
 async function runChannelInstaller() {
@@ -15148,7 +15332,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync20(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync21(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -15356,7 +15540,7 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync16, readFileSync as readFileSync21, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -15371,14 +15555,14 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path14 = resolve17(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifestAnyVersion(path14);
+  const path15 = resolve17(process.cwd(), file ?? "launchpad.yaml");
+  const result = loadManifestAnyVersion(path15);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
   const unsupported2 = rejectUnsupportedCliRuntime({
     command: "validate",
-    manifestPath: path14,
+    manifestPath: path15,
     manifest: result.manifest,
     io,
     json,
@@ -15387,8 +15571,8 @@ async function runValidate(args, io) {
   if (unsupported2 !== null)
     return unsupported2;
   const view = manifestView(result.manifest);
-  const boundary = checkBoundary(path14, view.appDeclared);
-  const serveErrors = checkStaticServeDir(path14, result.manifest);
+  const boundary = checkBoundary(path15, view.appDeclared);
+  const serveErrors = checkStaticServeDir(path15, result.manifest);
   if (serveErrors.length > 0) {
     boundary.errors = [...boundary.errors, ...serveErrors];
   }
@@ -15405,7 +15589,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync21(manifestPath, "utf8");
+    manifestYaml = readFileSync22(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -15431,7 +15615,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   }
   const dir = dirname12(manifestPath);
   const abs = resolve17(dir, serveDir);
-  if (!existsSync16(abs)) {
+  if (!existsSync17(abs)) {
     return [
       `static app serves '${serveDir}/' but that directory does not exist — nothing would be served. ` + `Create ${serveDir}/index.html (or run \`launchpad init\` to scaffold it).`
     ];
@@ -15456,7 +15640,7 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app's served directory '${serveDir}/' is empty — the deploy would serve an empty site.`
     ];
   }
-  if (!existsSync16(resolve17(abs, "index.html"))) {
+  if (!existsSync17(resolve17(abs, "index.html"))) {
     return [
       `static app's served directory '${serveDir}/' has no index.html — the deploy would serve a directory with no entrypoint.`
     ];
@@ -16433,10 +16617,10 @@ import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
 import { join as join18 } from "node:path";
 import {
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync22,
-  writeFileSync as writeFileSync8
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync23,
+  writeFileSync as writeFileSync9
 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
@@ -16444,7 +16628,7 @@ var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
 var CACHE_FILE = join18(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync22(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync23(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -16457,23 +16641,23 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
-    writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
+    mkdirSync5(join18(homedir4(), ".launchpad"), { recursive: true });
+    writeFileSync9(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
 var SKILLS_HINT_MARKER = join18(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
-    return existsSync17(SKILLS_HINT_MARKER);
+    return existsSync18(SKILLS_HINT_MARKER);
   } catch {
     return false;
   }
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
-    writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
+    mkdirSync5(join18(homedir4(), ".launchpad"), { recursive: true });
+    writeFileSync9(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
 }
@@ -16576,7 +16760,7 @@ var refreshUpdateCacheCommand = {
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join19 } from "node:path";
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync23, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync24, writeFileSync as writeFileSync10 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -16652,15 +16836,15 @@ async function resolveIdentityReal() {
 }
 function getOrCreateDeviceId() {
   try {
-    const raw = JSON.parse(readFileSync23(DEVICE_ID_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync24(DEVICE_ID_FILE, "utf8"));
     const id2 = raw?.deviceId;
     if (typeof id2 === "string" && id2)
       return id2;
   } catch {}
   const id = randomUUID();
   try {
-    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
-    writeFileSync9(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
+    mkdirSync6(join19(homedir5(), ".launchpad"), { recursive: true });
+    writeFileSync10(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
 `, {
       mode: 384
     });
@@ -16730,15 +16914,15 @@ function telemetryNoticeLine() {
 }
 function firstRunNoticeShown() {
   try {
-    return existsSync18(FIRST_RUN_MARKER);
+    return existsSync19(FIRST_RUN_MARKER);
   } catch {
     return false;
   }
 }
 function markFirstRunNotice() {
   try {
-    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
-    writeFileSync9(FIRST_RUN_MARKER, `${Date.now()}
+    mkdirSync6(join19(homedir5(), ".launchpad"), { recursive: true });
+    writeFileSync10(FIRST_RUN_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
 }
@@ -16803,7 +16987,7 @@ import { createInterface as createInterface7 } from "node:readline/promises";
 import { platform } from "node:os";
 
 // src/report/breadcrumb.ts
-import { writeFileSync as writeFileSync10, readFileSync as readFileSync24, mkdirSync as mkdirSync6 } from "node:fs";
+import { writeFileSync as writeFileSync11, readFileSync as readFileSync25, mkdirSync as mkdirSync7 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join20, dirname as dirname13 } from "node:path";
 function breadcrumbPath() {
@@ -16812,13 +16996,13 @@ function breadcrumbPath() {
 function writeBreadcrumb(verb, exit) {
   try {
     const p = breadcrumbPath();
-    mkdirSync6(dirname13(p), { recursive: true });
-    writeFileSync10(p, JSON.stringify({ verb, exit, ts: Date.now() }), "utf8");
+    mkdirSync7(dirname13(p), { recursive: true });
+    writeFileSync11(p, JSON.stringify({ verb, exit, ts: Date.now() }), "utf8");
   } catch {}
 }
 function readBreadcrumb() {
   try {
-    const raw = JSON.parse(readFileSync24(breadcrumbPath(), "utf8"));
+    const raw = JSON.parse(readFileSync25(breadcrumbPath(), "utf8"));
     if (typeof raw !== "object" || raw === null)
       return null;
     const r = raw;
@@ -16987,6 +17171,7 @@ var COMMANDS = [
   createCommand,
   cloneCommand,
   deployCommand,
+  migrateCommand,
   redeployCommand,
   reviewCommand,
   mergeCommand,

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAstBxC,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA4tBxC,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}

package/dist/commands/migrate.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "../dispatcher.js";
+export declare const migrateCommand: Command;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/commands/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC"}

package/dist/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AA0DA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAOzD,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EA0CtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,EACvC,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CA4BnB;AAuDD,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AA2DA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAOzD,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EA2CtC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,QAAQ,GAAE,SAAS,OAAO,EAAa,EACvC,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CA4BnB;AAuDD,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAyBvE"}

package/dist/http/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/http/api-client.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgB9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA6FnB"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/http/api-client.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgB9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA8FnB"}

package/dist/http/errors.d.ts

@@ -13,7 +13,10 @@ export declare class ForbiddenError extends Error {
 /** 404 — the bot returned not-found. Distinct from UnauthenticatedError
  *  so the CLI doesn't suggest re-login when the slug is just unknown. */
 export declare class NotFoundError extends Error {
+    readonly serverCode?: string | undefined;
     readonly code: "not_found";
+    /** Retain the server's code so registry misses differ from unknown routes. */
+    constructor(message: string, serverCode?: string | undefined);
 }
 /** Stable process exit used only for a server-enforced CLI upgrade. */
 export declare const EXIT_CLI_UPGRADE_REQUIRED = 42;

package/dist/http/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/http/errors.ts"],"names":[],"mappings":"AAIA;;2DAE2D;AAC3D,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;uCAEuC;AACvC,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;CACtC;AAED;yEACyE;AACzE,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;CACtC;AAED,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,gFAAgF;AAChF,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAM3C;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,SAAS,EAAG,WAAW,CAAU;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;gBAE/B,QAAQ,EAAE,uBAAuB;CAgB9C;AAED;2BAC2B;AAC3B,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/http/errors.ts"],"names":[],"mappings":"AAIA;;2DAE2D;AAC3D,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C;AAED;;uCAEuC;AACvC,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;CACtC;AAED;yEACyE;AACzE,qBAAa,aAAc,SAAQ,KAAK;IAIT,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM;IAHzD,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;IAErC,8EAA8E;gBAClE,OAAO,EAAE,MAAM,EAAW,UAAU,CAAC,EAAE,MAAM,YAAA;CAG1D;AAED,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,gFAAgF;AAChF,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAM3C;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,SAAS,EAAG,WAAW,CAAU;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;gBAE/B,QAAQ,EAAE,uBAAuB;CAgB9C;AAED;2BAC2B;AAC3B,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;CAC5C"}

package/dist/manifest/migrate-dispatch.d.ts

@@ -0,0 +1,4 @@
+import { type DeploymentManifest, type ManifestV2 } from "@m-kopa/launchpad-engine";
+/** Convert only the static subset whose deployment contract dispatch preserves. */
+export declare function dispatchManifest(manifest: DeploymentManifest): ManifestV2;
+//# sourceMappingURL=migrate-dispatch.d.ts.map

package/dist/manifest/migrate-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-dispatch.d.ts","sourceRoot":"","sources":["../../src/manifest/migrate-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAElC,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,UAAU,CAkDzE"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.61.1";
+export declare const CLI_VERSION = "0.62.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.61.1",
+  "version": "0.62.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -151,6 +151,14 @@ Gateway placement is automatic for new gateway-fronted apps, including Pages API
 The platform selects the configured gateway with the most free hostname slots, counting pending deployments as reservations.
 Do not ask the author to choose a gateway or add gateway project names to the manifest.
 Existing apps and retries retain their assigned gateway and public URL.
+Updating the CLI does not rewrite an existing Pages manifest.
+If an unprovisioned static or React app hits the Pages project limit, run `launchpad update`, then `launchpad migrate --origin dispatch --dry-run`.
+When eligible, run `launchpad migrate --origin dispatch`, review the preserved audience and build settings, then run `launchpad deploy`.
+The command checks the live registry and saves the original YAML under `.launchpad/manifest-before-dispatch.yaml`.
+Do not regenerate the manifest with `init`, broaden its groups, or change private ownership to work around the quota.
+If migration refuses functions, custom runtime configuration or bindings, stop and explain the named limitation.
+Pages Functions apps need a compiled Worker build; changing `appType` to `react` would not convert their API.
+Do not use this command to migrate a registered app or delete its Pages resources.
 If the pool is full or inventory cannot be read, report the capacity error; do not fall back to Pages or change authentication to bypass it.
 Do not replace that manifest with a v1 example or add `--origin pages` just because an older app uses Pages.
 Use `--origin pages` only when Pages is deliberately required.

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.61.1
+version: 0.62.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->