@m-kopa/launchpad-cli 0.64.0 → 0.65.0

package/CHANGELOG.md

@@ -6,7 +6,27 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
-## Unreleased
+## 0.65.0 - 2026-10-03
+
+### Added
+
+- `validate` and `plan` print a non-blocking warning for any container manifest: the platform's runtime switch may still be `off` for the app, in which case `launchpad deploy` returns HTTP 503 `container_runtime_off` (AIO-786).
+  A `runtime: aca` manifest gets a second warning — that value is reserved and currently ignored. Exit codes are unchanged; see `docs/concepts/containers.md` for the runtime gate, the `lite`-only container size, and the cold-start behaviour after idle.
+
+### Changed
+
+- Raise the production minimum CLI version to 0.64.0 through the governed policy workflow.
+- The `launchpad-deploy`, `launchpad-status` and `launchpad-deploy-status` skills keep a refused dispatch build on dispatch (AIO-756).
+  They name the `hidden build output is not supported` error and its fix, and they say that the Cloudflare account allows only 100 Pages projects.
+
+### Fixed
+
+- A first deploy with several hundred files no longer times out at `content_seeded` (AIO-738).
+  The platform now sends text files inside the git tree call, in chunks of at most 500 files or 8 MB, and checks every file's git SHA after the commit tree is built; if any SHA differs, it falls back to one blob per file.
+  Binary files still get their own blobs, created 8 at a time. A rate-limited blob or tree call retries, and the commit step has 10 minutes.
+- `launchpad destroy` now tears down an app whose provisioning failed at stage `pending` when main has no per-app Terraform.
+  It refuses with `tf_pr_open` while the app's Terraform PR is open, and with `dispatch_delivery_present` when a pre-Terraform app already has a dispatch delivery.
+- `launchpad deploy`'s apply-status polling (the automatic reconcile path for an access or origin change, e.g. switching `origin: dispatch` → `pages`) no longer goes quiet after a real `terraform apply` failure. Previously, once the bot recorded that failure and queued an automatic retry, every poll *before* the retry's PR opened fell through to a stale lookup and 404'd `no_apply_found` — which the CLI treats as "still settling" and retries. If the retry's regenerated Terraform happened to be byte-identical to what the failed attempt already merged (because the failed apply's file content lands on `main` even though the real infrastructure was never created), its PR carried an empty diff and never re-ran `terraform apply` at all, so the original failure could go unreported for as long as it took that empty retry to resolve (AIO-756). The bot now reports the already-known `failed` verdict on every poll in that window, so `launchpad deploy` exits non-zero with the failing stage named, instead of appearing to hang or (in the worst case) eventually reading as if nothing was wrong. Run `launchpad status <slug>` to confirm the current state after a reported failure.
 
 ## 0.64.0 - 2026-09-25
 

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.64.0";
+var CLI_VERSION = "0.65.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -12402,6 +12402,20 @@ function describe25(e) {
 
 // src/commands/plan.ts
 import { resolve as resolve12 } from "node:path";
+
+// src/manifest/container-runtime-warnings.ts
+var CONTAINER_RUNTIME_GATE_WARNING = "Container apps are gated by the platform runtime switch; `launchpad deploy` may return " + "503 container_runtime_off until the platform team enables your app. See docs/concepts/containers.md.";
+var RUNTIME_ACA_RESERVED_WARNING = "deployment.runtime: aca is reserved and currently ignored — the app runs on cloudflare-containers " + "regardless. See docs/concepts/containers.md.";
+function containerRuntimeWarnings(view) {
+  if (view.deploymentType !== "container")
+    return [];
+  const warnings = [CONTAINER_RUNTIME_GATE_WARNING];
+  if (view.runtime === "aca")
+    warnings.push(RUNTIME_ACA_RESERVED_WARNING);
+  return warnings;
+}
+
+// src/commands/plan.ts
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -12433,7 +12447,15 @@ function renderJson(result, io) {
   switch (result.kind) {
     case "ok": {
       const plan = derivePlan(result.manifest);
-      io.out(JSON.stringify({ ok: true, ...plan }));
+      const warnings = containerRuntimeWarnings({
+        deploymentType: plan.desired.app.deploymentType,
+        runtime: plan.desired.app.runtime
+      });
+      io.out(JSON.stringify({
+        ok: true,
+        ...plan,
+        ...warnings.length > 0 ? { warnings } : {}
+      }));
       return 0;
     }
     case "file-not-found":
@@ -12543,6 +12565,12 @@ function renderPlan(m, io) {
     }
     io.out("");
   }
+  for (const w of containerRuntimeWarnings({
+    deploymentType: desired.app.deploymentType,
+    runtime: desired.app.runtime
+  })) {
+    io.out(`⚠ ${w}`);
+  }
   const totalBindings = desired.secrets.envFile.length + desired.secrets.platformManaged.length;
   io.out(`Secrets (${totalBindings})`);
   if (totalBindings === 0) {
@@ -16106,6 +16134,9 @@ function renderHumanOk(result, group, boundary, io) {
   if (!boundary.declared) {
     io.out(`⚠ ${DECLARE_APP_HINT}`);
   }
+  for (const w of containerRuntimeWarnings(view)) {
+    io.out(`⚠ ${w}`);
+  }
   switch (group.kind) {
     case "skipped":
       return 0;
@@ -16172,6 +16203,7 @@ function renderHumanError(result, io) {
 }
 function renderJsonOk(result, group, boundary, io) {
   const view = manifestView(result.manifest);
+  const runtimeWarnings = containerRuntimeWarnings(view);
   const base = {
     manifest_valid: true,
     runtime_supported: true,
@@ -16181,7 +16213,8 @@ function renderJsonOk(result, group, boundary, io) {
       declared: boundary.declared,
       errors: boundary.errors,
       warnings: boundary.warnings
-    }
+    },
+    ...runtimeWarnings.length > 0 ? { warnings: runtimeWarnings } : {}
   };
   if (boundary.errors.length > 0) {
     io.out(JSON.stringify({ ok: false, ...base }));
@@ -16270,7 +16303,8 @@ function manifestView(manifest) {
       access: manifest.spec.access,
       buildCommand: manifest.spec.build?.command,
       destinationDir: manifest.spec.build?.destination_dir,
-      appDeclared: manifest.spec.app !== undefined
+      appDeclared: manifest.spec.app !== undefined,
+      runtime: undefined
     };
   }
   return {
@@ -16279,7 +16313,8 @@ function manifestView(manifest) {
     access: manifest.access,
     buildCommand: manifest.build?.command,
     destinationDir: manifest.build?.destination_dir,
-    appDeclared: manifest.app !== undefined
+    appDeclared: manifest.app !== undefined,
+    runtime: manifest.deployment.runtime
   };
 }
 function parseArgs13(args) {

package/dist/commands/plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/commands/plan.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC"}
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/commands/plan.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAMjE,eAAO,MAAM,WAAW,EAAE,OAIzB,CAAC"}

package/dist/commands/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAQjE,eAAO,MAAM,eAAe,EAAE,OAI7B,CAAC"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AASjE,eAAO,MAAM,eAAe,EAAE,OAI7B,CAAC"}

package/dist/manifest/container-runtime-warnings.d.ts

@@ -0,0 +1,13 @@
+export declare const CONTAINER_RUNTIME_GATE_WARNING: string;
+export declare const RUNTIME_ACA_RESERVED_WARNING: string;
+/**
+ * Non-blocking advisories for a manifest, derived from its deployment
+ * type and (v1alpha1-only) runtime field. Empty for any non-container
+ * manifest, so callers can spread/append it without a type-specific
+ * branch.
+ */
+export declare function containerRuntimeWarnings(view: {
+    readonly deploymentType: string;
+    readonly runtime: string | undefined;
+}): readonly string[];
+//# sourceMappingURL=container-runtime-warnings.d.ts.map

package/dist/manifest/container-runtime-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-runtime-warnings.d.ts","sourceRoot":"","sources":["../../src/manifest/container-runtime-warnings.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,8BAA8B,QAE6D,CAAC;AAOzG,eAAO,MAAM,4BAA4B,QAEO,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,GAAG,SAAS,MAAM,EAAE,CAKpB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.64.0";
+export declare const CLI_VERSION = "0.65.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
@@ -37,8 +37,8 @@
   },
   "devDependencies": {
     "@types/node": "22.18.10",
-    "@typescript-eslint/eslint-plugin": "8.46.4",
-    "@typescript-eslint/parser": "8.46.4",
+    "@typescript-eslint/eslint-plugin": "8.71.0",
+    "@typescript-eslint/parser": "8.71.0",
     "@vitest/coverage-istanbul": "4.1.5",
     "eslint": "9.39.4",
     "typescript": "5.9.3",

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -165,6 +165,14 @@ For a React API app, `functions/` converts as-is and the dispatch build compiles
 When deploy says secrets carried over, tell the author to run `launchpad secrets push` once `launchpad status` shows the first delivery; pushing earlier fails with `dispatch_script_not_delivered`.
 Still refused on dispatch, with the reason printed: wrangler settings beyond name, compatibility date/flags, `pages_build_output_dir` and one D1 (so KV, R2, services, vars, Durable Objects, queues), a root `functions/_middleware` or root-level catch-all that would claim `/*`, a hand-written `_worker.js`, and functions that compile to more than one module.
 A function that calls `next()` to fall through to a static asset does not work on dispatch, because the Worker has no asset fallback.
+A dispatch build also refuses hidden files or directories inside the build output (`destination_dir`) with `hidden build output is not supported: <path>`.
+`launchpad status <slug>` shows this as `v2 delivery: state refused` followed by the reason.
+The usual cause in a React API app is three files copied from the starter template: `static/.github/workflows/launchpad-review.yml`, `static/.github/scripts/parse-html-validate.mjs` and `static/public/.gitkeep`.
+Fix it on dispatch: show the author the paths the error names, delete them with the author's agreement, then run `launchpad deploy` again.
+Delete only the paths the error names, and never the repository-root `.github/` directory.
+If `launchpad status` shows the same refusal after that deploy, the paths are outside the manifest's `app.include`, so the deploy cannot remove them; offer `/launchpad-report` instead of editing `app.include` to force it.
+A refused dispatch build is not a reason to switch to Pages: do not rewrite the manifest as v1, set `origin: pages`, or pass `--origin pages` to get past it.
+The Cloudflare account has a fixed limit of 100 Pages projects, so a new Pages project can fail at Terraform apply even after the CLI accepts the deploy.
 Changing `appType` to `react` would not convert the API; do not suggest it.
 Do not use this command to migrate a registered app or delete its Pages resources.
 If the pool is full or inventory cannot be read, report the capacity error; do not fall back to Pages or change authentication to bypass it.
@@ -437,6 +445,17 @@ Flags — there is nothing useful to pass on the Model A path:
   symlinks, secret-pattern hits, build-command violations) are
   rejected at upload and self-describing in the CLI's stderr; surface
   them verbatim and let the user fix and re-`launchpad deploy`.
+- **Dispatch delivery refused** (`launchpad status` shows `v2 delivery:
+  state refused`) → surface the `failed at` reason verbatim. For
+  `hidden build output is not supported`, follow the fix in §A.2 and
+  re-`launchpad deploy` on dispatch. Do not move the app to Pages.
+- **`tf_apply_failed` naming the Pages project limit** (`You have
+  reached the limit of projects`, Cloudflare code 8000027) → this is
+  a platform capacity fault, not the author's. Do not retry on Pages,
+  and do not create a new slug to get round it. A registered app that
+  was moved from dispatch to Pages needs the platform team to return
+  it to dispatch (`launchpad migrate` refuses registered apps), so
+  offer `/launchpad-report` with the slug and the error.
 - **Terminal-failed but the app is actually serving** → `launchpad
   recover <slug>`. The bot re-derives reality from live Cloudflare
   state and repairs the record to `live` only when the app is
@@ -612,6 +631,10 @@ the in-flight case.
   TF emits them as `secret_text`; trust it.
 - Do **not** re-enable `confine_origin` on a gateway `react+api` app — it
   strips the user JWT and 401s every user (see "Gateway auth").
+- Do **not** switch a dispatch app to Pages (`origin: pages`, a v1
+  manifest or `--origin pages`) to get past a refused dispatch build.
+  Fix the reason the build names. New Pages projects are limited by
+  the account's Pages project limit; dispatch apps are not.
 - Do **not** `wrangler secret put` for a two-tier app — `launchpad secrets
   push` with `targets: all` seeds both tiers via the bot.
 

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -382,3 +382,6 @@ A missing Pages project is expected for `origin: dispatch`; do not treat it as a
 Use `launchpad status <slug> --json` to compare `deployedSha`, `headSha` and `deployment.liveDeployment.buildStatus`.
 A `live_drift_unknown` state can include a successful dispatch deployment while infrastructure drift is unavailable.
 If the CLI's first-deploy wait expires, keep checking the recorded submission instead of creating another app or claiming it is live.
+A `v2 delivery: state refused` line means the dispatch build refused the commit; surface its `failed at` reason verbatim.
+For `hidden build output is not supported: <path>`, the author deletes the named paths inside the build output (usually `static/.github/` and `static/public/.gitkeep` copied from the starter) and runs `launchpad deploy` again.
+Do not move a refused dispatch app to Pages: the Cloudflare account has a fixed limit of 100 Pages projects, and a `tf_apply_failed` reason that names the project limit is a platform fault to report with `/launchpad-report`.

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.64.0
+version: 0.65.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -388,3 +388,6 @@ A missing Pages project is expected for `origin: dispatch`; do not treat it as a
 Use `launchpad status <slug> --json` to compare `deployedSha`, `headSha` and `deployment.liveDeployment.buildStatus`.
 A `live_drift_unknown` state can include a successful dispatch deployment while infrastructure drift is unavailable.
 If the CLI's first-deploy wait expires, keep checking the recorded submission instead of creating another app or claiming it is live.
+A `v2 delivery: state refused` line means the dispatch build refused the commit; surface its `failed at` reason verbatim.
+For `hidden build output is not supported: <path>`, the author deletes the named paths inside the build output (usually `static/.github/` and `static/public/.gitkeep` copied from the starter) and runs `launchpad deploy` again.
+Do not move a refused dispatch app to Pages: the Cloudflare account has a fixed limit of 100 Pages projects, and a `tf_apply_failed` reason that names the project limit is a platform fault to report with `/launchpad-report`.