@msn-control/liftoff 0.10.2 → 0.10.4

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAoB9C,MAAM,qBAAqB,GAAsB;IAC/C,aAAa,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF,CAAC;AAEF,SAAS,qBAAqB,CAC5B,KAAc,EACd,MAA6B,EAC7B,MAA6B;IAE7B,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC;QAC3C,MAAM;QACN,MAAM;KACP,CAAC,CAAC;IACH,YAAY,CAAC,KAAK,CAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,6DAA6D,CAC9D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAA8B;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAA2B;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAO,GAAkB,EAAE;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,qBAAqB,CAAC;IAE7D,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,sBAAsB,CACjD,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAC3C,CAAC;IAEF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE;YAC/B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;YACrC,MAAM;YACN,MAAM;YACN,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,uBAAuB,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EACpG,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAoBrE,MAAM,qBAAqB,GAAsB;IAC/C,aAAa,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF,CAAC;AAEF,SAAS,qBAAqB,CAC5B,KAAc,EACd,MAA6B,EAC7B,MAA6B;IAE7B,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC;QAC3C,MAAM;QACN,MAAM;KACP,CAAC,CAAC;IACH,YAAY,CAAC,KAAK,CAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,6DAA6D,CAC9D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAA8B;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAA2B;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAO,GAAkB,EAAE;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,qBAAqB,CAAC;IAE7D,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,sBAAsB,CACxF,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAC3C,CAAC;IAEF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE;YAC/B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;YACrC,MAAM;YACN,MAAM;YACN,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,uBAAuB,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EACpG,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/commands.js

@@ -12,7 +12,7 @@ import { validateFrameworkInstallation } from './framework-validation.js';
 import { artifactPath, applyProjectFileTransaction, assertNewOrEmptyDirectory, captureProjectFileSnapshot, findProjectRoot, loadManifest, manifestHadFilteredLegacyNonDurableOwnership, manifestDisplayPath, readProjectFile, resolveProjectPath, validateGeneratedProject, writeArtifacts, writeProjectFile } from './file-system.js';
 import { InteractiveCancelledError, InteractivePrompter } from './interactive.js';
 import { applyMergePreflight, assertSafeInitTarget, authorizeMergePreflight, buildMergePreflight, captureTreeState, discoverGitRoot, resolveInitTargetFromDiscovery, validateStagedTree, withStagingArea, writeStagedArtifacts } from './init-filesystem.js';
-import { renderMigrationChecklist, renderMigrationProposal, renderMigrationTasks, seedMigrationGroups } from './migrate-plan.js';
+import { migrationCapabilityId, migrationChangeName, renderMigrationChecklist, renderMigrationDesign, renderMigrationProposal, renderMigrationSpec, renderMigrationTasks, seedMigrationGroups } from './migrate-plan.js';
 import { buildOpenSpecProfileWriteCommands, configureOpenSpecProfile, inspectOpenSpecProfile, OPEN_SPEC_DELIVERY, OPEN_SPEC_PROFILE, OPEN_SPEC_WORKFLOW_IDS } from './openspec-profile.js';
 import { buildProjectPlan, loadConfigOptions, mergeOptions, PlanValidationError, projectPlanEntries } from './planner.js';
 import { buildDependencySetupPlan, dependencyResumeCommand, runDependencySetup, verifyPowerAppsPackageMetadata } from './project-dependencies.js';
@@ -27,7 +27,7 @@ import { supportedStack } from './supported-stack.js';
 import { buildArtifacts, buildManifest, partitionGeneratedArtifacts } from './templates.js';
 import { PresentationSession } from './terminal.js';
 import { governanceCommand } from './governance-activation/commands.js';
-import { loadActivationState as loadCurrentActivationState } from './governance-activation/activation-state.js';
+import { activationStateFilePathParts, loadActivationState as loadCurrentActivationState } from './governance-activation/activation-state.js';
 import { planHistoricalActivationStateMigration, updateFailureInjectionEnv } from './governance-activation/migration.js';
 import { currentActivationIdentity } from './governance-activation/graph.js';
 import { governanceChangeMetadataFileName, reconcileActiveGovernanceChange, validateGovernanceChangeMetadata } from './governance-activation/source-of-truth.js';
@@ -51,7 +51,7 @@ export async function runCommand(parsed, context) {
     const executionContext = { ...context, presentation };
     try {
         if (parsed.command && readBooleanFlag(parsed.flags, 'help')) {
-            renderCommandHelp(parsed.command, presentation);
+            renderCommandHelp(parsed.command, presentation, parsed.subcommand);
             return 0;
         }
         switch (parsed.command) {
@@ -489,7 +489,8 @@ async function handleProjectDependencies(plan, projectRoot, options, probes, con
     });
     if (!result.success) {
         presentation.error('Project dependencies failed', `${result.failed?.label ?? 'dependency command'}: ${result.detail ?? 'unknown failure'}`);
-        presentation.status('info', 'Scaffold preserved', projectRoot);
+        presentation.status('info', 'Protected dependency metadata preserved', 'Package manifests and lock metadata were checked and restored when changed.');
+        presentation.warning('Dependency scripts may have changed other project files; review the working tree before retrying.');
         if (result.restoredMutations.length > 0) {
             presentation.warning(`Restored protected files: ${result.restoredMutations.join(', ')}`);
         }
@@ -631,22 +632,50 @@ function migrationPlanArtifacts(plan, inventory) {
     if (plan.specWorkflow.id === 'openspec') {
         return {
             artifacts: [
+                {
+                    logicalName: 'migration-change-metadata',
+                    category: 'seed',
+                    lifecycle: 'seed',
+                    pathParts: ['openspec', 'changes', migrationChangeName, '.openspec.yaml'],
+                    content: 'schema: spec-driven\n'
+                },
                 {
                     logicalName: 'migration-proposal',
                     category: 'seed',
                     lifecycle: 'seed',
-                    pathParts: ['openspec', 'changes', 'migrate-to-liftoff', 'proposal.md'],
+                    pathParts: ['openspec', 'changes', migrationChangeName, 'proposal.md'],
                     content: renderMigrationProposal(plan, inventory)
                 },
+                {
+                    logicalName: 'migration-design',
+                    category: 'seed',
+                    lifecycle: 'seed',
+                    pathParts: ['openspec', 'changes', migrationChangeName, 'design.md'],
+                    content: renderMigrationDesign(plan, inventory)
+                },
                 {
                     logicalName: 'migration-tasks',
                     category: 'seed',
                     lifecycle: 'seed',
-                    pathParts: ['openspec', 'changes', 'migrate-to-liftoff', 'tasks.md'],
+                    pathParts: ['openspec', 'changes', migrationChangeName, 'tasks.md'],
                     content: renderMigrationTasks(groups)
+                },
+                {
+                    logicalName: 'migration-spec',
+                    category: 'seed',
+                    lifecycle: 'seed',
+                    pathParts: [
+                        'openspec',
+                        'changes',
+                        migrationChangeName,
+                        'specs',
+                        migrationCapabilityId,
+                        'spec.md'
+                    ],
+                    content: renderMigrationSpec()
                 }
             ],
-            location: 'openspec/changes/migrate-to-liftoff/ (run it with your agent workflow, e.g. /opsx:apply migrate-to-liftoff)'
+            location: `openspec/changes/${migrationChangeName}/ (run it with your agent workflow, e.g. /opsx:apply ${migrationChangeName})`
         };
     }
     return {
@@ -765,6 +794,26 @@ async function executeMigration(parsed, context, sourceRoot) {
             await stageMigrationSource(area, sourceRoot);
             await writeStagedArtifacts(area, migrationPlan.artifacts, 'seed');
             await writeStagedArtifacts(area, [partition.manifest], 'liftoff');
+            if (plan.specWorkflow.id === 'openspec') {
+                const command = {
+                    executable: plan.framework.executable,
+                    args: ['validate', migrationChangeName, '--strict']
+                };
+                presentation.stage('Validate generated migration plan', migrationChangeName);
+                presentation.command(formatCommand(command));
+                const result = await runner.run(command, {
+                    cwd: area.root,
+                    env: context.env,
+                    timeoutMs: 30_000
+                });
+                if (result.status !== 0 || result.timedOut || result.errorCode) {
+                    const detail = result.timedOut
+                        ? 'command timed out'
+                        : result.errorMessage || result.stderr.trim().split(/\r?\n/)[0] ||
+                            `exit status ${result.status}`;
+                    throw new Error(`Generated migration plan failed strict validation: ${result.displayCommand}: ${detail}`);
+                }
+            }
             presentation.stage('Validate staged migration');
             await validateStagedTree(area);
             const stagedIssues = await validateGeneratedProject(area.root);
@@ -1084,8 +1133,23 @@ function planWithBlockedProvisioning(plan, recordedWorkload, provisioningPlans)
         environments
     };
 }
-async function preflightUpdate(projectRoot, entries, force) {
+function isUnownedUpdateConflict(entry, recordedByName) {
+    if (entry.status === 'moved') {
+        return entry.destinationOccupied === true && entry.destinationMatches !== true;
+    }
+    if (entry.status !== 'conflict') {
+        return false;
+    }
+    const recorded = recordedByName.get(entry.logicalName);
+    return !recorded ||
+        recorded.category !== entry.rendered?.category ||
+        recorded.pathParts.join('\0') !== entry.pathParts.join('\0');
+}
+async function preflightUpdate(projectRoot, entries, force, recordedByName) {
     for (const entry of entries) {
+        if (isUnownedUpdateConflict(entry, recordedByName)) {
+            continue;
+        }
         const writesDestination = entry.status === 'new' ||
             entry.status === 'missing' ||
             entry.status === 'upgrade' ||
@@ -1427,13 +1491,24 @@ async function updateCommand(parsed, context) {
             captureProjectFileSnapshot(projectRoot, ['liftoff.config.json'])
         ]);
     const manifest = await loadManifest(projectRoot);
+    const oldByName = new Map(manifest.managedArtifacts.map((artifact) => [artifact.logicalName, artifact]));
     if (compareSemver(manifest.liftoffVersion, liftoffVersion) > 0) {
         presentation.error(`This project was written by Liftoff ${manifest.liftoffVersion}, which is newer than this CLI (${liftoffVersion}).`, 'Upgrade the CLI first.');
         return 1;
     }
     const config = await loadConfigOptions('liftoff.config.json', projectRoot);
-    const plan = buildProjectPlan(config, { requireProjectName: true });
     const recordedWorkload = manifest.project.workload;
+    if (recordedWorkload.kind !== 'power-apps-code-app' &&
+        config.cloud !== undefined &&
+        config.cloud !== recordedWorkload.cloud) {
+        presentation.error(`Cloud changes (${recordedWorkload.cloud} -> ${config.cloud}) are a migration, not an update.`, 'Restore liftoff.config.json or perform the cloud change through a separately reviewed project migration.');
+        return 1;
+    }
+    const plan = buildProjectPlan(config, { requireProjectName: true });
+    if (plan.projectName !== manifest.project.name) {
+        presentation.error(`Project name changes (${manifest.project.name} -> ${plan.projectName}) are a migration, not an update.`, 'Restore liftoff.config.json or perform the rename through a separately reviewed project migration.');
+        return 1;
+    }
     if (plan.workload !== recordedWorkload.kind) {
         const involvesPowerApps = plan.workload === 'power-apps-code-app' ||
             recordedWorkload.kind === 'power-apps-code-app';
@@ -1455,6 +1530,14 @@ async function updateCommand(parsed, context) {
         }
     }
     else if (plan.workload !== 'power-apps-code-app' && recordedWorkload.kind !== 'power-apps-code-app') {
+        if (plan.provider.id !== recordedWorkload.cloud) {
+            presentation.error(`Cloud changes (${recordedWorkload.cloud} -> ${plan.provider.id}) are a migration, not an update.`, 'Restore liftoff.config.json or perform the cloud change through a separately reviewed project migration.');
+            return 1;
+        }
+        if (plan.region.slug !== recordedWorkload.region) {
+            presentation.error(`Region changes (${recordedWorkload.region} -> ${plan.region.slug}) are a migration, not an update.`, 'Restore liftoff.config.json or perform the region change through a separately reviewed project migration.');
+            return 1;
+        }
         if (plan.apiStack.id !== recordedWorkload.apiStack) {
             presentation.error(`API stack changes (${recordedWorkload.apiStack} -> ${plan.apiStack.id}) are a migration, not an update.`, 'Initialize a fresh project and move production behavior through a reviewed project change.');
             return 1;
@@ -1466,6 +1549,13 @@ async function updateCommand(parsed, context) {
             return 1;
         }
     }
+    if (manifest.governance.profile !== 'none' &&
+        manifest.governance.profile !== 'unspecified' &&
+        plan.governanceProfile.id === 'none' &&
+        await readProjectFile(projectRoot, [...activationStateFilePathParts]) !== undefined) {
+        presentation.error('Repository governance cannot be disabled by update while governance/activation-state.json exists.', 'Restore liftoff.config.json or complete a separately supported deactivation and reconciliation workflow before disabling governance. This Liftoff release does not infer deactivation or the absence of live enforcement.');
+        return 1;
+    }
     if (plan.specWorkflow.id !== manifest.project.specWorkflow) {
         presentation.error(`Spec workflow changes (${manifest.project.specWorkflow} -> ${plan.specWorkflow.id}) require official framework initialization and are not supported by liftoff update.`, 'Restore the workflow recorded in liftoff.manifest.json or migrate into a fresh project.');
         return 1;
@@ -1680,7 +1770,13 @@ async function updateCommand(parsed, context) {
         if (toWrite > 0 || toRetire > 0) {
             presentation.command('liftoff update');
         }
-        if (summary.conflict > 0 || summary.retiredConflict > 0) {
+        const unownedConflicts = entries.filter((entry) => isUnownedUpdateConflict(entry, oldByName));
+        if (unownedConflicts.length > 0) {
+            presentation.bullets('Unowned destinations remain protected', unownedConflicts.map((entry) => `${entryDisplay(entry)}: review and resolve this unowned destination manually; --force cannot overwrite it`));
+        }
+        if (entries.some((entry) => !isUnownedUpdateConflict(entry, oldByName) &&
+            (entry.status === 'conflict' || entry.status === 'retired-conflict' ||
+                entry.status === 'moved' && !entry.cleanMove))) {
             presentation.command('liftoff update --force');
         }
         return 2;
@@ -1696,7 +1792,7 @@ async function updateCommand(parsed, context) {
         }
     }
     presentation.stage('Apply safe Liftoff core changes', projectRoot);
-    await preflightUpdate(projectRoot, entries, force);
+    await preflightUpdate(projectRoot, entries, force, oldByName);
     maybeInjectUpdateFailure(context.env, 'after-preflight');
     const written = [];
     const retired = [];
@@ -1715,7 +1811,7 @@ async function updateCommand(parsed, context) {
                 written.push(entry);
                 break;
             case 'moved':
-                if (entry.cleanMove || force) {
+                if (!isUnownedUpdateConflict(entry, oldByName) && (entry.cleanMove || force)) {
                     if (!entry.destinationMatches) {
                         mutations.push({
                             type: 'write',
@@ -1744,7 +1840,7 @@ async function updateCommand(parsed, context) {
                 }
                 break;
             case 'conflict':
-                if (force) {
+                if (force && !isUnownedUpdateConflict(entry, oldByName)) {
                     mutations.push({
                         type: 'write',
                         pathParts: entry.pathParts,
@@ -1782,7 +1878,6 @@ async function updateCommand(parsed, context) {
     for (const mutation of stateMigration.mutations) {
         mutations.push(mutation);
     }
-    const oldByName = new Map(manifest.managedArtifacts.map((artifact) => [artifact.logicalName, artifact]));
     const skippedByName = new Map(skipped.map((entry) => [entry.logicalName, entry]));
     const hasUnrecordedGovernanceConflict = skipped.some((entry) => entry.status === 'conflict' &&
         entry.rendered?.category === 'governance' &&
@@ -1916,9 +2011,11 @@ async function updateCommand(parsed, context) {
             .map((entry) => `${group.group}: preserved ${manifestDisplayPath(entry.rendered.pathParts)}; --force cannot overwrite project-owned bytes`)));
     }
     if (skipped.length > 0) {
-        presentation.bullets('Skipped Liftoff core conflicts', skipped.map((entry) => entry.status === 'retired-conflict'
-            ? `protected retired alias ${entryDisplay(entry)}  ${entry.reason}${force ? '' : ' (delete it manually or use --force to remove)'}`
-            : `skipped ${entryDisplay(entry)}  ${entry.reason}${force ? '' : ' (use --force to overwrite)'}`));
+        presentation.bullets('Skipped Liftoff core conflicts', skipped.map((entry) => isUnownedUpdateConflict(entry, oldByName)
+            ? `protected unowned destination ${entryDisplay(entry)}  ${entry.reason} (resolve manually; --force cannot overwrite it)`
+            : entry.status === 'retired-conflict'
+                ? `protected retired alias ${entryDisplay(entry)}  ${entry.reason}${force ? '' : ' (delete it manually or use --force to remove)'}`
+                : `skipped ${entryDisplay(entry)}  ${entry.reason}${force ? '' : ' (use --force to overwrite)'}`));
     }
     const orphans = entries.filter((entry) => entry.status === 'orphan');
     if (orphans.length > 0) {
@@ -2022,23 +2119,42 @@ async function upgradeCommand(parsed, context) {
     }
     return selfUpgradeExitCode(value);
 }
-function versionedBinaryCheck(label, command, args, minimum, remedy) {
-    const result = spawnSync(command, args, { encoding: 'utf8' });
+const doctorProbeTimeoutMs = 15_000;
+async function versionedBinaryCheck(label, command, args, minimum, remedy, runner) {
+    const result = await runner.run({ executable: command, args }, { timeoutMs: doctorProbeTimeoutMs });
+    if (result.timedOut) {
+        return {
+            check: { label, severity: 'fail', detail: 'version probe timed out', remedy },
+            available: false
+        };
+    }
     if (result.status !== 0) {
-        return { label, severity: 'fail', detail: 'not found', remedy };
+        return {
+            check: { label, severity: 'fail', detail: 'not found', remedy },
+            available: result.errorCode !== 'ENOENT'
+        };
     }
     const output = (result.stdout || result.stderr).split('\n')[0].trim();
     const match = output.match(/(\d+)\.(\d+)/);
     if (!match) {
-        return { label, severity: 'fail', detail: `unable to determine version from "${output}"`, remedy };
+        return {
+            check: { label, severity: 'fail', detail: `unable to determine version from "${output}"`, remedy },
+            available: true
+        };
     }
     const found = [Number(match[1]), Number(match[2])];
     if (found[0] < minimum[0] || found[0] === minimum[0] && found[1] < minimum[1]) {
-        return { label, severity: 'fail', detail: `${output} is below ${minimum.join('.')}`, remedy };
+        return {
+            check: { label, severity: 'fail', detail: `${output} is below ${minimum.join('.')}`, remedy },
+            available: true
+        };
     }
-    return { label, severity: 'ok', detail: output };
+    return {
+        check: { label, severity: 'ok', detail: output },
+        available: true
+    };
 }
-function pythonRuntime() {
+async function pythonRuntime(runner) {
     const [major, minor] = (supportedStack.runtimes.python.minimumVersion ??
         supportedStack.runtimes.python.version).split('.');
     const minimum = [Number(major), Number(minor)];
@@ -2052,7 +2168,17 @@ function pythonRuntime() {
             { command: 'python3', versionArgs: ['--version'], commandArgs: [] },
             { command: 'python', versionArgs: ['--version'], commandArgs: [] }
         ];
-    return candidates.find((candidate) => versionedBinaryCheck('python', candidate.command, candidate.versionArgs, minimum, `install Python ${major}.${minor} or newer`).severity === 'ok') ?? candidates.find((candidate) => binaryPresent(candidate.command));
+    let available;
+    for (const candidate of candidates) {
+        const probe = await versionedBinaryCheck('python', candidate.command, candidate.versionArgs, minimum, `install Python ${major}.${minor} or newer`, runner);
+        if (probe.check.severity === 'ok') {
+            return candidate;
+        }
+        if (probe.available && !available) {
+            available = candidate;
+        }
+    }
+    return available;
 }
 function doctorCheckFromProbe(probe) {
     const severity = probe.state === 'ready'
@@ -2175,7 +2301,7 @@ async function frameworkDoctorChecks(projectRoot, manifest) {
         markers
     ];
 }
-function stackProjectCheck(projectRoot, apiStack) {
+async function stackProjectCheck(projectRoot, apiStack, runner) {
     const requiredMetadata = {
         'python-fastapi': ['backend/pyproject.toml', 'backend/uv.lock'],
         'node-fastify': ['backend/package.json', 'backend/package-lock.json'],
@@ -2208,23 +2334,31 @@ function stackProjectCheck(projectRoot, apiStack) {
     switch (apiStack) {
         case 'python-fastapi':
             {
-                const python = pythonRuntime();
+                const python = await pythonRuntime(runner);
                 if (!python) {
                     return { label: 'python project', severity: 'skipped', detail: 'python is unavailable' };
                 }
-                result = runReadOnly(python.command, [...python.commandArgs, '-c', 'from pathlib import Path; p=Path("backend/apis/main.py"); compile(p.read_text(), str(p), "exec")'], projectRoot);
+                result = await runReadOnly(python.command, [...python.commandArgs, '-c', 'from pathlib import Path; p=Path("backend/apis/main.py"); compile(p.read_text(), str(p), "exec")'], projectRoot, runner);
             }
             break;
         case 'node-fastify':
-            result = runReadOnly('node', ['-e', 'const f=require("fs"); JSON.parse(f.readFileSync("backend/package.json")); JSON.parse(f.readFileSync("backend/tsconfig.json"));'], projectRoot);
+            result = await runReadOnly('node', ['-e', 'const f=require("fs"); JSON.parse(f.readFileSync("backend/package.json")); JSON.parse(f.readFileSync("backend/tsconfig.json"));'], projectRoot, runner);
             break;
         case 'go-huma':
-            if (!binaryPresent('go')) {
+            result = await runReadOnly('go', ['mod', 'edit', '-json'], path.join(projectRoot, 'backend'), runner);
+            if (result.errorCode === 'ENOENT') {
                 return { label: 'go project', severity: 'skipped', detail: 'go is unavailable' };
             }
-            result = runReadOnly('go', ['mod', 'edit', '-json'], path.join(projectRoot, 'backend'));
             break;
     }
+    if (result.timedOut) {
+        return {
+            label: `${apiStack} project`,
+            severity: 'fail',
+            detail: 'stack validation timed out',
+            remedy: `repair the generated ${apiStack} backend configuration`
+        };
+    }
     if (result.status === 0) {
         return { label: `${apiStack} project`, severity: 'ok', detail: 'stack configuration is valid' };
     }
@@ -2255,13 +2389,12 @@ async function powerAppsProjectCheck(projectRoot) {
         remedy: 'repair the project-owned package.json and package-lock.json'
     };
 }
-function runReadOnly(command, args, cwd) {
-    const result = spawnSync(command, args, { cwd, encoding: 'utf8' });
-    return { status: result.status, stdout: result.stdout, stderr: result.stderr };
+function runReadOnly(command, args, cwd, runner) {
+    return runner.run({ executable: command, args }, { cwd, timeoutMs: doctorProbeTimeoutMs });
 }
-function binaryPresent(command) {
-    const probe = process.platform === 'win32' ? 'where' : 'which';
-    return spawnSync(probe, [command], { encoding: 'utf8' }).status === 0;
+async function binaryPresent(command, runner) {
+    const result = await runner.run({ executable: command, args: ['--version'] }, { timeoutMs: doctorProbeTimeoutMs });
+    return result.status === 0 && !result.timedOut;
 }
 async function azureCloudChecks(runner) {
     const auth = await runner.run({ executable: 'az', args: ['account', 'show', '-o', 'none', '--only-show-errors'] }, { timeoutMs: 15_000 });
@@ -2325,7 +2458,7 @@ async function cliLayer(releaseLookup, configuredRegistryLookup) {
     }
     return { title: 'CLI', checks };
 }
-async function projectLayer(projectRoot, manifest) {
+async function projectLayer(projectRoot, manifest, runner) {
     const checks = [];
     const issues = await validateGeneratedProject(projectRoot);
     if (issues.length > 0) {
@@ -2382,9 +2515,9 @@ async function projectLayer(projectRoot, manifest) {
                 ? `local ${manifest.governance.profile} policy ${manifest.governance.policyVersion} handoff is incomplete; one or more exact destinations remain outside Liftoff ownership`
                 : `local ${manifest.governance.profile} policy ${manifest.governance.policyVersion} handoff is intact; live enforcement is not inferred`);
         const remedy = governanceIssue
-            ? 'inspect with liftoff update --check; run liftoff update for safe repairs or use --force only after reviewing exact conflicts; neither activates GitHub governance'
+            ? 'inspect with liftoff update --check; run liftoff update for safe repairs or use --force only after reviewing exact already-managed conflicts; unowned destinations require manual resolution; neither activates GitHub governance'
             : partialHandoff
-                ? 'inspect liftoff update --check; use liftoff update --force only after reviewing each governance conflict'
+                ? 'inspect liftoff update --check; resolve unowned destinations manually; liftoff update --force may replace only already-managed conflicts or remove exact retired aliases after review'
                 : undefined;
         checks.push({
             id: 'repository-governance',
@@ -2409,7 +2542,7 @@ async function projectLayer(projectRoot, manifest) {
         checks.push(await powerAppsProjectCheck(projectRoot));
     }
     else {
-        checks.push(stackProjectCheck(projectRoot, manifest.project.workload.apiStack));
+        checks.push(await stackProjectCheck(projectRoot, manifest.project.workload.apiStack, runner));
     }
     try {
         const config = await loadConfigOptions('liftoff.config.json', projectRoot);
@@ -2572,11 +2705,7 @@ async function doctorCommand(parsed, context) {
             manifestError = error;
         }
     }
-    const releaseLookup = context.stableReleaseLookup ?? (() => lookupStableRelease({
-        registry: context.env?.LIFTOFF_REGISTRY ??
-            process.env.LIFTOFF_REGISTRY ??
-            canonicalNpmRegistry
-    }));
+    const releaseLookup = context.stableReleaseLookup ?? (() => lookupStableRelease({ registry: canonicalNpmRegistry }));
     const configuredRegistryLookup = context.configuredRegistryTargetLookup ??
         ((targetVersion) => checkConfiguredRegistryTarget(targetVersion, {
             runner,
@@ -2598,7 +2727,7 @@ async function doctorCommand(parsed, context) {
             });
         }
         if (manifest) {
-            layers.push(await projectLayer(projectRoot, manifest));
+            layers.push(await projectLayer(projectRoot, manifest, runner));
             layers.push(await runtimeLayer(projectRoot, dockerAvailable, runner, manifest));
             if (manifest.project.workload.kind === 'power-apps-code-app') {
                 if (manifest.project.workload.codeAppsPlugin) {
@@ -2613,7 +2742,8 @@ async function doctorCommand(parsed, context) {
                     ? patterns.find((candidate) => candidate.id === workload.pattern)
                     : undefined;
                 if (pattern?.worker && cloud === 'azure') {
-                    cloudChecks.checks.push(binaryPresent('func')
+                    const functionsAvailable = await binaryPresent('func', runner);
+                    cloudChecks.checks.push(functionsAvailable
                         ? { label: 'functions tooling', severity: 'ok', detail: 'Azure Functions Core Tools installed' }
                         : { label: 'functions tooling', severity: 'warn', detail: 'Azure Functions Core Tools not found', remedy: 'npm install -g azure-functions-core-tools@4' });
                 }
@@ -2637,6 +2767,7 @@ async function doctorCommand(parsed, context) {
 }
 async function helperCommand(parsed, context, tool) {
     const projectRoot = await findProjectRoot(context.cwd);
+    let infraProject;
     if (projectRoot) {
         const manifest = await loadManifest(projectRoot);
         if (manifest.project.workload.kind === 'power-apps-code-app') {
@@ -2652,8 +2783,14 @@ async function helperCommand(parsed, context, tool) {
             context.presentation.status('info', 'Not applicable', 'Power Apps code apps are hosted by Power Platform; Liftoff-managed OpenTofu infrastructure is not generated.');
             return 0;
         }
+        infraProject = {
+            root: projectRoot,
+            environments: manifest.project.workload.environments
+        };
     }
-    const command = parsed.command === 'dev' ? buildDevCommand(parsed) : buildInfraCommand(parsed);
+    const command = parsed.command === 'dev'
+        ? buildDevCommand(parsed)
+        : buildInfraCommand(parsed, infraProject);
     context.presentation.commandIdentity(parsed.command ?? tool, `${tool} helper command`);
     context.presentation.section(`${tool} helper command`, []);
     context.presentation.command(command);
@@ -2674,25 +2811,45 @@ function buildDevCommand(parsed) {
         }
     }
 }
-function buildInfraCommand(parsed) {
-    const env = readStringFlag(parsed.flags, 'env') ?? 'dev';
+function buildInfraCommand(parsed, project) {
+    const requestedEnvironment = readStringFlag(parsed.flags, 'env');
+    const env = requestedEnvironment ?? project?.environments[0] ?? 'dev';
     const environment = getEnvironment(env);
     if (!environment) {
         throw new PlanValidationError([
             `Unsupported environment: ${env}. Supported environments: dev, staging, prod.`
         ]);
     }
+    if (project &&
+        requestedEnvironment !== undefined &&
+        !project.environments.includes(environment.id)) {
+        throw new PlanValidationError([
+            `Environment ${environment.id} is not selected for this project. ` +
+                `Selected environments: ${project.environments.join(', ')}.`
+        ]);
+    }
+    const infrastructureRoot = project
+        ? path.join(project.root, 'infrastructure', 'opentofu', 'azure')
+            .split(path.sep)
+            .join('/')
+        : undefined;
+    const args = infrastructureRoot ? [`-chdir=${infrastructureRoot}`] : [];
     switch (parsed.subcommand) {
         case 'apply':
-            return `tofu apply -var-file=environments/${environment.id}.tfvars`;
+            args.push('apply', `-var-file=environments/${environment.id}.tfvars`);
+            break;
         case 'output':
-            return 'tofu output';
+            args.push('output');
+            break;
         case 'init':
-            return 'tofu init';
+            args.push('init');
+            break;
         case 'plan':
         default:
-            return `tofu plan -var-file=environments/${environment.id}.tfvars`;
+            args.push('plan', `-var-file=environments/${environment.id}.tfvars`);
+            break;
     }
+    return formatCommand({ executable: 'tofu', args });
 }
 async function optionsFromParsedArgs(parsed, cwd, includeProjectName) {
     const configPath = readStringFlag(parsed.flags, 'config');
@@ -2760,8 +2917,8 @@ function renderGeneralHelp(presentation) {
     }
     presentation.status('info', 'Tip', help.hint);
 }
-function renderCommandHelp(command, presentation) {
-    const help = getCommandHelp(command);
+function renderCommandHelp(command, presentation, subcommand) {
+    const help = getCommandHelp(command, subcommand);
     presentation.commandIdentity(help.command, help.description);
     presentation.section('Usage', [
         presentation.stdout.layout === 'plain' ? `Usage: ${help.usage}` : help.usage