@m-kopa/launchpad-cli 0.62.0 → 0.64.0

package/dist/commands/deploy.d.ts

@@ -1,6 +1,6 @@
 import { MAX_COMPRESSED_TARBALL_BYTES } from "../deploy/tar-pack.js";
 import { inferSlugFromCwd, resolveManifestSlug } from "./infer-slug.js";
-import type { Command } from "../dispatcher.js";
+import type { CliIo, Command } from "../dispatcher.js";
 export { inferSlugFromCwd, resolveManifestSlug };
 export declare const deployCommand: Command;
 interface DeployArgs {
@@ -23,6 +23,15 @@ export declare function deployUsage(): string;
 export declare function parseArgs(args: readonly string[]): DeployArgs | null;
 /** Re-export for tests. */
 export { MAX_COMPRESSED_TARBALL_BYTES };
+/**
+ * Workers dispatch is the default for new static, React and React API apps. Before a
+ * first deploy, convert a gateway manifest that only implies Pages (no
+ * `origin` in v1 or v2) to v2 dispatch. An explicit origin is an opt-out and
+ * registered apps keep their origin. Returns a note explaining why the deploy
+ * stays on Pages, or null when there is nothing to say. Throws when
+ * registration cannot be confirmed or the converted manifest cannot be saved.
+ */
+export declare function defaultToDispatch(cwd: string, manifestPath: string, io: CliIo): Promise<string | null>;
 /** Pure wording branch kept exported for the v1 byte-identity contract. */
 /** What the local manifest says the origin is: v1 manifests are always pages;
  *  a v2 manifest defaults to pages; `undefined` means it could not be read. */

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA4tBxC,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA8uBxC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY5G;AAkCD,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAK7D,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,EAChB,QAAQ,GAAE,MAAM,OAAO,CAAC,YAAY,CAAuE,GAC1G,OAAO,CAAC,QAAQ,CAAC,CA8LnB"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAK7D,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,EAChB,QAAQ,GAAE,MAAM,OAAO,CAAC,YAAY,CAAuE,GAC1G,OAAO,CAAC,QAAQ,CAAC,CA0LnB"}

package/dist/commands/migrate.d.ts

@@ -1,3 +1,33 @@
 import type { Command } from "../dispatcher.js";
 export declare const migrateCommand: Command;
+export declare const BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+/** Dispatch secrets land on the Worker script, which exists only after the first delivery. */
+export declare function secretsNextStep(secrets: readonly string[]): string | null;
+export type DispatchConversion = {
+    readonly kind: "already";
+} | {
+    readonly kind: "eligible" | "converted";
+    readonly slug: string;
+    /** Secret names the converted manifest declares; set with `secrets push` after first delivery. */
+    readonly secrets: readonly string[];
+};
+/**
+ * Convert `<cwd>/launchpad.yaml` to a v2 dispatch manifest, or report that it
+ * would convert (`dryRun`). Throws with a user-facing reason when the app is
+ * registered, the registry cannot be read, or the app has a runtime dispatch
+ * cannot preserve. Shared by `migrate` and first-deploy auto-conversion.
+ */
+export declare function convertToDispatch(cwd: string, dryRun: boolean): Promise<DispatchConversion>;
+/** The app is eligible but the converted manifest or its backup could not be written. */
+export declare class MigrationSaveError extends Error {
+    constructor(cause: unknown);
+}
+/** The registry could not confirm the slug is unregistered, so nothing was converted. */
+export declare class RegistryUnavailableError extends Error {
+    constructor(cause: unknown);
+}
+/** The slug already has an app record; its origin changes only via a planned infrastructure migration. */
+export declare class RegisteredAppError extends Error {
+    constructor();
+}
 //# sourceMappingURL=migrate.d.ts.map

package/dist/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC;AAiCF,eAAO,MAAM,WAAW,6CAA6C,CAAC;AAEtE,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAGzE;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEN;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0BjG;AAkCD,yFAAyF;AACzF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAG3B;AAED,yFAAyF;AACzF,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,KAAK;;CAI5C"}

package/dist/commands/secrets-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-template.d.ts","sourceRoot":"","sources":["../../src/commands/secrets-template.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgBxD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}
+{"version":3,"file":"secrets-template.d.ts","sourceRoot":"","sources":["../../src/commands/secrets-template.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgBxD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}

package/dist/manifest/migrate-dispatch.d.ts

@@ -1,4 +1,14 @@
-import { type DeploymentManifest, type ManifestV2 } from "@m-kopa/launchpad-engine";
-/** Convert only the static subset whose deployment contract dispatch preserves. */
-export declare function dispatchManifest(manifest: DeploymentManifest): ManifestV2;
+import { type DeploymentManifest, type Manifest, type ManifestV2 } from "@m-kopa/launchpad-engine";
+/**
+ * Convert a Pages-implied manifest to v2 dispatch, keeping only what the
+ * dispatch runtime preserves. `wranglerD1` is the D1 binding the app's
+ * wrangler config declares, already checked by the caller.
+ */
+export declare function dispatchManifest(manifest: DeploymentManifest, wranglerD1?: string): ManifestV2;
+/**
+ * The D1 binding name when `targets` is exactly one pages target carrying
+ * `d1_binding`. Dispatch declares that database as `spec.bindings.d1`; every
+ * other target shape (cron Workers, secrets surfaces) has no dispatch form.
+ */
+export declare function pagesTargetD1(manifest: Pick<Manifest, "targets">): string | undefined;
 //# sourceMappingURL=migrate-dispatch.d.ts.map

package/dist/manifest/migrate-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-dispatch.d.ts","sourceRoot":"","sources":["../../src/manifest/migrate-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAElC,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,UAAU,CAkDzE"}
+{"version":3,"file":"migrate-dispatch.d.ts","sourceRoot":"","sources":["../../src/manifest/migrate-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,QAAQ,EACb,KAAK,UAAU,EAGhB,MAAM,0BAA0B,CAAC;AAOlC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,CAgD9F;AAuDD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAIrF"}

package/dist/manifest/wrangler-config.d.ts

@@ -0,0 +1,3 @@
+/** The D1 binding a wrangler config declares, if any. Throws on anything else. */
+export declare function wranglerD1Binding(file: string, text: string): string | undefined;
+//# sourceMappingURL=wrangler-config.d.ts.map

package/dist/manifest/wrangler-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-config.d.ts","sourceRoot":"","sources":["../../src/manifest/wrangler-config.ts"],"names":[],"mappings":"AAoBA,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuBhF"}

package/dist/secrets/declared.d.ts

@@ -0,0 +1,12 @@
+import type { SecretBinding } from "@m-kopa/launchpad-engine";
+import type { AnyVersionLoadResult } from "../manifest/load.js";
+export interface DeclaredSecrets {
+    readonly slug: string;
+    readonly apiVersion: string;
+    readonly bindings: readonly SecretBinding[];
+}
+/** Normalise a loaded manifest's secret declarations to v1-shaped bindings. */
+export declare function declaredSecrets(loaded: Extract<AnyVersionLoadResult, {
+    kind: "ok";
+}>): DeclaredSecrets;
+//# sourceMappingURL=declared.d.ts.map

package/dist/secrets/declared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared.d.ts","sourceRoot":"","sources":["../../src/secrets/declared.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAc,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GACpD,eAAe,CAiBjB"}

package/dist/secrets/push.d.ts

@@ -1,5 +1,4 @@
 import { type CliConfig } from "../config.js";
-import { type AnyVersionLoadResult } from "../manifest/load.js";
 import { type RedeployOptions, type RedeployDeps } from "../commands/redeploy.js";
 import type { CliIo, ExitCode } from "../dispatcher.js";
 export interface PushOptions {
@@ -26,11 +25,4 @@ export interface PushDeps {
     readonly runRedeploy?: (opts: RedeployOptions, io: CliIo, deps?: RedeployDeps) => Promise<ExitCode>;
 }
 export declare function runSecretsPush(opts: PushOptions, io: CliIo, deps?: PushDeps): Promise<ExitCode>;
-/** v2 manifests carry no `secrets.bindings`. On `origin: dispatch` the bot
- *  refuses too (PS-2740), so say so here before any .env is read; on a v2
- *  pages app say what this command reads today instead of reporting
- *  "no bindings declared", which would be false. Returns null for v1alpha1. */
-export declare function refuseV2Manifest(loaded: Extract<AnyVersionLoadResult, {
-    kind: "ok";
-}>, command: string, io: CliIo): ExitCode | null;
 //# sourceMappingURL=push.d.ts.map

package/dist/secrets/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/secrets/push.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAcD,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CA+MnB;AAyGD;;;+EAG+E;AAC/E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,EACrD,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,KAAK,GACR,QAAQ,GAAG,IAAI,CAYjB"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/secrets/push.ts"],"names":[],"mappings":"AAoDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY1D,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAiBD,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CAoNnB"}

package/dist/secrets/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAa1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAkBD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CA0EnB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAkBD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CAoEnB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.62.0";
+export declare const CLI_VERSION = "0.64.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.62.0",
+  "version": "0.64.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -56,10 +56,11 @@ change — and how do you know it's actually serving.
 Keep the existing audience for ordinary content updates.
 Do not broaden groups to bypass a validation or deployment failure.
 If this update newly grants a company-wide audience, ask: **"Are you sure you want every employee to be able to open this app?"**
-Name the app and groups, explain that any selected group grants access, and give the human the server's confirmation URL.
-Never submit the browser decision on their behalf.
-Wait for their confirmation, then retry the unchanged deployment.
-Sensitive apps also require platform-admin approval.
+Name the app and groups, explain that any selected group grants access, and wait for their explicit answer in this conversation.
+If they decline, stop the grant and keep the existing audience.
+For ordinary apps, continue after they agree; no browser confirmation, decision ID or extra acknowledgement flag is required.
+Sensitive apps retain builder confirmation and platform-admin approval through the server's confirmation URL.
+Never submit that browser decision on their behalf; retry only after the required people complete it.
 Do not review or recertify unchanged existing audiences as part of a routine update.
 Catalogue visibility controls discovery, not access; platform administrators retain entry independently of app groups.
 

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -48,12 +48,16 @@ Never select `S_ALL_Employees`, `S_ALL`, or another broad group to fix a missing
 
 Before requesting a new company-wide grant, ask the human exactly: **"Are you sure you want every employee to be able to open this app?"**
 Name the app and the selected groups, and explain that membership in any selected group grants access.
-A general instruction to deploy, a generic yes flag, and a previous approval for another app or revision do not answer this question.
-When the server returns `audience_confirmation_required`, give the user its confirmation URL and wait for them to complete the browser decision.
-Never open the decision endpoint with automation to approve it, submit its form, or manufacture an acknowledgement for the user.
-Retry the same deployment only after the human confirms completion.
-Sensitive apps also require a platform administrator's approval.
-A changed audience or revision needs a new decision; unchanged existing audiences do not require recertification.
+A general instruction to deploy, a generic yes flag, and a previous approval for another app or audience do not answer this question.
+Wait for the human's explicit answer in this conversation before deploying the company-wide grant.
+If they decline, stop the grant and keep the existing audience.
+For ordinary apps, their answer is the confirmation: continue the deployment without a browser, confirmation ID, token or extra acknowledgement flag.
+The server does not attest to this conversation; do not claim that it enforces the human decision.
+Sensitive apps retain the separate builder-confirmation and platform-admin approval requirement.
+If the server returns `audience_confirmation_required` with `requires_admin_approval: true`, give the human its URL and retry only after the required people complete approval.
+Never submit that browser decision on their behalf.
+If the error does not require admin approval, report that the server needs updating rather than telling the user a browser visit is part of the ordinary flow.
+A changed audience needs an explicit answer for that audience; unchanged existing audiences do not require recertification.
 
 Catalogue listing controls discovery only.
 It neither grants access nor makes an app private.
@@ -145,25 +149,29 @@ resolve it by passing `--type` explicitly or skipping detection with
 launchpad init
 ```
 
-New `static` and `react` apps default to Workers dispatch with gateway authentication.
+New `static`, `react` and `react+api` apps default to Workers dispatch with gateway authentication.
 The CLI writes a v2 manifest and keeps the detected build settings and access groups.
-Gateway placement is automatic for new gateway-fronted apps, including Pages API starters.
+Gateway placement is automatic for new gateway-fronted apps, including API apps.
 The platform selects the configured gateway with the most free hostname slots, counting pending deployments as reservations.
 Do not ask the author to choose a gateway or add gateway project names to the manifest.
 Existing apps and retries retain their assigned gateway and public URL.
-Updating the CLI does not rewrite an existing Pages manifest.
-If an unprovisioned static or React app hits the Pages project limit, run `launchpad update`, then `launchpad migrate --origin dispatch --dry-run`.
-When eligible, run `launchpad migrate --origin dispatch`, review the preserved audience and build settings, then run `launchpad deploy`.
-The command checks the live registry and saves the original YAML under `.launchpad/manifest-before-dispatch.yaml`.
+An older manifest that only implies Pages (v1, or v2 without `spec.origin`) is converted to dispatch automatically on the first `launchpad deploy` of an unregistered static, React or React API app.
+Tell the author when deploy reports the conversion, and point them at the backup in `.launchpad/manifest-before-dispatch.yaml`.
+`launchpad migrate --origin dispatch --dry-run` runs the same check without deploying, if the author wants to see it first.
+If deploy prints `Not converted to Workers dispatch`, the deploy continues on Pages; tell the author the reason, and do not delete files or change `appType` to force the conversion.
 Do not regenerate the manifest with `init`, broaden its groups, or change private ownership to work around the quota.
-If migration refuses functions, custom runtime configuration or bindings, stop and explain the named limitation.
-Pages Functions apps need a compiled Worker build; changing `appType` to `react` would not convert their API.
+If `launchpad migrate` refuses functions, custom runtime configuration or bindings, explain the named limitation; a normal `launchpad deploy` still works on Pages.
+For a React API app, `functions/` converts as-is and the dispatch build compiles it; its D1 becomes `spec.bindings.d1` and declared secrets become `secret_text` env vars.
+When deploy says secrets carried over, tell the author to run `launchpad secrets push` once `launchpad status` shows the first delivery; pushing earlier fails with `dispatch_script_not_delivered`.
+Still refused on dispatch, with the reason printed: wrangler settings beyond name, compatibility date/flags, `pages_build_output_dir` and one D1 (so KV, R2, services, vars, Durable Objects, queues), a root `functions/_middleware` or root-level catch-all that would claim `/*`, a hand-written `_worker.js`, and functions that compile to more than one module.
+A function that calls `next()` to fall through to a static asset does not work on dispatch, because the Worker has no asset fallback.
+Changing `appType` to `react` would not convert the API; do not suggest it.
 Do not use this command to migrate a registered app or delete its Pages resources.
 If the pool is full or inventory cannot be read, report the capacity error; do not fall back to Pages or change authentication to bypass it.
 Do not replace that manifest with a v1 example or add `--origin pages` just because an older app uses Pages.
 Use `--origin pages` only when Pages is deliberately required.
-React API starters stay on Pages until their build produces a Worker entry; containers keep their existing deployment path.
-Dispatch supports plain-text environment variables, but secret bindings are currently rejected before provisioning.
+Containers keep their existing deployment path.
+Dispatch supports plain-text environment variables and `secret_text` env vars; after the first deploy is delivered, `launchpad secrets push` sets the secret values, live immediately with no redeploy.
 
 This is interactive by default. It will ask for:
 
@@ -496,6 +504,22 @@ targets:
 On `launchpad deploy` the bot auto-provisions the shared D1 named after the slug (**create-or-adopt by slug during deploy** - a successful destroy exports and deletes the recorded UUID before repository archive, so platform recovery creates a fresh destination database) and binds it to the Pages app, so `env.DB` works with no manual `wrangler d1 create`.
 The bot also pins the matching `[[d1_databases]]` block into the **committed** `wrangler.toml` - Pages git-source builds read bindings from that file, and a build without the block silently resets the binding to empty.
 
+**Dispatch form.** A v2 `react+api` app on `origin: dispatch` has no `targets`; it declares the same database as `spec.bindings.d1`:
+
+```yaml
+spec:
+  appType: react+api
+  auth: gateway
+  origin: dispatch
+  bindings:
+    d1: DB                # env binding name your Worker code reads
+```
+
+The bot create-or-adopts the slug-named D1, records its UUID, and binds it on every Worker upload (no `wrangler.toml` needed).
+If the database cannot be resolved the delivery refuses with `d1-unresolved` and nothing uploads.
+`bindings.d1` is refused on a v2 pages app and on any appType other than `react+api`.
+`launchpad migrate --origin dispatch` and a first `launchpad deploy` write this field from a v1 pages target `d1_binding` or a single wrangler `d1_databases` entry.
+
 **Empty-DB gotcha:** the platform provisions an **empty** database — schema
 and migrations are the app's job. The usual pattern is idempotent
 `CREATE TABLE IF NOT EXISTS …` at runtime (startup / first request); there

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -215,11 +215,12 @@ Otherwise finish with:
 
 ## New app defaults
 
-`launchpad init` creates new static and React apps on Workers dispatch with gateway authentication.
+`launchpad init` creates new static, React and React API apps on Workers dispatch with gateway authentication.
 The generated v2 manifest preserves the detected build settings and the chosen access groups.
 Use the normal `launchpad deploy` flow; authors do not create Cloudflare projects or choose a gateway.
 The platform assigns new gateway-fronted apps to the configured gateway with the most free hostname slots, including pending reservations.
 Existing apps keep their assigned gateway, URL and access groups.
-React API starters remain on Pages, and existing manifests keep their current origin.
+Registered apps keep their current origin.
+An older manifest for an unregistered static, React or React API app is converted to dispatch on its first `launchpad deploy`; a React API app with KV, R2 or other unsupported wrangler bindings stays on Pages with the reason printed.
 An explicit `--origin pages` is available when required.
-Dispatch secret bindings are not supported yet, so do not promise that `launchpad secrets push` will work for those apps.
+Dispatch apps declare secrets as `secret_text` env vars and set them with `launchpad secrets push` once the first deploy has been delivered.

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.62.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->