@m-kopa/launchpad-cli 0.62.0 → 0.64.0

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.62.0";
+var CLI_VERSION = "0.64.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -1888,8 +1888,8 @@ function describe10(e) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync7 } from "node:fs";
-import * as path8 from "node:path";
+import { existsSync as existsSync8 } from "node:fs";
+import * as path9 from "node:path";
 
 // src/bundle/orchestrate.ts
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -2206,8 +2206,14 @@ function deployBundleError(envelope, body) {
     ...typeof body.head_sha === "string" ? { head_sha: body.head_sha } : {},
     ...paths === undefined ? {} : { paths },
     ...typeof body.reason === "string" ? { reason: body.reason } : {},
+    ...readDeployGuidance(body)
+  };
+}
+function readDeployGuidance(body) {
+  return {
     ...typeof body.minimum === "string" ? { minimum: body.minimum } : {},
     ...typeof body.yours === "string" ? { yours: body.yours } : {},
+    ...typeof body.requires_admin_approval === "boolean" ? { requires_admin_approval: body.requires_admin_approval } : {},
     ...typeof body.statusPageUrl === "string" ? { statusPageUrl: body.statusPageUrl } : {}
   };
 }
@@ -3357,7 +3363,10 @@ var SpecSchema = z3.object({
   env_vars: z3.record(z3.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
   containers: z3.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
-  fronted_by_concierge: z3.boolean().optional()
+  fronted_by_concierge: z3.boolean().optional(),
+  bindings: z3.object({
+    d1: z3.string().min(1).max(64).regex(ENV_NAME_REGEX, "bindings.d1 must be an UPPER_SNAKE_CASE binding name").optional()
+  }).strict().optional()
 }).strict().superRefine((s, ctx) => {
   if (s.access.identity_types !== undefined && (s.auth ?? "access") !== "gateway") {
     ctx.addIssue({
@@ -3426,14 +3435,27 @@ var SpecSchema = z3.object({
         message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
       });
     }
-    for (const [name, envVar] of Object.entries(s.env_vars ?? {})) {
-      if (envVar.type === "secret_text") {
-        ctx.addIssue({
-          code: z3.ZodIssueCode.custom,
-          path: ["env_vars", name],
-          message: "secret_text env vars are not supported with origin: dispatch until PS-2740 (secrets on v2) provides their runtime consumer."
-        });
-      }
+  }
+  if (s.bindings?.d1 !== undefined) {
+    if (s.origin !== "dispatch") {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["bindings", "d1"],
+        message: "bindings.d1 requires origin: dispatch. A pages-origin app declares its database with a v1 pages target d1_binding."
+      });
+    } else if (s.appType !== "react+api") {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["bindings", "d1"],
+        message: `bindings.d1 requires appType 'react+api' (current appType: '${s.appType}'); only a react+api app ships the Worker code that can read a database.`
+      });
+    }
+    if (s.env_vars?.[s.bindings.d1] !== undefined) {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["env_vars", s.bindings.d1],
+        message: `env var '${s.bindings.d1}' has the same name as bindings.d1. Rename one of them.`
+      });
     }
   }
   if (!isContainer && s.containers !== undefined) {
@@ -4443,7 +4465,7 @@ function deploymentAuthIssue(appType, auth) {
 function newAppOrigin(appType, requested) {
   if (appType === "container")
     return;
-  return requested ?? (appType === "react+api" ? "pages" : "dispatch");
+  return requested ?? "dispatch";
 }
 // src/bundle/boundary.ts
 var MAX_CONTENT_PROBE_BYTES = 1024 * 1024;
@@ -7005,7 +7027,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 
 // src/commands/deploy.ts
 import { parse as parseYaml6 } from "yaml";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -8613,6 +8635,494 @@ function rejectUnsupportedCliRuntime(args) {
   return 1;
 }
 
+// src/commands/migrate.ts
+import { closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync2, mkdtempSync, openSync, readdirSync as readdirSync2, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import path8 from "node:path";
+import { stringify } from "yaml";
+
+// src/manifest/migrate-dispatch.ts
+var PLATFORM_ENV_NAMES = new Set([
+  "GATEWAY_ISSUER",
+  "GATEWAY_AUD",
+  "GATEWAY_JWKS_URL",
+  "CF_ACCESS_TEAM_DOMAIN",
+  "CF_ACCESS_AUD",
+  "JWKS_URL"
+]);
+function dispatchManifest(manifest, wranglerD1) {
+  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
+  const source = v2 ? manifest.spec : manifest;
+  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
+  if (appType === "container" || source.containers !== undefined) {
+    throw new Error("Containers use their own runtime and cannot convert to dispatch.");
+  }
+  if (!v2)
+    assertConvertibleV1(manifest);
+  const d1 = d1Binding(v2 ? manifest.spec.bindings?.d1 : pagesTargetD1(manifest), wranglerD1);
+  const plainEnv = v2 ? manifest.spec.env_vars : plainTextEnv(manifest.production_env);
+  const envVars = { ...plainEnv, ...secretEnv(source.secrets, plainEnv) };
+  const spec = v2 ? { ...manifest.spec, secrets: undefined } : {
+    appType,
+    display: {
+      name: manifest.metadata.name,
+      team: manifest.metadata.team,
+      ...manifest.metadata.description === undefined ? {} : { description: manifest.metadata.description }
+    },
+    owner: { email: manifest.metadata.owner },
+    access: {
+      audience: manifest.access.audience,
+      private_owner: manifest.access.private_owner,
+      allowed_entra_groups: [...allowedEntraGroups(manifest.access)],
+      identity_types: manifest.access.identity_types
+    },
+    build: manifest.build,
+    app: manifest.app,
+    verify: manifest.verify,
+    sensitive: manifest.sensitive,
+    catalogue: manifest.catalogue
+  };
+  const candidate = {
+    apiVersion: "launchpad.m-kopa.us/v2",
+    kind: "App",
+    metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
+    spec: {
+      ...spec,
+      ...d1 === undefined ? {} : { bindings: { d1 } },
+      env_vars: Object.keys(envVars).length === 0 ? undefined : envVars,
+      origin: "dispatch",
+      auth: "gateway",
+      confine_origin: undefined
+    }
+  };
+  const parsed = parseManifestV2(candidate);
+  if (parsed.kind !== "ok") {
+    throw new Error(`Cannot convert manifest: ${parsed.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
+  }
+  return parsed.manifest;
+}
+function assertConvertibleV1(manifest) {
+  const unsupported2 = [
+    manifest.hostnames !== undefined && "hostnames",
+    manifest.targets !== undefined && pagesTargetD1(manifest) === undefined && "targets",
+    manifest.access.session_duration !== undefined && "access.session_duration",
+    manifest.deployment.runtime !== undefined && "deployment.runtime"
+  ].filter(Boolean);
+  if (unsupported2.length > 0) {
+    throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
+  }
+}
+function d1Binding(declared, wranglerD1) {
+  if (declared !== undefined && wranglerD1 !== undefined && declared !== wranglerD1) {
+    throw new Error(`The manifest binds D1 as ${declared} but the wrangler config binds ${wranglerD1}. Use one name for both.`);
+  }
+  return declared ?? wranglerD1;
+}
+function plainTextEnv(env) {
+  if (env === undefined)
+    return;
+  return Object.fromEntries(Object.entries(env).map(([name, value]) => [name, { type: "plain_text", value }]));
+}
+function secretEnv(secrets, env) {
+  const out = {};
+  for (const binding of secrets?.bindings ?? []) {
+    const refusal = secretRefusal(binding, env);
+    if (refusal !== undefined)
+      throw new Error(`Secret ${binding.name} ${refusal}`);
+    out[binding.name] = { type: "secret_text", secret_ref: binding.name };
+  }
+  return out;
+}
+function secretRefusal(binding, env) {
+  const targets = binding.targets === undefined || binding.targets === "all" ? [] : binding.targets;
+  const checks = [
+    [binding.source !== "env-file", "is platform-managed and cannot be converted automatically. Ask the platform team to migrate it."],
+    [targets.some((target) => target !== "primary"), "targets another surface, which dispatch does not have."],
+    [PLATFORM_ENV_NAMES.has(binding.name), "is set by the platform on dispatch apps. Rename it before converting."],
+    [env?.[binding.name] !== undefined, "is also declared as an environment variable. Keep one."]
+  ];
+  return checks.find(([refused]) => refused)?.[1];
+}
+function pagesTargetD1(manifest) {
+  const [target, ...rest] = manifest.targets ?? [];
+  if (rest.length > 0 || target?.kind !== "pages")
+    return;
+  return target.d1_binding;
+}
+
+// src/manifest/wrangler-config.ts
+var ALLOWED_KEYS = new Set([
+  "name",
+  "compatibility_date",
+  "compatibility_flags",
+  "pages_build_output_dir",
+  "d1_databases"
+]);
+var PLATFORM_FLAGS = new Set(["nodejs_compat"]);
+
+class UnsupportedWranglerConfigError extends Error {
+}
+function wranglerD1Binding(file, text) {
+  const toml = file.endsWith(".toml");
+  const config = toml ? readToml(file, text) : readJsonc(file, text);
+  for (const key of Object.keys(config)) {
+    if (!ALLOWED_KEYS.has(key) && (toml || key !== "$schema"))
+      throw unsupportedKey(file, key);
+  }
+  if (config.compatibility_flags !== undefined) {
+    const extra = asArray(file, "compatibility_flags", config.compatibility_flags).find((flag) => !PLATFORM_FLAGS.has(String(flag)));
+    if (extra !== undefined) {
+      throw new UnsupportedWranglerConfigError(`${file} sets compatibility flag \`${String(extra)}\`; dispatch runs with nodejs_compat only`);
+    }
+  }
+  if (config.d1_databases === undefined)
+    return;
+  const databases = asArray(file, "d1_databases", config.d1_databases);
+  if (databases.length !== 1) {
+    throw new UnsupportedWranglerConfigError(`${file} declares ${databases.length} \`d1_databases\` entries; dispatch binds exactly one D1 database`);
+  }
+  const binding = databases[0]?.binding;
+  if (typeof binding !== "string" || binding === "") {
+    throw new UnsupportedWranglerConfigError(`${file} has a \`d1_databases\` entry without a binding name`);
+  }
+  return binding;
+}
+function unsupportedKey(file, key) {
+  return new UnsupportedWranglerConfigError(`${file} sets \`${key}\`, which dispatch cannot preserve`);
+}
+function asArray(file, key, value) {
+  if (!Array.isArray(value))
+    throw new UnsupportedWranglerConfigError(`${file} sets \`${key}\` to something other than a list`);
+  return value;
+}
+function readJsonc(file, text) {
+  const stripped = stripOutsideStrings(text, '"', (at) => {
+    if (text.startsWith("//", at))
+      return lineEnd(text, at) - at;
+    if (!text.startsWith("/*", at))
+      return 0;
+    const end = text.indexOf("*/", at + 2);
+    return (end === -1 ? text.length : end + 2) - at;
+  }).replace(/,(\s*[}\]])/g, "$1");
+  let parsed;
+  try {
+    parsed = JSON.parse(stripped);
+  } catch {
+    throw new UnsupportedWranglerConfigError(`${file} could not be read as JSON`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new UnsupportedWranglerConfigError(`${file} is not a JSON object`);
+  }
+  return parsed;
+}
+function readToml(file, text) {
+  const config = {};
+  const databases = [];
+  let table = config;
+  for (const line of logicalTomlLines(text)) {
+    if (line.startsWith("[")) {
+      table = d1Table(file, line);
+      databases.push(table);
+    } else {
+      assign(file, table, line, table === config);
+    }
+  }
+  if (databases.length === 0)
+    return config;
+  if (config.d1_databases !== undefined)
+    throw new UnsupportedWranglerConfigError(`${file} declares d1_databases twice`);
+  return { ...config, d1_databases: databases };
+}
+function d1Table(file, line) {
+  const name = /^\[\[?\s*([^\]]*?)\s*\]\]?$/.exec(line)?.[1] ?? line;
+  if (!line.startsWith("[[") || name !== "d1_databases")
+    throw unsupportedKey(file, topKey(name));
+  return {};
+}
+function assign(file, table, line, topLevel) {
+  const assignment = /^([\w\-."]+)\s*=\s*(.*)$/.exec(line);
+  if (assignment === null)
+    throw new UnsupportedWranglerConfigError(`${file} could not be read as TOML near \`${line.slice(0, 40)}\``);
+  const key = topKey(assignment[1]);
+  if (topLevel && assignment[1].includes("."))
+    throw unsupportedKey(file, key);
+  table[key] = tomlValue(assignment[2].trim());
+}
+function topKey(dotted) {
+  return dotted.split(".")[0].replace(/"/g, "").trim();
+}
+function tomlValue(raw) {
+  const quoted = /^"((?:[^"\\]|\\.)*)"$|^'([^']*)'$/.exec(raw);
+  if (quoted !== null)
+    return quoted[1] ?? quoted[2];
+  if (!raw.startsWith("["))
+    return raw;
+  const inner = raw.slice(1, -1);
+  if (inner.includes("{")) {
+    return [...inner.matchAll(/\{([^}]*)\}/g)].map((table) => ({
+      binding: /(?:^|[\s,])binding\s*=\s*["']([^"']*)["']/.exec(table[1])?.[1]
+    }));
+  }
+  return [...inner.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'/g)].map((item) => item[1] ?? item[2]);
+}
+function logicalTomlLines(text) {
+  const stripped = stripOutsideStrings(text, `"'`, (at) => text[at] === "#" ? lineEnd(text, at) - at : 0);
+  const lines = [];
+  let pending = "";
+  for (const raw of stripped.split(/\r?\n/)) {
+    pending = `${pending} ${raw.trim()}`.trim();
+    if (pending === "" || openBrackets(pending) > 0)
+      continue;
+    lines.push(pending);
+    pending = "";
+  }
+  if (pending !== "")
+    lines.push(pending);
+  return lines;
+}
+function lineEnd(text, at) {
+  const end = text.indexOf(`
+`, at);
+  return end === -1 ? text.length : end;
+}
+function openBrackets(line) {
+  if (/^\[\[?[^\]=]*\]\]?$/.test(line))
+    return 0;
+  let open = 0;
+  stripOutsideStrings(line, `"'`, (at) => {
+    if (line[at] === "[" || line[at] === "{")
+      open++;
+    if (line[at] === "]" || line[at] === "}")
+      open--;
+    return 0;
+  });
+  return open;
+}
+function stripOutsideStrings(text, quotes, skip) {
+  let out = "";
+  for (let i = 0;i < text.length; ) {
+    if (quotes.includes(text[i])) {
+      const end = stringEnd(text, i);
+      out += text.slice(i, end);
+      i = end;
+      continue;
+    }
+    const skipped = skip(i);
+    if (skipped === 0)
+      out += text[i];
+    i += Math.max(skipped, 1);
+  }
+  return out;
+}
+function stringEnd(text, start) {
+  const quote = text[start];
+  for (let i = start + 1;i < text.length; i++) {
+    if (text[i] === "\\" && quote === '"')
+      i++;
+    else if (text[i] === quote)
+      return i + 1;
+  }
+  return text.length;
+}
+
+// src/commands/migrate.ts
+var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
+var migrateCommand = {
+  name: "migrate",
+  summary: "convert an unprovisioned static, React or React API app to Workers dispatch",
+  run: runMigrate
+};
+async function runMigrate(args, io) {
+  if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
+    io.out(USAGE);
+    return 0;
+  }
+  const flags = args.filter((arg) => arg !== "--dry-run");
+  if (flags.length !== 2 || flags[0] !== "--origin" || flags[1] !== "dispatch" || args.length > 3) {
+    io.err(USAGE);
+    return 64;
+  }
+  try {
+    const result = await convertToDispatch(process.cwd(), args.includes("--dry-run"));
+    if (result.kind === "already") {
+      io.out("launchpad.yaml already selects Workers dispatch. Run `launchpad deploy`.");
+    } else if (result.kind === "eligible") {
+      io.out(`${result.slug}: eligible for v2 Workers dispatch with gateway authentication. No files changed.`);
+    } else {
+      io.out(`${result.slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
+      io.out(`Audience, owner and application settings are preserved. Original: ${BACKUP_PATH}`);
+      io.out("Run `launchpad deploy`. No Pages project is needed.");
+      const next = secretsNextStep(result.secrets);
+      if (next !== null)
+        io.out(next);
+    }
+    return 0;
+  } catch (error) {
+    io.err(`launchpad migrate: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+var BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+function secretsNextStep(secrets) {
+  if (secrets.length === 0)
+    return null;
+  return `Secrets (${secrets.join(", ")}) carry over as secret_text env vars. Once \`launchpad status\` shows the first deploy delivered, run \`launchpad secrets push\` to set them.`;
+}
+async function convertToDispatch(cwd, dryRun) {
+  const file = path8.join(cwd, "launchpad.yaml");
+  if (!lstatSync4(file).isFile())
+    throw new Error("launchpad.yaml must be a regular file, not a symlink.");
+  const original = readFileSync11(file, "utf8");
+  const loaded = parseManifestAnyVersion(original, file);
+  if (loaded.kind !== "ok")
+    throw new Error("launchpad.yaml is invalid. Run `launchpad validate` and correct it first.");
+  const manifest = loaded.manifest;
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch")
+    return { kind: "already" };
+  const slug = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? manifest.metadata.slug : manifest.metadata.name;
+  let converted;
+  try {
+    converted = convertLocally(cwd, manifest);
+  } catch (error) {
+    await refuseIfRegistered(slug);
+    throw error;
+  }
+  await assertUnregistered(slug);
+  const secrets = Object.entries(converted.spec.env_vars ?? {}).filter(([, value]) => value.type === "secret_text").map(([name]) => name);
+  if (dryRun)
+    return { kind: "eligible", slug, secrets };
+  try {
+    saveMigration(file, original, converted);
+  } catch (error) {
+    throw new MigrationSaveError(error);
+  }
+  return { kind: "converted", slug, secrets };
+}
+function convertLocally(cwd, manifest) {
+  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
+  const spec = v2 ? manifest.spec : manifest;
+  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
+  return dispatchManifest(manifest, inspectRuntime(cwd, appType, spec.app?.root, spec.build));
+}
+async function refuseIfRegistered(slug) {
+  try {
+    await assertUnregistered(slug);
+  } catch (error) {
+    if (error instanceof RegisteredAppError)
+      throw error;
+  }
+}
+async function assertUnregistered(slug) {
+  try {
+    await apiRaw(loadConfig(), { path: `/apps/${encodeURIComponent(slug)}/manifest/state` });
+  } catch (error) {
+    if (error instanceof NotFoundError && error.serverCode === "not_found")
+      return;
+    if (error instanceof UpgradeRequiredError || error instanceof UnauthenticatedError)
+      throw error;
+    throw new RegistryUnavailableError(error);
+  }
+  throw new RegisteredAppError;
+}
+
+class MigrationSaveError extends Error {
+  constructor(cause) {
+    super(`Could not save the converted manifest: ${cause instanceof Error ? cause.message : String(cause)}`);
+  }
+}
+
+class RegistryUnavailableError extends Error {
+  constructor(cause) {
+    super(`Could not confirm whether this app is registered: ${cause instanceof Error ? cause.message : String(cause)}`);
+  }
+}
+
+class RegisteredAppError extends Error {
+  constructor() {
+    super("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
+  }
+}
+var WRANGLER_FILES = ["wrangler.toml", "wrangler.json", "wrangler.jsonc"];
+function inspectRuntime(cwd, appType, appRootDir, build) {
+  const d1 = new Set;
+  for (const root of runtimeRoots(cwd, appRootDir, build)) {
+    assertNoUncompiledCode(root, appType);
+    for (const binding2 of wranglerD1Bindings(cwd, root))
+      d1.add(binding2);
+  }
+  if (d1.size > 1)
+    throw new Error(`The wrangler configs bind D1 under different names (${[...d1].join(", ")}). Use one name.`);
+  const [binding] = d1;
+  if (binding !== undefined && appType !== "react+api") {
+    throw new Error("The wrangler config declares a D1 database, which only react+api apps can use on dispatch.");
+  }
+  return binding;
+}
+function runtimeRoots(cwd, appRootDir, build) {
+  const appRoot = path8.resolve(cwd, appRootDir ?? ".");
+  const buildRoot = path8.resolve(appRoot, build?.root_dir ?? ".");
+  return new Set([
+    cwd,
+    appRoot,
+    buildRoot,
+    path8.resolve(cwd, build?.root_dir ?? "."),
+    path8.resolve(buildRoot, build?.destination_dir ?? "dist")
+  ]);
+}
+function assertNoUncompiledCode(root, appType) {
+  const api = appType === "react+api";
+  for (const name of api ? ["_worker.js"] : ["_worker.js", "functions"]) {
+    if (existsSync7(path8.join(root, name))) {
+      throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker code must not be dropped. Ask the platform team to review this app.`);
+    }
+  }
+  if (api)
+    assertWorkerRoutesFit(root);
+}
+function wranglerD1Bindings(cwd, root) {
+  return WRANGLER_FILES.map((name) => path8.join(root, name)).filter((file) => existsSync7(file)).map((file) => wranglerD1Binding(path8.relative(cwd, file), readFileSync11(file, "utf8"))).filter((binding) => binding !== undefined);
+}
+function assertWorkerRoutesFit(root) {
+  const functions = path8.join(root, "functions");
+  if (!existsSync7(functions) || !lstatSync4(functions).isDirectory())
+    return;
+  const catchAll = readdirSync2(functions).find((name) => /^_middleware\.[cm]?[jt]sx?$/.test(name) || name.startsWith("["));
+  if (catchAll !== undefined) {
+    throw new Error(`functions/${catchAll} would run the Worker for every path, including static assets, which dispatch does not support. Move it under a prefix such as functions/api/.`);
+  }
+}
+function saveMigration(file, original, converted) {
+  if (readFileSync11(file, "utf8") !== original)
+    throw new Error("launchpad.yaml changed during the check. Retry migration.");
+  const backupDir = path8.join(path8.dirname(file), ".launchpad");
+  if (existsSync7(backupDir) && !lstatSync4(backupDir).isDirectory()) {
+    throw new Error(".launchpad must be a regular directory, not a symlink or file.");
+  }
+  mkdirSync2(backupDir, { recursive: true });
+  const backup = path8.join(backupDir, "manifest-before-dispatch.yaml");
+  const attemptDir = mkdtempSync(path8.join(backupDir, "migration-"));
+  let backupCreated = false;
+  try {
+    const fd = openSync(backup, "wx", 384);
+    backupCreated = true;
+    try {
+      writeFileSync2(fd, original);
+    } finally {
+      closeSync(fd);
+    }
+    const temporary = path8.join(attemptDir, "launchpad.yaml");
+    writeFileSync2(temporary, stringify(converted), { flag: "wx", mode: 384 });
+    if (readFileSync11(file, "utf8") !== original)
+      throw new Error("launchpad.yaml changed during migration. Retry migration.");
+    renameSync(temporary, file);
+  } catch (error) {
+    if (backupCreated)
+      rmSync2(backup);
+    throw error;
+  } finally {
+    rmSync2(attemptDir, { recursive: true, force: true });
+  }
+}
+
 // src/commands/deploy.ts
 var deployCommand = {
   name: "deploy",
@@ -8665,8 +9175,8 @@ async function runDeploy(args, io) {
     }, io);
   }
   const cwd = process.cwd();
-  const manifestPath = path8.join(cwd, "launchpad.yaml");
-  if (existsSync7(manifestPath)) {
+  const manifestPath = path9.join(cwd, "launchpad.yaml");
+  if (existsSync8(manifestPath)) {
     const contentMode = flags.mode.kind === "content" ? flags.mode : {
       allowStale: false,
       rebaseOntoHead: false,
@@ -8700,7 +9210,7 @@ async function runDeploy(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad deploy: could not infer slug from cwd (${path8.basename(process.cwd())});
+      io.err(`launchpad deploy: could not infer slug from cwd (${path9.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -8720,10 +9230,10 @@ async function runDeploy(args, io) {
       return 1;
     }
     let contentManifestYaml = null;
-    const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
-    if (existsSync7(contentManifestPath)) {
+    const contentManifestPath = path9.join(process.cwd(), "launchpad.yaml");
+    if (existsSync8(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync11(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync12(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -8933,8 +9443,8 @@ function surfaceStaleBlock(body, io) {
   const head = body.head_sha ?? null;
   if (body.error === "stale_overlap" && body.paths !== undefined) {
     io.err(`launchpad deploy: BLOCKED — this deploy would roll back ${body.paths.length} file(s) a teammate changed on main since you cloned:`);
-    for (const path9 of body.paths.slice(0, 20)) {
-      io.err(`         - ${path9}`);
+    for (const path10 of body.paths.slice(0, 20)) {
+      io.err(`         - ${path10}`);
     }
     if (body.paths.length > 20) {
       io.err(`         … and ${body.paths.length - 20} more`);
@@ -8967,7 +9477,7 @@ function withTimeout(p, ms) {
 async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
   let localYaml;
   try {
-    localYaml = readFileSync11(manifestPath, "utf8");
+    localYaml = readFileSync12(manifestPath, "utf8");
   } catch {
     return;
   }
@@ -9016,8 +9526,21 @@ async function runModelADeploy(args) {
   let slug;
   let appType = "static";
   let declaredOrigin;
+  let pagesNote;
   try {
-    const manifestObj = parseYaml6(readFileSync11(manifestPath, "utf8"));
+    pagesNote = await defaultToDispatch(cwd, manifestPath, io);
+  } catch (e) {
+    if (e instanceof UpgradeRequiredError) {
+      io.err(e.message);
+      return EXIT_CLI_UPGRADE_REQUIRED;
+    }
+    io.err(`launchpad deploy: ${describe17(e)}. Nothing was deployed.`);
+    if (e instanceof UnauthenticatedError)
+      io.err("       run `launchpad login` to refresh your session.");
+    return 1;
+  }
+  try {
+    const manifestObj = parseYaml6(readFileSync12(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
@@ -9084,9 +9607,8 @@ async function runModelADeploy(args) {
   io.out(`Bundling ${cwd} for ${slug} (Model A) …`);
   if (declaredOrigin !== "dispatch" && appType !== "container") {
     io.out("Deployment target: Cloudflare Pages, selected by launchpad.yaml.");
-    if (appType === "static" || appType === "react") {
-      io.out("For an app that has never provisioned, `launchpad migrate --origin dispatch` checks whether it can use Workers without a Pages project.");
-    }
+    if (pagesNote !== null)
+      io.out(pagesNote);
   }
   let cfg;
   try {
@@ -9172,7 +9694,7 @@ async function runModelADeploy(args) {
       const errorCode = body.error;
       if (errorCode === "audience_confirmation_required") {
         io.err(String(body.message));
-        io.err("Only the human builder may confirm. Retry this deployment after confirmation.");
+        io.err(body.requires_admin_approval === true ? "This sensitive app needs builder confirmation and platform-admin approval. Retry after both are complete." : "The server still requires browser confirmation. Ask the platform team to update it, then retry.");
         return 1;
       }
       if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
@@ -9375,6 +9897,49 @@ async function runModelADeploy(args) {
 function surfaceCommittedHandoff(dispatchOrigin, io, pagesStyle = "unicode") {
   io.out(committedHandoffMessage(dispatchOrigin, pagesStyle));
 }
+function isIneligible(e) {
+  return !(e instanceof RegistryUnavailableError || e instanceof MigrationSaveError || e instanceof UpgradeRequiredError || e instanceof UnauthenticatedError);
+}
+async function defaultToDispatch(cwd, manifestPath, io) {
+  if (!impliesPagesForGateway(manifestPath))
+    return null;
+  try {
+    const result = await convertToDispatch(cwd, false);
+    if (result.kind === "converted")
+      reportConversion(io, result.secrets);
+    return null;
+  } catch (e) {
+    if (e instanceof RegisteredAppError)
+      return null;
+    if (!(e instanceof Error) || !isIneligible(e))
+      throw e;
+    return `Not converted to Workers dispatch: ${describe17(e)}`;
+  }
+}
+var CONVERTIBLE_APP_TYPES = new Set(["static", "react", "react+api"]);
+function impliesPagesForGateway(manifestPath) {
+  const fields = originFields(manifestPath);
+  return CONVERTIBLE_APP_TYPES.has(fields.appType) && fields.origin === undefined && fields.auth === "gateway";
+}
+function originFields(manifestPath) {
+  let raw;
+  try {
+    raw = parseYaml6(readFileSync12(manifestPath, "utf8")) ?? {};
+  } catch {
+    return {};
+  }
+  if (raw.apiVersion === "launchpad.m-kopa.us/v2")
+    return raw.spec ?? {};
+  return { origin: raw.origin, auth: raw.auth, appType: raw.deployment?.type };
+}
+function reportConversion(io, secrets) {
+  io.out("New apps deploy on Workers dispatch by default, so launchpad.yaml was converted (no Pages project needed).");
+  io.out(`  Audience, owner and build settings are preserved. Original: ${BACKUP_PATH}`);
+  io.out(`  To stay on Pages instead, restore ${BACKUP_PATH} as launchpad.yaml, set \`origin: pages\` (v1) or \`spec.origin: pages\` (v2) and deploy again.`);
+  const next = secretsNextStep(secrets);
+  if (next !== null)
+    io.out(`  ${next}`);
+}
 function declaredOriginOf(isV22, origin) {
   if (!isV22)
     return "pages";
@@ -9409,7 +9974,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync8, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -9487,10 +10052,10 @@ async function runRedeploy(opts, io, deps = {}) {
 }
 function readLocalAppType(cwd, file) {
   const manifestPath = resolvePath2(cwd, file ?? "launchpad.yaml");
-  if (!existsSync8(manifestPath))
+  if (!existsSync9(manifestPath))
     return null;
   try {
-    const obj = parseYaml7(readFileSync12(manifestPath, "utf8"));
+    const obj = parseYaml7(readFileSync13(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -9584,7 +10149,7 @@ function printHelp(io) {
 }
 
 // src/commands/envvars.ts
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var envvarsCommand = {
   name: "envvars",
   summary: "list / set / remove production env vars (slug-scoped)",
@@ -9604,7 +10169,7 @@ async function runEnvvars(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad envvars: could not infer slug from cwd (${path9.basename(process.cwd())});
+      io.err(`launchpad envvars: could not infer slug from cwd (${path10.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -9774,7 +10339,7 @@ function describe18(e) {
 }
 
 // src/commands/generate.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname7, resolve as resolve10, relative as relative4 } from "node:path";
 var generateCommand = {
   name: "generate",
@@ -9824,7 +10389,7 @@ async function runGenerate(args, io) {
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
-function applyOne(artefact, path10, out, force) {
+function applyOne(artefact, path11, out, force) {
   if (out.kind === "not-applicable" || out.kind === "unsupported") {
     return {
       artefact,
@@ -9835,32 +10400,32 @@ function applyOne(artefact, path10, out, force) {
       warnings: []
     };
   }
-  const existing = readIfExists(path10);
+  const existing = readIfExists(path11);
   if (existing.kind === "read-error") {
     return {
       artefact,
-      action: { kind: "write-error", path: path10, message: existing.message },
+      action: { kind: "write-error", path: path11, message: existing.message },
       warnings: out.warnings
     };
   }
   if (existing.kind === "ok" && existing.content === out.content) {
-    return { artefact, action: { kind: "unchanged", path: path10 }, warnings: out.warnings };
+    return { artefact, action: { kind: "unchanged", path: path11 }, warnings: out.warnings };
   }
   if (existing.kind === "ok" && existing.content !== out.content && !force) {
     return {
       artefact,
-      action: { kind: "would-overwrite", path: path10 },
+      action: { kind: "would-overwrite", path: path11 },
       warnings: out.warnings
     };
   }
   try {
-    mkdirSync2(dirname7(path10), { recursive: true });
-    writeFileSync2(path10, out.content, "utf8");
+    mkdirSync3(dirname7(path11), { recursive: true });
+    writeFileSync3(path11, out.content, "utf8");
     return {
       artefact,
       action: {
         kind: "written",
-        path: path10,
+        path: path11,
         bytes: Buffer.byteLength(out.content, "utf8")
       },
       warnings: out.warnings
@@ -9870,16 +10435,16 @@ function applyOne(artefact, path10, out, force) {
       artefact,
       action: {
         kind: "write-error",
-        path: path10,
+        path: path11,
         message: err.message ?? String(err)
       },
       warnings: out.warnings
     };
   }
 }
-function readIfExists(path10) {
+function readIfExists(path11) {
   try {
-    return { kind: "ok", content: readFileSync13(path10, "utf8") };
+    return { kind: "ok", content: readFileSync14(path11, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -10618,17 +11183,17 @@ function describe21(e) {
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname8, resolve as resolve11 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14, statSync } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15, statSync } from "node:fs";
 import { join as join13 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync9(join13(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync9(join13(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync9(join13(cwd, n)));
+  const hasPackageJson = existsSync10(join13(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync10(join13(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync10(join13(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -10674,7 +11239,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync9(join13(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync10(join13(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -10697,7 +11262,7 @@ function detectPackageManager(cwd) {
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
     const p = join13(cwd, name);
-    if (existsSync9(p)) {
+    if (existsSync10(p)) {
       return { kind: "ok", value: { path: p } };
     }
   }
@@ -10709,7 +11274,7 @@ function detectVitePresence(cwd) {
 function detectAppType(cwd) {
   const fnDir = join13(cwd, "functions");
   let hasFunctionsDir = false;
-  if (existsSync9(fnDir)) {
+  if (existsSync10(fnDir)) {
     try {
       hasFunctionsDir = statSync(fnDir).isDirectory();
     } catch {
@@ -10720,7 +11285,7 @@ function detectAppType(cwd) {
 }
 function detectBuildCommand(cwd, pm) {
   const pkgJsonPath = join13(cwd, "package.json");
-  if (!existsSync9(pkgJsonPath)) {
+  if (!existsSync10(pkgJsonPath)) {
     return {
       kind: "ambiguous",
       reason: "no package.json at repo root. Run your package manager's `init` first."
@@ -10728,7 +11293,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync14(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync15(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10763,7 +11328,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync14(vite.path, "utf8");
+    text = readFileSync15(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10793,7 +11358,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   }
   const { inputs, options } = parsed;
   const outPath = resolve11(process.cwd(), options.out);
-  if (existsSync10(outPath) && !options.force) {
+  if (existsSync11(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
     return 64;
@@ -10830,10 +11395,6 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
     return 64;
   }
   const dispatch = newAppOrigin(fillResult.inputs.type, inputs.origin) === "dispatch";
-  if (dispatch && fillResult.inputs.type === "react+api") {
-    io.err("launchpad init: API starter dispatch is not available yet; use --origin pages");
-    return 64;
-  }
   if (dispatch && (inputs.hostnames.length > 0 || inputs.sessionDuration !== undefined)) {
     io.err("launchpad init: dispatch does not support --hostname or --session-duration; use --origin pages for a Pages manifest");
     return 64;
@@ -10849,7 +11410,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
     io.out(`Audience: private. Only you (${privateOwner.email}) and platform administrators can open this app.`);
   } else {
     io.out(`Audience: selected Entra groups (${fillResult.inputs.groups.join(", ")}), plus platform administrators.`);
-    io.out("Company-wide grants require your explicit browser confirmation before publishing.");
+    io.out("The deploy skill confirms company-wide grants with you. Sensitive apps also require browser confirmation and platform-admin approval.");
   }
   const manifest = buildManifest({ ...fillResult.inputs, ...privateOwner === undefined ? {} : { privateOwner } }, detected);
   const validation = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? ManifestV2Schema.safeParse(manifest) : ManifestSchema.safeParse(manifest);
@@ -10862,7 +11423,7 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   }
   const yamlText = renderYaml(manifest);
   try {
-    writeFileSync3(outPath, yamlText, { encoding: "utf8" });
+    writeFileSync4(outPath, yamlText, { encoding: "utf8" });
   } catch (err) {
     const e = err;
     io.err(`launchpad init: failed to write ${outPath}`);
@@ -10888,10 +11449,10 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   if (fillResult.inputs.type === "static") {
     const serveDir = resolve11(dirname8(outPath), STATIC_SERVE_DIR);
     const indexPath = resolve11(serveDir, "index.html");
-    if (!existsSync10(indexPath)) {
+    if (!existsSync11(indexPath)) {
       try {
-        mkdirSync3(serveDir, { recursive: true });
-        writeFileSync3(indexPath, starterIndexHtml(fillResult.inputs.name), {
+        mkdirSync4(serveDir, { recursive: true });
+        writeFileSync4(indexPath, starterIndexHtml(fillResult.inputs.name), {
           encoding: "utf8"
         });
         io.out(`✓ scaffolded ${indexPath}`);
@@ -10905,11 +11466,10 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   io.out("");
   io.out("Next steps:");
   io.out("  launchpad validate                # confirm the manifest");
-  if (!dispatch)
-    io.out("  launchpad secrets template        # scaffold .env.example");
+  io.out("  launchpad secrets template        # scaffold .env.example");
   io.out("  launchpad deploy                  # build and deploy the app");
   if (dispatch)
-    io.out("  Dispatch currently supports plain-text environment variables, but not secret bindings.");
+    io.out("  Push secrets with `launchpad secrets push` once the first deploy has been delivered.");
   return 0;
 }
 function parseArgs6(args) {
@@ -10961,11 +11521,11 @@ function parseArgs6(args) {
       i++;
       return next;
     };
-    const setFromNext = (assign) => {
+    const setFromNext = (assign2) => {
       const got = needsValue();
       if (typeof got !== "string")
         return got;
-      assign(got);
+      assign2(got);
       return;
     };
     if (a === "--name") {
@@ -11310,10 +11870,10 @@ function starterIndexHtml(slug) {
 function renderYaml(manifest) {
   return yamlStringify(manifest, { lineWidth: 0 });
 }
-function ensureGitignoreEntries(path10, entries) {
+function ensureGitignoreEntries(path11, entries) {
   let current = "";
-  if (existsSync10(path10)) {
-    current = readFileSync15(path10, "utf8");
+  if (existsSync11(path11)) {
+    current = readFileSync16(path11, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -11331,7 +11891,7 @@ function ensureGitignoreEntries(path10, entries) {
     }
   }
   if (added.length > 0) {
-    writeFileSync3(path10, out, { encoding: "utf8" });
+    writeFileSync4(path11, out, { encoding: "utf8" });
   }
   return added;
 }
@@ -11503,7 +12063,7 @@ function describe23(e) {
 }
 
 // src/commands/logs.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var logsCommand = {
   name: "logs",
   summary: "show recent Pages deployment history (slug-scoped)",
@@ -11525,7 +12085,7 @@ async function runLogs(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad logs: could not infer slug from cwd (${path10.basename(process.cwd())});
+      io.err(`launchpad logs: could not infer slug from cwd (${path11.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -11653,7 +12213,7 @@ function describe24(e) {
 }
 
 // src/commands/merge.ts
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 var mergeCommand = {
   name: "merge",
   summary: "squash-merge a review-passed PR (slug-scoped)",
@@ -11674,7 +12234,7 @@ async function runMerge(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad merge: could not infer slug from cwd (${path11.basename(process.cwd())});
+      io.err(`launchpad merge: could not infer slug from cwd (${path12.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -11840,178 +12400,6 @@ function describe25(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
-// src/commands/migrate.ts
-import { closeSync, existsSync as existsSync11, lstatSync as lstatSync4, mkdirSync as mkdirSync4, mkdtempSync, openSync, readFileSync as readFileSync16, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import path12 from "node:path";
-import { stringify } from "yaml";
-
-// src/manifest/migrate-dispatch.ts
-function dispatchManifest(manifest) {
-  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
-  const source = v2 ? manifest.spec : manifest;
-  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
-  if (appType !== "static" && appType !== "react") {
-    throw new Error("Only static and React apps can use this converter. Pages Functions (react+api) need a compiled Worker build before switching to dispatch; containers use their own runtime.");
-  }
-  if (source.secrets !== undefined || source.containers !== undefined) {
-    throw new Error("Secret and container bindings cannot be converted automatically.");
-  }
-  if (!v2)
-    assertConvertibleV1(manifest);
-  const spec = v2 ? { ...manifest.spec } : {
-    appType,
-    display: {
-      name: manifest.metadata.name,
-      team: manifest.metadata.team,
-      ...manifest.metadata.description === undefined ? {} : { description: manifest.metadata.description }
-    },
-    owner: { email: manifest.metadata.owner },
-    access: {
-      audience: manifest.access.audience,
-      private_owner: manifest.access.private_owner,
-      allowed_entra_groups: [...allowedEntraGroups(manifest.access)],
-      identity_types: manifest.access.identity_types
-    },
-    build: manifest.build,
-    app: manifest.app,
-    verify: manifest.verify,
-    sensitive: manifest.sensitive,
-    catalogue: manifest.catalogue,
-    ...manifest.production_env === undefined ? {} : {
-      env_vars: Object.fromEntries(Object.entries(manifest.production_env).map(([name, value]) => [name, { type: "plain_text", value }]))
-    }
-  };
-  const candidate = {
-    apiVersion: "launchpad.m-kopa.us/v2",
-    kind: "App",
-    metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
-    spec: { ...spec, origin: "dispatch", auth: "gateway", confine_origin: undefined }
-  };
-  const parsed = parseManifestV2(candidate);
-  if (parsed.kind !== "ok") {
-    throw new Error(`Cannot convert manifest: ${parsed.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
-  }
-  return parsed.manifest;
-}
-function assertConvertibleV1(manifest) {
-  const unsupported2 = [
-    manifest.hostnames !== undefined && "hostnames",
-    manifest.targets !== undefined && "targets",
-    manifest.access.session_duration !== undefined && "access.session_duration",
-    manifest.deployment.runtime !== undefined && "deployment.runtime"
-  ].filter(Boolean);
-  if (unsupported2.length > 0) {
-    throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
-  }
-}
-
-// src/commands/migrate.ts
-var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
-var migrateCommand = {
-  name: "migrate",
-  summary: "convert an unprovisioned static or React app to Workers dispatch",
-  run: runMigrate
-};
-async function runMigrate(args, io) {
-  if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-    io.out(USAGE);
-    return 0;
-  }
-  const flags = args.filter((arg) => arg !== "--dry-run");
-  if (flags.length !== 2 || flags[0] !== "--origin" || flags[1] !== "dispatch" || args.length > 3) {
-    io.err(USAGE);
-    return 64;
-  }
-  const cwd = process.cwd();
-  const file = path12.join(cwd, "launchpad.yaml");
-  try {
-    if (!lstatSync4(file).isFile())
-      throw new Error("launchpad.yaml must be a regular file, not a symlink.");
-    const original = readFileSync16(file, "utf8");
-    const loaded = parseManifestAnyVersion(original, file);
-    if (loaded.kind !== "ok")
-      throw new Error("launchpad.yaml is invalid. Run `launchpad validate` and correct it first.");
-    const manifest = loaded.manifest;
-    if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch") {
-      io.out("launchpad.yaml already selects Workers dispatch. Run `launchpad deploy`.");
-      return 0;
-    }
-    const converted = dispatchManifest(manifest);
-    assertNoCustomRuntime(cwd, converted);
-    const slug = converted.metadata.slug;
-    await assertUnregistered(slug);
-    if (args.includes("--dry-run")) {
-      io.out(`${slug}: eligible for v2 Workers dispatch with gateway authentication. No files changed.`);
-      return 0;
-    }
-    saveMigration(file, original, converted);
-    io.out(`${slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
-    io.out("Audience, owner and application settings are preserved. Original: .launchpad/manifest-before-dispatch.yaml");
-    io.out("Run `launchpad deploy`. No Pages project is needed.");
-    return 0;
-  } catch (error) {
-    io.err(`launchpad migrate: ${error instanceof Error ? error.message : String(error)}`);
-    return 1;
-  }
-}
-async function assertUnregistered(slug) {
-  try {
-    await apiRaw(loadConfig(), { path: `/apps/${encodeURIComponent(slug)}/manifest/state` });
-  } catch (error) {
-    if (error instanceof NotFoundError && error.serverCode === "not_found")
-      return;
-    throw error;
-  }
-  throw new Error("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
-}
-function assertNoCustomRuntime(cwd, manifest) {
-  const appRoot = path12.resolve(cwd, manifest.spec.app?.root ?? ".");
-  const buildRoot = path12.resolve(appRoot, manifest.spec.build?.root_dir ?? ".");
-  const roots = new Set([
-    cwd,
-    appRoot,
-    buildRoot,
-    path12.resolve(cwd, manifest.spec.build?.root_dir ?? "."),
-    path12.resolve(buildRoot, manifest.spec.build?.destination_dir ?? "dist")
-  ]);
-  for (const root of roots) {
-    for (const name of ["functions", "_worker.js", "wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
-      if (existsSync11(path12.join(root, name))) {
-        throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker bindings must not be dropped. Ask the platform team to review this app.`);
-      }
-    }
-  }
-}
-function saveMigration(file, original, converted) {
-  if (readFileSync16(file, "utf8") !== original)
-    throw new Error("launchpad.yaml changed during the check. Retry migration.");
-  const backupDir = path12.join(path12.dirname(file), ".launchpad");
-  mkdirSync4(backupDir, { recursive: true });
-  const backup = path12.join(backupDir, "manifest-before-dispatch.yaml");
-  const attemptDir = mkdtempSync(path12.join(backupDir, "migration-"));
-  let backupCreated = false;
-  try {
-    const fd = openSync(backup, "wx", 384);
-    backupCreated = true;
-    try {
-      writeFileSync4(fd, original);
-    } finally {
-      closeSync(fd);
-    }
-    const temporary = path12.join(attemptDir, "launchpad.yaml");
-    writeFileSync4(temporary, stringify(converted), { flag: "wx", mode: 384 });
-    if (readFileSync16(file, "utf8") !== original)
-      throw new Error("launchpad.yaml changed during migration. Retry migration.");
-    renameSync(temporary, file);
-  } catch (error) {
-    if (backupCreated)
-      rmSync2(backup);
-    throw error;
-  } finally {
-    rmSync2(attemptDir, { recursive: true, force: true });
-  }
-}
-
 // src/commands/plan.ts
 import { resolve as resolve12 } from "node:path";
 var planCommand = {
@@ -13892,6 +14280,22 @@ function parseEnv(text) {
   return { entries, invalidNames, malformedLines };
 }
 
+// src/secrets/declared.ts
+function declaredSecrets(loaded) {
+  if (loaded.schema === "launchpad.m-kopa.us/v1alpha1") {
+    const m2 = loaded.manifest;
+    return { slug: m2.metadata.name, apiVersion: m2.apiVersion, bindings: m2.secrets?.bindings ?? [] };
+  }
+  const m = loaded.manifest;
+  const envVars = m.spec.appType === "container" ? {} : m.spec.env_vars ?? {};
+  const fromEnvVars = Object.entries(envVars).filter(([, v]) => v.type === "secret_text").map(([name]) => ({ name, source: "env-file" }));
+  return {
+    slug: m.metadata.slug,
+    apiVersion: m.apiVersion,
+    bindings: [...m.spec.secrets?.bindings ?? [], ...fromEnvVars]
+  };
+}
+
 // src/secrets/push.ts
 async function runSecretsPush(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
@@ -13901,14 +14305,10 @@ async function runSecretsPush(opts, io, deps = {}) {
   if (loaded.kind !== "ok") {
     return renderManifestError4(loaded, io);
   }
-  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets push", io);
-  if (v2Refusal !== null)
-    return v2Refusal;
-  const manifest = loaded.manifest;
-  const bindings = manifest.secrets?.bindings ?? [];
+  const { slug, bindings } = declaredSecrets(loaded);
   const envFileBindings = bindings.filter((b) => b.source === "env-file");
   if (envFileBindings.length === 0) {
-    io.out("No `env-file` secret bindings declared in the manifest.");
+    io.out("No secrets to push: the manifest declares no `env-file` bindings or `secret_text` env vars.");
     io.out("(platform-managed bindings are pushed via the platform-team ops path.)");
     return 0;
   }
@@ -13987,11 +14387,11 @@ async function runSecretsPush(opts, io, deps = {}) {
     io.out("Re-run without --dry-run to push.");
     return 0;
   }
-  const slug = manifest.metadata.name;
   let pushed = 0;
   let partial = 0;
   let anyPagesUpdated = false;
   let anyWorkerUpdated = false;
+  let anyDispatchUpdated = false;
   for (const b of envFileBindings) {
     const value = parsed.entries.get(b.name);
     io.out(`Pushing ${b.name} …`);
@@ -14012,6 +14412,11 @@ async function runSecretsPush(opts, io, deps = {}) {
       io.err(`✗ secrets push ${b.name}: invalid bot response (results must be an array)`);
       return 2;
     }
+    if (resp.error === "dispatch_script_not_delivered") {
+      io.err(`✗ secrets push ${b.name}: ${resp.message ?? "the dispatch script is not delivered yet"}`);
+      io.err(`${pushed} of ${envFileBindings.length} pushed before failure.`);
+      return 1;
+    }
     const results = resp.results ?? [];
     for (const r of results) {
       if (r.status !== "updated")
@@ -14020,6 +14425,8 @@ async function runSecretsPush(opts, io, deps = {}) {
         anyPagesUpdated = true;
       else if (r.kind === "worker")
         anyWorkerUpdated = true;
+      else if (r.kind === "dispatch")
+        anyDispatchUpdated = true;
     }
     const notUpdated = results.filter((r) => r.status !== "updated");
     if (resp.updated === true && notUpdated.length === 0) {
@@ -14043,7 +14450,9 @@ async function runSecretsPush(opts, io, deps = {}) {
   if (anyPagesUpdated) {
     return offerRedeploy(slug, opts, io, deps);
   }
-  if (anyWorkerUpdated) {
+  if (anyDispatchUpdated) {
+    io.out("Set on the app's dispatch Worker and live now - no redeploy needed.");
+  } else if (anyWorkerUpdated) {
     io.out("These secrets bind on the app's next invocation — no redeploy needed.");
   }
   return 0;
@@ -14112,20 +14521,6 @@ function mapPushError(e, slug, name, io) {
 function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
-function refuseV2Manifest(loaded, command, io) {
-  if (loaded.schema !== "launchpad.m-kopa.us/v2")
-    return null;
-  const origin = loaded.manifest.spec?.origin;
-  if (origin === "dispatch") {
-    io.err(`${command}: this is a dispatch-origin (v2) app.`);
-    const outcome = command.endsWith("push") ? "nothing was pushed" : "nothing was read";
-    io.err(`  Secrets are not delivered to the dispatch namespace yet (PS-2740); ${outcome}.`);
-    return 1;
-  }
-  io.err(`${command}: this is a launchpad.m-kopa.us/v2 manifest.`);
-  io.err("  This command reads v1alpha1 `secrets.bindings`; v2 declares secrets as `spec.env_vars` `secret_text` entries, which it does not push yet.");
-  return 1;
-}
 function renderManifestError4(result, io) {
   switch (result.kind) {
     case "ok":
@@ -14166,17 +14561,12 @@ async function runSecretsStatus(opts, io, deps = {}) {
   const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok")
     return renderManifestError5(loaded, io);
-  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets status", io);
-  if (v2Refusal !== null)
-    return v2Refusal;
-  const manifest = loaded.manifest;
-  const slug = manifest.metadata.name;
+  const { slug, bindings } = declaredSecrets(loaded);
   if (opts.slug != null && opts.slug !== slug) {
     io.err(`launchpad secrets status: slug "${opts.slug}" does not match this directory's ` + `manifest (metadata.name: "${slug}").`);
     io.err("  secrets status audits the manifest in the current directory — omit the slug, " + "or run from the app's directory.");
     return 2;
   }
-  const bindings = manifest.secrets?.bindings ?? [];
   if (bindings.length === 0) {
     io.out("No secret bindings declared in the manifest.");
     return 0;
@@ -14526,12 +14916,12 @@ async function runSecretsTemplate(args, io) {
     return 64;
   }
   const manifestPath = resolve14(process.cwd(), flags.file ?? "launchpad.yaml");
-  const result = loadManifest(manifestPath);
-  const renderResult = renderManifest(result, io);
+  const renderResult = renderManifest(loadManifestAnyVersion(manifestPath), io);
   if (renderResult.kind !== "ok") {
     return renderResult.code;
   }
-  const body = buildTemplate(renderResult.manifest, flags.includePlatformManaged);
+  const declared = renderResult.declared;
+  const body = buildTemplate(declared, flags.includePlatformManaged);
   if (flags.toStdout) {
     for (const line of body.split(`
 `)) {
@@ -14554,14 +14944,14 @@ async function runSecretsTemplate(args, io) {
     return 2;
   }
   io.out(`✓ wrote ${outPath}`);
-  const bindings = result.kind === "ok" ? countBindings(result.manifest) : { total: 0, written: 0 };
-  io.out(`  ${bindings.written} binding${bindings.written === 1 ? "" : "s"} scaffolded`);
+  const written = declared.bindings.filter((b) => b.source === "env-file").length;
+  io.out(`  ${written} binding${written === 1 ? "" : "s"} scaffolded`);
   return 0;
 }
 function renderManifest(result, io) {
   switch (result.kind) {
     case "ok":
-      return { kind: "ok", manifest: result.manifest };
+      return { kind: "ok", declared: declaredSecrets(result) };
     case "file-not-found":
       io.err(`launchpad secrets template: ${result.path}`);
       io.err("  manifest not found");
@@ -14583,19 +14973,19 @@ function renderManifest(result, io) {
       return { kind: "fail", code: 1 };
   }
 }
-function buildTemplate(manifest, includePlatformManaged) {
-  const bindings = manifest.secrets?.bindings ?? [];
+function buildTemplate(declared, includePlatformManaged) {
+  const { bindings } = declared;
   const lines = [];
   lines.push("# Auto-generated by `launchpad secrets template` — do not commit values.");
-  lines.push(`# Source: launchpad.yaml (apiVersion: ${manifest.apiVersion})`);
-  lines.push(`# App:    ${manifest.metadata.name}`);
+  lines.push(`# Source: launchpad.yaml (apiVersion: ${declared.apiVersion})`);
+  lines.push(`# App:    ${declared.slug}`);
   lines.push("#");
   lines.push("# Fill in values, then run `launchpad secrets push`.");
   lines.push("# This file is meant to be committed; the real `.env` must be gitignored.");
   lines.push("");
   if (bindings.length === 0) {
     lines.push("# No secret bindings declared in launchpad.yaml.");
-    lines.push("# Add entries under `secrets.bindings[]` and re-run this command.");
+    lines.push("# Add entries under `secrets.bindings[]` (v1alpha1) or `spec.env_vars` with " + "`type: secret_text` (v2) and re-run this command.");
     lines.push("");
     return lines.join(`
 `);
@@ -14629,11 +15019,6 @@ function buildTemplate(manifest, includePlatformManaged) {
   return lines.join(`
 `);
 }
-function countBindings(manifest) {
-  const bindings = manifest.secrets?.bindings ?? [];
-  const written = bindings.filter((b) => b.source === "env-file").length;
-  return { total: bindings.length, written };
-}
 function parseFlags4(args) {
   let file;
   let out = ".env.example";
@@ -14842,7 +15227,7 @@ import { promises as fs7, existsSync as existsSync16 } from "node:fs";
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join15 } from "node:path";
-import { readFileSync as readFileSync20, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync20, readdirSync as readdirSync3 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
   return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
@@ -14850,7 +15235,7 @@ function skillsTargetDir() {
 function readInstalledSkills() {
   try {
     const dir = skillsTargetDir();
-    const bundle = readdirSync2(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
+    const bundle = readdirSync3(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
     if (!bundle)
       return { present: false, version: null };
     return {
@@ -15540,7 +15925,7 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -15631,7 +16016,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   }
   let entries;
   try {
-    entries = readdirSync3(abs);
+    entries = readdirSync4(abs);
   } catch (e) {
     return [`failed to read static served directory '${serveDir}/': ${describe32(e)}`];
   }