@m-kopa/launchpad-cli 0.65.0 → 0.66.0

package/CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.66.0 - 2026-10-04
+
+### Added
+
+- Container apps can sign in through the Entra auth gateway with `auth: gateway` (AIO-811, ADR 0057). `validate` and `plan` accept it, and a gateway container app uses no Cloudflare Access app or Zero Trust seat.
+- The platform now operates a one-minute, platform-owned health sweep against live container apps, default-off behind a kill-switch and shipped with no manifest, CLI, or `launchpad.yaml` changes (AIO-269). The sweep authenticates as a dedicated Cloudflare Access service token the platform team provisions and rotates — see `docs/runbooks/container-health-monitoring.md`. App authors take no action; this note exists only so the new, platform-operated probe traffic to the generated Worker's `/__platform/health/container` route and the platform-level Access policy addition on each container app's custom-hostname application are documented, not undocumented infrastructure. See `docs/concepts/containers.md` for a short pointer.
+
+### Changed
+
+- `launchpad init` now writes `auth: gateway` for container apps by default. Pass `--auth access` to keep the old Access sign-in (AIO-811).
+
 ## 0.65.0 - 2026-10-03
 
 ### Added

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.65.0";
+var CLI_VERSION = "0.66.0";
 
 // src/config.ts
 import { readFileSync } from "node:fs";
@@ -2744,13 +2744,6 @@ var ManifestSchema = z2.object({
       });
     }
   }
-  if (isContainer && m.auth === "gateway") {
-    ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
-      path: ["auth"],
-      message: "auth: gateway is only supported for pages-app shapes (static/react/react+api); container apps stay on Cloudflare Access (ADR 0016)."
-    });
-  }
   if (isContainer && m.containers === undefined) {
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
@@ -3472,13 +3465,6 @@ var SpecSchema = z3.object({
       message: "build is not allowed when appType is 'container' (container build lives in the Dockerfile)"
     });
   }
-  if (isContainer && s.auth === "gateway") {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["auth"],
-      message: "auth: gateway is only supported for pages-app shapes (static/react/react+api); container apps stay on Cloudflare Access (ADR 0016)."
-    });
-  }
   if (!isContainer && s.fronted_by_concierge === true) {
     ctx.addIssue({
       code: z3.ZodIssueCode.custom,
@@ -3754,10 +3740,17 @@ function validateDeploymentCapability(manifest) {
       className: containerClassName(view.appName),
       bindingName,
       dockerfilePathFromContainerDirectory: `../${container.image.slice(2)}`,
-      environmentNames
+      environmentNames,
+      authMode: deploymentAuthMode(manifest)
     }
   };
 }
+function deploymentAuthMode(manifest) {
+  if (manifest.apiVersion === "launchpad.m-kopa.us/v2") {
+    return manifest.spec.auth === "gateway" ? "gateway" : "access";
+  }
+  return manifest.auth === "gateway" ? "gateway" : "access";
+}
 function containerClassName(containerName) {
   return `AppContainer${containerName.split("-").map(capitalise).join("")}`;
 }
@@ -3832,8 +3825,12 @@ function emit(capability) {
   const app = JSON.stringify(capability.appName);
   const className = capability.className;
   const bindingName = capability.bindingName;
+  const healthcheckPath = JSON.stringify(capability.container.healthcheck);
+  const isGateway = capability.authMode === "gateway";
   const environmentFields = capability.environmentNames.map((name) => `  ${name}: string;`);
   const environmentValues = capability.environmentNames.map((name) => `    ${name}: this.env.${name} ?? "",`);
+  const envAuthFields = isGateway ? ["  GATEWAY_ISSUER: string;", "  GATEWAY_AUD: string;", "  GATEWAY_JWKS_URL: string;"] : ["  CF_ACCESS_AUD: string;", "  CF_ACCESS_TEAM_DOMAIN: string;"];
+  const monitorEnvField = isGateway ? ["  MONITOR_SHARED_SECRET: string;"] : [];
   const lines = [
     "/**",
     " * Auto-generated by @m-kopa/launchpad-engine.",
@@ -3843,17 +3840,19 @@ function emit(capability) {
     "import {",
     "  AccessJwtVerificationError,",
     "  createJwksCache,",
-    "  parseAccessJwtFromHeaders,",
+    isGateway ? "  parseGatewayAssertionFromHeaders," : "  parseAccessJwtFromHeaders,",
     "  verifyAccessJwt,",
+    ...isGateway ? [] : ["  verifyJwt,"],
     "  type User,",
+    ...isGateway ? [] : ["  type VerifiedPrincipal,"],
     '} from "@m-kopa/platform-auth";',
     "",
     "type Env = {",
     `  ${bindingName}: DurableObjectNamespace<${className}>;`,
     "  BINDINGS_PROXY_SECRET: string;",
-    "  CF_ACCESS_AUD: string;",
-    "  CF_ACCESS_TEAM_DOMAIN: string;",
+    ...envAuthFields,
     "  LAUNCHPAD_DEPLOYMENT_SHA: string;",
+    ...isGateway ? monitorEnvField : ["  MONITOR_CLIENT_ID: string;"],
     ...environmentFields,
     "};",
     "",
@@ -3868,7 +3867,7 @@ function emit(capability) {
     "function jwks(env: Env): ReturnType<typeof createJwksCache> {",
     "  if (jwksCache === null) {",
     "    jwksCache = createJwksCache(",
-    "      `https://${env.CF_ACCESS_TEAM_DOMAIN}/cdn-cgi/access/certs`,",
+    isGateway ? "      env.GATEWAY_JWKS_URL," : "      `https://${env.CF_ACCESS_TEAM_DOMAIN}/cdn-cgi/access/certs`,",
     "    );",
     "  }",
     "  return jwksCache;",
@@ -3896,29 +3895,59 @@ function emit(capability) {
     "  return difference === 0;",
     "}",
     "",
-    "async function authenticate(request: Request, env: Env): Promise<User | Response> {",
-    "  if (!env.CF_ACCESS_TEAM_DOMAIN || !env.CF_ACCESS_AUD) {",
-    '    return unauthenticated("auth_unconfigured");',
-    "  }",
-    "  const token = parseAccessJwtFromHeaders(request.headers);",
-    "  if (token === null) {",
-    '    return unauthenticated("access_jwt_missing");',
-    "  }",
-    "  try {",
-    "    return await verifyAccessJwt(token, {",
-    "      teamDomain: `https://${env.CF_ACCESS_TEAM_DOMAIN}`,",
-    "      audience: env.CF_ACCESS_AUD,",
-    "      jwks: jwks(env),",
-    "      clockTolerance: 30,",
-    "    });",
-    "  } catch (error) {",
-    "    if (error instanceof AccessJwtVerificationError) {",
-    "      return unauthenticated(error.code);",
-    "    }",
-    '    console.error(JSON.stringify({ event: "container_runtime_error", kind: "access_jwt_verification_failed" }));',
-    '    return unauthenticated("access_jwt_verification_failed");',
-    "  }",
-    "}",
+    ...isGateway ? [
+      "async function authenticate(request: Request, env: Env): Promise<User | Response> {",
+      "  if (!env.GATEWAY_ISSUER || !env.GATEWAY_AUD || !env.GATEWAY_JWKS_URL) {",
+      '    return unauthenticated("auth_unconfigured");',
+      "  }",
+      "  const token = parseGatewayAssertionFromHeaders(request.headers);",
+      "  if (token === null) {",
+      '    return unauthenticated("gateway_assertion_missing");',
+      "  }",
+      "  try {",
+      "    // verifyAccessJwt is a generic RS256-against-issuer/audience/JWKS",
+      "    // check; a gateway-fronted container verifies the Entra-OIDC",
+      "    // gateway's assertion (ADR 0057) with the SAME verifier used for",
+      "    // Cf Access JWTs, against the GATEWAY_* values instead.",
+      "    return await verifyAccessJwt(token, {",
+      "      teamDomain: env.GATEWAY_ISSUER,",
+      "      audience: env.GATEWAY_AUD,",
+      "      jwks: jwks(env),",
+      "      clockTolerance: 30,",
+      "    });",
+      "  } catch (error) {",
+      "    if (error instanceof AccessJwtVerificationError) {",
+      "      return unauthenticated(error.code);",
+      "    }",
+      '    console.error(JSON.stringify({ event: "container_runtime_error", kind: "gateway_assertion_verification_failed" }));',
+      '    return unauthenticated("gateway_assertion_verification_failed");',
+      "  }",
+      "}"
+    ] : [
+      "async function authenticate(request: Request, env: Env): Promise<User | Response> {",
+      "  if (!env.CF_ACCESS_TEAM_DOMAIN || !env.CF_ACCESS_AUD) {",
+      '    return unauthenticated("auth_unconfigured");',
+      "  }",
+      "  const token = parseAccessJwtFromHeaders(request.headers);",
+      "  if (token === null) {",
+      '    return unauthenticated("access_jwt_missing");',
+      "  }",
+      "  try {",
+      "    return await verifyAccessJwt(token, {",
+      "      teamDomain: `https://${env.CF_ACCESS_TEAM_DOMAIN}`,",
+      "      audience: env.CF_ACCESS_AUD,",
+      "      jwks: jwks(env),",
+      "      clockTolerance: 30,",
+      "    });",
+      "  } catch (error) {",
+      "    if (error instanceof AccessJwtVerificationError) {",
+      "      return unauthenticated(error.code);",
+      "    }",
+      '    console.error(JSON.stringify({ event: "container_runtime_error", kind: "access_jwt_verification_failed" }));',
+      '    return unauthenticated("access_jwt_verification_failed");',
+      "  }",
+      "}"
+    ],
     "",
     "function forwardedRequest(",
     "  request: Request,",
@@ -3955,6 +3984,173 @@ function emit(capability) {
     "  });",
     "}",
     "",
+    "/**",
+    " * Build the machine-only health-probe request dispatched to the",
+    " * container DO. Deliberately NOT `forwardedRequest`: it carries no",
+    " * inbound header (no auth, no user identity, no bindings-proxy",
+    " * secret/url) and targets the manifest-declared healthcheck path,",
+    " * never the Worker's own reserved `GET /health` liveness route.",
+    " */",
+    "function buildHealthDispatchRequest(",
+    "  origin: string,",
+    "  requestId: string,",
+    "): Request {",
+    "  const headers = new Headers();",
+    '  headers.set("X-Request-ID", requestId);',
+    `  return new Request(origin + ${healthcheckPath}, {`,
+    '    method: "GET",',
+    "    headers,",
+    '    redirect: "manual",',
+    "  });",
+    "}",
+    "",
+    "function healthDenied(code: string): Response {",
+    "  return Response.json(",
+    '    { error: "health_unavailable", code },',
+    '    { status: 404, headers: { "cache-control": "no-store" } },',
+    "  );",
+    "}",
+    "",
+    ...isGateway ? [
+      "/**",
+      " * `GET /__platform/health/container` — AIO-269 T8. A gateway-",
+      " * fronted app has no Access app and no public hostname (ADR",
+      " * 0057), so there is no Access service-token surface for the",
+      " * monitor to present a credential to. Instead this trusts a",
+      " * shared secret (`MONITOR_SHARED_SECRET`) carried in",
+      " * `X-Launchpad-Monitor-Secret` — safe ONLY because this Worker",
+      " * is reachable exclusively via launchpad-container-router's",
+      " * per-app service binding (never a public hostname), and the",
+      " * monitor is the only caller with a binding to that router.",
+      " * Missing configuration, a missing header, and a mismatched",
+      " * secret all fail closed with no container fetch, same as the",
+      " * Access-mode path below. The container's response body is",
+      " * never forwarded; the reply is a fixed, redacted, `no-store`",
+      " * JSON body.",
+      " */",
+      "async function handleContainerHealth(",
+      "  request: Request,",
+      "  env: Env,",
+      "  requestId: string,",
+      "): Promise<Response> {",
+      '  if (request.method !== "GET") {',
+      '    return healthDenied("method_not_allowed");',
+      "  }",
+      "  if (!env.MONITOR_SHARED_SECRET) {",
+      '    return healthDenied("monitor_unconfigured");',
+      "  }",
+      '  const presented = request.headers.get("x-launchpad-monitor-secret");',
+      "  if (!presented || !(await secretsEqual(presented, env.MONITOR_SHARED_SECRET))) {",
+      '    return healthDenied("monitor_secret_mismatch");',
+      "  }",
+      "  const url = new URL(request.url);",
+      "  const dispatchRequest = buildHealthDispatchRequest(url.origin, requestId);",
+      "  const start = Date.now();",
+      "  let containerResponse: Response;",
+      "  try {",
+      `    const id = env.${bindingName}.idFromName("singleton");`,
+      `    containerResponse = await env.${bindingName}.get(id).fetch(dispatchRequest);`,
+      "  } catch {",
+      "    return Response.json(",
+      "      {",
+      '        outcome: "error",',
+      "        workload_status: null,",
+      "        deployment_sha: env.LAUNCHPAD_DEPLOYMENT_SHA,",
+      "        request_id: requestId,",
+      "        duration_ms: Math.min(Date.now() - start, 30_000),",
+      "      },",
+      '      { status: 200, headers: { "cache-control": "no-store" } },',
+      "    );",
+      "  }",
+      "  return Response.json(",
+      "    {",
+      '      outcome: containerResponse.ok ? "healthy" : "unhealthy",',
+      "      workload_status: containerResponse.status,",
+      "      deployment_sha: env.LAUNCHPAD_DEPLOYMENT_SHA,",
+      "      request_id: requestId,",
+      "      duration_ms: Math.min(Date.now() - start, 30_000),",
+      "    },",
+      '    { status: 200, headers: { "cache-control": "no-store" } },',
+      "  );",
+      "}"
+    ] : [
+      "/**",
+      " * `GET /__platform/health/container` — machine-only. Gated on",
+      " * `verifyJwt` returning a service principal whose `commonName`",
+      " * matches the configured monitor client ID. Anonymous callers,",
+      " * human JWTs, wrong service principals, non-GET methods, and a",
+      " * missing monitor-client-ID configuration all fail closed with no",
+      " * container fetch. The container's response body is never",
+      " * forwarded; the reply is a fixed, redacted, `no-store` JSON body.",
+      " */",
+      "async function handleContainerHealth(",
+      "  request: Request,",
+      "  env: Env,",
+      "  requestId: string,",
+      "): Promise<Response> {",
+      '  if (request.method !== "GET") {',
+      '    return healthDenied("method_not_allowed");',
+      "  }",
+      "  if (!env.MONITOR_CLIENT_ID || !env.CF_ACCESS_TEAM_DOMAIN || !env.CF_ACCESS_AUD) {",
+      '    return healthDenied("monitor_unconfigured");',
+      "  }",
+      "  const token = parseAccessJwtFromHeaders(request.headers);",
+      "  if (token === null) {",
+      '    return healthDenied("access_jwt_missing");',
+      "  }",
+      "  let principal: VerifiedPrincipal;",
+      "  try {",
+      "    principal = await verifyJwt(token, {",
+      "      teamDomain: `https://${env.CF_ACCESS_TEAM_DOMAIN}`,",
+      "      audience: env.CF_ACCESS_AUD,",
+      "      jwks: jwks(env),",
+      "      clockTolerance: 30,",
+      "    });",
+      "  } catch (error) {",
+      "    if (error instanceof AccessJwtVerificationError) {",
+      "      return healthDenied(error.code);",
+      "    }",
+      '    console.error(JSON.stringify({ event: "container_runtime_error", kind: "monitor_jwt_verification_failed" }));',
+      '    return healthDenied("monitor_jwt_verification_failed");',
+      "  }",
+      '  if (principal.kind !== "service") {',
+      '    return healthDenied("human_identity_not_allowed");',
+      "  }",
+      "  if (principal.principal.commonName !== env.MONITOR_CLIENT_ID) {",
+      '    return healthDenied("monitor_identity_mismatch");',
+      "  }",
+      "  const url = new URL(request.url);",
+      "  const dispatchRequest = buildHealthDispatchRequest(url.origin, requestId);",
+      "  const start = Date.now();",
+      "  let containerResponse: Response;",
+      "  try {",
+      `    const id = env.${bindingName}.idFromName("singleton");`,
+      `    containerResponse = await env.${bindingName}.get(id).fetch(dispatchRequest);`,
+      "  } catch {",
+      "    return Response.json(",
+      "      {",
+      '        outcome: "error",',
+      "        workload_status: null,",
+      "        deployment_sha: env.LAUNCHPAD_DEPLOYMENT_SHA,",
+      "        request_id: requestId,",
+      "        duration_ms: Math.min(Date.now() - start, 30_000),",
+      "      },",
+      '      { status: 200, headers: { "cache-control": "no-store" } },',
+      "    );",
+      "  }",
+      "  return Response.json(",
+      "    {",
+      '      outcome: containerResponse.ok ? "healthy" : "unhealthy",',
+      "      workload_status: containerResponse.status,",
+      "      deployment_sha: env.LAUNCHPAD_DEPLOYMENT_SHA,",
+      "      request_id: requestId,",
+      "      duration_ms: Math.min(Date.now() - start, 30_000),",
+      "    },",
+      '    { status: 200, headers: { "cache-control": "no-store" } },',
+      "  );",
+      "}"
+    ],
+    "",
     "function runtimeEvent(",
     "  env: Env,",
     "  requestId: string,",
@@ -3993,6 +4189,11 @@ function emit(capability) {
     '      runtimeEvent(env, requestId, response.status, "bindings_unknown");',
     "      return response;",
     "    }",
+    '    if (url.pathname === "/__platform/health/container") {',
+    "      const response = await handleContainerHealth(request, env, requestId);",
+    '      runtimeEvent(env, requestId, response.status, "container_health_probe");',
+    "      return response;",
+    "    }",
     "    const identity = await authenticate(request, env);",
     "    if (identity instanceof Response) {",
     '      runtimeEvent(env, requestId, identity.status, "authentication_failed");',
@@ -4033,6 +4234,8 @@ function generateWranglerToml(manifest) {
 }
 function emit2(capability) {
   const maxInstances = capability.container.max_instances ?? 1;
+  const isGateway = capability.authMode === "gateway";
+  const authVars = isGateway ? ['GATEWAY_ISSUER = ""', 'GATEWAY_AUD = ""', 'GATEWAY_JWKS_URL = ""'] : ['CF_ACCESS_AUD = ""', 'CF_ACCESS_TEAM_DOMAIN = ""'];
   return [
     "# Auto-generated by @m-kopa/launchpad-engine. Do not edit by hand.",
     `# Source: launchpad.yaml (apiVersion: ${capability.apiVersion})`,
@@ -4042,14 +4245,14 @@ function emit2(capability) {
     'main = "worker/index.ts"',
     `compatibility_date = "${DEFAULT_COMPATIBILITY_DATE}"`,
     `compatibility_flags = [${DEFAULT_COMPATIBILITY_FLAGS.map((flag) => `"${flag}"`).join(", ")}]`,
+    ...isGateway ? ["workers_dev = false"] : [],
     "",
     "[observability]",
     "enabled = true",
     "head_sampling_rate = 1.0",
     "",
     "[vars]",
-    'CF_ACCESS_AUD = ""',
-    'CF_ACCESS_TEAM_DOMAIN = ""',
+    ...authVars,
     'LAUNCHPAD_DEPLOYMENT_SHA = ""',
     "",
     "[[containers]]",
@@ -4093,6 +4296,10 @@ function generateGithubDeployWorkflow(manifest) {
   return { kind: "ok", content: emit3(result.capability), warnings: [] };
 }
 function emit3(capability) {
+  const isGateway = capability.authMode === "gateway";
+  const authVarNames = isGateway ? ["GATEWAY_ISSUER", "GATEWAY_AUD", "GATEWAY_JWKS_URL"] : ["CF_ACCESS_AUD", "CF_ACCESS_TEAM_DOMAIN"];
+  const authVarEnvLines = authVarNames.map((name) => `          ${name}: \${{ vars.${name} }}`);
+  const authVarWranglerFlags = authVarNames.map((name) => `            --var "${name}:\${${name}}" \\`);
   const lines = [
     "# Auto-generated by @m-kopa/launchpad-engine. Do not edit by hand.",
     `# Source: launchpad.yaml (apiVersion: ${capability.apiVersion})`,
@@ -4181,29 +4388,22 @@ function emit3(capability) {
     "          cache: npm",
     "          cache-dependency-path: |",
     "            container/package-lock.json",
-    "            container/backend/package-lock.json",
     "",
     "      - name: Install frozen Worker dependencies",
     "        working-directory: container",
     "        run: npm ci --ignore-scripts",
     "",
-    "      - name: Install frozen workload dependencies",
-    "        working-directory: container/backend",
-    "        run: npm ci --ignore-scripts",
-    "",
     "      - name: Verify required deployment inputs",
     "        env:",
     "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
     "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
-    "          CF_ACCESS_AUD: ${{ vars.CF_ACCESS_AUD }}",
-    "          CF_ACCESS_TEAM_DOMAIN: ${{ vars.CF_ACCESS_TEAM_DOMAIN }}",
+    ...authVarEnvLines,
     "          BINDINGS_PROXY_SECRET: ${{ secrets.BINDINGS_PROXY_SECRET }}",
-    "          CF_ACCESS_AUD: ${{ vars.CF_ACCESS_AUD }}",
-    "          CF_ACCESS_TEAM_DOMAIN: ${{ vars.CF_ACCESS_TEAM_DOMAIN }}",
+    ...isGateway ? ["          MONITOR_SHARED_SECRET: ${{ secrets.MONITOR_SHARED_SECRET }}"] : [],
     ...capability.environmentNames.map((name) => `          ${name}: \${{ secrets.${name} }}`),
     "        run: |",
     "          set -euo pipefail",
-    "          for name in CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID BINDINGS_PROXY_SECRET CF_ACCESS_AUD CF_ACCESS_TEAM_DOMAIN; do",
+    `          for name in CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID BINDINGS_PROXY_SECRET${isGateway ? " MONITOR_SHARED_SECRET" : ""} ${authVarNames.join(" ")}; do`,
     '            if [ -z "${!name:-}" ]; then',
     '              echo "Required deployment input $name is empty" >&2',
     "              exit 1",
@@ -4216,37 +4416,207 @@ function emit3(capability) {
       "          fi"
     ]),
     "",
-    "      - name: Deploy Worker and container image",
+    "      - name: Deploy Worker, container image and secrets",
     "        working-directory: container",
     "        env:",
     "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
     "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
+    ...authVarEnvLines,
+    ...secretNames(capability).map((name) => `          ${name}: \${{ secrets.${name} }}`),
     "        run: |",
+    "          set -euo pipefail",
+    '          secrets_file="$(mktemp "${RUNNER_TEMP}/launchpad-secrets.XXXXXX")"',
+    `          trap 'rm -f "$secrets_file"' EXIT`,
+    `          jq -n '${secretsJqFilter(capability)}' > "$secrets_file"`,
     "          npx --no-install wrangler deploy \\",
     '            --message "launchpad:${GITHUB_SHA}" \\',
     '            --tag "launchpad-deployment-sha:${GITHUB_SHA}" \\',
-    '            --var "CF_ACCESS_AUD:${CF_ACCESS_AUD}" \\',
-    '            --var "CF_ACCESS_TEAM_DOMAIN:${CF_ACCESS_TEAM_DOMAIN}" \\',
-    '            --var "LAUNCHPAD_DEPLOYMENT_SHA:${GITHUB_SHA}"',
-    "",
-    ...secretSteps(capability)
+    ...authVarWranglerFlags,
+    '            --var "LAUNCHPAD_DEPLOYMENT_SHA:${GITHUB_SHA}" \\',
+    '            --secrets-file "$secrets_file"',
+    ""
   ];
   return lines.join(`
 `);
 }
-function secretSteps(capability) {
-  return ["BINDINGS_PROXY_SECRET", ...capability.environmentNames].flatMap((name) => [
-    `      - name: Push ${name}`,
-    "        working-directory: container",
-    "        env:",
-    "          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}",
-    "          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}",
-    `          ${name}: \${{ secrets.${name} }}`,
-    "        run: |",
-    `          printf '%s' "$${name}" | npx --no-install wrangler secret put ${name}`,
-    ""
-  ]);
+function secretNames(capability) {
+  return capability.authMode === "gateway" ? ["BINDINGS_PROXY_SECRET", "MONITOR_SHARED_SECRET", ...capability.environmentNames] : ["BINDINGS_PROXY_SECRET", ...capability.environmentNames];
 }
+function secretsJqFilter(capability) {
+  return `{${secretNames(capability).map((name) => `${name}: env.${name}`).join(", ")}}`;
+}
+// ../launchpad-engine/dist/per-app-lock.js
+var PER_APP_LOCK_HCL = `# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cloudflare/cloudflare" {
+  version     = "5.19.1"
+  constraints = "~> 5.19"
+  hashes = [
+    "h1:HkKPMZ/n+QiExkRUSLjGMTGnuIaph+k932LiTp7CKZM=",
+    "h1:mopYISyLkUVUwMjJbuPenxIUVDrna1/7ACB1hfMfciU=",
+    "zh:0651618000db705564dab5a25322b9d76ea54b7dd78931ed3565497b559babeb",
+    "zh:1a7847e9479fb6d21a65ef933ffae1416b1e4b44ca940c0d6c50fc4248cc4a0d",
+    "zh:5597cee5854131045eb9f201ae3a70b59c51955d31a647d9616863c746d902cb",
+    "zh:580786830d93e35b957754fd4c62d4681a3b19abc28b757e41acba26455663b1",
+    "zh:83c4bdfb0e74fd50e56fff3c461d76c1c1ec61af3f679e4de1aa70b5ed05a09f",
+    "zh:abb4d1052cee61d80f9cb51e5421e3c118312403afb7104b98bd7e310ac736ee",
+    "zh:b0aeeb3d66ea4d719989875e778c477065ba941e3a76e9a8caacc3be08208dd9",
+    "zh:e43b4b2dfcec1ce2115f5a5c86042d432deb49bee8eae103eb56d97ea02e2e3b",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/azurerm" {
+  version     = "4.76.0"
+  constraints = "~> 4.0"
+  hashes = [
+    "h1:4VD01UBYjsa3w7zeEBKnDtwClwpsPw6Dk+V9evhiKqU=",
+    "h1:bOzo55MQgsvQ+KRwrWM5q+waapuMZ3AGIkK5ZIOe+JU=",
+    "zh:07bb3a087abca8bd14cc28e3d3d4abb71e0ed711ecec65e7c0a2f1a97b948cf4",
+    "zh:0fa6640b5d6c0b0fe0b7fa25cebc0091b7dda2efd83ec0347c5a50dfce0957bc",
+    "zh:3c8618c8a5ab07fadfcb53ecf614f7b99e25bb6c407cf0af703a6b0647d4461d",
+    "zh:5f23fdda6ff290bc99b25b68f612bf67fbb503b04b1e38664e66d3204a51e99e",
+    "zh:68e6794cbe5e3b021657035c2465767b8296beed6c9acc8a9e032c4b90ba5746",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:8a51dad112248d3fdfb19cdd65a182bd6a37e7fb7f1af801ab72a962813b5188",
+    "zh:945ff59c36de8c2128487f4ae0838655feef7c869112430ffa24ea69ff483b76",
+    "zh:b7306af0ecc8ad78771c17e0e911dd7a561251e4255ffe80516f0654a53f42bb",
+    "zh:c584de4858fc4ece330f1986f371acd235a5444e9b14ecea177779b1214539e0",
+    "zh:daa3675af21f8cdf330532af0b420287388f62ac57eaf0bd4c48e732d1052f35",
+    "zh:e76d972712b48a689f8deae41a3ad796c31d8b3798074d66c6f68e2b3b0aaa1f",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/time" {
+  version     = "0.14.0"
+  constraints = "~> 0.13"
+  hashes = [
+    "h1:/hlxsUpuN/lvPTNL9+NyVGsOyRsK5NsxwFMsj5CdOp4=",
+    "h1:4EThC3ocCFiFPMZQSUvSGSxoJqBcGWxMcFYmL67uS7Y=",
+    "zh:12abfd6b800e4d7fa6db7310dec8ffd440b31993861ef188c7ed5260b3073937",
+    "zh:23005521e800bb19e1597bf755c5f70d675d30b685d4255001ed5fa47d9df3f1",
+    "zh:2fea249b582ae97cd1cc10385187ea50993bb47c28cc5df0305e57ceaabf0a10",
+    "zh:322018d3b987b7aad08697178029a2bb667bed699e88328f0c89c52a2fd41341",
+    "zh:32a08e98fce2d273cb9b2c89d6c54727cc9f0a32e15bfd896be4e02cc6b48f95",
+    "zh:3db89aabd0e619616bd4b0f8b373a7586dfe60feffcea12a84a0bdbc445714b3",
+    "zh:7488f56c81d742dc020f29063626c8f07ca188aa97be61e7307e8d62397020a2",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7cb4067f2e7559b13f7562ef722f948950901eb37834873e98360ab28f66e9d7",
+    "zh:9d552c8345f61e1b7db8e725144981345f18ac1014d58d6f5ddf0928a195fffb",
+    "zh:a8e69fb6b97fc9d86fb19a9f4d42abe33c4a68e700b15387ce2e17d2b9934bed",
+    "zh:aeeb900eb8dd0f790c60ea5c0e0c8d42bd6e4a54f391681d4decca15b544394b",
+    "zh:c239c619101a8c95e1f14061eb973c57a8d15fa0e68878ced5bbd76858ee5b79",
+  ]
+}
+`;
+
+// ../launchpad-engine/dist/per-app-container-lock.js
+var PER_APP_CONTAINER_LOCK_HCL = `# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cloudflare/cloudflare" {
+  version     = "5.19.1"
+  constraints = "~> 5.19"
+  hashes = [
+    "h1:HkKPMZ/n+QiExkRUSLjGMTGnuIaph+k932LiTp7CKZM=",
+    "h1:mopYISyLkUVUwMjJbuPenxIUVDrna1/7ACB1hfMfciU=",
+    "zh:0651618000db705564dab5a25322b9d76ea54b7dd78931ed3565497b559babeb",
+    "zh:1a7847e9479fb6d21a65ef933ffae1416b1e4b44ca940c0d6c50fc4248cc4a0d",
+    "zh:5597cee5854131045eb9f201ae3a70b59c51955d31a647d9616863c746d902cb",
+    "zh:580786830d93e35b957754fd4c62d4681a3b19abc28b757e41acba26455663b1",
+    "zh:83c4bdfb0e74fd50e56fff3c461d76c1c1ec61af3f679e4de1aa70b5ed05a09f",
+    "zh:abb4d1052cee61d80f9cb51e5421e3c118312403afb7104b98bd7e310ac736ee",
+    "zh:b0aeeb3d66ea4d719989875e778c477065ba941e3a76e9a8caacc3be08208dd9",
+    "zh:e43b4b2dfcec1ce2115f5a5c86042d432deb49bee8eae103eb56d97ea02e2e3b",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+  version     = "3.9.0"
+  constraints = "~> 3.6"
+  hashes = [
+    "h1:OO+IuvQJSPmWdN8AyyIEvPJbLvDQpgX/zbktoa9KsJE=",
+    "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=",
+    "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1",
+    "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea",
+    "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f",
+    "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0",
+    "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61",
+    "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc",
+    "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e",
+    "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef",
+    "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b",
+    "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257",
+    "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/time" {
+  version     = "0.14.0"
+  constraints = "~> 0.13"
+  hashes = [
+    "h1:/hlxsUpuN/lvPTNL9+NyVGsOyRsK5NsxwFMsj5CdOp4=",
+    "h1:4EThC3ocCFiFPMZQSUvSGSxoJqBcGWxMcFYmL67uS7Y=",
+    "zh:12abfd6b800e4d7fa6db7310dec8ffd440b31993861ef188c7ed5260b3073937",
+    "zh:23005521e800bb19e1597bf755c5f70d675d30b685d4255001ed5fa47d9df3f1",
+    "zh:2fea249b582ae97cd1cc10385187ea50993bb47c28cc5df0305e57ceaabf0a10",
+    "zh:322018d3b987b7aad08697178029a2bb667bed699e88328f0c89c52a2fd41341",
+    "zh:32a08e98fce2d273cb9b2c89d6c54727cc9f0a32e15bfd896be4e02cc6b48f95",
+    "zh:3db89aabd0e619616bd4b0f8b373a7586dfe60feffcea12a84a0bdbc445714b3",
+    "zh:7488f56c81d742dc020f29063626c8f07ca188aa97be61e7307e8d62397020a2",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7cb4067f2e7559b13f7562ef722f948950901eb37834873e98360ab28f66e9d7",
+    "zh:9d552c8345f61e1b7db8e725144981345f18ac1014d58d6f5ddf0928a195fffb",
+    "zh:a8e69fb6b97fc9d86fb19a9f4d42abe33c4a68e700b15387ce2e17d2b9934bed",
+    "zh:aeeb900eb8dd0f790c60ea5c0e0c8d42bd6e4a54f391681d4decca15b544394b",
+    "zh:c239c619101a8c95e1f14061eb973c57a8d15fa0e68878ced5bbd76858ee5b79",
+  ]
+}
+
+provider "registry.terraform.io/integrations/github" {
+  version     = "6.12.1"
+  constraints = "~> 6.0"
+  hashes = [
+    "h1:bGz4LIep/7PVrqy6P8cTYbAJpdxXGrupUJjkCczlzIs=",
+    "h1:hHOwf554tYL9pQS2uRPbaAGSXRbbBJ/+HtQAoT9mtuA=",
+    "zh:3e1a4081ecb9518fdf0074db83c16ad00dc81ffe8249a6e3cf1894e947e28df6",
+    "zh:4cb8224b7f530795b674ac044675f6b22a7c9154f55eb9f76c5af6c7534056a4",
+    "zh:560bc08637926191f6871a89e986022ca67c70afda5bebca34b5216e6fac69c9",
+    "zh:5a70b5d2ac650c5c9819a1875411ebda229d0fcc6c9f57f9d751852ca3cd77ac",
+    "zh:8668d93bd4dc2ffa2545e1473af600a925d479b16033a71a4498a16f3b683c0c",
+    "zh:86eacc6059fd057948e178b665ba5cce74bd5488a9e1035734e60ff5ef1b6f8f",
+    "zh:a329fac98881d8dfc211a9bdc0ec6f2948f0b0c2704d1b6cbe5307403c7ad1b2",
+    "zh:dadd44abab3c52b9d572955afaef1658790e17ea355ee22b58996d81d28e02d8",
+    "zh:de9f455ef342cc38fb76bce844bfcd376fb81a4b9f9bc2fae023ff99efdf1338",
+    "zh:f8c6d2e8351b334491790358574e0a30a7c6d7f5b80f7daf32a7c0f3e9b1ab19",
+    "zh:fab41971a3edee04ab6eceaeab4eeb9a2b2f38a2af3b06eda93e2117b64994be",
+    "zh:fb1279b566dd9c8c117b2e4e0cc8344413b8fc8f2a3e24be22a9b2610551777b",
+    "zh:fbd1fee2c9df3aa19cf8851ce134dea6e45ea01cb85695c1726670c285797e25",
+    "zh:fe79d2a861fb9af420fa5bd7f02c031b2a0a3edf5dbc46022c8ecc7a33cf2b6d",
+  ]
+}
+`;
+var PER_APP_CONTAINER_GATEWAY_LOCK_HCL = (() => {
+  const marker = 'provider "registry.terraform.io/hashicorp/azurerm" {';
+  const start = PER_APP_LOCK_HCL.indexOf(marker);
+  const end = PER_APP_LOCK_HCL.indexOf(`
+}
+`, start) + 3;
+  if (start < 0 || end < 3)
+    throw new Error("azurerm block missing from the pages lock");
+  const azurerm = PER_APP_LOCK_HCL.slice(start, end);
+  const before = 'provider "registry.terraform.io/hashicorp/random" {';
+  const at = PER_APP_CONTAINER_LOCK_HCL.indexOf(before);
+  if (at < 0)
+    throw new Error("random block missing from the container lock");
+  return PER_APP_CONTAINER_LOCK_HCL.slice(0, at) + azurerm + `
+` + PER_APP_CONTAINER_LOCK_HCL.slice(at);
+})();
+
 // ../launchpad-engine/dist/per-app-workspace.js
 var CF_ACCOUNT_ID = "c07cb17c9f742e8144c4828b3693ca65";
 var R2_S3_ENDPOINT = `https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com`;
@@ -11789,7 +12159,7 @@ function buildManifest(inputs, detected) {
     catalogue: { listed: false },
     access
   };
-  const resolvedAuth = inputs.auth ?? (inputs.type === "container" ? "access" : "gateway");
+  const resolvedAuth = inputs.auth ?? "gateway";
   if (resolvedAuth === "gateway") {
     manifest.auth = "gateway";
   }

package/dist/commands/init.d.ts

@@ -10,8 +10,8 @@ export interface InitInputs {
     type: AppType | undefined;
     /**
      * Edge gating mode (sp-gwdflt). Supplied via `--auth`. Undefined ⇒
-     * the buildManifest default: `gateway` for pages shapes, `access`
-     * for containers.
+     * the buildManifest default: `gateway` for every shape, containers
+     * included (AIO-811).
      */
     auth: AuthMode | undefined;
     /** New apps choose dispatch explicitly; existing manifests keep their origin. */

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.65.0";
+export declare const CLI_VERSION = "0.66.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -178,7 +178,7 @@ Do not use this command to migrate a registered app or delete its Pages resource
 If the pool is full or inventory cannot be read, report the capacity error; do not fall back to Pages or change authentication to bypass it.
 Do not replace that manifest with a v1 example or add `--origin pages` just because an older app uses Pages.
 Use `--origin pages` only when Pages is deliberately required.
-Containers keep their existing deployment path.
+Containers keep their existing deployment path, with one change: use `auth: gateway` for them (see "Container apps" below).
 Dispatch supports plain-text environment variables and `secret_text` env vars; after the first deploy is delivered, `launchpad secrets push` sets the secret values, live immediately with no redeploy.
 
 This is interactive by default. It will ask for:
@@ -230,7 +230,7 @@ commit to a slug:
 | `static`    | n/a                   | n/a                                     | n/a                    | No bundler, no TS, no React.                           |
 | `react`     | n/a                   | client-side or remote-fetch only        | n/a                    | SPA only — no server-side anything.                    |
 | `react+api` | `hono` (exclusive)    | Cloudflare D1 / Neon (HTTP) / KV / R2   | **Sibling cron Worker** (Pages has no `scheduled` handler — see "Two-tier apps" below) | Requires `compatibility_flags = ["nodejs_compat"]` in `wrangler.toml` (ADR-0011 carve-out). |
-| `container` | any HTTP server       | any (container-local or HTTP backend)   | container-local        | Single HTTP port. Schema-valid, but the guided flow in this skill covers `static`/`react`/`react+api` — container guidance ships separately. |
+| `container` | any HTTP server       | any (container-local or HTTP backend)   | container-local        | Single HTTP port. Use `auth: gateway` (default for containers; see "Container apps" below). The rest of the guided flow in this skill covers `static`/`react`/`react+api`. |
 
 **Will not run on the Workers runtime** (advisory — representative,
 not exhaustive): `fastify` / `@fastify/*` / `express` / `koa` /
@@ -354,6 +354,39 @@ endpoint. Files outside the manifest's app boundary (`app.root` /
 `app.include`) and never-shippable files (private keys, `.env`
 material) are stripped with a warning before upload.
 
+### Container apps — use `auth: gateway` (AIO-811)
+
+Container apps (`type: container`) sign in through the same Entra auth gateway as Pages apps. `launchpad init` scaffolds new container apps with `auth: gateway` by default; keep it. Pass `--auth access` only for a legacy Access app.
+
+Request path: user → Entra auth gateway → `launchpad-container-router` (one service binding per app) → the app's container Worker.
+The container Worker has no public hostname and no Cloudflare Access application.
+It verifies the gateway's `X-Launchpad-User-Assertion` and fails closed with 401 when the assertion is missing or invalid.
+
+```yaml
+apiVersion: launchpad.m-kopa.us/v1alpha1
+kind: App
+metadata:
+  name: my-container-app
+  team: my-team
+  owner: owner@m-kopa.com
+deployment:
+  type: container
+auth: gateway
+catalogue:
+  listed: false
+access:
+  allowed_entra_group: G_my_group   # or omit and use a private audience
+containers:
+  - name: my-container-app
+    image: ghcr.io/m-kopa/my-container-app:1.0.0
+    port: 8080
+```
+
+`auth: access` for containers is **legacy**. Every Access-gated app uses a Cloudflare Zero Trust seat and the account has a fixed seat cap (about 50 seats; AIO-811 was prompted by hitting it), so new Access apps can be refused once the cap is reached.
+Only keep `auth: access` on an existing container app that has not been migrated.
+Do not switch an existing container between modes on your own; offer `/launchpad-report` so the platform team can migrate it.
+Reading the signed-in user inside the container is covered in `/launchpad-identity`.
+
 **First deploy vs subsequent deploys** (M-1234). Under Model A there
 is no separate "create the app" step — `launchpad deploy` against a
 fresh slug auto-provisions:
@@ -363,7 +396,7 @@ fresh slug auto-provisions:
   workflow (TF apply, cert issuance, edge auth, app-repo scaffold).
   Pages manifests must explicitly set `auth: gateway` to use the platform Entra-OIDC gateway.
   `launchpad init` writes this field. Pages apps cannot opt into Cloudflare Access; only
-  containers retain that login mode. The CLI prints `✓ First-time deploy — provisioning
+  containers retain that legacy login mode, and container apps should use `auth: gateway` too (AIO-811). The CLI prints `✓ First-time deploy — provisioning
   workflow started` and waits for delivery. If its wait expires, check
   `launchpad status <slug>` before reporting success. Provisioning typically takes
   5–10 minutes. **Your bundle ships with the provisioning run** — when

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -198,6 +198,16 @@ if (me.authenticated) {
 }
 ```
 
+## Container apps (`type: container`, `auth: gateway`)
+
+Container apps behind the gateway (AIO-811) get the same signed-in identity. The path is gateway → `launchpad-container-router` → your app's container Worker, and the gateway still sends `X-Launchpad-User-Assertion`.
+
+- **The container Worker verifies the assertion for you.** The generated `container-worker.ts` reads `X-Launchpad-User-Assertion`, verifies it with `@m-kopa/platform-auth` against `GATEWAY_ISSUER`, `GATEWAY_AUD` and `GATEWAY_JWKS_URL`, and returns 401 if it is missing or invalid. It is the only gate, because the container has no public hostname and no Cloudflare Access app.
+- **Your container process receives plain headers after that check:** `X-User-Sub` (Entra `oid`) and `X-User-Email` (tenant UPN), plus `X-User-Groups` when groups are present. Inbound `X-User-*` headers are stripped before the Worker sets its own, so a client cannot forge them.
+- **Do not re-verify in the container unless you need to.** The raw assertion is checked at the container Worker and your process sees only the `X-User-*` headers.
+- Same rules as Pages: identity is for attribution, not authorization. Enforce who may open the app through `access.allowed_entra_group`.
+- The legacy `auth: access` container mode (Cloudflare Access JWT, `CF_ACCESS_*`) still works for existing apps but is limited by the Zero Trust seat cap. New container apps should use `auth: gateway`.
+
 ## The two app shapes
 
 ### (a) build-less `type: static` — vendored verifier (INTERIM)
@@ -323,6 +333,7 @@ An unverified payload can be forged by anyone who can reach your origin
 - Do **not** confuse `launchpad whoami` (your CLI session) with in-app
   identity. This skill is about the **end-user signed into your deployed
   app**, read server-side from the forwarded token.
+- Do **not** read identity from `X-User-*` headers in a container unless `auth: gateway` or `auth: access` is set on the app; they are only trustworthy because the container Worker verified the token first.
 - Do **not** trust the header without verifying the signature, and do **not**
   omit the audience check — both open you to forgery / cross-app replay.
 - Do **not** gate access on `/api/me` claims — they are attribution, not

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Safely refresh a Launchpad clone, show manifest drift, or read the deployed manifest. Wraps bare `launchpad pull` for source sync, `launchpad pull --manifest` for deployed YAML, and `launchpad status` for drift. Use for "sync my clone", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or post-deploy verification.
-version: 0.65.0
+version: 0.66.0
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->