@m-kopa/launchpad-cli 0.62.0 → 0.63.0

package/CHANGELOG.md

@@ -8,6 +8,33 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.63.0 - 2026-09-25
+
+### Changed
+
+- Workers dispatch is now the default for every new static and React app, not only ones created with `launchpad init`.
+  A first `launchpad deploy` converts a manifest that only implies Pages (v1, or v2 without `spec.origin`) to v2 dispatch before bundling, with the same checks and backup as `launchpad migrate --origin dispatch`.
+  An explicit `origin: pages` opts out, registered apps keep their origin, and apps that need a runtime review stay on Pages with the reason printed.
+  If the registry cannot confirm the app is new, deploy stops instead of falling back to Pages.
+- The production minimum CLI version rises to 0.63.0 once this release is published.
+
+### Fixed
+
+- Pages API deployments reject duplicate catch-all handlers before committing content.
+  First content uploads replace an unchanged bootstrap API starter when the app supplies its own API catch-all, and content PR deployments no longer recreate removed starters.
+  The authentication guide documents gateway JWKS configuration and recovery for older apps affected by AIO-440.
+- Platform deployments find the existing audience policy for apps whose first deploy omitted their provisioning path.
+  New first-deploy registrations now retain that path.
+  Conflicting or unavailable policies still block publication.
+
+### Changed
+
+- Ordinary all-employees grants are confirmed in the deploy skill conversation, without a browser page or expiring decision ID.
+  Sensitive apps retain builder confirmation and platform-admin approval.
+
+- Raise the production minimum CLI version to 0.62.0 through the governed policy workflow.
+  Older stable clients must run `launchpad update` before platform mutations.
+
 ## 0.62.0 - 2026-09-17
 
 ### Added

package/dist/bundle/upload.d.ts

@@ -97,6 +97,8 @@ export interface DeployBundleProvisioningStarted {
 export type DeployBundleSuccess = DeployBundleAccepted | DeployBundleProvisioningStarted | DeployBundleNothingToDeploy;
 /** Structured error shape from the bot on validation failure. */
 export interface DeployBundleError extends StructuredErrorEnvelope {
+    /** Sensitive grants still require the authenticated approval flow. */
+    readonly requires_admin_approval?: boolean;
     readonly error: string;
     readonly violations?: ReadonlyArray<{
         path: string;

package/dist/bundle/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/bundle/upload.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,eAAO,MAAM,6BAA6B,kCACT,CAAC;AAClC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,WAAW,GACX,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;CAC/B;AAgBD;;;oCAGoC;AACpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;qEAGqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;4CACwC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,+BAA+B,GAC/B,2BAA2B,CAAC;AAEhC,iEAAiE;AACjE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc;AAC/B;gEACgE;AAChE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;AACvB;0EAC0E;AAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;AAC7B,+EAA+E;AAC/E,cAAc,GAAE,OAAe,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA+H7B"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/bundle/upload.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,eAAO,MAAM,6BAA6B,kCACT,CAAC;AAClC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,WAAW,GACX,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;CAC/B;AAgBD;;;oCAGoC;AACpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;qEAGqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;4CACwC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,+BAA+B,GAC/B,2BAA2B,CAAC;AAEhC,iEAAiE;AACjE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,sEAAsE;IACtE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc;AAC/B;gEACgE;AAChE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;AACvB;0EAC0E;AAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;AAC7B,+EAA+E;AAC/E,cAAc,GAAE,OAAe,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA+H7B"}

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.62.0";
+var CLI_VERSION = "0.63.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -1888,8 +1888,8 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync7 } from "node:fs";
-import * as path8 from "node:path";
+import { existsSync as existsSync8 } from "node:fs";
+import * as path9 from "node:path";
 
 // src/bundle/orchestrate.ts
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -2206,8 +2206,14 @@ function deployBundleError(envelope, body) {
     ...typeof body.head_sha === "string" ? { head_sha: body.head_sha } : {},
     ...paths === undefined ? {} : { paths },
     ...typeof body.reason === "string" ? { reason: body.reason } : {},
+    ...readDeployGuidance(body)
+  };
+}
+function readDeployGuidance(body) {
+  return {
     ...typeof body.minimum === "string" ? { minimum: body.minimum } : {},
     ...typeof body.yours === "string" ? { yours: body.yours } : {},
+    ...typeof body.requires_admin_approval === "boolean" ? { requires_admin_approval: body.requires_admin_approval } : {},
     ...typeof body.statusPageUrl === "string" ? { statusPageUrl: body.statusPageUrl } : {}
   };
 }
@@ -7005,7 +7011,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 
 // src/commands/deploy.ts
 import { parse as parseYaml6 } from "yaml";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -8613,6 +8619,211 @@ function rejectUnsupportedCliRuntime(args) {
   return 1;
 }
 
+// src/commands/migrate.ts
+import { closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync2, mkdtempSync, openSync, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import path8 from "node:path";
+import { stringify } from "yaml";
+
+// src/manifest/migrate-dispatch.ts
+function dispatchManifest(manifest) {
+  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
+  const source = v2 ? manifest.spec : manifest;
+  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
+  if (appType !== "static" && appType !== "react") {
+    throw new Error("Only static and React apps can use this converter. Pages Functions (react+api) need a compiled Worker build before switching to dispatch; containers use their own runtime.");
+  }
+  if (source.secrets !== undefined || source.containers !== undefined) {
+    throw new Error("Secret and container bindings cannot be converted automatically.");
+  }
+  if (!v2)
+    assertConvertibleV1(manifest);
+  const spec = v2 ? { ...manifest.spec } : {
+    appType,
+    display: {
+      name: manifest.metadata.name,
+      team: manifest.metadata.team,
+      ...manifest.metadata.description === undefined ? {} : { description: manifest.metadata.description }
+    },
+    owner: { email: manifest.metadata.owner },
+    access: {
+      audience: manifest.access.audience,
+      private_owner: manifest.access.private_owner,
+      allowed_entra_groups: [...allowedEntraGroups(manifest.access)],
+      identity_types: manifest.access.identity_types
+    },
+    build: manifest.build,
+    app: manifest.app,
+    verify: manifest.verify,
+    sensitive: manifest.sensitive,
+    catalogue: manifest.catalogue,
+    ...manifest.production_env === undefined ? {} : {
+      env_vars: Object.fromEntries(Object.entries(manifest.production_env).map(([name, value]) => [name, { type: "plain_text", value }]))
+    }
+  };
+  const candidate = {
+    apiVersion: "launchpad.m-kopa.us/v2",
+    kind: "App",
+    metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
+    spec: { ...spec, origin: "dispatch", auth: "gateway", confine_origin: undefined }
+  };
+  const parsed = parseManifestV2(candidate);
+  if (parsed.kind !== "ok") {
+    throw new Error(`Cannot convert manifest: ${parsed.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
+  }
+  return parsed.manifest;
+}
+function assertConvertibleV1(manifest) {
+  const unsupported2 = [
+    manifest.hostnames !== undefined && "hostnames",
+    manifest.targets !== undefined && "targets",
+    manifest.access.session_duration !== undefined && "access.session_duration",
+    manifest.deployment.runtime !== undefined && "deployment.runtime"
+  ].filter(Boolean);
+  if (unsupported2.length > 0) {
+    throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
+  }
+}
+
+// src/commands/migrate.ts
+var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
+var migrateCommand = {
+  name: "migrate",
+  summary: "convert an unprovisioned static or React app to Workers dispatch",
+  run: runMigrate
+};
+async function runMigrate(args, io) {
+  if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
+    io.out(USAGE);
+    return 0;
+  }
+  const flags = args.filter((arg) => arg !== "--dry-run");
+  if (flags.length !== 2 || flags[0] !== "--origin" || flags[1] !== "dispatch" || args.length > 3) {
+    io.err(USAGE);
+    return 64;
+  }
+  try {
+    const result = await convertToDispatch(process.cwd(), args.includes("--dry-run"));
+    if (result.kind === "already") {
+      io.out("launchpad.yaml already selects Workers dispatch. Run `launchpad deploy`.");
+    } else if (result.kind === "eligible") {
+      io.out(`${result.slug}: eligible for v2 Workers dispatch with gateway authentication. No files changed.`);
+    } else {
+      io.out(`${result.slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
+      io.out(`Audience, owner and application settings are preserved. Original: ${BACKUP_PATH}`);
+      io.out("Run `launchpad deploy`. No Pages project is needed.");
+    }
+    return 0;
+  } catch (error) {
+    io.err(`launchpad migrate: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+var BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+async function convertToDispatch(cwd, dryRun) {
+  const file = path8.join(cwd, "launchpad.yaml");
+  if (!lstatSync4(file).isFile())
+    throw new Error("launchpad.yaml must be a regular file, not a symlink.");
+  const original = readFileSync11(file, "utf8");
+  const loaded = parseManifestAnyVersion(original, file);
+  if (loaded.kind !== "ok")
+    throw new Error("launchpad.yaml is invalid. Run `launchpad validate` and correct it first.");
+  const manifest = loaded.manifest;
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch")
+    return { kind: "already" };
+  const converted = dispatchManifest(manifest);
+  assertNoCustomRuntime(cwd, converted);
+  const slug = converted.metadata.slug;
+  await assertUnregistered(slug);
+  if (dryRun)
+    return { kind: "eligible", slug };
+  try {
+    saveMigration(file, original, converted);
+  } catch (error) {
+    throw new MigrationSaveError(error);
+  }
+  return { kind: "converted", slug };
+}
+async function assertUnregistered(slug) {
+  try {
+    await apiRaw(loadConfig(), { path: `/apps/${encodeURIComponent(slug)}/manifest/state` });
+  } catch (error) {
+    if (error instanceof NotFoundError && error.serverCode === "not_found")
+      return;
+    if (error instanceof UpgradeRequiredError || error instanceof UnauthenticatedError)
+      throw error;
+    throw new RegistryUnavailableError(error);
+  }
+  throw new RegisteredAppError;
+}
+
+class MigrationSaveError extends Error {
+  constructor(cause) {
+    super(`Could not save the converted manifest: ${cause instanceof Error ? cause.message : String(cause)}`);
+  }
+}
+
+class RegistryUnavailableError extends Error {
+  constructor(cause) {
+    super(`Could not confirm whether this app is registered: ${cause instanceof Error ? cause.message : String(cause)}`);
+  }
+}
+
+class RegisteredAppError extends Error {
+  constructor() {
+    super("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
+  }
+}
+function assertNoCustomRuntime(cwd, manifest) {
+  const appRoot = path8.resolve(cwd, manifest.spec.app?.root ?? ".");
+  const buildRoot = path8.resolve(appRoot, manifest.spec.build?.root_dir ?? ".");
+  const roots = new Set([
+    cwd,
+    appRoot,
+    buildRoot,
+    path8.resolve(cwd, manifest.spec.build?.root_dir ?? "."),
+    path8.resolve(buildRoot, manifest.spec.build?.destination_dir ?? "dist")
+  ]);
+  for (const root of roots) {
+    for (const name of ["functions", "_worker.js", "wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
+      if (existsSync7(path8.join(root, name))) {
+        throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker bindings must not be dropped. Ask the platform team to review this app.`);
+      }
+    }
+  }
+}
+function saveMigration(file, original, converted) {
+  if (readFileSync11(file, "utf8") !== original)
+    throw new Error("launchpad.yaml changed during the check. Retry migration.");
+  const backupDir = path8.join(path8.dirname(file), ".launchpad");
+  if (existsSync7(backupDir) && !lstatSync4(backupDir).isDirectory()) {
+    throw new Error(".launchpad must be a regular directory, not a symlink or file.");
+  }
+  mkdirSync2(backupDir, { recursive: true });
+  const backup = path8.join(backupDir, "manifest-before-dispatch.yaml");
+  const attemptDir = mkdtempSync(path8.join(backupDir, "migration-"));
+  let backupCreated = false;
+  try {
+    const fd = openSync(backup, "wx", 384);
+    backupCreated = true;
+    try {
+      writeFileSync2(fd, original);
+    } finally {
+      closeSync(fd);
+    }
+    const temporary = path8.join(attemptDir, "launchpad.yaml");
+    writeFileSync2(temporary, stringify(converted), { flag: "wx", mode: 384 });
+    if (readFileSync11(file, "utf8") !== original)
+      throw new Error("launchpad.yaml changed during migration. Retry migration.");
+    renameSync(temporary, file);
+  } catch (error) {
+    if (backupCreated)
+      rmSync2(backup);
+    throw error;
+  } finally {
+    rmSync2(attemptDir, { recursive: true, force: true });
+  }
+}
+
 // src/commands/deploy.ts
 var deployCommand = {
   name: "deploy",
@@ -8665,8 +8876,8 @@ async function runDeploy(args, io) {
     }, io);
   }
   const cwd = process.cwd();
-  const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync7(manifestPath)) {
+  const manifestPath = path9.join(cwd, "launchpad.yaml");
+  if (existsSync8(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : {
       allowStale: false,
       rebaseOntoHead: false,
@@ -8700,7 +8911,7 @@ async function runDeploy(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad deploy: could not infer slug from cwd (${path8.basename(process.cwd())});
+      io.err(`launchpad deploy: could not infer slug from cwd (${path9.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -8720,10 +8931,10 @@ async function runDeploy(args, io) {
       return 1;
     }
     let contentManifestYaml = null;
-    const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync7(contentManifestPath)) {
+    const contentManifestPath = path9.join(process.cwd(), "launchpad.yaml");
+    if (existsSync8(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync11(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync12(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -8933,8 +9144,8 @@ function surfaceStaleBlock(body, io) {
   const head = body.head_sha ?? null;
   if (body.error === "stale_overlap" && body.paths !== undefined) {
     io.err(`launchpad deploy: BLOCKED — this deploy would roll back ${body.paths.length} file(s) a teammate changed on main since you cloned:`);
-    for (const path9 of body.paths.slice(0, 20)) {
-      io.err(`         - ${path9}`);
+    for (const path10 of body.paths.slice(0, 20)) {
+      io.err(`         - ${path10}`);
     }
     if (body.paths.length > 20) {
       io.err(`         … and ${body.paths.length - 20} more`);
@@ -8967,7 +9178,7 @@ function withTimeout(p, ms) {
 async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
   let localYaml;
   try {
-    localYaml = readFileSync11(manifestPath, "utf8");
+    localYaml = readFileSync12(manifestPath, "utf8");
   } catch {
     return;
   }
@@ -9016,8 +9227,21 @@ async function runModelADeploy(args) {
   let slug;
   let appType = "static";
   let declaredOrigin;
+  let pagesNote;
+  try {
+    pagesNote = await defaultToDispatch(cwd, manifestPath, io);
+  } catch (e) {
+    if (e instanceof UpgradeRequiredError) {
+      io.err(e.message);
+      return EXIT_CLI_UPGRADE_REQUIRED;
+    }
+    io.err(`launchpad deploy: ${describe17(e)}. Nothing was deployed.`);
+    if (e instanceof UnauthenticatedError)
+      io.err("       run `launchpad login` to refresh your session.");
+    return 1;
+  }
   try {
-    const manifestObj = parseYaml6(readFileSync11(manifestPath, "utf8"));
+    const manifestObj = parseYaml6(readFileSync12(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
@@ -9084,9 +9308,8 @@ async function runModelADeploy(args) {
   io.out(`Bundling ${cwd} for ${slug} (Model A) …`);
   if (declaredOrigin !== "dispatch" && appType !== "container") {
     io.out("Deployment target: Cloudflare Pages, selected by launchpad.yaml.");
-    if (appType === "static" || appType === "react") {
-      io.out("For an app that has never provisioned, `launchpad migrate --origin dispatch` checks whether it can use Workers without a Pages project.");
-    }
+    if (pagesNote !== null)
+      io.out(pagesNote);
   }
   let cfg;
   try {
@@ -9172,7 +9395,7 @@ async function runModelADeploy(args) {
       const errorCode = body.error;
       if (errorCode === "audience_confirmation_required") {
         io.err(String(body.message));
-        io.err("Only the human builder may confirm. Retry this deployment after confirmation.");
+        io.err(body.requires_admin_approval === true ? "This sensitive app needs builder confirmation and platform-admin approval. Retry after both are complete." : "The server still requires browser confirmation. Ask the platform team to update it, then retry.");
         return 1;
       }
       if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
@@ -9375,6 +9598,37 @@ async function runModelADeploy(args) {
 function surfaceCommittedHandoff(dispatchOrigin, io, pagesStyle = "unicode") {
   io.out(committedHandoffMessage(dispatchOrigin, pagesStyle));
 }
+function isIneligible(e) {
+  return !(e instanceof RegistryUnavailableError || e instanceof MigrationSaveError || e instanceof UpgradeRequiredError || e instanceof UnauthenticatedError);
+}
+async function defaultToDispatch(cwd, manifestPath, io) {
+  let raw;
+  try {
+    raw = parseYaml6(readFileSync12(manifestPath, "utf8"));
+  } catch {
+    return null;
+  }
+  const isV22 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
+  const appType = isV22 ? raw?.spec?.appType : raw?.deployment?.type;
+  const origin = isV22 ? raw?.spec?.origin : raw?.origin;
+  const auth = isV22 ? raw?.spec?.auth : raw?.auth;
+  if (appType !== "static" && appType !== "react" || origin !== undefined || auth !== "gateway")
+    return null;
+  try {
+    if ((await convertToDispatch(cwd, false)).kind === "converted") {
+      io.out("New apps deploy on Workers dispatch by default, so launchpad.yaml was converted (no Pages project needed).");
+      io.out(`  Audience, owner and build settings are preserved. Original: ${BACKUP_PATH}`);
+      io.out("  To stay on Pages instead, set `spec.origin: pages` and deploy again.");
+    }
+    return null;
+  } catch (e) {
+    if (e instanceof RegisteredAppError)
+      return null;
+    if (!(e instanceof Error) || !isIneligible(e))
+      throw e;
+    return `Not converted to Workers dispatch: ${describe17(e)}`;
+  }
+}
 function declaredOriginOf(isV22, origin) {
   if (!isV22)
     return "pages";
@@ -9409,7 +9663,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync8, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -9487,10 +9741,10 @@ async function runRedeploy(opts, io, deps = {}) {
 }
 function readLocalAppType(cwd, file) {
   const manifestPath = resolvePath2(cwd, file ?? "launchpad.yaml");
-  if (!existsSync8(manifestPath))
+  if (!existsSync9(manifestPath))
     return null;
   try {
-    const obj = parseYaml7(readFileSync12(manifestPath, "utf8"));
+    const obj = parseYaml7(readFileSync13(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -9584,7 +9838,7 @@ function printHelp(io) {
 }
 
 // src/commands/envvars.ts
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var envvarsCommand = {
   name: "envvars",
   summary: "list / set / remove production env vars (slug-scoped)",
@@ -9604,7 +9858,7 @@ async function runEnvvars(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad envvars: could not infer slug from cwd (${path9.basename(process.cwd())});
+      io.err(`launchpad envvars: could not infer slug from cwd (${path10.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -9774,7 +10028,7 @@ function describe18(e) {
 }
 
 // src/commands/generate.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname7, resolve as resolve10, relative as relative4 } from "node:path";
 var generateCommand = {
   name: "generate",
@@ -9824,7 +10078,7 @@ async function runGenerate(args, io) {
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
-function applyOne(artefact, path10, out, force) {
+function applyOne(artefact, path11, out, force) {
   if (out.kind === "not-applicable" || out.kind === "unsupported") {
     return {
       artefact,
@@ -9835,32 +10089,32 @@ function applyOne(artefact, path10, out, force) {
       warnings: []
     };
   }
-  const existing = readIfExists(path10);
+  const existing = readIfExists(path11);
   if (existing.kind === "read-error") {
     return {
       artefact,
-      action: { kind: "write-error", path: path10, message: existing.message },
+      action: { kind: "write-error", path: path11, message: existing.message },
       warnings: out.warnings
     };
   }
   if (existing.kind === "ok" && existing.content === out.content) {
-    return { artefact, action: { kind: "unchanged", path: path10 }, warnings: out.warnings };
+    return { artefact, action: { kind: "unchanged", path: path11 }, warnings: out.warnings };
   }
   if (existing.kind === "ok" && existing.content !== out.content && !force) {
     return {
       artefact,
-      action: { kind: "would-overwrite", path: path10 },
+      action: { kind: "would-overwrite", path: path11 },
       warnings: out.warnings
     };
   }
   try {
-    mkdirSync2(dirname7(path10), { recursive: true });
-    writeFileSync2(path10, out.content, "utf8");
+    mkdirSync3(dirname7(path11), { recursive: true });
+    writeFileSync3(path11, out.content, "utf8");
     return {
       artefact,
       action: {
         kind: "written",
-        path: path10,
+        path: path11,
         bytes: Buffer.byteLength(out.content, "utf8")
       },
       warnings: out.warnings
@@ -9870,16 +10124,16 @@ function applyOne(artefact, path10, out, force) {
       artefact,
       action: {
         kind: "write-error",
-        path: path10,
+        path: path11,
         message: err.message ?? String(err)
       },
       warnings: out.warnings
     };
   }
 }
-function readIfExists(path10) {
+function readIfExists(path11) {
   try {
-    return { kind: "ok", content: readFileSync13(path10, "utf8") };
+    return { kind: "ok", content: readFileSync14(path11, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -10618,17 +10872,17 @@ function describe21(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname8, resolve as resolve11 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14, statSync } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15, statSync } from "node:fs";
 import { join as join13 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync9(join13(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join13(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join13(cwd, n)));
+  const hasPackageJson = existsSync10(join13(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync10(join13(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync10(join13(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -10674,7 +10928,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync9(join13(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync10(join13(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -10697,7 +10951,7 @@ function detectPackageManager(cwd) {
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
     const p = join13(cwd, name);
-    if (existsSync9(p)) {
+    if (existsSync10(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -10709,7 +10963,7 @@ function detectVitePresence(cwd) {
 function detectAppType(cwd) {
   const fnDir = join13(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync9(fnDir)) {
+  if (existsSync10(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -10720,7 +10974,7 @@ function detectAppType(cwd) {
 }
 function detectBuildCommand(cwd, pm) {
   const pkgJsonPath = join13(cwd, "package.json");
-  if (!existsSync9(pkgJsonPath)) {
+  if (!existsSync10(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -10728,7 +10982,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync14(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync15(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10763,7 +11017,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync14(vite.path, "utf8");
+    text = readFileSync15(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10793,7 +11047,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   }
   const { inputs, options } = parsed;
   const outPath = resolve11(process.cwd(), options.out);
-  if (existsSync10(outPath) && !options.force) {
+  if (existsSync11(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -10849,7 +11103,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
     io.out(`Audience: private. Only you (${privateOwner.email}) and platform administrators can open this app.`);
   } else {
     io.out(`Audience: selected Entra groups (${fillResult.inputs.groups.join(", ")}), plus platform administrators.`);
-    io.out("Company-wide grants require your explicit browser confirmation before publishing.");
+    io.out("The deploy skill confirms company-wide grants with you. Sensitive apps also require browser confirmation and platform-admin approval.");
   }
   const manifest = buildManifest({ ...fillResult.inputs, ...privateOwner === undefined ? {} : { privateOwner } }, detected);
   const validation = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? ManifestV2Schema.safeParse(manifest) : ManifestSchema.safeParse(manifest);
@@ -10862,7 +11116,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   }
   const yamlText = renderYaml(manifest);
   try {
-    writeFileSync3(outPath, yamlText, { encoding: "utf8" });
+    writeFileSync4(outPath, yamlText, { encoding: "utf8" });
   } catch (err) {
     const e = err;
     io.err(`launchpad init: failed to write ${outPath}`);
@@ -10888,10 +11142,10 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   if (fillResult.inputs.type === "static") {
     const serveDir = resolve11(dirname8(outPath), STATIC_SERVE_DIR);
     const indexPath = resolve11(serveDir, "index.html");
-    if (!existsSync10(indexPath)) {
+    if (!existsSync11(indexPath)) {
       try {
-        mkdirSync3(serveDir, { recursive: true });
-        writeFileSync3(indexPath, starterIndexHtml(fillResult.inputs.name), {
+        mkdirSync4(serveDir, { recursive: true });
+        writeFileSync4(indexPath, starterIndexHtml(fillResult.inputs.name), {
           encoding: "utf8"
         });
         io.out(`✓ scaffolded ${indexPath}`);
@@ -11310,10 +11564,10 @@ function starterIndexHtml(slug) {
 function renderYaml(manifest) {
   return yamlStringify(manifest, { lineWidth: 0 });
 }
-function ensureGitignoreEntries(path10, entries) {
+function ensureGitignoreEntries(path11, entries) {
   let current = "";
-  if (existsSync10(path10)) {
-    current = readFileSync15(path10, "utf8");
+  if (existsSync11(path11)) {
+    current = readFileSync16(path11, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -11331,7 +11585,7 @@ function ensureGitignoreEntries(path10, entries) {
     }
   }
   if (added.length > 0) {
-    writeFileSync3(path10, out, { encoding: "utf8" });
+    writeFileSync4(path11, out, { encoding: "utf8" });
   }
   return added;
 }
@@ -11503,7 +11757,7 @@ function describe23(e) {
 }
 
 // src/commands/logs.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var logsCommand = {
   name: "logs",
   summary: "show recent Pages deployment history (slug-scoped)",
@@ -11525,7 +11779,7 @@ async function runLogs(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad logs: could not infer slug from cwd (${path10.basename(process.cwd())});
+      io.err(`launchpad logs: could not infer slug from cwd (${path11.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -11653,7 +11907,7 @@ function describe24(e) {
 }
 
 // src/commands/merge.ts
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 var mergeCommand = {
   name: "merge",
   summary: "squash-merge a review-passed PR (slug-scoped)",
@@ -11674,7 +11928,7 @@ async function runMerge(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad merge: could not infer slug from cwd (${path11.basename(process.cwd())});
+      io.err(`launchpad merge: could not infer slug from cwd (${path12.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -11840,178 +12094,6 @@ function describe25(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
-// src/commands/migrate.ts
-import { closeSync, existsSync as existsSync11, lstatSync as lstatSync4, mkdirSync as mkdirSync4, mkdtempSync, openSync, readFileSync as readFileSync16, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import path12 from "node:path";
-import { stringify } from "yaml";
-
-// src/manifest/migrate-dispatch.ts
-function dispatchManifest(manifest) {
-  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
-  const source = v2 ? manifest.spec : manifest;
-  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
-  if (appType !== "static" && appType !== "react") {
-    throw new Error("Only static and React apps can use this converter. Pages Functions (react+api) need a compiled Worker build before switching to dispatch; containers use their own runtime.");
-  }
-  if (source.secrets !== undefined || source.containers !== undefined) {
-    throw new Error("Secret and container bindings cannot be converted automatically.");
-  }
-  if (!v2)
-    assertConvertibleV1(manifest);
-  const spec = v2 ? { ...manifest.spec } : {
-    appType,
-    display: {
-      name: manifest.metadata.name,
-      team: manifest.metadata.team,
-      ...manifest.metadata.description === undefined ? {} : { description: manifest.metadata.description }
-    },
-    owner: { email: manifest.metadata.owner },
-    access: {
-      audience: manifest.access.audience,
-      private_owner: manifest.access.private_owner,
-      allowed_entra_groups: [...allowedEntraGroups(manifest.access)],
-      identity_types: manifest.access.identity_types
-    },
-    build: manifest.build,
-    app: manifest.app,
-    verify: manifest.verify,
-    sensitive: manifest.sensitive,
-    catalogue: manifest.catalogue,
-    ...manifest.production_env === undefined ? {} : {
-      env_vars: Object.fromEntries(Object.entries(manifest.production_env).map(([name, value]) => [name, { type: "plain_text", value }]))
-    }
-  };
-  const candidate = {
-    apiVersion: "launchpad.m-kopa.us/v2",
-    kind: "App",
-    metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
-    spec: { ...spec, origin: "dispatch", auth: "gateway", confine_origin: undefined }
-  };
-  const parsed = parseManifestV2(candidate);
-  if (parsed.kind !== "ok") {
-    throw new Error(`Cannot convert manifest: ${parsed.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
-  }
-  return parsed.manifest;
-}
-function assertConvertibleV1(manifest) {
-  const unsupported2 = [
-    manifest.hostnames !== undefined && "hostnames",
-    manifest.targets !== undefined && "targets",
-    manifest.access.session_duration !== undefined && "access.session_duration",
-    manifest.deployment.runtime !== undefined && "deployment.runtime"
-  ].filter(Boolean);
-  if (unsupported2.length > 0) {
-    throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
-  }
-}
-
-// src/commands/migrate.ts
-var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
-var migrateCommand = {
-  name: "migrate",
-  summary: "convert an unprovisioned static or React app to Workers dispatch",
-  run: runMigrate
-};
-async function runMigrate(args, io) {
-  if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-    io.out(USAGE);
-    return 0;
-  }
-  const flags = args.filter((arg) => arg !== "--dry-run");
-  if (flags.length !== 2 || flags[0] !== "--origin" || flags[1] !== "dispatch" || args.length > 3) {
-    io.err(USAGE);
-    return 64;
-  }
-  const cwd = process.cwd();
-  const file = path12.join(cwd, "launchpad.yaml");
-  try {
-    if (!lstatSync4(file).isFile())
-      throw new Error("launchpad.yaml must be a regular file, not a symlink.");
-    const original = readFileSync16(file, "utf8");
-    const loaded = parseManifestAnyVersion(original, file);
-    if (loaded.kind !== "ok")
-      throw new Error("launchpad.yaml is invalid. Run `launchpad validate` and correct it first.");
-    const manifest = loaded.manifest;
-    if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch") {
-      io.out("launchpad.yaml already selects Workers dispatch. Run `launchpad deploy`.");
-      return 0;
-    }
-    const converted = dispatchManifest(manifest);
-    assertNoCustomRuntime(cwd, converted);
-    const slug = converted.metadata.slug;
-    await assertUnregistered(slug);
-    if (args.includes("--dry-run")) {
-      io.out(`${slug}: eligible for v2 Workers dispatch with gateway authentication. No files changed.`);
-      return 0;
-    }
-    saveMigration(file, original, converted);
-    io.out(`${slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
-    io.out("Audience, owner and application settings are preserved. Original: .launchpad/manifest-before-dispatch.yaml");
-    io.out("Run `launchpad deploy`. No Pages project is needed.");
-    return 0;
-  } catch (error) {
-    io.err(`launchpad migrate: ${error instanceof Error ? error.message : String(error)}`);
-    return 1;
-  }
-}
-async function assertUnregistered(slug) {
-  try {
-    await apiRaw(loadConfig(), { path: `/apps/${encodeURIComponent(slug)}/manifest/state` });
-  } catch (error) {
-    if (error instanceof NotFoundError && error.serverCode === "not_found")
-      return;
-    throw error;
-  }
-  throw new Error("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
-}
-function assertNoCustomRuntime(cwd, manifest) {
-  const appRoot = path12.resolve(cwd, manifest.spec.app?.root ?? ".");
-  const buildRoot = path12.resolve(appRoot, manifest.spec.build?.root_dir ?? ".");
-  const roots = new Set([
-    cwd,
-    appRoot,
-    buildRoot,
-    path12.resolve(cwd, manifest.spec.build?.root_dir ?? "."),
-    path12.resolve(buildRoot, manifest.spec.build?.destination_dir ?? "dist")
-  ]);
-  for (const root of roots) {
-    for (const name of ["functions", "_worker.js", "wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
-      if (existsSync11(path12.join(root, name))) {
-        throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker bindings must not be dropped. Ask the platform team to review this app.`);
-      }
-    }
-  }
-}
-function saveMigration(file, original, converted) {
-  if (readFileSync16(file, "utf8") !== original)
-    throw new Error("launchpad.yaml changed during the check. Retry migration.");
-  const backupDir = path12.join(path12.dirname(file), ".launchpad");
-  mkdirSync4(backupDir, { recursive: true });
-  const backup = path12.join(backupDir, "manifest-before-dispatch.yaml");
-  const attemptDir = mkdtempSync(path12.join(backupDir, "migration-"));
-  let backupCreated = false;
-  try {
-    const fd = openSync(backup, "wx", 384);
-    backupCreated = true;
-    try {
-      writeFileSync4(fd, original);
-    } finally {
-      closeSync(fd);
-    }
-    const temporary = path12.join(attemptDir, "launchpad.yaml");
-    writeFileSync4(temporary, stringify(converted), { flag: "wx", mode: 384 });
-    if (readFileSync16(file, "utf8") !== original)
-      throw new Error("launchpad.yaml changed during migration. Retry migration.");
-    renameSync(temporary, file);
-  } catch (error) {
-    if (backupCreated)
-      rmSync2(backup);
-    throw error;
-  } finally {
-    rmSync2(attemptDir, { recursive: true, force: true });
-  }
-}
-
 // src/commands/plan.ts
 import { resolve as resolve12 } from "node:path";
 var planCommand = {

package/dist/commands/deploy.d.ts

@@ -1,6 +1,6 @@
 import { MAX_COMPRESSED_TARBALL_BYTES } from "../deploy/tar-pack.js";
 import { inferSlugFromCwd, resolveManifestSlug } from "./infer-slug.js";
-import type { Command } from "../dispatcher.js";
+import type { CliIo, Command } from "../dispatcher.js";
 export { inferSlugFromCwd, resolveManifestSlug };
 export declare const deployCommand: Command;
 interface DeployArgs {
@@ -23,6 +23,15 @@ export declare function deployUsage(): string;
 export declare function parseArgs(args: readonly string[]): DeployArgs | null;
 /** Re-export for tests. */
 export { MAX_COMPRESSED_TARBALL_BYTES };
+/**
+ * Workers dispatch is the default for new static and React apps. Before a
+ * first deploy, convert a gateway manifest that only implies Pages (no
+ * `origin` in v1 or v2) to v2 dispatch. An explicit origin is an opt-out and
+ * registered apps keep their origin. Returns a note explaining why the deploy
+ * stays on Pages, or null when there is nothing to say. Throws when
+ * registration cannot be confirmed or the converted manifest cannot be saved.
+ */
+export declare function defaultToDispatch(cwd: string, manifestPath: string, io: CliIo): Promise<string | null>;
 /** Pure wording branch kept exported for the v1 byte-identity contract. */
 /** What the local manifest says the origin is: v1 manifests are always pages;
  *  a v2 manifest defaults to pages; `undefined` means it could not be read. */

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA4tBxC,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA8uBxC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6B5G;AAED,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}

package/dist/commands/migrate.d.ts

@@ -1,3 +1,29 @@
 import type { Command } from "../dispatcher.js";
 export declare const migrateCommand: Command;
+export declare const BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+export type DispatchConversion = {
+    readonly kind: "already";
+} | {
+    readonly kind: "eligible" | "converted";
+    readonly slug: string;
+};
+/**
+ * Convert `<cwd>/launchpad.yaml` to a v2 dispatch manifest, or report that it
+ * would convert (`dryRun`). Throws with a user-facing reason when the app is
+ * registered, the registry cannot be read, or the app has a runtime dispatch
+ * cannot preserve. Shared by `migrate` and first-deploy auto-conversion.
+ */
+export declare function convertToDispatch(cwd: string, dryRun: boolean): Promise<DispatchConversion>;
+/** The app is eligible but the converted manifest or its backup could not be written. */
+export declare class MigrationSaveError extends Error {
+    constructor(cause: unknown);
+}
+/** The registry could not confirm the slug is unregistered, so nothing was converted. */
+export declare class RegistryUnavailableError extends Error {
+    constructor(cause: unknown);
+}
+/** The slug already has an app record; its origin changes only via a planned infrastructure migration. */
+export declare class RegisteredAppError extends Error {
+    constructor();
+}
 //# sourceMappingURL=migrate.d.ts.map

package/dist/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC;AA+BF,eAAO,MAAM,WAAW,6CAA6C,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmBjG;AAcD,yFAAyF;AACzF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAG3B;AAED,yFAAyF;AACzF,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,KAAK;;CAI5C"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.62.0";
+export declare const CLI_VERSION = "0.63.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.62.0",
+  "version": "0.63.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -56,10 +56,11 @@ change — and how do you know it's actually serving.
 Keep the existing audience for ordinary content updates.
 Do not broaden groups to bypass a validation or deployment failure.
 If this update newly grants a company-wide audience, ask: **"Are you sure you want every employee to be able to open this app?"**
-Name the app and groups, explain that any selected group grants access, and give the human the server's confirmation URL.
-Never submit the browser decision on their behalf.
-Wait for their confirmation, then retry the unchanged deployment.
-Sensitive apps also require platform-admin approval.
+Name the app and groups, explain that any selected group grants access, and wait for their explicit answer in this conversation.
+If they decline, stop the grant and keep the existing audience.
+For ordinary apps, continue after they agree; no browser confirmation, decision ID or extra acknowledgement flag is required.
+Sensitive apps retain builder confirmation and platform-admin approval through the server's confirmation URL.
+Never submit that browser decision on their behalf; retry only after the required people complete it.
 Do not review or recertify unchanged existing audiences as part of a routine update.
 Catalogue visibility controls discovery, not access; platform administrators retain entry independently of app groups.
 

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -48,12 +48,16 @@ Never select `S_ALL_Employees`, `S_ALL`, or another broad group to fix a missing
 
 Before requesting a new company-wide grant, ask the human exactly: **"Are you sure you want every employee to be able to open this app?"**
 Name the app and the selected groups, and explain that membership in any selected group grants access.
-A general instruction to deploy, a generic yes flag, and a previous approval for another app or revision do not answer this question.
-When the server returns `audience_confirmation_required`, give the user its confirmation URL and wait for them to complete the browser decision.
-Never open the decision endpoint with automation to approve it, submit its form, or manufacture an acknowledgement for the user.
-Retry the same deployment only after the human confirms completion.
-Sensitive apps also require a platform administrator's approval.
-A changed audience or revision needs a new decision; unchanged existing audiences do not require recertification.
+A general instruction to deploy, a generic yes flag, and a previous approval for another app or audience do not answer this question.
+Wait for the human's explicit answer in this conversation before deploying the company-wide grant.
+If they decline, stop the grant and keep the existing audience.
+For ordinary apps, their answer is the confirmation: continue the deployment without a browser, confirmation ID, token or extra acknowledgement flag.
+The server does not attest to this conversation; do not claim that it enforces the human decision.
+Sensitive apps retain the separate builder-confirmation and platform-admin approval requirement.
+If the server returns `audience_confirmation_required` with `requires_admin_approval: true`, give the human its URL and retry only after the required people complete approval.
+Never submit that browser decision on their behalf.
+If the error does not require admin approval, report that the server needs updating rather than telling the user a browser visit is part of the ordinary flow.
+A changed audience needs an explicit answer for that audience; unchanged existing audiences do not require recertification.
 
 Catalogue listing controls discovery only.
 It neither grants access nor makes an app private.
@@ -151,12 +155,12 @@ Gateway placement is automatic for new gateway-fronted apps, including Pages API
 The platform selects the configured gateway with the most free hostname slots, counting pending deployments as reservations.
 Do not ask the author to choose a gateway or add gateway project names to the manifest.
 Existing apps and retries retain their assigned gateway and public URL.
-Updating the CLI does not rewrite an existing Pages manifest.
-If an unprovisioned static or React app hits the Pages project limit, run `launchpad update`, then `launchpad migrate --origin dispatch --dry-run`.
-When eligible, run `launchpad migrate --origin dispatch`, review the preserved audience and build settings, then run `launchpad deploy`.
-The command checks the live registry and saves the original YAML under `.launchpad/manifest-before-dispatch.yaml`.
+An older manifest that only implies Pages (v1, or v2 without `spec.origin`) is converted to dispatch automatically on the first `launchpad deploy` of an unregistered static or React app.
+Tell the author when deploy reports the conversion, and point them at the backup in `.launchpad/manifest-before-dispatch.yaml`.
+`launchpad migrate --origin dispatch --dry-run` runs the same check without deploying, if the author wants to see it first.
+If deploy prints `Not converted to Workers dispatch`, the deploy continues on Pages; tell the author the reason, and do not delete files or change `appType` to force the conversion.
 Do not regenerate the manifest with `init`, broaden its groups, or change private ownership to work around the quota.
-If migration refuses functions, custom runtime configuration or bindings, stop and explain the named limitation.
+If `launchpad migrate` refuses functions, custom runtime configuration or bindings, explain the named limitation; a normal `launchpad deploy` still works on Pages.
 Pages Functions apps need a compiled Worker build; changing `appType` to `react` would not convert their API.
 Do not use this command to migrate a registered app or delete its Pages resources.
 If the pool is full or inventory cannot be read, report the capacity error; do not fall back to Pages or change authentication to bypass it.

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -220,6 +220,7 @@ The generated v2 manifest preserves the detected build settings and the chosen a
 Use the normal `launchpad deploy` flow; authors do not create Cloudflare projects or choose a gateway.
 The platform assigns new gateway-fronted apps to the configured gateway with the most free hostname slots, including pending reservations.
 Existing apps keep their assigned gateway, URL and access groups.
-React API starters remain on Pages, and existing manifests keep their current origin.
+React API starters remain on Pages and registered apps keep their current origin.
+An older manifest for an unregistered static or React app is converted to dispatch on its first `launchpad deploy`.
 An explicit `--origin pages` is available when required.
 Dispatch secret bindings are not supported yet, so do not promise that `launchpad secrets push` will work for those apps.

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.62.0
+version: 0.63.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->