@m-kopa/launchpad-cli 0.63.0 → 0.65.0

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.63.0";
+var CLI_VERSION = "0.65.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -3363,7 +3363,10 @@ var SpecSchema = z3.object({
   env_vars: z3.record(z3.string().regex(ENV_NAME_REGEX, "env_vars keys must be UPPER_SNAKE_CASE"), EnvVarSchema).optional(),
   containers: z3.array(ContainerSchema).min(1).optional(),
   secrets: SecretsSchema.optional(),
-  fronted_by_concierge: z3.boolean().optional()
+  fronted_by_concierge: z3.boolean().optional(),
+  bindings: z3.object({
+    d1: z3.string().min(1).max(64).regex(ENV_NAME_REGEX, "bindings.d1 must be an UPPER_SNAKE_CASE binding name").optional()
+  }).strict().optional()
 }).strict().superRefine((s, ctx) => {
   if (s.access.identity_types !== undefined && (s.auth ?? "access") !== "gateway") {
     ctx.addIssue({
@@ -3432,14 +3435,27 @@ var SpecSchema = z3.object({
         message: "confine_origin has no meaning with origin: dispatch — there is no public pages.dev apex to confine. Remove it."
       });
     }
-    for (const [name, envVar] of Object.entries(s.env_vars ?? {})) {
-      if (envVar.type === "secret_text") {
-        ctx.addIssue({
-          code: z3.ZodIssueCode.custom,
-          path: ["env_vars", name],
-          message: "secret_text env vars are not supported with origin: dispatch until PS-2740 (secrets on v2) provides their runtime consumer."
-        });
-      }
+  }
+  if (s.bindings?.d1 !== undefined) {
+    if (s.origin !== "dispatch") {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["bindings", "d1"],
+        message: "bindings.d1 requires origin: dispatch. A pages-origin app declares its database with a v1 pages target d1_binding."
+      });
+    } else if (s.appType !== "react+api") {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["bindings", "d1"],
+        message: `bindings.d1 requires appType 'react+api' (current appType: '${s.appType}'); only a react+api app ships the Worker code that can read a database.`
+      });
+    }
+    if (s.env_vars?.[s.bindings.d1] !== undefined) {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: ["env_vars", s.bindings.d1],
+        message: `env var '${s.bindings.d1}' has the same name as bindings.d1. Rename one of them.`
+      });
     }
   }
   if (!isContainer && s.containers !== undefined) {
@@ -4449,7 +4465,7 @@ function deploymentAuthIssue(appType, auth) {
 function newAppOrigin(appType, requested) {
   if (appType === "container")
     return;
-  return requested ?? (appType === "react+api" ? "pages" : "dispatch");
+  return requested ?? "dispatch";
 }
 // src/bundle/boundary.ts
 var MAX_CONTENT_PROBE_BYTES = 1024 * 1024;
@@ -8620,24 +8636,32 @@ function rejectUnsupportedCliRuntime(args) {
 }
 
 // src/commands/migrate.ts
-import { closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync2, mkdtempSync, openSync, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync2, mkdtempSync, openSync, readdirSync as readdirSync2, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import path8 from "node:path";
 import { stringify } from "yaml";
 
 // src/manifest/migrate-dispatch.ts
-function dispatchManifest(manifest) {
+var PLATFORM_ENV_NAMES = new Set([
+  "GATEWAY_ISSUER",
+  "GATEWAY_AUD",
+  "GATEWAY_JWKS_URL",
+  "CF_ACCESS_TEAM_DOMAIN",
+  "CF_ACCESS_AUD",
+  "JWKS_URL"
+]);
+function dispatchManifest(manifest, wranglerD1) {
   const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
   const source = v2 ? manifest.spec : manifest;
   const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
-  if (appType !== "static" && appType !== "react") {
-    throw new Error("Only static and React apps can use this converter. Pages Functions (react+api) need a compiled Worker build before switching to dispatch; containers use their own runtime.");
-  }
-  if (source.secrets !== undefined || source.containers !== undefined) {
-    throw new Error("Secret and container bindings cannot be converted automatically.");
+  if (appType === "container" || source.containers !== undefined) {
+    throw new Error("Containers use their own runtime and cannot convert to dispatch.");
   }
   if (!v2)
     assertConvertibleV1(manifest);
-  const spec = v2 ? { ...manifest.spec } : {
+  const d1 = d1Binding(v2 ? manifest.spec.bindings?.d1 : pagesTargetD1(manifest), wranglerD1);
+  const plainEnv = v2 ? manifest.spec.env_vars : plainTextEnv(manifest.production_env);
+  const envVars = { ...plainEnv, ...secretEnv(source.secrets, plainEnv) };
+  const spec = v2 ? { ...manifest.spec, secrets: undefined } : {
     appType,
     display: {
       name: manifest.metadata.name,
@@ -8655,16 +8679,20 @@ function dispatchManifest(manifest) {
     app: manifest.app,
     verify: manifest.verify,
     sensitive: manifest.sensitive,
-    catalogue: manifest.catalogue,
-    ...manifest.production_env === undefined ? {} : {
-      env_vars: Object.fromEntries(Object.entries(manifest.production_env).map(([name, value]) => [name, { type: "plain_text", value }]))
-    }
+    catalogue: manifest.catalogue
   };
   const candidate = {
     apiVersion: "launchpad.m-kopa.us/v2",
     kind: "App",
     metadata: v2 ? manifest.metadata : { slug: manifest.metadata.name, schemaVersion: 2 },
-    spec: { ...spec, origin: "dispatch", auth: "gateway", confine_origin: undefined }
+    spec: {
+      ...spec,
+      ...d1 === undefined ? {} : { bindings: { d1 } },
+      env_vars: Object.keys(envVars).length === 0 ? undefined : envVars,
+      origin: "dispatch",
+      auth: "gateway",
+      confine_origin: undefined
+    }
   };
   const parsed = parseManifestV2(candidate);
   if (parsed.kind !== "ok") {
@@ -8675,7 +8703,7 @@ function dispatchManifest(manifest) {
 function assertConvertibleV1(manifest) {
   const unsupported2 = [
     manifest.hostnames !== undefined && "hostnames",
-    manifest.targets !== undefined && "targets",
+    manifest.targets !== undefined && pagesTargetD1(manifest) === undefined && "targets",
     manifest.access.session_duration !== undefined && "access.session_duration",
     manifest.deployment.runtime !== undefined && "deployment.runtime"
   ].filter(Boolean);
@@ -8683,12 +8711,224 @@ function assertConvertibleV1(manifest) {
     throw new Error(`Cannot preserve ${unsupported2.join(", ")} on dispatch. Review these settings with the platform team before migrating.`);
   }
 }
+function d1Binding(declared, wranglerD1) {
+  if (declared !== undefined && wranglerD1 !== undefined && declared !== wranglerD1) {
+    throw new Error(`The manifest binds D1 as ${declared} but the wrangler config binds ${wranglerD1}. Use one name for both.`);
+  }
+  return declared ?? wranglerD1;
+}
+function plainTextEnv(env) {
+  if (env === undefined)
+    return;
+  return Object.fromEntries(Object.entries(env).map(([name, value]) => [name, { type: "plain_text", value }]));
+}
+function secretEnv(secrets, env) {
+  const out = {};
+  for (const binding of secrets?.bindings ?? []) {
+    const refusal = secretRefusal(binding, env);
+    if (refusal !== undefined)
+      throw new Error(`Secret ${binding.name} ${refusal}`);
+    out[binding.name] = { type: "secret_text", secret_ref: binding.name };
+  }
+  return out;
+}
+function secretRefusal(binding, env) {
+  const targets = binding.targets === undefined || binding.targets === "all" ? [] : binding.targets;
+  const checks = [
+    [binding.source !== "env-file", "is platform-managed and cannot be converted automatically. Ask the platform team to migrate it."],
+    [targets.some((target) => target !== "primary"), "targets another surface, which dispatch does not have."],
+    [PLATFORM_ENV_NAMES.has(binding.name), "is set by the platform on dispatch apps. Rename it before converting."],
+    [env?.[binding.name] !== undefined, "is also declared as an environment variable. Keep one."]
+  ];
+  return checks.find(([refused]) => refused)?.[1];
+}
+function pagesTargetD1(manifest) {
+  const [target, ...rest] = manifest.targets ?? [];
+  if (rest.length > 0 || target?.kind !== "pages")
+    return;
+  return target.d1_binding;
+}
+
+// src/manifest/wrangler-config.ts
+var ALLOWED_KEYS = new Set([
+  "name",
+  "compatibility_date",
+  "compatibility_flags",
+  "pages_build_output_dir",
+  "d1_databases"
+]);
+var PLATFORM_FLAGS = new Set(["nodejs_compat"]);
+
+class UnsupportedWranglerConfigError extends Error {
+}
+function wranglerD1Binding(file, text) {
+  const toml = file.endsWith(".toml");
+  const config = toml ? readToml(file, text) : readJsonc(file, text);
+  for (const key of Object.keys(config)) {
+    if (!ALLOWED_KEYS.has(key) && (toml || key !== "$schema"))
+      throw unsupportedKey(file, key);
+  }
+  if (config.compatibility_flags !== undefined) {
+    const extra = asArray(file, "compatibility_flags", config.compatibility_flags).find((flag) => !PLATFORM_FLAGS.has(String(flag)));
+    if (extra !== undefined) {
+      throw new UnsupportedWranglerConfigError(`${file} sets compatibility flag \`${String(extra)}\`; dispatch runs with nodejs_compat only`);
+    }
+  }
+  if (config.d1_databases === undefined)
+    return;
+  const databases = asArray(file, "d1_databases", config.d1_databases);
+  if (databases.length !== 1) {
+    throw new UnsupportedWranglerConfigError(`${file} declares ${databases.length} \`d1_databases\` entries; dispatch binds exactly one D1 database`);
+  }
+  const binding = databases[0]?.binding;
+  if (typeof binding !== "string" || binding === "") {
+    throw new UnsupportedWranglerConfigError(`${file} has a \`d1_databases\` entry without a binding name`);
+  }
+  return binding;
+}
+function unsupportedKey(file, key) {
+  return new UnsupportedWranglerConfigError(`${file} sets \`${key}\`, which dispatch cannot preserve`);
+}
+function asArray(file, key, value) {
+  if (!Array.isArray(value))
+    throw new UnsupportedWranglerConfigError(`${file} sets \`${key}\` to something other than a list`);
+  return value;
+}
+function readJsonc(file, text) {
+  const stripped = stripOutsideStrings(text, '"', (at) => {
+    if (text.startsWith("//", at))
+      return lineEnd(text, at) - at;
+    if (!text.startsWith("/*", at))
+      return 0;
+    const end = text.indexOf("*/", at + 2);
+    return (end === -1 ? text.length : end + 2) - at;
+  }).replace(/,(\s*[}\]])/g, "$1");
+  let parsed;
+  try {
+    parsed = JSON.parse(stripped);
+  } catch {
+    throw new UnsupportedWranglerConfigError(`${file} could not be read as JSON`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new UnsupportedWranglerConfigError(`${file} is not a JSON object`);
+  }
+  return parsed;
+}
+function readToml(file, text) {
+  const config = {};
+  const databases = [];
+  let table = config;
+  for (const line of logicalTomlLines(text)) {
+    if (line.startsWith("[")) {
+      table = d1Table(file, line);
+      databases.push(table);
+    } else {
+      assign(file, table, line, table === config);
+    }
+  }
+  if (databases.length === 0)
+    return config;
+  if (config.d1_databases !== undefined)
+    throw new UnsupportedWranglerConfigError(`${file} declares d1_databases twice`);
+  return { ...config, d1_databases: databases };
+}
+function d1Table(file, line) {
+  const name = /^\[\[?\s*([^\]]*?)\s*\]\]?$/.exec(line)?.[1] ?? line;
+  if (!line.startsWith("[[") || name !== "d1_databases")
+    throw unsupportedKey(file, topKey(name));
+  return {};
+}
+function assign(file, table, line, topLevel) {
+  const assignment = /^([\w\-."]+)\s*=\s*(.*)$/.exec(line);
+  if (assignment === null)
+    throw new UnsupportedWranglerConfigError(`${file} could not be read as TOML near \`${line.slice(0, 40)}\``);
+  const key = topKey(assignment[1]);
+  if (topLevel && assignment[1].includes("."))
+    throw unsupportedKey(file, key);
+  table[key] = tomlValue(assignment[2].trim());
+}
+function topKey(dotted) {
+  return dotted.split(".")[0].replace(/"/g, "").trim();
+}
+function tomlValue(raw) {
+  const quoted = /^"((?:[^"\\]|\\.)*)"$|^'([^']*)'$/.exec(raw);
+  if (quoted !== null)
+    return quoted[1] ?? quoted[2];
+  if (!raw.startsWith("["))
+    return raw;
+  const inner = raw.slice(1, -1);
+  if (inner.includes("{")) {
+    return [...inner.matchAll(/\{([^}]*)\}/g)].map((table) => ({
+      binding: /(?:^|[\s,])binding\s*=\s*["']([^"']*)["']/.exec(table[1])?.[1]
+    }));
+  }
+  return [...inner.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'/g)].map((item) => item[1] ?? item[2]);
+}
+function logicalTomlLines(text) {
+  const stripped = stripOutsideStrings(text, `"'`, (at) => text[at] === "#" ? lineEnd(text, at) - at : 0);
+  const lines = [];
+  let pending = "";
+  for (const raw of stripped.split(/\r?\n/)) {
+    pending = `${pending} ${raw.trim()}`.trim();
+    if (pending === "" || openBrackets(pending) > 0)
+      continue;
+    lines.push(pending);
+    pending = "";
+  }
+  if (pending !== "")
+    lines.push(pending);
+  return lines;
+}
+function lineEnd(text, at) {
+  const end = text.indexOf(`
+`, at);
+  return end === -1 ? text.length : end;
+}
+function openBrackets(line) {
+  if (/^\[\[?[^\]=]*\]\]?$/.test(line))
+    return 0;
+  let open = 0;
+  stripOutsideStrings(line, `"'`, (at) => {
+    if (line[at] === "[" || line[at] === "{")
+      open++;
+    if (line[at] === "]" || line[at] === "}")
+      open--;
+    return 0;
+  });
+  return open;
+}
+function stripOutsideStrings(text, quotes, skip) {
+  let out = "";
+  for (let i = 0;i < text.length; ) {
+    if (quotes.includes(text[i])) {
+      const end = stringEnd(text, i);
+      out += text.slice(i, end);
+      i = end;
+      continue;
+    }
+    const skipped = skip(i);
+    if (skipped === 0)
+      out += text[i];
+    i += Math.max(skipped, 1);
+  }
+  return out;
+}
+function stringEnd(text, start) {
+  const quote = text[start];
+  for (let i = start + 1;i < text.length; i++) {
+    if (text[i] === "\\" && quote === '"')
+      i++;
+    else if (text[i] === quote)
+      return i + 1;
+  }
+  return text.length;
+}
 
 // src/commands/migrate.ts
 var USAGE = "usage: launchpad migrate --origin dispatch [--dry-run]";
 var migrateCommand = {
   name: "migrate",
-  summary: "convert an unprovisioned static or React app to Workers dispatch",
+  summary: "convert an unprovisioned static, React or React API app to Workers dispatch",
   run: runMigrate
 };
 async function runMigrate(args, io) {
@@ -8711,6 +8951,9 @@ async function runMigrate(args, io) {
       io.out(`${result.slug}: launchpad.yaml now uses v2 Workers dispatch with gateway authentication.`);
       io.out(`Audience, owner and application settings are preserved. Original: ${BACKUP_PATH}`);
       io.out("Run `launchpad deploy`. No Pages project is needed.");
+      const next = secretsNextStep(result.secrets);
+      if (next !== null)
+        io.out(next);
     }
     return 0;
   } catch (error) {
@@ -8719,6 +8962,11 @@ async function runMigrate(args, io) {
   }
 }
 var BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+function secretsNextStep(secrets) {
+  if (secrets.length === 0)
+    return null;
+  return `Secrets (${secrets.join(", ")}) carry over as secret_text env vars. Once \`launchpad status\` shows the first deploy delivered, run \`launchpad secrets push\` to set them.`;
+}
 async function convertToDispatch(cwd, dryRun) {
   const file = path8.join(cwd, "launchpad.yaml");
   if (!lstatSync4(file).isFile())
@@ -8730,18 +8978,38 @@ async function convertToDispatch(cwd, dryRun) {
   const manifest = loaded.manifest;
   if (manifest.apiVersion === "launchpad.m-kopa.us/v2" && manifest.spec.origin === "dispatch")
     return { kind: "already" };
-  const converted = dispatchManifest(manifest);
-  assertNoCustomRuntime(cwd, converted);
-  const slug = converted.metadata.slug;
+  const slug = manifest.apiVersion === "launchpad.m-kopa.us/v2" ? manifest.metadata.slug : manifest.metadata.name;
+  let converted;
+  try {
+    converted = convertLocally(cwd, manifest);
+  } catch (error) {
+    await refuseIfRegistered(slug);
+    throw error;
+  }
   await assertUnregistered(slug);
+  const secrets = Object.entries(converted.spec.env_vars ?? {}).filter(([, value]) => value.type === "secret_text").map(([name]) => name);
   if (dryRun)
-    return { kind: "eligible", slug };
+    return { kind: "eligible", slug, secrets };
   try {
     saveMigration(file, original, converted);
   } catch (error) {
     throw new MigrationSaveError(error);
   }
-  return { kind: "converted", slug };
+  return { kind: "converted", slug, secrets };
+}
+function convertLocally(cwd, manifest) {
+  const v2 = manifest.apiVersion === "launchpad.m-kopa.us/v2";
+  const spec = v2 ? manifest.spec : manifest;
+  const appType = v2 ? manifest.spec.appType : manifest.deployment.type;
+  return dispatchManifest(manifest, inspectRuntime(cwd, appType, spec.app?.root, spec.build));
+}
+async function refuseIfRegistered(slug) {
+  try {
+    await assertUnregistered(slug);
+  } catch (error) {
+    if (error instanceof RegisteredAppError)
+      throw error;
+  }
 }
 async function assertUnregistered(slug) {
   try {
@@ -8773,23 +9041,54 @@ class RegisteredAppError extends Error {
     super("This app is already registered. This command only converts apps that have never provisioned; ask the platform team to migrate an existing app.");
   }
 }
-function assertNoCustomRuntime(cwd, manifest) {
-  const appRoot = path8.resolve(cwd, manifest.spec.app?.root ?? ".");
-  const buildRoot = path8.resolve(appRoot, manifest.spec.build?.root_dir ?? ".");
-  const roots = new Set([
+var WRANGLER_FILES = ["wrangler.toml", "wrangler.json", "wrangler.jsonc"];
+function inspectRuntime(cwd, appType, appRootDir, build) {
+  const d1 = new Set;
+  for (const root of runtimeRoots(cwd, appRootDir, build)) {
+    assertNoUncompiledCode(root, appType);
+    for (const binding2 of wranglerD1Bindings(cwd, root))
+      d1.add(binding2);
+  }
+  if (d1.size > 1)
+    throw new Error(`The wrangler configs bind D1 under different names (${[...d1].join(", ")}). Use one name.`);
+  const [binding] = d1;
+  if (binding !== undefined && appType !== "react+api") {
+    throw new Error("The wrangler config declares a D1 database, which only react+api apps can use on dispatch.");
+  }
+  return binding;
+}
+function runtimeRoots(cwd, appRootDir, build) {
+  const appRoot = path8.resolve(cwd, appRootDir ?? ".");
+  const buildRoot = path8.resolve(appRoot, build?.root_dir ?? ".");
+  return new Set([
     cwd,
     appRoot,
     buildRoot,
-    path8.resolve(cwd, manifest.spec.build?.root_dir ?? "."),
-    path8.resolve(buildRoot, manifest.spec.build?.destination_dir ?? "dist")
+    path8.resolve(cwd, build?.root_dir ?? "."),
+    path8.resolve(buildRoot, build?.destination_dir ?? "dist")
   ]);
-  for (const root of roots) {
-    for (const name of ["functions", "_worker.js", "wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
-      if (existsSync7(path8.join(root, name))) {
-        throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker bindings must not be dropped. Ask the platform team to review this app.`);
-      }
+}
+function assertNoUncompiledCode(root, appType) {
+  const api = appType === "react+api";
+  for (const name of api ? ["_worker.js"] : ["_worker.js", "functions"]) {
+    if (existsSync7(path8.join(root, name))) {
+      throw new Error(`${name} needs a runtime review before conversion. Pages Functions and custom Worker code must not be dropped. Ask the platform team to review this app.`);
     }
   }
+  if (api)
+    assertWorkerRoutesFit(root);
+}
+function wranglerD1Bindings(cwd, root) {
+  return WRANGLER_FILES.map((name) => path8.join(root, name)).filter((file) => existsSync7(file)).map((file) => wranglerD1Binding(path8.relative(cwd, file), readFileSync11(file, "utf8"))).filter((binding) => binding !== undefined);
+}
+function assertWorkerRoutesFit(root) {
+  const functions = path8.join(root, "functions");
+  if (!existsSync7(functions) || !lstatSync4(functions).isDirectory())
+    return;
+  const catchAll = readdirSync2(functions).find((name) => /^_middleware\.[cm]?[jt]sx?$/.test(name) || name.startsWith("["));
+  if (catchAll !== undefined) {
+    throw new Error(`functions/${catchAll} would run the Worker for every path, including static assets, which dispatch does not support. Move it under a prefix such as functions/api/.`);
+  }
 }
 function saveMigration(file, original, converted) {
   if (readFileSync11(file, "utf8") !== original)
@@ -9602,24 +9901,12 @@ function isIneligible(e) {
   return !(e instanceof RegistryUnavailableError || e instanceof MigrationSaveError || e instanceof UpgradeRequiredError || e instanceof UnauthenticatedError);
 }
 async function defaultToDispatch(cwd, manifestPath, io) {
-  let raw;
-  try {
-    raw = parseYaml6(readFileSync12(manifestPath, "utf8"));
-  } catch {
-    return null;
-  }
-  const isV22 = raw?.apiVersion === "launchpad.m-kopa.us/v2";
-  const appType = isV22 ? raw?.spec?.appType : raw?.deployment?.type;
-  const origin = isV22 ? raw?.spec?.origin : raw?.origin;
-  const auth = isV22 ? raw?.spec?.auth : raw?.auth;
-  if (appType !== "static" && appType !== "react" || origin !== undefined || auth !== "gateway")
+  if (!impliesPagesForGateway(manifestPath))
     return null;
   try {
-    if ((await convertToDispatch(cwd, false)).kind === "converted") {
-      io.out("New apps deploy on Workers dispatch by default, so launchpad.yaml was converted (no Pages project needed).");
-      io.out(`  Audience, owner and build settings are preserved. Original: ${BACKUP_PATH}`);
-      io.out("  To stay on Pages instead, set `spec.origin: pages` and deploy again.");
-    }
+    const result = await convertToDispatch(cwd, false);
+    if (result.kind === "converted")
+      reportConversion(io, result.secrets);
     return null;
   } catch (e) {
     if (e instanceof RegisteredAppError)
@@ -9629,6 +9916,30 @@ async function defaultToDispatch(cwd, manifestPath, io) {
     return `Not converted to Workers dispatch: ${describe17(e)}`;
   }
 }
+var CONVERTIBLE_APP_TYPES = new Set(["static", "react", "react+api"]);
+function impliesPagesForGateway(manifestPath) {
+  const fields = originFields(manifestPath);
+  return CONVERTIBLE_APP_TYPES.has(fields.appType) && fields.origin === undefined && fields.auth === "gateway";
+}
+function originFields(manifestPath) {
+  let raw;
+  try {
+    raw = parseYaml6(readFileSync12(manifestPath, "utf8")) ?? {};
+  } catch {
+    return {};
+  }
+  if (raw.apiVersion === "launchpad.m-kopa.us/v2")
+    return raw.spec ?? {};
+  return { origin: raw.origin, auth: raw.auth, appType: raw.deployment?.type };
+}
+function reportConversion(io, secrets) {
+  io.out("New apps deploy on Workers dispatch by default, so launchpad.yaml was converted (no Pages project needed).");
+  io.out(`  Audience, owner and build settings are preserved. Original: ${BACKUP_PATH}`);
+  io.out(`  To stay on Pages instead, restore ${BACKUP_PATH} as launchpad.yaml, set \`origin: pages\` (v1) or \`spec.origin: pages\` (v2) and deploy again.`);
+  const next = secretsNextStep(secrets);
+  if (next !== null)
+    io.out(`  ${next}`);
+}
 function declaredOriginOf(isV22, origin) {
   if (!isV22)
     return "pages";
@@ -11084,10 +11395,6 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
     return 64;
   }
   const dispatch = newAppOrigin(fillResult.inputs.type, inputs.origin) === "dispatch";
-  if (dispatch && fillResult.inputs.type === "react+api") {
-    io.err("launchpad init: API starter dispatch is not available yet; use --origin pages");
-    return 64;
-  }
   if (dispatch && (inputs.hostnames.length > 0 || inputs.sessionDuration !== undefined)) {
     io.err("launchpad init: dispatch does not support --hostname or --session-duration; use --origin pages for a Pages manifest");
     return 64;
@@ -11159,11 +11466,10 @@ async function runInit(args, io, prompt, identity = () => apiJson(loadConfig(),
   io.out("");
   io.out("Next steps:");
   io.out("  launchpad validate                # confirm the manifest");
-  if (!dispatch)
-    io.out("  launchpad secrets template        # scaffold .env.example");
+  io.out("  launchpad secrets template        # scaffold .env.example");
   io.out("  launchpad deploy                  # build and deploy the app");
   if (dispatch)
-    io.out("  Dispatch currently supports plain-text environment variables, but not secret bindings.");
+    io.out("  Push secrets with `launchpad secrets push` once the first deploy has been delivered.");
   return 0;
 }
 function parseArgs6(args) {
@@ -11215,11 +11521,11 @@ function parseArgs6(args) {
       i++;
       return next;
     };
-    const setFromNext = (assign) => {
+    const setFromNext = (assign2) => {
       const got = needsValue();
       if (typeof got !== "string")
         return got;
-      assign(got);
+      assign2(got);
       return;
     };
     if (a === "--name") {
@@ -12096,6 +12402,20 @@ function describe25(e) {
 
 // src/commands/plan.ts
 import { resolve as resolve12 } from "node:path";
+
+// src/manifest/container-runtime-warnings.ts
+var CONTAINER_RUNTIME_GATE_WARNING = "Container apps are gated by the platform runtime switch; `launchpad deploy` may return " + "503 container_runtime_off until the platform team enables your app. See docs/concepts/containers.md.";
+var RUNTIME_ACA_RESERVED_WARNING = "deployment.runtime: aca is reserved and currently ignored — the app runs on cloudflare-containers " + "regardless. See docs/concepts/containers.md.";
+function containerRuntimeWarnings(view) {
+  if (view.deploymentType !== "container")
+    return [];
+  const warnings = [CONTAINER_RUNTIME_GATE_WARNING];
+  if (view.runtime === "aca")
+    warnings.push(RUNTIME_ACA_RESERVED_WARNING);
+  return warnings;
+}
+
+// src/commands/plan.ts
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -12127,7 +12447,15 @@ function renderJson(result, io) {
   switch (result.kind) {
     case "ok": {
       const plan = derivePlan(result.manifest);
-      io.out(JSON.stringify({ ok: true, ...plan }));
+      const warnings = containerRuntimeWarnings({
+        deploymentType: plan.desired.app.deploymentType,
+        runtime: plan.desired.app.runtime
+      });
+      io.out(JSON.stringify({
+        ok: true,
+        ...plan,
+        ...warnings.length > 0 ? { warnings } : {}
+      }));
       return 0;
     }
     case "file-not-found":
@@ -12237,6 +12565,12 @@ function renderPlan(m, io) {
     }
     io.out("");
   }
+  for (const w of containerRuntimeWarnings({
+    deploymentType: desired.app.deploymentType,
+    runtime: desired.app.runtime
+  })) {
+    io.out(`⚠ ${w}`);
+  }
   const totalBindings = desired.secrets.envFile.length + desired.secrets.platformManaged.length;
   io.out(`Secrets (${totalBindings})`);
   if (totalBindings === 0) {
@@ -13974,6 +14308,22 @@ function parseEnv(text) {
   return { entries, invalidNames, malformedLines };
 }
 
+// src/secrets/declared.ts
+function declaredSecrets(loaded) {
+  if (loaded.schema === "launchpad.m-kopa.us/v1alpha1") {
+    const m2 = loaded.manifest;
+    return { slug: m2.metadata.name, apiVersion: m2.apiVersion, bindings: m2.secrets?.bindings ?? [] };
+  }
+  const m = loaded.manifest;
+  const envVars = m.spec.appType === "container" ? {} : m.spec.env_vars ?? {};
+  const fromEnvVars = Object.entries(envVars).filter(([, v]) => v.type === "secret_text").map(([name]) => ({ name, source: "env-file" }));
+  return {
+    slug: m.metadata.slug,
+    apiVersion: m.apiVersion,
+    bindings: [...m.spec.secrets?.bindings ?? [], ...fromEnvVars]
+  };
+}
+
 // src/secrets/push.ts
 async function runSecretsPush(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
@@ -13983,14 +14333,10 @@ async function runSecretsPush(opts, io, deps = {}) {
   if (loaded.kind !== "ok") {
     return renderManifestError4(loaded, io);
   }
-  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets push", io);
-  if (v2Refusal !== null)
-    return v2Refusal;
-  const manifest = loaded.manifest;
-  const bindings = manifest.secrets?.bindings ?? [];
+  const { slug, bindings } = declaredSecrets(loaded);
   const envFileBindings = bindings.filter((b) => b.source === "env-file");
   if (envFileBindings.length === 0) {
-    io.out("No `env-file` secret bindings declared in the manifest.");
+    io.out("No secrets to push: the manifest declares no `env-file` bindings or `secret_text` env vars.");
     io.out("(platform-managed bindings are pushed via the platform-team ops path.)");
     return 0;
   }
@@ -14069,11 +14415,11 @@ async function runSecretsPush(opts, io, deps = {}) {
     io.out("Re-run without --dry-run to push.");
     return 0;
   }
-  const slug = manifest.metadata.name;
   let pushed = 0;
   let partial = 0;
   let anyPagesUpdated = false;
   let anyWorkerUpdated = false;
+  let anyDispatchUpdated = false;
   for (const b of envFileBindings) {
     const value = parsed.entries.get(b.name);
     io.out(`Pushing ${b.name} …`);
@@ -14094,6 +14440,11 @@ async function runSecretsPush(opts, io, deps = {}) {
       io.err(`✗ secrets push ${b.name}: invalid bot response (results must be an array)`);
       return 2;
     }
+    if (resp.error === "dispatch_script_not_delivered") {
+      io.err(`✗ secrets push ${b.name}: ${resp.message ?? "the dispatch script is not delivered yet"}`);
+      io.err(`${pushed} of ${envFileBindings.length} pushed before failure.`);
+      return 1;
+    }
     const results = resp.results ?? [];
     for (const r of results) {
       if (r.status !== "updated")
@@ -14102,6 +14453,8 @@ async function runSecretsPush(opts, io, deps = {}) {
         anyPagesUpdated = true;
       else if (r.kind === "worker")
         anyWorkerUpdated = true;
+      else if (r.kind === "dispatch")
+        anyDispatchUpdated = true;
     }
     const notUpdated = results.filter((r) => r.status !== "updated");
     if (resp.updated === true && notUpdated.length === 0) {
@@ -14125,7 +14478,9 @@ async function runSecretsPush(opts, io, deps = {}) {
   if (anyPagesUpdated) {
     return offerRedeploy(slug, opts, io, deps);
   }
-  if (anyWorkerUpdated) {
+  if (anyDispatchUpdated) {
+    io.out("Set on the app's dispatch Worker and live now - no redeploy needed.");
+  } else if (anyWorkerUpdated) {
     io.out("These secrets bind on the app's next invocation — no redeploy needed.");
   }
   return 0;
@@ -14194,20 +14549,6 @@ function mapPushError(e, slug, name, io) {
 function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
-function refuseV2Manifest(loaded, command, io) {
-  if (loaded.schema !== "launchpad.m-kopa.us/v2")
-    return null;
-  const origin = loaded.manifest.spec?.origin;
-  if (origin === "dispatch") {
-    io.err(`${command}: this is a dispatch-origin (v2) app.`);
-    const outcome = command.endsWith("push") ? "nothing was pushed" : "nothing was read";
-    io.err(`  Secrets are not delivered to the dispatch namespace yet (PS-2740); ${outcome}.`);
-    return 1;
-  }
-  io.err(`${command}: this is a launchpad.m-kopa.us/v2 manifest.`);
-  io.err("  This command reads v1alpha1 `secrets.bindings`; v2 declares secrets as `spec.env_vars` `secret_text` entries, which it does not push yet.");
-  return 1;
-}
 function renderManifestError4(result, io) {
   switch (result.kind) {
     case "ok":
@@ -14248,17 +14589,12 @@ async function runSecretsStatus(opts, io, deps = {}) {
   const loaded = loadManifestAnyVersion(manifestPath);
   if (loaded.kind !== "ok")
     return renderManifestError5(loaded, io);
-  const v2Refusal = refuseV2Manifest(loaded, "launchpad secrets status", io);
-  if (v2Refusal !== null)
-    return v2Refusal;
-  const manifest = loaded.manifest;
-  const slug = manifest.metadata.name;
+  const { slug, bindings } = declaredSecrets(loaded);
   if (opts.slug != null && opts.slug !== slug) {
     io.err(`launchpad secrets status: slug "${opts.slug}" does not match this directory's ` + `manifest (metadata.name: "${slug}").`);
     io.err("  secrets status audits the manifest in the current directory — omit the slug, " + "or run from the app's directory.");
     return 2;
   }
-  const bindings = manifest.secrets?.bindings ?? [];
   if (bindings.length === 0) {
     io.out("No secret bindings declared in the manifest.");
     return 0;
@@ -14608,12 +14944,12 @@ async function runSecretsTemplate(args, io) {
     return 64;
   }
   const manifestPath = resolve14(process.cwd(), flags.file ?? "launchpad.yaml");
-  const result = loadManifest(manifestPath);
-  const renderResult = renderManifest(result, io);
+  const renderResult = renderManifest(loadManifestAnyVersion(manifestPath), io);
   if (renderResult.kind !== "ok") {
     return renderResult.code;
   }
-  const body = buildTemplate(renderResult.manifest, flags.includePlatformManaged);
+  const declared = renderResult.declared;
+  const body = buildTemplate(declared, flags.includePlatformManaged);
   if (flags.toStdout) {
     for (const line of body.split(`
 `)) {
@@ -14636,14 +14972,14 @@ async function runSecretsTemplate(args, io) {
     return 2;
   }
   io.out(`✓ wrote ${outPath}`);
-  const bindings = result.kind === "ok" ? countBindings(result.manifest) : { total: 0, written: 0 };
-  io.out(`  ${bindings.written} binding${bindings.written === 1 ? "" : "s"} scaffolded`);
+  const written = declared.bindings.filter((b) => b.source === "env-file").length;
+  io.out(`  ${written} binding${written === 1 ? "" : "s"} scaffolded`);
   return 0;
 }
 function renderManifest(result, io) {
   switch (result.kind) {
     case "ok":
-      return { kind: "ok", manifest: result.manifest };
+      return { kind: "ok", declared: declaredSecrets(result) };
     case "file-not-found":
       io.err(`launchpad secrets template: ${result.path}`);
       io.err("  manifest not found");
@@ -14665,19 +15001,19 @@ function renderManifest(result, io) {
       return { kind: "fail", code: 1 };
   }
 }
-function buildTemplate(manifest, includePlatformManaged) {
-  const bindings = manifest.secrets?.bindings ?? [];
+function buildTemplate(declared, includePlatformManaged) {
+  const { bindings } = declared;
   const lines = [];
   lines.push("# Auto-generated by `launchpad secrets template` — do not commit values.");
-  lines.push(`# Source: launchpad.yaml (apiVersion: ${manifest.apiVersion})`);
-  lines.push(`# App:    ${manifest.metadata.name}`);
+  lines.push(`# Source: launchpad.yaml (apiVersion: ${declared.apiVersion})`);
+  lines.push(`# App:    ${declared.slug}`);
   lines.push("#");
   lines.push("# Fill in values, then run `launchpad secrets push`.");
   lines.push("# This file is meant to be committed; the real `.env` must be gitignored.");
   lines.push("");
   if (bindings.length === 0) {
     lines.push("# No secret bindings declared in launchpad.yaml.");
-    lines.push("# Add entries under `secrets.bindings[]` and re-run this command.");
+    lines.push("# Add entries under `secrets.bindings[]` (v1alpha1) or `spec.env_vars` with " + "`type: secret_text` (v2) and re-run this command.");
     lines.push("");
     return lines.join(`
 `);
@@ -14711,11 +15047,6 @@ function buildTemplate(manifest, includePlatformManaged) {
   return lines.join(`
 `);
 }
-function countBindings(manifest) {
-  const bindings = manifest.secrets?.bindings ?? [];
-  const written = bindings.filter((b) => b.source === "env-file").length;
-  return { total: bindings.length, written };
-}
 function parseFlags4(args) {
   let file;
   let out = ".env.example";
@@ -14924,7 +15255,7 @@ import { promises as fs7, existsSync as existsSync16 } from "node:fs";
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join15 } from "node:path";
-import { readFileSync as readFileSync20, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync20, readdirSync as readdirSync3 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
   return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
@@ -14932,7 +15263,7 @@ function skillsTargetDir() {
 function readInstalledSkills() {
   try {
     const dir = skillsTargetDir();
-    const bundle = readdirSync2(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
+    const bundle = readdirSync3(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
     if (!bundle)
       return { present: false, version: null };
     return {
@@ -15622,7 +15953,7 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync22, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -15713,7 +16044,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   }
   let entries;
   try {
-    entries = readdirSync3(abs);
+    entries = readdirSync4(abs);
   } catch (e) {
     return [`failed to read static served directory '${serveDir}/': ${describe32(e)}`];
   }
@@ -15803,6 +16134,9 @@ function renderHumanOk(result, group, boundary, io) {
   if (!boundary.declared) {
     io.out(`⚠ ${DECLARE_APP_HINT}`);
   }
+  for (const w of containerRuntimeWarnings(view)) {
+    io.out(`⚠ ${w}`);
+  }
   switch (group.kind) {
     case "skipped":
       return 0;
@@ -15869,6 +16203,7 @@ function renderHumanError(result, io) {
 }
 function renderJsonOk(result, group, boundary, io) {
   const view = manifestView(result.manifest);
+  const runtimeWarnings = containerRuntimeWarnings(view);
   const base = {
     manifest_valid: true,
     runtime_supported: true,
@@ -15878,7 +16213,8 @@ function renderJsonOk(result, group, boundary, io) {
       declared: boundary.declared,
       errors: boundary.errors,
       warnings: boundary.warnings
-    }
+    },
+    ...runtimeWarnings.length > 0 ? { warnings: runtimeWarnings } : {}
   };
   if (boundary.errors.length > 0) {
     io.out(JSON.stringify({ ok: false, ...base }));
@@ -15967,7 +16303,8 @@ function manifestView(manifest) {
       access: manifest.spec.access,
       buildCommand: manifest.spec.build?.command,
       destinationDir: manifest.spec.build?.destination_dir,
-      appDeclared: manifest.spec.app !== undefined
+      appDeclared: manifest.spec.app !== undefined,
+      runtime: undefined
     };
   }
   return {
@@ -15976,7 +16313,8 @@ function manifestView(manifest) {
     access: manifest.access,
     buildCommand: manifest.build?.command,
     destinationDir: manifest.build?.destination_dir,
-    appDeclared: manifest.app !== undefined
+    appDeclared: manifest.app !== undefined,
+    runtime: manifest.deployment.runtime
   };
 }
 function parseArgs13(args) {