@m-kopa/launchpad-cli 0.63.0 → 0.64.0

package/CHANGELOG.md

@@ -8,6 +8,29 @@ pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
 ## Unreleased
 
+## 0.64.0 - 2026-09-25
+
+### Added
+
+- New `react+api` apps default to Workers dispatch too.
+  `launchpad init --type react+api` writes a v2 dispatch manifest with `functions/**` in the bundle; `--origin pages` still opts out.
+  A first `launchpad deploy` (or `launchpad migrate --origin dispatch`) of an unregistered React API app with a Pages-implied manifest converts it the same way static and React apps already convert.
+  `functions/` is compiled by the dispatch build, a v1 pages-target `d1_binding` or a single wrangler `d1_databases` entry becomes `spec.bindings.d1`, `production_env` values become plain-text env vars, and declared `env-file` secrets become `secret_text` env vars with a reminder to run `launchpad secrets push` once the first deploy is delivered.
+  The app stays on Pages with the reason printed when its wrangler config sets anything else (KV, R2, services, vars, Durable Objects and so on, named in the message), its functions have a root `_middleware` or root-level dynamic route that would claim every path, it ships a hand-written `_worker.js`, or a secret is platform-managed, targets another surface, or uses a name the platform sets.
+- `launchpad validate` refuses a v2 env var with the same name as `spec.bindings.d1`.
+- `launchpad secrets push` works for dispatch-origin apps.
+  The value goes to the app's Worker script in the dispatch namespace and is live immediately, so there is no redeploy prompt.
+  Pushing before the first deploy has been delivered stops with `dispatch_script_not_delivered` and writes nothing.
+  Fleet secret-set pushes reach dispatch members the same way.
+- `secrets template`, `push` and `status` read v2 manifests of either origin, taking each `spec.env_vars` entry of `type: secret_text` as a secret.
+  v2 dispatch manifests may now declare `secret_text` env vars.
+- Dispatch `react+api` apps can declare a D1 database as `spec.bindings.d1`, and `launchpad validate` accepts it.
+
+### Changed
+
+- Raise the production minimum CLI version to 0.63.0 through the governed policy workflow.
+  Older stable clients must run `launchpad update` before platform mutations.
+
 ## 0.63.0 - 2026-09-25
 
 ### Changed

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.63.0";
+var CLI_VERSION = "0.64.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -3363,7 +3363,10 @@ var SpecSchema = z3.object({
   env_vars: z3.record(z3.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
   containers: z3.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
-  fronted_by_concierge: z3.boolean().optional()
+  fronted_by_concierge: z3.boolean().optional(),
+  bindings: z3.object({
+    d1: z3.string().min(1).max(64).regex(ENV_NAME_REGEX, "bindings.d1 must be an UPPER_SNAKE_CASE binding name").optional()
+  }).strict().optional()
 }).strict().superRefine((s, ctx) => {
   if (s.access.identity_types !== undefined && (s.auth ?? "access") !== "gateway") {
     ctx.addIssue({
@@ -3432,14 +3435,27 @@ var SpecSchema = z3.object({
         message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
       });
     }
-    for (const [name, envVar] of Object.entries(s.env_vars ?? {})) {
-      if (envVar.type === "secret_text") {
-        ctx.addIssue({
-          code: z3.ZodIssueCode.custom,
-          path: ["env_vars", name],
-          message: "secret_text env vars are not supported with origin: dispatch until PS-2740 (secrets on v2) provides their runtime consumer."
-        });
-      }
+  }
+  if (s.bindings?.d1 !== undefined) {
+    if (s.origin !== "dispatch") {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["bindings", "d1"],
+        message: "bindings.d1 requires origin: dispatch. A pages-origin app declares its database with a v1 pages target d1_binding."
+      });
+    } else if (s.appType !== "react+api") {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["bindings", "d1"],
+        message: `bindings.d1 requires appType 'react+api' (current appType: '${s.appType}'); only a react+api app ships the Worker code that can read a database.`
+      });
+    }
+    if (s.env_vars?.[s.bindings.d1] !== undefined) {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["env_vars", s.bindings.d1],
+        message: `env var '${s.bindings.d1}' has the same name as bindings.d1. Rename one of them.`
+      });
     }
   }
   if (!isContainer && s.containers !== undefined) {
@@ -4449,7 +4465,7 @@ function deploymentAuthIssue(appType, auth) {
 function newAppOrigin(appType, requested) {
   if (appType === "container")
     return;
-  return requested ?? (appType === "react+api" ? "pages" : "dispatch");
+  return requested ?? "dispatch";
 }
 // src/bundle/boundary.ts
 var MAX_CONTENT_PROBE_BYTES = 1024 * 1024;
@@ -8620,24 +8636,32 @@ function rejectUnsupportedCliRuntime(args) {
 }
 
 // src/commands/migrate.ts
-import { closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync2, mkdtempSync, openSync, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync2, mkdtempSync, openSync, readdirSync as readdirSync2, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import path8 from "node:path";
 import { stringify } from "yaml";
 
 // src/manifest/migrate-dispatch.ts
-function dispatchManifest(manifest) {
+var PLATFORM_ENV_NAMES = new Set([
+  "GATEWAY_ISSUER",
+  "GATEWAY_AUD",
+  "GATEWAY_JWKS_URL",
+  "CF_ACCESS_TEAM_DOMAIN",
+  "CF_ACCESS_AUD",
+  "JWKS_URL"
+]);
+function dispatchManifest(manifest, wranglerD1) {
   const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
   const source = v2 ? manifest.spec : manifest;
   const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
-  if (appType !== "static" && appType !== "react") {
-    throw new Error("Only static and React apps can use this converter. Pages Functions (react+api) need a compiled Worker build before switching to dispatch; containers use their own runtime.");
-  }
-  if (source.secrets !== undefined || source.containers !== undefined) {
-    throw new Error("Secret and container bindings cannot be converted automatically.");
+  if (appType === "container" || source.containers !== undefined) {
+    throw new Error("Containers use their own runtime and cannot convert to dispatch.");
   }
   if (!v2)
     assertConvertibleV1(manifest);
-  const spec = v2 ? { ...manifest.spec } : {
+  const d1 = d1Binding(v2 ? manifest.spec.bindings?.d1 : pagesTargetD1(manifest), wranglerD1);
+  const plainEnv = v2 ? manifest.spec.env_vars : plainTextEnv(manifest.production_env);
+  const envVars = { ...plainEnv, ...secretEnv(source.secrets, plainEnv) };
+  const spec = v2 ? { ...manifest.spec, secrets: undefined } : {
     appType,
     display: {
       name: manifest.metadata.name,
@@ -8655,16 +8679,20 @@ function dispatchManifest(manifest) {
     app: manifest.app,
     verify: manifest.verify,
     sensitive: manifest.sensitive,
-    catalogue: manifest.catalogue,
-    ...manifest.production_env === undefined ? {} : {
-      env_vars: Object.fromEntries(Object.entries(manifest.production_env).map(([name, value]) => [name, { type: "plain_text", value }]))
-    }
+    catalogue: manifest.catalogue
   };
   const candidate = {
     apiVersion: "launchpad.m-kopa.us/v2",
     kind: "App",
     metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
-    spec: { ...spec, origin: "dispatch", auth: "gateway", confine_origin: undefined }
+    spec: {
+      ...spec,
+      ...d1 === undefined ? {} : { bindings: { d1 } },
+      env_vars: Object.keys(envVars).length === 0 ? undefined : envVars,
+      origin: "dispatch",
+      auth: "gateway",
+      confine_origin: undefined
+    }
   };
   const parsed = parseManifestV2(candidate);
   if (parsed.kind !== "ok") {
@@ -8675,7 +8703,7 @@ function dispatchManifest(manifest) {
 function assertConvertibleV1(manifest) {
   const unsupported2 = [
     manifest.hostnames !== undefined && "hostnames",
-    manifest.targets !== undefined && "targets",
+    manifest.targets !== undefined && pagesTargetD1(manifest) === undefined && "targets",
     manifest.access.session_duration !== undefined && "access.session_duration",
     manifest.deployment.runtime !== undefined && "deployment.runtime"
   ].filter(Boolean);
@@ -8683,12 +8711,224 @@ function assertConvertibleV1(manifest) {
     throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
   }
 }
+function d1Binding(declared, wranglerD1) {
+  if (declared !== undefined && wranglerD1 !== undefined && declared !== wranglerD1) {
+    throw new Error(`The manifest binds D1 as ${declared} but the wrangler config binds ${wranglerD1}. Use one name for both.`);
+  }
+  return declared ?? wranglerD1;
+}
+function plainTextEnv(env) {
+  if (env === undefined)
+    return;
+  return Object.fromEntries(Object.entries(env).map(([name, value]) => [name, { type: "plain_text", value }]));
+}
+function secretEnv(secrets, env) {
+  const out = {};
+  for (const binding of secrets?.bindings ?? []) {
+    const refusal = secretRefusal(binding, env);
+    if (refusal !== undefined)
+      throw new Error(`Secret ${binding.name} ${refusal}`);
+    out[binding.name] = { type: "secret_text", secret_ref: binding.name };
+  }
+  return out;
+}
+function secretRefusal(binding, env) {
+  const targets = binding.targets === undefined || binding.targets === "all" ? [] : binding.targets;
+  const checks = [
+    [binding.source !== "env-file", "is platform-managed and cannot be converted automatically. Ask the platform team to migrate it."],
+    [targets.some((target) => target !== "primary"), "targets another surface, which dispatch does not have."],
+    [PLATFORM_ENV_NAMES.has(binding.name), "is set by the platform on dispatch apps. Rename it before converting."],
+    [env?.[binding.name] !== undefined, "is also declared as an environment variable. Keep one."]
+  ];
+  return checks.find(([refused]) => refused)?.[1];
+}
+function pagesTargetD1(manifest) {
+  const [target, ...rest] = manifest.targets ?? [];
+  if (rest.length > 0 || target?.kind !== "pages")
+    return;
+  return target.d1_binding;
+}
+
+// src/manifest/wrangler-config.ts
+var ALLOWED_KEYS = new Set([
+  "name",
+  "compatibility_date",
+  "compatibility_flags",
+  "pages_build_output_dir",
+  "d1_databases"
+]);
+var PLATFORM_FLAGS = new Set(["nodejs_compat"]);
+
+class UnsupportedWranglerConfigError extends Error {
+}
+function wranglerD1Binding(file, text) {
+  const toml = file.endsWith(".toml");
+  const config = toml ? readToml(file, text) : readJsonc(file, text);
+  for (const key of Object.keys(config)) {
+    if (!ALLOWED_KEYS.has(key) && (toml || key !== "$schema"))
+      throw unsupportedKey(file, key);
+  }
+  if (config.compatibility_flags !== undefined) {
+    const extra = asArray(file, "compatibility_flags", config.compatibility_flags).find((flag) => !PLATFORM_FLAGS.has(String(flag)));
+    if (extra !== undefined) {
+      throw new UnsupportedWranglerConfigError(`${file} sets compatibility flag \`${String(extra)}\`; dispatch runs with nodejs_compat only`);
+    }
+  }
+  if (config.d1_databases === undefined)
+    return;
+  const databases = asArray(file, "d1_databases", config.d1_databases);
+  if (databases.length !== 1) {
+    throw new UnsupportedWranglerConfigError(`${file} declares ${databases.length} \`d1_databases\` entries; dispatch binds exactly one D1 database`);
+  }
+  const binding = databases[0]?.binding;
+  if (typeof binding !== "string" || binding === "") {
+    throw new UnsupportedWranglerConfigError(`${file} has a \`d1_databases\` entry without a binding name`);
+  }
+  return binding;
+}
+function unsupportedKey(file, key) {
+  return new UnsupportedWranglerConfigError(`${file} sets \`${key}\`, which dispatch cannot preserve`);
+}
+function asArray(file, key, value) {
+  if (!Array.isArray(value))
+    throw new UnsupportedWranglerConfigError(`${file} sets \`${key}\` to something other than a list`);
+  return value;
+}
+function readJsonc(file, text) {
+  const stripped = stripOutsideStrings(text, '"', (at) => {
+    if (text.startsWith("//", at))
+      return lineEnd(text, at) - at;
+    if (!text.startsWith("/*", at))
+      return 0;
+    const end = text.indexOf("*/", at + 2);
+    return (end === -1 ? text.length : end + 2) - at;
+  }).replace(/,(\s*[}\]])/g, "$1");
+  let parsed;
+  try {
+    parsed = JSON.parse(stripped);
+  } catch {
+    throw new UnsupportedWranglerConfigError(`${file} could not be read as JSON`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new UnsupportedWranglerConfigError(`${file} is not a JSON object`);
+  }
+  return parsed;
+}
+function readToml(file, text) {
+  const config = {};
+  const databases = [];
+  let table = config;
+  for (const line of logicalTomlLines(text)) {
+    if (line.startsWith("[")) {
+      table = d1Table(file, line);
+      databases.push(table);
+    } else {
+      assign(file, table, line, table === config);
+    }
+  }
+  if (databases.length === 0)
+    return config;
+  if (config.d1_databases !== undefined)
+    throw new UnsupportedWranglerConfigError(`${file} declares d1_databases twice`);
+  return { ...config, d1_databases: databases };
+}
+function d1Table(file, line) {
+  const name = /^\[\[?\s*([^\]]*?)\s*\]\]?$/.exec(line)?.[1] ?? line;
+  if (!line.startsWith("[[") || name !== "d1_databases")
+    throw unsupportedKey(file, topKey(name));
+  return {};
+}
+function assign(file, table, line, topLevel) {
+  const assignment = /^([\w\-."]+)\s*=\s*(.*)$/.exec(line);
+  if (assignment === null)
+    throw new UnsupportedWranglerConfigError(`${file} could not be read as TOML near \`${line.slice(0, 40)}\``);
+  const key = topKey(assignment[1]);
+  if (topLevel && assignment[1].includes("."))
+    throw unsupportedKey(file, key);
+  table[key] = tomlValue(assignment[2].trim());
+}
+function topKey(dotted) {
+  return dotted.split(".")[0].replace(/"/g, "").trim();
+}
+function tomlValue(raw) {
+  const quoted = /^"((?:[^"\\]|\\.)*)"$|^'([^']*)'$/.exec(raw);
+  if (quoted !== null)
+    return quoted[1] ?? quoted[2];
+  if (!raw.startsWith("["))
+    return raw;
+  const inner = raw.slice(1, -1);
+  if (inner.includes("{")) {
+    return [...inner.matchAll(/\{([^}]*)\}/g)].map((table) => ({
+      binding: /(?:^|[\s,])binding\s*=\s*["']([^"']*)["']/.exec(table[1])?.[1]
+    }));
+  }
+  return [...inner.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'/g)].map((item) => item[1] ?? item[2]);
+}
+function logicalTomlLines(text) {
+  const stripped = stripOutsideStrings(text, `"'`, (at) => text[at] === "#" ? lineEnd(text, at) - at : 0);
+  const lines = [];
+  let pending = "";
+  for (const raw of stripped.split(/\r?\n/)) {
+    pending = `${pending} ${raw.trim()}`.trim();
+    if (pending === "" || openBrackets(pending) > 0)
+      continue;
+    lines.push(pending);
+    pending = "";
+  }
+  if (pending !== "")
+    lines.push(pending);
+  return lines;
+}
+function lineEnd(text, at) {
+  const end = text.indexOf(`
+`, at);
+  return end === -1 ? text.length : end;
+}
+function openBrackets(line) {
+  if (/^\[\[?[^\]=]*\]\]?$/.test(line))
+    return 0;
+  let open = 0;
+  stripOutsideStrings(line, `"'`, (at) => {
+    if (line[at] === "[" || line[at] === "{")
+      open++;
+    if (line[at] === "]" || line[at] === "}")
+      open--;
+    return 0;
+  });
+  return open;
+}
+function stripOutsideStrings(text, quotes, skip) {
+  let out = "";
+  for (let i = 0;i < text.length; ) {
+    if (quotes.includes(text[i])) {
+      const end = stringEnd(text, i);
+      out += text.slice(i, end);
+      i = end;
+      continue;
+    }
+    const skipped = skip(i);
+    if (skipped === 0)
+      out += text[i];
+    i += Math.max(skipped, 1);
+  }
+  return out;
+}
+function stringEnd(text, start) {
+  const quote = text[start];
+  for (let i = start + 1;i < text.length; i++) {
+    if (text[i] === "\\" && quote === '"')
+      i++;
+    else if (text[i] === quote)
+      return i + 1;
+  }
+  return text.length;
+}
 
 // src/commands/migrate.ts
 var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
 var migrateCommand = {
   name: "migrate",
-  summary: "convert an unprovisioned static or React app to Workers dispatch",
+  summary: "convert an unprovisioned static, React or React API app to Workers dispatch",
   run: runMigrate
 };
 async function runMigrate(args, io) {
@@ -8711,6 +8951,9 @@ async function runMigrate(args, io) {
       io.out(`${result.slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
       io.out(`Audience, owner and application settings are preserved. Original: ${BACKUP_PATH}`);
       io.out("Run `launchpad deploy`. No Pages project is needed.");
+      const next = secretsNextStep(result.secrets);
+      if (next !== null)
+        io.out(next);
     }
     return 0;
   } catch (error) {
@@ -8719,6 +8962,11 @@ async function runMigrate(args, io) {
   }
 }
 var BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+function secretsNextStep(secrets) {
+  if (secrets.length === 0)
+    return null;
+  return `Secrets (${secrets.join(", ")}) carry over as secret_text env vars. Once \`launchpad status\` shows the first deploy delivered, run \`launchpad secrets push\` to set them.`;
+}
 async function convertToDispatch(cwd, dryRun) {
   const file = path8.join(cwd, "launchpad.yaml");
   if (!lstatSync4(file).isFile())
@@ -8730,18 +8978,38 @@ async function convertToDispatch(cwd, dryRun) {
   const manifest = loaded.manifest;
   if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch")
     return { kind: "already" };
-  const converted = dispatchManifest(manifest);
-  assertNoCustomRuntime(cwd, converted);
-  const slug = converted.metadata.slug;
+  const slug = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? manifest.metadata.slug : manifest.metadata.name;
+  let converted;
+  try {
+    converted = convertLocally(cwd, manifest);
+  } catch (error) {
+    await refuseIfRegistered(slug);
+    throw error;
+  }
   await assertUnregistered(slug);
+  const secrets = Object.entries(converted.spec.env_vars ?? {}).filter(([, value]) => value.type === "secret_text").map(([name]) => name);
   if (dryRun)
-    return { kind: "eligible", slug };
+    return { kind: "eligible", slug, secrets };
   try {
     saveMigration(file, original, converted);
   } catch (error) {
     throw new MigrationSaveError(error);
   }
-  return { kind: "converted", slug };
+  return { kind: "converted", slug, secrets };
+}
+function convertLocally(cwd, manifest) {
+  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
+  const spec = v2 ? manifest.spec : manifest;
+  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
+  return dispatchManifest(manifest, inspectRuntime(cwd, appType, spec.app?.root, spec.build));
+}
+async function refuseIfRegistered(slug) {
+  try {
+    await assertUnregistered(slug);
+  } catch (error) {
+    if (error instanceof RegisteredAppError)
+      throw error;
+  }
 }
 async function assertUnregistered(slug) {
   try {
@@ -8773,23 +9041,54 @@ class RegisteredAppError extends Error {
     super("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
   }
 }
-function assertNoCustomRuntime(cwd, manifest) {
-  const appRoot = path8.resolve(cwd, manifest.spec.app?.root ?? ".");
-  const buildRoot = path8.resolve(appRoot, manifest.spec.build?.root_dir ?? ".");
-  const roots = new Set([
+var WRANGLER_FILES = ["wrangler.toml", "wrangler.json", "wrangler.jsonc"];
+function inspectRuntime(cwd, appType, appRootDir, build) {
+  const d1 = new Set;
+  for (const root of runtimeRoots(cwd, appRootDir, build)) {
+    assertNoUncompiledCode(root, appType);
+    for (const binding2 of wranglerD1Bindings(cwd, root))
+      d1.add(binding2);
+  }
+  if (d1.size > 1)
+    throw new Error(`The wrangler configs bind D1 under different names (${[...d1].join(", ")}). Use one name.`);
+  const [binding] = d1;
+  if (binding !== undefined && appType !== "react+api") {
+    throw new Error("The wrangler config declares a D1 database, which only react+api apps can use on dispatch.");
+  }
+  return binding;
+}
+function runtimeRoots(cwd, appRootDir, build) {
+  const appRoot = path8.resolve(cwd, appRootDir ?? ".");
+  const buildRoot = path8.resolve(appRoot, build?.root_dir ?? ".");
+  return new Set([
     cwd,
     appRoot,
     buildRoot,
-    path8.resolve(cwd, manifest.spec.build?.root_dir ?? "."),
-    path8.resolve(buildRoot, manifest.spec.build?.destination_dir ?? "dist")
+    path8.resolve(cwd, build?.root_dir ?? "."),
+    path8.resolve(buildRoot, build?.destination_dir ?? "dist")
   ]);
-  for (const root of roots) {
-    for (const name of ["functions", "_worker.js", "wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
-      if (existsSync7(path8.join(root, name))) {
-        throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker bindings must not be dropped. Ask the platform team to review this app.`);
-      }
+}
+function assertNoUncompiledCode(root, appType) {
+  const api = appType === "react+api";
+  for (const name of api ? ["_worker.js"] : ["_worker.js", "functions"]) {
+    if (existsSync7(path8.join(root, name))) {
+      throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker code must not be dropped. Ask the platform team to review this app.`);
     }
   }
+  if (api)
+    assertWorkerRoutesFit(root);
+}
+function wranglerD1Bindings(cwd, root) {
+  return WRANGLER_FILES.map((name) => path8.join(root, name)).filter((file) => existsSync7(file)).map((file) => wranglerD1Binding(path8.relative(cwd, file), readFileSync11(file, "utf8"))).filter((binding) => binding !== undefined);
+}
+function assertWorkerRoutesFit(root) {
+  const functions = path8.join(root, "functions");
+  if (!existsSync7(functions) || !lstatSync4(functions).isDirectory())
+    return;
+  const catchAll = readdirSync2(functions).find((name) => /^_middleware\.[cm]?[jt]sx?$/.test(name) || name.startsWith("["));
+  if (catchAll !== undefined) {
+    throw new Error(`functions/${catchAll} would run the Worker for every path, including static assets, which dispatch does not support. Move it under a prefix such as functions/api/.`);
+  }
 }
 function saveMigration(file, original, converted) {
   if (readFileSync11(file, "utf8") !== original)
@@ -9602,24 +9901,12 @@ function isIneligible(e) {
   return !(e instanceof RegistryUnavailableError || e instanceof MigrationSaveError || e instanceof UpgradeRequiredError || e instanceof UnauthenticatedError);
 }
 async function defaultToDispatch(cwd, manifestPath, io) {
-  let raw;
-  try {
-    raw = parseYaml6(readFileSync12(manifestPath, "utf8"));
-  } catch {
-    return null;
-  }
-  const isV22 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
-  const appType = isV22 ? raw?.spec?.appType : raw?.deployment?.type;
-  const origin = isV22 ? raw?.spec?.origin : raw?.origin;
-  const auth = isV22 ? raw?.spec?.auth : raw?.auth;
-  if (appType !== "static" && appType !== "react" || origin !== undefined || auth !== "gateway")
+  if (!impliesPagesForGateway(manifestPath))
     return null;
   try {
-    if ((await convertToDispatch(cwd, false)).kind === "converted") {
-      io.out("New apps deploy on Workers dispatch by default, so launchpad.yaml was converted (no Pages project needed).");
-      io.out(`  Audience, owner and build settings are preserved. Original: ${BACKUP_PATH}`);
-      io.out("  To stay on Pages instead, set `spec.origin: pages` and deploy again.");
-    }
+    const result = await convertToDispatch(cwd, false);
+    if (result.kind === "converted")
+      reportConversion(io, result.secrets);
     return null;
   } catch (e) {
     if (e instanceof RegisteredAppError)
@@ -9629,6 +9916,30 @@ async function defaultToDispatch(cwd, manifestPath, io) {
     return `Not converted to Workers dispatch: ${describe17(e)}`;
   }
 }
+var CONVERTIBLE_APP_TYPES = new Set(["static", "react", "react+api"]);
+function impliesPagesForGateway(manifestPath) {
+  const fields = originFields(manifestPath);
+  return CONVERTIBLE_APP_TYPES.has(fields.appType) && fields.origin === undefined && fields.auth === "gateway";
+}
+function originFields(manifestPath) {
+  let raw;
+  try {
+    raw = parseYaml6(readFileSync12(manifestPath, "utf8")) ?? {};
+  } catch {
+    return {};
+  }
+  if (raw.apiVersion === "launchpad.m-kopa.us/v2")
+    return raw.spec ?? {};
+  return { origin: raw.origin, auth: raw.auth, appType: raw.deployment?.type };
+}
+function reportConversion(io, secrets) {
+  io.out("New apps deploy on Workers dispatch by default, so launchpad.yaml was converted (no Pages project needed).");
+  io.out(`  Audience, owner and build settings are preserved. Original: ${BACKUP_PATH}`);
+  io.out(`  To stay on Pages instead, restore ${BACKUP_PATH} as launchpad.yaml, set \`origin: pages\` (v1) or \`spec.origin: pages\` (v2) and deploy again.`);
+  const next = secretsNextStep(secrets);
+  if (next !== null)
+    io.out(`  ${next}`);
+}
 function declaredOriginOf(isV22, origin) {
   if (!isV22)
     return "pages";
@@ -11084,10 +11395,6 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
     return 64;
   }
   const dispatch = newAppOrigin(fillResult.inputs.type, inputs.origin) === "dispatch";
-  if (dispatch && fillResult.inputs.type === "react+api") {
-    io.err("launchpad init: API starter dispatch is not available yet; use --origin pages");
-    return 64;
-  }
   if (dispatch && (inputs.hostnames.length > 0 || inputs.sessionDuration !== undefined)) {
     io.err("launchpad init: dispatch does not support --hostname or --session-duration; use --origin pages for a Pages manifest");
     return 64;
@@ -11159,11 +11466,10 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   io.out("");
   io.out("Next steps:");
   io.out("  launchpad validate                # confirm the manifest");
-  if (!dispatch)
-    io.out("  launchpad secrets template        # scaffold .env.example");
+  io.out("  launchpad secrets template        # scaffold .env.example");
   io.out("  launchpad deploy                  # build and deploy the app");
   if (dispatch)
-    io.out("  Dispatch currently supports plain-text environment variables, but not secret bindings.");
+    io.out("  Push secrets with `launchpad secrets push` once the first deploy has been delivered.");
   return 0;
 }
 function parseArgs6(args) {
@@ -11215,11 +11521,11 @@ function parseArgs6(args) {
       i++;
       return next;
     };
-    const setFromNext = (assign) => {
+    const setFromNext = (assign2) => {
       const got = needsValue();
       if (typeof got !== "string")
         return got;
-      assign(got);
+      assign2(got);
       return;
     };
     if (a === "--name") {
@@ -13974,6 +14280,22 @@ function parseEnv(text) {
   return { entries, invalidNames, malformedLines };
 }
 
+// src/secrets/declared.ts
+function declaredSecrets(loaded) {
+  if (loaded.schema === "launchpad.m-kopa.us/v1alpha1") {
+    const m2 = loaded.manifest;
+    return { slug: m2.metadata.name, apiVersion: m2.apiVersion, bindings: m2.secrets?.bindings ?? [] };
+  }
+  const m = loaded.manifest;
+  const envVars = m.spec.appType === "container" ? {} : m.spec.env_vars ?? {};
+  const fromEnvVars = Object.entries(envVars).filter(([, v]) => v.type === "secret_text").map(([name]) => ({ name, source: "env-file" }));
+  return {
+    slug: m.metadata.slug,
+    apiVersion: m.apiVersion,
+    bindings: [...m.spec.secrets?.bindings ?? [], ...fromEnvVars]
+  };
+}
+
 // src/secrets/push.ts
 async function runSecretsPush(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
@@ -13983,14 +14305,10 @@ async function runSecretsPush(opts, io, deps = {}) {
   if (loaded.kind !== "ok") {
     return renderManifestError4(loaded, io);
   }
-  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets push", io);
-  if (v2Refusal !== null)
-    return v2Refusal;
-  const manifest = loaded.manifest;
-  const bindings = manifest.secrets?.bindings ?? [];
+  const { slug, bindings } = declaredSecrets(loaded);
   const envFileBindings = bindings.filter((b) => b.source === "env-file");
   if (envFileBindings.length === 0) {
-    io.out("No `env-file` secret bindings declared in the manifest.");
+    io.out("No secrets to push: the manifest declares no `env-file` bindings or `secret_text` env vars.");
     io.out("(platform-managed bindings are pushed via the platform-team ops path.)");
     return 0;
   }
@@ -14069,11 +14387,11 @@ async function runSecretsPush(opts, io, deps = {}) {
     io.out("Re-run without --dry-run to push.");
     return 0;
   }
-  const slug = manifest.metadata.name;
   let pushed = 0;
   let partial = 0;
   let anyPagesUpdated = false;
   let anyWorkerUpdated = false;
+  let anyDispatchUpdated = false;
   for (const b of envFileBindings) {
     const value = parsed.entries.get(b.name);
     io.out(`Pushing ${b.name} …`);
@@ -14094,6 +14412,11 @@ async function runSecretsPush(opts, io, deps = {}) {
       io.err(`✗ secrets push ${b.name}: invalid bot response (results must be an array)`);
       return 2;
     }
+    if (resp.error === "dispatch_script_not_delivered") {
+      io.err(`✗ secrets push ${b.name}: ${resp.message ?? "the dispatch script is not delivered yet"}`);
+      io.err(`${pushed} of ${envFileBindings.length} pushed before failure.`);
+      return 1;
+    }
     const results = resp.results ?? [];
     for (const r of results) {
       if (r.status !== "updated")
@@ -14102,6 +14425,8 @@ async function runSecretsPush(opts, io, deps = {}) {
         anyPagesUpdated = true;
       else if (r.kind === "worker")
         anyWorkerUpdated = true;
+      else if (r.kind === "dispatch")
+        anyDispatchUpdated = true;
     }
     const notUpdated = results.filter((r) => r.status !== "updated");
     if (resp.updated === true && notUpdated.length === 0) {
@@ -14125,7 +14450,9 @@ async function runSecretsPush(opts, io, deps = {}) {
   if (anyPagesUpdated) {
     return offerRedeploy(slug, opts, io, deps);
   }
-  if (anyWorkerUpdated) {
+  if (anyDispatchUpdated) {
+    io.out("Set on the app's dispatch Worker and live now - no redeploy needed.");
+  } else if (anyWorkerUpdated) {
     io.out("These secrets bind on the app's next invocation — no redeploy needed.");
   }
   return 0;
@@ -14194,20 +14521,6 @@ function mapPushError(e, slug, name, io) {
 function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
-function refuseV2Manifest(loaded, command, io) {
-  if (loaded.schema !== "launchpad.m-kopa.us/v2")
-    return null;
-  const origin = loaded.manifest.spec?.origin;
-  if (origin === "dispatch") {
-    io.err(`${command}: this is a dispatch-origin (v2) app.`);
-    const outcome = command.endsWith("push") ? "nothing was pushed" : "nothing was read";
-    io.err(`  Secrets are not delivered to the dispatch namespace yet (PS-2740); ${outcome}.`);
-    return 1;
-  }
-  io.err(`${command}: this is a launchpad.m-kopa.us/v2 manifest.`);
-  io.err("  This command reads v1alpha1 `secrets.bindings`; v2 declares secrets as `spec.env_vars` `secret_text` entries, which it does not push yet.");
-  return 1;
-}
 function renderManifestError4(result, io) {
   switch (result.kind) {
     case "ok":
@@ -14248,17 +14561,12 @@ async function runSecretsStatus(opts, io, deps = {}) {
   const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok")
     return renderManifestError5(loaded, io);
-  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets status", io);
-  if (v2Refusal !== null)
-    return v2Refusal;
-  const manifest = loaded.manifest;
-  const slug = manifest.metadata.name;
+  const { slug, bindings } = declaredSecrets(loaded);
   if (opts.slug != null && opts.slug !== slug) {
     io.err(`launchpad secrets status: slug "${opts.slug}" does not match this directory's ` + `manifest (metadata.name: "${slug}").`);
     io.err("  secrets status audits the manifest in the current directory — omit the slug, " + "or run from the app's directory.");
     return 2;
   }
-  const bindings = manifest.secrets?.bindings ?? [];
   if (bindings.length === 0) {
     io.out("No secret bindings declared in the manifest.");
     return 0;
@@ -14608,12 +14916,12 @@ async function runSecretsTemplate(args, io) {
     return 64;
   }
   const manifestPath = resolve14(process.cwd(), flags.file ?? "launchpad.yaml");
-  const result = loadManifest(manifestPath);
-  const renderResult = renderManifest(result, io);
+  const renderResult = renderManifest(loadManifestAnyVersion(manifestPath), io);
   if (renderResult.kind !== "ok") {
     return renderResult.code;
   }
-  const body = buildTemplate(renderResult.manifest, flags.includePlatformManaged);
+  const declared = renderResult.declared;
+  const body = buildTemplate(declared, flags.includePlatformManaged);
   if (flags.toStdout) {
     for (const line of body.split(`
 `)) {
@@ -14636,14 +14944,14 @@ async function runSecretsTemplate(args, io) {
     return 2;
   }
   io.out(`✓ wrote ${outPath}`);
-  const bindings = result.kind === "ok" ? countBindings(result.manifest) : { total: 0, written: 0 };
-  io.out(`  ${bindings.written} binding${bindings.written === 1 ? "" : "s"} scaffolded`);
+  const written = declared.bindings.filter((b) => b.source === "env-file").length;
+  io.out(`  ${written} binding${written === 1 ? "" : "s"} scaffolded`);
   return 0;
 }
 function renderManifest(result, io) {
   switch (result.kind) {
     case "ok":
-      return { kind: "ok", manifest: result.manifest };
+      return { kind: "ok", declared: declaredSecrets(result) };
     case "file-not-found":
       io.err(`launchpad secrets template: ${result.path}`);
       io.err("  manifest not found");
@@ -14665,19 +14973,19 @@ function renderManifest(result, io) {
       return { kind: "fail", code: 1 };
   }
 }
-function buildTemplate(manifest, includePlatformManaged) {
-  const bindings = manifest.secrets?.bindings ?? [];
+function buildTemplate(declared, includePlatformManaged) {
+  const { bindings } = declared;
   const lines = [];
   lines.push("# Auto-generated by `launchpad secrets template` — do not commit values.");
-  lines.push(`# Source: launchpad.yaml (apiVersion: ${manifest.apiVersion})`);
-  lines.push(`# App:    ${manifest.metadata.name}`);
+  lines.push(`# Source: launchpad.yaml (apiVersion: ${declared.apiVersion})`);
+  lines.push(`# App:    ${declared.slug}`);
   lines.push("#");
   lines.push("# Fill in values, then run `launchpad secrets push`.");
   lines.push("# This file is meant to be committed; the real `.env` must be gitignored.");
   lines.push("");
   if (bindings.length === 0) {
     lines.push("# No secret bindings declared in launchpad.yaml.");
-    lines.push("# Add entries under `secrets.bindings[]` and re-run this command.");
+    lines.push("# Add entries under `secrets.bindings[]` (v1alpha1) or `spec.env_vars` with " + "`type: secret_text` (v2) and re-run this command.");
     lines.push("");
     return lines.join(`
 `);
@@ -14711,11 +15019,6 @@ function buildTemplate(manifest, includePlatformManaged) {
   return lines.join(`
 `);
 }
-function countBindings(manifest) {
-  const bindings = manifest.secrets?.bindings ?? [];
-  const written = bindings.filter((b) => b.source === "env-file").length;
-  return { total: bindings.length, written };
-}
 function parseFlags4(args) {
   let file;
   let out = ".env.example";
@@ -14924,7 +15227,7 @@ import { promises as fs7, existsSync as existsSync16 } from "node:fs";
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join15 } from "node:path";
-import { readFileSync as readFileSync20, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync20, readdirSync as readdirSync3 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
   return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
@@ -14932,7 +15235,7 @@ function skillsTargetDir() {
 function readInstalledSkills() {
   try {
     const dir = skillsTargetDir();
-    const bundle = readdirSync2(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
+    const bundle = readdirSync3(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
     if (!bundle)
       return { present: false, version: null };
     return {
@@ -15622,7 +15925,7 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -15713,7 +16016,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   }
   let entries;
   try {
-    entries = readdirSync3(abs);
+    entries = readdirSync4(abs);
   } catch (e) {
     return [`failed to read static served directory '${serveDir}/': ${describe32(e)}`];
   }

package/dist/commands/deploy.d.ts

@@ -24,7 +24,7 @@ export declare function parseArgs(args: readonly string[]): DeployArgs | null;
 /** Re-export for tests. */
 export { MAX_COMPRESSED_TARBALL_BYTES };
 /**
- * Workers dispatch is the default for new static and React apps. Before a
+ * Workers dispatch is the default for new static, React and React API apps. Before a
  * first deploy, convert a gateway manifest that only implies Pages (no
  * `origin` in v1 or v2) to v2 dispatch. An explicit origin is an opt-out and
  * registered apps keep their origin. Returns a note explaining why the deploy

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA8uBxC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6B5G;AAED,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA8uBxC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY5G;AAkCD,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAK7D,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,EAChB,QAAQ,GAAE,MAAM,OAAO,CAAC,YAAY,CAAuE,GAC1G,OAAO,CAAC,QAAQ,CAAC,CA8LnB"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAK7D,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,EAChB,QAAQ,GAAE,MAAM,OAAO,CAAC,YAAY,CAAuE,GAC1G,OAAO,CAAC,QAAQ,CAAC,CA0LnB"}

package/dist/commands/migrate.d.ts

@@ -1,11 +1,15 @@
 import type { Command } from "../dispatcher.js";
 export declare const migrateCommand: Command;
 export declare const BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+/** Dispatch secrets land on the Worker script, which exists only after the first delivery. */
+export declare function secretsNextStep(secrets: readonly string[]): string | null;
 export type DispatchConversion = {
     readonly kind: "already";
 } | {
     readonly kind: "eligible" | "converted";
     readonly slug: string;
+    /** Secret names the converted manifest declares; set with `secrets push` after first delivery. */
+    readonly secrets: readonly string[];
 };
 /**
  * Convert `<cwd>/launchpad.yaml` to a v2 dispatch manifest, or report that it

package/dist/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC;AA+BF,eAAO,MAAM,WAAW,6CAA6C,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmBjG;AAcD,yFAAyF;AACzF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAG3B;AAED,yFAAyF;AACzF,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,KAAK;;CAI5C"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC;AAiCF,eAAO,MAAM,WAAW,6CAA6C,CAAC;AAEtE,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAGzE;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEN;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0BjG;AAkCD,yFAAyF;AACzF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAG3B;AAED,yFAAyF;AACzF,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,KAAK;;CAI5C"}

package/dist/commands/secrets-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-template.d.ts","sourceRoot":"","sources":["../../src/commands/secrets-template.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgBxD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}
+{"version":3,"file":"secrets-template.d.ts","sourceRoot":"","sources":["../../src/commands/secrets-template.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgBxD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}

package/dist/manifest/migrate-dispatch.d.ts

@@ -1,4 +1,14 @@
-import { type DeploymentManifest, type ManifestV2 } from "@m-kopa/launchpad-engine";
-/** Convert only the static subset whose deployment contract dispatch preserves. */
-export declare function dispatchManifest(manifest: DeploymentManifest): ManifestV2;
+import { type DeploymentManifest, type Manifest, type ManifestV2 } from "@m-kopa/launchpad-engine";
+/**
+ * Convert a Pages-implied manifest to v2 dispatch, keeping only what the
+ * dispatch runtime preserves. `wranglerD1` is the D1 binding the app's
+ * wrangler config declares, already checked by the caller.
+ */
+export declare function dispatchManifest(manifest: DeploymentManifest, wranglerD1?: string): ManifestV2;
+/**
+ * The D1 binding name when `targets` is exactly one pages target carrying
+ * `d1_binding`. Dispatch declares that database as `spec.bindings.d1`; every
+ * other target shape (cron Workers, secrets surfaces) has no dispatch form.
+ */
+export declare function pagesTargetD1(manifest: Pick<Manifest, "targets">): string | undefined;
 //# sourceMappingURL=migrate-dispatch.d.ts.map

package/dist/manifest/migrate-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-dispatch.d.ts","sourceRoot":"","sources":["../../src/manifest/migrate-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAElC,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,UAAU,CAkDzE"}
+{"version":3,"file":"migrate-dispatch.d.ts","sourceRoot":"","sources":["../../src/manifest/migrate-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,QAAQ,EACb,KAAK,UAAU,EAGhB,MAAM,0BAA0B,CAAC;AAOlC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,CAgD9F;AAuDD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAIrF"}

package/dist/manifest/wrangler-config.d.ts

@@ -0,0 +1,3 @@
+/** The D1 binding a wrangler config declares, if any. Throws on anything else. */
+export declare function wranglerD1Binding(file: string, text: string): string | undefined;
+//# sourceMappingURL=wrangler-config.d.ts.map

package/dist/manifest/wrangler-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-config.d.ts","sourceRoot":"","sources":["../../src/manifest/wrangler-config.ts"],"names":[],"mappings":"AAoBA,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuBhF"}

package/dist/secrets/declared.d.ts

@@ -0,0 +1,12 @@
+import type { SecretBinding } from "@m-kopa/launchpad-engine";
+import type { AnyVersionLoadResult } from "../manifest/load.js";
+export interface DeclaredSecrets {
+    readonly slug: string;
+    readonly apiVersion: string;
+    readonly bindings: readonly SecretBinding[];
+}
+/** Normalise a loaded manifest's secret declarations to v1-shaped bindings. */
+export declare function declaredSecrets(loaded: Extract<AnyVersionLoadResult, {
+    kind: "ok";
+}>): DeclaredSecrets;
+//# sourceMappingURL=declared.d.ts.map

package/dist/secrets/declared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared.d.ts","sourceRoot":"","sources":["../../src/secrets/declared.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAc,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GACpD,eAAe,CAiBjB"}

package/dist/secrets/push.d.ts

@@ -1,5 +1,4 @@
 import { type CliConfig } from "../config.js";
-import { type AnyVersionLoadResult } from "../manifest/load.js";
 import { type RedeployOptions, type RedeployDeps } from "../commands/redeploy.js";
 import type { CliIo, ExitCode } from "../dispatcher.js";
 export interface PushOptions {
@@ -26,11 +25,4 @@ export interface PushDeps {
     readonly runRedeploy?: (opts: RedeployOptions, io: CliIo, deps?: RedeployDeps) => Promise<ExitCode>;
 }
 export declare function runSecretsPush(opts: PushOptions, io: CliIo, deps?: PushDeps): Promise<ExitCode>;
-/** v2 manifests carry no `secrets.bindings`. On `origin: dispatch` the bot
- *  refuses too (PS-2740), so say so here before any .env is read; on a v2
- *  pages app say what this command reads today instead of reporting
- *  "no bindings declared", which would be false. Returns null for v1alpha1. */
-export declare function refuseV2Manifest(loaded: Extract<AnyVersionLoadResult, {
-    kind: "ok";
-}>, command: string, io: CliIo): ExitCode | null;
 //# sourceMappingURL=push.d.ts.map

package/dist/secrets/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/secrets/push.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAcD,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CA+MnB;AAyGD;;;+EAG+E;AAC/E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,EACrD,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,KAAK,GACR,QAAQ,GAAG,IAAI,CAYjB"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/secrets/push.ts"],"names":[],"mappings":"AAoDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY1D,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAiBD,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CAoNnB"}

package/dist/secrets/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAa1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAkBD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CA0EnB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAkBD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CAoEnB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.63.0";
+export declare const CLI_VERSION = "0.64.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -149,25 +149,29 @@ resolve it by passing `--type` explicitly or skipping detection with
 launchpad init
 ```
 
-New `static` and `react` apps default to Workers dispatch with gateway authentication.
+New `static`, `react` and `react+api` apps default to Workers dispatch with gateway authentication.
 The CLI writes a v2 manifest and keeps the detected build settings and access groups.
-Gateway placement is automatic for new gateway-fronted apps, including Pages API starters.
+Gateway placement is automatic for new gateway-fronted apps, including API apps.
 The platform selects the configured gateway with the most free hostname slots, counting pending deployments as reservations.
 Do not ask the author to choose a gateway or add gateway project names to the manifest.
 Existing apps and retries retain their assigned gateway and public URL.
-An older manifest that only implies Pages (v1, or v2 without `spec.origin`) is converted to dispatch automatically on the first `launchpad deploy` of an unregistered static or React app.
+An older manifest that only implies Pages (v1, or v2 without `spec.origin`) is converted to dispatch automatically on the first `launchpad deploy` of an unregistered static, React or React API app.
 Tell the author when deploy reports the conversion, and point them at the backup in `.launchpad/manifest-before-dispatch.yaml`.
 `launchpad migrate --origin dispatch --dry-run` runs the same check without deploying, if the author wants to see it first.
 If deploy prints `Not converted to Workers dispatch`, the deploy continues on Pages; tell the author the reason, and do not delete files or change `appType` to force the conversion.
 Do not regenerate the manifest with `init`, broaden its groups, or change private ownership to work around the quota.
 If `launchpad migrate` refuses functions, custom runtime configuration or bindings, explain the named limitation; a normal `launchpad deploy` still works on Pages.
-Pages Functions apps need a compiled Worker build; changing `appType` to `react` would not convert their API.
+For a React API app, `functions/` converts as-is and the dispatch build compiles it; its D1 becomes `spec.bindings.d1` and declared secrets become `secret_text` env vars.
+When deploy says secrets carried over, tell the author to run `launchpad secrets push` once `launchpad status` shows the first delivery; pushing earlier fails with `dispatch_script_not_delivered`.
+Still refused on dispatch, with the reason printed: wrangler settings beyond name, compatibility date/flags, `pages_build_output_dir` and one D1 (so KV, R2, services, vars, Durable Objects, queues), a root `functions/_middleware` or root-level catch-all that would claim `/*`, a hand-written `_worker.js`, and functions that compile to more than one module.
+A function that calls `next()` to fall through to a static asset does not work on dispatch, because the Worker has no asset fallback.
+Changing `appType` to `react` would not convert the API; do not suggest it.
 Do not use this command to migrate a registered app or delete its Pages resources.
 If the pool is full or inventory cannot be read, report the capacity error; do not fall back to Pages or change authentication to bypass it.
 Do not replace that manifest with a v1 example or add `--origin pages` just because an older app uses Pages.
 Use `--origin pages` only when Pages is deliberately required.
-React API starters stay on Pages until their build produces a Worker entry; containers keep their existing deployment path.
-Dispatch supports plain-text environment variables, but secret bindings are currently rejected before provisioning.
+Containers keep their existing deployment path.
+Dispatch supports plain-text environment variables and `secret_text` env vars; after the first deploy is delivered, `launchpad secrets push` sets the secret values, live immediately with no redeploy.
 
 This is interactive by default. It will ask for:
 
@@ -500,6 +504,22 @@ targets:
 On `launchpad deploy` the bot auto-provisions the shared D1 named after the slug (**create-or-adopt by slug during deploy** - a successful destroy exports and deletes the recorded UUID before repository archive, so platform recovery creates a fresh destination database) and binds it to the Pages app, so `env.DB` works with no manual `wrangler d1 create`.
 The bot also pins the matching `[[d1_databases]]` block into the **committed** `wrangler.toml` - Pages git-source builds read bindings from that file, and a build without the block silently resets the binding to empty.
 
+**Dispatch form.** A v2 `react+api` app on `origin: dispatch` has no `targets`; it declares the same database as `spec.bindings.d1`:
+
+```yaml
+spec:
+  appType: react+api
+  auth: gateway
+  origin: dispatch
+  bindings:
+    d1: DB                # env binding name your Worker code reads
+```
+
+The bot create-or-adopts the slug-named D1, records its UUID, and binds it on every Worker upload (no `wrangler.toml` needed).
+If the database cannot be resolved the delivery refuses with `d1-unresolved` and nothing uploads.
+`bindings.d1` is refused on a v2 pages app and on any appType other than `react+api`.
+`launchpad migrate --origin dispatch` and a first `launchpad deploy` write this field from a v1 pages target `d1_binding` or a single wrangler `d1_databases` entry.
+
 **Empty-DB gotcha:** the platform provisions an **empty** database — schema
 and migrations are the app's job. The usual pattern is idempotent
 `CREATE TABLE IF NOT EXISTS …` at runtime (startup / first request); there

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -215,12 +215,12 @@ Otherwise finish with:
 
 ## New app defaults
 
-`launchpad init` creates new static and React apps on Workers dispatch with gateway authentication.
+`launchpad init` creates new static, React and React API apps on Workers dispatch with gateway authentication.
 The generated v2 manifest preserves the detected build settings and the chosen access groups.
 Use the normal `launchpad deploy` flow; authors do not create Cloudflare projects or choose a gateway.
 The platform assigns new gateway-fronted apps to the configured gateway with the most free hostname slots, including pending reservations.
 Existing apps keep their assigned gateway, URL and access groups.
-React API starters remain on Pages and registered apps keep their current origin.
-An older manifest for an unregistered static or React app is converted to dispatch on its first `launchpad deploy`.
+Registered apps keep their current origin.
+An older manifest for an unregistered static, React or React API app is converted to dispatch on its first `launchpad deploy`; a React API app with KV, R2 or other unsupported wrangler bindings stays on Pages with the reason printed.
 An explicit `--origin pages` is available when required.
-Dispatch secret bindings are not supported yet, so do not promise that `launchpad secrets push` will work for those apps.
+Dispatch apps declare secrets as `secret_text` env vars and set them with `launchpad secrets push` once the first deploy has been delivered.

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.63.0
+version: 0.64.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->