@m-kopa/launchpad-cli 0.63.0 → 0.65.0

package/dist/commands/deploy.d.ts

@@ -24,7 +24,7 @@ export declare function parseArgs(args: readonly string[]): DeployArgs | null;
 /** Re-export for tests. */
 export { MAX_COMPRESSED_TARBALL_BYTES };
 /**
- * Workers dispatch is the default for new static and React apps. Before a
+ * Workers dispatch is the default for new static, React and React API apps. Before a
  * first deploy, convert a gateway manifest that only implies Pages (no
  * `origin` in v1 or v2) to v2 dispatch. An explicit origin is an opt-out and
  * registered apps keep their origin. Returns a note explaining why the deploy

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA8uBxC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6B5G;AAED,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA0EA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6RD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA4BpE;AAiMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA8uBxC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY5G;AAkCD,2EAA2E;AAC3E;+EAC+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAG/E;AAED;;;4EAG4E;AAC5E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD,GAAG,OAAO,CAIV;AAED,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,OAAO,EACvB,UAAU,GAAE,OAAO,GAAG,SAAqB,GAC1C,MAAM,CAOR"}

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAK7D,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,EAChB,QAAQ,GAAE,MAAM,OAAO,CAAC,YAAY,CAAuE,GAC1G,OAAO,CAAC,QAAQ,CAAC,CA8LnB"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAK7D,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,iFAAiF;IACjF,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,QAAQ,EAChB,QAAQ,GAAE,MAAM,OAAO,CAAC,YAAY,CAAuE,GAC1G,OAAO,CAAC,QAAQ,CAAC,CA0LnB"}

package/dist/commands/migrate.d.ts

@@ -1,11 +1,15 @@
 import type { Command } from "../dispatcher.js";
 export declare const migrateCommand: Command;
 export declare const BACKUP_PATH = ".launchpad/manifest-before-dispatch.yaml";
+/** Dispatch secrets land on the Worker script, which exists only after the first delivery. */
+export declare function secretsNextStep(secrets: readonly string[]): string | null;
 export type DispatchConversion = {
     readonly kind: "already";
 } | {
     readonly kind: "eligible" | "converted";
     readonly slug: string;
+    /** Secret names the converted manifest declares; set with `secrets push` after first delivery. */
+    readonly secrets: readonly string[];
 };
 /**
  * Convert `<cwd>/launchpad.yaml` to a v2 dispatch manifest, or report that it

package/dist/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC;AA+BF,eAAO,MAAM,WAAW,6CAA6C,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmBjG;AAcD,yFAAyF;AACzF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAG3B;AAED,yFAAyF;AACzF,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,KAAK;;CAI5C"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIvD,eAAO,MAAM,cAAc,EAAE,OAI5B,CAAC;AAiCF,eAAO,MAAM,WAAW,6CAA6C,CAAC;AAEtE,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAGzE;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEN;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0BjG;AAkCD,yFAAyF;AACzF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAG3B;AAED,yFAAyF;AACzF,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,KAAK;;CAI5C"}

package/dist/commands/plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/commands/plan.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC"}
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/commands/plan.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAMjE,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC"}

package/dist/commands/secrets-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-template.d.ts","sourceRoot":"","sources":["../../src/commands/secrets-template.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgBxD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}
+{"version":3,"file":"secrets-template.d.ts","sourceRoot":"","sources":["../../src/commands/secrets-template.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgBxD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}

package/dist/commands/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,eAAO,MAAM,eAAe,EAAE,OAI7B,CAAC"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,eAAO,MAAM,eAAe,EAAE,OAI7B,CAAC"}

package/dist/manifest/container-runtime-warnings.d.ts

@@ -0,0 +1,13 @@
+export declare const CONTAINER_RUNTIME_GATE_WARNING: string;
+export declare const RUNTIME_ACA_RESERVED_WARNING: string;
+/**
+ * Non-blocking advisories for a manifest, derived from its deployment
+ * type and (v1alpha1-only) runtime field. Empty for any non-container
+ * manifest, so callers can spread/append it without a type-specific
+ * branch.
+ */
+export declare function containerRuntimeWarnings(view: {
+    readonly deploymentType: string;
+    readonly runtime: string | undefined;
+}): readonly string[];
+//# sourceMappingURL=container-runtime-warnings.d.ts.map

package/dist/manifest/container-runtime-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-runtime-warnings.d.ts","sourceRoot":"","sources":["../../src/manifest/container-runtime-warnings.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,8BAA8B,QAE6D,CAAC;AAOzG,eAAO,MAAM,4BAA4B,QAEO,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,GAAG,SAAS,MAAM,EAAE,CAKpB"}

package/dist/manifest/migrate-dispatch.d.ts

@@ -1,4 +1,14 @@
-import { type DeploymentManifest, type ManifestV2 } from "@m-kopa/launchpad-engine";
-/** Convert only the static subset whose deployment contract dispatch preserves. */
-export declare function dispatchManifest(manifest: DeploymentManifest): ManifestV2;
+import { type DeploymentManifest, type Manifest, type ManifestV2 } from "@m-kopa/launchpad-engine";
+/**
+ * Convert a Pages-implied manifest to v2 dispatch, keeping only what the
+ * dispatch runtime preserves. `wranglerD1` is the D1 binding the app's
+ * wrangler config declares, already checked by the caller.
+ */
+export declare function dispatchManifest(manifest: DeploymentManifest, wranglerD1?: string): ManifestV2;
+/**
+ * The D1 binding name when `targets` is exactly one pages target carrying
+ * `d1_binding`. Dispatch declares that database as `spec.bindings.d1`; every
+ * other target shape (cron Workers, secrets surfaces) has no dispatch form.
+ */
+export declare function pagesTargetD1(manifest: Pick<Manifest, "targets">): string | undefined;
 //# sourceMappingURL=migrate-dispatch.d.ts.map

package/dist/manifest/migrate-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-dispatch.d.ts","sourceRoot":"","sources":["../../src/manifest/migrate-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAElC,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,UAAU,CAkDzE"}
+{"version":3,"file":"migrate-dispatch.d.ts","sourceRoot":"","sources":["../../src/manifest/migrate-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,QAAQ,EACb,KAAK,UAAU,EAGhB,MAAM,0BAA0B,CAAC;AAOlC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,CAgD9F;AAuDD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAIrF"}

package/dist/manifest/wrangler-config.d.ts

@@ -0,0 +1,3 @@
+/** The D1 binding a wrangler config declares, if any. Throws on anything else. */
+export declare function wranglerD1Binding(file: string, text: string): string | undefined;
+//# sourceMappingURL=wrangler-config.d.ts.map

package/dist/manifest/wrangler-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-config.d.ts","sourceRoot":"","sources":["../../src/manifest/wrangler-config.ts"],"names":[],"mappings":"AAoBA,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuBhF"}

package/dist/secrets/declared.d.ts

@@ -0,0 +1,12 @@
+import type { SecretBinding } from "@m-kopa/launchpad-engine";
+import type { AnyVersionLoadResult } from "../manifest/load.js";
+export interface DeclaredSecrets {
+    readonly slug: string;
+    readonly apiVersion: string;
+    readonly bindings: readonly SecretBinding[];
+}
+/** Normalise a loaded manifest's secret declarations to v1-shaped bindings. */
+export declare function declaredSecrets(loaded: Extract<AnyVersionLoadResult, {
+    kind: "ok";
+}>): DeclaredSecrets;
+//# sourceMappingURL=declared.d.ts.map

package/dist/secrets/declared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared.d.ts","sourceRoot":"","sources":["../../src/secrets/declared.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAc,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GACpD,eAAe,CAiBjB"}

package/dist/secrets/push.d.ts

@@ -1,5 +1,4 @@
 import { type CliConfig } from "../config.js";
-import { type AnyVersionLoadResult } from "../manifest/load.js";
 import { type RedeployOptions, type RedeployDeps } from "../commands/redeploy.js";
 import type { CliIo, ExitCode } from "../dispatcher.js";
 export interface PushOptions {
@@ -26,11 +25,4 @@ export interface PushDeps {
     readonly runRedeploy?: (opts: RedeployOptions, io: CliIo, deps?: RedeployDeps) => Promise<ExitCode>;
 }
 export declare function runSecretsPush(opts: PushOptions, io: CliIo, deps?: PushDeps): Promise<ExitCode>;
-/** v2 manifests carry no `secrets.bindings`. On `origin: dispatch` the bot
- *  refuses too (PS-2740), so say so here before any .env is read; on a v2
- *  pages app say what this command reads today instead of reporting
- *  "no bindings declared", which would be false. Returns null for v1alpha1. */
-export declare function refuseV2Manifest(loaded: Extract<AnyVersionLoadResult, {
-    kind: "ok";
-}>, command: string, io: CliIo): ExitCode | null;
 //# sourceMappingURL=push.d.ts.map

package/dist/secrets/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/secrets/push.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAcD,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CA+MnB;AAyGD;;;+EAG+E;AAC/E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,EACrD,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,KAAK,GACR,QAAQ,GAAG,IAAI,CAYjB"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/secrets/push.ts"],"names":[],"mappings":"AAoDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY1D,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAiBD,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CAoNnB"}

package/dist/secrets/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAa1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAkBD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CA0EnB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAkBD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CAoEnB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.63.0";
+export declare const CLI_VERSION = "0.65.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
@@ -37,8 +37,8 @@
   },
   "devDependencies": {
     "@types/node": "22.18.10",
-    "@typescript-eslint/eslint-plugin": "8.46.4",
-    "@typescript-eslint/parser": "8.46.4",
+    "@typescript-eslint/eslint-plugin": "8.71.0",
+    "@typescript-eslint/parser": "8.71.0",
     "@vitest/coverage-istanbul": "4.1.5",
     "eslint": "9.39.4",
     "typescript": "5.9.3",

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -149,25 +149,37 @@ resolve it by passing `--type` explicitly or skipping detection with
 launchpad init
 ```
 
-New `static` and `react` apps default to Workers dispatch with gateway authentication.
+New `static`, `react` and `react+api` apps default to Workers dispatch with gateway authentication.
 The CLI writes a v2 manifest and keeps the detected build settings and access groups.
-Gateway placement is automatic for new gateway-fronted apps, including Pages API starters.
+Gateway placement is automatic for new gateway-fronted apps, including API apps.
 The platform selects the configured gateway with the most free hostname slots, counting pending deployments as reservations.
 Do not ask the author to choose a gateway or add gateway project names to the manifest.
 Existing apps and retries retain their assigned gateway and public URL.
-An older manifest that only implies Pages (v1, or v2 without `spec.origin`) is converted to dispatch automatically on the first `launchpad deploy` of an unregistered static or React app.
+An older manifest that only implies Pages (v1, or v2 without `spec.origin`) is converted to dispatch automatically on the first `launchpad deploy` of an unregistered static, React or React API app.
 Tell the author when deploy reports the conversion, and point them at the backup in `.launchpad/manifest-before-dispatch.yaml`.
 `launchpad migrate --origin dispatch --dry-run` runs the same check without deploying, if the author wants to see it first.
 If deploy prints `Not converted to Workers dispatch`, the deploy continues on Pages; tell the author the reason, and do not delete files or change `appType` to force the conversion.
 Do not regenerate the manifest with `init`, broaden its groups, or change private ownership to work around the quota.
 If `launchpad migrate` refuses functions, custom runtime configuration or bindings, explain the named limitation; a normal `launchpad deploy` still works on Pages.
-Pages Functions apps need a compiled Worker build; changing `appType` to `react` would not convert their API.
+For a React API app, `functions/` converts as-is and the dispatch build compiles it; its D1 becomes `spec.bindings.d1` and declared secrets become `secret_text` env vars.
+When deploy says secrets carried over, tell the author to run `launchpad secrets push` once `launchpad status` shows the first delivery; pushing earlier fails with `dispatch_script_not_delivered`.
+Still refused on dispatch, with the reason printed: wrangler settings beyond name, compatibility date/flags, `pages_build_output_dir` and one D1 (so KV, R2, services, vars, Durable Objects, queues), a root `functions/_middleware` or root-level catch-all that would claim `/*`, a hand-written `_worker.js`, and functions that compile to more than one module.
+A function that calls `next()` to fall through to a static asset does not work on dispatch, because the Worker has no asset fallback.
+A dispatch build also refuses hidden files or directories inside the build output (`destination_dir`) with `hidden build output is not supported: <path>`.
+`launchpad status <slug>` shows this as `v2 delivery: state refused` followed by the reason.
+The usual cause in a React API app is three files copied from the starter template: `static/.github/workflows/launchpad-review.yml`, `static/.github/scripts/parse-html-validate.mjs` and `static/public/.gitkeep`.
+Fix it on dispatch: show the author the paths the error names, delete them with the author's agreement, then run `launchpad deploy` again.
+Delete only the paths the error names, and never the repository-root `.github/` directory.
+If `launchpad status` shows the same refusal after that deploy, the paths are outside the manifest's `app.include`, so the deploy cannot remove them; offer `/launchpad-report` instead of editing `app.include` to force it.
+A refused dispatch build is not a reason to switch to Pages: do not rewrite the manifest as v1, set `origin: pages`, or pass `--origin pages` to get past it.
+The Cloudflare account has a fixed limit of 100 Pages projects, so a new Pages project can fail at Terraform apply even after the CLI accepts the deploy.
+Changing `appType` to `react` would not convert the API; do not suggest it.
 Do not use this command to migrate a registered app or delete its Pages resources.
 If the pool is full or inventory cannot be read, report the capacity error; do not fall back to Pages or change authentication to bypass it.
 Do not replace that manifest with a v1 example or add `--origin pages` just because an older app uses Pages.
 Use `--origin pages` only when Pages is deliberately required.
-React API starters stay on Pages until their build produces a Worker entry; containers keep their existing deployment path.
-Dispatch supports plain-text environment variables, but secret bindings are currently rejected before provisioning.
+Containers keep their existing deployment path.
+Dispatch supports plain-text environment variables and `secret_text` env vars; after the first deploy is delivered, `launchpad secrets push` sets the secret values, live immediately with no redeploy.
 
 This is interactive by default. It will ask for:
 
@@ -433,6 +445,17 @@ Flags — there is nothing useful to pass on the Model A path:
   symlinks, secret-pattern hits, build-command violations) are
   rejected at upload and self-describing in the CLI's stderr; surface
   them verbatim and let the user fix and re-`launchpad deploy`.
+- **Dispatch delivery refused** (`launchpad status` shows `v2 delivery:
+  state refused`) → surface the `failed at` reason verbatim. For
+  `hidden build output is not supported`, follow the fix in §A.2 and
+  re-`launchpad deploy` on dispatch. Do not move the app to Pages.
+- **`tf_apply_failed` naming the Pages project limit** (`You have
+  reached the limit of projects`, Cloudflare code 8000027) → this is
+  a platform capacity fault, not the author's. Do not retry on Pages,
+  and do not create a new slug to get round it. A registered app that
+  was moved from dispatch to Pages needs the platform team to return
+  it to dispatch (`launchpad migrate` refuses registered apps), so
+  offer `/launchpad-report` with the slug and the error.
 - **Terminal-failed but the app is actually serving** → `launchpad
   recover <slug>`. The bot re-derives reality from live Cloudflare
   state and repairs the record to `live` only when the app is
@@ -500,6 +523,22 @@ targets:
 On `launchpad deploy` the bot auto-provisions the shared D1 named after the slug (**create-or-adopt by slug during deploy** - a successful destroy exports and deletes the recorded UUID before repository archive, so platform recovery creates a fresh destination database) and binds it to the Pages app, so `env.DB` works with no manual `wrangler d1 create`.
 The bot also pins the matching `[[d1_databases]]` block into the **committed** `wrangler.toml` - Pages git-source builds read bindings from that file, and a build without the block silently resets the binding to empty.
 
+**Dispatch form.** A v2 `react+api` app on `origin: dispatch` has no `targets`; it declares the same database as `spec.bindings.d1`:
+
+```yaml
+spec:
+  appType: react+api
+  auth: gateway
+  origin: dispatch
+  bindings:
+    d1: DB                # env binding name your Worker code reads
+```
+
+The bot create-or-adopts the slug-named D1, records its UUID, and binds it on every Worker upload (no `wrangler.toml` needed).
+If the database cannot be resolved the delivery refuses with `d1-unresolved` and nothing uploads.
+`bindings.d1` is refused on a v2 pages app and on any appType other than `react+api`.
+`launchpad migrate --origin dispatch` and a first `launchpad deploy` write this field from a v1 pages target `d1_binding` or a single wrangler `d1_databases` entry.
+
 **Empty-DB gotcha:** the platform provisions an **empty** database — schema
 and migrations are the app's job. The usual pattern is idempotent
 `CREATE TABLE IF NOT EXISTS …` at runtime (startup / first request); there
@@ -592,6 +631,10 @@ the in-flight case.
   TF emits them as `secret_text`; trust it.
 - Do **not** re-enable `confine_origin` on a gateway `react+api` app — it
   strips the user JWT and 401s every user (see "Gateway auth").
+- Do **not** switch a dispatch app to Pages (`origin: pages`, a v1
+  manifest or `--origin pages`) to get past a refused dispatch build.
+  Fix the reason the build names. New Pages projects are limited by
+  the account's Pages project limit; dispatch apps are not.
 - Do **not** `wrangler secret put` for a two-tier app — `launchpad secrets
   push` with `targets: all` seeds both tiers via the bot.
 

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -382,3 +382,6 @@ A missing Pages project is expected for `origin: dispatch`; do not treat it as a
 Use `launchpad status <slug> --json` to compare `deployedSha`, `headSha` and `deployment.liveDeployment.buildStatus`.
 A `live_drift_unknown` state can include a successful dispatch deployment while infrastructure drift is unavailable.
 If the CLI's first-deploy wait expires, keep checking the recorded submission instead of creating another app or claiming it is live.
+A `v2 delivery: state refused` line means the dispatch build refused the commit; surface its `failed at` reason verbatim.
+For `hidden build output is not supported: <path>`, the author deletes the named paths inside the build output (usually `static/.github/` and `static/public/.gitkeep` copied from the starter) and runs `launchpad deploy` again.
+Do not move a refused dispatch app to Pages: the Cloudflare account has a fixed limit of 100 Pages projects, and a `tf_apply_failed` reason that names the project limit is a platform fault to report with `/launchpad-report`.

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -215,12 +215,12 @@ Otherwise finish with:
 
 ## New app defaults
 
-`launchpad init` creates new static and React apps on Workers dispatch with gateway authentication.
+`launchpad init` creates new static, React and React API apps on Workers dispatch with gateway authentication.
 The generated v2 manifest preserves the detected build settings and the chosen access groups.
 Use the normal `launchpad deploy` flow; authors do not create Cloudflare projects or choose a gateway.
 The platform assigns new gateway-fronted apps to the configured gateway with the most free hostname slots, including pending reservations.
 Existing apps keep their assigned gateway, URL and access groups.
-React API starters remain on Pages and registered apps keep their current origin.
-An older manifest for an unregistered static or React app is converted to dispatch on its first `launchpad deploy`.
+Registered apps keep their current origin.
+An older manifest for an unregistered static, React or React API app is converted to dispatch on its first `launchpad deploy`; a React API app with KV, R2 or other unsupported wrangler bindings stays on Pages with the reason printed.
 An explicit `--origin pages` is available when required.
-Dispatch secret bindings are not supported yet, so do not promise that `launchpad secrets push` will work for those apps.
+Dispatch apps declare secrets as `secret_text` env vars and set them with `launchpad secrets push` once the first deploy has been delivered.

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.63.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -388,3 +388,6 @@ A missing Pages project is expected for `origin: dispatch`; do not treat it as a
 Use `launchpad status <slug> --json` to compare `deployedSha`, `headSha` and `deployment.liveDeployment.buildStatus`.
 A `live_drift_unknown` state can include a successful dispatch deployment while infrastructure drift is unavailable.
 If the CLI's first-deploy wait expires, keep checking the recorded submission instead of creating another app or claiming it is live.
+A `v2 delivery: state refused` line means the dispatch build refused the commit; surface its `failed at` reason verbatim.
+For `hidden build output is not supported: <path>`, the author deletes the named paths inside the build output (usually `static/.github/` and `static/public/.gitkeep` copied from the starter) and runs `launchpad deploy` again.
+Do not move a refused dispatch app to Pages: the Cloudflare account has a fixed limit of 100 Pages projects, and a `tf_apply_failed` reason that names the project limit is a platform fault to report with `/launchpad-report`.