@m-kopa/launchpad-cli 0.61.1 → 0.63.0

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.61.1";
+var CLI_VERSION = "0.63.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -226,7 +226,12 @@ class ForbiddenError extends Error {
 }
 
 class NotFoundError extends Error {
+  serverCode;
   code = "not_found";
+  constructor(message, serverCode) {
+    super(message);
+    this.serverCode = serverCode;
+  }
 }
 var EXIT_CLI_UPGRADE_REQUIRED = 42;
 
@@ -1148,8 +1153,9 @@ async function apiRaw(cfg, opts, fetcher = fetch) {
     throw recordedFault(new ForbiddenError(`bot returned 403 for ${opts.path}: ${detail}`));
   }
   if (res.status === 404) {
-    const detail = await errorDetail(res, opts.path);
-    throw recordedFault(new NotFoundError(`bot returned 404 for ${opts.path}: ${detail}`));
+    const envelope = await readErrorEnvelope(res, opts.path);
+    const detail = formatErrorEnvelope(envelope);
+    throw recordedFault(new NotFoundError(`bot returned 404 for ${opts.path}: ${detail}`, envelope.code));
   }
   if (!res.ok) {
     if (opts.nonThrowingStatuses?.includes(res.status) === true) {
@@ -1882,8 +1888,8 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync7 } from "node:fs";
-import * as path8 from "node:path";
+import { existsSync as existsSync8 } from "node:fs";
+import * as path9 from "node:path";
 
 // src/bundle/orchestrate.ts
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -2200,8 +2206,14 @@ function deployBundleError(envelope, body) {
     ...typeof body.head_sha === "string" ? { head_sha: body.head_sha } : {},
     ...paths === undefined ? {} : { paths },
     ...typeof body.reason === "string" ? { reason: body.reason } : {},
+    ...readDeployGuidance(body)
+  };
+}
+function readDeployGuidance(body) {
+  return {
     ...typeof body.minimum === "string" ? { minimum: body.minimum } : {},
     ...typeof body.yours === "string" ? { yours: body.yours } : {},
+    ...typeof body.requires_admin_approval === "boolean" ? { requires_admin_approval: body.requires_admin_approval } : {},
     ...typeof body.statusPageUrl === "string" ? { statusPageUrl: body.statusPageUrl } : {}
   };
 }
@@ -6999,7 +7011,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 
 // src/commands/deploy.ts
 import { parse as parseYaml6 } from "yaml";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -8607,6 +8619,211 @@ function rejectUnsupportedCliRuntime(args) {
   return 1;
 }
 
+// src/commands/migrate.ts
+import { closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync2, mkdtempSync, openSync, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import path8 from "node:path";
+import { stringify } from "yaml";
+
+// src/manifest/migrate-dispatch.ts
+function dispatchManifest(manifest) {
+  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
+  const source = v2 ? manifest.spec : manifest;
+  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
+  if (appType !== "static" && appType !== "react") {
+    throw new Error("Only static and React apps can use this converter. Pages Functions (react+api) need a compiled Worker build before switching to dispatch; containers use their own runtime.");
+  }
+  if (source.secrets !== undefined || source.containers !== undefined) {
+    throw new Error("Secret and container bindings cannot be converted automatically.");
+  }
+  if (!v2)
+    assertConvertibleV1(manifest);
+  const spec = v2 ? { ...manifest.spec } : {
+    appType,
+    display: {
+      name: manifest.metadata.name,
+      team: manifest.metadata.team,
+      ...manifest.metadata.description === undefined ? {} : { description: manifest.metadata.description }
+    },
+    owner: { email: manifest.metadata.owner },
+    access: {
+      audience: manifest.access.audience,
+      private_owner: manifest.access.private_owner,
+      allowed_entra_groups: [...allowedEntraGroups(manifest.access)],
+      identity_types: manifest.access.identity_types
+    },
+    build: manifest.build,
+    app: manifest.app,
+    verify: manifest.verify,
+    sensitive: manifest.sensitive,
+    catalogue: manifest.catalogue,
+    ...manifest.production_env === undefined ? {} : {
+      env_vars: Object.fromEntries(Object.entries(manifest.production_env).map(([name, value]) => [name, { type: "plain_text", value }]))
+    }
+  };
+  const candidate = {
+    apiVersion: "launchpad.m-kopa.us/v2",
+    kind: "App",
+    metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
+    spec: { ...spec, origin: "dispatch", auth: "gateway", confine_origin: undefined }
+  };
+  const parsed = parseManifestV2(candidate);
+  if (parsed.kind !== "ok") {
+    throw new Error(`Cannot convert manifest: ${parsed.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
+  }
+  return parsed.manifest;
+}
+function assertConvertibleV1(manifest) {
+  const unsupported2 = [
+    manifest.hostnames !== undefined && "hostnames",
+    manifest.targets !== undefined && "targets",
+    manifest.access.session_duration !== undefined && "access.session_duration",
+    manifest.deployment.runtime !== undefined && "deployment.runtime"
+  ].filter(Boolean);
+  if (unsupported2.length > 0) {
+    throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
+  }
+}
+
+// src/commands/migrate.ts
+var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
+var migrateCommand = {
+  name: "migrate",
+  summary: "convert an unprovisioned static or React app to Workers dispatch",
+  run: runMigrate
+};
+async function runMigrate(args, io) {
+  if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
+    io.out(USAGE);
+    return 0;
+  }
+  const flags = args.filter((arg) => arg !== "--dry-run");
+  if (flags.length !== 2 || flags[0] !== "--origin" || flags[1] !== "dispatch" || args.length > 3) {
+    io.err(USAGE);
+    return 64;
+  }
+  try {
+    const result = await convertToDispatch(process.cwd(), args.includes("--dry-run"));
+    if (result.kind === "already") {
+      io.out("launchpad.yaml already selects Workers dispatch. Run `launchpad deploy`.");
+    } else if (result.kind === "eligible") {
+      io.out(`${result.slug}: eligible for v2 Workers dispatch with gateway authentication. No files changed.`);
+    } else {
+      io.out(`${result.slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
+      io.out(`Audience, owner and application settings are preserved. Original: ${BACKUP_PATH}`);
+      io.out("Run `launchpad deploy`. No Pages project is needed.");
+    }
+    return 0;
+  } catch (error) {
+    io.err(`launchpad migrate: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+var BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+async function convertToDispatch(cwd, dryRun) {
+  const file = path8.join(cwd, "launchpad.yaml");
+  if (!lstatSync4(file).isFile())
+    throw new Error("launchpad.yaml must be a regular file, not a symlink.");
+  const original = readFileSync11(file, "utf8");
+  const loaded = parseManifestAnyVersion(original, file);
+  if (loaded.kind !== "ok")
+    throw new Error("launchpad.yaml is invalid. Run `launchpad validate` and correct it first.");
+  const manifest = loaded.manifest;
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch")
+    return { kind: "already" };
+  const converted = dispatchManifest(manifest);
+  assertNoCustomRuntime(cwd, converted);
+  const slug = converted.metadata.slug;
+  await assertUnregistered(slug);
+  if (dryRun)
+    return { kind: "eligible", slug };
+  try {
+    saveMigration(file, original, converted);
+  } catch (error) {
+    throw new MigrationSaveError(error);
+  }
+  return { kind: "converted", slug };
+}
+async function assertUnregistered(slug) {
+  try {
+    await apiRaw(loadConfig(), { path: `/apps/${encodeURIComponent(slug)}/manifest/state` });
+  } catch (error) {
+    if (error instanceof NotFoundError && error.serverCode === "not_found")
+      return;
+    if (error instanceof UpgradeRequiredError || error instanceof UnauthenticatedError)
+      throw error;
+    throw new RegistryUnavailableError(error);
+  }
+  throw new RegisteredAppError;
+}
+
+class MigrationSaveError extends Error {
+  constructor(cause) {
+    super(`Could not save the converted manifest: ${cause instanceof Error ? cause.message : String(cause)}`);
+  }
+}
+
+class RegistryUnavailableError extends Error {
+  constructor(cause) {
+    super(`Could not confirm whether this app is registered: ${cause instanceof Error ? cause.message : String(cause)}`);
+  }
+}
+
+class RegisteredAppError extends Error {
+  constructor() {
+    super("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
+  }
+}
+function assertNoCustomRuntime(cwd, manifest) {
+  const appRoot = path8.resolve(cwd, manifest.spec.app?.root ?? ".");
+  const buildRoot = path8.resolve(appRoot, manifest.spec.build?.root_dir ?? ".");
+  const roots = new Set([
+    cwd,
+    appRoot,
+    buildRoot,
+    path8.resolve(cwd, manifest.spec.build?.root_dir ?? "."),
+    path8.resolve(buildRoot, manifest.spec.build?.destination_dir ?? "dist")
+  ]);
+  for (const root of roots) {
+    for (const name of ["functions", "_worker.js", "wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
+      if (existsSync7(path8.join(root, name))) {
+        throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker bindings must not be dropped. Ask the platform team to review this app.`);
+      }
+    }
+  }
+}
+function saveMigration(file, original, converted) {
+  if (readFileSync11(file, "utf8") !== original)
+    throw new Error("launchpad.yaml changed during the check. Retry migration.");
+  const backupDir = path8.join(path8.dirname(file), ".launchpad");
+  if (existsSync7(backupDir) && !lstatSync4(backupDir).isDirectory()) {
+    throw new Error(".launchpad must be a regular directory, not a symlink or file.");
+  }
+  mkdirSync2(backupDir, { recursive: true });
+  const backup = path8.join(backupDir, "manifest-before-dispatch.yaml");
+  const attemptDir = mkdtempSync(path8.join(backupDir, "migration-"));
+  let backupCreated = false;
+  try {
+    const fd = openSync(backup, "wx", 384);
+    backupCreated = true;
+    try {
+      writeFileSync2(fd, original);
+    } finally {
+      closeSync(fd);
+    }
+    const temporary = path8.join(attemptDir, "launchpad.yaml");
+    writeFileSync2(temporary, stringify(converted), { flag: "wx", mode: 384 });
+    if (readFileSync11(file, "utf8") !== original)
+      throw new Error("launchpad.yaml changed during migration. Retry migration.");
+    renameSync(temporary, file);
+  } catch (error) {
+    if (backupCreated)
+      rmSync2(backup);
+    throw error;
+  } finally {
+    rmSync2(attemptDir, { recursive: true, force: true });
+  }
+}
+
 // src/commands/deploy.ts
 var deployCommand = {
   name: "deploy",
@@ -8659,8 +8876,8 @@ async function runDeploy(args, io) {
     }, io);
   }
   const cwd = process.cwd();
-  const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync7(manifestPath)) {
+  const manifestPath = path9.join(cwd, "launchpad.yaml");
+  if (existsSync8(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : {
       allowStale: false,
       rebaseOntoHead: false,
@@ -8694,7 +8911,7 @@ async function runDeploy(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad deploy: could not infer slug from cwd (${path8.basename(process.cwd())});
+      io.err(`launchpad deploy: could not infer slug from cwd (${path9.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -8714,10 +8931,10 @@ async function runDeploy(args, io) {
       return 1;
     }
     let contentManifestYaml = null;
-    const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync7(contentManifestPath)) {
+    const contentManifestPath = path9.join(process.cwd(), "launchpad.yaml");
+    if (existsSync8(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync11(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync12(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -8927,8 +9144,8 @@ function surfaceStaleBlock(body, io) {
   const head = body.head_sha ?? null;
   if (body.error === "stale_overlap" && body.paths !== undefined) {
     io.err(`launchpad deploy: BLOCKED — this deploy would roll back ${body.paths.length} file(s) a teammate changed on main since you cloned:`);
-    for (const path9 of body.paths.slice(0, 20)) {
-      io.err(`         - ${path9}`);
+    for (const path10 of body.paths.slice(0, 20)) {
+      io.err(`         - ${path10}`);
     }
     if (body.paths.length > 20) {
       io.err(`         … and ${body.paths.length - 20} more`);
@@ -8961,7 +9178,7 @@ function withTimeout(p, ms) {
 async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
   let localYaml;
   try {
-    localYaml = readFileSync11(manifestPath, "utf8");
+    localYaml = readFileSync12(manifestPath, "utf8");
   } catch {
     return;
   }
@@ -9010,8 +9227,21 @@ async function runModelADeploy(args) {
   let slug;
   let appType = "static";
   let declaredOrigin;
+  let pagesNote;
+  try {
+    pagesNote = await defaultToDispatch(cwd, manifestPath, io);
+  } catch (e) {
+    if (e instanceof UpgradeRequiredError) {
+      io.err(e.message);
+      return EXIT_CLI_UPGRADE_REQUIRED;
+    }
+    io.err(`launchpad deploy: ${describe17(e)}. Nothing was deployed.`);
+    if (e instanceof UnauthenticatedError)
+      io.err("       run `launchpad login` to refresh your session.");
+    return 1;
+  }
   try {
-    const manifestObj = parseYaml6(readFileSync11(manifestPath, "utf8"));
+    const manifestObj = parseYaml6(readFileSync12(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
@@ -9076,6 +9306,11 @@ async function runModelADeploy(args) {
     return 64;
   }
   io.out(`Bundling ${cwd} for ${slug} (Model A) …`);
+  if (declaredOrigin !== "dispatch" && appType !== "container") {
+    io.out("Deployment target: Cloudflare Pages, selected by launchpad.yaml.");
+    if (pagesNote !== null)
+      io.out(pagesNote);
+  }
   let cfg;
   try {
     cfg = loadConfig();
@@ -9160,7 +9395,7 @@ async function runModelADeploy(args) {
       const errorCode = body.error;
       if (errorCode === "audience_confirmation_required") {
         io.err(String(body.message));
-        io.err("Only the human builder may confirm. Retry this deployment after confirmation.");
+        io.err(body.requires_admin_approval === true ? "This sensitive app needs builder confirmation and platform-admin approval. Retry after both are complete." : "The server still requires browser confirmation. Ask the platform team to update it, then retry.");
         return 1;
       }
       if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
@@ -9363,6 +9598,37 @@ async function runModelADeploy(args) {
 function surfaceCommittedHandoff(dispatchOrigin, io, pagesStyle = "unicode") {
   io.out(committedHandoffMessage(dispatchOrigin, pagesStyle));
 }
+function isIneligible(e) {
+  return !(e instanceof RegistryUnavailableError || e instanceof MigrationSaveError || e instanceof UpgradeRequiredError || e instanceof UnauthenticatedError);
+}
+async function defaultToDispatch(cwd, manifestPath, io) {
+  let raw;
+  try {
+    raw = parseYaml6(readFileSync12(manifestPath, "utf8"));
+  } catch {
+    return null;
+  }
+  const isV22 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
+  const appType = isV22 ? raw?.spec?.appType : raw?.deployment?.type;
+  const origin = isV22 ? raw?.spec?.origin : raw?.origin;
+  const auth = isV22 ? raw?.spec?.auth : raw?.auth;
+  if (appType !== "static" && appType !== "react" || origin !== undefined || auth !== "gateway")
+    return null;
+  try {
+    if ((await convertToDispatch(cwd, false)).kind === "converted") {
+      io.out("New apps deploy on Workers dispatch by default, so launchpad.yaml was converted (no Pages project needed).");
+      io.out(`  Audience, owner and build settings are preserved. Original: ${BACKUP_PATH}`);
+      io.out("  To stay on Pages instead, set `spec.origin: pages` and deploy again.");
+    }
+    return null;
+  } catch (e) {
+    if (e instanceof RegisteredAppError)
+      return null;
+    if (!(e instanceof Error) || !isIneligible(e))
+      throw e;
+    return `Not converted to Workers dispatch: ${describe17(e)}`;
+  }
+}
 function declaredOriginOf(isV22, origin) {
   if (!isV22)
     return "pages";
@@ -9397,7 +9663,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync8, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -9475,10 +9741,10 @@ async function runRedeploy(opts, io, deps = {}) {
 }
 function readLocalAppType(cwd, file) {
   const manifestPath = resolvePath2(cwd, file ?? "launchpad.yaml");
-  if (!existsSync8(manifestPath))
+  if (!existsSync9(manifestPath))
     return null;
   try {
-    const obj = parseYaml7(readFileSync12(manifestPath, "utf8"));
+    const obj = parseYaml7(readFileSync13(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -9572,7 +9838,7 @@ function printHelp(io) {
 }
 
 // src/commands/envvars.ts
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var envvarsCommand = {
   name: "envvars",
   summary: "list / set / remove production env vars (slug-scoped)",
@@ -9592,7 +9858,7 @@ async function runEnvvars(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad envvars: could not infer slug from cwd (${path9.basename(process.cwd())});
+      io.err(`launchpad envvars: could not infer slug from cwd (${path10.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -9762,7 +10028,7 @@ function describe18(e) {
 }
 
 // src/commands/generate.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname7, resolve as resolve10, relative as relative4 } from "node:path";
 var generateCommand = {
   name: "generate",
@@ -9812,7 +10078,7 @@ async function runGenerate(args, io) {
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
-function applyOne(artefact, path10, out, force) {
+function applyOne(artefact, path11, out, force) {
   if (out.kind === "not-applicable" || out.kind === "unsupported") {
     return {
       artefact,
@@ -9823,32 +10089,32 @@ function applyOne(artefact, path10, out, force) {
       warnings: []
     };
   }
-  const existing = readIfExists(path10);
+  const existing = readIfExists(path11);
   if (existing.kind === "read-error") {
     return {
       artefact,
-      action: { kind: "write-error", path: path10, message: existing.message },
+      action: { kind: "write-error", path: path11, message: existing.message },
       warnings: out.warnings
     };
   }
   if (existing.kind === "ok" && existing.content === out.content) {
-    return { artefact, action: { kind: "unchanged", path: path10 }, warnings: out.warnings };
+    return { artefact, action: { kind: "unchanged", path: path11 }, warnings: out.warnings };
   }
   if (existing.kind === "ok" && existing.content !== out.content && !force) {
     return {
       artefact,
-      action: { kind: "would-overwrite", path: path10 },
+      action: { kind: "would-overwrite", path: path11 },
       warnings: out.warnings
     };
   }
   try {
-    mkdirSync2(dirname7(path10), { recursive: true });
-    writeFileSync2(path10, out.content, "utf8");
+    mkdirSync3(dirname7(path11), { recursive: true });
+    writeFileSync3(path11, out.content, "utf8");
     return {
       artefact,
       action: {
         kind: "written",
-        path: path10,
+        path: path11,
         bytes: Buffer.byteLength(out.content, "utf8")
       },
       warnings: out.warnings
@@ -9858,16 +10124,16 @@ function applyOne(artefact, path10, out, force) {
       artefact,
       action: {
         kind: "write-error",
-        path: path10,
+        path: path11,
         message: err.message ?? String(err)
       },
       warnings: out.warnings
     };
   }
 }
-function readIfExists(path10) {
+function readIfExists(path11) {
   try {
-    return { kind: "ok", content: readFileSync13(path10, "utf8") };
+    return { kind: "ok", content: readFileSync14(path11, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -10606,17 +10872,17 @@ function describe21(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname8, resolve as resolve11 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14, statSync } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15, statSync } from "node:fs";
 import { join as join13 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync9(join13(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join13(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join13(cwd, n)));
+  const hasPackageJson = existsSync10(join13(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync10(join13(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync10(join13(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -10662,7 +10928,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync9(join13(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync10(join13(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -10685,7 +10951,7 @@ function detectPackageManager(cwd) {
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
     const p = join13(cwd, name);
-    if (existsSync9(p)) {
+    if (existsSync10(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -10697,7 +10963,7 @@ function detectVitePresence(cwd) {
 function detectAppType(cwd) {
   const fnDir = join13(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync9(fnDir)) {
+  if (existsSync10(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -10708,7 +10974,7 @@ function detectAppType(cwd) {
 }
 function detectBuildCommand(cwd, pm) {
   const pkgJsonPath = join13(cwd, "package.json");
-  if (!existsSync9(pkgJsonPath)) {
+  if (!existsSync10(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -10716,7 +10982,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync14(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync15(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10751,7 +11017,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync14(vite.path, "utf8");
+    text = readFileSync15(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10781,7 +11047,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   }
   const { inputs, options } = parsed;
   const outPath = resolve11(process.cwd(), options.out);
-  if (existsSync10(outPath) && !options.force) {
+  if (existsSync11(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -10837,7 +11103,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
     io.out(`Audience: private. Only you (${privateOwner.email}) and platform administrators can open this app.`);
   } else {
     io.out(`Audience: selected Entra groups (${fillResult.inputs.groups.join(", ")}), plus platform administrators.`);
-    io.out("Company-wide grants require your explicit browser confirmation before publishing.");
+    io.out("The deploy skill confirms company-wide grants with you. Sensitive apps also require browser confirmation and platform-admin approval.");
   }
   const manifest = buildManifest({ ...fillResult.inputs, ...privateOwner === undefined ? {} : { privateOwner } }, detected);
   const validation = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? ManifestV2Schema.safeParse(manifest) : ManifestSchema.safeParse(manifest);
@@ -10850,7 +11116,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   }
   const yamlText = renderYaml(manifest);
   try {
-    writeFileSync3(outPath, yamlText, { encoding: "utf8" });
+    writeFileSync4(outPath, yamlText, { encoding: "utf8" });
   } catch (err) {
     const e = err;
     io.err(`launchpad init: failed to write ${outPath}`);
@@ -10876,10 +11142,10 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   if (fillResult.inputs.type === "static") {
     const serveDir = resolve11(dirname8(outPath), STATIC_SERVE_DIR);
     const indexPath = resolve11(serveDir, "index.html");
-    if (!existsSync10(indexPath)) {
+    if (!existsSync11(indexPath)) {
       try {
-        mkdirSync3(serveDir, { recursive: true });
-        writeFileSync3(indexPath, starterIndexHtml(fillResult.inputs.name), {
+        mkdirSync4(serveDir, { recursive: true });
+        writeFileSync4(indexPath, starterIndexHtml(fillResult.inputs.name), {
           encoding: "utf8"
         });
         io.out(`✓ scaffolded ${indexPath}`);
@@ -11298,10 +11564,10 @@ function starterIndexHtml(slug) {
 function renderYaml(manifest) {
   return yamlStringify(manifest, { lineWidth: 0 });
 }
-function ensureGitignoreEntries(path10, entries) {
+function ensureGitignoreEntries(path11, entries) {
   let current = "";
-  if (existsSync10(path10)) {
-    current = readFileSync15(path10, "utf8");
+  if (existsSync11(path11)) {
+    current = readFileSync16(path11, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -11319,7 +11585,7 @@ function ensureGitignoreEntries(path10, entries) {
     }
   }
   if (added.length > 0) {
-    writeFileSync3(path10, out, { encoding: "utf8" });
+    writeFileSync4(path11, out, { encoding: "utf8" });
   }
   return added;
 }
@@ -11491,7 +11757,7 @@ function describe23(e) {
 }
 
 // src/commands/logs.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var logsCommand = {
   name: "logs",
   summary: "show recent Pages deployment history (slug-scoped)",
@@ -11513,7 +11779,7 @@ async function runLogs(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad logs: could not infer slug from cwd (${path10.basename(process.cwd())});
+      io.err(`launchpad logs: could not infer slug from cwd (${path11.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -11641,7 +11907,7 @@ function describe24(e) {
 }
 
 // src/commands/merge.ts
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 var mergeCommand = {
   name: "merge",
   summary: "squash-merge a review-passed PR (slug-scoped)",
@@ -11662,7 +11928,7 @@ async function runMerge(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad merge: could not infer slug from cwd (${path11.basename(process.cwd())});
+      io.err(`launchpad merge: could not infer slug from cwd (${path12.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -12292,18 +12558,18 @@ function describe26(e) {
 }
 
 // src/commands/pull.ts
-import { writeFileSync as writeFileSync4 } from "node:fs";
+import { writeFileSync as writeFileSync5 } from "node:fs";
 import { stringify as stringifyYaml } from "yaml";
 
 // src/deploy/manifest-status.ts
 async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
-  const path12 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
-  return apiJson(cfg, { path: path12 }, fetcher);
+  const path13 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
+  return apiJson(cfg, { path: path13 }, fetcher);
 }
 
 // src/pull/source-sync.ts
 import * as fs6 from "node:fs/promises";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import { constants as fsConstants } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
 import { execFile } from "node:child_process";
@@ -12342,9 +12608,9 @@ async function runSourceSync(args) {
     args.io.out(`Already current at ${compare.headSha.slice(0, 12)}.`);
     return 0;
   }
-  const stageRoot = path12.resolve(args.cwd, MARKER_DIR, `pull-stage-${process.pid}-${crypto.randomUUID()}`);
-  const baseDir = path12.join(stageRoot, "base");
-  const headDir = path12.join(stageRoot, "head");
+  const stageRoot = path13.resolve(args.cwd, MARKER_DIR, `pull-stage-${process.pid}-${crypto.randomUUID()}`);
+  const baseDir = path13.join(stageRoot, "base");
+  const headDir = path13.join(stageRoot, "head");
   await fs6.mkdir(baseDir, { recursive: true });
   await fs6.mkdir(headDir, { recursive: true });
   try {
@@ -12396,7 +12662,7 @@ async function bootstrapProvenance(args) {
     args.io.err("  Preserve this directory and obtain a separate current clone for comparison.");
     return 1;
   }
-  const stageRoot = path12.resolve(args.cwd, MARKER_DIR, `pull-bootstrap-${process.pid}-${crypto.randomUUID()}`);
+  const stageRoot = path13.resolve(args.cwd, MARKER_DIR, `pull-bootstrap-${process.pid}-${crypto.randomUUID()}`);
   await fs6.mkdir(stageRoot, { recursive: true });
   try {
     const headSha = await fetchSnapshotRef(args.cfg, args.slug, "main", stageRoot);
@@ -12422,7 +12688,7 @@ async function treesEqual(cwd, tracked, headDir, headPaths) {
   for (const relative6 of tracked) {
     if (!expected.has(relative6))
       return false;
-    if (!equal(await readEntry(path12.resolve(cwd, relative6)), await readEntry(path12.resolve(headDir, relative6)))) {
+    if (!equal(await readEntry(path13.resolve(cwd, relative6)), await readEntry(path13.resolve(headDir, relative6)))) {
       return false;
     }
   }
@@ -12430,7 +12696,7 @@ async function treesEqual(cwd, tracked, headDir, headPaths) {
 }
 async function listFiles(root, relative6 = "") {
   const files = [];
-  const entries = await fs6.readdir(path12.resolve(root, relative6), {
+  const entries = await fs6.readdir(path13.resolve(root, relative6), {
     withFileTypes: true
   });
   for (const entry of entries) {
@@ -12506,7 +12772,7 @@ async function cleanAncestorRemovals(args) {
     const checked = await checkParents(args.cwd, relative6, removals);
     if (checked.kind === "blocked")
       continue;
-    const base = await readEntry(path12.resolve(args.baseDir, relative6));
+    const base = await readEntry(path13.resolve(args.baseDir, relative6));
     const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
     if (local.kind !== "missing" && cleanLocal(base, local))
       removals.add(relative6);
@@ -12516,9 +12782,9 @@ async function cleanAncestorRemovals(args) {
 async function planPath(args, relative6, removals) {
   assertSafePath(relative6);
   const checked = await checkParents(args.cwd, relative6, removals);
-  const base = await readEntry(path12.resolve(args.baseDir, relative6));
+  const base = await readEntry(path13.resolve(args.baseDir, relative6));
   const upstreamDeleted = args.compare.deleted.includes(relative6);
-  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path12.resolve(args.headDir, relative6));
+  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path13.resolve(args.headDir, relative6));
   const unsupported2 = (args.compare.unsupported ?? []).includes(relative6);
   if (checked.kind === "blocked") {
     return conflictPlan(relative6, checked.target, { kind: "missing" }, head, upstreamDeleted, checked.reason);
@@ -12655,7 +12921,7 @@ async function writeAtomic(cwd, relative6, bytes, mode, allowMetadata = false) {
   if (checked.kind === "blocked")
     throw new Error(checked.reason);
   const file = checked.target;
-  await fs6.mkdir(path12.dirname(file), { recursive: true });
+  await fs6.mkdir(path13.dirname(file), { recursive: true });
   const rechecked = await checkParents(cwd, relative6, new Set, allowMetadata);
   if (rechecked.kind === "blocked")
     throw new Error(rechecked.reason);
@@ -12697,14 +12963,14 @@ function isSafeSourcePath(relative6) {
   return isSafeRelativePath(relative6) && !relative6.startsWith(`${MARKER_DIR}/`);
 }
 function isSafeRelativePath(relative6) {
-  const normalized = path12.posix.normalize(relative6);
-  return relative6.length > 0 && !relative6.includes("\\") && !path12.isAbsolute(relative6) && normalized === relative6 && normalized !== ".." && !normalized.startsWith("../");
+  const normalized = path13.posix.normalize(relative6);
+  return relative6.length > 0 && !relative6.includes("\\") && !path13.isAbsolute(relative6) && normalized === relative6 && normalized !== ".." && !normalized.startsWith("../");
 }
 function resolveInsideClone(cwd, relative6) {
-  const root = path12.resolve(cwd);
-  const target = path12.resolve(root, relative6);
-  const fromRoot = path12.relative(root, target);
-  if (fromRoot.length === 0 || path12.isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${path12.sep}`)) {
+  const root = path13.resolve(cwd);
+  const target = path13.resolve(root, relative6);
+  const fromRoot = path13.relative(root, target);
+  if (fromRoot.length === 0 || path13.isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${path13.sep}`)) {
     throw new Error(`unsafe source path returned by bot: ${relative6}`);
   }
   return target;
@@ -12719,9 +12985,9 @@ async function checkParents(cwd, relative6, projectedRemovals, allowMetadata = f
   }
   const target = resolveInsideClone(cwd, relative6);
   const components = relative6.split("/");
-  let current = path12.resolve(cwd);
+  let current = path13.resolve(cwd);
   for (let index = 0;index < components.length - 1; index += 1) {
-    current = path12.join(current, components[index]);
+    current = path13.join(current, components[index]);
     const ancestor = components.slice(0, index + 1).join("/");
     const stat = await lstatIfPresent(current);
     if (stat === null)
@@ -12747,12 +13013,12 @@ async function checkParents(cwd, relative6, projectedRemovals, allowMetadata = f
   return { kind: "safe", target, projectedMissing: false };
 }
 async function assertSafeCloneRoot(cwd) {
-  const root = await fs6.lstat(path12.resolve(cwd));
+  const root = await fs6.lstat(path13.resolve(cwd));
   if (!root.isDirectory() || root.isSymbolicLink()) {
     throw new Error("launchpad pull requires a real clone directory");
   }
   try {
-    const metadata = await fs6.lstat(path12.resolve(cwd, MARKER_DIR));
+    const metadata = await fs6.lstat(path13.resolve(cwd, MARKER_DIR));
     if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
       throw new Error("launchpad pull refuses a non-directory or symlinked .launchpad path");
     }
@@ -12808,7 +13074,7 @@ async function runPull(args, io) {
       }
       const yaml = stringifyYaml(res.status);
       if (parsed.out !== null) {
-        writeFileSync4(parsed.out, yaml);
+        writeFileSync5(parsed.out, yaml);
         io.err(`launchpad pull: wrote status (${res.role} view) to ${parsed.out}`);
       } else {
         io.out(yaml.replace(/\n$/, ""));
@@ -12829,7 +13095,7 @@ async function runPull(args, io) {
       return 1;
     }
     if (parsed.out !== null) {
-      writeFileSync4(parsed.out, state.manifestYaml);
+      writeFileSync5(parsed.out, state.manifestYaml);
       io.err(`launchpad pull: wrote ${state.manifestYaml.length} bytes to ${parsed.out}`);
     } else {
       io.out(state.manifestYaml.replace(/\n$/, ""));
@@ -13230,7 +13496,7 @@ var watchCommand = {
 };
 
 // src/commands/review.ts
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 var reviewCommand = {
   name: "review",
   summary: "show the review state for a PR (slug-scoped)",
@@ -13250,7 +13516,7 @@ async function runReview(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad review: could not infer slug from cwd (${path13.basename(process.cwd())});
+      io.err(`launchpad review: could not infer slug from cwd (${path14.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -13383,7 +13649,7 @@ function describe28(e) {
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -13485,7 +13751,7 @@ async function runRollback(opts, io, deps = {}) {
     }
   }
   try {
-    writeFileSync5(manifestPath, historicalYaml, "utf8");
+    writeFileSync6(manifestPath, historicalYaml, "utf8");
   } catch (e) {
     io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe29(e)}`);
     return 2;
@@ -13507,16 +13773,16 @@ async function runRollback(opts, io, deps = {}) {
     yes: true
   }, io, applyDeps);
 }
-function readCurrentManifest(path14) {
-  if (!existsSync11(path14))
+function readCurrentManifest(path15) {
+  if (!existsSync12(path15))
     return null;
   let raw;
   try {
-    raw = readFileSync16(path14, "utf8");
+    raw = readFileSync17(path15, "utf8");
   } catch {
     return null;
   }
-  const parsed = parseManifest2(raw, path14);
+  const parsed = parseManifest2(raw, path15);
   if (parsed.kind !== "ok")
     return null;
   return summarise(parsed.manifest);
@@ -13668,7 +13934,7 @@ function parseArgs12(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync18 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as input2, stdout as output2 } from "node:process";
@@ -13729,14 +13995,14 @@ async function runSecretsPush(opts, io, deps = {}) {
     return 0;
   }
   const envPath = resolvePath4(process.cwd(), opts.env ?? ".env");
-  if (!existsSync12(envPath)) {
+  if (!existsSync13(envPath)) {
     io.err(`launchpad secrets push: ${envPath}`);
     io.err("  .env file not found. Run `launchpad secrets template` to scaffold one.");
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync17(envPath, "utf8");
+    envText = readFileSync18(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push: failed to read ${envPath}: ${describe30(e)}`);
     return 2;
@@ -14079,7 +14345,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync13, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync19 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
@@ -14088,23 +14354,23 @@ var CELL_LABEL2 = {
   not_deployed: "NOT_DEPLOYED"
 };
 function loadSet(fleetFile, setName, io) {
-  const path14 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync13(path14)) {
-    io.err(`✗ ${path14}`);
+  const path15 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
+  if (!existsSync14(path15)) {
+    io.err(`✗ ${path15}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml8(readFileSync18(path14, "utf8"));
+    obj = parseYaml8(readFileSync19(path15, "utf8"));
   } catch (e) {
-    io.err(`✗ ${path14}`);
+    io.err(`✗ ${path15}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
   const parsed = parseFleetSecretSets(obj);
   if (!parsed.ok) {
-    io.err(`✗ ${path14}`);
+    io.err(`✗ ${path15}`);
     io.err(`  ${parsed.issues.length} schema issue(s):`);
     for (const i of parsed.issues)
       io.err(`    ${i.path}: ${i.message}`);
@@ -14113,7 +14379,7 @@ function loadSet(fleetFile, setName, io) {
   const set = parsed.manifest.secretSets.find((s) => s.name === setName);
   if (set === undefined) {
     const names = parsed.manifest.secretSets.map((s) => s.name).join(", ");
-    io.err(`✗ secret-set "${setName}" not found in ${path14}`);
+    io.err(`✗ secret-set "${setName}" not found in ${path15}`);
     io.err(`  declared sets: ${names}`);
     return 1;
   }
@@ -14181,14 +14447,14 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   if (typeof set === "number")
     return set;
   const envPath = resolvePath6(process.cwd(), opts.env ?? ".env");
-  if (!existsSync13(envPath)) {
+  if (!existsSync14(envPath)) {
     io.err(`launchpad secrets push --set: ${envPath} not found.`);
     io.err(`  Create a .env carrying the set's secrets: ${set.secrets.join(", ")}`);
     return 2;
   }
   let envText;
   try {
-    envText = readFileSync18(envPath, "utf8");
+    envText = readFileSync19(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -14332,7 +14598,7 @@ function setPushExit(e) {
 }
 
 // src/commands/secrets-template.ts
-import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync15, writeFileSync as writeFileSync7 } from "node:fs";
 import { resolve as resolve14 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
@@ -14356,13 +14622,13 @@ async function runSecretsTemplate(args, io) {
     return 0;
   }
   const outPath = resolve14(process.cwd(), flags.out);
-  if (existsSync14(outPath) && !flags.force) {
+  if (existsSync15(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
     return 64;
   }
   try {
-    writeFileSync6(outPath, body, { encoding: "utf8" });
+    writeFileSync7(outPath, body, { encoding: "utf8" });
   } catch (err) {
     const e = err;
     io.err(`launchpad secrets template: failed to write ${outPath}`);
@@ -14653,12 +14919,12 @@ function printHelp3(io) {
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
 import { dirname as dirname10, join as join16, resolve as resolve15 } from "node:path";
-import { promises as fs7, existsSync as existsSync15 } from "node:fs";
+import { promises as fs7, existsSync as existsSync16 } from "node:fs";
 
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join15 } from "node:path";
-import { readFileSync as readFileSync19, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync20, readdirSync as readdirSync2 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
   return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
@@ -14677,9 +14943,9 @@ function readInstalledSkills() {
     return { present: false, version: null };
   }
 }
-function readSkillVersion(path14) {
+function readSkillVersion(path15) {
   try {
-    const text = readFileSync19(path14, "utf8");
+    const text = readFileSync20(path15, "utf8");
     const fenceEnd = text.indexOf(`
 ---`, 4);
     const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
@@ -14762,7 +15028,7 @@ function defaultBundleDir() {
     resolve15(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync15(join16(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync16(join16(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -14842,10 +15108,10 @@ async function doList(io) {
   }
   return 0;
 }
-async function readVersion(path14) {
+async function readVersion(path15) {
   let text;
   try {
-    text = await fs7.readFile(path14, "utf8");
+    text = await fs7.readFile(path15, "utf8");
   } catch {
     return null;
   }
@@ -14855,9 +15121,9 @@ async function readVersion(path14) {
   const m = /^version:\s*(.+?)\s*$/m.exec(front);
   return m === null ? null : m[1] ?? null;
 }
-async function isDir(path14) {
+async function isDir(path15) {
   try {
-    const stat = await fs7.stat(path14);
+    const stat = await fs7.stat(path15);
     return stat.isDirectory();
   } catch {
     return false;
@@ -14873,7 +15139,7 @@ import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { dirname as dirname11, resolve as resolve16, relative as relative6, isAbsolute as isAbsolute3, join as join17 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync20, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync21, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync8, rmSync as rmSync3 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
@@ -15123,17 +15389,17 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join17(tmpdir(), "launchpad-update-"));
+  const dir = mkdtempSync2(join17(tmpdir(), "launchpad-update-"));
   const file = join17(dir, "install.sh");
   try {
-    writeFileSync7(file, script, { mode: 448 });
+    writeFileSync8(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
       const child = spawn5("bash", [file], { stdio: "inherit" });
       child.on("error", () => resolvePromise(127));
       child.on("close", (c) => resolvePromise(c ?? 1));
     });
   } finally {
-    rmSync2(dir, { recursive: true, force: true });
+    rmSync3(dir, { recursive: true, force: true });
   }
 }
 async function runChannelInstaller() {
@@ -15148,7 +15414,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync20(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync21(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -15356,7 +15622,7 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync16, readFileSync as readFileSync21, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -15371,14 +15637,14 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path14 = resolve17(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifestAnyVersion(path14);
+  const path15 = resolve17(process.cwd(), file ?? "launchpad.yaml");
+  const result = loadManifestAnyVersion(path15);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
   const unsupported2 = rejectUnsupportedCliRuntime({
     command: "validate",
-    manifestPath: path14,
+    manifestPath: path15,
     manifest: result.manifest,
     io,
     json,
@@ -15387,8 +15653,8 @@ async function runValidate(args, io) {
   if (unsupported2 !== null)
     return unsupported2;
   const view = manifestView(result.manifest);
-  const boundary = checkBoundary(path14, view.appDeclared);
-  const serveErrors = checkStaticServeDir(path14, result.manifest);
+  const boundary = checkBoundary(path15, view.appDeclared);
+  const serveErrors = checkStaticServeDir(path15, result.manifest);
   if (serveErrors.length > 0) {
     boundary.errors = [...boundary.errors, ...serveErrors];
   }
@@ -15405,7 +15671,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync21(manifestPath, "utf8");
+    manifestYaml = readFileSync22(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -15431,7 +15697,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   }
   const dir = dirname12(manifestPath);
   const abs = resolve17(dir, serveDir);
-  if (!existsSync16(abs)) {
+  if (!existsSync17(abs)) {
     return [
       `static app serves '${serveDir}/' but that directory does not exist — nothing would be served. ` + `Create ${serveDir}/index.html (or run \`launchpad init\` to scaffold it).`
     ];
@@ -15456,7 +15722,7 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app's served directory '${serveDir}/' is empty — the deploy would serve an empty site.`
     ];
   }
-  if (!existsSync16(resolve17(abs, "index.html"))) {
+  if (!existsSync17(resolve17(abs, "index.html"))) {
     return [
       `static app's served directory '${serveDir}/' has no index.html — the deploy would serve a directory with no entrypoint.`
     ];
@@ -16433,10 +16699,10 @@ import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
 import { join as join18 } from "node:path";
 import {
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync22,
-  writeFileSync as writeFileSync8
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync23,
+  writeFileSync as writeFileSync9
 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
@@ -16444,7 +16710,7 @@ var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
 var CACHE_FILE = join18(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync22(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync23(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -16457,23 +16723,23 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
-    writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
+    mkdirSync5(join18(homedir4(), ".launchpad"), { recursive: true });
+    writeFileSync9(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
 var SKILLS_HINT_MARKER = join18(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
-    return existsSync17(SKILLS_HINT_MARKER);
+    return existsSync18(SKILLS_HINT_MARKER);
   } catch {
     return false;
   }
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync4(join18(homedir4(), ".launchpad"), { recursive: true });
-    writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
+    mkdirSync5(join18(homedir4(), ".launchpad"), { recursive: true });
+    writeFileSync9(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
 }
@@ -16576,7 +16842,7 @@ var refreshUpdateCacheCommand = {
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join19 } from "node:path";
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync23, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync24, writeFileSync as writeFileSync10 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -16652,15 +16918,15 @@ async function resolveIdentityReal() {
 }
 function getOrCreateDeviceId() {
   try {
-    const raw = JSON.parse(readFileSync23(DEVICE_ID_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync24(DEVICE_ID_FILE, "utf8"));
     const id2 = raw?.deviceId;
     if (typeof id2 === "string" && id2)
       return id2;
   } catch {}
   const id = randomUUID();
   try {
-    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
-    writeFileSync9(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
+    mkdirSync6(join19(homedir5(), ".launchpad"), { recursive: true });
+    writeFileSync10(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
 `, {
       mode: 384
     });
@@ -16730,15 +16996,15 @@ function telemetryNoticeLine() {
 }
 function firstRunNoticeShown() {
   try {
-    return existsSync18(FIRST_RUN_MARKER);
+    return existsSync19(FIRST_RUN_MARKER);
   } catch {
     return false;
   }
 }
 function markFirstRunNotice() {
   try {
-    mkdirSync5(join19(homedir5(), ".launchpad"), { recursive: true });
-    writeFileSync9(FIRST_RUN_MARKER, `${Date.now()}
+    mkdirSync6(join19(homedir5(), ".launchpad"), { recursive: true });
+    writeFileSync10(FIRST_RUN_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
 }
@@ -16803,7 +17069,7 @@ import { createInterface as createInterface7 } from "node:readline/promises";
 import { platform } from "node:os";
 
 // src/report/breadcrumb.ts
-import { writeFileSync as writeFileSync10, readFileSync as readFileSync24, mkdirSync as mkdirSync6 } from "node:fs";
+import { writeFileSync as writeFileSync11, readFileSync as readFileSync25, mkdirSync as mkdirSync7 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join20, dirname as dirname13 } from "node:path";
 function breadcrumbPath() {
@@ -16812,13 +17078,13 @@ function breadcrumbPath() {
 function writeBreadcrumb(verb, exit) {
   try {
     const p = breadcrumbPath();
-    mkdirSync6(dirname13(p), { recursive: true });
-    writeFileSync10(p, JSON.stringify({ verb, exit, ts: Date.now() }), "utf8");
+    mkdirSync7(dirname13(p), { recursive: true });
+    writeFileSync11(p, JSON.stringify({ verb, exit, ts: Date.now() }), "utf8");
   } catch {}
 }
 function readBreadcrumb() {
   try {
-    const raw = JSON.parse(readFileSync24(breadcrumbPath(), "utf8"));
+    const raw = JSON.parse(readFileSync25(breadcrumbPath(), "utf8"));
     if (typeof raw !== "object" || raw === null)
       return null;
     const r = raw;
@@ -16987,6 +17253,7 @@ var COMMANDS = [
   createCommand,
   cloneCommand,
   deployCommand,
+  migrateCommand,
   redeployCommand,
   reviewCommand,
   mergeCommand,